193 files changed, 13831 insertions, 3539 deletions

diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index b0a71ecee682..e4804fb05e23 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -401,11 +401,13 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
          * driver reported one, then use it. Exit in any case.
          */
         if (gsi < 0) {
+                u32 dev_gsi;
                 dev_warn(&dev->dev, "PCI INT %c: no GSI", pin_name(pin));
                 /* Interrupt Line values above 0xF are forbidden */
-                if (dev->irq > 0 && (dev->irq <= 0xF)) {
-                        printk(" - using IRQ %d\n", dev->irq);
-                        acpi_register_gsi(&dev->dev, dev->irq,
+                if (dev->irq > 0 && (dev->irq <= 0xF) &&
+                    (acpi_isa_irq_to_gsi(dev->irq, &dev_gsi) == 0)) {
+                        printk(" - using ISA IRQ %d\n", dev->irq);
+                        acpi_register_gsi(&dev->dev, dev_gsi,
                                           ACPI_LEVEL_SENSITIVE,
                                           ACPI_ACTIVE_LOW);
                         return 0;
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 5939e7f7d8e9..c3817e1f32c7 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -698,7 +698,7 @@ static int acpi_processor_power_seq_show(struct seq_file *seq, void *offset)
                    "max_cstate:              C%d\n"
                    "maximum allowed latency: %d usec\n",
                    pr->power.state ? pr->power.state - pr->power.states : 0,
-                   max_cstate, pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY));
+                   max_cstate, pm_qos_request(PM_QOS_CPU_DMA_LATENCY));
 
         seq_puts(seq, "states:\n");
 
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index e2e992599e68..baa76bbf244a 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -475,101 +475,13 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
         },
         {
         .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
+        .ident = "Lenovo ThinkPad X201[s]",
         .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
                 DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
                 },
         },
         {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad T410",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad T510",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad W510",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad T410",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad T510",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad W510",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-                },
-        },
-        {
         .callback = init_old_suspend_ordering,
         .ident = "Panasonic CF51-2L",
         .matches = {
diff --git a/drivers/base/iommu.c b/drivers/base/iommu.c
index 8ad4ffea6920..6e6b6a11b3ce 100644
--- a/drivers/base/iommu.c
+++ b/drivers/base/iommu.c
@@ -80,20 +80,6 @@ void iommu_detach_device(struct iommu_domain *domain, struct device *dev)
 }
 EXPORT_SYMBOL_GPL(iommu_detach_device);
 
-int iommu_map_range(struct iommu_domain *domain, unsigned long iova,
-                    phys_addr_t paddr, size_t size, int prot)
-{
-        return iommu_ops->map(domain, iova, paddr, size, prot);
-}
-EXPORT_SYMBOL_GPL(iommu_map_range);
-
-void iommu_unmap_range(struct iommu_domain *domain, unsigned long iova,
-                      size_t size)
-{
-        iommu_ops->unmap(domain, iova, size);
-}
-EXPORT_SYMBOL_GPL(iommu_unmap_range);
-
 phys_addr_t iommu_iova_to_phys(struct iommu_domain *domain,
                                unsigned long iova)
 {
@@ -107,3 +93,32 @@ int iommu_domain_has_cap(struct iommu_domain *domain,
         return iommu_ops->domain_has_cap(domain, cap);
 }
 EXPORT_SYMBOL_GPL(iommu_domain_has_cap);
+
+int iommu_map(struct iommu_domain *domain, unsigned long iova,
+              phys_addr_t paddr, int gfp_order, int prot)
+{
+        unsigned long invalid_mask;
+        size_t size;
+
+        size         = 0x1000UL << gfp_order;
+        invalid_mask = size - 1;
+
+        BUG_ON((iova | paddr) & invalid_mask);
+
+        return iommu_ops->map(domain, iova, paddr, gfp_order, prot);
+}
+EXPORT_SYMBOL_GPL(iommu_map);
+
+int iommu_unmap(struct iommu_domain *domain, unsigned long iova, int gfp_order)
+{
+        unsigned long invalid_mask;
+        size_t size;
+
+        size         = 0x1000UL << gfp_order;
+        invalid_mask = size - 1;
+
+        BUG_ON(iova & invalid_mask);
+
+        return iommu_ops->unmap(domain, iova, gfp_order);
+}
+EXPORT_SYMBOL_GPL(iommu_unmap);
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 4b4b565c835f..ada6397c23a5 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -187,7 +187,7 @@ EXPORT_SYMBOL_GPL(platform_device_alloc);
  * released.
  */
 int platform_device_add_resources(struct platform_device *pdev,
-                                  struct resource *res, unsigned int num)
+                                  const struct resource *res, unsigned int num)
 {
         struct resource *r;
 
@@ -367,7 +367,7 @@ EXPORT_SYMBOL_GPL(platform_device_unregister);
  */
 struct platform_device *platform_device_register_simple(const char *name,
                                                         int id,
-                                                        struct resource *res,
+                                                        const struct resource *res,
                                                         unsigned int num)
 {
         struct platform_device *pdev;
@@ -967,17 +967,17 @@ static int platform_pm_restore_noirq(struct device *dev)
 
 int __weak platform_pm_runtime_suspend(struct device *dev)
 {
-        return -ENOSYS;
+        return pm_generic_runtime_suspend(dev);
 };
 
 int __weak platform_pm_runtime_resume(struct device *dev)
 {
-        return -ENOSYS;
+        return pm_generic_runtime_resume(dev);
 };
 
 int __weak platform_pm_runtime_idle(struct device *dev)
 {
-        return -ENOSYS;
+        return pm_generic_runtime_idle(dev);
 };
 
 #else /* !CONFIG_PM_RUNTIME */
@@ -1254,6 +1254,26 @@ static int __init early_platform_driver_probe_id(char *class_str,
                 }
 
                 if (match) {
+                        /*
+                         * Set up a sensible init_name to enable
+                         * dev_name() and others to be used before the
+                         * rest of the driver core is initialized.
+                         */
+                        if (!match->dev.init_name && slab_is_available()) {
+                                if (match->id != -1)
+                                        match->dev.init_name =
+                                                kasprintf(GFP_KERNEL, "%s.%d",
+                                                          match->name,
+                                                          match->id);
+                                else
+                                        match->dev.init_name =
+                                                kasprintf(GFP_KERNEL, "%s",
+                                                          match->name);
+
+                                if (!match->dev.init_name)
+                                        return -ENOMEM;
+                        }
+
                         if (epdrv->pdrv->probe(match))
                                 pr_warning("%s: unable to probe %s early.\n",
                                            class_str, match->name);
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 626dd147b75f..b0ec0e9f27e9 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -229,14 +229,16 @@ int __pm_runtime_suspend(struct device *dev, bool from_wq)
 
         if (retval) {
                 dev->power.runtime_status = RPM_ACTIVE;
-                pm_runtime_cancel_pending(dev);
-
                 if (retval == -EAGAIN || retval == -EBUSY) {
-                        notify = true;
+                        if (dev->power.timer_expires == 0)
+                                notify = true;
                         dev->power.runtime_error = 0;
+                } else {
+                        pm_runtime_cancel_pending(dev);
                 }
         } else {
                 dev->power.runtime_status = RPM_SUSPENDED;
+                pm_runtime_deactivate_timer(dev);
 
                 if (dev->parent) {
                         parent = dev->parent;
@@ -659,8 +661,6 @@ int pm_schedule_suspend(struct device *dev, unsigned int delay)
 
         if (dev->power.runtime_status == RPM_SUSPENDED)
                 retval = 1;
-        else if (dev->power.runtime_status == RPM_SUSPENDING)
-                retval = -EINPROGRESS;
         else if (atomic_read(&dev->power.usage_count) > 0
             || dev->power.disable_depth > 0)
                 retval = -EAGAIN;
diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c
index 86fd9373447e..a4c33bc51257 100644
--- a/drivers/base/power/sysfs.c
+++ b/drivers/base/power/sysfs.c
@@ -5,6 +5,7 @@
 #include <linux/device.h>
 #include <linux/string.h>
 #include <linux/pm_runtime.h>
+#include <asm/atomic.h>
 #include "power.h"
 
 /*
@@ -143,7 +144,59 @@ wake_store(struct device * dev, struct device_attribute *attr,
 
 static DEVICE_ATTR(wakeup, 0644, wake_show, wake_store);
 
-#ifdef CONFIG_PM_SLEEP_ADVANCED_DEBUG
+#ifdef CONFIG_PM_ADVANCED_DEBUG
+#ifdef CONFIG_PM_RUNTIME
+
+static ssize_t rtpm_usagecount_show(struct device *dev,
+                                    struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", atomic_read(&dev->power.usage_count));
+}
+
+static ssize_t rtpm_children_show(struct device *dev,
+                                  struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", dev->power.ignore_children ?
+                0 : atomic_read(&dev->power.child_count));
+}
+
+static ssize_t rtpm_enabled_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        if ((dev->power.disable_depth) && (dev->power.runtime_auto == false))
+                return sprintf(buf, "disabled & forbidden\n");
+        else if (dev->power.disable_depth)
+                return sprintf(buf, "disabled\n");
+        else if (dev->power.runtime_auto == false)
+                return sprintf(buf, "forbidden\n");
+        return sprintf(buf, "enabled\n");
+}
+
+static ssize_t rtpm_status_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        if (dev->power.runtime_error)
+                return sprintf(buf, "error\n");
+        switch (dev->power.runtime_status) {
+        case RPM_SUSPENDED:
+                return sprintf(buf, "suspended\n");
+        case RPM_SUSPENDING:
+                return sprintf(buf, "suspending\n");
+        case RPM_RESUMING:
+                return sprintf(buf, "resuming\n");
+        case RPM_ACTIVE:
+                return sprintf(buf, "active\n");
+        }
+        return -EIO;
+}
+
+static DEVICE_ATTR(runtime_usage, 0444, rtpm_usagecount_show, NULL);
+static DEVICE_ATTR(runtime_active_kids, 0444, rtpm_children_show, NULL);
+static DEVICE_ATTR(runtime_status, 0444, rtpm_status_show, NULL);
+static DEVICE_ATTR(runtime_enabled, 0444, rtpm_enabled_show, NULL);
+
+#endif
+
 static ssize_t async_show(struct device *dev, struct device_attribute *attr,
                           char *buf)
 {
@@ -170,15 +223,21 @@ static ssize_t async_store(struct device *dev, struct device_attribute *attr,
 }
 
 static DEVICE_ATTR(async, 0644, async_show, async_store);
-#endif /* CONFIG_PM_SLEEP_ADVANCED_DEBUG */
+#endif /* CONFIG_PM_ADVANCED_DEBUG */
 
 static struct attribute * power_attrs[] = {
 #ifdef CONFIG_PM_RUNTIME
         &dev_attr_control.attr,
 #endif
         &dev_attr_wakeup.attr,
-#ifdef CONFIG_PM_SLEEP_ADVANCED_DEBUG
+#ifdef CONFIG_PM_ADVANCED_DEBUG
         &dev_attr_async.attr,
+#ifdef CONFIG_PM_RUNTIME
+        &dev_attr_runtime_usage.attr,
+        &dev_attr_runtime_active_kids.attr,
+        &dev_attr_runtime_status.attr,
+        &dev_attr_runtime_enabled.attr,
+#endif
 #endif
         NULL,
 };
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index 0182a22c423a..832798aa14f6 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -66,6 +66,7 @@
 #include <linux/blkdev.h>
 #include <linux/elevator.h>
 #include <linux/interrupt.h>
+#include <linux/platform_device.h>
 
 #include <asm/setup.h>
 #include <asm/uaccess.h>
@@ -1696,34 +1697,18 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         return get_disk(unit[drive].gendisk);
 }
 
-static int __init amiga_floppy_init(void)
+static int __init amiga_floppy_probe(struct platform_device *pdev)
 {
         int i, ret;
 
-        if (!MACH_IS_AMIGA)
-                return -ENODEV;
-
-        if (!AMIGAHW_PRESENT(AMI_FLOPPY))
-                return -ENODEV;
-
         if (register_blkdev(FLOPPY_MAJOR,"fd"))
                 return -EBUSY;
 
-        /*
-         *  We request DSKPTR, DSKLEN and DSKDATA only, because the other
-         *  floppy registers are too spreaded over the custom register space
-         */
-        ret = -EBUSY;
-        if (!request_mem_region(CUSTOM_PHYSADDR+0x20, 8, "amiflop [Paula]")) {
-                printk("fd: cannot get floppy registers\n");
-                goto out_blkdev;
-        }
-
         ret = -ENOMEM;
         if ((raw_buf = (char *)amiga_chip_alloc (RAW_BUF_SIZE, "Floppy")) ==
             NULL) {
                 printk("fd: cannot get chip mem buffer\n");
-                goto out_memregion;
+                goto out_blkdev;
         }
 
         ret = -EBUSY;
@@ -1792,18 +1777,13 @@ out_irq2:
         free_irq(IRQ_AMIGA_DSKBLK, NULL);
 out_irq:
         amiga_chip_free(raw_buf);
-out_memregion:
-        release_mem_region(CUSTOM_PHYSADDR+0x20, 8);
 out_blkdev:
         unregister_blkdev(FLOPPY_MAJOR,"fd");
         return ret;
 }
 
-module_init(amiga_floppy_init);
-#ifdef MODULE
-
 #if 0 /* not safe to unload */
-void cleanup_module(void)
+static int __exit amiga_floppy_remove(struct platform_device *pdev)
 {
         int i;
 
@@ -1820,12 +1800,25 @@ void cleanup_module(void)
         custom.dmacon = DMAF_DISK; /* disable DMA */
         amiga_chip_free(raw_buf);
         blk_cleanup_queue(floppy_queue);
-        release_mem_region(CUSTOM_PHYSADDR+0x20, 8);
         unregister_blkdev(FLOPPY_MAJOR, "fd");
 }
 #endif
 
-#else
+static struct platform_driver amiga_floppy_driver = {
+        .driver   = {
+                .name   = "amiga-floppy",
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init amiga_floppy_init(void)
+{
+        return platform_driver_probe(&amiga_floppy_driver, amiga_floppy_probe);
+}
+
+module_init(amiga_floppy_init);
+
+#ifndef MODULE
 static int __init amiga_floppy_setup (char *str)
 {
         int n;
@@ -1840,3 +1833,5 @@ static int __init amiga_floppy_setup (char *str)
 
 __setup("floppy=", amiga_floppy_setup);
 #endif
+
+MODULE_ALIAS("platform:amiga-floppy");
diff --git a/drivers/block/hd.c b/drivers/block/hd.c
index 034e6dfc878c..81c78b3ce2df 100644
--- a/drivers/block/hd.c
+++ b/drivers/block/hd.c
@@ -164,12 +164,12 @@ unsigned long read_timer(void)
         unsigned long t, flags;
         int i;
 
-        spin_lock_irqsave(&i8253_lock, flags);
+        raw_spin_lock_irqsave(&i8253_lock, flags);
         t = jiffies * 11932;
         outb_p(0, 0x43);
         i = inb_p(0x40);
         i |= inb(0x40) << 8;
-        spin_unlock_irqrestore(&i8253_lock, flags);
+        raw_spin_unlock_irqrestore(&i8253_lock, flags);
         return(t - i);
 }
 #endif
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index fc8cf7ac7f2b..4cd8b227c11f 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -23,6 +23,7 @@
 #include <linux/seq_file.h>
 #include <linux/dmi.h>
 #include <linux/capability.h>
+#include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 
@@ -82,8 +83,7 @@ module_param(fan_mult, int, 0);
 MODULE_PARM_DESC(fan_mult, "Factor to multiply fan speed with");
 
 static int i8k_open_fs(struct inode *inode, struct file *file);
-static int i8k_ioctl(struct inode *, struct file *, unsigned int,
-                     unsigned long);
+static long i8k_ioctl(struct file *, unsigned int, unsigned long);
 
 static const struct file_operations i8k_fops = {
         .owner          = THIS_MODULE,
@@ -91,7 +91,7 @@ static const struct file_operations i8k_fops = {
         .read           = seq_read,
         .llseek         = seq_lseek,
         .release        = single_release,
-        .ioctl          = i8k_ioctl,
+        .unlocked_ioctl = i8k_ioctl,
 };
 
 struct smm_regs {
@@ -307,8 +307,8 @@ static int i8k_get_dell_signature(int req_fn)
         return regs.eax == 1145651527 && regs.edx == 1145392204 ? 0 : -1;
 }
 
-static int i8k_ioctl(struct inode *ip, struct file *fp, unsigned int cmd,
-                     unsigned long arg)
+static int
+i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
 {
         int val = 0;
         int speed;
@@ -395,6 +395,17 @@ static int i8k_ioctl(struct inode *ip, struct file *fp, unsigned int cmd,
         return 0;
 }
 
+static long i8k_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
+{
+        long ret;
+
+        lock_kernel();
+        ret = i8k_ioctl_unlocked(fp, cmd, arg);
+        unlock_kernel();
+
+        return ret;
+}
+
 /*
  * Print the information for /proc/i8k.
  */
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index 8dfd24721a82..78a62ebe75c7 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -627,7 +627,6 @@ static irqreturn_t cd2401_rx_interrupt(int irq, void *dev_id)
         char data;
         int char_count;
         int save_cnt;
-        int len;
 
         /* determine the channel and change to that context */
         channel = (u_short) (base_addr[CyLICR] >> 2);
@@ -1528,7 +1527,6 @@ static int
 cy_ioctl(struct tty_struct *tty, struct file *file,
          unsigned int cmd, unsigned long arg)
 {
-        unsigned long val;
         struct cyclades_port *info = tty->driver_data;
         int ret_val = 0;
         void __user *argp = (void __user *)arg;
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 59de2525d303..d4e8b213a462 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -289,7 +289,7 @@ static struct sysrq_key_op sysrq_showstate_blocked_op = {
 
 static void sysrq_ftrace_dump(int key, struct tty_struct *tty)
 {
-        ftrace_dump();
+        ftrace_dump(DUMP_ALL);
 }
 static struct sysrq_key_op sysrq_ftrace_dump_op = {
         .handler        = sysrq_ftrace_dump,
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index f5fc64f89c5c..4dc338f3d1aa 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -17,14 +17,16 @@ menuconfig TCG_TPM
           obtained at: <http://sourceforge.net/projects/trousers>.  To 
           compile this driver as a module, choose M here; the module 
           will be called tpm. If unsure, say N.
-          Note: For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
+          Notes:
+          1) For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
           and CONFIG_PNPACPI.
+          2) Without ACPI enabled, the BIOS event log won't be accessible,
+          which is required to validate the PCR 0-7 values.
 
 if TCG_TPM
 
 config TCG_TIS
         tristate "TPM Interface Specification 1.2 Interface"
-        depends on PNP
         ---help---
           If you have a TPM security chip that is compliant with the
           TCG TIS 1.2 TPM specification say Yes and it will be accessible
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 068c816e6942..05ad4a17a28f 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1068,6 +1068,27 @@ void tpm_remove_hardware(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(tpm_remove_hardware);
 
+#define TPM_ORD_SAVESTATE cpu_to_be32(152)
+#define SAVESTATE_RESULT_SIZE 10
+
+static struct tpm_input_header savestate_header = {
+        .tag = TPM_TAG_RQU_COMMAND,
+        .length = cpu_to_be32(10),
+        .ordinal = TPM_ORD_SAVESTATE
+};
+
+/* Bug workaround - some TPM's don't flush the most
+ * recently changed pcr on suspend, so force the flush
+ * with an extend to the selected _unused_ non-volatile pcr.
+ */
+static int tpm_suspend_pcr;
+static int __init tpm_suspend_setup(char *str)
+{
+        get_option(&str, &tpm_suspend_pcr);
+        return 1;
+}
+__setup("tpm_suspend_pcr=", tpm_suspend_setup);
+
 /*
  * We are about to suspend. Save the TPM state
  * so that it can be restored.
@@ -1075,17 +1096,29 @@ EXPORT_SYMBOL_GPL(tpm_remove_hardware);
 int tpm_pm_suspend(struct device *dev, pm_message_t pm_state)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
-        u8 savestate[] = {
-                0, 193,         /* TPM_TAG_RQU_COMMAND */
-                0, 0, 0, 10,    /* blob length (in bytes) */
-                0, 0, 0, 152    /* TPM_ORD_SaveState */
-        };
+        struct tpm_cmd_t cmd;
+        int rc;
+
+        u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 };
 
         if (chip == NULL)
                 return -ENODEV;
 
-        tpm_transmit(chip, savestate, sizeof(savestate));
-        return 0;
+        /* for buggy tpm, flush pcrs with extend to selected dummy */
+        if (tpm_suspend_pcr) {
+                cmd.header.in = pcrextend_header;
+                cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(tpm_suspend_pcr);
+                memcpy(cmd.params.pcrextend_in.hash, dummy_hash,
+                       TPM_DIGEST_SIZE);
+                rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
+                                  "extending dummy pcr before suspend");
+        }
+
+        /* now do the actual savestate */
+        cmd.header.in = savestate_header;
+        rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE,
+                          "sending savestate before suspend");
+        return rc;
 }
 EXPORT_SYMBOL_GPL(tpm_pm_suspend);
 
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 94345994f8a6..24314a9cffe8 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -598,7 +598,7 @@ out_err:
         tpm_remove_hardware(chip->dev);
         return rc;
 }
-
+#ifdef CONFIG_PNP
 static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
                                       const struct pnp_device_id *pnp_id)
 {
@@ -663,7 +663,7 @@ static struct pnp_driver tis_pnp_driver = {
 module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
                     sizeof(tpm_pnp_tbl[TIS_HID_USR_IDX].id), 0444);
 MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
-
+#endif
 static int tpm_tis_suspend(struct platform_device *dev, pm_message_t msg)
 {
         return tpm_pm_suspend(&dev->dev, msg);
@@ -690,21 +690,21 @@ MODULE_PARM_DESC(force, "Force device probe rather than using ACPI entry");
 static int __init init_tis(void)
 {
         int rc;
+#ifdef CONFIG_PNP
+        if (!force)
+                return pnp_register_driver(&tis_pnp_driver);
+#endif
 
-        if (force) {
-                rc = platform_driver_register(&tis_drv);
-                if (rc < 0)
-                        return rc;
-                if (IS_ERR(pdev=platform_device_register_simple("tpm_tis", -1, NULL, 0)))
-                        return PTR_ERR(pdev);
-                if((rc=tpm_tis_init(&pdev->dev, TIS_MEM_BASE, TIS_MEM_LEN, 0)) != 0) {
-                        platform_device_unregister(pdev);
-                        platform_driver_unregister(&tis_drv);
-                }
+        rc = platform_driver_register(&tis_drv);
+        if (rc < 0)
                 return rc;
+        if (IS_ERR(pdev=platform_device_register_simple("tpm_tis", -1, NULL, 0)))
+                return PTR_ERR(pdev);
+        if((rc=tpm_tis_init(&pdev->dev, TIS_MEM_BASE, TIS_MEM_LEN, 0)) != 0) {
+                platform_device_unregister(pdev);
+                platform_driver_unregister(&tis_drv);
         }
-
-        return pnp_register_driver(&tis_pnp_driver);
+        return rc;
 }
 
 static void __exit cleanup_tis(void)
@@ -728,12 +728,14 @@ static void __exit cleanup_tis(void)
                 list_del(&i->list);
         }
         spin_unlock(&tis_lock);
-
-        if (force) {
-                platform_device_unregister(pdev);
-                platform_driver_unregister(&tis_drv);
-        } else
+#ifdef CONFIG_PNP
+        if (!force) {
                 pnp_unregister_driver(&tis_pnp_driver);
+                return;
+        }
+#endif
+        platform_device_unregister(pdev);
+        platform_driver_unregister(&tis_drv);
 }
 
 module_init(init_tis);
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 6da962c9b21c..d71f0fc34b46 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1875,6 +1875,7 @@ got_driver:
                  */
                 if (filp->f_op == &hung_up_tty_fops)
                         filp->f_op = &tty_fops;
+                unlock_kernel();
                 goto retry_open;
         }
         unlock_kernel();
diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
index b314a999aabe..d7be69f13154 100644
--- a/drivers/clocksource/cs5535-clockevt.c
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -154,14 +154,14 @@ static int __init cs5535_mfgpt_init(void)
         if (cs5535_mfgpt_setup_irq(timer, MFGPT_CMP2, &timer_irq)) {
                 printk(KERN_ERR DRV_NAME ": Could not set up IRQ %d\n",
                                 timer_irq);
-                return -EIO;
+                goto err_timer;
         }
 
         /* And register it with the kernel */
         ret = setup_irq(timer_irq, &mfgptirq);
         if (ret) {
                 printk(KERN_ERR DRV_NAME ": Unable to set up the interrupt.\n");
-                goto err;
+                goto err_irq;
         }
 
         /* Set the clock scale and enable the event mode for CMP2 */
@@ -184,8 +184,10 @@ static int __init cs5535_mfgpt_init(void)
 
         return 0;
 
-err:
+err_irq:
         cs5535_mfgpt_release_irq(cs5535_event_clock, MFGPT_CMP2, &timer_irq);
+err_timer:
+        cs5535_mfgpt_free_timer(cs5535_event_clock);
         printk(KERN_ERR DRV_NAME ": Unable to set up the MFGPT clock source\n");
         return -EIO;
 }
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 744f748cc84b..f6677cb19789 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -150,13 +150,12 @@ static void sh_cmt_start_stop_ch(struct sh_cmt_priv *p, int start)
 
 static int sh_cmt_enable(struct sh_cmt_priv *p, unsigned long *rate)
 {
-        struct sh_timer_config *cfg = p->pdev->dev.platform_data;
         int ret;
 
         /* enable clock */
         ret = clk_enable(p->clk);
         if (ret) {
-                pr_err("sh_cmt: cannot enable clock \"%s\"\n", cfg->clk);
+                dev_err(&p->pdev->dev, "cannot enable clock\n");
                 return ret;
         }
 
@@ -279,7 +278,7 @@ static void sh_cmt_clock_event_program_verify(struct sh_cmt_priv *p,
                         delay = 1;
 
                 if (!delay)
-                        pr_warning("sh_cmt: too long delay\n");
+                        dev_warn(&p->pdev->dev, "too long delay\n");
 
         } while (delay);
 }
@@ -289,7 +288,7 @@ static void sh_cmt_set_next(struct sh_cmt_priv *p, unsigned long delta)
         unsigned long flags;
 
         if (delta > p->max_match_value)
-                pr_warning("sh_cmt: delta out of range\n");
+                dev_warn(&p->pdev->dev, "delta out of range\n");
 
         spin_lock_irqsave(&p->lock, flags);
         p->next_match_value = delta;
@@ -451,7 +450,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_priv *p,
         cs->resume = sh_cmt_clocksource_resume;
         cs->mask = CLOCKSOURCE_MASK(sizeof(unsigned long) * 8);
         cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
-        pr_info("sh_cmt: %s used as clock source\n", cs->name);
+        dev_info(&p->pdev->dev, "used as clock source\n");
         clocksource_register(cs);
         return 0;
 }
@@ -497,13 +496,11 @@ static void sh_cmt_clock_event_mode(enum clock_event_mode mode,
 
         switch (mode) {
         case CLOCK_EVT_MODE_PERIODIC:
-                pr_info("sh_cmt: %s used for periodic clock events\n",
-                        ced->name);
+                dev_info(&p->pdev->dev, "used for periodic clock events\n");
                 sh_cmt_clock_event_start(p, 1);
                 break;
         case CLOCK_EVT_MODE_ONESHOT:
-                pr_info("sh_cmt: %s used for oneshot clock events\n",
-                        ced->name);
+                dev_info(&p->pdev->dev, "used for oneshot clock events\n");
                 sh_cmt_clock_event_start(p, 0);
                 break;
         case CLOCK_EVT_MODE_SHUTDOWN:
@@ -544,7 +541,7 @@ static void sh_cmt_register_clockevent(struct sh_cmt_priv *p,
         ced->set_next_event = sh_cmt_clock_event_next;
         ced->set_mode = sh_cmt_clock_event_mode;
 
-        pr_info("sh_cmt: %s used for clock events\n", ced->name);
+        dev_info(&p->pdev->dev, "used for clock events\n");
         clockevents_register_device(ced);
 }
 
@@ -601,22 +598,27 @@ static int sh_cmt_setup(struct sh_cmt_priv *p, struct platform_device *pdev)
         /* map memory, let mapbase point to our channel */
         p->mapbase = ioremap_nocache(res->start, resource_size(res));
         if (p->mapbase == NULL) {
-                pr_err("sh_cmt: failed to remap I/O memory\n");
+                dev_err(&p->pdev->dev, "failed to remap I/O memory\n");
                 goto err0;
         }
 
         /* request irq using setup_irq() (too early for request_irq()) */
-        p->irqaction.name = cfg->name;
+        p->irqaction.name = dev_name(&p->pdev->dev);
         p->irqaction.handler = sh_cmt_interrupt;
         p->irqaction.dev_id = p;
-        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL;
+        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | \
+                             IRQF_IRQPOLL  | IRQF_NOBALANCING;
 
         /* get hold of clock */
-        p->clk = clk_get(&p->pdev->dev, cfg->clk);
+        p->clk = clk_get(&p->pdev->dev, "cmt_fck");
         if (IS_ERR(p->clk)) {
-                pr_err("sh_cmt: cannot get clock \"%s\"\n", cfg->clk);
-                ret = PTR_ERR(p->clk);
-                goto err1;
+                dev_warn(&p->pdev->dev, "using deprecated clock lookup\n");
+                p->clk = clk_get(&p->pdev->dev, cfg->clk);
+                if (IS_ERR(p->clk)) {
+                        dev_err(&p->pdev->dev, "cannot get clock\n");
+                        ret = PTR_ERR(p->clk);
+                        goto err1;
+                }
         }
 
         if (resource_size(res) == 6) {
@@ -629,17 +631,17 @@ static int sh_cmt_setup(struct sh_cmt_priv *p, struct platform_device *pdev)
                 p->clear_bits = ~0xc000;
         }
 
-        ret = sh_cmt_register(p, cfg->name,
+        ret = sh_cmt_register(p, (char *)dev_name(&p->pdev->dev),
                               cfg->clockevent_rating,
                               cfg->clocksource_rating);
         if (ret) {
-                pr_err("sh_cmt: registration failed\n");
+                dev_err(&p->pdev->dev, "registration failed\n");
                 goto err1;
         }
 
         ret = setup_irq(irq, &p->irqaction);
         if (ret) {
-                pr_err("sh_cmt: failed to request irq %d\n", irq);
+                dev_err(&p->pdev->dev, "failed to request irq %d\n", irq);
                 goto err1;
         }
 
@@ -654,11 +656,10 @@ err0:
 static int __devinit sh_cmt_probe(struct platform_device *pdev)
 {
         struct sh_cmt_priv *p = platform_get_drvdata(pdev);
-        struct sh_timer_config *cfg = pdev->dev.platform_data;
         int ret;
 
         if (p) {
-                pr_info("sh_cmt: %s kept as earlytimer\n", cfg->name);
+                dev_info(&pdev->dev, "kept as earlytimer\n");
                 return 0;
         }
 
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 5fb78bfd73bb..ef7a5be8a09f 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -119,13 +119,12 @@ static void sh_mtu2_start_stop_ch(struct sh_mtu2_priv *p, int start)
 
 static int sh_mtu2_enable(struct sh_mtu2_priv *p)
 {
-        struct sh_timer_config *cfg = p->pdev->dev.platform_data;
         int ret;
 
         /* enable clock */
         ret = clk_enable(p->clk);
         if (ret) {
-                pr_err("sh_mtu2: cannot enable clock \"%s\"\n", cfg->clk);
+                dev_err(&p->pdev->dev, "cannot enable clock\n");
                 return ret;
         }
 
@@ -194,8 +193,7 @@ static void sh_mtu2_clock_event_mode(enum clock_event_mode mode,
 
         switch (mode) {
         case CLOCK_EVT_MODE_PERIODIC:
-                pr_info("sh_mtu2: %s used for periodic clock events\n",
-                        ced->name);
+                dev_info(&p->pdev->dev, "used for periodic clock events\n");
                 sh_mtu2_enable(p);
                 break;
         case CLOCK_EVT_MODE_UNUSED:
@@ -222,13 +220,13 @@ static void sh_mtu2_register_clockevent(struct sh_mtu2_priv *p,
         ced->cpumask = cpumask_of(0);
         ced->set_mode = sh_mtu2_clock_event_mode;
 
-        pr_info("sh_mtu2: %s used for clock events\n", ced->name);
+        dev_info(&p->pdev->dev, "used for clock events\n");
         clockevents_register_device(ced);
 
         ret = setup_irq(p->irqaction.irq, &p->irqaction);
         if (ret) {
-                pr_err("sh_mtu2: failed to request irq %d\n",
-                       p->irqaction.irq);
+                dev_err(&p->pdev->dev, "failed to request irq %d\n",
+                        p->irqaction.irq);
                 return;
         }
 }
@@ -274,26 +272,32 @@ static int sh_mtu2_setup(struct sh_mtu2_priv *p, struct platform_device *pdev)
         /* map memory, let mapbase point to our channel */
         p->mapbase = ioremap_nocache(res->start, resource_size(res));
         if (p->mapbase == NULL) {
-                pr_err("sh_mtu2: failed to remap I/O memory\n");
+                dev_err(&p->pdev->dev, "failed to remap I/O memory\n");
                 goto err0;
         }
 
         /* setup data for setup_irq() (too early for request_irq()) */
-        p->irqaction.name = cfg->name;
+        p->irqaction.name = dev_name(&p->pdev->dev);
         p->irqaction.handler = sh_mtu2_interrupt;
         p->irqaction.dev_id = p;
         p->irqaction.irq = irq;
-        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL;
+        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | \
+                             IRQF_IRQPOLL  | IRQF_NOBALANCING;
 
         /* get hold of clock */
-        p->clk = clk_get(&p->pdev->dev, cfg->clk);
+        p->clk = clk_get(&p->pdev->dev, "mtu2_fck");
         if (IS_ERR(p->clk)) {
-                pr_err("sh_mtu2: cannot get clock \"%s\"\n", cfg->clk);
-                ret = PTR_ERR(p->clk);
-                goto err1;
+                dev_warn(&p->pdev->dev, "using deprecated clock lookup\n");
+                p->clk = clk_get(&p->pdev->dev, cfg->clk);
+                if (IS_ERR(p->clk)) {
+                        dev_err(&p->pdev->dev, "cannot get clock\n");
+                        ret = PTR_ERR(p->clk);
+                        goto err1;
+                }
         }
 
-        return sh_mtu2_register(p, cfg->name, cfg->clockevent_rating);
+        return sh_mtu2_register(p, (char *)dev_name(&p->pdev->dev),
+                                cfg->clockevent_rating);
  err1:
         iounmap(p->mapbase);
  err0:
@@ -303,11 +307,10 @@ static int sh_mtu2_setup(struct sh_mtu2_priv *p, struct platform_device *pdev)
 static int __devinit sh_mtu2_probe(struct platform_device *pdev)
 {
         struct sh_mtu2_priv *p = platform_get_drvdata(pdev);
-        struct sh_timer_config *cfg = pdev->dev.platform_data;
         int ret;
 
         if (p) {
-                pr_info("sh_mtu2: %s kept as earlytimer\n", cfg->name);
+                dev_info(&pdev->dev, "kept as earlytimer\n");
                 return 0;
         }
 
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index fc9ff1e5b770..8e44e14ec4c2 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -107,13 +107,12 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_priv *p, int start)
 
 static int sh_tmu_enable(struct sh_tmu_priv *p)
 {
-        struct sh_timer_config *cfg = p->pdev->dev.platform_data;
         int ret;
 
         /* enable clock */
         ret = clk_enable(p->clk);
         if (ret) {
-                pr_err("sh_tmu: cannot enable clock \"%s\"\n", cfg->clk);
+                dev_err(&p->pdev->dev, "cannot enable clock\n");
                 return ret;
         }
 
@@ -229,7 +228,7 @@ static int sh_tmu_register_clocksource(struct sh_tmu_priv *p,
         cs->disable = sh_tmu_clocksource_disable;
         cs->mask = CLOCKSOURCE_MASK(32);
         cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
-        pr_info("sh_tmu: %s used as clock source\n", cs->name);
+        dev_info(&p->pdev->dev, "used as clock source\n");
         clocksource_register(cs);
         return 0;
 }
@@ -277,13 +276,11 @@ static void sh_tmu_clock_event_mode(enum clock_event_mode mode,
 
         switch (mode) {
         case CLOCK_EVT_MODE_PERIODIC:
-                pr_info("sh_tmu: %s used for periodic clock events\n",
-                        ced->name);
+                dev_info(&p->pdev->dev, "used for periodic clock events\n");
                 sh_tmu_clock_event_start(p, 1);
                 break;
         case CLOCK_EVT_MODE_ONESHOT:
-                pr_info("sh_tmu: %s used for oneshot clock events\n",
-                        ced->name);
+                dev_info(&p->pdev->dev, "used for oneshot clock events\n");
                 sh_tmu_clock_event_start(p, 0);
                 break;
         case CLOCK_EVT_MODE_UNUSED:
@@ -324,13 +321,13 @@ static void sh_tmu_register_clockevent(struct sh_tmu_priv *p,
         ced->set_next_event = sh_tmu_clock_event_next;
         ced->set_mode = sh_tmu_clock_event_mode;
 
-        pr_info("sh_tmu: %s used for clock events\n", ced->name);
+        dev_info(&p->pdev->dev, "used for clock events\n");
         clockevents_register_device(ced);
 
         ret = setup_irq(p->irqaction.irq, &p->irqaction);
         if (ret) {
-                pr_err("sh_tmu: failed to request irq %d\n",
-                       p->irqaction.irq);
+                dev_err(&p->pdev->dev, "failed to request irq %d\n",
+                        p->irqaction.irq);
                 return;
         }
 }
@@ -379,26 +376,31 @@ static int sh_tmu_setup(struct sh_tmu_priv *p, struct platform_device *pdev)
         /* map memory, let mapbase point to our channel */
         p->mapbase = ioremap_nocache(res->start, resource_size(res));
         if (p->mapbase == NULL) {
-                pr_err("sh_tmu: failed to remap I/O memory\n");
+                dev_err(&p->pdev->dev, "failed to remap I/O memory\n");
                 goto err0;
         }
 
         /* setup data for setup_irq() (too early for request_irq()) */
-        p->irqaction.name = cfg->name;
+        p->irqaction.name = dev_name(&p->pdev->dev);
         p->irqaction.handler = sh_tmu_interrupt;
         p->irqaction.dev_id = p;
         p->irqaction.irq = irq;
-        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL;
+        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | \
+                             IRQF_IRQPOLL  | IRQF_NOBALANCING;
 
         /* get hold of clock */
-        p->clk = clk_get(&p->pdev->dev, cfg->clk);
+        p->clk = clk_get(&p->pdev->dev, "tmu_fck");
         if (IS_ERR(p->clk)) {
-                pr_err("sh_tmu: cannot get clock \"%s\"\n", cfg->clk);
-                ret = PTR_ERR(p->clk);
-                goto err1;
+                dev_warn(&p->pdev->dev, "using deprecated clock lookup\n");
+                p->clk = clk_get(&p->pdev->dev, cfg->clk);
+                if (IS_ERR(p->clk)) {
+                        dev_err(&p->pdev->dev, "cannot get clock\n");
+                        ret = PTR_ERR(p->clk);
+                        goto err1;
+                }
         }
 
-        return sh_tmu_register(p, cfg->name,
+        return sh_tmu_register(p, (char *)dev_name(&p->pdev->dev),
                                cfg->clockevent_rating,
                                cfg->clocksource_rating);
  err1:
@@ -410,11 +412,10 @@ static int sh_tmu_setup(struct sh_tmu_priv *p, struct platform_device *pdev)
 static int __devinit sh_tmu_probe(struct platform_device *pdev)
 {
         struct sh_tmu_priv *p = platform_get_drvdata(pdev);
-        struct sh_timer_config *cfg = pdev->dev.platform_data;
         int ret;
 
         if (p) {
-                pr_info("sh_tmu: %s kept as earlytimer\n", cfg->name);
+                dev_info(&pdev->dev, "kept as earlytimer\n");
                 return 0;
         }
 
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 75d293eeb3ee..063b2184caf5 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -662,32 +662,20 @@ static ssize_t show_bios_limit(struct cpufreq_policy *policy, char *buf)
         return sprintf(buf, "%u\n", policy->cpuinfo.max_freq);
 }
 
-#define define_one_ro(_name) \
-static struct freq_attr _name = \
-__ATTR(_name, 0444, show_##_name, NULL)
-
-#define define_one_ro0400(_name) \
-static struct freq_attr _name = \
-__ATTR(_name, 0400, show_##_name, NULL)
-
-#define define_one_rw(_name) \
-static struct freq_attr _name = \
-__ATTR(_name, 0644, show_##_name, store_##_name)
-
-define_one_ro0400(cpuinfo_cur_freq);
-define_one_ro(cpuinfo_min_freq);
-define_one_ro(cpuinfo_max_freq);
-define_one_ro(cpuinfo_transition_latency);
-define_one_ro(scaling_available_governors);
-define_one_ro(scaling_driver);
-define_one_ro(scaling_cur_freq);
-define_one_ro(bios_limit);
-define_one_ro(related_cpus);
-define_one_ro(affected_cpus);
-define_one_rw(scaling_min_freq);
-define_one_rw(scaling_max_freq);
-define_one_rw(scaling_governor);
-define_one_rw(scaling_setspeed);
+cpufreq_freq_attr_ro_perm(cpuinfo_cur_freq, 0400);
+cpufreq_freq_attr_ro(cpuinfo_min_freq);
+cpufreq_freq_attr_ro(cpuinfo_max_freq);
+cpufreq_freq_attr_ro(cpuinfo_transition_latency);
+cpufreq_freq_attr_ro(scaling_available_governors);
+cpufreq_freq_attr_ro(scaling_driver);
+cpufreq_freq_attr_ro(scaling_cur_freq);
+cpufreq_freq_attr_ro(bios_limit);
+cpufreq_freq_attr_ro(related_cpus);
+cpufreq_freq_attr_ro(affected_cpus);
+cpufreq_freq_attr_rw(scaling_min_freq);
+cpufreq_freq_attr_rw(scaling_max_freq);
+cpufreq_freq_attr_rw(scaling_governor);
+cpufreq_freq_attr_rw(scaling_setspeed);
 
 static struct attribute *default_attrs[] = {
         &cpuinfo_min_freq.attr,
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 3a147874a465..526bfbf69611 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -178,12 +178,8 @@ static ssize_t show_sampling_rate_min(struct kobject *kobj,
         return sprintf(buf, "%u\n", min_sampling_rate);
 }
 
-#define define_one_ro(_name)            \
-static struct global_attr _name =       \
-__ATTR(_name, 0444, show_##_name, NULL)
-
-define_one_ro(sampling_rate_max);
-define_one_ro(sampling_rate_min);
+define_one_global_ro(sampling_rate_max);
+define_one_global_ro(sampling_rate_min);
 
 /* cpufreq_conservative Governor Tunables */
 #define show_one(file_name, object)                                     \
@@ -221,12 +217,8 @@ show_one_old(freq_step);
 show_one_old(sampling_rate_min);
 show_one_old(sampling_rate_max);
 
-#define define_one_ro_old(object, _name)        \
-static struct freq_attr object =                \
-__ATTR(_name, 0444, show_##_name##_old, NULL)
-
-define_one_ro_old(sampling_rate_min_old, sampling_rate_min);
-define_one_ro_old(sampling_rate_max_old, sampling_rate_max);
+cpufreq_freq_attr_ro_old(sampling_rate_min);
+cpufreq_freq_attr_ro_old(sampling_rate_max);
 
 /*** delete after deprecation time ***/
 
@@ -364,16 +356,12 @@ static ssize_t store_freq_step(struct kobject *a, struct attribute *b,
         return count;
 }
 
-#define define_one_rw(_name) \
-static struct global_attr _name = \
-__ATTR(_name, 0644, show_##_name, store_##_name)
-
-define_one_rw(sampling_rate);
-define_one_rw(sampling_down_factor);
-define_one_rw(up_threshold);
-define_one_rw(down_threshold);
-define_one_rw(ignore_nice_load);
-define_one_rw(freq_step);
+define_one_global_rw(sampling_rate);
+define_one_global_rw(sampling_down_factor);
+define_one_global_rw(up_threshold);
+define_one_global_rw(down_threshold);
+define_one_global_rw(ignore_nice_load);
+define_one_global_rw(freq_step);
 
 static struct attribute *dbs_attributes[] = {
         &sampling_rate_max.attr,
@@ -409,16 +397,12 @@ write_one_old(down_threshold);
 write_one_old(ignore_nice_load);
 write_one_old(freq_step);
 
-#define define_one_rw_old(object, _name)        \
-static struct freq_attr object =                \
-__ATTR(_name, 0644, show_##_name##_old, store_##_name##_old)
-
-define_one_rw_old(sampling_rate_old, sampling_rate);
-define_one_rw_old(sampling_down_factor_old, sampling_down_factor);
-define_one_rw_old(up_threshold_old, up_threshold);
-define_one_rw_old(down_threshold_old, down_threshold);
-define_one_rw_old(ignore_nice_load_old, ignore_nice_load);
-define_one_rw_old(freq_step_old, freq_step);
+cpufreq_freq_attr_rw_old(sampling_rate);
+cpufreq_freq_attr_rw_old(sampling_down_factor);
+cpufreq_freq_attr_rw_old(up_threshold);
+cpufreq_freq_attr_rw_old(down_threshold);
+cpufreq_freq_attr_rw_old(ignore_nice_load);
+cpufreq_freq_attr_rw_old(freq_step);
 
 static struct attribute *dbs_attributes_old[] = {
         &sampling_rate_max_old.attr,
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index bd444dc93cf2..e1314212d8d4 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -73,6 +73,7 @@ enum {DBS_NORMAL_SAMPLE, DBS_SUB_SAMPLE};
 
 struct cpu_dbs_info_s {
         cputime64_t prev_cpu_idle;
+        cputime64_t prev_cpu_iowait;
         cputime64_t prev_cpu_wall;
         cputime64_t prev_cpu_nice;
         struct cpufreq_policy *cur_policy;
@@ -108,6 +109,7 @@ static struct dbs_tuners {
         unsigned int down_differential;
         unsigned int ignore_nice;
         unsigned int powersave_bias;
+        unsigned int io_is_busy;
 } dbs_tuners_ins = {
         .up_threshold = DEF_FREQUENCY_UP_THRESHOLD,
         .down_differential = DEF_FREQUENCY_DOWN_DIFFERENTIAL,
@@ -148,6 +150,16 @@ static inline cputime64_t get_cpu_idle_time(unsigned int cpu, cputime64_t *wall)
         return idle_time;
 }
 
+static inline cputime64_t get_cpu_iowait_time(unsigned int cpu, cputime64_t *wall)
+{
+        u64 iowait_time = get_cpu_iowait_time_us(cpu, wall);
+
+        if (iowait_time == -1ULL)
+                return 0;
+
+        return iowait_time;
+}
+
 /*
  * Find right freq to be set now with powersave_bias on.
  * Returns the freq_hi to be used right now and will set freq_hi_jiffies,
@@ -234,12 +246,8 @@ static ssize_t show_sampling_rate_min(struct kobject *kobj,
         return sprintf(buf, "%u\n", min_sampling_rate);
 }
 
-#define define_one_ro(_name)            \
-static struct global_attr _name =       \
-__ATTR(_name, 0444, show_##_name, NULL)
-
-define_one_ro(sampling_rate_max);
-define_one_ro(sampling_rate_min);
+define_one_global_ro(sampling_rate_max);
+define_one_global_ro(sampling_rate_min);
 
 /* cpufreq_ondemand Governor Tunables */
 #define show_one(file_name, object)                                     \
@@ -249,6 +257,7 @@ static ssize_t show_##file_name						\
         return sprintf(buf, "%u\n", dbs_tuners_ins.object);             \
 }
 show_one(sampling_rate, sampling_rate);
+show_one(io_is_busy, io_is_busy);
 show_one(up_threshold, up_threshold);
 show_one(ignore_nice_load, ignore_nice);
 show_one(powersave_bias, powersave_bias);
@@ -274,12 +283,8 @@ show_one_old(powersave_bias);
 show_one_old(sampling_rate_min);
 show_one_old(sampling_rate_max);
 
-#define define_one_ro_old(object, _name)       \
-static struct freq_attr object =               \
-__ATTR(_name, 0444, show_##_name##_old, NULL)
-
-define_one_ro_old(sampling_rate_min_old, sampling_rate_min);
-define_one_ro_old(sampling_rate_max_old, sampling_rate_max);
+cpufreq_freq_attr_ro_old(sampling_rate_min);
+cpufreq_freq_attr_ro_old(sampling_rate_max);
 
 /*** delete after deprecation time ***/
 
@@ -299,6 +304,23 @@ static ssize_t store_sampling_rate(struct kobject *a, struct attribute *b,
         return count;
 }
 
+static ssize_t store_io_is_busy(struct kobject *a, struct attribute *b,
+                                   const char *buf, size_t count)
+{
+        unsigned int input;
+        int ret;
+
+        ret = sscanf(buf, "%u", &input);
+        if (ret != 1)
+                return -EINVAL;
+
+        mutex_lock(&dbs_mutex);
+        dbs_tuners_ins.io_is_busy = !!input;
+        mutex_unlock(&dbs_mutex);
+
+        return count;
+}
+
 static ssize_t store_up_threshold(struct kobject *a, struct attribute *b,
                                   const char *buf, size_t count)
 {
@@ -376,14 +398,11 @@ static ssize_t store_powersave_bias(struct kobject *a, struct attribute *b,
         return count;
 }
 
-#define define_one_rw(_name) \
-static struct global_attr _name = \
-__ATTR(_name, 0644, show_##_name, store_##_name)
-
-define_one_rw(sampling_rate);
-define_one_rw(up_threshold);
-define_one_rw(ignore_nice_load);
-define_one_rw(powersave_bias);
+define_one_global_rw(sampling_rate);
+define_one_global_rw(io_is_busy);
+define_one_global_rw(up_threshold);
+define_one_global_rw(ignore_nice_load);
+define_one_global_rw(powersave_bias);
 
 static struct attribute *dbs_attributes[] = {
         &sampling_rate_max.attr,
@@ -392,6 +411,7 @@ static struct attribute *dbs_attributes[] = {
         &up_threshold.attr,
         &ignore_nice_load.attr,
         &powersave_bias.attr,
+        &io_is_busy.attr,
         NULL
 };
 
@@ -415,14 +435,10 @@ write_one_old(up_threshold);
 write_one_old(ignore_nice_load);
 write_one_old(powersave_bias);
 
-#define define_one_rw_old(object, _name)       \
-static struct freq_attr object =               \
-__ATTR(_name, 0644, show_##_name##_old, store_##_name##_old)
-
-define_one_rw_old(sampling_rate_old, sampling_rate);
-define_one_rw_old(up_threshold_old, up_threshold);
-define_one_rw_old(ignore_nice_load_old, ignore_nice_load);
-define_one_rw_old(powersave_bias_old, powersave_bias);
+cpufreq_freq_attr_rw_old(sampling_rate);
+cpufreq_freq_attr_rw_old(up_threshold);
+cpufreq_freq_attr_rw_old(ignore_nice_load);
+cpufreq_freq_attr_rw_old(powersave_bias);
 
 static struct attribute *dbs_attributes_old[] = {
        &sampling_rate_max_old.attr,
@@ -470,14 +486,15 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
 
         for_each_cpu(j, policy->cpus) {
                 struct cpu_dbs_info_s *j_dbs_info;
-                cputime64_t cur_wall_time, cur_idle_time;
-                unsigned int idle_time, wall_time;
+                cputime64_t cur_wall_time, cur_idle_time, cur_iowait_time;
+                unsigned int idle_time, wall_time, iowait_time;
                 unsigned int load, load_freq;
                 int freq_avg;
 
                 j_dbs_info = &per_cpu(od_cpu_dbs_info, j);
 
                 cur_idle_time = get_cpu_idle_time(j, &cur_wall_time);
+                cur_iowait_time = get_cpu_iowait_time(j, &cur_wall_time);
 
                 wall_time = (unsigned int) cputime64_sub(cur_wall_time,
                                 j_dbs_info->prev_cpu_wall);
@@ -487,6 +504,10 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                                 j_dbs_info->prev_cpu_idle);
                 j_dbs_info->prev_cpu_idle = cur_idle_time;
 
+                iowait_time = (unsigned int) cputime64_sub(cur_iowait_time,
+                                j_dbs_info->prev_cpu_iowait);
+                j_dbs_info->prev_cpu_iowait = cur_iowait_time;
+
                 if (dbs_tuners_ins.ignore_nice) {
                         cputime64_t cur_nice;
                         unsigned long cur_nice_jiffies;
@@ -504,6 +525,16 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                         idle_time += jiffies_to_usecs(cur_nice_jiffies);
                 }
 
+                /*
+                 * For the purpose of ondemand, waiting for disk IO is an
+                 * indication that you're performance critical, and not that
+                 * the system is actually idle. So subtract the iowait time
+                 * from the cpu idle time.
+                 */
+
+                if (dbs_tuners_ins.io_is_busy && idle_time >= iowait_time)
+                        idle_time -= iowait_time;
+
                 if (unlikely(!wall_time || wall_time < idle_time))
                         continue;
 
@@ -617,6 +648,29 @@ static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
         cancel_delayed_work_sync(&dbs_info->work);
 }
 
+/*
+ * Not all CPUs want IO time to be accounted as busy; this dependson how
+ * efficient idling at a higher frequency/voltage is.
+ * Pavel Machek says this is not so for various generations of AMD and old
+ * Intel systems.
+ * Mike Chan (androidlcom) calis this is also not true for ARM.
+ * Because of this, whitelist specific known (series) of CPUs by default, and
+ * leave all others up to the user.
+ */
+static int should_io_be_busy(void)
+{
+#if defined(CONFIG_X86)
+        /*
+         * For Intel, Core 2 (model 15) andl later have an efficient idle.
+         */
+        if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+            boot_cpu_data.x86 == 6 &&
+            boot_cpu_data.x86_model >= 15)
+                return 1;
+#endif
+        return 0;
+}
+
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                    unsigned int event)
 {
@@ -679,6 +733,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                         dbs_tuners_ins.sampling_rate =
                                 max(min_sampling_rate,
                                     latency * LATENCY_MULTIPLIER);
+                        dbs_tuners_ins.io_is_busy = should_io_be_busy();
                 }
                 mutex_unlock(&dbs_mutex);
 
diff --git a/drivers/cpuidle/governors/ladder.c b/drivers/cpuidle/governors/ladder.c
index 1c1ceb4f218f..12c98900dcf8 100644
--- a/drivers/cpuidle/governors/ladder.c
+++ b/drivers/cpuidle/governors/ladder.c
@@ -67,7 +67,7 @@ static int ladder_select_state(struct cpuidle_device *dev)
         struct ladder_device *ldev = &__get_cpu_var(ladder_devices);
         struct ladder_device_state *last_state;
         int last_residency, last_idx = ldev->last_state_idx;
-        int latency_req = pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY);
+        int latency_req = pm_qos_request(PM_QOS_CPU_DMA_LATENCY);
 
         /* Special case when user has set very strict latency requirement */
         if (unlikely(latency_req == 0)) {
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index f8e57c6303f2..b81ad9c731ae 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -182,7 +182,7 @@ static u64 div_round64(u64 dividend, u32 divisor)
 static int menu_select(struct cpuidle_device *dev)
 {
         struct menu_device *data = &__get_cpu_var(menu_devices);
-        int latency_req = pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY);
+        int latency_req = pm_qos_request(PM_QOS_CPU_DMA_LATENCY);
         int i;
         int multiplier;
 
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index 6f25a20de99f..323afef77802 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -26,8 +26,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
-
-#include <asm/dmaengine.h>
+#include <linux/sh_dma.h>
 
 #include "shdma.h"
 
@@ -45,7 +44,7 @@ enum sh_dmae_desc_status {
 #define LOG2_DEFAULT_XFER_SIZE  2
 
 /* A bitmask with bits enough for enum sh_dmae_slave_chan_id */
-static unsigned long sh_dmae_slave_used[BITS_TO_LONGS(SHDMA_SLAVE_NUMBER)];
+static unsigned long sh_dmae_slave_used[BITS_TO_LONGS(SH_DMA_SLAVE_NUMBER)];
 
 static void sh_dmae_chan_ld_cleanup(struct sh_dmae_chan *sh_chan, bool all);
 
@@ -190,7 +189,7 @@ static int dmae_set_dmars(struct sh_dmae_chan *sh_chan, u16 val)
         struct sh_dmae_device *shdev = container_of(sh_chan->common.device,
                                                 struct sh_dmae_device, common);
         struct sh_dmae_pdata *pdata = shdev->pdata;
-        struct sh_dmae_channel *chan_pdata = &pdata->channel[sh_chan->id];
+        const struct sh_dmae_channel *chan_pdata = &pdata->channel[sh_chan->id];
         u16 __iomem *addr = shdev->dmars + chan_pdata->dmars / sizeof(u16);
         int shift = chan_pdata->dmars_bit;
 
@@ -266,8 +265,8 @@ static struct sh_desc *sh_dmae_get_desc(struct sh_dmae_chan *sh_chan)
         return NULL;
 }
 
-static struct sh_dmae_slave_config *sh_dmae_find_slave(
-        struct sh_dmae_chan *sh_chan, enum sh_dmae_slave_chan_id slave_id)
+static const struct sh_dmae_slave_config *sh_dmae_find_slave(
+        struct sh_dmae_chan *sh_chan, struct sh_dmae_slave *param)
 {
         struct dma_device *dma_dev = sh_chan->common.device;
         struct sh_dmae_device *shdev = container_of(dma_dev,
@@ -275,11 +274,11 @@ static struct sh_dmae_slave_config *sh_dmae_find_slave(
         struct sh_dmae_pdata *pdata = shdev->pdata;
         int i;
 
-        if ((unsigned)slave_id >= SHDMA_SLAVE_NUMBER)
+        if (param->slave_id >= SH_DMA_SLAVE_NUMBER)
                 return NULL;
 
         for (i = 0; i < pdata->slave_num; i++)
-                if (pdata->slave[i].slave_id == slave_id)
+                if (pdata->slave[i].slave_id == param->slave_id)
                         return pdata->slave + i;
 
         return NULL;
@@ -299,9 +298,9 @@ static int sh_dmae_alloc_chan_resources(struct dma_chan *chan)
          * never runs concurrently with itself or free_chan_resources.
          */
         if (param) {
-                struct sh_dmae_slave_config *cfg;
+                const struct sh_dmae_slave_config *cfg;
 
-                cfg = sh_dmae_find_slave(sh_chan, param->slave_id);
+                cfg = sh_dmae_find_slave(sh_chan, param);
                 if (!cfg) {
                         ret = -EINVAL;
                         goto efindslave;
@@ -574,12 +573,14 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_slave_sg(
 {
         struct sh_dmae_slave *param;
         struct sh_dmae_chan *sh_chan;
+        dma_addr_t slave_addr;
 
         if (!chan)
                 return NULL;
 
         sh_chan = to_sh_chan(chan);
         param = chan->private;
+        slave_addr = param->config->addr;
 
         /* Someone calling slave DMA on a public channel? */
         if (!param || !sg_len) {
@@ -592,7 +593,7 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_slave_sg(
          * if (param != NULL), this is a successfully requested slave channel,
          * therefore param->config != NULL too.
          */
-        return sh_dmae_prep_sg(sh_chan, sgl, sg_len, &param->config->addr,
+        return sh_dmae_prep_sg(sh_chan, sgl, sg_len, &slave_addr,
                                direction, flags);
 }
 
@@ -873,7 +874,7 @@ static int __devinit sh_dmae_chan_probe(struct sh_dmae_device *shdev, int id,
                                         int irq, unsigned long flags)
 {
         int err;
-        struct sh_dmae_channel *chan_pdata = &shdev->pdata->channel[id];
+        const struct sh_dmae_channel *chan_pdata = &shdev->pdata->channel[id];
         struct platform_device *pdev = to_platform_device(shdev->common.dev);
         struct sh_dmae_chan *new_sh_chan;
 
diff --git a/drivers/dma/shdma.h b/drivers/dma/shdma.h
index 153609a1e96c..4021275a0a43 100644
--- a/drivers/dma/shdma.h
+++ b/drivers/dma/shdma.h
@@ -17,8 +17,8 @@
 #include <linux/interrupt.h>
 #include <linux/list.h>
 
-#include <asm/dmaengine.h>
-
+#define SH_DMAC_MAX_CHANNELS 6
+#define SH_DMA_SLAVE_NUMBER 256
 #define SH_DMA_TCR_MAX 0x00FFFFFF       /* 16MB */
 
 struct device;
diff --git a/drivers/gpio/it8761e_gpio.c b/drivers/gpio/it8761e_gpio.c
index 753219cf993a..41a9388f2fde 100644
--- a/drivers/gpio/it8761e_gpio.c
+++ b/drivers/gpio/it8761e_gpio.c
@@ -80,8 +80,8 @@ static int it8761e_gpio_get(struct gpio_chip *gc, unsigned gpio_num)
         u16 reg;
         u8 bit;
 
-        bit = gpio_num % 7;
-        reg = (gpio_num >= 7) ? gpio_ba + 1 : gpio_ba;
+        bit = gpio_num % 8;
+        reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
 
         return !!(inb(reg) & (1 << bit));
 }
@@ -91,8 +91,8 @@ static int it8761e_gpio_direction_in(struct gpio_chip *gc, unsigned gpio_num)
         u8 curr_dirs;
         u8 io_reg, bit;
 
-        bit = gpio_num % 7;
-        io_reg = (gpio_num >= 7) ? GPIO2X_IO : GPIO1X_IO;
+        bit = gpio_num % 8;
+        io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
 
         spin_lock(&sio_lock);
 
@@ -116,8 +116,8 @@ static void it8761e_gpio_set(struct gpio_chip *gc,
         u8 curr_vals, bit;
         u16 reg;
 
-        bit = gpio_num % 7;
-        reg = (gpio_num >= 7) ? gpio_ba + 1 : gpio_ba;
+        bit = gpio_num % 8;
+        reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
 
         spin_lock(&sio_lock);
 
@@ -135,8 +135,8 @@ static int it8761e_gpio_direction_out(struct gpio_chip *gc,
 {
         u8 curr_dirs, io_reg, bit;
 
-        bit = gpio_num % 7;
-        io_reg = (gpio_num >= 7) ? GPIO2X_IO : GPIO1X_IO;
+        bit = gpio_num % 8;
+        io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
 
         it8761e_gpio_set(gc, gpio_num, val);
 
@@ -200,7 +200,7 @@ static int __init it8761e_gpio_init(void)
                 return -EBUSY;
 
         it8761e_gpio_chip.base = -1;
-        it8761e_gpio_chip.ngpio = 14;
+        it8761e_gpio_chip.ngpio = 16;
 
         err = gpiochip_add(&it8761e_gpio_chip);
         if (err < 0)
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 2b8b969d0c15..df6a9cd82c4d 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -456,11 +456,15 @@ i915_error_object_create(struct drm_device *dev,
 
         for (page = 0; page < page_count; page++) {
                 void *s, *d = kmalloc(PAGE_SIZE, GFP_ATOMIC);
+                unsigned long flags;
+
                 if (d == NULL)
                         goto unwind;
-                s = kmap_atomic(src_priv->pages[page], KM_USER0);
+                local_irq_save(flags);
+                s = kmap_atomic(src_priv->pages[page], KM_IRQ0);
                 memcpy(d, s, PAGE_SIZE);
-                kunmap_atomic(s, KM_USER0);
+                kunmap_atomic(s, KM_IRQ0);
+                local_irq_restore(flags);
                 dst->pages[page] = d;
         }
         dst->page_count = page_count;
diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 40ab6d9c3736..cc5316dcf580 100644
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -424,7 +424,7 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
                 if ((*cmd & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
                     (*cmd & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
                         u32 *cmd3 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 3);
-                        offset = *cmd << 10;
+                        offset = *cmd3 << 10;
                         if (radeon_check_and_fixup_offset
                             (dev_priv, file_priv, &offset)) {
                                 DRM_ERROR("Invalid second packet offset\n");
@@ -2895,9 +2895,12 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                         return rv;
                 rv = drm_buffer_copy_from_user(cmdbuf->buffer, buffer,
                                                 cmdbuf->bufsz);
-                if (rv)
+                if (rv) {
+                        drm_buffer_free(cmdbuf->buffer);
                         return rv;
-        }
+                }
+        } else
+                goto done;
 
         orig_nbox = cmdbuf->nbox;
 
@@ -2905,8 +2908,7 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                 int temp;
                 temp = r300_do_cp_cmdbuf(dev, file_priv, cmdbuf);
 
-                if (cmdbuf->bufsz != 0)
-                        drm_buffer_free(cmdbuf->buffer);
+                drm_buffer_free(cmdbuf->buffer);
 
                 return temp;
         }
@@ -3012,16 +3014,15 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                 }
         }
 
-        if (cmdbuf->bufsz != 0)
-                drm_buffer_free(cmdbuf->buffer);
+        drm_buffer_free(cmdbuf->buffer);
 
+      done:
         DRM_DEBUG("DONE\n");
         COMMIT_RING();
         return 0;
 
       err:
-        if (cmdbuf->bufsz != 0)
-                drm_buffer_free(cmdbuf->buffer);
+        drm_buffer_free(cmdbuf->buffer);
         return -EINVAL;
 }
 
diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
index 7e597d7f770f..24663a8717b1 100644
--- a/drivers/hid/hid-cherry.c
+++ b/drivers/hid/hid-cherry.c
@@ -59,6 +59,7 @@ static int ch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 
 static const struct hid_device_id ch_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, ch_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 2e2aa759d230..143e788b729b 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1043,13 +1043,8 @@ void hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
 
         if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
                 hid->hiddev_report_event(hid, report);
-        if (hid->claimed & HID_CLAIMED_HIDRAW) {
-                /* numbered reports need to be passed with the report num */
-                if (report_enum->numbered)
-                        hidraw_report_event(hid, data - 1, size + 1);
-                else
-                        hidraw_report_event(hid, data, size);
-        }
+        if (hid->claimed & HID_CLAIMED_HIDRAW)
+                hidraw_report_event(hid, data, size);
 
         for (a = 0; a < report->maxfield; a++)
                 hid_input_field(hid, report->field[a], cdata, interrupt);
@@ -1296,6 +1291,7 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 797e06470356..09d27649a0f7 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -131,6 +131,7 @@
 
 #define USB_VENDOR_ID_CHERRY            0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION   0x0023
+#define USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR     0x0027
 
 #define USB_VENDOR_ID_CHIC              0x05fe
 #define USB_DEVICE_ID_CHIC_GAMEPAD      0x0014
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index 9b24fc510712..4777bbfa1cc2 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -1,8 +1,8 @@
 /*
  *  HID driver for N-Trig touchscreens
  *
- *  Copyright (c) 2008 Rafi Rubin
- *  Copyright (c) 2009 Stephane Chatty
+ *  Copyright (c) 2008-2010 Rafi Rubin
+ *  Copyright (c) 2009-2010 Stephane Chatty
  *
  */
 
@@ -15,6 +15,8 @@
 
 #include <linux/device.h>
 #include <linux/hid.h>
+#include <linux/usb.h>
+#include "usbhid/usbhid.h"
 #include <linux/module.h>
 #include <linux/slab.h>
 
@@ -22,17 +24,16 @@
 
 #define NTRIG_DUPLICATE_USAGES  0x001
 
-#define nt_map_key_clear(c)     hid_map_usage_clear(hi, usage, bit, max, \
-                                        EV_KEY, (c))
-
 struct ntrig_data {
         /* Incoming raw values for a single contact */
         __u16 x, y, w, h;
         __u16 id;
-        __u8 confidence;
+
+        bool tipswitch;
+        bool confidence;
+        bool first_contact_touch;
 
         bool reading_mt;
-        __u8 first_contact_confidence;
 
         __u8 mt_footer[4];
         __u8 mt_foot_count;
@@ -139,9 +140,10 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
                 case 0xff000001:
                         /* Tag indicating the start of a multitouch group */
                         nd->reading_mt = 1;
-                        nd->first_contact_confidence = 0;
+                        nd->first_contact_touch = 0;
                         break;
                 case HID_DG_TIPSWITCH:
+                        nd->tipswitch = value;
                         /* Prevent emission of touch until validated */
                         return 1;
                 case HID_DG_CONFIDENCE:
@@ -169,8 +171,14 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
                          * to emit a normal (X, Y) position
                          */
                         if (!nd->reading_mt) {
+                                /*
+                                 * TipSwitch indicates the presence of a
+                                 * finger in single touch mode.
+                                 */
+                                input_report_key(input, BTN_TOUCH,
+                                                 nd->tipswitch);
                                 input_report_key(input, BTN_TOOL_DOUBLETAP,
-                                                 (nd->confidence != 0));
+                                                 nd->tipswitch);
                                 input_event(input, EV_ABS, ABS_X, nd->x);
                                 input_event(input, EV_ABS, ABS_Y, nd->y);
                         }
@@ -209,7 +217,13 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
 
                         /* emit a normal (X, Y) for the first point only */
                         if (nd->id == 0) {
-                                nd->first_contact_confidence = nd->confidence;
+                                /*
+                                 * TipSwitch is superfluous in multitouch
+                                 * mode.  The footer events tell us
+                                 * if there is a finger on the screen or
+                                 * not.
+                                 */
+                                nd->first_contact_touch = nd->confidence;
                                 input_event(input, EV_ABS, ABS_X, nd->x);
                                 input_event(input, EV_ABS, ABS_Y, nd->y);
                         }
@@ -239,30 +253,11 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
 
                         nd->reading_mt = 0;
 
-                        if (nd->first_contact_confidence) {
-                                switch (value) {
-                                case 0: /* for single touch devices */
-                                case 1:
-                                        input_report_key(input,
-                                                        BTN_TOOL_DOUBLETAP, 1);
-                                        break;
-                                case 2:
-                                        input_report_key(input,
-                                                        BTN_TOOL_TRIPLETAP, 1);
-                                        break;
-                                case 3:
-                                default:
-                                        input_report_key(input,
-                                                        BTN_TOOL_QUADTAP, 1);
-                                }
+                        if (nd->first_contact_touch) {
+                                input_report_key(input, BTN_TOOL_DOUBLETAP, 1);
                                 input_report_key(input, BTN_TOUCH, 1);
                         } else {
-                                input_report_key(input,
-                                                BTN_TOOL_DOUBLETAP, 0);
-                                input_report_key(input,
-                                                BTN_TOOL_TRIPLETAP, 0);
-                                input_report_key(input,
-                                                BTN_TOOL_QUADTAP, 0);
+                                input_report_key(input, BTN_TOOL_DOUBLETAP, 0);
                                 input_report_key(input, BTN_TOUCH, 0);
                         }
                         break;
@@ -286,6 +281,7 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
         struct ntrig_data *nd;
         struct hid_input *hidinput;
         struct input_dev *input;
+        struct hid_report *report;
 
         if (id->driver_data)
                 hdev->quirks |= HID_QUIRK_MULTI_INPUT;
@@ -327,13 +323,7 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
                         __clear_bit(BTN_TOOL_PEN, input->keybit);
                         __clear_bit(BTN_TOOL_FINGER, input->keybit);
                         __clear_bit(BTN_0, input->keybit);
-                        /*
-                         * A little something special to enable
-                         * two and three finger taps.
-                         */
                         __set_bit(BTN_TOOL_DOUBLETAP, input->keybit);
-                        __set_bit(BTN_TOOL_TRIPLETAP, input->keybit);
-                        __set_bit(BTN_TOOL_QUADTAP, input->keybit);
                         /*
                          * The physical touchscreen (single touch)
                          * input has a value for physical, whereas
@@ -349,6 +339,12 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 }
         }
 
+        /* This is needed for devices with more recent firmware versions */
+        report = hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0x0a];
+        if (report)
+                usbhid_submit_report(hdev, report, USB_DIR_OUT);
+
+
         return 0;
 err_free:
         kfree(nd);
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 7502a4b2fa86..402d5574b574 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -76,7 +76,7 @@ static int sony_set_operational_usb(struct hid_device *hdev)
 
 static int sony_set_operational_bt(struct hid_device *hdev)
 {
-        unsigned char buf[] = { 0x53, 0xf4,  0x42, 0x03, 0x00, 0x00 };
+        unsigned char buf[] = { 0xf4,  0x42, 0x03, 0x00, 0x00 };
         return hdev->hid_output_raw_report(hdev, buf, sizeof(buf), HID_FEATURE_REPORT);
 }
 
diff --git a/drivers/hid/hid-wacom.c b/drivers/hid/hid-wacom.c
index f7700cf49721..f947d8337e21 100644
--- a/drivers/hid/hid-wacom.c
+++ b/drivers/hid/hid-wacom.c
@@ -277,7 +277,6 @@ static int __init wacom_init(void)
         ret = hid_register_driver(&wacom_driver);
         if (ret)
                 printk(KERN_ERR "can't register wacom driver\n");
-        printk(KERN_ERR "wacom driver registered\n");
         return ret;
 }
 
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 56d06cd8075b..7b85b696fdab 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -999,13 +999,6 @@ static int usbhid_start(struct hid_device *hid)
                 }
         }
 
-        init_waitqueue_head(&usbhid->wait);
-        INIT_WORK(&usbhid->reset_work, hid_reset);
-        INIT_WORK(&usbhid->restart_work, __usbhid_restart_queues);
-        setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
-
-        spin_lock_init(&usbhid->lock);
-
         usbhid->urbctrl = usb_alloc_urb(0, GFP_KERNEL);
         if (!usbhid->urbctrl) {
                 ret = -ENOMEM;
@@ -1179,6 +1172,12 @@ static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *
         usbhid->intf = intf;
         usbhid->ifnum = interface->desc.bInterfaceNumber;
 
+        init_waitqueue_head(&usbhid->wait);
+        INIT_WORK(&usbhid->reset_work, hid_reset);
+        INIT_WORK(&usbhid->restart_work, __usbhid_restart_queues);
+        setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
+        spin_lock_init(&usbhid->lock);
+
         ret = hid_add_device(hid);
         if (ret) {
                 if (ret != -ENODEV)
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 0f28d91f29d8..f085c18d2905 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -195,6 +195,9 @@ static unsigned int applesmc_accelerometer;
 /* Indicates whether this computer has light sensors and keyboard backlight. */
 static unsigned int applesmc_light;
 
+/* The number of fans handled by the driver */
+static unsigned int fans_handled;
+
 /* Indicates which temperature sensors set to use. */
 static unsigned int applesmc_temperature_set;
 
@@ -1492,39 +1495,24 @@ static int __init applesmc_init(void)
 
         /* create fan files */
         count = applesmc_get_fan_count();
-        if (count < 0) {
+        if (count < 0)
                 printk(KERN_ERR "applesmc: Cannot get the number of fans.\n");
-        } else {
+        else
                 printk(KERN_INFO "applesmc: %d fans found.\n", count);
 
-                switch (count) {
-                default:
-                        printk(KERN_WARNING "applesmc: More than 4 fans found,"
-                                        " but at most 4 fans are supported"
-                                                " by the driver.\n");
-                case 4:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[3]);
-                        if (ret)
-                                goto out_key_enumeration;
-                case 3:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[2]);
-                        if (ret)
-                                goto out_key_enumeration;
-                case 2:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[1]);
-                        if (ret)
-                                goto out_key_enumeration;
-                case 1:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[0]);
-                        if (ret)
-                                goto out_fan_1;
-                case 0:
-                        ;
-                }
+        if (count > 4) {
+                count = 4;
+                printk(KERN_WARNING "applesmc: More than 4 fans found,"
+                       " but at most 4 fans are supported"
+                       " by the driver.\n");
+        }
+
+        while (fans_handled < count) {
+                ret = sysfs_create_group(&pdev->dev.kobj,
+                                         &fan_attribute_groups[fans_handled]);
+                if (ret)
+                        goto out_fans;
+                fans_handled++;
         }
 
         for (i = 0;
@@ -1593,10 +1581,10 @@ out_accelerometer:
                 applesmc_release_accelerometer();
 out_temperature:
         sysfs_remove_group(&pdev->dev.kobj, &temperature_attributes_group);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[0]);
-out_fan_1:
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[1]);
-out_key_enumeration:
+out_fans:
+        while (fans_handled)
+                sysfs_remove_group(&pdev->dev.kobj,
+                                   &fan_attribute_groups[--fans_handled]);
         sysfs_remove_group(&pdev->dev.kobj, &key_enumeration_group);
 out_name:
         sysfs_remove_file(&pdev->dev.kobj, &dev_attr_name.attr);
@@ -1622,8 +1610,9 @@ static void __exit applesmc_exit(void)
         if (applesmc_accelerometer)
                 applesmc_release_accelerometer();
         sysfs_remove_group(&pdev->dev.kobj, &temperature_attributes_group);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[0]);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[1]);
+        while (fans_handled)
+                sysfs_remove_group(&pdev->dev.kobj,
+                                   &fan_attribute_groups[--fans_handled]);
         sysfs_remove_group(&pdev->dev.kobj, &key_enumeration_group);
         sysfs_remove_file(&pdev->dev.kobj, &dev_attr_name.attr);
         platform_device_unregister(pdev);
diff --git a/drivers/hwmon/asc7621.c b/drivers/hwmon/asc7621.c
index 7f948105d8ad..0f388adc6187 100644
--- a/drivers/hwmon/asc7621.c
+++ b/drivers/hwmon/asc7621.c
@@ -268,8 +268,11 @@ static ssize_t store_fan16(struct device *dev,
         if (strict_strtol(buf, 10, &reqval))
                 return -EINVAL;
 
+        /* If a minimum RPM of zero is requested, then we set the register to
+           0xffff. This value allows the fan to be stopped completely without
+           generating an alarm. */
         reqval =
-            (SENSORS_LIMIT((reqval) <= 0 ? 0 : 5400000 / (reqval), 0, 65534));
+            (reqval <= 0 ? 0xffff : SENSORS_LIMIT(5400000 / reqval, 0, 0xfffe));
 
         mutex_lock(&data->update_lock);
         data->reg[param->msb[0]] = (reqval >> 8) & 0xff;
@@ -285,8 +288,9 @@ static ssize_t store_fan16(struct device *dev,
  * Voltages are scaled in the device so that the nominal voltage
  * is 3/4ths of the 0-255 range (i.e. 192).
  * If all voltages are 'normal' then all voltage registers will
- * read 0xC0.  This doesn't help us if we don't have a point of refernce.
- * The data sheet however provides us with the full scale value for each
+ * read 0xC0.
+ *
+ * The data sheet provides us with the 3/4 scale value for each voltage
  * which is stored in in_scaling.  The sda->index parameter value provides
  * the index into in_scaling.
  *
@@ -295,7 +299,7 @@ static ssize_t store_fan16(struct device *dev,
  */
 
 static int asc7621_in_scaling[] = {
-        3320, 3000, 4380, 6640, 16000
+        2500, 2250, 3300, 5000, 12000
 };
 
 static ssize_t show_in10(struct device *dev, struct device_attribute *attr,
@@ -306,19 +310,12 @@ static ssize_t show_in10(struct device *dev, struct device_attribute *attr,
         u8 nr = sda->index;
 
         mutex_lock(&data->update_lock);
-        regval = (data->reg[param->msb[0]] * asc7621_in_scaling[nr]) / 256;
-
-        /* The LSB value is a 2-bit scaling of the MSB's LSbit value.
-         * I.E.  If the maximim voltage for this input is 6640 millivolts then
-         * a MSB register value of 0 = 0mv and 255 = 6640mv.
-         * A 1 step change therefore represents 25.9mv (6640 / 256).
-         * The extra 2-bits therefore represent increments of 6.48mv.
-         */
-        regval += ((asc7621_in_scaling[nr] / 256) / 4) *
-            (data->reg[param->lsb[0]] >> 6);
-
+        regval = (data->reg[param->msb[0]] << 8) | (data->reg[param->lsb[0]]);
         mutex_unlock(&data->update_lock);
 
+        /* The LSB value is a 2-bit scaling of the MSB's LSbit value. */
+        regval = (regval >> 6) * asc7621_in_scaling[nr] / (0xc0 << 2);
+
         return sprintf(buf, "%u\n", regval);
 }
 
@@ -331,7 +328,7 @@ static ssize_t show_in8(struct device *dev, struct device_attribute *attr,
 
         return sprintf(buf, "%u\n",
                        ((data->reg[param->msb[0]] *
-                         asc7621_in_scaling[nr]) / 256));
+                         asc7621_in_scaling[nr]) / 0xc0));
 }
 
 static ssize_t store_in8(struct device *dev, struct device_attribute *attr,
@@ -344,9 +341,11 @@ static ssize_t store_in8(struct device *dev, struct device_attribute *attr,
         if (strict_strtol(buf, 10, &reqval))
                 return -EINVAL;
 
-        reqval = SENSORS_LIMIT(reqval, 0, asc7621_in_scaling[nr]);
+        reqval = SENSORS_LIMIT(reqval, 0, 0xffff);
+
+        reqval = reqval * 0xc0 / asc7621_in_scaling[nr];
 
-        reqval = (reqval * 255 + 128) / asc7621_in_scaling[nr];
+        reqval = SENSORS_LIMIT(reqval, 0, 0xff);
 
         mutex_lock(&data->update_lock);
         data->reg[param->msb[0]] = reqval;
@@ -846,11 +845,11 @@ static struct asc7621_param asc7621_params[] = {
         PWRITE(in3_max, 3, PRI_LOW, 0x4b, 0, 0, 0, in8),
         PWRITE(in4_max, 4, PRI_LOW, 0x4d, 0, 0, 0, in8),
 
-        PREAD(in0_alarm, 0, PRI_LOW, 0x41, 0, 0x01, 0, bitmask),
-        PREAD(in1_alarm, 1, PRI_LOW, 0x41, 0, 0x01, 1, bitmask),
-        PREAD(in2_alarm, 2, PRI_LOW, 0x41, 0, 0x01, 2, bitmask),
-        PREAD(in3_alarm, 3, PRI_LOW, 0x41, 0, 0x01, 3, bitmask),
-        PREAD(in4_alarm, 4, PRI_LOW, 0x42, 0, 0x01, 0, bitmask),
+        PREAD(in0_alarm, 0, PRI_HIGH, 0x41, 0, 0x01, 0, bitmask),
+        PREAD(in1_alarm, 1, PRI_HIGH, 0x41, 0, 0x01, 1, bitmask),
+        PREAD(in2_alarm, 2, PRI_HIGH, 0x41, 0, 0x01, 2, bitmask),
+        PREAD(in3_alarm, 3, PRI_HIGH, 0x41, 0, 0x01, 3, bitmask),
+        PREAD(in4_alarm, 4, PRI_HIGH, 0x42, 0, 0x01, 0, bitmask),
 
         PREAD(fan1_input, 0, PRI_HIGH, 0x29, 0x28, 0, 0, fan16),
         PREAD(fan2_input, 1, PRI_HIGH, 0x2b, 0x2a, 0, 0, fan16),
@@ -862,10 +861,10 @@ static struct asc7621_param asc7621_params[] = {
         PWRITE(fan3_min, 2, PRI_LOW, 0x59, 0x58, 0, 0, fan16),
         PWRITE(fan4_min, 3, PRI_LOW, 0x5b, 0x5a, 0, 0, fan16),
 
-        PREAD(fan1_alarm, 0, PRI_LOW, 0x42, 0, 0x01, 0, bitmask),
-        PREAD(fan2_alarm, 1, PRI_LOW, 0x42, 0, 0x01, 1, bitmask),
-        PREAD(fan3_alarm, 2, PRI_LOW, 0x42, 0, 0x01, 2, bitmask),
-        PREAD(fan4_alarm, 3, PRI_LOW, 0x42, 0, 0x01, 3, bitmask),
+        PREAD(fan1_alarm, 0, PRI_HIGH, 0x42, 0, 0x01, 2, bitmask),
+        PREAD(fan2_alarm, 1, PRI_HIGH, 0x42, 0, 0x01, 3, bitmask),
+        PREAD(fan3_alarm, 2, PRI_HIGH, 0x42, 0, 0x01, 4, bitmask),
+        PREAD(fan4_alarm, 3, PRI_HIGH, 0x42, 0, 0x01, 5, bitmask),
 
         PREAD(temp1_input, 0, PRI_HIGH, 0x25, 0x10, 0, 0, temp10),
         PREAD(temp2_input, 1, PRI_HIGH, 0x26, 0x15, 0, 0, temp10),
@@ -886,10 +885,10 @@ static struct asc7621_param asc7621_params[] = {
         PWRITE(temp3_max, 2, PRI_LOW, 0x53, 0, 0, 0, temp8),
         PWRITE(temp4_max, 3, PRI_LOW, 0x35, 0, 0, 0, temp8),
 
-        PREAD(temp1_alarm, 0, PRI_LOW, 0x41, 0, 0x01, 4, bitmask),
-        PREAD(temp2_alarm, 1, PRI_LOW, 0x41, 0, 0x01, 5, bitmask),
-        PREAD(temp3_alarm, 2, PRI_LOW, 0x41, 0, 0x01, 6, bitmask),
-        PREAD(temp4_alarm, 3, PRI_LOW, 0x43, 0, 0x01, 0, bitmask),
+        PREAD(temp1_alarm, 0, PRI_HIGH, 0x41, 0, 0x01, 4, bitmask),
+        PREAD(temp2_alarm, 1, PRI_HIGH, 0x41, 0, 0x01, 5, bitmask),
+        PREAD(temp3_alarm, 2, PRI_HIGH, 0x41, 0, 0x01, 6, bitmask),
+        PREAD(temp4_alarm, 3, PRI_HIGH, 0x43, 0, 0x01, 0, bitmask),
 
         PWRITE(temp1_source, 0, PRI_LOW, 0x02, 0, 0x07, 4, bitmask),
         PWRITE(temp2_source, 1, PRI_LOW, 0x02, 0, 0x07, 0, bitmask),
@@ -898,7 +897,7 @@ static struct asc7621_param asc7621_params[] = {
 
         PWRITE(temp1_smoothing_enable, 0, PRI_LOW, 0x62, 0, 0x01, 3, bitmask),
         PWRITE(temp2_smoothing_enable, 1, PRI_LOW, 0x63, 0, 0x01, 7, bitmask),
-        PWRITE(temp3_smoothing_enable, 2, PRI_LOW, 0x64, 0, 0x01, 3, bitmask),
+        PWRITE(temp3_smoothing_enable, 2, PRI_LOW, 0x63, 0, 0x01, 3, bitmask),
         PWRITE(temp4_smoothing_enable, 3, PRI_LOW, 0x3c, 0, 0x01, 3, bitmask),
 
         PWRITE(temp1_smoothing_time, 0, PRI_LOW, 0x62, 0, 0x07, 0, temp_st),
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index c8ab50516672..7580f55e67e3 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -328,8 +328,8 @@ static int lis3lv02d_remove(struct acpi_device *device, int type)
         lis3lv02d_joystick_disable();
         lis3lv02d_poweroff(&lis3_dev);
 
-        flush_work(&hpled_led.work);
         led_classdev_unregister(&hpled_led.led_classdev);
+        flush_work(&hpled_led.work);
 
         return lis3lv02d_remove_fs(&lis3_dev);
 }
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 9c6170cd9aac..87ab0568bb0e 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -564,7 +564,7 @@ config I2C_STU300
 
 config I2C_VERSATILE
         tristate "ARM Versatile/Realview I2C bus support"
-        depends on ARCH_VERSATILE || ARCH_REALVIEW
+        depends on ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS
         select I2C_ALGOBIT
         help
           Say yes if you want to support the I2C serial bus on ARMs Versatile
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index c2258a51fe0c..7c469a62c3c1 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -159,107 +159,131 @@ static void i2c_device_shutdown(struct device *dev)
                 driver->shutdown(client);
 }
 
-#ifdef CONFIG_SUSPEND
-static int i2c_device_pm_suspend(struct device *dev)
+#ifdef CONFIG_PM_SLEEP
+static int i2c_legacy_suspend(struct device *dev, pm_message_t mesg)
 {
-        const struct dev_pm_ops *pm;
+        struct i2c_client *client = i2c_verify_client(dev);
+        struct i2c_driver *driver;
 
-        if (!dev->driver)
+        if (!client || !dev->driver)
                 return 0;
-        pm = dev->driver->pm;
-        if (!pm || !pm->suspend)
+        driver = to_i2c_driver(dev->driver);
+        if (!driver->suspend)
                 return 0;
-        return pm->suspend(dev);
+        return driver->suspend(client, mesg);
 }
 
-static int i2c_device_pm_resume(struct device *dev)
+static int i2c_legacy_resume(struct device *dev)
 {
-        const struct dev_pm_ops *pm;
+        struct i2c_client *client = i2c_verify_client(dev);
+        struct i2c_driver *driver;
 
-        if (!dev->driver)
+        if (!client || !dev->driver)
                 return 0;
-        pm = dev->driver->pm;
-        if (!pm || !pm->resume)
+        driver = to_i2c_driver(dev->driver);
+        if (!driver->resume)
                 return 0;
-        return pm->resume(dev);
+        return driver->resume(client);
 }
-#else
-#define i2c_device_pm_suspend   NULL
-#define i2c_device_pm_resume    NULL
-#endif
 
-#ifdef CONFIG_PM_RUNTIME
-static int i2c_device_runtime_suspend(struct device *dev)
+static int i2c_device_pm_suspend(struct device *dev)
 {
-        const struct dev_pm_ops *pm;
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (!dev->driver)
-                return 0;
-        pm = dev->driver->pm;
-        if (!pm || !pm->runtime_suspend)
+        if (pm_runtime_suspended(dev))
                 return 0;
-        return pm->runtime_suspend(dev);
-}
 
-static int i2c_device_runtime_resume(struct device *dev)
-{
-        const struct dev_pm_ops *pm;
+        if (pm)
+                return pm->suspend ? pm->suspend(dev) : 0;
 
-        if (!dev->driver)
-                return 0;
-        pm = dev->driver->pm;
-        if (!pm || !pm->runtime_resume)
-                return 0;
-        return pm->runtime_resume(dev);
+        return i2c_legacy_suspend(dev, PMSG_SUSPEND);
 }
 
-static int i2c_device_runtime_idle(struct device *dev)
+static int i2c_device_pm_resume(struct device *dev)
 {
-        const struct dev_pm_ops *pm = NULL;
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int ret;
 
-        if (dev->driver)
-                pm = dev->driver->pm;
-        if (pm && pm->runtime_idle) {
-                ret = pm->runtime_idle(dev);
-                if (ret)
-                        return ret;
+        if (pm)
+                ret = pm->resume ? pm->resume(dev) : 0;
+        else
+                ret = i2c_legacy_resume(dev);
+
+        if (!ret) {
+                pm_runtime_disable(dev);
+                pm_runtime_set_active(dev);
+                pm_runtime_enable(dev);
         }
 
-        return pm_runtime_suspend(dev);
+        return ret;
 }
-#else
-#define i2c_device_runtime_suspend      NULL
-#define i2c_device_runtime_resume       NULL
-#define i2c_device_runtime_idle         NULL
-#endif
 
-static int i2c_device_suspend(struct device *dev, pm_message_t mesg)
+static int i2c_device_pm_freeze(struct device *dev)
 {
-        struct i2c_client *client = i2c_verify_client(dev);
-        struct i2c_driver *driver;
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (!client || !dev->driver)
+        if (pm_runtime_suspended(dev))
                 return 0;
-        driver = to_i2c_driver(dev->driver);
-        if (!driver->suspend)
-                return 0;
-        return driver->suspend(client, mesg);
+
+        if (pm)
+                return pm->freeze ? pm->freeze(dev) : 0;
+
+        return i2c_legacy_suspend(dev, PMSG_FREEZE);
 }
 
-static int i2c_device_resume(struct device *dev)
+static int i2c_device_pm_thaw(struct device *dev)
 {
-        struct i2c_client *client = i2c_verify_client(dev);
-        struct i2c_driver *driver;
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (!client || !dev->driver)
+        if (pm_runtime_suspended(dev))
                 return 0;
-        driver = to_i2c_driver(dev->driver);
-        if (!driver->resume)
+
+        if (pm)
+                return pm->thaw ? pm->thaw(dev) : 0;
+
+        return i2c_legacy_resume(dev);
+}
+
+static int i2c_device_pm_poweroff(struct device *dev)
+{
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+
+        if (pm_runtime_suspended(dev))
                 return 0;
-        return driver->resume(client);
+
+        if (pm)
+                return pm->poweroff ? pm->poweroff(dev) : 0;
+
+        return i2c_legacy_suspend(dev, PMSG_HIBERNATE);
 }
 
+static int i2c_device_pm_restore(struct device *dev)
+{
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+        int ret;
+
+        if (pm)
+                ret = pm->restore ? pm->restore(dev) : 0;
+        else
+                ret = i2c_legacy_resume(dev);
+
+        if (!ret) {
+                pm_runtime_disable(dev);
+                pm_runtime_set_active(dev);
+                pm_runtime_enable(dev);
+        }
+
+        return ret;
+}
+#else /* !CONFIG_PM_SLEEP */
+#define i2c_device_pm_suspend   NULL
+#define i2c_device_pm_resume    NULL
+#define i2c_device_pm_freeze    NULL
+#define i2c_device_pm_thaw      NULL
+#define i2c_device_pm_poweroff  NULL
+#define i2c_device_pm_restore   NULL
+#endif /* !CONFIG_PM_SLEEP */
+
 static void i2c_client_dev_release(struct device *dev)
 {
         kfree(to_i2c_client(dev));
@@ -301,9 +325,15 @@ static const struct attribute_group *i2c_dev_attr_groups[] = {
 static const struct dev_pm_ops i2c_device_pm_ops = {
         .suspend = i2c_device_pm_suspend,
         .resume = i2c_device_pm_resume,
-        .runtime_suspend = i2c_device_runtime_suspend,
-        .runtime_resume = i2c_device_runtime_resume,
-        .runtime_idle = i2c_device_runtime_idle,
+        .freeze = i2c_device_pm_freeze,
+        .thaw = i2c_device_pm_thaw,
+        .poweroff = i2c_device_pm_poweroff,
+        .restore = i2c_device_pm_restore,
+        SET_RUNTIME_PM_OPS(
+                pm_generic_runtime_suspend,
+                pm_generic_runtime_resume,
+                pm_generic_runtime_idle
+        )
 };
 
 struct bus_type i2c_bus_type = {
@@ -312,8 +342,6 @@ struct bus_type i2c_bus_type = {
         .probe          = i2c_device_probe,
         .remove         = i2c_device_remove,
         .shutdown       = i2c_device_shutdown,
-        .suspend        = i2c_device_suspend,
-        .resume         = i2c_device_resume,
         .pm             = &i2c_device_pm_ops,
 };
 EXPORT_SYMBOL_GPL(i2c_bus_type);
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index 975adce5f40c..330d2a423362 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -46,6 +46,7 @@ source "drivers/infiniband/hw/ipath/Kconfig"
 source "drivers/infiniband/hw/ehca/Kconfig"
 source "drivers/infiniband/hw/amso1100/Kconfig"
 source "drivers/infiniband/hw/cxgb3/Kconfig"
+source "drivers/infiniband/hw/cxgb4/Kconfig"
 source "drivers/infiniband/hw/mlx4/Kconfig"
 source "drivers/infiniband/hw/nes/Kconfig"
 
diff --git a/drivers/infiniband/Makefile b/drivers/infiniband/Makefile
index ed35e4496241..0c4e589d746e 100644
--- a/drivers/infiniband/Makefile
+++ b/drivers/infiniband/Makefile
@@ -4,6 +4,7 @@ obj-$(CONFIG_INFINIBAND_IPATH)		+= hw/ipath/
 obj-$(CONFIG_INFINIBAND_EHCA)           += hw/ehca/
 obj-$(CONFIG_INFINIBAND_AMSO1100)       += hw/amso1100/
 obj-$(CONFIG_INFINIBAND_CXGB3)          += hw/cxgb3/
+obj-$(CONFIG_INFINIBAND_CXGB4)          += hw/cxgb4/
 obj-$(CONFIG_MLX4_INFINIBAND)           += hw/mlx4/
 obj-$(CONFIG_INFINIBAND_NES)            += hw/nes/
 obj-$(CONFIG_INFINIBAND_IPOIB)          += ulp/ipoib/
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 6d777069d86d..b930b8110a63 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -79,7 +79,6 @@ static DEFINE_IDR(sdp_ps);
 static DEFINE_IDR(tcp_ps);
 static DEFINE_IDR(udp_ps);
 static DEFINE_IDR(ipoib_ps);
-static int next_port;
 
 struct cma_device {
         struct list_head        list;
@@ -1677,13 +1676,13 @@ int rdma_set_ib_paths(struct rdma_cm_id *id,
         if (!cma_comp_exch(id_priv, CMA_ADDR_RESOLVED, CMA_ROUTE_RESOLVED))
                 return -EINVAL;
 
-        id->route.path_rec = kmalloc(sizeof *path_rec * num_paths, GFP_KERNEL);
+        id->route.path_rec = kmemdup(path_rec, sizeof *path_rec * num_paths,
+                                     GFP_KERNEL);
         if (!id->route.path_rec) {
                 ret = -ENOMEM;
                 goto err;
         }
 
-        memcpy(id->route.path_rec, path_rec, sizeof *path_rec * num_paths);
         id->route.num_paths = num_paths;
         return 0;
 err:
@@ -1970,47 +1969,33 @@ err1:
 
 static int cma_alloc_any_port(struct idr *ps, struct rdma_id_private *id_priv)
 {
-        struct rdma_bind_list *bind_list;
-        int port, ret, low, high;
-
-        bind_list = kzalloc(sizeof *bind_list, GFP_KERNEL);
-        if (!bind_list)
-                return -ENOMEM;
-
-retry:
-        /* FIXME: add proper port randomization per like inet_csk_get_port */
-        do {
-                ret = idr_get_new_above(ps, bind_list, next_port, &port);
-        } while ((ret == -EAGAIN) && idr_pre_get(ps, GFP_KERNEL));
-
-        if (ret)
-                goto err1;
+        static unsigned int last_used_port;
+        int low, high, remaining;
+        unsigned int rover;
 
         inet_get_local_port_range(&low, &high);
-        if (port > high) {
-                if (next_port != low) {
-                        idr_remove(ps, port);
-                        next_port = low;
-                        goto retry;
-                }
-                ret = -EADDRNOTAVAIL;
-                goto err2;
+        remaining = (high - low) + 1;
+        rover = net_random() % remaining + low;
+retry:
+        if (last_used_port != rover &&
+            !idr_find(ps, (unsigned short) rover)) {
+                int ret = cma_alloc_port(ps, id_priv, rover);
+                /*
+                 * Remember previously used port number in order to avoid
+                 * re-using same port immediately after it is closed.
+                 */
+                if (!ret)
+                        last_used_port = rover;
+                if (ret != -EADDRNOTAVAIL)
+                        return ret;
         }
-
-        if (port == high)
-                next_port = low;
-        else
-                next_port = port + 1;
-
-        bind_list->ps = ps;
-        bind_list->port = (unsigned short) port;
-        cma_bind_port(bind_list, id_priv);
-        return 0;
-err2:
-        idr_remove(ps, port);
-err1:
-        kfree(bind_list);
-        return ret;
+        if (--remaining) {
+                rover++;
+                if ((rover < low) || (rover > high))
+                        rover = low;
+                goto retry;
+        }
+        return -EADDRNOTAVAIL;
 }
 
 static int cma_use_port(struct idr *ps, struct rdma_id_private *id_priv)
@@ -2995,12 +2980,7 @@ static void cma_remove_one(struct ib_device *device)
 
 static int __init cma_init(void)
 {
-        int ret, low, high, remaining;
-
-        get_random_bytes(&next_port, sizeof next_port);
-        inet_get_local_port_range(&low, &high);
-        remaining = (high - low) + 1;
-        next_port = ((unsigned int) next_port % remaining) + low;
+        int ret;
 
         cma_wq = create_singlethread_workqueue("rdma_cm");
         if (!cma_wq)
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 1df1194aeba4..6dc7b77d5d29 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -291,13 +291,11 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
         }
 
         if (mad_reg_req) {
-                reg_req = kmalloc(sizeof *reg_req, GFP_KERNEL);
+                reg_req = kmemdup(mad_reg_req, sizeof *reg_req, GFP_KERNEL);
                 if (!reg_req) {
                         ret = ERR_PTR(-ENOMEM);
                         goto error3;
                 }
-                /* Make a copy of the MAD registration request */
-                memcpy(reg_req, mad_reg_req, sizeof *reg_req);
         }
 
         /* Now, fill in the various structures */
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 512b1c43460c..46474842cfe9 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -1181,7 +1181,7 @@ static int ib_ucm_open(struct inode *inode, struct file *filp)
         file->filp = filp;
         file->device = container_of(inode->i_cdev, struct ib_ucm_device, cdev);
 
-        return 0;
+        return nonseekable_open(inode, filp);
 }
 
 static int ib_ucm_close(struct inode *inode, struct file *filp)
@@ -1229,6 +1229,7 @@ static const struct file_operations ucm_fops = {
         .release = ib_ucm_close,
         .write   = ib_ucm_write,
         .poll    = ib_ucm_poll,
+        .llseek  = no_llseek,
 };
 
 static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 46185084121e..ac7edc24165c 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1220,7 +1220,8 @@ static int ucma_open(struct inode *inode, struct file *filp)
 
         filp->private_data = file;
         file->filp = filp;
-        return 0;
+
+        return nonseekable_open(inode, filp);
 }
 
 static int ucma_close(struct inode *inode, struct file *filp)
@@ -1250,6 +1251,7 @@ static const struct file_operations ucma_fops = {
         .release = ucma_close,
         .write   = ucma_write,
         .poll    = ucma_poll,
+        .llseek  = no_llseek,
 };
 
 static struct miscdevice ucma_misc = {
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index e7db054fb1c8..6babb72b39fc 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -781,7 +781,7 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
 {
         struct ib_umad_port *port;
         struct ib_umad_file *file;
-        int ret = 0;
+        int ret;
 
         port = container_of(inode->i_cdev, struct ib_umad_port, cdev);
         if (port)
@@ -814,6 +814,8 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
 
         list_add_tail(&file->port_list, &port->file_list);
 
+        ret = nonseekable_open(inode, filp);
+
 out:
         mutex_unlock(&port->file_mutex);
         return ret;
@@ -866,7 +868,8 @@ static const struct file_operations umad_fops = {
         .compat_ioctl   = ib_umad_compat_ioctl,
 #endif
         .open           = ib_umad_open,
-        .release        = ib_umad_close
+        .release        = ib_umad_close,
+        .llseek         = no_llseek,
 };
 
 static int ib_umad_sm_open(struct inode *inode, struct file *filp)
@@ -903,7 +906,7 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp)
 
         filp->private_data = port;
 
-        return 0;
+        return nonseekable_open(inode, filp);
 
 fail:
         kref_put(&port->umad_dev->ref, ib_umad_release_dev);
@@ -933,7 +936,8 @@ static int ib_umad_sm_close(struct inode *inode, struct file *filp)
 static const struct file_operations umad_sm_fops = {
         .owner   = THIS_MODULE,
         .open    = ib_umad_sm_open,
-        .release = ib_umad_sm_close
+        .release = ib_umad_sm_close,
+        .llseek  = no_llseek,
 };
 
 static struct ib_client umad_client = {
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index fb3526254426..ec83e9fe387b 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -369,7 +369,8 @@ static const struct file_operations uverbs_event_fops = {
         .read    = ib_uverbs_event_read,
         .poll    = ib_uverbs_event_poll,
         .release = ib_uverbs_event_close,
-        .fasync  = ib_uverbs_event_fasync
+        .fasync  = ib_uverbs_event_fasync,
+        .llseek  = no_llseek,
 };
 
 void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context)
@@ -623,7 +624,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
 
         filp->private_data = file;
 
-        return 0;
+        return nonseekable_open(inode, filp);
 
 err_module:
         module_put(dev->ib_dev->owner);
@@ -651,7 +652,8 @@ static const struct file_operations uverbs_fops = {
         .owner   = THIS_MODULE,
         .write   = ib_uverbs_write,
         .open    = ib_uverbs_open,
-        .release = ib_uverbs_close
+        .release = ib_uverbs_close,
+        .llseek  = no_llseek,
 };
 
 static const struct file_operations uverbs_mmap_fops = {
@@ -659,7 +661,8 @@ static const struct file_operations uverbs_mmap_fops = {
         .write   = ib_uverbs_write,
         .mmap    = ib_uverbs_mmap,
         .open    = ib_uverbs_open,
-        .release = ib_uverbs_close
+        .release = ib_uverbs_close,
+        .llseek  = no_llseek,
 };
 
 static struct ib_client uverbs_client = {
diff --git a/drivers/infiniband/hw/amso1100/c2.h b/drivers/infiniband/hw/amso1100/c2.h
index f7ff66f98361..6ae698e68775 100644
--- a/drivers/infiniband/hw/amso1100/c2.h
+++ b/drivers/infiniband/hw/amso1100/c2.h
@@ -250,7 +250,7 @@ struct c2_array {
 struct sp_chunk {
         struct sp_chunk *next;
         dma_addr_t dma_addr;
-        DECLARE_PCI_UNMAP_ADDR(mapping);
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         u16 head;
         u16 shared_ptr[0];
 };
diff --git a/drivers/infiniband/hw/amso1100/c2_alloc.c b/drivers/infiniband/hw/amso1100/c2_alloc.c
index d4f5f5d42e90..78d247ec6961 100644
--- a/drivers/infiniband/hw/amso1100/c2_alloc.c
+++ b/drivers/infiniband/hw/amso1100/c2_alloc.c
@@ -49,7 +49,7 @@ static int c2_alloc_mqsp_chunk(struct c2_dev *c2dev, gfp_t gfp_mask,
                 return -ENOMEM;
 
         new_head->dma_addr = dma_addr;
-        pci_unmap_addr_set(new_head, mapping, new_head->dma_addr);
+        dma_unmap_addr_set(new_head, mapping, new_head->dma_addr);
 
         new_head->next = NULL;
         new_head->head = 0;
@@ -81,7 +81,7 @@ void c2_free_mqsp_pool(struct c2_dev *c2dev, struct sp_chunk *root)
         while (root) {
                 next = root->next;
                 dma_free_coherent(&c2dev->pcidev->dev, PAGE_SIZE, root,
-                                  pci_unmap_addr(root, mapping));
+                                  dma_unmap_addr(root, mapping));
                 root = next;
         }
 }
diff --git a/drivers/infiniband/hw/amso1100/c2_cq.c b/drivers/infiniband/hw/amso1100/c2_cq.c
index f7b0fc23f413..49e0e8533f74 100644
--- a/drivers/infiniband/hw/amso1100/c2_cq.c
+++ b/drivers/infiniband/hw/amso1100/c2_cq.c
@@ -257,7 +257,7 @@ int c2_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags notify_flags)
 static void c2_free_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq)
 {
         dma_free_coherent(&c2dev->pcidev->dev, mq->q_size * mq->msg_size,
-                          mq->msg_pool.host, pci_unmap_addr(mq, mapping));
+                          mq->msg_pool.host, dma_unmap_addr(mq, mapping));
 }
 
 static int c2_alloc_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq, int q_size,
@@ -278,7 +278,7 @@ static int c2_alloc_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq, int q_size,
                        NULL,    /* peer (currently unknown) */
                        C2_MQ_HOST_TARGET);
 
-        pci_unmap_addr_set(mq, mapping, mq->host_dma);
+        dma_unmap_addr_set(mq, mapping, mq->host_dma);
 
         return 0;
 }
diff --git a/drivers/infiniband/hw/amso1100/c2_mq.h b/drivers/infiniband/hw/amso1100/c2_mq.h
index acede007b94a..fc1b9a7cec4b 100644
--- a/drivers/infiniband/hw/amso1100/c2_mq.h
+++ b/drivers/infiniband/hw/amso1100/c2_mq.h
@@ -71,7 +71,7 @@ struct c2_mq {
                 u8 __iomem *adapter;
         } msg_pool;
         dma_addr_t host_dma;
-        DECLARE_PCI_UNMAP_ADDR(mapping);
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         u16 hint_count;
         u16 priv;
         struct c2_mq_shared __iomem *peer;
diff --git a/drivers/infiniband/hw/amso1100/c2_provider.h b/drivers/infiniband/hw/amso1100/c2_provider.h
index 1076df2ee96a..bf189987711f 100644
--- a/drivers/infiniband/hw/amso1100/c2_provider.h
+++ b/drivers/infiniband/hw/amso1100/c2_provider.h
@@ -50,7 +50,7 @@
 
 struct c2_buf_list {
         void *buf;
-         DECLARE_PCI_UNMAP_ADDR(mapping)
+        DEFINE_DMA_UNMAP_ADDR(mapping);
 };
 
 
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index 78c4bcc6ef60..85cfae4cad71 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -524,7 +524,7 @@ int __devinit c2_rnic_init(struct c2_dev *c2dev)
                 err = -ENOMEM;
                 goto bail1;
         }
-        pci_unmap_addr_set(&c2dev->rep_vq, mapping, c2dev->rep_vq.host_dma);
+        dma_unmap_addr_set(&c2dev->rep_vq, mapping, c2dev->rep_vq.host_dma);
         pr_debug("%s rep_vq va %p dma %llx\n", __func__, q1_pages,
                  (unsigned long long) c2dev->rep_vq.host_dma);
         c2_mq_rep_init(&c2dev->rep_vq,
@@ -545,7 +545,7 @@ int __devinit c2_rnic_init(struct c2_dev *c2dev)
                 err = -ENOMEM;
                 goto bail2;
         }
-        pci_unmap_addr_set(&c2dev->aeq, mapping, c2dev->aeq.host_dma);
+        dma_unmap_addr_set(&c2dev->aeq, mapping, c2dev->aeq.host_dma);
         pr_debug("%s aeq va %p dma %llx\n", __func__, q2_pages,
                  (unsigned long long) c2dev->aeq.host_dma);
         c2_mq_rep_init(&c2dev->aeq,
@@ -596,11 +596,11 @@ int __devinit c2_rnic_init(struct c2_dev *c2dev)
       bail3:
         dma_free_coherent(&c2dev->pcidev->dev,
                           c2dev->aeq.q_size * c2dev->aeq.msg_size,
-                          q2_pages, pci_unmap_addr(&c2dev->aeq, mapping));
+                          q2_pages, dma_unmap_addr(&c2dev->aeq, mapping));
       bail2:
         dma_free_coherent(&c2dev->pcidev->dev,
                           c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
-                          q1_pages, pci_unmap_addr(&c2dev->rep_vq, mapping));
+                          q1_pages, dma_unmap_addr(&c2dev->rep_vq, mapping));
       bail1:
         c2_free_mqsp_pool(c2dev, c2dev->kern_mqsp_pool);
       bail0:
@@ -637,13 +637,13 @@ void __devexit c2_rnic_term(struct c2_dev *c2dev)
         dma_free_coherent(&c2dev->pcidev->dev,
                           c2dev->aeq.q_size * c2dev->aeq.msg_size,
                           c2dev->aeq.msg_pool.host,
-                          pci_unmap_addr(&c2dev->aeq, mapping));
+                          dma_unmap_addr(&c2dev->aeq, mapping));
 
         /* Free the verbs reply queue */
         dma_free_coherent(&c2dev->pcidev->dev,
                           c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
                           c2dev->rep_vq.msg_pool.host,
-                          pci_unmap_addr(&c2dev->rep_vq, mapping));
+                          dma_unmap_addr(&c2dev->rep_vq, mapping));
 
         /* Free the MQ shared pointer pool */
         c2_free_mqsp_pool(c2dev, c2dev->kern_mqsp_pool);
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 35f286f1ad1e..005b7b52bc1e 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -174,7 +174,7 @@ int cxio_create_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq, int kernel)
                 kfree(cq->sw_queue);
                 return -ENOMEM;
         }
-        pci_unmap_addr_set(cq, mapping, cq->dma_addr);
+        dma_unmap_addr_set(cq, mapping, cq->dma_addr);
         memset(cq->queue, 0, size);
         setup.id = cq->cqid;
         setup.base_addr = (u64) (cq->dma_addr);
@@ -297,7 +297,7 @@ int cxio_create_qp(struct cxio_rdev *rdev_p, u32 kernel_domain,
                 goto err4;
 
         memset(wq->queue, 0, depth * sizeof(union t3_wr));
-        pci_unmap_addr_set(wq, mapping, wq->dma_addr);
+        dma_unmap_addr_set(wq, mapping, wq->dma_addr);
         wq->doorbell = (void __iomem *)rdev_p->rnic_info.kdb_addr;
         if (!kernel_domain)
                 wq->udb = (u64)rdev_p->rnic_info.udbell_physbase +
@@ -325,7 +325,7 @@ int cxio_destroy_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq)
         dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
                           (1UL << (cq->size_log2))
                           * sizeof(struct t3_cqe), cq->queue,
-                          pci_unmap_addr(cq, mapping));
+                          dma_unmap_addr(cq, mapping));
         cxio_hal_put_cqid(rdev_p->rscp, cq->cqid);
         return err;
 }
@@ -336,7 +336,7 @@ int cxio_destroy_qp(struct cxio_rdev *rdev_p, struct t3_wq *wq,
         dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
                           (1UL << (wq->size_log2))
                           * sizeof(union t3_wr), wq->queue,
-                          pci_unmap_addr(wq, mapping));
+                          dma_unmap_addr(wq, mapping));
         kfree(wq->sq);
         cxio_hal_rqtpool_free(rdev_p, wq->rq_addr, (1UL << wq->rq_size_log2));
         kfree(wq->rq);
@@ -537,7 +537,7 @@ static int cxio_hal_init_ctrl_qp(struct cxio_rdev *rdev_p)
                 err = -ENOMEM;
                 goto err;
         }
-        pci_unmap_addr_set(&rdev_p->ctrl_qp, mapping,
+        dma_unmap_addr_set(&rdev_p->ctrl_qp, mapping,
                            rdev_p->ctrl_qp.dma_addr);
         rdev_p->ctrl_qp.doorbell = (void __iomem *)rdev_p->rnic_info.kdb_addr;
         memset(rdev_p->ctrl_qp.workq, 0,
@@ -583,7 +583,7 @@ static int cxio_hal_destroy_ctrl_qp(struct cxio_rdev *rdev_p)
         dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
                           (1UL << T3_CTRL_QP_SIZE_LOG2)
                           * sizeof(union t3_wr), rdev_p->ctrl_qp.workq,
-                          pci_unmap_addr(&rdev_p->ctrl_qp, mapping));
+                          dma_unmap_addr(&rdev_p->ctrl_qp, mapping));
         return cxio_hal_clear_qp_ctx(rdev_p, T3_CTRL_QP_ID);
 }
 
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.h b/drivers/infiniband/hw/cxgb3/cxio_hal.h
index 073373c2c560..8f0caf7d4482 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.h
@@ -71,7 +71,7 @@ struct cxio_hal_ctrl_qp {
         wait_queue_head_t waitq;/* wait for RspQ/CQE msg */
         union t3_wr *workq;     /* the work request queue */
         dma_addr_t dma_addr;    /* pci bus address of the workq */
-        DECLARE_PCI_UNMAP_ADDR(mapping)
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         void __iomem *doorbell;
 };
 
diff --git a/drivers/infiniband/hw/cxgb3/cxio_wr.h b/drivers/infiniband/hw/cxgb3/cxio_wr.h
index 15073b2da1c5..e5ddb63e7d23 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_wr.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_wr.h
@@ -691,7 +691,7 @@ struct t3_swrq {
 struct t3_wq {
         union t3_wr *queue;             /* DMA accessable memory */
         dma_addr_t dma_addr;            /* DMA address for HW */
-        DECLARE_PCI_UNMAP_ADDR(mapping) /* unmap kruft */
+        DEFINE_DMA_UNMAP_ADDR(mapping); /* unmap kruft */
         u32 error;                      /* 1 once we go to ERROR */
         u32 qpid;
         u32 wptr;                       /* idx to next available WR slot */
@@ -718,7 +718,7 @@ struct t3_cq {
         u32 wptr;
         u32 size_log2;
         dma_addr_t dma_addr;
-        DECLARE_PCI_UNMAP_ADDR(mapping)
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         struct t3_cqe *queue;
         struct t3_cqe *sw_queue;
         u32 sw_rptr;
diff --git a/drivers/infiniband/hw/cxgb3/iwch.c b/drivers/infiniband/hw/cxgb3/iwch.c
index 63f975f3e30f..8e77dc543dd1 100644
--- a/drivers/infiniband/hw/cxgb3/iwch.c
+++ b/drivers/infiniband/hw/cxgb3/iwch.c
@@ -47,8 +47,6 @@ MODULE_DESCRIPTION("Chelsio T3 RDMA Driver");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(DRV_VERSION);
 
-cxgb3_cpl_handler_func t3c_handlers[NUM_CPL_CMDS];
-
 static void open_rnic_dev(struct t3cdev *);
 static void close_rnic_dev(struct t3cdev *);
 static void iwch_event_handler(struct t3cdev *, u32, u32);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 4fef03296276..ebfb117ba68b 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -102,12 +102,9 @@ static unsigned int cong_flavor = 1;
 module_param(cong_flavor, uint, 0644);
 MODULE_PARM_DESC(cong_flavor, "TCP Congestion control flavor (default=1)");
 
-static void process_work(struct work_struct *work);
 static struct workqueue_struct *workq;
-static DECLARE_WORK(skb_work, process_work);
 
 static struct sk_buff_head rxq;
-static cxgb3_cpl_handler_func work_handlers[NUM_CPL_CMDS];
 
 static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp);
 static void ep_timeout(unsigned long arg);
@@ -151,7 +148,7 @@ int iwch_l2t_send(struct t3cdev *tdev, struct sk_buff *skb, struct l2t_entry *l2
                 return -EIO;
         }
         error = l2t_send(tdev, skb, l2e);
-        if (error)
+        if (error < 0)
                 kfree_skb(skb);
         return error;
 }
@@ -167,7 +164,7 @@ int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb)
                 return -EIO;
         }
         error = cxgb3_ofld_send(tdev, skb);
-        if (error)
+        if (error < 0)
                 kfree_skb(skb);
         return error;
 }
@@ -302,27 +299,6 @@ static void release_ep_resources(struct iwch_ep *ep)
         put_ep(&ep->com);
 }
 
-static void process_work(struct work_struct *work)
-{
-        struct sk_buff *skb = NULL;
-        void *ep;
-        struct t3cdev *tdev;
-        int ret;
-
-        while ((skb = skb_dequeue(&rxq))) {
-                ep = *((void **) (skb->cb));
-                tdev = *((struct t3cdev **) (skb->cb + sizeof(void *)));
-                ret = work_handlers[G_OPCODE(ntohl((__force __be32)skb->csum))](tdev, skb, ep);
-                if (ret & CPL_RET_BUF_DONE)
-                        kfree_skb(skb);
-
-                /*
-                 * ep was referenced in sched(), and is freed here.
-                 */
-                put_ep((struct iwch_ep_common *)ep);
-        }
-}
-
 static int status2errno(int status)
 {
         switch (status) {
@@ -2157,7 +2133,49 @@ int iwch_ep_redirect(void *ctx, struct dst_entry *old, struct dst_entry *new,
 
 /*
  * All the CM events are handled on a work queue to have a safe context.
+ * These are the real handlers that are called from the work queue.
  */
+static const cxgb3_cpl_handler_func work_handlers[NUM_CPL_CMDS] = {
+        [CPL_ACT_ESTABLISH]     = act_establish,
+        [CPL_ACT_OPEN_RPL]      = act_open_rpl,
+        [CPL_RX_DATA]           = rx_data,
+        [CPL_TX_DMA_ACK]        = tx_ack,
+        [CPL_ABORT_RPL_RSS]     = abort_rpl,
+        [CPL_ABORT_RPL]         = abort_rpl,
+        [CPL_PASS_OPEN_RPL]     = pass_open_rpl,
+        [CPL_CLOSE_LISTSRV_RPL] = close_listsrv_rpl,
+        [CPL_PASS_ACCEPT_REQ]   = pass_accept_req,
+        [CPL_PASS_ESTABLISH]    = pass_establish,
+        [CPL_PEER_CLOSE]        = peer_close,
+        [CPL_ABORT_REQ_RSS]     = peer_abort,
+        [CPL_CLOSE_CON_RPL]     = close_con_rpl,
+        [CPL_RDMA_TERMINATE]    = terminate,
+        [CPL_RDMA_EC_STATUS]    = ec_status,
+};
+
+static void process_work(struct work_struct *work)
+{
+        struct sk_buff *skb = NULL;
+        void *ep;
+        struct t3cdev *tdev;
+        int ret;
+
+        while ((skb = skb_dequeue(&rxq))) {
+                ep = *((void **) (skb->cb));
+                tdev = *((struct t3cdev **) (skb->cb + sizeof(void *)));
+                ret = work_handlers[G_OPCODE(ntohl((__force __be32)skb->csum))](tdev, skb, ep);
+                if (ret & CPL_RET_BUF_DONE)
+                        kfree_skb(skb);
+
+                /*
+                 * ep was referenced in sched(), and is freed here.
+                 */
+                put_ep((struct iwch_ep_common *)ep);
+        }
+}
+
+static DECLARE_WORK(skb_work, process_work);
+
 static int sched(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
 {
         struct iwch_ep_common *epc = ctx;
@@ -2189,6 +2207,29 @@ static int set_tcb_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
         return CPL_RET_BUF_DONE;
 }
 
+/*
+ * All upcalls from the T3 Core go to sched() to schedule the
+ * processing on a work queue.
+ */
+cxgb3_cpl_handler_func t3c_handlers[NUM_CPL_CMDS] = {
+        [CPL_ACT_ESTABLISH]     = sched,
+        [CPL_ACT_OPEN_RPL]      = sched,
+        [CPL_RX_DATA]           = sched,
+        [CPL_TX_DMA_ACK]        = sched,
+        [CPL_ABORT_RPL_RSS]     = sched,
+        [CPL_ABORT_RPL]         = sched,
+        [CPL_PASS_OPEN_RPL]     = sched,
+        [CPL_CLOSE_LISTSRV_RPL] = sched,
+        [CPL_PASS_ACCEPT_REQ]   = sched,
+        [CPL_PASS_ESTABLISH]    = sched,
+        [CPL_PEER_CLOSE]        = sched,
+        [CPL_CLOSE_CON_RPL]     = sched,
+        [CPL_ABORT_REQ_RSS]     = sched,
+        [CPL_RDMA_TERMINATE]    = sched,
+        [CPL_RDMA_EC_STATUS]    = sched,
+        [CPL_SET_TCB_RPL]       = set_tcb_rpl,
+};
+
 int __init iwch_cm_init(void)
 {
         skb_queue_head_init(&rxq);
@@ -2197,46 +2238,6 @@ int __init iwch_cm_init(void)
         if (!workq)
                 return -ENOMEM;
 
-        /*
-         * All upcalls from the T3 Core go to sched() to
-         * schedule the processing on a work queue.
-         */
-        t3c_handlers[CPL_ACT_ESTABLISH] = sched;
-        t3c_handlers[CPL_ACT_OPEN_RPL] = sched;
-        t3c_handlers[CPL_RX_DATA] = sched;
-        t3c_handlers[CPL_TX_DMA_ACK] = sched;
-        t3c_handlers[CPL_ABORT_RPL_RSS] = sched;
-        t3c_handlers[CPL_ABORT_RPL] = sched;
-        t3c_handlers[CPL_PASS_OPEN_RPL] = sched;
-        t3c_handlers[CPL_CLOSE_LISTSRV_RPL] = sched;
-        t3c_handlers[CPL_PASS_ACCEPT_REQ] = sched;
-        t3c_handlers[CPL_PASS_ESTABLISH] = sched;
-        t3c_handlers[CPL_PEER_CLOSE] = sched;
-        t3c_handlers[CPL_CLOSE_CON_RPL] = sched;
-        t3c_handlers[CPL_ABORT_REQ_RSS] = sched;
-        t3c_handlers[CPL_RDMA_TERMINATE] = sched;
-        t3c_handlers[CPL_RDMA_EC_STATUS] = sched;
-        t3c_handlers[CPL_SET_TCB_RPL] = set_tcb_rpl;
-
-        /*
-         * These are the real handlers that are called from a
-         * work queue.
-         */
-        work_handlers[CPL_ACT_ESTABLISH] = act_establish;
-        work_handlers[CPL_ACT_OPEN_RPL] = act_open_rpl;
-        work_handlers[CPL_RX_DATA] = rx_data;
-        work_handlers[CPL_TX_DMA_ACK] = tx_ack;
-        work_handlers[CPL_ABORT_RPL_RSS] = abort_rpl;
-        work_handlers[CPL_ABORT_RPL] = abort_rpl;
-        work_handlers[CPL_PASS_OPEN_RPL] = pass_open_rpl;
-        work_handlers[CPL_CLOSE_LISTSRV_RPL] = close_listsrv_rpl;
-        work_handlers[CPL_PASS_ACCEPT_REQ] = pass_accept_req;
-        work_handlers[CPL_PASS_ESTABLISH] = pass_establish;
-        work_handlers[CPL_PEER_CLOSE] = peer_close;
-        work_handlers[CPL_ABORT_REQ_RSS] = peer_abort;
-        work_handlers[CPL_CLOSE_CON_RPL] = close_con_rpl;
-        work_handlers[CPL_RDMA_TERMINATE] = terminate;
-        work_handlers[CPL_RDMA_EC_STATUS] = ec_status;
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/cxgb4/Kconfig b/drivers/infiniband/hw/cxgb4/Kconfig
new file mode 100644
index 000000000000..ccb85eaaad75
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/Kconfig
@@ -0,0 +1,18 @@
+config INFINIBAND_CXGB4
+        tristate "Chelsio T4 RDMA Driver"
+        depends on CHELSIO_T4 && INET
+        select GENERIC_ALLOCATOR
+        ---help---
+          This is an iWARP/RDMA driver for the Chelsio T4 1GbE and
+          10GbE adapters.
+
+          For general information about Chelsio and our products, visit
+          our website at <http://www.chelsio.com>.
+
+          For customer support, please visit our customer support page at
+          <http://www.chelsio.com/support.htm>.
+
+          Please send feedback to <linux-bugs@chelsio.com>.
+
+          To compile this driver as a module, choose M here: the module
+          will be called iw_cxgb4.
diff --git a/drivers/infiniband/hw/cxgb4/Makefile b/drivers/infiniband/hw/cxgb4/Makefile
new file mode 100644
index 000000000000..e31a499f0172
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/Makefile
@@ -0,0 +1,5 @@
+EXTRA_CFLAGS += -Idrivers/net/cxgb4
+
+obj-$(CONFIG_INFINIBAND_CXGB4) += iw_cxgb4.o
+
+iw_cxgb4-y :=  device.o cm.o provider.o mem.o cq.o qp.o resource.o ev.o
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
new file mode 100644
index 000000000000..30ce0a8eca09
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -0,0 +1,2374 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/list.h>
+#include <linux/workqueue.h>
+#include <linux/skbuff.h>
+#include <linux/timer.h>
+#include <linux/notifier.h>
+#include <linux/inetdevice.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+
+#include <net/neighbour.h>
+#include <net/netevent.h>
+#include <net/route.h>
+
+#include "iw_cxgb4.h"
+
+static char *states[] = {
+        "idle",
+        "listen",
+        "connecting",
+        "mpa_wait_req",
+        "mpa_req_sent",
+        "mpa_req_rcvd",
+        "mpa_rep_sent",
+        "fpdu_mode",
+        "aborting",
+        "closing",
+        "moribund",
+        "dead",
+        NULL,
+};
+
+int c4iw_max_read_depth = 8;
+module_param(c4iw_max_read_depth, int, 0644);
+MODULE_PARM_DESC(c4iw_max_read_depth, "Per-connection max ORD/IRD (default=8)");
+
+static int enable_tcp_timestamps;
+module_param(enable_tcp_timestamps, int, 0644);
+MODULE_PARM_DESC(enable_tcp_timestamps, "Enable tcp timestamps (default=0)");
+
+static int enable_tcp_sack;
+module_param(enable_tcp_sack, int, 0644);
+MODULE_PARM_DESC(enable_tcp_sack, "Enable tcp SACK (default=0)");
+
+static int enable_tcp_window_scaling = 1;
+module_param(enable_tcp_window_scaling, int, 0644);
+MODULE_PARM_DESC(enable_tcp_window_scaling,
+                 "Enable tcp window scaling (default=1)");
+
+int c4iw_debug;
+module_param(c4iw_debug, int, 0644);
+MODULE_PARM_DESC(c4iw_debug, "Enable debug logging (default=0)");
+
+static int peer2peer;
+module_param(peer2peer, int, 0644);
+MODULE_PARM_DESC(peer2peer, "Support peer2peer ULPs (default=0)");
+
+static int p2p_type = FW_RI_INIT_P2PTYPE_READ_REQ;
+module_param(p2p_type, int, 0644);
+MODULE_PARM_DESC(p2p_type, "RDMAP opcode to use for the RTR message: "
+                           "1=RDMA_READ 0=RDMA_WRITE (default 1)");
+
+static int ep_timeout_secs = 60;
+module_param(ep_timeout_secs, int, 0644);
+MODULE_PARM_DESC(ep_timeout_secs, "CM Endpoint operation timeout "
+                                   "in seconds (default=60)");
+
+static int mpa_rev = 1;
+module_param(mpa_rev, int, 0644);
+MODULE_PARM_DESC(mpa_rev, "MPA Revision, 0 supports amso1100, "
+                 "1 is spec compliant. (default=1)");
+
+static int markers_enabled;
+module_param(markers_enabled, int, 0644);
+MODULE_PARM_DESC(markers_enabled, "Enable MPA MARKERS (default(0)=disabled)");
+
+static int crc_enabled = 1;
+module_param(crc_enabled, int, 0644);
+MODULE_PARM_DESC(crc_enabled, "Enable MPA CRC (default(1)=enabled)");
+
+static int rcv_win = 256 * 1024;
+module_param(rcv_win, int, 0644);
+MODULE_PARM_DESC(rcv_win, "TCP receive window in bytes (default=256KB)");
+
+static int snd_win = 32 * 1024;
+module_param(snd_win, int, 0644);
+MODULE_PARM_DESC(snd_win, "TCP send window in bytes (default=32KB)");
+
+static struct workqueue_struct *workq;
+
+static struct sk_buff_head rxq;
+
+static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp);
+static void ep_timeout(unsigned long arg);
+static void connect_reply_upcall(struct c4iw_ep *ep, int status);
+
+static LIST_HEAD(timeout_list);
+static spinlock_t timeout_lock;
+
+static void start_ep_timer(struct c4iw_ep *ep)
+{
+        PDBG("%s ep %p\n", __func__, ep);
+        if (timer_pending(&ep->timer)) {
+                PDBG("%s stopped / restarted timer ep %p\n", __func__, ep);
+                del_timer_sync(&ep->timer);
+        } else
+                c4iw_get_ep(&ep->com);
+        ep->timer.expires = jiffies + ep_timeout_secs * HZ;
+        ep->timer.data = (unsigned long)ep;
+        ep->timer.function = ep_timeout;
+        add_timer(&ep->timer);
+}
+
+static void stop_ep_timer(struct c4iw_ep *ep)
+{
+        PDBG("%s ep %p\n", __func__, ep);
+        if (!timer_pending(&ep->timer)) {
+                printk(KERN_ERR "%s timer stopped when its not running! "
+                       "ep %p state %u\n", __func__, ep, ep->com.state);
+                WARN_ON(1);
+                return;
+        }
+        del_timer_sync(&ep->timer);
+        c4iw_put_ep(&ep->com);
+}
+
+static int c4iw_l2t_send(struct c4iw_rdev *rdev, struct sk_buff *skb,
+                  struct l2t_entry *l2e)
+{
+        int     error = 0;
+
+        if (c4iw_fatal_error(rdev)) {
+                kfree_skb(skb);
+                PDBG("%s - device in error state - dropping\n", __func__);
+                return -EIO;
+        }
+        error = cxgb4_l2t_send(rdev->lldi.ports[0], skb, l2e);
+        if (error < 0)
+                kfree_skb(skb);
+        return error;
+}
+
+int c4iw_ofld_send(struct c4iw_rdev *rdev, struct sk_buff *skb)
+{
+        int     error = 0;
+
+        if (c4iw_fatal_error(rdev)) {
+                kfree_skb(skb);
+                PDBG("%s - device in error state - dropping\n", __func__);
+                return -EIO;
+        }
+        error = cxgb4_ofld_send(rdev->lldi.ports[0], skb);
+        if (error < 0)
+                kfree_skb(skb);
+        return error;
+}
+
+static void release_tid(struct c4iw_rdev *rdev, u32 hwtid, struct sk_buff *skb)
+{
+        struct cpl_tid_release *req;
+
+        skb = get_skb(skb, sizeof *req, GFP_KERNEL);
+        if (!skb)
+                return;
+        req = (struct cpl_tid_release *) skb_put(skb, sizeof(*req));
+        INIT_TP_WR(req, hwtid);
+        OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_TID_RELEASE, hwtid));
+        set_wr_txq(skb, CPL_PRIORITY_SETUP, 0);
+        c4iw_ofld_send(rdev, skb);
+        return;
+}
+
+static void set_emss(struct c4iw_ep *ep, u16 opt)
+{
+        ep->emss = ep->com.dev->rdev.lldi.mtus[GET_TCPOPT_MSS(opt)] - 40;
+        ep->mss = ep->emss;
+        if (GET_TCPOPT_TSTAMP(opt))
+                ep->emss -= 12;
+        if (ep->emss < 128)
+                ep->emss = 128;
+        PDBG("%s mss_idx %u mss %u emss=%u\n", __func__, GET_TCPOPT_MSS(opt),
+             ep->mss, ep->emss);
+}
+
+static enum c4iw_ep_state state_read(struct c4iw_ep_common *epc)
+{
+        unsigned long flags;
+        enum c4iw_ep_state state;
+
+        spin_lock_irqsave(&epc->lock, flags);
+        state = epc->state;
+        spin_unlock_irqrestore(&epc->lock, flags);
+        return state;
+}
+
+static void __state_set(struct c4iw_ep_common *epc, enum c4iw_ep_state new)
+{
+        epc->state = new;
+}
+
+static void state_set(struct c4iw_ep_common *epc, enum c4iw_ep_state new)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&epc->lock, flags);
+        PDBG("%s - %s -> %s\n", __func__, states[epc->state], states[new]);
+        __state_set(epc, new);
+        spin_unlock_irqrestore(&epc->lock, flags);
+        return;
+}
+
+static void *alloc_ep(int size, gfp_t gfp)
+{
+        struct c4iw_ep_common *epc;
+
+        epc = kzalloc(size, gfp);
+        if (epc) {
+                kref_init(&epc->kref);
+                spin_lock_init(&epc->lock);
+                init_waitqueue_head(&epc->waitq);
+        }
+        PDBG("%s alloc ep %p\n", __func__, epc);
+        return epc;
+}
+
+void _c4iw_free_ep(struct kref *kref)
+{
+        struct c4iw_ep *ep;
+
+        ep = container_of(kref, struct c4iw_ep, com.kref);
+        PDBG("%s ep %p state %s\n", __func__, ep, states[state_read(&ep->com)]);
+        if (test_bit(RELEASE_RESOURCES, &ep->com.flags)) {
+                cxgb4_remove_tid(ep->com.dev->rdev.lldi.tids, 0, ep->hwtid);
+                dst_release(ep->dst);
+                cxgb4_l2t_release(ep->l2t);
+        }
+        kfree(ep);
+}
+
+static void release_ep_resources(struct c4iw_ep *ep)
+{
+        set_bit(RELEASE_RESOURCES, &ep->com.flags);
+        c4iw_put_ep(&ep->com);
+}
+
+static int status2errno(int status)
+{
+        switch (status) {
+        case CPL_ERR_NONE:
+                return 0;
+        case CPL_ERR_CONN_RESET:
+                return -ECONNRESET;
+        case CPL_ERR_ARP_MISS:
+                return -EHOSTUNREACH;
+        case CPL_ERR_CONN_TIMEDOUT:
+                return -ETIMEDOUT;
+        case CPL_ERR_TCAM_FULL:
+                return -ENOMEM;
+        case CPL_ERR_CONN_EXIST:
+                return -EADDRINUSE;
+        default:
+                return -EIO;
+        }
+}
+
+/*
+ * Try and reuse skbs already allocated...
+ */
+static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp)
+{
+        if (skb && !skb_is_nonlinear(skb) && !skb_cloned(skb)) {
+                skb_trim(skb, 0);
+                skb_get(skb);
+                skb_reset_transport_header(skb);
+        } else {
+                skb = alloc_skb(len, gfp);
+        }
+        return skb;
+}
+
+static struct rtable *find_route(struct c4iw_dev *dev, __be32 local_ip,
+                                 __be32 peer_ip, __be16 local_port,
+                                 __be16 peer_port, u8 tos)
+{
+        struct rtable *rt;
+        struct flowi fl = {
+                .oif = 0,
+                .nl_u = {
+                         .ip4_u = {
+                                   .daddr = peer_ip,
+                                   .saddr = local_ip,
+                                   .tos = tos}
+                         },
+                .proto = IPPROTO_TCP,
+                .uli_u = {
+                          .ports = {
+                                    .sport = local_port,
+                                    .dport = peer_port}
+                          }
+        };
+
+        if (ip_route_output_flow(&init_net, &rt, &fl, NULL, 0))
+                return NULL;
+        return rt;
+}
+
+static void arp_failure_discard(void *handle, struct sk_buff *skb)
+{
+        PDBG("%s c4iw_dev %p\n", __func__, handle);
+        kfree_skb(skb);
+}
+
+/*
+ * Handle an ARP failure for an active open.
+ */
+static void act_open_req_arp_failure(void *handle, struct sk_buff *skb)
+{
+        printk(KERN_ERR MOD "ARP failure duing connect\n");
+        kfree_skb(skb);
+}
+
+/*
+ * Handle an ARP failure for a CPL_ABORT_REQ.  Change it into a no RST variant
+ * and send it along.
+ */
+static void abort_arp_failure(void *handle, struct sk_buff *skb)
+{
+        struct c4iw_rdev *rdev = handle;
+        struct cpl_abort_req *req = cplhdr(skb);
+
+        PDBG("%s rdev %p\n", __func__, rdev);
+        req->cmd = CPL_ABORT_NO_RST;
+        c4iw_ofld_send(rdev, skb);
+}
+
+static void send_flowc(struct c4iw_ep *ep, struct sk_buff *skb)
+{
+        unsigned int flowclen = 80;
+        struct fw_flowc_wr *flowc;
+        int i;
+
+        skb = get_skb(skb, flowclen, GFP_KERNEL);
+        flowc = (struct fw_flowc_wr *)__skb_put(skb, flowclen);
+
+        flowc->op_to_nparams = cpu_to_be32(FW_WR_OP(FW_FLOWC_WR) |
+                                           FW_FLOWC_WR_NPARAMS(8));
+        flowc->flowid_len16 = cpu_to_be32(FW_WR_LEN16(DIV_ROUND_UP(flowclen,
+                                          16)) | FW_WR_FLOWID(ep->hwtid));
+
+        flowc->mnemval[0].mnemonic = FW_FLOWC_MNEM_PFNVFN;
+        flowc->mnemval[0].val = cpu_to_be32(0);
+        flowc->mnemval[1].mnemonic = FW_FLOWC_MNEM_CH;
+        flowc->mnemval[1].val = cpu_to_be32(ep->tx_chan);
+        flowc->mnemval[2].mnemonic = FW_FLOWC_MNEM_PORT;
+        flowc->mnemval[2].val = cpu_to_be32(ep->tx_chan);
+        flowc->mnemval[3].mnemonic = FW_FLOWC_MNEM_IQID;
+        flowc->mnemval[3].val = cpu_to_be32(ep->rss_qid);
+        flowc->mnemval[4].mnemonic = FW_FLOWC_MNEM_SNDNXT;
+        flowc->mnemval[4].val = cpu_to_be32(ep->snd_seq);
+        flowc->mnemval[5].mnemonic = FW_FLOWC_MNEM_RCVNXT;
+        flowc->mnemval[5].val = cpu_to_be32(ep->rcv_seq);
+        flowc->mnemval[6].mnemonic = FW_FLOWC_MNEM_SNDBUF;
+        flowc->mnemval[6].val = cpu_to_be32(snd_win);
+        flowc->mnemval[7].mnemonic = FW_FLOWC_MNEM_MSS;
+        flowc->mnemval[7].val = cpu_to_be32(ep->emss);
+        /* Pad WR to 16 byte boundary */
+        flowc->mnemval[8].mnemonic = 0;
+        flowc->mnemval[8].val = 0;
+        for (i = 0; i < 9; i++) {
+                flowc->mnemval[i].r4[0] = 0;
+                flowc->mnemval[i].r4[1] = 0;
+                flowc->mnemval[i].r4[2] = 0;
+        }
+
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+        c4iw_ofld_send(&ep->com.dev->rdev, skb);
+}
+
+static int send_halfclose(struct c4iw_ep *ep, gfp_t gfp)
+{
+        struct cpl_close_con_req *req;
+        struct sk_buff *skb;
+        int wrlen = roundup(sizeof *req, 16);
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        skb = get_skb(NULL, wrlen, gfp);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb\n", __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+        t4_set_arp_err_handler(skb, NULL, arp_failure_discard);
+        req = (struct cpl_close_con_req *) skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        INIT_TP_WR(req, ep->hwtid);
+        OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_CLOSE_CON_REQ,
+                                                    ep->hwtid));
+        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+}
+
+static int send_abort(struct c4iw_ep *ep, struct sk_buff *skb, gfp_t gfp)
+{
+        struct cpl_abort_req *req;
+        int wrlen = roundup(sizeof *req, 16);
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        skb = get_skb(skb, wrlen, gfp);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb.\n",
+                       __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+        t4_set_arp_err_handler(skb, &ep->com.dev->rdev, abort_arp_failure);
+        req = (struct cpl_abort_req *) skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        INIT_TP_WR(req, ep->hwtid);
+        OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_ABORT_REQ, ep->hwtid));
+        req->cmd = CPL_ABORT_SEND_RST;
+        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+}
+
+static int send_connect(struct c4iw_ep *ep)
+{
+        struct cpl_act_open_req *req;
+        struct sk_buff *skb;
+        u64 opt0;
+        u32 opt2;
+        unsigned int mtu_idx;
+        int wscale;
+        int wrlen = roundup(sizeof *req, 16);
+
+        PDBG("%s ep %p atid %u\n", __func__, ep, ep->atid);
+
+        skb = get_skb(NULL, wrlen, GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb.\n",
+                       __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_SETUP, ep->txq_idx);
+
+        cxgb4_best_mtu(ep->com.dev->rdev.lldi.mtus, ep->mtu, &mtu_idx);
+        wscale = compute_wscale(rcv_win);
+        opt0 = KEEP_ALIVE(1) |
+               WND_SCALE(wscale) |
+               MSS_IDX(mtu_idx) |
+               L2T_IDX(ep->l2t->idx) |
+               TX_CHAN(ep->tx_chan) |
+               SMAC_SEL(ep->smac_idx) |
+               DSCP(ep->tos) |
+               RCV_BUFSIZ(rcv_win>>10);
+        opt2 = RX_CHANNEL(0) |
+               RSS_QUEUE_VALID | RSS_QUEUE(ep->rss_qid);
+        if (enable_tcp_timestamps)
+                opt2 |= TSTAMPS_EN(1);
+        if (enable_tcp_sack)
+                opt2 |= SACK_EN(1);
+        if (wscale && enable_tcp_window_scaling)
+                opt2 |= WND_SCALE_EN(1);
+        t4_set_arp_err_handler(skb, NULL, act_open_req_arp_failure);
+
+        req = (struct cpl_act_open_req *) skb_put(skb, wrlen);
+        INIT_TP_WR(req, 0);
+        OPCODE_TID(req) = cpu_to_be32(
+                MK_OPCODE_TID(CPL_ACT_OPEN_REQ, ((ep->rss_qid<<14)|ep->atid)));
+        req->local_port = ep->com.local_addr.sin_port;
+        req->peer_port = ep->com.remote_addr.sin_port;
+        req->local_ip = ep->com.local_addr.sin_addr.s_addr;
+        req->peer_ip = ep->com.remote_addr.sin_addr.s_addr;
+        req->opt0 = cpu_to_be64(opt0);
+        req->params = 0;
+        req->opt2 = cpu_to_be32(opt2);
+        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+}
+
+static void send_mpa_req(struct c4iw_ep *ep, struct sk_buff *skb)
+{
+        int mpalen, wrlen;
+        struct fw_ofld_tx_data_wr *req;
+        struct mpa_message *mpa;
+
+        PDBG("%s ep %p tid %u pd_len %d\n", __func__, ep, ep->hwtid, ep->plen);
+
+        BUG_ON(skb_cloned(skb));
+
+        mpalen = sizeof(*mpa) + ep->plen;
+        wrlen = roundup(mpalen + sizeof *req, 16);
+        skb = get_skb(skb, wrlen, GFP_KERNEL);
+        if (!skb) {
+                connect_reply_upcall(ep, -ENOMEM);
+                return;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+
+        req = (struct fw_ofld_tx_data_wr *)skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        req->op_to_immdlen = cpu_to_be32(
+                FW_WR_OP(FW_OFLD_TX_DATA_WR) |
+                FW_WR_COMPL(1) |
+                FW_WR_IMMDLEN(mpalen));
+        req->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(ep->hwtid) |
+                FW_WR_LEN16(wrlen >> 4));
+        req->plen = cpu_to_be32(mpalen);
+        req->tunnel_to_proxy = cpu_to_be32(
+                FW_OFLD_TX_DATA_WR_FLUSH(1) |
+                FW_OFLD_TX_DATA_WR_SHOVE(1));
+
+        mpa = (struct mpa_message *)(req + 1);
+        memcpy(mpa->key, MPA_KEY_REQ, sizeof(mpa->key));
+        mpa->flags = (crc_enabled ? MPA_CRC : 0) |
+                     (markers_enabled ? MPA_MARKERS : 0);
+        mpa->private_data_size = htons(ep->plen);
+        mpa->revision = mpa_rev;
+
+        if (ep->plen)
+                memcpy(mpa->private_data, ep->mpa_pkt + sizeof(*mpa), ep->plen);
+
+        /*
+         * Reference the mpa skb.  This ensures the data area
+         * will remain in memory until the hw acks the tx.
+         * Function fw4_ack() will deref it.
+         */
+        skb_get(skb);
+        t4_set_arp_err_handler(skb, NULL, arp_failure_discard);
+        BUG_ON(ep->mpa_skb);
+        ep->mpa_skb = skb;
+        c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+        start_ep_timer(ep);
+        state_set(&ep->com, MPA_REQ_SENT);
+        ep->mpa_attr.initiator = 1;
+        return;
+}
+
+static int send_mpa_reject(struct c4iw_ep *ep, const void *pdata, u8 plen)
+{
+        int mpalen, wrlen;
+        struct fw_ofld_tx_data_wr *req;
+        struct mpa_message *mpa;
+        struct sk_buff *skb;
+
+        PDBG("%s ep %p tid %u pd_len %d\n", __func__, ep, ep->hwtid, ep->plen);
+
+        mpalen = sizeof(*mpa) + plen;
+        wrlen = roundup(mpalen + sizeof *req, 16);
+
+        skb = get_skb(NULL, wrlen, GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - cannot alloc skb!\n", __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+
+        req = (struct fw_ofld_tx_data_wr *)skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        req->op_to_immdlen = cpu_to_be32(
+                FW_WR_OP(FW_OFLD_TX_DATA_WR) |
+                FW_WR_COMPL(1) |
+                FW_WR_IMMDLEN(mpalen));
+        req->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(ep->hwtid) |
+                FW_WR_LEN16(wrlen >> 4));
+        req->plen = cpu_to_be32(mpalen);
+        req->tunnel_to_proxy = cpu_to_be32(
+                FW_OFLD_TX_DATA_WR_FLUSH(1) |
+                FW_OFLD_TX_DATA_WR_SHOVE(1));
+
+        mpa = (struct mpa_message *)(req + 1);
+        memset(mpa, 0, sizeof(*mpa));
+        memcpy(mpa->key, MPA_KEY_REP, sizeof(mpa->key));
+        mpa->flags = MPA_REJECT;
+        mpa->revision = mpa_rev;
+        mpa->private_data_size = htons(plen);
+        if (plen)
+                memcpy(mpa->private_data, pdata, plen);
+
+        /*
+         * Reference the mpa skb again.  This ensures the data area
+         * will remain in memory until the hw acks the tx.
+         * Function fw4_ack() will deref it.
+         */
+        skb_get(skb);
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+        t4_set_arp_err_handler(skb, NULL, arp_failure_discard);
+        BUG_ON(ep->mpa_skb);
+        ep->mpa_skb = skb;
+        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+}
+
+static int send_mpa_reply(struct c4iw_ep *ep, const void *pdata, u8 plen)
+{
+        int mpalen, wrlen;
+        struct fw_ofld_tx_data_wr *req;
+        struct mpa_message *mpa;
+        struct sk_buff *skb;
+
+        PDBG("%s ep %p tid %u pd_len %d\n", __func__, ep, ep->hwtid, ep->plen);
+
+        mpalen = sizeof(*mpa) + plen;
+        wrlen = roundup(mpalen + sizeof *req, 16);
+
+        skb = get_skb(NULL, wrlen, GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - cannot alloc skb!\n", __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+
+        req = (struct fw_ofld_tx_data_wr *) skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        req->op_to_immdlen = cpu_to_be32(
+                FW_WR_OP(FW_OFLD_TX_DATA_WR) |
+                FW_WR_COMPL(1) |
+                FW_WR_IMMDLEN(mpalen));
+        req->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(ep->hwtid) |
+                FW_WR_LEN16(wrlen >> 4));
+        req->plen = cpu_to_be32(mpalen);
+        req->tunnel_to_proxy = cpu_to_be32(
+                FW_OFLD_TX_DATA_WR_FLUSH(1) |
+                FW_OFLD_TX_DATA_WR_SHOVE(1));
+
+        mpa = (struct mpa_message *)(req + 1);
+        memset(mpa, 0, sizeof(*mpa));
+        memcpy(mpa->key, MPA_KEY_REP, sizeof(mpa->key));
+        mpa->flags = (ep->mpa_attr.crc_enabled ? MPA_CRC : 0) |
+                     (markers_enabled ? MPA_MARKERS : 0);
+        mpa->revision = mpa_rev;
+        mpa->private_data_size = htons(plen);
+        if (plen)
+                memcpy(mpa->private_data, pdata, plen);
+
+        /*
+         * Reference the mpa skb.  This ensures the data area
+         * will remain in memory until the hw acks the tx.
+         * Function fw4_ack() will deref it.
+         */
+        skb_get(skb);
+        t4_set_arp_err_handler(skb, NULL, arp_failure_discard);
+        ep->mpa_skb = skb;
+        state_set(&ep->com, MPA_REP_SENT);
+        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+}
+
+static int act_establish(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_act_establish *req = cplhdr(skb);
+        unsigned int tid = GET_TID(req);
+        unsigned int atid = GET_TID_TID(ntohl(req->tos_atid));
+        struct tid_info *t = dev->rdev.lldi.tids;
+
+        ep = lookup_atid(t, atid);
+
+        PDBG("%s ep %p tid %u snd_isn %u rcv_isn %u\n", __func__, ep, tid,
+             be32_to_cpu(req->snd_isn), be32_to_cpu(req->rcv_isn));
+
+        dst_confirm(ep->dst);
+
+        /* setup the hwtid for this connection */
+        ep->hwtid = tid;
+        cxgb4_insert_tid(t, ep, tid);
+
+        ep->snd_seq = be32_to_cpu(req->snd_isn);
+        ep->rcv_seq = be32_to_cpu(req->rcv_isn);
+
+        set_emss(ep, ntohs(req->tcp_opt));
+
+        /* dealloc the atid */
+        cxgb4_free_atid(t, atid);
+
+        /* start MPA negotiation */
+        send_flowc(ep, NULL);
+        send_mpa_req(ep, skb);
+
+        return 0;
+}
+
+static void close_complete_upcall(struct c4iw_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CLOSE;
+        if (ep->com.cm_id) {
+                PDBG("close complete delivered ep %p cm_id %p tid %u\n",
+                     ep, ep->com.cm_id, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+                ep->com.cm_id->rem_ref(ep->com.cm_id);
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+        }
+}
+
+static int abort_connection(struct c4iw_ep *ep, struct sk_buff *skb, gfp_t gfp)
+{
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        close_complete_upcall(ep);
+        state_set(&ep->com, ABORTING);
+        return send_abort(ep, skb, gfp);
+}
+
+static void peer_close_upcall(struct c4iw_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_DISCONNECT;
+        if (ep->com.cm_id) {
+                PDBG("peer close delivered ep %p cm_id %p tid %u\n",
+                     ep, ep->com.cm_id, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+        }
+}
+
+static void peer_abort_upcall(struct c4iw_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CLOSE;
+        event.status = -ECONNRESET;
+        if (ep->com.cm_id) {
+                PDBG("abort delivered ep %p cm_id %p tid %u\n", ep,
+                     ep->com.cm_id, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+                ep->com.cm_id->rem_ref(ep->com.cm_id);
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+        }
+}
+
+static void connect_reply_upcall(struct c4iw_ep *ep, int status)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u status %d\n", __func__, ep, ep->hwtid, status);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CONNECT_REPLY;
+        event.status = status;
+        event.local_addr = ep->com.local_addr;
+        event.remote_addr = ep->com.remote_addr;
+
+        if ((status == 0) || (status == -ECONNREFUSED)) {
+                event.private_data_len = ep->plen;
+                event.private_data = ep->mpa_pkt + sizeof(struct mpa_message);
+        }
+        if (ep->com.cm_id) {
+                PDBG("%s ep %p tid %u status %d\n", __func__, ep,
+                     ep->hwtid, status);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+        }
+        if (status < 0) {
+                ep->com.cm_id->rem_ref(ep->com.cm_id);
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+        }
+}
+
+static void connect_request_upcall(struct c4iw_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CONNECT_REQUEST;
+        event.local_addr = ep->com.local_addr;
+        event.remote_addr = ep->com.remote_addr;
+        event.private_data_len = ep->plen;
+        event.private_data = ep->mpa_pkt + sizeof(struct mpa_message);
+        event.provider_data = ep;
+        if (state_read(&ep->parent_ep->com) != DEAD) {
+                c4iw_get_ep(&ep->com);
+                ep->parent_ep->com.cm_id->event_handler(
+                                                ep->parent_ep->com.cm_id,
+                                                &event);
+        }
+        c4iw_put_ep(&ep->parent_ep->com);
+        ep->parent_ep = NULL;
+}
+
+static void established_upcall(struct c4iw_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_ESTABLISHED;
+        if (ep->com.cm_id) {
+                PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+        }
+}
+
+static int update_rx_credits(struct c4iw_ep *ep, u32 credits)
+{
+        struct cpl_rx_data_ack *req;
+        struct sk_buff *skb;
+        int wrlen = roundup(sizeof *req, 16);
+
+        PDBG("%s ep %p tid %u credits %u\n", __func__, ep, ep->hwtid, credits);
+        skb = get_skb(NULL, wrlen, GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "update_rx_credits - cannot alloc skb!\n");
+                return 0;
+        }
+
+        req = (struct cpl_rx_data_ack *) skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        INIT_TP_WR(req, ep->hwtid);
+        OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_RX_DATA_ACK,
+                                                    ep->hwtid));
+        req->credit_dack = cpu_to_be32(credits);
+        set_wr_txq(skb, CPL_PRIORITY_ACK, ep->txq_idx);
+        c4iw_ofld_send(&ep->com.dev->rdev, skb);
+        return credits;
+}
+
+static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
+{
+        struct mpa_message *mpa;
+        u16 plen;
+        struct c4iw_qp_attributes attrs;
+        enum c4iw_qp_attr_mask mask;
+        int err;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+
+        /*
+         * Stop mpa timer.  If it expired, then the state has
+         * changed and we bail since ep_timeout already aborted
+         * the connection.
+         */
+        stop_ep_timer(ep);
+        if (state_read(&ep->com) != MPA_REQ_SENT)
+                return;
+
+        /*
+         * If we get more than the supported amount of private data
+         * then we must fail this connection.
+         */
+        if (ep->mpa_pkt_len + skb->len > sizeof(ep->mpa_pkt)) {
+                err = -EINVAL;
+                goto err;
+        }
+
+        /*
+         * copy the new data into our accumulation buffer.
+         */
+        skb_copy_from_linear_data(skb, &(ep->mpa_pkt[ep->mpa_pkt_len]),
+                                  skb->len);
+        ep->mpa_pkt_len += skb->len;
+
+        /*
+         * if we don't even have the mpa message, then bail.
+         */
+        if (ep->mpa_pkt_len < sizeof(*mpa))
+                return;
+        mpa = (struct mpa_message *) ep->mpa_pkt;
+
+        /* Validate MPA header. */
+        if (mpa->revision != mpa_rev) {
+                err = -EPROTO;
+                goto err;
+        }
+        if (memcmp(mpa->key, MPA_KEY_REP, sizeof(mpa->key))) {
+                err = -EPROTO;
+                goto err;
+        }
+
+        plen = ntohs(mpa->private_data_size);
+
+        /*
+         * Fail if there's too much private data.
+         */
+        if (plen > MPA_MAX_PRIVATE_DATA) {
+                err = -EPROTO;
+                goto err;
+        }
+
+        /*
+         * If plen does not account for pkt size
+         */
+        if (ep->mpa_pkt_len > (sizeof(*mpa) + plen)) {
+                err = -EPROTO;
+                goto err;
+        }
+
+        ep->plen = (u8) plen;
+
+        /*
+         * If we don't have all the pdata yet, then bail.
+         * We'll continue process when more data arrives.
+         */
+        if (ep->mpa_pkt_len < (sizeof(*mpa) + plen))
+                return;
+
+        if (mpa->flags & MPA_REJECT) {
+                err = -ECONNREFUSED;
+                goto err;
+        }
+
+        /*
+         * If we get here we have accumulated the entire mpa
+         * start reply message including private data. And
+         * the MPA header is valid.
+         */
+        state_set(&ep->com, FPDU_MODE);
+        ep->mpa_attr.crc_enabled = (mpa->flags & MPA_CRC) | crc_enabled ? 1 : 0;
+        ep->mpa_attr.recv_marker_enabled = markers_enabled;
+        ep->mpa_attr.xmit_marker_enabled = mpa->flags & MPA_MARKERS ? 1 : 0;
+        ep->mpa_attr.version = mpa_rev;
+        ep->mpa_attr.p2p_type = peer2peer ? p2p_type :
+                                            FW_RI_INIT_P2PTYPE_DISABLED;
+        PDBG("%s - crc_enabled=%d, recv_marker_enabled=%d, "
+             "xmit_marker_enabled=%d, version=%d\n", __func__,
+             ep->mpa_attr.crc_enabled, ep->mpa_attr.recv_marker_enabled,
+             ep->mpa_attr.xmit_marker_enabled, ep->mpa_attr.version);
+
+        attrs.mpa_attr = ep->mpa_attr;
+        attrs.max_ird = ep->ird;
+        attrs.max_ord = ep->ord;
+        attrs.llp_stream_handle = ep;
+        attrs.next_state = C4IW_QP_STATE_RTS;
+
+        mask = C4IW_QP_ATTR_NEXT_STATE |
+            C4IW_QP_ATTR_LLP_STREAM_HANDLE | C4IW_QP_ATTR_MPA_ATTR |
+            C4IW_QP_ATTR_MAX_IRD | C4IW_QP_ATTR_MAX_ORD;
+
+        /* bind QP and TID with INIT_WR */
+        err = c4iw_modify_qp(ep->com.qp->rhp,
+                             ep->com.qp, mask, &attrs, 1);
+        if (err)
+                goto err;
+        goto out;
+err:
+        abort_connection(ep, skb, GFP_KERNEL);
+out:
+        connect_reply_upcall(ep, err);
+        return;
+}
+
+static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
+{
+        struct mpa_message *mpa;
+        u16 plen;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+
+        if (state_read(&ep->com) != MPA_REQ_WAIT)
+                return;
+
+        /*
+         * If we get more than the supported amount of private data
+         * then we must fail this connection.
+         */
+        if (ep->mpa_pkt_len + skb->len > sizeof(ep->mpa_pkt)) {
+                stop_ep_timer(ep);
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        PDBG("%s enter (%s line %u)\n", __func__, __FILE__, __LINE__);
+
+        /*
+         * Copy the new data into our accumulation buffer.
+         */
+        skb_copy_from_linear_data(skb, &(ep->mpa_pkt[ep->mpa_pkt_len]),
+                                  skb->len);
+        ep->mpa_pkt_len += skb->len;
+
+        /*
+         * If we don't even have the mpa message, then bail.
+         * We'll continue process when more data arrives.
+         */
+        if (ep->mpa_pkt_len < sizeof(*mpa))
+                return;
+
+        PDBG("%s enter (%s line %u)\n", __func__, __FILE__, __LINE__);
+        stop_ep_timer(ep);
+        mpa = (struct mpa_message *) ep->mpa_pkt;
+
+        /*
+         * Validate MPA Header.
+         */
+        if (mpa->revision != mpa_rev) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        if (memcmp(mpa->key, MPA_KEY_REQ, sizeof(mpa->key))) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        plen = ntohs(mpa->private_data_size);
+
+        /*
+         * Fail if there's too much private data.
+         */
+        if (plen > MPA_MAX_PRIVATE_DATA) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        /*
+         * If plen does not account for pkt size
+         */
+        if (ep->mpa_pkt_len > (sizeof(*mpa) + plen)) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+        ep->plen = (u8) plen;
+
+        /*
+         * If we don't have all the pdata yet, then bail.
+         */
+        if (ep->mpa_pkt_len < (sizeof(*mpa) + plen))
+                return;
+
+        /*
+         * If we get here we have accumulated the entire mpa
+         * start reply message including private data.
+         */
+        ep->mpa_attr.initiator = 0;
+        ep->mpa_attr.crc_enabled = (mpa->flags & MPA_CRC) | crc_enabled ? 1 : 0;
+        ep->mpa_attr.recv_marker_enabled = markers_enabled;
+        ep->mpa_attr.xmit_marker_enabled = mpa->flags & MPA_MARKERS ? 1 : 0;
+        ep->mpa_attr.version = mpa_rev;
+        ep->mpa_attr.p2p_type = peer2peer ? p2p_type :
+                                            FW_RI_INIT_P2PTYPE_DISABLED;
+        PDBG("%s - crc_enabled=%d, recv_marker_enabled=%d, "
+             "xmit_marker_enabled=%d, version=%d p2p_type=%d\n", __func__,
+             ep->mpa_attr.crc_enabled, ep->mpa_attr.recv_marker_enabled,
+             ep->mpa_attr.xmit_marker_enabled, ep->mpa_attr.version,
+             ep->mpa_attr.p2p_type);
+
+        state_set(&ep->com, MPA_REQ_RCVD);
+
+        /* drive upcall */
+        connect_request_upcall(ep);
+        return;
+}
+
+static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_rx_data *hdr = cplhdr(skb);
+        unsigned int dlen = ntohs(hdr->len);
+        unsigned int tid = GET_TID(hdr);
+        struct tid_info *t = dev->rdev.lldi.tids;
+
+        ep = lookup_tid(t, tid);
+        PDBG("%s ep %p tid %u dlen %u\n", __func__, ep, ep->hwtid, dlen);
+        skb_pull(skb, sizeof(*hdr));
+        skb_trim(skb, dlen);
+
+        ep->rcv_seq += dlen;
+        BUG_ON(ep->rcv_seq != (ntohl(hdr->seq) + dlen));
+
+        /* update RX credits */
+        update_rx_credits(ep, dlen);
+
+        switch (state_read(&ep->com)) {
+        case MPA_REQ_SENT:
+                process_mpa_reply(ep, skb);
+                break;
+        case MPA_REQ_WAIT:
+                process_mpa_request(ep, skb);
+                break;
+        case MPA_REP_SENT:
+                break;
+        default:
+                printk(KERN_ERR MOD "%s Unexpected streaming data."
+                       " ep %p state %d tid %u\n",
+                       __func__, ep, state_read(&ep->com), ep->hwtid);
+
+                /*
+                 * The ep will timeout and inform the ULP of the failure.
+                 * See ep_timeout().
+                 */
+                break;
+        }
+        return 0;
+}
+
+static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_abort_rpl_rss *rpl = cplhdr(skb);
+        unsigned long flags;
+        int release = 0;
+        unsigned int tid = GET_TID(rpl);
+        struct tid_info *t = dev->rdev.lldi.tids;
+
+        ep = lookup_tid(t, tid);
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        BUG_ON(!ep);
+        spin_lock_irqsave(&ep->com.lock, flags);
+        switch (ep->com.state) {
+        case ABORTING:
+                __state_set(&ep->com, DEAD);
+                release = 1;
+                break;
+        default:
+                printk(KERN_ERR "%s ep %p state %d\n",
+                     __func__, ep, ep->com.state);
+                break;
+        }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+
+        if (release)
+                release_ep_resources(ep);
+        return 0;
+}
+
+/*
+ * Return whether a failed active open has allocated a TID
+ */
+static inline int act_open_has_tid(int status)
+{
+        return status != CPL_ERR_TCAM_FULL && status != CPL_ERR_CONN_EXIST &&
+               status != CPL_ERR_ARP_MISS;
+}
+
+static int act_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_act_open_rpl *rpl = cplhdr(skb);
+        unsigned int atid = GET_TID_TID(GET_AOPEN_ATID(
+                                        ntohl(rpl->atid_status)));
+        struct tid_info *t = dev->rdev.lldi.tids;
+        int status = GET_AOPEN_STATUS(ntohl(rpl->atid_status));
+
+        ep = lookup_atid(t, atid);
+
+        PDBG("%s ep %p atid %u status %u errno %d\n", __func__, ep, atid,
+             status, status2errno(status));
+
+        if (status == CPL_ERR_RTX_NEG_ADVICE) {
+                printk(KERN_WARNING MOD "Connection problems for atid %u\n",
+                        atid);
+                return 0;
+        }
+
+        connect_reply_upcall(ep, status2errno(status));
+        state_set(&ep->com, DEAD);
+
+        if (status && act_open_has_tid(status))
+                cxgb4_remove_tid(ep->com.dev->rdev.lldi.tids, 0, GET_TID(rpl));
+
+        cxgb4_free_atid(t, atid);
+        dst_release(ep->dst);
+        cxgb4_l2t_release(ep->l2t);
+        c4iw_put_ep(&ep->com);
+
+        return 0;
+}
+
+static int pass_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_pass_open_rpl *rpl = cplhdr(skb);
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int stid = GET_TID(rpl);
+        struct c4iw_listen_ep *ep = lookup_stid(t, stid);
+
+        if (!ep) {
+                printk(KERN_ERR MOD "stid %d lookup failure!\n", stid);
+                return 0;
+        }
+        PDBG("%s ep %p status %d error %d\n", __func__, ep,
+             rpl->status, status2errno(rpl->status));
+        ep->com.rpl_err = status2errno(rpl->status);
+        ep->com.rpl_done = 1;
+        wake_up(&ep->com.waitq);
+
+        return 0;
+}
+
+static int listen_stop(struct c4iw_listen_ep *ep)
+{
+        struct sk_buff *skb;
+        struct cpl_close_listsvr_req *req;
+
+        PDBG("%s ep %p\n", __func__, ep);
+        skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb\n", __func__);
+                return -ENOMEM;
+        }
+        req = (struct cpl_close_listsvr_req *) skb_put(skb, sizeof(*req));
+        INIT_TP_WR(req, 0);
+        OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_CLOSE_LISTSRV_REQ,
+                                                    ep->stid));
+        req->reply_ctrl = cpu_to_be16(
+                          QUEUENO(ep->com.dev->rdev.lldi.rxq_ids[0]));
+        set_wr_txq(skb, CPL_PRIORITY_SETUP, 0);
+        return c4iw_ofld_send(&ep->com.dev->rdev, skb);
+}
+
+static int close_listsrv_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_close_listsvr_rpl *rpl = cplhdr(skb);
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int stid = GET_TID(rpl);
+        struct c4iw_listen_ep *ep = lookup_stid(t, stid);
+
+        PDBG("%s ep %p\n", __func__, ep);
+        ep->com.rpl_err = status2errno(rpl->status);
+        ep->com.rpl_done = 1;
+        wake_up(&ep->com.waitq);
+        return 0;
+}
+
+static void accept_cr(struct c4iw_ep *ep, __be32 peer_ip, struct sk_buff *skb,
+                      struct cpl_pass_accept_req *req)
+{
+        struct cpl_pass_accept_rpl *rpl;
+        unsigned int mtu_idx;
+        u64 opt0;
+        u32 opt2;
+        int wscale;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        BUG_ON(skb_cloned(skb));
+        skb_trim(skb, sizeof(*rpl));
+        skb_get(skb);
+        cxgb4_best_mtu(ep->com.dev->rdev.lldi.mtus, ep->mtu, &mtu_idx);
+        wscale = compute_wscale(rcv_win);
+        opt0 = KEEP_ALIVE(1) |
+               WND_SCALE(wscale) |
+               MSS_IDX(mtu_idx) |
+               L2T_IDX(ep->l2t->idx) |
+               TX_CHAN(ep->tx_chan) |
+               SMAC_SEL(ep->smac_idx) |
+               DSCP(ep->tos) |
+               RCV_BUFSIZ(rcv_win>>10);
+        opt2 = RX_CHANNEL(0) |
+               RSS_QUEUE_VALID | RSS_QUEUE(ep->rss_qid);
+
+        if (enable_tcp_timestamps && req->tcpopt.tstamp)
+                opt2 |= TSTAMPS_EN(1);
+        if (enable_tcp_sack && req->tcpopt.sack)
+                opt2 |= SACK_EN(1);
+        if (wscale && enable_tcp_window_scaling)
+                opt2 |= WND_SCALE_EN(1);
+
+        rpl = cplhdr(skb);
+        INIT_TP_WR(rpl, ep->hwtid);
+        OPCODE_TID(rpl) = cpu_to_be32(MK_OPCODE_TID(CPL_PASS_ACCEPT_RPL,
+                                      ep->hwtid));
+        rpl->opt0 = cpu_to_be64(opt0);
+        rpl->opt2 = cpu_to_be32(opt2);
+        set_wr_txq(skb, CPL_PRIORITY_SETUP, ep->txq_idx);
+        c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+
+        return;
+}
+
+static void reject_cr(struct c4iw_dev *dev, u32 hwtid, __be32 peer_ip,
+                      struct sk_buff *skb)
+{
+        PDBG("%s c4iw_dev %p tid %u peer_ip %x\n", __func__, dev, hwtid,
+             peer_ip);
+        BUG_ON(skb_cloned(skb));
+        skb_trim(skb, sizeof(struct cpl_tid_release));
+        skb_get(skb);
+        release_tid(&dev->rdev, hwtid, skb);
+        return;
+}
+
+static void get_4tuple(struct cpl_pass_accept_req *req,
+                       __be32 *local_ip, __be32 *peer_ip,
+                       __be16 *local_port, __be16 *peer_port)
+{
+        int eth_len = G_ETH_HDR_LEN(be32_to_cpu(req->hdr_len));
+        int ip_len = G_IP_HDR_LEN(be32_to_cpu(req->hdr_len));
+        struct iphdr *ip = (struct iphdr *)((u8 *)(req + 1) + eth_len);
+        struct tcphdr *tcp = (struct tcphdr *)
+                             ((u8 *)(req + 1) + eth_len + ip_len);
+
+        PDBG("%s saddr 0x%x daddr 0x%x sport %u dport %u\n", __func__,
+             ntohl(ip->saddr), ntohl(ip->daddr), ntohs(tcp->source),
+             ntohs(tcp->dest));
+
+        *peer_ip = ip->saddr;
+        *local_ip = ip->daddr;
+        *peer_port = tcp->source;
+        *local_port = tcp->dest;
+
+        return;
+}
+
+static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *child_ep, *parent_ep;
+        struct cpl_pass_accept_req *req = cplhdr(skb);
+        unsigned int stid = GET_POPEN_TID(ntohl(req->tos_stid));
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int hwtid = GET_TID(req);
+        struct dst_entry *dst;
+        struct l2t_entry *l2t;
+        struct rtable *rt;
+        __be32 local_ip, peer_ip;
+        __be16 local_port, peer_port;
+        struct net_device *pdev;
+        u32 tx_chan, smac_idx;
+        u16 rss_qid;
+        u32 mtu;
+        int step;
+        int txq_idx;
+
+        parent_ep = lookup_stid(t, stid);
+        PDBG("%s parent ep %p tid %u\n", __func__, parent_ep, hwtid);
+
+        get_4tuple(req, &local_ip, &peer_ip, &local_port, &peer_port);
+
+        if (state_read(&parent_ep->com) != LISTEN) {
+                printk(KERN_ERR "%s - listening ep not in LISTEN\n",
+                       __func__);
+                goto reject;
+        }
+
+        /* Find output route */
+        rt = find_route(dev, local_ip, peer_ip, local_port, peer_port,
+                        GET_POPEN_TOS(ntohl(req->tos_stid)));
+        if (!rt) {
+                printk(KERN_ERR MOD "%s - failed to find dst entry!\n",
+                       __func__);
+                goto reject;
+        }
+        dst = &rt->u.dst;
+        if (dst->neighbour->dev->flags & IFF_LOOPBACK) {
+                pdev = ip_dev_find(&init_net, peer_ip);
+                BUG_ON(!pdev);
+                l2t = cxgb4_l2t_get(dev->rdev.lldi.l2t, dst->neighbour,
+                                    pdev, 0);
+                mtu = pdev->mtu;
+                tx_chan = cxgb4_port_chan(pdev);
+                smac_idx = tx_chan << 1;
+                step = dev->rdev.lldi.ntxq / dev->rdev.lldi.nchan;
+                txq_idx = cxgb4_port_idx(pdev) * step;
+                step = dev->rdev.lldi.nrxq / dev->rdev.lldi.nchan;
+                rss_qid = dev->rdev.lldi.rxq_ids[cxgb4_port_idx(pdev) * step];
+                dev_put(pdev);
+        } else {
+                l2t = cxgb4_l2t_get(dev->rdev.lldi.l2t, dst->neighbour,
+                                        dst->neighbour->dev, 0);
+                mtu = dst_mtu(dst);
+                tx_chan = cxgb4_port_chan(dst->neighbour->dev);
+                smac_idx = tx_chan << 1;
+                step = dev->rdev.lldi.ntxq / dev->rdev.lldi.nchan;
+                txq_idx = cxgb4_port_idx(dst->neighbour->dev) * step;
+                step = dev->rdev.lldi.nrxq / dev->rdev.lldi.nchan;
+                rss_qid = dev->rdev.lldi.rxq_ids[
+                          cxgb4_port_idx(dst->neighbour->dev) * step];
+        }
+        if (!l2t) {
+                printk(KERN_ERR MOD "%s - failed to allocate l2t entry!\n",
+                       __func__);
+                dst_release(dst);
+                goto reject;
+        }
+
+        child_ep = alloc_ep(sizeof(*child_ep), GFP_KERNEL);
+        if (!child_ep) {
+                printk(KERN_ERR MOD "%s - failed to allocate ep entry!\n",
+                       __func__);
+                cxgb4_l2t_release(l2t);
+                dst_release(dst);
+                goto reject;
+        }
+        state_set(&child_ep->com, CONNECTING);
+        child_ep->com.dev = dev;
+        child_ep->com.cm_id = NULL;
+        child_ep->com.local_addr.sin_family = PF_INET;
+        child_ep->com.local_addr.sin_port = local_port;
+        child_ep->com.local_addr.sin_addr.s_addr = local_ip;
+        child_ep->com.remote_addr.sin_family = PF_INET;
+        child_ep->com.remote_addr.sin_port = peer_port;
+        child_ep->com.remote_addr.sin_addr.s_addr = peer_ip;
+        c4iw_get_ep(&parent_ep->com);
+        child_ep->parent_ep = parent_ep;
+        child_ep->tos = GET_POPEN_TOS(ntohl(req->tos_stid));
+        child_ep->l2t = l2t;
+        child_ep->dst = dst;
+        child_ep->hwtid = hwtid;
+        child_ep->tx_chan = tx_chan;
+        child_ep->smac_idx = smac_idx;
+        child_ep->rss_qid = rss_qid;
+        child_ep->mtu = mtu;
+        child_ep->txq_idx = txq_idx;
+
+        PDBG("%s tx_chan %u smac_idx %u rss_qid %u\n", __func__,
+             tx_chan, smac_idx, rss_qid);
+
+        init_timer(&child_ep->timer);
+        cxgb4_insert_tid(t, child_ep, hwtid);
+        accept_cr(child_ep, peer_ip, skb, req);
+        goto out;
+reject:
+        reject_cr(dev, hwtid, peer_ip, skb);
+out:
+        return 0;
+}
+
+static int pass_establish(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_pass_establish *req = cplhdr(skb);
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(req);
+
+        ep = lookup_tid(t, tid);
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        ep->snd_seq = be32_to_cpu(req->snd_isn);
+        ep->rcv_seq = be32_to_cpu(req->rcv_isn);
+
+        set_emss(ep, ntohs(req->tcp_opt));
+
+        dst_confirm(ep->dst);
+        state_set(&ep->com, MPA_REQ_WAIT);
+        start_ep_timer(ep);
+        send_flowc(ep, skb);
+
+        return 0;
+}
+
+static int peer_close(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_peer_close *hdr = cplhdr(skb);
+        struct c4iw_ep *ep;
+        struct c4iw_qp_attributes attrs;
+        unsigned long flags;
+        int disconnect = 1;
+        int release = 0;
+        int closing = 0;
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(hdr);
+        int start_timer = 0;
+        int stop_timer = 0;
+
+        ep = lookup_tid(t, tid);
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        dst_confirm(ep->dst);
+
+        spin_lock_irqsave(&ep->com.lock, flags);
+        switch (ep->com.state) {
+        case MPA_REQ_WAIT:
+                __state_set(&ep->com, CLOSING);
+                break;
+        case MPA_REQ_SENT:
+                __state_set(&ep->com, CLOSING);
+                connect_reply_upcall(ep, -ECONNRESET);
+                break;
+        case MPA_REQ_RCVD:
+
+                /*
+                 * We're gonna mark this puppy DEAD, but keep
+                 * the reference on it until the ULP accepts or
+                 * rejects the CR. Also wake up anyone waiting
+                 * in rdma connection migration (see c4iw_accept_cr()).
+                 */
+                __state_set(&ep->com, CLOSING);
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p tid %u\n", ep, ep->hwtid);
+                wake_up(&ep->com.waitq);
+                break;
+        case MPA_REP_SENT:
+                __state_set(&ep->com, CLOSING);
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p tid %u\n", ep, ep->hwtid);
+                wake_up(&ep->com.waitq);
+                break;
+        case FPDU_MODE:
+                start_timer = 1;
+                __state_set(&ep->com, CLOSING);
+                closing = 1;
+                peer_close_upcall(ep);
+                break;
+        case ABORTING:
+                disconnect = 0;
+                break;
+        case CLOSING:
+                __state_set(&ep->com, MORIBUND);
+                disconnect = 0;
+                break;
+        case MORIBUND:
+                stop_timer = 1;
+                if (ep->com.cm_id && ep->com.qp) {
+                        attrs.next_state = C4IW_QP_STATE_IDLE;
+                        c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+                                       C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+                }
+                close_complete_upcall(ep);
+                __state_set(&ep->com, DEAD);
+                release = 1;
+                disconnect = 0;
+                break;
+        case DEAD:
+                disconnect = 0;
+                break;
+        default:
+                BUG_ON(1);
+        }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        if (closing) {
+                attrs.next_state = C4IW_QP_STATE_CLOSING;
+                c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+        }
+        if (start_timer)
+                start_ep_timer(ep);
+        if (stop_timer)
+                stop_ep_timer(ep);
+        if (disconnect)
+                c4iw_ep_disconnect(ep, 0, GFP_KERNEL);
+        if (release)
+                release_ep_resources(ep);
+        return 0;
+}
+
+/*
+ * Returns whether an ABORT_REQ_RSS message is a negative advice.
+ */
+static int is_neg_adv_abort(unsigned int status)
+{
+        return status == CPL_ERR_RTX_NEG_ADVICE ||
+               status == CPL_ERR_PERSIST_NEG_ADVICE;
+}
+
+static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_abort_req_rss *req = cplhdr(skb);
+        struct c4iw_ep *ep;
+        struct cpl_abort_rpl *rpl;
+        struct sk_buff *rpl_skb;
+        struct c4iw_qp_attributes attrs;
+        int ret;
+        int release = 0;
+        unsigned long flags;
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(req);
+        int stop_timer = 0;
+
+        ep = lookup_tid(t, tid);
+        if (is_neg_adv_abort(req->status)) {
+                PDBG("%s neg_adv_abort ep %p tid %u\n", __func__, ep,
+                     ep->hwtid);
+                return 0;
+        }
+        spin_lock_irqsave(&ep->com.lock, flags);
+        PDBG("%s ep %p tid %u state %u\n", __func__, ep, ep->hwtid,
+             ep->com.state);
+        switch (ep->com.state) {
+        case CONNECTING:
+                break;
+        case MPA_REQ_WAIT:
+                stop_timer = 1;
+                break;
+        case MPA_REQ_SENT:
+                stop_timer = 1;
+                connect_reply_upcall(ep, -ECONNRESET);
+                break;
+        case MPA_REP_SENT:
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p\n", ep);
+                wake_up(&ep->com.waitq);
+                break;
+        case MPA_REQ_RCVD:
+
+                /*
+                 * We're gonna mark this puppy DEAD, but keep
+                 * the reference on it until the ULP accepts or
+                 * rejects the CR. Also wake up anyone waiting
+                 * in rdma connection migration (see c4iw_accept_cr()).
+                 */
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p tid %u\n", ep, ep->hwtid);
+                wake_up(&ep->com.waitq);
+                break;
+        case MORIBUND:
+        case CLOSING:
+                stop_timer = 1;
+                /*FALLTHROUGH*/
+        case FPDU_MODE:
+                if (ep->com.cm_id && ep->com.qp) {
+                        attrs.next_state = C4IW_QP_STATE_ERROR;
+                        ret = c4iw_modify_qp(ep->com.qp->rhp,
+                                     ep->com.qp, C4IW_QP_ATTR_NEXT_STATE,
+                                     &attrs, 1);
+                        if (ret)
+                                printk(KERN_ERR MOD
+                                       "%s - qp <- error failed!\n",
+                                       __func__);
+                }
+                peer_abort_upcall(ep);
+                break;
+        case ABORTING:
+                break;
+        case DEAD:
+                PDBG("%s PEER_ABORT IN DEAD STATE!!!!\n", __func__);
+                spin_unlock_irqrestore(&ep->com.lock, flags);
+                return 0;
+        default:
+                BUG_ON(1);
+                break;
+        }
+        dst_confirm(ep->dst);
+        if (ep->com.state != ABORTING) {
+                __state_set(&ep->com, DEAD);
+                release = 1;
+        }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+
+        rpl_skb = get_skb(skb, sizeof(*rpl), GFP_KERNEL);
+        if (!rpl_skb) {
+                printk(KERN_ERR MOD "%s - cannot allocate skb!\n",
+                       __func__);
+                release = 1;
+                goto out;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+        rpl = (struct cpl_abort_rpl *) skb_put(rpl_skb, sizeof(*rpl));
+        INIT_TP_WR(rpl, ep->hwtid);
+        OPCODE_TID(rpl) = cpu_to_be32(MK_OPCODE_TID(CPL_ABORT_RPL, ep->hwtid));
+        rpl->cmd = CPL_ABORT_NO_RST;
+        c4iw_ofld_send(&ep->com.dev->rdev, rpl_skb);
+out:
+        if (stop_timer)
+                stop_ep_timer(ep);
+        if (release)
+                release_ep_resources(ep);
+        return 0;
+}
+
+static int close_con_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct c4iw_qp_attributes attrs;
+        struct cpl_close_con_rpl *rpl = cplhdr(skb);
+        unsigned long flags;
+        int release = 0;
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(rpl);
+        int stop_timer = 0;
+
+        ep = lookup_tid(t, tid);
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        BUG_ON(!ep);
+
+        /* The cm_id may be null if we failed to connect */
+        spin_lock_irqsave(&ep->com.lock, flags);
+        switch (ep->com.state) {
+        case CLOSING:
+                __state_set(&ep->com, MORIBUND);
+                break;
+        case MORIBUND:
+                stop_timer = 1;
+                if ((ep->com.cm_id) && (ep->com.qp)) {
+                        attrs.next_state = C4IW_QP_STATE_IDLE;
+                        c4iw_modify_qp(ep->com.qp->rhp,
+                                             ep->com.qp,
+                                             C4IW_QP_ATTR_NEXT_STATE,
+                                             &attrs, 1);
+                }
+                close_complete_upcall(ep);
+                __state_set(&ep->com, DEAD);
+                release = 1;
+                break;
+        case ABORTING:
+        case DEAD:
+                break;
+        default:
+                BUG_ON(1);
+                break;
+        }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        if (stop_timer)
+                stop_ep_timer(ep);
+        if (release)
+                release_ep_resources(ep);
+        return 0;
+}
+
+static int terminate(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_rdma_terminate *term = cplhdr(skb);
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(term);
+
+        ep = lookup_tid(t, tid);
+
+        if (state_read(&ep->com) != FPDU_MODE)
+                return 0;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        skb_pull(skb, sizeof *term);
+        PDBG("%s saving %d bytes of term msg\n", __func__, skb->len);
+        skb_copy_from_linear_data(skb, ep->com.qp->attr.terminate_buffer,
+                                  skb->len);
+        ep->com.qp->attr.terminate_msg_len = skb->len;
+        ep->com.qp->attr.is_terminate_local = 0;
+        return 0;
+}
+
+/*
+ * Upcall from the adapter indicating data has been transmitted.
+ * For us its just the single MPA request or reply.  We can now free
+ * the skb holding the mpa message.
+ */
+static int fw4_ack(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_fw4_ack *hdr = cplhdr(skb);
+        u8 credits = hdr->credits;
+        unsigned int tid = GET_TID(hdr);
+        struct tid_info *t = dev->rdev.lldi.tids;
+
+
+        ep = lookup_tid(t, tid);
+        PDBG("%s ep %p tid %u credits %u\n", __func__, ep, ep->hwtid, credits);
+        if (credits == 0) {
+                PDBG(KERN_ERR "%s 0 credit ack ep %p tid %u state %u\n",
+                        __func__, ep, ep->hwtid, state_read(&ep->com));
+                return 0;
+        }
+
+        dst_confirm(ep->dst);
+        if (ep->mpa_skb) {
+                PDBG("%s last streaming msg ack ep %p tid %u state %u "
+                     "initiator %u freeing skb\n", __func__, ep, ep->hwtid,
+                     state_read(&ep->com), ep->mpa_attr.initiator ? 1 : 0);
+                kfree_skb(ep->mpa_skb);
+                ep->mpa_skb = NULL;
+        }
+        return 0;
+}
+
+int c4iw_reject_cr(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
+{
+        int err;
+        struct c4iw_ep *ep = to_ep(cm_id);
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+
+        if (state_read(&ep->com) == DEAD) {
+                c4iw_put_ep(&ep->com);
+                return -ECONNRESET;
+        }
+        BUG_ON(state_read(&ep->com) != MPA_REQ_RCVD);
+        if (mpa_rev == 0)
+                abort_connection(ep, NULL, GFP_KERNEL);
+        else {
+                err = send_mpa_reject(ep, pdata, pdata_len);
+                err = c4iw_ep_disconnect(ep, 0, GFP_KERNEL);
+        }
+        c4iw_put_ep(&ep->com);
+        return 0;
+}
+
+int c4iw_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+{
+        int err;
+        struct c4iw_qp_attributes attrs;
+        enum c4iw_qp_attr_mask mask;
+        struct c4iw_ep *ep = to_ep(cm_id);
+        struct c4iw_dev *h = to_c4iw_dev(cm_id->device);
+        struct c4iw_qp *qp = get_qhp(h, conn_param->qpn);
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        if (state_read(&ep->com) == DEAD) {
+                err = -ECONNRESET;
+                goto err;
+        }
+
+        BUG_ON(state_read(&ep->com) != MPA_REQ_RCVD);
+        BUG_ON(!qp);
+
+        if ((conn_param->ord > c4iw_max_read_depth) ||
+            (conn_param->ird > c4iw_max_read_depth)) {
+                abort_connection(ep, NULL, GFP_KERNEL);
+                err = -EINVAL;
+                goto err;
+        }
+
+        cm_id->add_ref(cm_id);
+        ep->com.cm_id = cm_id;
+        ep->com.qp = qp;
+
+        ep->ird = conn_param->ird;
+        ep->ord = conn_param->ord;
+
+        if (peer2peer && ep->ird == 0)
+                ep->ird = 1;
+
+        PDBG("%s %d ird %d ord %d\n", __func__, __LINE__, ep->ird, ep->ord);
+
+        /* bind QP to EP and move to RTS */
+        attrs.mpa_attr = ep->mpa_attr;
+        attrs.max_ird = ep->ird;
+        attrs.max_ord = ep->ord;
+        attrs.llp_stream_handle = ep;
+        attrs.next_state = C4IW_QP_STATE_RTS;
+
+        /* bind QP and TID with INIT_WR */
+        mask = C4IW_QP_ATTR_NEXT_STATE |
+                             C4IW_QP_ATTR_LLP_STREAM_HANDLE |
+                             C4IW_QP_ATTR_MPA_ATTR |
+                             C4IW_QP_ATTR_MAX_IRD |
+                             C4IW_QP_ATTR_MAX_ORD;
+
+        err = c4iw_modify_qp(ep->com.qp->rhp,
+                             ep->com.qp, mask, &attrs, 1);
+        if (err)
+                goto err1;
+        err = send_mpa_reply(ep, conn_param->private_data,
+                             conn_param->private_data_len);
+        if (err)
+                goto err1;
+
+        state_set(&ep->com, FPDU_MODE);
+        established_upcall(ep);
+        c4iw_put_ep(&ep->com);
+        return 0;
+err1:
+        ep->com.cm_id = NULL;
+        ep->com.qp = NULL;
+        cm_id->rem_ref(cm_id);
+err:
+        c4iw_put_ep(&ep->com);
+        return err;
+}
+
+int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+{
+        int err = 0;
+        struct c4iw_dev *dev = to_c4iw_dev(cm_id->device);
+        struct c4iw_ep *ep;
+        struct rtable *rt;
+        struct net_device *pdev;
+        int step;
+
+        if ((conn_param->ord > c4iw_max_read_depth) ||
+            (conn_param->ird > c4iw_max_read_depth)) {
+                err = -EINVAL;
+                goto out;
+        }
+        ep = alloc_ep(sizeof(*ep), GFP_KERNEL);
+        if (!ep) {
+                printk(KERN_ERR MOD "%s - cannot alloc ep.\n", __func__);
+                err = -ENOMEM;
+                goto out;
+        }
+        init_timer(&ep->timer);
+        ep->plen = conn_param->private_data_len;
+        if (ep->plen)
+                memcpy(ep->mpa_pkt + sizeof(struct mpa_message),
+                       conn_param->private_data, ep->plen);
+        ep->ird = conn_param->ird;
+        ep->ord = conn_param->ord;
+
+        if (peer2peer && ep->ord == 0)
+                ep->ord = 1;
+
+        cm_id->add_ref(cm_id);
+        ep->com.dev = dev;
+        ep->com.cm_id = cm_id;
+        ep->com.qp = get_qhp(dev, conn_param->qpn);
+        BUG_ON(!ep->com.qp);
+        PDBG("%s qpn 0x%x qp %p cm_id %p\n", __func__, conn_param->qpn,
+             ep->com.qp, cm_id);
+
+        /*
+         * Allocate an active TID to initiate a TCP connection.
+         */
+        ep->atid = cxgb4_alloc_atid(dev->rdev.lldi.tids, ep);
+        if (ep->atid == -1) {
+                printk(KERN_ERR MOD "%s - cannot alloc atid.\n", __func__);
+                err = -ENOMEM;
+                goto fail2;
+        }
+
+        PDBG("%s saddr 0x%x sport 0x%x raddr 0x%x rport 0x%x\n", __func__,
+             ntohl(cm_id->local_addr.sin_addr.s_addr),
+             ntohs(cm_id->local_addr.sin_port),
+             ntohl(cm_id->remote_addr.sin_addr.s_addr),
+             ntohs(cm_id->remote_addr.sin_port));
+
+        /* find a route */
+        rt = find_route(dev,
+                        cm_id->local_addr.sin_addr.s_addr,
+                        cm_id->remote_addr.sin_addr.s_addr,
+                        cm_id->local_addr.sin_port,
+                        cm_id->remote_addr.sin_port, 0);
+        if (!rt) {
+                printk(KERN_ERR MOD "%s - cannot find route.\n", __func__);
+                err = -EHOSTUNREACH;
+                goto fail3;
+        }
+        ep->dst = &rt->u.dst;
+
+        /* get a l2t entry */
+        if (ep->dst->neighbour->dev->flags & IFF_LOOPBACK) {
+                PDBG("%s LOOPBACK\n", __func__);
+                pdev = ip_dev_find(&init_net,
+                                   cm_id->remote_addr.sin_addr.s_addr);
+                ep->l2t = cxgb4_l2t_get(ep->com.dev->rdev.lldi.l2t,
+                                        ep->dst->neighbour,
+                                        pdev, 0);
+                ep->mtu = pdev->mtu;
+                ep->tx_chan = cxgb4_port_chan(pdev);
+                ep->smac_idx = ep->tx_chan << 1;
+                step = ep->com.dev->rdev.lldi.ntxq /
+                       ep->com.dev->rdev.lldi.nchan;
+                ep->txq_idx = cxgb4_port_idx(pdev) * step;
+                step = ep->com.dev->rdev.lldi.nrxq /
+                       ep->com.dev->rdev.lldi.nchan;
+                ep->rss_qid = ep->com.dev->rdev.lldi.rxq_ids[
+                              cxgb4_port_idx(pdev) * step];
+                dev_put(pdev);
+        } else {
+                ep->l2t = cxgb4_l2t_get(ep->com.dev->rdev.lldi.l2t,
+                                        ep->dst->neighbour,
+                                        ep->dst->neighbour->dev, 0);
+                ep->mtu = dst_mtu(ep->dst);
+                ep->tx_chan = cxgb4_port_chan(ep->dst->neighbour->dev);
+                ep->smac_idx = ep->tx_chan << 1;
+                step = ep->com.dev->rdev.lldi.ntxq /
+                       ep->com.dev->rdev.lldi.nchan;
+                ep->txq_idx = cxgb4_port_idx(ep->dst->neighbour->dev) * step;
+                step = ep->com.dev->rdev.lldi.nrxq /
+                       ep->com.dev->rdev.lldi.nchan;
+                ep->rss_qid = ep->com.dev->rdev.lldi.rxq_ids[
+                              cxgb4_port_idx(ep->dst->neighbour->dev) * step];
+        }
+        if (!ep->l2t) {
+                printk(KERN_ERR MOD "%s - cannot alloc l2e.\n", __func__);
+                err = -ENOMEM;
+                goto fail4;
+        }
+
+        PDBG("%s txq_idx %u tx_chan %u smac_idx %u rss_qid %u l2t_idx %u\n",
+                __func__, ep->txq_idx, ep->tx_chan, ep->smac_idx, ep->rss_qid,
+                ep->l2t->idx);
+
+        state_set(&ep->com, CONNECTING);
+        ep->tos = 0;
+        ep->com.local_addr = cm_id->local_addr;
+        ep->com.remote_addr = cm_id->remote_addr;
+
+        /* send connect request to rnic */
+        err = send_connect(ep);
+        if (!err)
+                goto out;
+
+        cxgb4_l2t_release(ep->l2t);
+fail4:
+        dst_release(ep->dst);
+fail3:
+        cxgb4_free_atid(ep->com.dev->rdev.lldi.tids, ep->atid);
+fail2:
+        cm_id->rem_ref(cm_id);
+        c4iw_put_ep(&ep->com);
+out:
+        return err;
+}
+
+int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog)
+{
+        int err = 0;
+        struct c4iw_dev *dev = to_c4iw_dev(cm_id->device);
+        struct c4iw_listen_ep *ep;
+
+
+        might_sleep();
+
+        ep = alloc_ep(sizeof(*ep), GFP_KERNEL);
+        if (!ep) {
+                printk(KERN_ERR MOD "%s - cannot alloc ep.\n", __func__);
+                err = -ENOMEM;
+                goto fail1;
+        }
+        PDBG("%s ep %p\n", __func__, ep);
+        cm_id->add_ref(cm_id);
+        ep->com.cm_id = cm_id;
+        ep->com.dev = dev;
+        ep->backlog = backlog;
+        ep->com.local_addr = cm_id->local_addr;
+
+        /*
+         * Allocate a server TID.
+         */
+        ep->stid = cxgb4_alloc_stid(dev->rdev.lldi.tids, PF_INET, ep);
+        if (ep->stid == -1) {
+                printk(KERN_ERR MOD "%s - cannot alloc stid.\n", __func__);
+                err = -ENOMEM;
+                goto fail2;
+        }
+
+        state_set(&ep->com, LISTEN);
+        err = cxgb4_create_server(ep->com.dev->rdev.lldi.ports[0], ep->stid,
+                                  ep->com.local_addr.sin_addr.s_addr,
+                                  ep->com.local_addr.sin_port,
+                                  ep->com.dev->rdev.lldi.rxq_ids[0]);
+        if (err)
+                goto fail3;
+
+        /* wait for pass_open_rpl */
+        wait_event(ep->com.waitq, ep->com.rpl_done);
+        err = ep->com.rpl_err;
+        if (!err) {
+                cm_id->provider_data = ep;
+                goto out;
+        }
+fail3:
+        cxgb4_free_stid(ep->com.dev->rdev.lldi.tids, ep->stid, PF_INET);
+fail2:
+        cm_id->rem_ref(cm_id);
+        c4iw_put_ep(&ep->com);
+fail1:
+out:
+        return err;
+}
+
+int c4iw_destroy_listen(struct iw_cm_id *cm_id)
+{
+        int err;
+        struct c4iw_listen_ep *ep = to_listen_ep(cm_id);
+
+        PDBG("%s ep %p\n", __func__, ep);
+
+        might_sleep();
+        state_set(&ep->com, DEAD);
+        ep->com.rpl_done = 0;
+        ep->com.rpl_err = 0;
+        err = listen_stop(ep);
+        if (err)
+                goto done;
+        wait_event(ep->com.waitq, ep->com.rpl_done);
+        cxgb4_free_stid(ep->com.dev->rdev.lldi.tids, ep->stid, PF_INET);
+done:
+        err = ep->com.rpl_err;
+        cm_id->rem_ref(cm_id);
+        c4iw_put_ep(&ep->com);
+        return err;
+}
+
+int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp)
+{
+        int ret = 0;
+        unsigned long flags;
+        int close = 0;
+        int fatal = 0;
+        struct c4iw_rdev *rdev;
+        int start_timer = 0;
+        int stop_timer = 0;
+
+        spin_lock_irqsave(&ep->com.lock, flags);
+
+        PDBG("%s ep %p state %s, abrupt %d\n", __func__, ep,
+             states[ep->com.state], abrupt);
+
+        rdev = &ep->com.dev->rdev;
+        if (c4iw_fatal_error(rdev)) {
+                fatal = 1;
+                close_complete_upcall(ep);
+                ep->com.state = DEAD;
+        }
+        switch (ep->com.state) {
+        case MPA_REQ_WAIT:
+        case MPA_REQ_SENT:
+        case MPA_REQ_RCVD:
+        case MPA_REP_SENT:
+        case FPDU_MODE:
+                close = 1;
+                if (abrupt)
+                        ep->com.state = ABORTING;
+                else {
+                        ep->com.state = CLOSING;
+                        start_timer = 1;
+                }
+                set_bit(CLOSE_SENT, &ep->com.flags);
+                break;
+        case CLOSING:
+                if (!test_and_set_bit(CLOSE_SENT, &ep->com.flags)) {
+                        close = 1;
+                        if (abrupt) {
+                                stop_timer = 1;
+                                ep->com.state = ABORTING;
+                        } else
+                                ep->com.state = MORIBUND;
+                }
+                break;
+        case MORIBUND:
+        case ABORTING:
+        case DEAD:
+                PDBG("%s ignoring disconnect ep %p state %u\n",
+                     __func__, ep, ep->com.state);
+                break;
+        default:
+                BUG();
+                break;
+        }
+
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        if (start_timer)
+                start_ep_timer(ep);
+        if (stop_timer)
+                stop_ep_timer(ep);
+        if (close) {
+                if (abrupt)
+                        ret = abort_connection(ep, NULL, gfp);
+                else
+                        ret = send_halfclose(ep, gfp);
+                if (ret)
+                        fatal = 1;
+        }
+        if (fatal)
+                release_ep_resources(ep);
+        return ret;
+}
+
+/*
+ * These are the real handlers that are called from a
+ * work queue.
+ */
+static c4iw_handler_func work_handlers[NUM_CPL_CMDS] = {
+        [CPL_ACT_ESTABLISH] = act_establish,
+        [CPL_ACT_OPEN_RPL] = act_open_rpl,
+        [CPL_RX_DATA] = rx_data,
+        [CPL_ABORT_RPL_RSS] = abort_rpl,
+        [CPL_ABORT_RPL] = abort_rpl,
+        [CPL_PASS_OPEN_RPL] = pass_open_rpl,
+        [CPL_CLOSE_LISTSRV_RPL] = close_listsrv_rpl,
+        [CPL_PASS_ACCEPT_REQ] = pass_accept_req,
+        [CPL_PASS_ESTABLISH] = pass_establish,
+        [CPL_PEER_CLOSE] = peer_close,
+        [CPL_ABORT_REQ_RSS] = peer_abort,
+        [CPL_CLOSE_CON_RPL] = close_con_rpl,
+        [CPL_RDMA_TERMINATE] = terminate,
+        [CPL_FW4_ACK] = fw4_ack
+};
+
+static void process_timeout(struct c4iw_ep *ep)
+{
+        struct c4iw_qp_attributes attrs;
+        int abort = 1;
+
+        spin_lock_irq(&ep->com.lock);
+        PDBG("%s ep %p tid %u state %d\n", __func__, ep, ep->hwtid,
+             ep->com.state);
+        switch (ep->com.state) {
+        case MPA_REQ_SENT:
+                __state_set(&ep->com, ABORTING);
+                connect_reply_upcall(ep, -ETIMEDOUT);
+                break;
+        case MPA_REQ_WAIT:
+                __state_set(&ep->com, ABORTING);
+                break;
+        case CLOSING:
+        case MORIBUND:
+                if (ep->com.cm_id && ep->com.qp) {
+                        attrs.next_state = C4IW_QP_STATE_ERROR;
+                        c4iw_modify_qp(ep->com.qp->rhp,
+                                     ep->com.qp, C4IW_QP_ATTR_NEXT_STATE,
+                                     &attrs, 1);
+                }
+                __state_set(&ep->com, ABORTING);
+                break;
+        default:
+                printk(KERN_ERR "%s unexpected state ep %p tid %u state %u\n",
+                        __func__, ep, ep->hwtid, ep->com.state);
+                WARN_ON(1);
+                abort = 0;
+        }
+        spin_unlock_irq(&ep->com.lock);
+        if (abort)
+                abort_connection(ep, NULL, GFP_KERNEL);
+        c4iw_put_ep(&ep->com);
+}
+
+static void process_timedout_eps(void)
+{
+        struct c4iw_ep *ep;
+
+        spin_lock_irq(&timeout_lock);
+        while (!list_empty(&timeout_list)) {
+                struct list_head *tmp;
+
+                tmp = timeout_list.next;
+                list_del(tmp);
+                spin_unlock_irq(&timeout_lock);
+                ep = list_entry(tmp, struct c4iw_ep, entry);
+                process_timeout(ep);
+                spin_lock_irq(&timeout_lock);
+        }
+        spin_unlock_irq(&timeout_lock);
+}
+
+static void process_work(struct work_struct *work)
+{
+        struct sk_buff *skb = NULL;
+        struct c4iw_dev *dev;
+        struct cpl_act_establish *rpl = cplhdr(skb);
+        unsigned int opcode;
+        int ret;
+
+        while ((skb = skb_dequeue(&rxq))) {
+                rpl = cplhdr(skb);
+                dev = *((struct c4iw_dev **) (skb->cb + sizeof(void *)));
+                opcode = rpl->ot.opcode;
+
+                BUG_ON(!work_handlers[opcode]);
+                ret = work_handlers[opcode](dev, skb);
+                if (!ret)
+                        kfree_skb(skb);
+        }
+        process_timedout_eps();
+}
+
+static DECLARE_WORK(skb_work, process_work);
+
+static void ep_timeout(unsigned long arg)
+{
+        struct c4iw_ep *ep = (struct c4iw_ep *)arg;
+
+        spin_lock(&timeout_lock);
+        list_add_tail(&ep->entry, &timeout_list);
+        spin_unlock(&timeout_lock);
+        queue_work(workq, &skb_work);
+}
+
+/*
+ * All the CM events are handled on a work queue to have a safe context.
+ */
+static int sched(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+
+        /*
+         * Save dev in the skb->cb area.
+         */
+        *((struct c4iw_dev **) (skb->cb + sizeof(void *))) = dev;
+
+        /*
+         * Queue the skb and schedule the worker thread.
+         */
+        skb_queue_tail(&rxq, skb);
+        queue_work(workq, &skb_work);
+        return 0;
+}
+
+static int set_tcb_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_set_tcb_rpl *rpl = cplhdr(skb);
+
+        if (rpl->status != CPL_ERR_NONE) {
+                printk(KERN_ERR MOD "Unexpected SET_TCB_RPL status %u "
+                       "for tid %u\n", rpl->status, GET_TID(rpl));
+        }
+        return 0;
+}
+
+static int fw6_msg(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_fw6_msg *rpl = cplhdr(skb);
+        struct c4iw_wr_wait *wr_waitp;
+        int ret;
+
+        PDBG("%s type %u\n", __func__, rpl->type);
+
+        switch (rpl->type) {
+        case 1:
+                ret = (int)((be64_to_cpu(rpl->data[0]) >> 8) & 0xff);
+                wr_waitp = (__force struct c4iw_wr_wait *)rpl->data[1];
+                PDBG("%s wr_waitp %p ret %u\n", __func__, wr_waitp, ret);
+                if (wr_waitp) {
+                        wr_waitp->ret = ret;
+                        wr_waitp->done = 1;
+                        wake_up(&wr_waitp->wait);
+                }
+                break;
+        case 2:
+                c4iw_ev_dispatch(dev, (struct t4_cqe *)&rpl->data[0]);
+                break;
+        default:
+                printk(KERN_ERR MOD "%s unexpected fw6 msg type %u\n", __func__,
+                       rpl->type);
+                break;
+        }
+        return 0;
+}
+
+/*
+ * Most upcalls from the T4 Core go to sched() to
+ * schedule the processing on a work queue.
+ */
+c4iw_handler_func c4iw_handlers[NUM_CPL_CMDS] = {
+        [CPL_ACT_ESTABLISH] = sched,
+        [CPL_ACT_OPEN_RPL] = sched,
+        [CPL_RX_DATA] = sched,
+        [CPL_ABORT_RPL_RSS] = sched,
+        [CPL_ABORT_RPL] = sched,
+        [CPL_PASS_OPEN_RPL] = sched,
+        [CPL_CLOSE_LISTSRV_RPL] = sched,
+        [CPL_PASS_ACCEPT_REQ] = sched,
+        [CPL_PASS_ESTABLISH] = sched,
+        [CPL_PEER_CLOSE] = sched,
+        [CPL_CLOSE_CON_RPL] = sched,
+        [CPL_ABORT_REQ_RSS] = sched,
+        [CPL_RDMA_TERMINATE] = sched,
+        [CPL_FW4_ACK] = sched,
+        [CPL_SET_TCB_RPL] = set_tcb_rpl,
+        [CPL_FW6_MSG] = fw6_msg
+};
+
+int __init c4iw_cm_init(void)
+{
+        spin_lock_init(&timeout_lock);
+        skb_queue_head_init(&rxq);
+
+        workq = create_singlethread_workqueue("iw_cxgb4");
+        if (!workq)
+                return -ENOMEM;
+
+        return 0;
+}
+
+void __exit c4iw_cm_term(void)
+{
+        WARN_ON(!list_empty(&timeout_list));
+        flush_workqueue(workq);
+        destroy_workqueue(workq);
+}
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
new file mode 100644
index 000000000000..fb1aafcc294f
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -0,0 +1,882 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "iw_cxgb4.h"
+
+static int destroy_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
+                      struct c4iw_dev_ucontext *uctx)
+{
+        struct fw_ri_res_wr *res_wr;
+        struct fw_ri_res *res;
+        int wr_len;
+        struct c4iw_wr_wait wr_wait;
+        struct sk_buff *skb;
+        int ret;
+
+        wr_len = sizeof *res_wr + sizeof *res;
+        skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
+        if (!skb)
+                return -ENOMEM;
+        set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
+
+        res_wr = (struct fw_ri_res_wr *)__skb_put(skb, wr_len);
+        memset(res_wr, 0, wr_len);
+        res_wr->op_nres = cpu_to_be32(
+                        FW_WR_OP(FW_RI_RES_WR) |
+                        V_FW_RI_RES_WR_NRES(1) |
+                        FW_WR_COMPL(1));
+        res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
+        res_wr->cookie = (u64)&wr_wait;
+        res = res_wr->res;
+        res->u.cq.restype = FW_RI_RES_TYPE_CQ;
+        res->u.cq.op = FW_RI_RES_OP_RESET;
+        res->u.cq.iqid = cpu_to_be32(cq->cqid);
+
+        c4iw_init_wr_wait(&wr_wait);
+        ret = c4iw_ofld_send(rdev, skb);
+        if (!ret) {
+                wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+                if (!wr_wait.done) {
+                        printk(KERN_ERR MOD "Device %s not responding!\n",
+                               pci_name(rdev->lldi.pdev));
+                        rdev->flags = T4_FATAL_ERROR;
+                        ret = -EIO;
+                } else
+                        ret = wr_wait.ret;
+        }
+
+        kfree(cq->sw_queue);
+        dma_free_coherent(&(rdev->lldi.pdev->dev),
+                          cq->memsize, cq->queue,
+                          pci_unmap_addr(cq, mapping));
+        c4iw_put_cqid(rdev, cq->cqid, uctx);
+        return ret;
+}
+
+static int create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
+                     struct c4iw_dev_ucontext *uctx)
+{
+        struct fw_ri_res_wr *res_wr;
+        struct fw_ri_res *res;
+        int wr_len;
+        int user = (uctx != &rdev->uctx);
+        struct c4iw_wr_wait wr_wait;
+        int ret;
+        struct sk_buff *skb;
+
+        cq->cqid = c4iw_get_cqid(rdev, uctx);
+        if (!cq->cqid) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+
+        if (!user) {
+                cq->sw_queue = kzalloc(cq->memsize, GFP_KERNEL);
+                if (!cq->sw_queue) {
+                        ret = -ENOMEM;
+                        goto err2;
+                }
+        }
+        cq->queue = dma_alloc_coherent(&rdev->lldi.pdev->dev, cq->memsize,
+                                       &cq->dma_addr, GFP_KERNEL);
+        if (!cq->queue) {
+                ret = -ENOMEM;
+                goto err3;
+        }
+        pci_unmap_addr_set(cq, mapping, cq->dma_addr);
+        memset(cq->queue, 0, cq->memsize);
+
+        /* build fw_ri_res_wr */
+        wr_len = sizeof *res_wr + sizeof *res;
+
+        skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
+        if (!skb) {
+                ret = -ENOMEM;
+                goto err4;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
+
+        res_wr = (struct fw_ri_res_wr *)__skb_put(skb, wr_len);
+        memset(res_wr, 0, wr_len);
+        res_wr->op_nres = cpu_to_be32(
+                        FW_WR_OP(FW_RI_RES_WR) |
+                        V_FW_RI_RES_WR_NRES(1) |
+                        FW_WR_COMPL(1));
+        res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
+        res_wr->cookie = (u64)&wr_wait;
+        res = res_wr->res;
+        res->u.cq.restype = FW_RI_RES_TYPE_CQ;
+        res->u.cq.op = FW_RI_RES_OP_WRITE;
+        res->u.cq.iqid = cpu_to_be32(cq->cqid);
+        res->u.cq.iqandst_to_iqandstindex = cpu_to_be32(
+                        V_FW_RI_RES_WR_IQANUS(0) |
+                        V_FW_RI_RES_WR_IQANUD(1) |
+                        F_FW_RI_RES_WR_IQANDST |
+                        V_FW_RI_RES_WR_IQANDSTINDEX(*rdev->lldi.rxq_ids));
+        res->u.cq.iqdroprss_to_iqesize = cpu_to_be16(
+                        F_FW_RI_RES_WR_IQDROPRSS |
+                        V_FW_RI_RES_WR_IQPCIECH(2) |
+                        V_FW_RI_RES_WR_IQINTCNTTHRESH(0) |
+                        F_FW_RI_RES_WR_IQO |
+                        V_FW_RI_RES_WR_IQESIZE(1));
+        res->u.cq.iqsize = cpu_to_be16(cq->size);
+        res->u.cq.iqaddr = cpu_to_be64(cq->dma_addr);
+
+        c4iw_init_wr_wait(&wr_wait);
+
+        ret = c4iw_ofld_send(rdev, skb);
+        if (ret)
+                goto err4;
+        PDBG("%s wait_event wr_wait %p\n", __func__, &wr_wait);
+        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+        if (!wr_wait.done) {
+                printk(KERN_ERR MOD "Device %s not responding!\n",
+                       pci_name(rdev->lldi.pdev));
+                rdev->flags = T4_FATAL_ERROR;
+                ret = -EIO;
+        } else
+                ret = wr_wait.ret;
+        if (ret)
+                goto err4;
+
+        cq->gen = 1;
+        cq->gts = rdev->lldi.gts_reg;
+        cq->rdev = rdev;
+        if (user) {
+                cq->ugts = (u64)pci_resource_start(rdev->lldi.pdev, 2) +
+                                        (cq->cqid << rdev->cqshift);
+                cq->ugts &= PAGE_MASK;
+        }
+        return 0;
+err4:
+        dma_free_coherent(&rdev->lldi.pdev->dev, cq->memsize, cq->queue,
+                          pci_unmap_addr(cq, mapping));
+err3:
+        kfree(cq->sw_queue);
+err2:
+        c4iw_put_cqid(rdev, cq->cqid, uctx);
+err1:
+        return ret;
+}
+
+static void insert_recv_cqe(struct t4_wq *wq, struct t4_cq *cq)
+{
+        struct t4_cqe cqe;
+
+        PDBG("%s wq %p cq %p sw_cidx %u sw_pidx %u\n", __func__,
+             wq, cq, cq->sw_cidx, cq->sw_pidx);
+        memset(&cqe, 0, sizeof(cqe));
+        cqe.header = cpu_to_be32(V_CQE_STATUS(T4_ERR_SWFLUSH) |
+                                 V_CQE_OPCODE(FW_RI_SEND) |
+                                 V_CQE_TYPE(0) |
+                                 V_CQE_SWCQE(1) |
+                                 V_CQE_QPID(wq->rq.qid));
+        cqe.bits_type_ts = cpu_to_be64(V_CQE_GENBIT((u64)cq->gen));
+        cq->sw_queue[cq->sw_pidx] = cqe;
+        t4_swcq_produce(cq);
+}
+
+int c4iw_flush_rq(struct t4_wq *wq, struct t4_cq *cq, int count)
+{
+        int flushed = 0;
+        int in_use = wq->rq.in_use - count;
+
+        BUG_ON(in_use < 0);
+        PDBG("%s wq %p cq %p rq.in_use %u skip count %u\n", __func__,
+             wq, cq, wq->rq.in_use, count);
+        while (in_use--) {
+                insert_recv_cqe(wq, cq);
+                flushed++;
+        }
+        return flushed;
+}
+
+static void insert_sq_cqe(struct t4_wq *wq, struct t4_cq *cq,
+                          struct t4_swsqe *swcqe)
+{
+        struct t4_cqe cqe;
+
+        PDBG("%s wq %p cq %p sw_cidx %u sw_pidx %u\n", __func__,
+             wq, cq, cq->sw_cidx, cq->sw_pidx);
+        memset(&cqe, 0, sizeof(cqe));
+        cqe.header = cpu_to_be32(V_CQE_STATUS(T4_ERR_SWFLUSH) |
+                                 V_CQE_OPCODE(swcqe->opcode) |
+                                 V_CQE_TYPE(1) |
+                                 V_CQE_SWCQE(1) |
+                                 V_CQE_QPID(wq->sq.qid));
+        CQE_WRID_SQ_IDX(&cqe) = swcqe->idx;
+        cqe.bits_type_ts = cpu_to_be64(V_CQE_GENBIT((u64)cq->gen));
+        cq->sw_queue[cq->sw_pidx] = cqe;
+        t4_swcq_produce(cq);
+}
+
+int c4iw_flush_sq(struct t4_wq *wq, struct t4_cq *cq, int count)
+{
+        int flushed = 0;
+        struct t4_swsqe *swsqe = &wq->sq.sw_sq[wq->sq.cidx + count];
+        int in_use = wq->sq.in_use - count;
+
+        BUG_ON(in_use < 0);
+        while (in_use--) {
+                swsqe->signaled = 0;
+                insert_sq_cqe(wq, cq, swsqe);
+                swsqe++;
+                if (swsqe == (wq->sq.sw_sq + wq->sq.size))
+                        swsqe = wq->sq.sw_sq;
+                flushed++;
+        }
+        return flushed;
+}
+
+/*
+ * Move all CQEs from the HWCQ into the SWCQ.
+ */
+void c4iw_flush_hw_cq(struct t4_cq *cq)
+{
+        struct t4_cqe *cqe = NULL, *swcqe;
+        int ret;
+
+        PDBG("%s cq %p cqid 0x%x\n", __func__, cq, cq->cqid);
+        ret = t4_next_hw_cqe(cq, &cqe);
+        while (!ret) {
+                PDBG("%s flushing hwcq cidx 0x%x swcq pidx 0x%x\n",
+                     __func__, cq->cidx, cq->sw_pidx);
+                swcqe = &cq->sw_queue[cq->sw_pidx];
+                *swcqe = *cqe;
+                swcqe->header |= cpu_to_be32(V_CQE_SWCQE(1));
+                t4_swcq_produce(cq);
+                t4_hwcq_consume(cq);
+                ret = t4_next_hw_cqe(cq, &cqe);
+        }
+}
+
+static int cqe_completes_wr(struct t4_cqe *cqe, struct t4_wq *wq)
+{
+        if (CQE_OPCODE(cqe) == FW_RI_TERMINATE)
+                return 0;
+
+        if ((CQE_OPCODE(cqe) == FW_RI_RDMA_WRITE) && RQ_TYPE(cqe))
+                return 0;
+
+        if ((CQE_OPCODE(cqe) == FW_RI_READ_RESP) && SQ_TYPE(cqe))
+                return 0;
+
+        if (CQE_SEND_OPCODE(cqe) && RQ_TYPE(cqe) && t4_rq_empty(wq))
+                return 0;
+        return 1;
+}
+
+void c4iw_count_scqes(struct t4_cq *cq, struct t4_wq *wq, int *count)
+{
+        struct t4_cqe *cqe;
+        u32 ptr;
+
+        *count = 0;
+        ptr = cq->sw_cidx;
+        while (ptr != cq->sw_pidx) {
+                cqe = &cq->sw_queue[ptr];
+                if ((SQ_TYPE(cqe) || ((CQE_OPCODE(cqe) == FW_RI_READ_RESP) &&
+                                      wq->sq.oldest_read)) &&
+                    (CQE_QPID(cqe) == wq->sq.qid))
+                        (*count)++;
+                if (++ptr == cq->size)
+                        ptr = 0;
+        }
+        PDBG("%s cq %p count %d\n", __func__, cq, *count);
+}
+
+void c4iw_count_rcqes(struct t4_cq *cq, struct t4_wq *wq, int *count)
+{
+        struct t4_cqe *cqe;
+        u32 ptr;
+
+        *count = 0;
+        PDBG("%s count zero %d\n", __func__, *count);
+        ptr = cq->sw_cidx;
+        while (ptr != cq->sw_pidx) {
+                cqe = &cq->sw_queue[ptr];
+                if (RQ_TYPE(cqe) && (CQE_OPCODE(cqe) != FW_RI_READ_RESP) &&
+                    (CQE_QPID(cqe) == wq->rq.qid) && cqe_completes_wr(cqe, wq))
+                        (*count)++;
+                if (++ptr == cq->size)
+                        ptr = 0;
+        }
+        PDBG("%s cq %p count %d\n", __func__, cq, *count);
+}
+
+static void flush_completed_wrs(struct t4_wq *wq, struct t4_cq *cq)
+{
+        struct t4_swsqe *swsqe;
+        u16 ptr = wq->sq.cidx;
+        int count = wq->sq.in_use;
+        int unsignaled = 0;
+
+        swsqe = &wq->sq.sw_sq[ptr];
+        while (count--)
+                if (!swsqe->signaled) {
+                        if (++ptr == wq->sq.size)
+                                ptr = 0;
+                        swsqe = &wq->sq.sw_sq[ptr];
+                        unsignaled++;
+                } else if (swsqe->complete) {
+
+                        /*
+                         * Insert this completed cqe into the swcq.
+                         */
+                        PDBG("%s moving cqe into swcq sq idx %u cq idx %u\n",
+                             __func__, ptr, cq->sw_pidx);
+                        swsqe->cqe.header |= htonl(V_CQE_SWCQE(1));
+                        cq->sw_queue[cq->sw_pidx] = swsqe->cqe;
+                        t4_swcq_produce(cq);
+                        swsqe->signaled = 0;
+                        wq->sq.in_use -= unsignaled;
+                        break;
+                } else
+                        break;
+}
+
+static void create_read_req_cqe(struct t4_wq *wq, struct t4_cqe *hw_cqe,
+                                struct t4_cqe *read_cqe)
+{
+        read_cqe->u.scqe.cidx = wq->sq.oldest_read->idx;
+        read_cqe->len = cpu_to_be32(wq->sq.oldest_read->read_len);
+        read_cqe->header = htonl(V_CQE_QPID(CQE_QPID(hw_cqe)) |
+                                 V_CQE_SWCQE(SW_CQE(hw_cqe)) |
+                                 V_CQE_OPCODE(FW_RI_READ_REQ) |
+                                 V_CQE_TYPE(1));
+}
+
+/*
+ * Return a ptr to the next read wr in the SWSQ or NULL.
+ */
+static void advance_oldest_read(struct t4_wq *wq)
+{
+
+        u32 rptr = wq->sq.oldest_read - wq->sq.sw_sq + 1;
+
+        if (rptr == wq->sq.size)
+                rptr = 0;
+        while (rptr != wq->sq.pidx) {
+                wq->sq.oldest_read = &wq->sq.sw_sq[rptr];
+
+                if (wq->sq.oldest_read->opcode == FW_RI_READ_REQ)
+                        return;
+                if (++rptr == wq->sq.size)
+                        rptr = 0;
+        }
+        wq->sq.oldest_read = NULL;
+}
+
+/*
+ * poll_cq
+ *
+ * Caller must:
+ *     check the validity of the first CQE,
+ *     supply the wq assicated with the qpid.
+ *
+ * credit: cq credit to return to sge.
+ * cqe_flushed: 1 iff the CQE is flushed.
+ * cqe: copy of the polled CQE.
+ *
+ * return value:
+ *    0             CQE returned ok.
+ *    -EAGAIN       CQE skipped, try again.
+ *    -EOVERFLOW    CQ overflow detected.
+ */
+static int poll_cq(struct t4_wq *wq, struct t4_cq *cq, struct t4_cqe *cqe,
+                   u8 *cqe_flushed, u64 *cookie, u32 *credit)
+{
+        int ret = 0;
+        struct t4_cqe *hw_cqe, read_cqe;
+
+        *cqe_flushed = 0;
+        *credit = 0;
+        ret = t4_next_cqe(cq, &hw_cqe);
+        if (ret)
+                return ret;
+
+        PDBG("%s CQE OVF %u qpid 0x%0x genbit %u type %u status 0x%0x"
+             " opcode 0x%0x len 0x%0x wrid_hi_stag 0x%x wrid_low_msn 0x%x\n",
+             __func__, CQE_OVFBIT(hw_cqe), CQE_QPID(hw_cqe),
+             CQE_GENBIT(hw_cqe), CQE_TYPE(hw_cqe), CQE_STATUS(hw_cqe),
+             CQE_OPCODE(hw_cqe), CQE_LEN(hw_cqe), CQE_WRID_HI(hw_cqe),
+             CQE_WRID_LOW(hw_cqe));
+
+        /*
+         * skip cqe's not affiliated with a QP.
+         */
+        if (wq == NULL) {
+                ret = -EAGAIN;
+                goto skip_cqe;
+        }
+
+        /*
+         * Gotta tweak READ completions:
+         *      1) the cqe doesn't contain the sq_wptr from the wr.
+         *      2) opcode not reflected from the wr.
+         *      3) read_len not reflected from the wr.
+         *      4) cq_type is RQ_TYPE not SQ_TYPE.
+         */
+        if (RQ_TYPE(hw_cqe) && (CQE_OPCODE(hw_cqe) == FW_RI_READ_RESP)) {
+
+                /*
+                 * If this is an unsolicited read response, then the read
+                 * was generated by the kernel driver as part of peer-2-peer
+                 * connection setup.  So ignore the completion.
+                 */
+                if (!wq->sq.oldest_read) {
+                        if (CQE_STATUS(hw_cqe))
+                                t4_set_wq_in_error(wq);
+                        ret = -EAGAIN;
+                        goto skip_cqe;
+                }
+
+                /*
+                 * Don't write to the HWCQ, so create a new read req CQE
+                 * in local memory.
+                 */
+                create_read_req_cqe(wq, hw_cqe, &read_cqe);
+                hw_cqe = &read_cqe;
+                advance_oldest_read(wq);
+        }
+
+        if (CQE_STATUS(hw_cqe) || t4_wq_in_error(wq)) {
+                *cqe_flushed = t4_wq_in_error(wq);
+                t4_set_wq_in_error(wq);
+                goto proc_cqe;
+        }
+
+        /*
+         * RECV completion.
+         */
+        if (RQ_TYPE(hw_cqe)) {
+
+                /*
+                 * HW only validates 4 bits of MSN.  So we must validate that
+                 * the MSN in the SEND is the next expected MSN.  If its not,
+                 * then we complete this with T4_ERR_MSN and mark the wq in
+                 * error.
+                 */
+
+                if (t4_rq_empty(wq)) {
+                        t4_set_wq_in_error(wq);
+                        ret = -EAGAIN;
+                        goto skip_cqe;
+                }
+                if (unlikely((CQE_WRID_MSN(hw_cqe) != (wq->rq.msn)))) {
+                        t4_set_wq_in_error(wq);
+                        hw_cqe->header |= htonl(V_CQE_STATUS(T4_ERR_MSN));
+                        goto proc_cqe;
+                }
+                goto proc_cqe;
+        }
+
+        /*
+         * If we get here its a send completion.
+         *
+         * Handle out of order completion. These get stuffed
+         * in the SW SQ. Then the SW SQ is walked to move any
+         * now in-order completions into the SW CQ.  This handles
+         * 2 cases:
+         *      1) reaping unsignaled WRs when the first subsequent
+         *         signaled WR is completed.
+         *      2) out of order read completions.
+         */
+        if (!SW_CQE(hw_cqe) && (CQE_WRID_SQ_IDX(hw_cqe) != wq->sq.cidx)) {
+                struct t4_swsqe *swsqe;
+
+                PDBG("%s out of order completion going in sw_sq at idx %u\n",
+                     __func__, CQE_WRID_SQ_IDX(hw_cqe));
+                swsqe = &wq->sq.sw_sq[CQE_WRID_SQ_IDX(hw_cqe)];
+                swsqe->cqe = *hw_cqe;
+                swsqe->complete = 1;
+                ret = -EAGAIN;
+                goto flush_wq;
+        }
+
+proc_cqe:
+        *cqe = *hw_cqe;
+
+        /*
+         * Reap the associated WR(s) that are freed up with this
+         * completion.
+         */
+        if (SQ_TYPE(hw_cqe)) {
+                wq->sq.cidx = CQE_WRID_SQ_IDX(hw_cqe);
+                PDBG("%s completing sq idx %u\n", __func__, wq->sq.cidx);
+                *cookie = wq->sq.sw_sq[wq->sq.cidx].wr_id;
+                t4_sq_consume(wq);
+        } else {
+                PDBG("%s completing rq idx %u\n", __func__, wq->rq.cidx);
+                *cookie = wq->rq.sw_rq[wq->rq.cidx].wr_id;
+                BUG_ON(t4_rq_empty(wq));
+                t4_rq_consume(wq);
+        }
+
+flush_wq:
+        /*
+         * Flush any completed cqes that are now in-order.
+         */
+        flush_completed_wrs(wq, cq);
+
+skip_cqe:
+        if (SW_CQE(hw_cqe)) {
+                PDBG("%s cq %p cqid 0x%x skip sw cqe cidx %u\n",
+                     __func__, cq, cq->cqid, cq->sw_cidx);
+                t4_swcq_consume(cq);
+        } else {
+                PDBG("%s cq %p cqid 0x%x skip hw cqe cidx %u\n",
+                     __func__, cq, cq->cqid, cq->cidx);
+                t4_hwcq_consume(cq);
+        }
+        return ret;
+}
+
+/*
+ * Get one cq entry from c4iw and map it to openib.
+ *
+ * Returns:
+ *      0                       cqe returned
+ *      -ENODATA                EMPTY;
+ *      -EAGAIN                 caller must try again
+ *      any other -errno        fatal error
+ */
+static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
+{
+        struct c4iw_qp *qhp = NULL;
+        struct t4_cqe cqe = {0, 0}, *rd_cqe;
+        struct t4_wq *wq;
+        u32 credit = 0;
+        u8 cqe_flushed;
+        u64 cookie = 0;
+        int ret;
+
+        ret = t4_next_cqe(&chp->cq, &rd_cqe);
+
+        if (ret)
+                return ret;
+
+        qhp = get_qhp(chp->rhp, CQE_QPID(rd_cqe));
+        if (!qhp)
+                wq = NULL;
+        else {
+                spin_lock(&qhp->lock);
+                wq = &(qhp->wq);
+        }
+        ret = poll_cq(wq, &(chp->cq), &cqe, &cqe_flushed, &cookie, &credit);
+        if (ret)
+                goto out;
+
+        wc->wr_id = cookie;
+        wc->qp = &qhp->ibqp;
+        wc->vendor_err = CQE_STATUS(&cqe);
+        wc->wc_flags = 0;
+
+        PDBG("%s qpid 0x%x type %d opcode %d status 0x%x len %u wrid hi 0x%x "
+             "lo 0x%x cookie 0x%llx\n", __func__, CQE_QPID(&cqe),
+             CQE_TYPE(&cqe), CQE_OPCODE(&cqe), CQE_STATUS(&cqe), CQE_LEN(&cqe),
+             CQE_WRID_HI(&cqe), CQE_WRID_LOW(&cqe), (unsigned long long)cookie);
+
+        if (CQE_TYPE(&cqe) == 0) {
+                if (!CQE_STATUS(&cqe))
+                        wc->byte_len = CQE_LEN(&cqe);
+                else
+                        wc->byte_len = 0;
+                wc->opcode = IB_WC_RECV;
+                if (CQE_OPCODE(&cqe) == FW_RI_SEND_WITH_INV ||
+                    CQE_OPCODE(&cqe) == FW_RI_SEND_WITH_SE_INV) {
+                        wc->ex.invalidate_rkey = CQE_WRID_STAG(&cqe);
+                        wc->wc_flags |= IB_WC_WITH_INVALIDATE;
+                }
+        } else {
+                switch (CQE_OPCODE(&cqe)) {
+                case FW_RI_RDMA_WRITE:
+                        wc->opcode = IB_WC_RDMA_WRITE;
+                        break;
+                case FW_RI_READ_REQ:
+                        wc->opcode = IB_WC_RDMA_READ;
+                        wc->byte_len = CQE_LEN(&cqe);
+                        break;
+                case FW_RI_SEND_WITH_INV:
+                case FW_RI_SEND_WITH_SE_INV:
+                        wc->opcode = IB_WC_SEND;
+                        wc->wc_flags |= IB_WC_WITH_INVALIDATE;
+                        break;
+                case FW_RI_SEND:
+                case FW_RI_SEND_WITH_SE:
+                        wc->opcode = IB_WC_SEND;
+                        break;
+                case FW_RI_BIND_MW:
+                        wc->opcode = IB_WC_BIND_MW;
+                        break;
+
+                case FW_RI_LOCAL_INV:
+                        wc->opcode = IB_WC_LOCAL_INV;
+                        break;
+                case FW_RI_FAST_REGISTER:
+                        wc->opcode = IB_WC_FAST_REG_MR;
+                        break;
+                default:
+                        printk(KERN_ERR MOD "Unexpected opcode %d "
+                               "in the CQE received for QPID=0x%0x\n",
+                               CQE_OPCODE(&cqe), CQE_QPID(&cqe));
+                        ret = -EINVAL;
+                        goto out;
+                }
+        }
+
+        if (cqe_flushed)
+                wc->status = IB_WC_WR_FLUSH_ERR;
+        else {
+
+                switch (CQE_STATUS(&cqe)) {
+                case T4_ERR_SUCCESS:
+                        wc->status = IB_WC_SUCCESS;
+                        break;
+                case T4_ERR_STAG:
+                        wc->status = IB_WC_LOC_ACCESS_ERR;
+                        break;
+                case T4_ERR_PDID:
+                        wc->status = IB_WC_LOC_PROT_ERR;
+                        break;
+                case T4_ERR_QPID:
+                case T4_ERR_ACCESS:
+                        wc->status = IB_WC_LOC_ACCESS_ERR;
+                        break;
+                case T4_ERR_WRAP:
+                        wc->status = IB_WC_GENERAL_ERR;
+                        break;
+                case T4_ERR_BOUND:
+                        wc->status = IB_WC_LOC_LEN_ERR;
+                        break;
+                case T4_ERR_INVALIDATE_SHARED_MR:
+                case T4_ERR_INVALIDATE_MR_WITH_MW_BOUND:
+                        wc->status = IB_WC_MW_BIND_ERR;
+                        break;
+                case T4_ERR_CRC:
+                case T4_ERR_MARKER:
+                case T4_ERR_PDU_LEN_ERR:
+                case T4_ERR_OUT_OF_RQE:
+                case T4_ERR_DDP_VERSION:
+                case T4_ERR_RDMA_VERSION:
+                case T4_ERR_DDP_QUEUE_NUM:
+                case T4_ERR_MSN:
+                case T4_ERR_TBIT:
+                case T4_ERR_MO:
+                case T4_ERR_MSN_RANGE:
+                case T4_ERR_IRD_OVERFLOW:
+                case T4_ERR_OPCODE:
+                        wc->status = IB_WC_FATAL_ERR;
+                        break;
+                case T4_ERR_SWFLUSH:
+                        wc->status = IB_WC_WR_FLUSH_ERR;
+                        break;
+                default:
+                        printk(KERN_ERR MOD
+                               "Unexpected cqe_status 0x%x for QPID=0x%0x\n",
+                               CQE_STATUS(&cqe), CQE_QPID(&cqe));
+                        ret = -EINVAL;
+                }
+        }
+out:
+        if (wq)
+                spin_unlock(&qhp->lock);
+        return ret;
+}
+
+int c4iw_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
+{
+        struct c4iw_cq *chp;
+        unsigned long flags;
+        int npolled;
+        int err = 0;
+
+        chp = to_c4iw_cq(ibcq);
+
+        spin_lock_irqsave(&chp->lock, flags);
+        for (npolled = 0; npolled < num_entries; ++npolled) {
+                do {
+                        err = c4iw_poll_cq_one(chp, wc + npolled);
+                } while (err == -EAGAIN);
+                if (err)
+                        break;
+        }
+        spin_unlock_irqrestore(&chp->lock, flags);
+        return !err || err == -ENODATA ? npolled : err;
+}
+
+int c4iw_destroy_cq(struct ib_cq *ib_cq)
+{
+        struct c4iw_cq *chp;
+        struct c4iw_ucontext *ucontext;
+
+        PDBG("%s ib_cq %p\n", __func__, ib_cq);
+        chp = to_c4iw_cq(ib_cq);
+
+        remove_handle(chp->rhp, &chp->rhp->cqidr, chp->cq.cqid);
+        atomic_dec(&chp->refcnt);
+        wait_event(chp->wait, !atomic_read(&chp->refcnt));
+
+        ucontext = ib_cq->uobject ? to_c4iw_ucontext(ib_cq->uobject->context)
+                                  : NULL;
+        destroy_cq(&chp->rhp->rdev, &chp->cq,
+                   ucontext ? &ucontext->uctx : &chp->cq.rdev->uctx);
+        kfree(chp);
+        return 0;
+}
+
+struct ib_cq *c4iw_create_cq(struct ib_device *ibdev, int entries,
+                             int vector, struct ib_ucontext *ib_context,
+                             struct ib_udata *udata)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_cq *chp;
+        struct c4iw_create_cq_resp uresp;
+        struct c4iw_ucontext *ucontext = NULL;
+        int ret;
+        size_t memsize;
+        struct c4iw_mm_entry *mm, *mm2;
+
+        PDBG("%s ib_dev %p entries %d\n", __func__, ibdev, entries);
+
+        rhp = to_c4iw_dev(ibdev);
+
+        chp = kzalloc(sizeof(*chp), GFP_KERNEL);
+        if (!chp)
+                return ERR_PTR(-ENOMEM);
+
+        if (ib_context)
+                ucontext = to_c4iw_ucontext(ib_context);
+
+        /* account for the status page. */
+        entries++;
+
+        /*
+         * entries must be multiple of 16 for HW.
+         */
+        entries = roundup(entries, 16);
+        memsize = entries * sizeof *chp->cq.queue;
+
+        /*
+         * memsize must be a multiple of the page size if its a user cq.
+         */
+        if (ucontext)
+                memsize = roundup(memsize, PAGE_SIZE);
+        chp->cq.size = entries;
+        chp->cq.memsize = memsize;
+
+        ret = create_cq(&rhp->rdev, &chp->cq,
+                        ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+        if (ret)
+                goto err1;
+
+        chp->rhp = rhp;
+        chp->cq.size--;                         /* status page */
+        chp->ibcq.cqe = chp->cq.size;
+        spin_lock_init(&chp->lock);
+        atomic_set(&chp->refcnt, 1);
+        init_waitqueue_head(&chp->wait);
+        ret = insert_handle(rhp, &rhp->cqidr, chp, chp->cq.cqid);
+        if (ret)
+                goto err2;
+
+        if (ucontext) {
+                mm = kmalloc(sizeof *mm, GFP_KERNEL);
+                if (!mm)
+                        goto err3;
+                mm2 = kmalloc(sizeof *mm2, GFP_KERNEL);
+                if (!mm2)
+                        goto err4;
+
+                uresp.qid_mask = rhp->rdev.cqmask;
+                uresp.cqid = chp->cq.cqid;
+                uresp.size = chp->cq.size;
+                uresp.memsize = chp->cq.memsize;
+                spin_lock(&ucontext->mmap_lock);
+                uresp.key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                uresp.gts_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                spin_unlock(&ucontext->mmap_lock);
+                ret = ib_copy_to_udata(udata, &uresp, sizeof uresp);
+                if (ret)
+                        goto err5;
+
+                mm->key = uresp.key;
+                mm->addr = virt_to_phys(chp->cq.queue);
+                mm->len = chp->cq.memsize;
+                insert_mmap(ucontext, mm);
+
+                mm2->key = uresp.gts_key;
+                mm2->addr = chp->cq.ugts;
+                mm2->len = PAGE_SIZE;
+                insert_mmap(ucontext, mm2);
+        }
+        PDBG("%s cqid 0x%0x chp %p size %u memsize %zu, dma_addr 0x%0llx\n",
+             __func__, chp->cq.cqid, chp, chp->cq.size,
+             chp->cq.memsize,
+             (unsigned long long) chp->cq.dma_addr);
+        return &chp->ibcq;
+err5:
+        kfree(mm2);
+err4:
+        kfree(mm);
+err3:
+        remove_handle(rhp, &rhp->cqidr, chp->cq.cqid);
+err2:
+        destroy_cq(&chp->rhp->rdev, &chp->cq,
+                   ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+err1:
+        kfree(chp);
+        return ERR_PTR(ret);
+}
+
+int c4iw_resize_cq(struct ib_cq *cq, int cqe, struct ib_udata *udata)
+{
+        return -ENOSYS;
+}
+
+int c4iw_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
+{
+        struct c4iw_cq *chp;
+        int ret;
+        unsigned long flag;
+
+        chp = to_c4iw_cq(ibcq);
+        spin_lock_irqsave(&chp->lock, flag);
+        ret = t4_arm_cq(&chp->cq,
+                        (flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED);
+        spin_unlock_irqrestore(&chp->lock, flag);
+        if (ret && !(flags & IB_CQ_REPORT_MISSED_EVENTS))
+                ret = 0;
+        return ret;
+}
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
new file mode 100644
index 000000000000..be23b5eab13b
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -0,0 +1,520 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/debugfs.h>
+
+#include <rdma/ib_verbs.h>
+
+#include "iw_cxgb4.h"
+
+#define DRV_VERSION "0.1"
+
+MODULE_AUTHOR("Steve Wise");
+MODULE_DESCRIPTION("Chelsio T4 RDMA Driver");
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_VERSION(DRV_VERSION);
+
+static LIST_HEAD(dev_list);
+static DEFINE_MUTEX(dev_mutex);
+
+static struct dentry *c4iw_debugfs_root;
+
+struct debugfs_qp_data {
+        struct c4iw_dev *devp;
+        char *buf;
+        int bufsize;
+        int pos;
+};
+
+static int count_qps(int id, void *p, void *data)
+{
+        struct c4iw_qp *qp = p;
+        int *countp = data;
+
+        if (id != qp->wq.sq.qid)
+                return 0;
+
+        *countp = *countp + 1;
+        return 0;
+}
+
+static int dump_qps(int id, void *p, void *data)
+{
+        struct c4iw_qp *qp = p;
+        struct debugfs_qp_data *qpd = data;
+        int space;
+        int cc;
+
+        if (id != qp->wq.sq.qid)
+                return 0;
+
+        space = qpd->bufsize - qpd->pos - 1;
+        if (space == 0)
+                return 1;
+
+        if (qp->ep)
+                cc = snprintf(qpd->buf + qpd->pos, space, "qp id %u state %u "
+                             "ep tid %u state %u %pI4:%u->%pI4:%u\n",
+                             qp->wq.sq.qid, (int)qp->attr.state,
+                             qp->ep->hwtid, (int)qp->ep->com.state,
+                             &qp->ep->com.local_addr.sin_addr.s_addr,
+                             ntohs(qp->ep->com.local_addr.sin_port),
+                             &qp->ep->com.remote_addr.sin_addr.s_addr,
+                             ntohs(qp->ep->com.remote_addr.sin_port));
+        else
+                cc = snprintf(qpd->buf + qpd->pos, space, "qp id %u state %u\n",
+                              qp->wq.sq.qid, (int)qp->attr.state);
+        if (cc < space)
+                qpd->pos += cc;
+        return 0;
+}
+
+static int qp_release(struct inode *inode, struct file *file)
+{
+        struct debugfs_qp_data *qpd = file->private_data;
+        if (!qpd) {
+                printk(KERN_INFO "%s null qpd?\n", __func__);
+                return 0;
+        }
+        kfree(qpd->buf);
+        kfree(qpd);
+        return 0;
+}
+
+static int qp_open(struct inode *inode, struct file *file)
+{
+        struct debugfs_qp_data *qpd;
+        int ret = 0;
+        int count = 1;
+
+        qpd = kmalloc(sizeof *qpd, GFP_KERNEL);
+        if (!qpd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        qpd->devp = inode->i_private;
+        qpd->pos = 0;
+
+        spin_lock_irq(&qpd->devp->lock);
+        idr_for_each(&qpd->devp->qpidr, count_qps, &count);
+        spin_unlock_irq(&qpd->devp->lock);
+
+        qpd->bufsize = count * 128;
+        qpd->buf = kmalloc(qpd->bufsize, GFP_KERNEL);
+        if (!qpd->buf) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+
+        spin_lock_irq(&qpd->devp->lock);
+        idr_for_each(&qpd->devp->qpidr, dump_qps, qpd);
+        spin_unlock_irq(&qpd->devp->lock);
+
+        qpd->buf[qpd->pos++] = 0;
+        file->private_data = qpd;
+        goto out;
+err1:
+        kfree(qpd);
+out:
+        return ret;
+}
+
+static ssize_t qp_read(struct file *file, char __user *buf, size_t count,
+                        loff_t *ppos)
+{
+        struct debugfs_qp_data *qpd = file->private_data;
+        loff_t pos = *ppos;
+        loff_t avail = qpd->pos;
+
+        if (pos < 0)
+                return -EINVAL;
+        if (pos >= avail)
+                return 0;
+        if (count > avail - pos)
+                count = avail - pos;
+
+        while (count) {
+                size_t len = 0;
+
+                len = min((int)count, (int)qpd->pos - (int)pos);
+                if (copy_to_user(buf, qpd->buf + pos, len))
+                        return -EFAULT;
+                if (len == 0)
+                        return -EINVAL;
+
+                buf += len;
+                pos += len;
+                count -= len;
+        }
+        count = pos - *ppos;
+        *ppos = pos;
+        return count;
+}
+
+static const struct file_operations qp_debugfs_fops = {
+        .owner   = THIS_MODULE,
+        .open    = qp_open,
+        .release = qp_release,
+        .read    = qp_read,
+};
+
+static int setup_debugfs(struct c4iw_dev *devp)
+{
+        struct dentry *de;
+
+        if (!devp->debugfs_root)
+                return -1;
+
+        de = debugfs_create_file("qps", S_IWUSR, devp->debugfs_root,
+                                 (void *)devp, &qp_debugfs_fops);
+        if (de && de->d_inode)
+                de->d_inode->i_size = 4096;
+        return 0;
+}
+
+void c4iw_release_dev_ucontext(struct c4iw_rdev *rdev,
+                               struct c4iw_dev_ucontext *uctx)
+{
+        struct list_head *pos, *nxt;
+        struct c4iw_qid_list *entry;
+
+        mutex_lock(&uctx->lock);
+        list_for_each_safe(pos, nxt, &uctx->qpids) {
+                entry = list_entry(pos, struct c4iw_qid_list, entry);
+                list_del_init(&entry->entry);
+                if (!(entry->qid & rdev->qpmask))
+                        c4iw_put_resource(&rdev->resource.qid_fifo, entry->qid,
+                                          &rdev->resource.qid_fifo_lock);
+                kfree(entry);
+        }
+
+        list_for_each_safe(pos, nxt, &uctx->qpids) {
+                entry = list_entry(pos, struct c4iw_qid_list, entry);
+                list_del_init(&entry->entry);
+                kfree(entry);
+        }
+        mutex_unlock(&uctx->lock);
+}
+
+void c4iw_init_dev_ucontext(struct c4iw_rdev *rdev,
+                            struct c4iw_dev_ucontext *uctx)
+{
+        INIT_LIST_HEAD(&uctx->qpids);
+        INIT_LIST_HEAD(&uctx->cqids);
+        mutex_init(&uctx->lock);
+}
+
+/* Caller takes care of locking if needed */
+static int c4iw_rdev_open(struct c4iw_rdev *rdev)
+{
+        int err;
+
+        c4iw_init_dev_ucontext(rdev, &rdev->uctx);
+
+        /*
+         * qpshift is the number of bits to shift the qpid left in order
+         * to get the correct address of the doorbell for that qp.
+         */
+        rdev->qpshift = PAGE_SHIFT - ilog2(rdev->lldi.udb_density);
+        rdev->qpmask = rdev->lldi.udb_density - 1;
+        rdev->cqshift = PAGE_SHIFT - ilog2(rdev->lldi.ucq_density);
+        rdev->cqmask = rdev->lldi.ucq_density - 1;
+        PDBG("%s dev %s stag start 0x%0x size 0x%0x num stags %d "
+             "pbl start 0x%0x size 0x%0x rq start 0x%0x size 0x%0x\n",
+             __func__, pci_name(rdev->lldi.pdev), rdev->lldi.vr->stag.start,
+             rdev->lldi.vr->stag.size, c4iw_num_stags(rdev),
+             rdev->lldi.vr->pbl.start,
+             rdev->lldi.vr->pbl.size, rdev->lldi.vr->rq.start,
+             rdev->lldi.vr->rq.size);
+        PDBG("udb len 0x%x udb base %p db_reg %p gts_reg %p qpshift %lu "
+             "qpmask 0x%x cqshift %lu cqmask 0x%x\n",
+             (unsigned)pci_resource_len(rdev->lldi.pdev, 2),
+             (void *)pci_resource_start(rdev->lldi.pdev, 2),
+             rdev->lldi.db_reg,
+             rdev->lldi.gts_reg,
+             rdev->qpshift, rdev->qpmask,
+             rdev->cqshift, rdev->cqmask);
+
+        if (c4iw_num_stags(rdev) == 0) {
+                err = -EINVAL;
+                goto err1;
+        }
+
+        err = c4iw_init_resource(rdev, c4iw_num_stags(rdev), T4_MAX_NUM_PD);
+        if (err) {
+                printk(KERN_ERR MOD "error %d initializing resources\n", err);
+                goto err1;
+        }
+        err = c4iw_pblpool_create(rdev);
+        if (err) {
+                printk(KERN_ERR MOD "error %d initializing pbl pool\n", err);
+                goto err2;
+        }
+        err = c4iw_rqtpool_create(rdev);
+        if (err) {
+                printk(KERN_ERR MOD "error %d initializing rqt pool\n", err);
+                goto err3;
+        }
+        return 0;
+err3:
+        c4iw_pblpool_destroy(rdev);
+err2:
+        c4iw_destroy_resource(&rdev->resource);
+err1:
+        return err;
+}
+
+static void c4iw_rdev_close(struct c4iw_rdev *rdev)
+{
+        c4iw_pblpool_destroy(rdev);
+        c4iw_rqtpool_destroy(rdev);
+        c4iw_destroy_resource(&rdev->resource);
+}
+
+static void c4iw_remove(struct c4iw_dev *dev)
+{
+        PDBG("%s c4iw_dev %p\n", __func__,  dev);
+        cancel_delayed_work_sync(&dev->db_drop_task);
+        list_del(&dev->entry);
+        c4iw_unregister_device(dev);
+        c4iw_rdev_close(&dev->rdev);
+        idr_destroy(&dev->cqidr);
+        idr_destroy(&dev->qpidr);
+        idr_destroy(&dev->mmidr);
+        ib_dealloc_device(&dev->ibdev);
+}
+
+static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
+{
+        struct c4iw_dev *devp;
+        int ret;
+
+        devp = (struct c4iw_dev *)ib_alloc_device(sizeof(*devp));
+        if (!devp) {
+                printk(KERN_ERR MOD "Cannot allocate ib device\n");
+                return NULL;
+        }
+        devp->rdev.lldi = *infop;
+
+        mutex_lock(&dev_mutex);
+
+        ret = c4iw_rdev_open(&devp->rdev);
+        if (ret) {
+                mutex_unlock(&dev_mutex);
+                printk(KERN_ERR MOD "Unable to open CXIO rdev err %d\n", ret);
+                ib_dealloc_device(&devp->ibdev);
+                return NULL;
+        }
+
+        idr_init(&devp->cqidr);
+        idr_init(&devp->qpidr);
+        idr_init(&devp->mmidr);
+        spin_lock_init(&devp->lock);
+        list_add_tail(&devp->entry, &dev_list);
+        mutex_unlock(&dev_mutex);
+
+        if (c4iw_register_device(devp)) {
+                printk(KERN_ERR MOD "Unable to register device\n");
+                mutex_lock(&dev_mutex);
+                c4iw_remove(devp);
+                mutex_unlock(&dev_mutex);
+        }
+        if (c4iw_debugfs_root) {
+                devp->debugfs_root = debugfs_create_dir(
+                                        pci_name(devp->rdev.lldi.pdev),
+                                        c4iw_debugfs_root);
+                setup_debugfs(devp);
+        }
+        return devp;
+}
+
+static void *c4iw_uld_add(const struct cxgb4_lld_info *infop)
+{
+        struct c4iw_dev *dev;
+        static int vers_printed;
+        int i;
+
+        if (!vers_printed++)
+                printk(KERN_INFO MOD "Chelsio T4 RDMA Driver - version %s\n",
+                       DRV_VERSION);
+
+        dev = c4iw_alloc(infop);
+        if (!dev)
+                goto out;
+
+        PDBG("%s found device %s nchan %u nrxq %u ntxq %u nports %u\n",
+             __func__, pci_name(dev->rdev.lldi.pdev),
+             dev->rdev.lldi.nchan, dev->rdev.lldi.nrxq,
+             dev->rdev.lldi.ntxq, dev->rdev.lldi.nports);
+
+        for (i = 0; i < dev->rdev.lldi.nrxq; i++)
+                PDBG("rxqid[%u] %u\n", i, dev->rdev.lldi.rxq_ids[i]);
+
+        printk(KERN_INFO MOD "Initialized device %s\n",
+               pci_name(dev->rdev.lldi.pdev));
+out:
+        return dev;
+}
+
+static struct sk_buff *t4_pktgl_to_skb(const struct pkt_gl *gl,
+                                       unsigned int skb_len,
+                                       unsigned int pull_len)
+{
+        struct sk_buff *skb;
+        struct skb_shared_info *ssi;
+
+        if (gl->tot_len <= 512) {
+                skb = alloc_skb(gl->tot_len, GFP_ATOMIC);
+                if (unlikely(!skb))
+                        goto out;
+                __skb_put(skb, gl->tot_len);
+                skb_copy_to_linear_data(skb, gl->va, gl->tot_len);
+        } else {
+                skb = alloc_skb(skb_len, GFP_ATOMIC);
+                if (unlikely(!skb))
+                        goto out;
+                __skb_put(skb, pull_len);
+                skb_copy_to_linear_data(skb, gl->va, pull_len);
+
+                ssi = skb_shinfo(skb);
+                ssi->frags[0].page = gl->frags[0].page;
+                ssi->frags[0].page_offset = gl->frags[0].page_offset + pull_len;
+                ssi->frags[0].size = gl->frags[0].size - pull_len;
+                if (gl->nfrags > 1)
+                        memcpy(&ssi->frags[1], &gl->frags[1],
+                               (gl->nfrags - 1) * sizeof(skb_frag_t));
+                ssi->nr_frags = gl->nfrags;
+
+                skb->len = gl->tot_len;
+                skb->data_len = skb->len - pull_len;
+                skb->truesize += skb->data_len;
+
+                /* Get a reference for the last page, we don't own it */
+                get_page(gl->frags[gl->nfrags - 1].page);
+        }
+out:
+        return skb;
+}
+
+static int c4iw_uld_rx_handler(void *handle, const __be64 *rsp,
+                        const struct pkt_gl *gl)
+{
+        struct c4iw_dev *dev = handle;
+        struct sk_buff *skb;
+        const struct cpl_act_establish *rpl;
+        unsigned int opcode;
+
+        if (gl == NULL) {
+                /* omit RSS and rsp_ctrl at end of descriptor */
+                unsigned int len = 64 - sizeof(struct rsp_ctrl) - 8;
+
+                skb = alloc_skb(256, GFP_ATOMIC);
+                if (!skb)
+                        goto nomem;
+                __skb_put(skb, len);
+                skb_copy_to_linear_data(skb, &rsp[1], len);
+        } else if (gl == CXGB4_MSG_AN) {
+                const struct rsp_ctrl *rc = (void *)rsp;
+
+                u32 qid = be32_to_cpu(rc->pldbuflen_qid);
+                c4iw_ev_handler(dev, qid);
+                return 0;
+        } else {
+                skb = t4_pktgl_to_skb(gl, 128, 128);
+                if (unlikely(!skb))
+                        goto nomem;
+        }
+
+        rpl = cplhdr(skb);
+        opcode = rpl->ot.opcode;
+
+        if (c4iw_handlers[opcode])
+                c4iw_handlers[opcode](dev, skb);
+        else
+                printk(KERN_INFO "%s no handler opcode 0x%x...\n", __func__,
+                       opcode);
+
+        return 0;
+nomem:
+        return -1;
+}
+
+static int c4iw_uld_state_change(void *handle, enum cxgb4_state new_state)
+{
+        PDBG("%s new_state %u\n", __func__, new_state);
+        return 0;
+}
+
+static struct cxgb4_uld_info c4iw_uld_info = {
+        .name = DRV_NAME,
+        .add = c4iw_uld_add,
+        .rx_handler = c4iw_uld_rx_handler,
+        .state_change = c4iw_uld_state_change,
+};
+
+static int __init c4iw_init_module(void)
+{
+        int err;
+
+        err = c4iw_cm_init();
+        if (err)
+                return err;
+
+        c4iw_debugfs_root = debugfs_create_dir(DRV_NAME, NULL);
+        if (!c4iw_debugfs_root)
+                printk(KERN_WARNING MOD
+                       "could not create debugfs entry, continuing\n");
+
+        cxgb4_register_uld(CXGB4_ULD_RDMA, &c4iw_uld_info);
+
+        return 0;
+}
+
+static void __exit c4iw_exit_module(void)
+{
+        struct c4iw_dev *dev, *tmp;
+
+        cxgb4_unregister_uld(CXGB4_ULD_RDMA);
+
+        mutex_lock(&dev_mutex);
+        list_for_each_entry_safe(dev, tmp, &dev_list, entry) {
+                c4iw_remove(dev);
+        }
+        mutex_unlock(&dev_mutex);
+
+        c4iw_cm_term();
+        debugfs_remove_recursive(c4iw_debugfs_root);
+}
+
+module_init(c4iw_init_module);
+module_exit(c4iw_exit_module);
diff --git a/drivers/infiniband/hw/cxgb4/ev.c b/drivers/infiniband/hw/cxgb4/ev.c
new file mode 100644
index 000000000000..491e76a0327f
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/ev.c
@@ -0,0 +1,193 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/slab.h>
+#include <linux/mman.h>
+#include <net/sock.h>
+
+#include "iw_cxgb4.h"
+
+static void post_qp_event(struct c4iw_dev *dev, struct c4iw_cq *chp,
+                          struct c4iw_qp *qhp,
+                          struct t4_cqe *err_cqe,
+                          enum ib_event_type ib_event)
+{
+        struct ib_event event;
+        struct c4iw_qp_attributes attrs;
+
+        if ((qhp->attr.state == C4IW_QP_STATE_ERROR) ||
+            (qhp->attr.state == C4IW_QP_STATE_TERMINATE)) {
+                PDBG("%s AE received after RTS - "
+                     "qp state %d qpid 0x%x status 0x%x\n", __func__,
+                     qhp->attr.state, qhp->wq.sq.qid, CQE_STATUS(err_cqe));
+                return;
+        }
+
+        printk(KERN_ERR MOD "AE qpid 0x%x opcode %d status 0x%x "
+               "type %d wrid.hi 0x%x wrid.lo 0x%x\n",
+               CQE_QPID(err_cqe), CQE_OPCODE(err_cqe),
+               CQE_STATUS(err_cqe), CQE_TYPE(err_cqe),
+               CQE_WRID_HI(err_cqe), CQE_WRID_LOW(err_cqe));
+
+        if (qhp->attr.state == C4IW_QP_STATE_RTS) {
+                attrs.next_state = C4IW_QP_STATE_TERMINATE;
+                c4iw_modify_qp(qhp->rhp, qhp, C4IW_QP_ATTR_NEXT_STATE,
+                               &attrs, 1);
+        }
+
+        event.event = ib_event;
+        event.device = chp->ibcq.device;
+        if (ib_event == IB_EVENT_CQ_ERR)
+                event.element.cq = &chp->ibcq;
+        else
+                event.element.qp = &qhp->ibqp;
+        if (qhp->ibqp.event_handler)
+                (*qhp->ibqp.event_handler)(&event, qhp->ibqp.qp_context);
+
+        (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
+}
+
+void c4iw_ev_dispatch(struct c4iw_dev *dev, struct t4_cqe *err_cqe)
+{
+        struct c4iw_cq *chp;
+        struct c4iw_qp *qhp;
+        u32 cqid;
+
+        spin_lock(&dev->lock);
+        qhp = get_qhp(dev, CQE_QPID(err_cqe));
+        if (!qhp) {
+                printk(KERN_ERR MOD "BAD AE qpid 0x%x opcode %d "
+                       "status 0x%x type %d wrid.hi 0x%x wrid.lo 0x%x\n",
+                       CQE_QPID(err_cqe),
+                       CQE_OPCODE(err_cqe), CQE_STATUS(err_cqe),
+                       CQE_TYPE(err_cqe), CQE_WRID_HI(err_cqe),
+                       CQE_WRID_LOW(err_cqe));
+                spin_unlock(&dev->lock);
+                goto out;
+        }
+
+        if (SQ_TYPE(err_cqe))
+                cqid = qhp->attr.scq;
+        else
+                cqid = qhp->attr.rcq;
+        chp = get_chp(dev, cqid);
+        if (!chp) {
+                printk(KERN_ERR MOD "BAD AE cqid 0x%x qpid 0x%x opcode %d "
+                       "status 0x%x type %d wrid.hi 0x%x wrid.lo 0x%x\n",
+                       cqid, CQE_QPID(err_cqe),
+                       CQE_OPCODE(err_cqe), CQE_STATUS(err_cqe),
+                       CQE_TYPE(err_cqe), CQE_WRID_HI(err_cqe),
+                       CQE_WRID_LOW(err_cqe));
+                spin_unlock(&dev->lock);
+                goto out;
+        }
+
+        c4iw_qp_add_ref(&qhp->ibqp);
+        atomic_inc(&chp->refcnt);
+        spin_unlock(&dev->lock);
+
+        /* Bad incoming write */
+        if (RQ_TYPE(err_cqe) &&
+            (CQE_OPCODE(err_cqe) == FW_RI_RDMA_WRITE)) {
+                post_qp_event(dev, chp, qhp, err_cqe, IB_EVENT_QP_REQ_ERR);
+                goto done;
+        }
+
+        switch (CQE_STATUS(err_cqe)) {
+
+        /* Completion Events */
+        case T4_ERR_SUCCESS:
+                printk(KERN_ERR MOD "AE with status 0!\n");
+                break;
+
+        case T4_ERR_STAG:
+        case T4_ERR_PDID:
+        case T4_ERR_QPID:
+        case T4_ERR_ACCESS:
+        case T4_ERR_WRAP:
+        case T4_ERR_BOUND:
+        case T4_ERR_INVALIDATE_SHARED_MR:
+        case T4_ERR_INVALIDATE_MR_WITH_MW_BOUND:
+                post_qp_event(dev, chp, qhp, err_cqe, IB_EVENT_QP_ACCESS_ERR);
+                break;
+
+        /* Device Fatal Errors */
+        case T4_ERR_ECC:
+        case T4_ERR_ECC_PSTAG:
+        case T4_ERR_INTERNAL_ERR:
+                post_qp_event(dev, chp, qhp, err_cqe, IB_EVENT_DEVICE_FATAL);
+                break;
+
+        /* QP Fatal Errors */
+        case T4_ERR_OUT_OF_RQE:
+        case T4_ERR_PBL_ADDR_BOUND:
+        case T4_ERR_CRC:
+        case T4_ERR_MARKER:
+        case T4_ERR_PDU_LEN_ERR:
+        case T4_ERR_DDP_VERSION:
+        case T4_ERR_RDMA_VERSION:
+        case T4_ERR_OPCODE:
+        case T4_ERR_DDP_QUEUE_NUM:
+        case T4_ERR_MSN:
+        case T4_ERR_TBIT:
+        case T4_ERR_MO:
+        case T4_ERR_MSN_GAP:
+        case T4_ERR_MSN_RANGE:
+        case T4_ERR_RQE_ADDR_BOUND:
+        case T4_ERR_IRD_OVERFLOW:
+                post_qp_event(dev, chp, qhp, err_cqe, IB_EVENT_QP_FATAL);
+                break;
+
+        default:
+                printk(KERN_ERR MOD "Unknown T4 status 0x%x QPID 0x%x\n",
+                       CQE_STATUS(err_cqe), qhp->wq.sq.qid);
+                post_qp_event(dev, chp, qhp, err_cqe, IB_EVENT_QP_FATAL);
+                break;
+        }
+done:
+        if (atomic_dec_and_test(&chp->refcnt))
+                wake_up(&chp->wait);
+        c4iw_qp_rem_ref(&qhp->ibqp);
+out:
+        return;
+}
+
+int c4iw_ev_handler(struct c4iw_dev *dev, u32 qid)
+{
+        struct c4iw_cq *chp;
+
+        chp = get_chp(dev, qid);
+        if (chp)
+                (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
+        else
+                PDBG("%s unknown cqid 0x%x\n", __func__, qid);
+        return 0;
+}
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
new file mode 100644
index 000000000000..a6269981e815
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -0,0 +1,745 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __IW_CXGB4_H__
+#define __IW_CXGB4_H__
+
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/idr.h>
+#include <linux/workqueue.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/pci.h>
+#include <linux/dma-mapping.h>
+#include <linux/inet.h>
+#include <linux/wait.h>
+#include <linux/kref.h>
+#include <linux/timer.h>
+#include <linux/io.h>
+#include <linux/kfifo.h>
+
+#include <asm/byteorder.h>
+
+#include <net/net_namespace.h>
+
+#include <rdma/ib_verbs.h>
+#include <rdma/iw_cm.h>
+
+#include "cxgb4.h"
+#include "cxgb4_uld.h"
+#include "l2t.h"
+#include "user.h"
+
+#define DRV_NAME "iw_cxgb4"
+#define MOD DRV_NAME ":"
+
+extern int c4iw_debug;
+#define PDBG(fmt, args...) \
+do { \
+        if (c4iw_debug) \
+                printk(MOD fmt, ## args); \
+} while (0)
+
+#include "t4.h"
+
+#define PBL_OFF(rdev_p, a) ((a) - (rdev_p)->lldi.vr->pbl.start)
+#define RQT_OFF(rdev_p, a) ((a) - (rdev_p)->lldi.vr->rq.start)
+
+static inline void *cplhdr(struct sk_buff *skb)
+{
+        return skb->data;
+}
+
+#define C4IW_WR_TO (10*HZ)
+
+struct c4iw_wr_wait {
+        wait_queue_head_t wait;
+        int done;
+        int ret;
+};
+
+static inline void c4iw_init_wr_wait(struct c4iw_wr_wait *wr_waitp)
+{
+        wr_waitp->ret = 0;
+        wr_waitp->done = 0;
+        init_waitqueue_head(&wr_waitp->wait);
+}
+
+struct c4iw_resource {
+        struct kfifo tpt_fifo;
+        spinlock_t tpt_fifo_lock;
+        struct kfifo qid_fifo;
+        spinlock_t qid_fifo_lock;
+        struct kfifo pdid_fifo;
+        spinlock_t pdid_fifo_lock;
+};
+
+struct c4iw_qid_list {
+        struct list_head entry;
+        u32 qid;
+};
+
+struct c4iw_dev_ucontext {
+        struct list_head qpids;
+        struct list_head cqids;
+        struct mutex lock;
+};
+
+enum c4iw_rdev_flags {
+        T4_FATAL_ERROR = (1<<0),
+};
+
+struct c4iw_rdev {
+        struct c4iw_resource resource;
+        unsigned long qpshift;
+        u32 qpmask;
+        unsigned long cqshift;
+        u32 cqmask;
+        struct c4iw_dev_ucontext uctx;
+        struct gen_pool *pbl_pool;
+        struct gen_pool *rqt_pool;
+        u32 flags;
+        struct cxgb4_lld_info lldi;
+};
+
+static inline int c4iw_fatal_error(struct c4iw_rdev *rdev)
+{
+        return rdev->flags & T4_FATAL_ERROR;
+}
+
+static inline int c4iw_num_stags(struct c4iw_rdev *rdev)
+{
+        return min((int)T4_MAX_NUM_STAG, (int)(rdev->lldi.vr->stag.size >> 5));
+}
+
+struct c4iw_dev {
+        struct ib_device ibdev;
+        struct c4iw_rdev rdev;
+        u32 device_cap_flags;
+        struct idr cqidr;
+        struct idr qpidr;
+        struct idr mmidr;
+        spinlock_t lock;
+        struct list_head entry;
+        struct delayed_work db_drop_task;
+        struct dentry *debugfs_root;
+};
+
+static inline struct c4iw_dev *to_c4iw_dev(struct ib_device *ibdev)
+{
+        return container_of(ibdev, struct c4iw_dev, ibdev);
+}
+
+static inline struct c4iw_dev *rdev_to_c4iw_dev(struct c4iw_rdev *rdev)
+{
+        return container_of(rdev, struct c4iw_dev, rdev);
+}
+
+static inline struct c4iw_cq *get_chp(struct c4iw_dev *rhp, u32 cqid)
+{
+        return idr_find(&rhp->cqidr, cqid);
+}
+
+static inline struct c4iw_qp *get_qhp(struct c4iw_dev *rhp, u32 qpid)
+{
+        return idr_find(&rhp->qpidr, qpid);
+}
+
+static inline struct c4iw_mr *get_mhp(struct c4iw_dev *rhp, u32 mmid)
+{
+        return idr_find(&rhp->mmidr, mmid);
+}
+
+static inline int insert_handle(struct c4iw_dev *rhp, struct idr *idr,
+                                void *handle, u32 id)
+{
+        int ret;
+        int newid;
+
+        do {
+                if (!idr_pre_get(idr, GFP_KERNEL))
+                        return -ENOMEM;
+                spin_lock_irq(&rhp->lock);
+                ret = idr_get_new_above(idr, handle, id, &newid);
+                BUG_ON(newid != id);
+                spin_unlock_irq(&rhp->lock);
+        } while (ret == -EAGAIN);
+
+        return ret;
+}
+
+static inline void remove_handle(struct c4iw_dev *rhp, struct idr *idr, u32 id)
+{
+        spin_lock_irq(&rhp->lock);
+        idr_remove(idr, id);
+        spin_unlock_irq(&rhp->lock);
+}
+
+struct c4iw_pd {
+        struct ib_pd ibpd;
+        u32 pdid;
+        struct c4iw_dev *rhp;
+};
+
+static inline struct c4iw_pd *to_c4iw_pd(struct ib_pd *ibpd)
+{
+        return container_of(ibpd, struct c4iw_pd, ibpd);
+}
+
+struct tpt_attributes {
+        u64 len;
+        u64 va_fbo;
+        enum fw_ri_mem_perms perms;
+        u32 stag;
+        u32 pdid;
+        u32 qpid;
+        u32 pbl_addr;
+        u32 pbl_size;
+        u32 state:1;
+        u32 type:2;
+        u32 rsvd:1;
+        u32 remote_invaliate_disable:1;
+        u32 zbva:1;
+        u32 mw_bind_enable:1;
+        u32 page_size:5;
+};
+
+struct c4iw_mr {
+        struct ib_mr ibmr;
+        struct ib_umem *umem;
+        struct c4iw_dev *rhp;
+        u64 kva;
+        struct tpt_attributes attr;
+};
+
+static inline struct c4iw_mr *to_c4iw_mr(struct ib_mr *ibmr)
+{
+        return container_of(ibmr, struct c4iw_mr, ibmr);
+}
+
+struct c4iw_mw {
+        struct ib_mw ibmw;
+        struct c4iw_dev *rhp;
+        u64 kva;
+        struct tpt_attributes attr;
+};
+
+static inline struct c4iw_mw *to_c4iw_mw(struct ib_mw *ibmw)
+{
+        return container_of(ibmw, struct c4iw_mw, ibmw);
+}
+
+struct c4iw_fr_page_list {
+        struct ib_fast_reg_page_list ibpl;
+        DECLARE_PCI_UNMAP_ADDR(mapping);
+        dma_addr_t dma_addr;
+        struct c4iw_dev *dev;
+        int size;
+};
+
+static inline struct c4iw_fr_page_list *to_c4iw_fr_page_list(
+                                        struct ib_fast_reg_page_list *ibpl)
+{
+        return container_of(ibpl, struct c4iw_fr_page_list, ibpl);
+}
+
+struct c4iw_cq {
+        struct ib_cq ibcq;
+        struct c4iw_dev *rhp;
+        struct t4_cq cq;
+        spinlock_t lock;
+        atomic_t refcnt;
+        wait_queue_head_t wait;
+};
+
+static inline struct c4iw_cq *to_c4iw_cq(struct ib_cq *ibcq)
+{
+        return container_of(ibcq, struct c4iw_cq, ibcq);
+}
+
+struct c4iw_mpa_attributes {
+        u8 initiator;
+        u8 recv_marker_enabled;
+        u8 xmit_marker_enabled;
+        u8 crc_enabled;
+        u8 version;
+        u8 p2p_type;
+};
+
+struct c4iw_qp_attributes {
+        u32 scq;
+        u32 rcq;
+        u32 sq_num_entries;
+        u32 rq_num_entries;
+        u32 sq_max_sges;
+        u32 sq_max_sges_rdma_write;
+        u32 rq_max_sges;
+        u32 state;
+        u8 enable_rdma_read;
+        u8 enable_rdma_write;
+        u8 enable_bind;
+        u8 enable_mmid0_fastreg;
+        u32 max_ord;
+        u32 max_ird;
+        u32 pd;
+        u32 next_state;
+        char terminate_buffer[52];
+        u32 terminate_msg_len;
+        u8 is_terminate_local;
+        struct c4iw_mpa_attributes mpa_attr;
+        struct c4iw_ep *llp_stream_handle;
+};
+
+struct c4iw_qp {
+        struct ib_qp ibqp;
+        struct c4iw_dev *rhp;
+        struct c4iw_ep *ep;
+        struct c4iw_qp_attributes attr;
+        struct t4_wq wq;
+        spinlock_t lock;
+        atomic_t refcnt;
+        wait_queue_head_t wait;
+        struct timer_list timer;
+};
+
+static inline struct c4iw_qp *to_c4iw_qp(struct ib_qp *ibqp)
+{
+        return container_of(ibqp, struct c4iw_qp, ibqp);
+}
+
+struct c4iw_ucontext {
+        struct ib_ucontext ibucontext;
+        struct c4iw_dev_ucontext uctx;
+        u32 key;
+        spinlock_t mmap_lock;
+        struct list_head mmaps;
+};
+
+static inline struct c4iw_ucontext *to_c4iw_ucontext(struct ib_ucontext *c)
+{
+        return container_of(c, struct c4iw_ucontext, ibucontext);
+}
+
+struct c4iw_mm_entry {
+        struct list_head entry;
+        u64 addr;
+        u32 key;
+        unsigned len;
+};
+
+static inline struct c4iw_mm_entry *remove_mmap(struct c4iw_ucontext *ucontext,
+                                                u32 key, unsigned len)
+{
+        struct list_head *pos, *nxt;
+        struct c4iw_mm_entry *mm;
+
+        spin_lock(&ucontext->mmap_lock);
+        list_for_each_safe(pos, nxt, &ucontext->mmaps) {
+
+                mm = list_entry(pos, struct c4iw_mm_entry, entry);
+                if (mm->key == key && mm->len == len) {
+                        list_del_init(&mm->entry);
+                        spin_unlock(&ucontext->mmap_lock);
+                        PDBG("%s key 0x%x addr 0x%llx len %d\n", __func__,
+                             key, (unsigned long long) mm->addr, mm->len);
+                        return mm;
+                }
+        }
+        spin_unlock(&ucontext->mmap_lock);
+        return NULL;
+}
+
+static inline void insert_mmap(struct c4iw_ucontext *ucontext,
+                               struct c4iw_mm_entry *mm)
+{
+        spin_lock(&ucontext->mmap_lock);
+        PDBG("%s key 0x%x addr 0x%llx len %d\n", __func__,
+             mm->key, (unsigned long long) mm->addr, mm->len);
+        list_add_tail(&mm->entry, &ucontext->mmaps);
+        spin_unlock(&ucontext->mmap_lock);
+}
+
+enum c4iw_qp_attr_mask {
+        C4IW_QP_ATTR_NEXT_STATE = 1 << 0,
+        C4IW_QP_ATTR_ENABLE_RDMA_READ = 1 << 7,
+        C4IW_QP_ATTR_ENABLE_RDMA_WRITE = 1 << 8,
+        C4IW_QP_ATTR_ENABLE_RDMA_BIND = 1 << 9,
+        C4IW_QP_ATTR_MAX_ORD = 1 << 11,
+        C4IW_QP_ATTR_MAX_IRD = 1 << 12,
+        C4IW_QP_ATTR_LLP_STREAM_HANDLE = 1 << 22,
+        C4IW_QP_ATTR_STREAM_MSG_BUFFER = 1 << 23,
+        C4IW_QP_ATTR_MPA_ATTR = 1 << 24,
+        C4IW_QP_ATTR_QP_CONTEXT_ACTIVATE = 1 << 25,
+        C4IW_QP_ATTR_VALID_MODIFY = (C4IW_QP_ATTR_ENABLE_RDMA_READ |
+                                     C4IW_QP_ATTR_ENABLE_RDMA_WRITE |
+                                     C4IW_QP_ATTR_MAX_ORD |
+                                     C4IW_QP_ATTR_MAX_IRD |
+                                     C4IW_QP_ATTR_LLP_STREAM_HANDLE |
+                                     C4IW_QP_ATTR_STREAM_MSG_BUFFER |
+                                     C4IW_QP_ATTR_MPA_ATTR |
+                                     C4IW_QP_ATTR_QP_CONTEXT_ACTIVATE)
+};
+
+int c4iw_modify_qp(struct c4iw_dev *rhp,
+                                struct c4iw_qp *qhp,
+                                enum c4iw_qp_attr_mask mask,
+                                struct c4iw_qp_attributes *attrs,
+                                int internal);
+
+enum c4iw_qp_state {
+        C4IW_QP_STATE_IDLE,
+        C4IW_QP_STATE_RTS,
+        C4IW_QP_STATE_ERROR,
+        C4IW_QP_STATE_TERMINATE,
+        C4IW_QP_STATE_CLOSING,
+        C4IW_QP_STATE_TOT
+};
+
+static inline int c4iw_convert_state(enum ib_qp_state ib_state)
+{
+        switch (ib_state) {
+        case IB_QPS_RESET:
+        case IB_QPS_INIT:
+                return C4IW_QP_STATE_IDLE;
+        case IB_QPS_RTS:
+                return C4IW_QP_STATE_RTS;
+        case IB_QPS_SQD:
+                return C4IW_QP_STATE_CLOSING;
+        case IB_QPS_SQE:
+                return C4IW_QP_STATE_TERMINATE;
+        case IB_QPS_ERR:
+                return C4IW_QP_STATE_ERROR;
+        default:
+                return -1;
+        }
+}
+
+static inline u32 c4iw_ib_to_tpt_access(int a)
+{
+        return (a & IB_ACCESS_REMOTE_WRITE ? FW_RI_MEM_ACCESS_REM_WRITE : 0) |
+               (a & IB_ACCESS_REMOTE_READ ? FW_RI_MEM_ACCESS_REM_READ : 0) |
+               (a & IB_ACCESS_LOCAL_WRITE ? FW_RI_MEM_ACCESS_LOCAL_WRITE : 0) |
+               FW_RI_MEM_ACCESS_LOCAL_READ;
+}
+
+static inline u32 c4iw_ib_to_tpt_bind_access(int acc)
+{
+        return (acc & IB_ACCESS_REMOTE_WRITE ? FW_RI_MEM_ACCESS_REM_WRITE : 0) |
+               (acc & IB_ACCESS_REMOTE_READ ? FW_RI_MEM_ACCESS_REM_READ : 0);
+}
+
+enum c4iw_mmid_state {
+        C4IW_STAG_STATE_VALID,
+        C4IW_STAG_STATE_INVALID
+};
+
+#define C4IW_NODE_DESC "cxgb4 Chelsio Communications"
+
+#define MPA_KEY_REQ "MPA ID Req Frame"
+#define MPA_KEY_REP "MPA ID Rep Frame"
+
+#define MPA_MAX_PRIVATE_DATA    256
+#define MPA_REJECT              0x20
+#define MPA_CRC                 0x40
+#define MPA_MARKERS             0x80
+#define MPA_FLAGS_MASK          0xE0
+
+#define c4iw_put_ep(ep) { \
+        PDBG("put_ep (via %s:%u) ep %p refcnt %d\n", __func__, __LINE__,  \
+             ep, atomic_read(&((ep)->kref.refcount))); \
+        WARN_ON(atomic_read(&((ep)->kref.refcount)) < 1); \
+        kref_put(&((ep)->kref), _c4iw_free_ep); \
+}
+
+#define c4iw_get_ep(ep) { \
+        PDBG("get_ep (via %s:%u) ep %p, refcnt %d\n", __func__, __LINE__, \
+             ep, atomic_read(&((ep)->kref.refcount))); \
+        kref_get(&((ep)->kref));  \
+}
+void _c4iw_free_ep(struct kref *kref);
+
+struct mpa_message {
+        u8 key[16];
+        u8 flags;
+        u8 revision;
+        __be16 private_data_size;
+        u8 private_data[0];
+};
+
+struct terminate_message {
+        u8 layer_etype;
+        u8 ecode;
+        __be16 hdrct_rsvd;
+        u8 len_hdrs[0];
+};
+
+#define TERM_MAX_LENGTH (sizeof(struct terminate_message) + 2 + 18 + 28)
+
+enum c4iw_layers_types {
+        LAYER_RDMAP             = 0x00,
+        LAYER_DDP               = 0x10,
+        LAYER_MPA               = 0x20,
+        RDMAP_LOCAL_CATA        = 0x00,
+        RDMAP_REMOTE_PROT       = 0x01,
+        RDMAP_REMOTE_OP         = 0x02,
+        DDP_LOCAL_CATA          = 0x00,
+        DDP_TAGGED_ERR          = 0x01,
+        DDP_UNTAGGED_ERR        = 0x02,
+        DDP_LLP                 = 0x03
+};
+
+enum c4iw_rdma_ecodes {
+        RDMAP_INV_STAG          = 0x00,
+        RDMAP_BASE_BOUNDS       = 0x01,
+        RDMAP_ACC_VIOL          = 0x02,
+        RDMAP_STAG_NOT_ASSOC    = 0x03,
+        RDMAP_TO_WRAP           = 0x04,
+        RDMAP_INV_VERS          = 0x05,
+        RDMAP_INV_OPCODE        = 0x06,
+        RDMAP_STREAM_CATA       = 0x07,
+        RDMAP_GLOBAL_CATA       = 0x08,
+        RDMAP_CANT_INV_STAG     = 0x09,
+        RDMAP_UNSPECIFIED       = 0xff
+};
+
+enum c4iw_ddp_ecodes {
+        DDPT_INV_STAG           = 0x00,
+        DDPT_BASE_BOUNDS        = 0x01,
+        DDPT_STAG_NOT_ASSOC     = 0x02,
+        DDPT_TO_WRAP            = 0x03,
+        DDPT_INV_VERS           = 0x04,
+        DDPU_INV_QN             = 0x01,
+        DDPU_INV_MSN_NOBUF      = 0x02,
+        DDPU_INV_MSN_RANGE      = 0x03,
+        DDPU_INV_MO             = 0x04,
+        DDPU_MSG_TOOBIG         = 0x05,
+        DDPU_INV_VERS           = 0x06
+};
+
+enum c4iw_mpa_ecodes {
+        MPA_CRC_ERR             = 0x02,
+        MPA_MARKER_ERR          = 0x03
+};
+
+enum c4iw_ep_state {
+        IDLE = 0,
+        LISTEN,
+        CONNECTING,
+        MPA_REQ_WAIT,
+        MPA_REQ_SENT,
+        MPA_REQ_RCVD,
+        MPA_REP_SENT,
+        FPDU_MODE,
+        ABORTING,
+        CLOSING,
+        MORIBUND,
+        DEAD,
+};
+
+enum c4iw_ep_flags {
+        PEER_ABORT_IN_PROGRESS  = 0,
+        ABORT_REQ_IN_PROGRESS   = 1,
+        RELEASE_RESOURCES       = 2,
+        CLOSE_SENT              = 3,
+};
+
+struct c4iw_ep_common {
+        struct iw_cm_id *cm_id;
+        struct c4iw_qp *qp;
+        struct c4iw_dev *dev;
+        enum c4iw_ep_state state;
+        struct kref kref;
+        spinlock_t lock;
+        struct sockaddr_in local_addr;
+        struct sockaddr_in remote_addr;
+        wait_queue_head_t waitq;
+        int rpl_done;
+        int rpl_err;
+        unsigned long flags;
+};
+
+struct c4iw_listen_ep {
+        struct c4iw_ep_common com;
+        unsigned int stid;
+        int backlog;
+};
+
+struct c4iw_ep {
+        struct c4iw_ep_common com;
+        struct c4iw_ep *parent_ep;
+        struct timer_list timer;
+        struct list_head entry;
+        unsigned int atid;
+        u32 hwtid;
+        u32 snd_seq;
+        u32 rcv_seq;
+        struct l2t_entry *l2t;
+        struct dst_entry *dst;
+        struct sk_buff *mpa_skb;
+        struct c4iw_mpa_attributes mpa_attr;
+        u8 mpa_pkt[sizeof(struct mpa_message) + MPA_MAX_PRIVATE_DATA];
+        unsigned int mpa_pkt_len;
+        u32 ird;
+        u32 ord;
+        u32 smac_idx;
+        u32 tx_chan;
+        u32 mtu;
+        u16 mss;
+        u16 emss;
+        u16 plen;
+        u16 rss_qid;
+        u16 txq_idx;
+        u8 tos;
+};
+
+static inline struct c4iw_ep *to_ep(struct iw_cm_id *cm_id)
+{
+        return cm_id->provider_data;
+}
+
+static inline struct c4iw_listen_ep *to_listen_ep(struct iw_cm_id *cm_id)
+{
+        return cm_id->provider_data;
+}
+
+static inline int compute_wscale(int win)
+{
+        int wscale = 0;
+
+        while (wscale < 14 && (65535<<wscale) < win)
+                wscale++;
+        return wscale;
+}
+
+typedef int (*c4iw_handler_func)(struct c4iw_dev *dev, struct sk_buff *skb);
+
+int c4iw_ep_redirect(void *ctx, struct dst_entry *old, struct dst_entry *new,
+                     struct l2t_entry *l2t);
+void c4iw_put_qpid(struct c4iw_rdev *rdev, u32 qpid,
+                   struct c4iw_dev_ucontext *uctx);
+u32 c4iw_get_resource(struct kfifo *fifo, spinlock_t *lock);
+void c4iw_put_resource(struct kfifo *fifo, u32 entry, spinlock_t *lock);
+int c4iw_init_resource(struct c4iw_rdev *rdev, u32 nr_tpt, u32 nr_pdid);
+int c4iw_init_ctrl_qp(struct c4iw_rdev *rdev);
+int c4iw_pblpool_create(struct c4iw_rdev *rdev);
+int c4iw_rqtpool_create(struct c4iw_rdev *rdev);
+void c4iw_pblpool_destroy(struct c4iw_rdev *rdev);
+void c4iw_rqtpool_destroy(struct c4iw_rdev *rdev);
+void c4iw_destroy_resource(struct c4iw_resource *rscp);
+int c4iw_destroy_ctrl_qp(struct c4iw_rdev *rdev);
+int c4iw_register_device(struct c4iw_dev *dev);
+void c4iw_unregister_device(struct c4iw_dev *dev);
+int __init c4iw_cm_init(void);
+void __exit c4iw_cm_term(void);
+void c4iw_release_dev_ucontext(struct c4iw_rdev *rdev,
+                               struct c4iw_dev_ucontext *uctx);
+void c4iw_init_dev_ucontext(struct c4iw_rdev *rdev,
+                            struct c4iw_dev_ucontext *uctx);
+int c4iw_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc);
+int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
+                      struct ib_send_wr **bad_wr);
+int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
+                      struct ib_recv_wr **bad_wr);
+int c4iw_bind_mw(struct ib_qp *qp, struct ib_mw *mw,
+                 struct ib_mw_bind *mw_bind);
+int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param);
+int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog);
+int c4iw_destroy_listen(struct iw_cm_id *cm_id);
+int c4iw_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param);
+int c4iw_reject_cr(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len);
+void c4iw_qp_add_ref(struct ib_qp *qp);
+void c4iw_qp_rem_ref(struct ib_qp *qp);
+void c4iw_free_fastreg_pbl(struct ib_fast_reg_page_list *page_list);
+struct ib_fast_reg_page_list *c4iw_alloc_fastreg_pbl(
+                                        struct ib_device *device,
+                                        int page_list_len);
+struct ib_mr *c4iw_alloc_fast_reg_mr(struct ib_pd *pd, int pbl_depth);
+int c4iw_dealloc_mw(struct ib_mw *mw);
+struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd);
+struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start,
+                                           u64 length, u64 virt, int acc,
+                                           struct ib_udata *udata);
+struct ib_mr *c4iw_get_dma_mr(struct ib_pd *pd, int acc);
+struct ib_mr *c4iw_register_phys_mem(struct ib_pd *pd,
+                                        struct ib_phys_buf *buffer_list,
+                                        int num_phys_buf,
+                                        int acc,
+                                        u64 *iova_start);
+int c4iw_reregister_phys_mem(struct ib_mr *mr,
+                                     int mr_rereg_mask,
+                                     struct ib_pd *pd,
+                                     struct ib_phys_buf *buffer_list,
+                                     int num_phys_buf,
+                                     int acc, u64 *iova_start);
+int c4iw_dereg_mr(struct ib_mr *ib_mr);
+int c4iw_destroy_cq(struct ib_cq *ib_cq);
+struct ib_cq *c4iw_create_cq(struct ib_device *ibdev, int entries,
+                                        int vector,
+                                        struct ib_ucontext *ib_context,
+                                        struct ib_udata *udata);
+int c4iw_resize_cq(struct ib_cq *cq, int cqe, struct ib_udata *udata);
+int c4iw_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags);
+int c4iw_destroy_qp(struct ib_qp *ib_qp);
+struct ib_qp *c4iw_create_qp(struct ib_pd *pd,
+                             struct ib_qp_init_attr *attrs,
+                             struct ib_udata *udata);
+int c4iw_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                                 int attr_mask, struct ib_udata *udata);
+struct ib_qp *c4iw_get_qp(struct ib_device *dev, int qpn);
+u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size);
+void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size);
+u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size);
+void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size);
+int c4iw_ofld_send(struct c4iw_rdev *rdev, struct sk_buff *skb);
+void c4iw_flush_hw_cq(struct t4_cq *cq);
+void c4iw_count_rcqes(struct t4_cq *cq, struct t4_wq *wq, int *count);
+void c4iw_count_scqes(struct t4_cq *cq, struct t4_wq *wq, int *count);
+int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp);
+int c4iw_flush_rq(struct t4_wq *wq, struct t4_cq *cq, int count);
+int c4iw_flush_sq(struct t4_wq *wq, struct t4_cq *cq, int count);
+int c4iw_ev_handler(struct c4iw_dev *rnicp, u32 qid);
+u16 c4iw_rqes_posted(struct c4iw_qp *qhp);
+int c4iw_post_zb_read(struct c4iw_qp *qhp);
+int c4iw_post_terminate(struct c4iw_qp *qhp, struct t4_cqe *err_cqe);
+u32 c4iw_get_cqid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx);
+void c4iw_put_cqid(struct c4iw_rdev *rdev, u32 qid,
+                struct c4iw_dev_ucontext *uctx);
+u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx);
+void c4iw_put_qpid(struct c4iw_rdev *rdev, u32 qid,
+                struct c4iw_dev_ucontext *uctx);
+void c4iw_ev_dispatch(struct c4iw_dev *dev, struct t4_cqe *err_cqe);
+
+extern struct cxgb4_client t4c_client;
+extern c4iw_handler_func c4iw_handlers[NUM_CPL_CMDS];
+extern int c4iw_max_read_depth;
+
+#endif
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
new file mode 100644
index 000000000000..e54ff6d25691
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -0,0 +1,811 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <rdma/ib_umem.h>
+#include <asm/atomic.h>
+
+#include "iw_cxgb4.h"
+
+#define T4_ULPTX_MIN_IO 32
+#define C4IW_MAX_INLINE_SIZE 96
+
+static int write_adapter_mem(struct c4iw_rdev *rdev, u32 addr, u32 len,
+                             void *data)
+{
+        struct sk_buff *skb;
+        struct ulp_mem_io *req;
+        struct ulptx_idata *sc;
+        u8 wr_len, *to_dp, *from_dp;
+        int copy_len, num_wqe, i, ret = 0;
+        struct c4iw_wr_wait wr_wait;
+
+        addr &= 0x7FFFFFF;
+        PDBG("%s addr 0x%x len %u\n", __func__, addr, len);
+        num_wqe = DIV_ROUND_UP(len, C4IW_MAX_INLINE_SIZE);
+        c4iw_init_wr_wait(&wr_wait);
+        for (i = 0; i < num_wqe; i++) {
+
+                copy_len = len > C4IW_MAX_INLINE_SIZE ? C4IW_MAX_INLINE_SIZE :
+                           len;
+                wr_len = roundup(sizeof *req + sizeof *sc +
+                                 roundup(copy_len, T4_ULPTX_MIN_IO), 16);
+
+                skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
+                if (!skb)
+                        return -ENOMEM;
+                set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
+
+                req = (struct ulp_mem_io *)__skb_put(skb, wr_len);
+                memset(req, 0, wr_len);
+                INIT_ULPTX_WR(req, wr_len, 0, 0);
+
+                if (i == (num_wqe-1)) {
+                        req->wr.wr_hi = cpu_to_be32(FW_WR_OP(FW_ULPTX_WR) |
+                                                    FW_WR_COMPL(1));
+                        req->wr.wr_lo = (__force __be64)&wr_wait;
+                } else
+                        req->wr.wr_hi = cpu_to_be32(FW_WR_OP(FW_ULPTX_WR));
+                req->wr.wr_mid = cpu_to_be32(
+                                       FW_WR_LEN16(DIV_ROUND_UP(wr_len, 16)));
+
+                req->cmd = cpu_to_be32(ULPTX_CMD(ULP_TX_MEM_WRITE) | (1<<23));
+                req->dlen = cpu_to_be32(ULP_MEMIO_DATA_LEN(
+                                DIV_ROUND_UP(copy_len, T4_ULPTX_MIN_IO)));
+                req->len16 = cpu_to_be32(DIV_ROUND_UP(wr_len-sizeof(req->wr),
+                                                      16));
+                req->lock_addr = cpu_to_be32(ULP_MEMIO_ADDR(addr + i * 3));
+
+                sc = (struct ulptx_idata *)(req + 1);
+                sc->cmd_more = cpu_to_be32(ULPTX_CMD(ULP_TX_SC_IMM));
+                sc->len = cpu_to_be32(roundup(copy_len, T4_ULPTX_MIN_IO));
+
+                to_dp = (u8 *)(sc + 1);
+                from_dp = (u8 *)data + i * C4IW_MAX_INLINE_SIZE;
+                if (data)
+                        memcpy(to_dp, from_dp, copy_len);
+                else
+                        memset(to_dp, 0, copy_len);
+                if (copy_len % T4_ULPTX_MIN_IO)
+                        memset(to_dp + copy_len, 0, T4_ULPTX_MIN_IO -
+                               (copy_len % T4_ULPTX_MIN_IO));
+                ret = c4iw_ofld_send(rdev, skb);
+                if (ret)
+                        return ret;
+                len -= C4IW_MAX_INLINE_SIZE;
+        }
+
+        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+        if (!wr_wait.done) {
+                printk(KERN_ERR MOD "Device %s not responding!\n",
+                       pci_name(rdev->lldi.pdev));
+                rdev->flags = T4_FATAL_ERROR;
+                ret = -EIO;
+        } else
+                ret = wr_wait.ret;
+        return ret;
+}
+
+/*
+ * Build and write a TPT entry.
+ * IN: stag key, pdid, perm, bind_enabled, zbva, to, len, page_size,
+ *     pbl_size and pbl_addr
+ * OUT: stag index
+ */
+static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
+                           u32 *stag, u8 stag_state, u32 pdid,
+                           enum fw_ri_stag_type type, enum fw_ri_mem_perms perm,
+                           int bind_enabled, u32 zbva, u64 to,
+                           u64 len, u8 page_size, u32 pbl_size, u32 pbl_addr)
+{
+        int err;
+        struct fw_ri_tpte tpt;
+        u32 stag_idx;
+        static atomic_t key;
+
+        if (c4iw_fatal_error(rdev))
+                return -EIO;
+
+        stag_state = stag_state > 0;
+        stag_idx = (*stag) >> 8;
+
+        if ((!reset_tpt_entry) && (*stag == T4_STAG_UNSET)) {
+                stag_idx = c4iw_get_resource(&rdev->resource.tpt_fifo,
+                                             &rdev->resource.tpt_fifo_lock);
+                if (!stag_idx)
+                        return -ENOMEM;
+                *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
+        }
+        PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
+             __func__, stag_state, type, pdid, stag_idx);
+
+        /* write TPT entry */
+        if (reset_tpt_entry)
+                memset(&tpt, 0, sizeof(tpt));
+        else {
+                tpt.valid_to_pdid = cpu_to_be32(F_FW_RI_TPTE_VALID |
+                        V_FW_RI_TPTE_STAGKEY((*stag & M_FW_RI_TPTE_STAGKEY)) |
+                        V_FW_RI_TPTE_STAGSTATE(stag_state) |
+                        V_FW_RI_TPTE_STAGTYPE(type) | V_FW_RI_TPTE_PDID(pdid));
+                tpt.locread_to_qpid = cpu_to_be32(V_FW_RI_TPTE_PERM(perm) |
+                        (bind_enabled ? F_FW_RI_TPTE_MWBINDEN : 0) |
+                        V_FW_RI_TPTE_ADDRTYPE((zbva ? FW_RI_ZERO_BASED_TO :
+                                                      FW_RI_VA_BASED_TO))|
+                        V_FW_RI_TPTE_PS(page_size));
+                tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
+                        V_FW_RI_TPTE_PBLADDR(PBL_OFF(rdev, pbl_addr)>>3));
+                tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
+                tpt.va_hi = cpu_to_be32((u32)(to >> 32));
+                tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
+                tpt.dca_mwbcnt_pstag = cpu_to_be32(0);
+                tpt.len_hi = cpu_to_be32((u32)(len >> 32));
+        }
+        err = write_adapter_mem(rdev, stag_idx +
+                                (rdev->lldi.vr->stag.start >> 5),
+                                sizeof(tpt), &tpt);
+
+        if (reset_tpt_entry)
+                c4iw_put_resource(&rdev->resource.tpt_fifo, stag_idx,
+                                  &rdev->resource.tpt_fifo_lock);
+        return err;
+}
+
+static int write_pbl(struct c4iw_rdev *rdev, __be64 *pbl,
+                     u32 pbl_addr, u32 pbl_size)
+{
+        int err;
+
+        PDBG("%s *pdb_addr 0x%x, pbl_base 0x%x, pbl_size %d\n",
+             __func__, pbl_addr, rdev->lldi.vr->pbl.start,
+             pbl_size);
+
+        err = write_adapter_mem(rdev, pbl_addr >> 5, pbl_size << 3, pbl);
+        return err;
+}
+
+static int dereg_mem(struct c4iw_rdev *rdev, u32 stag, u32 pbl_size,
+                     u32 pbl_addr)
+{
+        return write_tpt_entry(rdev, 1, &stag, 0, 0, 0, 0, 0, 0, 0UL, 0, 0,
+                               pbl_size, pbl_addr);
+}
+
+static int allocate_window(struct c4iw_rdev *rdev, u32 * stag, u32 pdid)
+{
+        *stag = T4_STAG_UNSET;
+        return write_tpt_entry(rdev, 0, stag, 0, pdid, FW_RI_STAG_MW, 0, 0, 0,
+                               0UL, 0, 0, 0, 0);
+}
+
+static int deallocate_window(struct c4iw_rdev *rdev, u32 stag)
+{
+        return write_tpt_entry(rdev, 1, &stag, 0, 0, 0, 0, 0, 0, 0UL, 0, 0, 0,
+                               0);
+}
+
+static int allocate_stag(struct c4iw_rdev *rdev, u32 *stag, u32 pdid,
+                         u32 pbl_size, u32 pbl_addr)
+{
+        *stag = T4_STAG_UNSET;
+        return write_tpt_entry(rdev, 0, stag, 0, pdid, FW_RI_STAG_NSMR, 0, 0, 0,
+                               0UL, 0, 0, pbl_size, pbl_addr);
+}
+
+static int finish_mem_reg(struct c4iw_mr *mhp, u32 stag)
+{
+        u32 mmid;
+
+        mhp->attr.state = 1;
+        mhp->attr.stag = stag;
+        mmid = stag >> 8;
+        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
+        PDBG("%s mmid 0x%x mhp %p\n", __func__, mmid, mhp);
+        return insert_handle(mhp->rhp, &mhp->rhp->mmidr, mhp, mmid);
+}
+
+static int register_mem(struct c4iw_dev *rhp, struct c4iw_pd *php,
+                      struct c4iw_mr *mhp, int shift)
+{
+        u32 stag = T4_STAG_UNSET;
+        int ret;
+
+        ret = write_tpt_entry(&rhp->rdev, 0, &stag, 1, mhp->attr.pdid,
+                              FW_RI_STAG_NSMR, mhp->attr.perms,
+                              mhp->attr.mw_bind_enable, mhp->attr.zbva,
+                              mhp->attr.va_fbo, mhp->attr.len, shift - 12,
+                              mhp->attr.pbl_size, mhp->attr.pbl_addr);
+        if (ret)
+                return ret;
+
+        ret = finish_mem_reg(mhp, stag);
+        if (ret)
+                dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+        return ret;
+}
+
+static int reregister_mem(struct c4iw_dev *rhp, struct c4iw_pd *php,
+                          struct c4iw_mr *mhp, int shift, int npages)
+{
+        u32 stag;
+        int ret;
+
+        if (npages > mhp->attr.pbl_size)
+                return -ENOMEM;
+
+        stag = mhp->attr.stag;
+        ret = write_tpt_entry(&rhp->rdev, 0, &stag, 1, mhp->attr.pdid,
+                              FW_RI_STAG_NSMR, mhp->attr.perms,
+                              mhp->attr.mw_bind_enable, mhp->attr.zbva,
+                              mhp->attr.va_fbo, mhp->attr.len, shift - 12,
+                              mhp->attr.pbl_size, mhp->attr.pbl_addr);
+        if (ret)
+                return ret;
+
+        ret = finish_mem_reg(mhp, stag);
+        if (ret)
+                dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+
+        return ret;
+}
+
+static int alloc_pbl(struct c4iw_mr *mhp, int npages)
+{
+        mhp->attr.pbl_addr = c4iw_pblpool_alloc(&mhp->rhp->rdev,
+                                                    npages << 3);
+
+        if (!mhp->attr.pbl_addr)
+                return -ENOMEM;
+
+        mhp->attr.pbl_size = npages;
+
+        return 0;
+}
+
+static int build_phys_page_list(struct ib_phys_buf *buffer_list,
+                                int num_phys_buf, u64 *iova_start,
+                                u64 *total_size, int *npages,
+                                int *shift, __be64 **page_list)
+{
+        u64 mask;
+        int i, j, n;
+
+        mask = 0;
+        *total_size = 0;
+        for (i = 0; i < num_phys_buf; ++i) {
+                if (i != 0 && buffer_list[i].addr & ~PAGE_MASK)
+                        return -EINVAL;
+                if (i != 0 && i != num_phys_buf - 1 &&
+                    (buffer_list[i].size & ~PAGE_MASK))
+                        return -EINVAL;
+                *total_size += buffer_list[i].size;
+                if (i > 0)
+                        mask |= buffer_list[i].addr;
+                else
+                        mask |= buffer_list[i].addr & PAGE_MASK;
+                if (i != num_phys_buf - 1)
+                        mask |= buffer_list[i].addr + buffer_list[i].size;
+                else
+                        mask |= (buffer_list[i].addr + buffer_list[i].size +
+                                PAGE_SIZE - 1) & PAGE_MASK;
+        }
+
+        if (*total_size > 0xFFFFFFFFULL)
+                return -ENOMEM;
+
+        /* Find largest page shift we can use to cover buffers */
+        for (*shift = PAGE_SHIFT; *shift < 27; ++(*shift))
+                if ((1ULL << *shift) & mask)
+                        break;
+
+        buffer_list[0].size += buffer_list[0].addr & ((1ULL << *shift) - 1);
+        buffer_list[0].addr &= ~0ull << *shift;
+
+        *npages = 0;
+        for (i = 0; i < num_phys_buf; ++i)
+                *npages += (buffer_list[i].size +
+                        (1ULL << *shift) - 1) >> *shift;
+
+        if (!*npages)
+                return -EINVAL;
+
+        *page_list = kmalloc(sizeof(u64) * *npages, GFP_KERNEL);
+        if (!*page_list)
+                return -ENOMEM;
+
+        n = 0;
+        for (i = 0; i < num_phys_buf; ++i)
+                for (j = 0;
+                     j < (buffer_list[i].size + (1ULL << *shift) - 1) >> *shift;
+                     ++j)
+                        (*page_list)[n++] = cpu_to_be64(buffer_list[i].addr +
+                            ((u64) j << *shift));
+
+        PDBG("%s va 0x%llx mask 0x%llx shift %d len %lld pbl_size %d\n",
+             __func__, (unsigned long long)*iova_start,
+             (unsigned long long)mask, *shift, (unsigned long long)*total_size,
+             *npages);
+
+        return 0;
+
+}
+
+int c4iw_reregister_phys_mem(struct ib_mr *mr, int mr_rereg_mask,
+                             struct ib_pd *pd, struct ib_phys_buf *buffer_list,
+                             int num_phys_buf, int acc, u64 *iova_start)
+{
+
+        struct c4iw_mr mh, *mhp;
+        struct c4iw_pd *php;
+        struct c4iw_dev *rhp;
+        __be64 *page_list = NULL;
+        int shift = 0;
+        u64 total_size;
+        int npages;
+        int ret;
+
+        PDBG("%s ib_mr %p ib_pd %p\n", __func__, mr, pd);
+
+        /* There can be no memory windows */
+        if (atomic_read(&mr->usecnt))
+                return -EINVAL;
+
+        mhp = to_c4iw_mr(mr);
+        rhp = mhp->rhp;
+        php = to_c4iw_pd(mr->pd);
+
+        /* make sure we are on the same adapter */
+        if (rhp != php->rhp)
+                return -EINVAL;
+
+        memcpy(&mh, mhp, sizeof *mhp);
+
+        if (mr_rereg_mask & IB_MR_REREG_PD)
+                php = to_c4iw_pd(pd);
+        if (mr_rereg_mask & IB_MR_REREG_ACCESS) {
+                mh.attr.perms = c4iw_ib_to_tpt_access(acc);
+                mh.attr.mw_bind_enable = (acc & IB_ACCESS_MW_BIND) ==
+                                         IB_ACCESS_MW_BIND;
+        }
+        if (mr_rereg_mask & IB_MR_REREG_TRANS) {
+                ret = build_phys_page_list(buffer_list, num_phys_buf,
+                                                iova_start,
+                                                &total_size, &npages,
+                                                &shift, &page_list);
+                if (ret)
+                        return ret;
+        }
+
+        ret = reregister_mem(rhp, php, &mh, shift, npages);
+        kfree(page_list);
+        if (ret)
+                return ret;
+        if (mr_rereg_mask & IB_MR_REREG_PD)
+                mhp->attr.pdid = php->pdid;
+        if (mr_rereg_mask & IB_MR_REREG_ACCESS)
+                mhp->attr.perms = c4iw_ib_to_tpt_access(acc);
+        if (mr_rereg_mask & IB_MR_REREG_TRANS) {
+                mhp->attr.zbva = 0;
+                mhp->attr.va_fbo = *iova_start;
+                mhp->attr.page_size = shift - 12;
+                mhp->attr.len = (u32) total_size;
+                mhp->attr.pbl_size = npages;
+        }
+
+        return 0;
+}
+
+struct ib_mr *c4iw_register_phys_mem(struct ib_pd *pd,
+                                     struct ib_phys_buf *buffer_list,
+                                     int num_phys_buf, int acc, u64 *iova_start)
+{
+        __be64 *page_list;
+        int shift;
+        u64 total_size;
+        int npages;
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+        struct c4iw_mr *mhp;
+        int ret;
+
+        PDBG("%s ib_pd %p\n", __func__, pd);
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+
+        mhp->rhp = rhp;
+
+        /* First check that we have enough alignment */
+        if ((*iova_start & ~PAGE_MASK) != (buffer_list[0].addr & ~PAGE_MASK)) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        if (num_phys_buf > 1 &&
+            ((buffer_list[0].addr + buffer_list[0].size) & ~PAGE_MASK)) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        ret = build_phys_page_list(buffer_list, num_phys_buf, iova_start,
+                                        &total_size, &npages, &shift,
+                                        &page_list);
+        if (ret)
+                goto err;
+
+        ret = alloc_pbl(mhp, npages);
+        if (ret) {
+                kfree(page_list);
+                goto err_pbl;
+        }
+
+        ret = write_pbl(&mhp->rhp->rdev, page_list, mhp->attr.pbl_addr,
+                             npages);
+        kfree(page_list);
+        if (ret)
+                goto err_pbl;
+
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.zbva = 0;
+
+        mhp->attr.perms = c4iw_ib_to_tpt_access(acc);
+        mhp->attr.va_fbo = *iova_start;
+        mhp->attr.page_size = shift - 12;
+
+        mhp->attr.len = (u32) total_size;
+        mhp->attr.pbl_size = npages;
+        ret = register_mem(rhp, php, mhp, shift);
+        if (ret)
+                goto err_pbl;
+
+        return &mhp->ibmr;
+
+err_pbl:
+        c4iw_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
+                              mhp->attr.pbl_size << 3);
+
+err:
+        kfree(mhp);
+        return ERR_PTR(ret);
+
+}
+
+struct ib_mr *c4iw_get_dma_mr(struct ib_pd *pd, int acc)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+        struct c4iw_mr *mhp;
+        int ret;
+        u32 stag = T4_STAG_UNSET;
+
+        PDBG("%s ib_pd %p\n", __func__, pd);
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+
+        mhp->rhp = rhp;
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.perms = c4iw_ib_to_tpt_access(acc);
+        mhp->attr.mw_bind_enable = (acc&IB_ACCESS_MW_BIND) == IB_ACCESS_MW_BIND;
+        mhp->attr.zbva = 0;
+        mhp->attr.va_fbo = 0;
+        mhp->attr.page_size = 0;
+        mhp->attr.len = ~0UL;
+        mhp->attr.pbl_size = 0;
+
+        ret = write_tpt_entry(&rhp->rdev, 0, &stag, 1, php->pdid,
+                              FW_RI_STAG_NSMR, mhp->attr.perms,
+                              mhp->attr.mw_bind_enable, 0, 0, ~0UL, 0, 0, 0);
+        if (ret)
+                goto err1;
+
+        ret = finish_mem_reg(mhp, stag);
+        if (ret)
+                goto err2;
+        return &mhp->ibmr;
+err2:
+        dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                  mhp->attr.pbl_addr);
+err1:
+        kfree(mhp);
+        return ERR_PTR(ret);
+}
+
+struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+                               u64 virt, int acc, struct ib_udata *udata)
+{
+        __be64 *pages;
+        int shift, n, len;
+        int i, j, k;
+        int err = 0;
+        struct ib_umem_chunk *chunk;
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+        struct c4iw_mr *mhp;
+
+        PDBG("%s ib_pd %p\n", __func__, pd);
+
+        if (length == ~0ULL)
+                return ERR_PTR(-EINVAL);
+
+        if ((length + start) < start)
+                return ERR_PTR(-EINVAL);
+
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+
+        mhp->rhp = rhp;
+
+        mhp->umem = ib_umem_get(pd->uobject->context, start, length, acc, 0);
+        if (IS_ERR(mhp->umem)) {
+                err = PTR_ERR(mhp->umem);
+                kfree(mhp);
+                return ERR_PTR(err);
+        }
+
+        shift = ffs(mhp->umem->page_size) - 1;
+
+        n = 0;
+        list_for_each_entry(chunk, &mhp->umem->chunk_list, list)
+                n += chunk->nents;
+
+        err = alloc_pbl(mhp, n);
+        if (err)
+                goto err;
+
+        pages = (__be64 *) __get_free_page(GFP_KERNEL);
+        if (!pages) {
+                err = -ENOMEM;
+                goto err_pbl;
+        }
+
+        i = n = 0;
+
+        list_for_each_entry(chunk, &mhp->umem->chunk_list, list)
+                for (j = 0; j < chunk->nmap; ++j) {
+                        len = sg_dma_len(&chunk->page_list[j]) >> shift;
+                        for (k = 0; k < len; ++k) {
+                                pages[i++] = cpu_to_be64(sg_dma_address(
+                                        &chunk->page_list[j]) +
+                                        mhp->umem->page_size * k);
+                                if (i == PAGE_SIZE / sizeof *pages) {
+                                        err = write_pbl(&mhp->rhp->rdev,
+                                              pages,
+                                              mhp->attr.pbl_addr + (n << 3), i);
+                                        if (err)
+                                                goto pbl_done;
+                                        n += i;
+                                        i = 0;
+                                }
+                        }
+                }
+
+        if (i)
+                err = write_pbl(&mhp->rhp->rdev, pages,
+                                     mhp->attr.pbl_addr + (n << 3), i);
+
+pbl_done:
+        free_page((unsigned long) pages);
+        if (err)
+                goto err_pbl;
+
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.zbva = 0;
+        mhp->attr.perms = c4iw_ib_to_tpt_access(acc);
+        mhp->attr.va_fbo = virt;
+        mhp->attr.page_size = shift - 12;
+        mhp->attr.len = (u32) length;
+
+        err = register_mem(rhp, php, mhp, shift);
+        if (err)
+                goto err_pbl;
+
+        return &mhp->ibmr;
+
+err_pbl:
+        c4iw_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
+                              mhp->attr.pbl_size << 3);
+
+err:
+        ib_umem_release(mhp->umem);
+        kfree(mhp);
+        return ERR_PTR(err);
+}
+
+struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+        struct c4iw_mw *mhp;
+        u32 mmid;
+        u32 stag = 0;
+        int ret;
+
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+        ret = allocate_window(&rhp->rdev, &stag, php->pdid);
+        if (ret) {
+                kfree(mhp);
+                return ERR_PTR(ret);
+        }
+        mhp->rhp = rhp;
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.type = FW_RI_STAG_MW;
+        mhp->attr.stag = stag;
+        mmid = (stag) >> 8;
+        mhp->ibmw.rkey = stag;
+        if (insert_handle(rhp, &rhp->mmidr, mhp, mmid)) {
+                deallocate_window(&rhp->rdev, mhp->attr.stag);
+                kfree(mhp);
+                return ERR_PTR(-ENOMEM);
+        }
+        PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
+        return &(mhp->ibmw);
+}
+
+int c4iw_dealloc_mw(struct ib_mw *mw)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_mw *mhp;
+        u32 mmid;
+
+        mhp = to_c4iw_mw(mw);
+        rhp = mhp->rhp;
+        mmid = (mw->rkey) >> 8;
+        deallocate_window(&rhp->rdev, mhp->attr.stag);
+        remove_handle(rhp, &rhp->mmidr, mmid);
+        kfree(mhp);
+        PDBG("%s ib_mw %p mmid 0x%x ptr %p\n", __func__, mw, mmid, mhp);
+        return 0;
+}
+
+struct ib_mr *c4iw_alloc_fast_reg_mr(struct ib_pd *pd, int pbl_depth)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+        struct c4iw_mr *mhp;
+        u32 mmid;
+        u32 stag = 0;
+        int ret = 0;
+
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                goto err;
+
+        mhp->rhp = rhp;
+        ret = alloc_pbl(mhp, pbl_depth);
+        if (ret)
+                goto err1;
+        mhp->attr.pbl_size = pbl_depth;
+        ret = allocate_stag(&rhp->rdev, &stag, php->pdid,
+                                 mhp->attr.pbl_size, mhp->attr.pbl_addr);
+        if (ret)
+                goto err2;
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.type = FW_RI_STAG_NSMR;
+        mhp->attr.stag = stag;
+        mhp->attr.state = 1;
+        mmid = (stag) >> 8;
+        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
+        if (insert_handle(rhp, &rhp->mmidr, mhp, mmid))
+                goto err3;
+
+        PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
+        return &(mhp->ibmr);
+err3:
+        dereg_mem(&rhp->rdev, stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+err2:
+        c4iw_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
+                              mhp->attr.pbl_size << 3);
+err1:
+        kfree(mhp);
+err:
+        return ERR_PTR(ret);
+}
+
+struct ib_fast_reg_page_list *c4iw_alloc_fastreg_pbl(struct ib_device *device,
+                                                     int page_list_len)
+{
+        struct c4iw_fr_page_list *c4pl;
+        struct c4iw_dev *dev = to_c4iw_dev(device);
+        dma_addr_t dma_addr;
+        int size = sizeof *c4pl + page_list_len * sizeof(u64);
+
+        if (page_list_len > T4_MAX_FR_DEPTH)
+                return ERR_PTR(-EINVAL);
+
+        c4pl = dma_alloc_coherent(&dev->rdev.lldi.pdev->dev, size,
+                                  &dma_addr, GFP_KERNEL);
+        if (!c4pl)
+                return ERR_PTR(-ENOMEM);
+
+        pci_unmap_addr_set(c4pl, mapping, dma_addr);
+        c4pl->dma_addr = dma_addr;
+        c4pl->dev = dev;
+        c4pl->size = size;
+        c4pl->ibpl.page_list = (u64 *)(c4pl + 1);
+        c4pl->ibpl.max_page_list_len = page_list_len;
+
+        return &c4pl->ibpl;
+}
+
+void c4iw_free_fastreg_pbl(struct ib_fast_reg_page_list *ibpl)
+{
+        struct c4iw_fr_page_list *c4pl = to_c4iw_fr_page_list(ibpl);
+
+        dma_free_coherent(&c4pl->dev->rdev.lldi.pdev->dev, c4pl->size,
+                          c4pl, pci_unmap_addr(c4pl, mapping));
+}
+
+int c4iw_dereg_mr(struct ib_mr *ib_mr)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_mr *mhp;
+        u32 mmid;
+
+        PDBG("%s ib_mr %p\n", __func__, ib_mr);
+        /* There can be no memory windows */
+        if (atomic_read(&ib_mr->usecnt))
+                return -EINVAL;
+
+        mhp = to_c4iw_mr(ib_mr);
+        rhp = mhp->rhp;
+        mmid = mhp->attr.stag >> 8;
+        dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+        if (mhp->attr.pbl_size)
+                c4iw_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
+                                  mhp->attr.pbl_size << 3);
+        remove_handle(rhp, &rhp->mmidr, mmid);
+        if (mhp->kva)
+                kfree((void *) (unsigned long) mhp->kva);
+        if (mhp->umem)
+                ib_umem_release(mhp->umem);
+        PDBG("%s mmid 0x%x ptr %p\n", __func__, mmid, mhp);
+        kfree(mhp);
+        return 0;
+}
diff --git a/drivers/infiniband/hw/cxgb4/provider.c b/drivers/infiniband/hw/cxgb4/provider.c
new file mode 100644
index 000000000000..dfc49020bb9c
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/provider.c
@@ -0,0 +1,518 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/device.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <linux/rtnetlink.h>
+#include <linux/inetdevice.h>
+#include <linux/io.h>
+
+#include <asm/irq.h>
+#include <asm/byteorder.h>
+
+#include <rdma/iw_cm.h>
+#include <rdma/ib_verbs.h>
+#include <rdma/ib_smi.h>
+#include <rdma/ib_umem.h>
+#include <rdma/ib_user_verbs.h>
+
+#include "iw_cxgb4.h"
+
+static int fastreg_support;
+module_param(fastreg_support, int, 0644);
+MODULE_PARM_DESC(fastreg_support, "Advertise fastreg support (default=0)");
+
+static int c4iw_modify_port(struct ib_device *ibdev,
+                            u8 port, int port_modify_mask,
+                            struct ib_port_modify *props)
+{
+        return -ENOSYS;
+}
+
+static struct ib_ah *c4iw_ah_create(struct ib_pd *pd,
+                                    struct ib_ah_attr *ah_attr)
+{
+        return ERR_PTR(-ENOSYS);
+}
+
+static int c4iw_ah_destroy(struct ib_ah *ah)
+{
+        return -ENOSYS;
+}
+
+static int c4iw_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+{
+        return -ENOSYS;
+}
+
+static int c4iw_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+{
+        return -ENOSYS;
+}
+
+static int c4iw_process_mad(struct ib_device *ibdev, int mad_flags,
+                            u8 port_num, struct ib_wc *in_wc,
+                            struct ib_grh *in_grh, struct ib_mad *in_mad,
+                            struct ib_mad *out_mad)
+{
+        return -ENOSYS;
+}
+
+static int c4iw_dealloc_ucontext(struct ib_ucontext *context)
+{
+        struct c4iw_dev *rhp = to_c4iw_dev(context->device);
+        struct c4iw_ucontext *ucontext = to_c4iw_ucontext(context);
+        struct c4iw_mm_entry *mm, *tmp;
+
+        PDBG("%s context %p\n", __func__, context);
+        list_for_each_entry_safe(mm, tmp, &ucontext->mmaps, entry)
+                kfree(mm);
+        c4iw_release_dev_ucontext(&rhp->rdev, &ucontext->uctx);
+        kfree(ucontext);
+        return 0;
+}
+
+static struct ib_ucontext *c4iw_alloc_ucontext(struct ib_device *ibdev,
+                                               struct ib_udata *udata)
+{
+        struct c4iw_ucontext *context;
+        struct c4iw_dev *rhp = to_c4iw_dev(ibdev);
+
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+        context = kzalloc(sizeof(*context), GFP_KERNEL);
+        if (!context)
+                return ERR_PTR(-ENOMEM);
+        c4iw_init_dev_ucontext(&rhp->rdev, &context->uctx);
+        INIT_LIST_HEAD(&context->mmaps);
+        spin_lock_init(&context->mmap_lock);
+        return &context->ibucontext;
+}
+
+static int c4iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+{
+        int len = vma->vm_end - vma->vm_start;
+        u32 key = vma->vm_pgoff << PAGE_SHIFT;
+        struct c4iw_rdev *rdev;
+        int ret = 0;
+        struct c4iw_mm_entry *mm;
+        struct c4iw_ucontext *ucontext;
+        u64 addr;
+
+        PDBG("%s pgoff 0x%lx key 0x%x len %d\n", __func__, vma->vm_pgoff,
+             key, len);
+
+        if (vma->vm_start & (PAGE_SIZE-1))
+                return -EINVAL;
+
+        rdev = &(to_c4iw_dev(context->device)->rdev);
+        ucontext = to_c4iw_ucontext(context);
+
+        mm = remove_mmap(ucontext, key, len);
+        if (!mm)
+                return -EINVAL;
+        addr = mm->addr;
+        kfree(mm);
+
+        if ((addr >= pci_resource_start(rdev->lldi.pdev, 2)) &&
+            (addr < (pci_resource_start(rdev->lldi.pdev, 2) +
+                       pci_resource_len(rdev->lldi.pdev, 2)))) {
+
+                /*
+                 * Map T4 DB register.
+                 */
+                if (vma->vm_flags & VM_READ)
+                        return -EPERM;
+
+                vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+                vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
+                vma->vm_flags &= ~VM_MAYREAD;
+                ret = io_remap_pfn_range(vma, vma->vm_start,
+                                         addr >> PAGE_SHIFT,
+                                         len, vma->vm_page_prot);
+        } else {
+
+                /*
+                 * Map WQ or CQ contig dma memory...
+                 */
+                ret = remap_pfn_range(vma, vma->vm_start,
+                                      addr >> PAGE_SHIFT,
+                                      len, vma->vm_page_prot);
+        }
+
+        return ret;
+}
+
+static int c4iw_deallocate_pd(struct ib_pd *pd)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+        PDBG("%s ibpd %p pdid 0x%x\n", __func__, pd, php->pdid);
+        c4iw_put_resource(&rhp->rdev.resource.pdid_fifo, php->pdid,
+                          &rhp->rdev.resource.pdid_fifo_lock);
+        kfree(php);
+        return 0;
+}
+
+static struct ib_pd *c4iw_allocate_pd(struct ib_device *ibdev,
+                                      struct ib_ucontext *context,
+                                      struct ib_udata *udata)
+{
+        struct c4iw_pd *php;
+        u32 pdid;
+        struct c4iw_dev *rhp;
+
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+        rhp = (struct c4iw_dev *) ibdev;
+        pdid =  c4iw_get_resource(&rhp->rdev.resource.pdid_fifo,
+                                  &rhp->rdev.resource.pdid_fifo_lock);
+        if (!pdid)
+                return ERR_PTR(-EINVAL);
+        php = kzalloc(sizeof(*php), GFP_KERNEL);
+        if (!php) {
+                c4iw_put_resource(&rhp->rdev.resource.pdid_fifo, pdid,
+                                  &rhp->rdev.resource.pdid_fifo_lock);
+                return ERR_PTR(-ENOMEM);
+        }
+        php->pdid = pdid;
+        php->rhp = rhp;
+        if (context) {
+                if (ib_copy_to_udata(udata, &php->pdid, sizeof(u32))) {
+                        c4iw_deallocate_pd(&php->ibpd);
+                        return ERR_PTR(-EFAULT);
+                }
+        }
+        PDBG("%s pdid 0x%0x ptr 0x%p\n", __func__, pdid, php);
+        return &php->ibpd;
+}
+
+static int c4iw_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
+                           u16 *pkey)
+{
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+        *pkey = 0;
+        return 0;
+}
+
+static int c4iw_query_gid(struct ib_device *ibdev, u8 port, int index,
+                          union ib_gid *gid)
+{
+        struct c4iw_dev *dev;
+
+        PDBG("%s ibdev %p, port %d, index %d, gid %p\n",
+               __func__, ibdev, port, index, gid);
+        dev = to_c4iw_dev(ibdev);
+        BUG_ON(port == 0);
+        memset(&(gid->raw[0]), 0, sizeof(gid->raw));
+        memcpy(&(gid->raw[0]), dev->rdev.lldi.ports[port-1]->dev_addr, 6);
+        return 0;
+}
+
+static int c4iw_query_device(struct ib_device *ibdev,
+                             struct ib_device_attr *props)
+{
+
+        struct c4iw_dev *dev;
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+
+        dev = to_c4iw_dev(ibdev);
+        memset(props, 0, sizeof *props);
+        memcpy(&props->sys_image_guid, dev->rdev.lldi.ports[0]->dev_addr, 6);
+        props->hw_ver = dev->rdev.lldi.adapter_type;
+        props->fw_ver = dev->rdev.lldi.fw_vers;
+        props->device_cap_flags = dev->device_cap_flags;
+        props->page_size_cap = T4_PAGESIZE_MASK;
+        props->vendor_id = (u32)dev->rdev.lldi.pdev->vendor;
+        props->vendor_part_id = (u32)dev->rdev.lldi.pdev->device;
+        props->max_mr_size = T4_MAX_MR_SIZE;
+        props->max_qp = T4_MAX_NUM_QP;
+        props->max_qp_wr = T4_MAX_QP_DEPTH;
+        props->max_sge = T4_MAX_RECV_SGE;
+        props->max_sge_rd = 1;
+        props->max_qp_rd_atom = c4iw_max_read_depth;
+        props->max_qp_init_rd_atom = c4iw_max_read_depth;
+        props->max_cq = T4_MAX_NUM_CQ;
+        props->max_cqe = T4_MAX_CQ_DEPTH;
+        props->max_mr = c4iw_num_stags(&dev->rdev);
+        props->max_pd = T4_MAX_NUM_PD;
+        props->local_ca_ack_delay = 0;
+        props->max_fast_reg_page_list_len = T4_MAX_FR_DEPTH;
+
+        return 0;
+}
+
+static int c4iw_query_port(struct ib_device *ibdev, u8 port,
+                           struct ib_port_attr *props)
+{
+        struct c4iw_dev *dev;
+        struct net_device *netdev;
+        struct in_device *inetdev;
+
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+
+        dev = to_c4iw_dev(ibdev);
+        netdev = dev->rdev.lldi.ports[port-1];
+
+        memset(props, 0, sizeof(struct ib_port_attr));
+        props->max_mtu = IB_MTU_4096;
+        if (netdev->mtu >= 4096)
+                props->active_mtu = IB_MTU_4096;
+        else if (netdev->mtu >= 2048)
+                props->active_mtu = IB_MTU_2048;
+        else if (netdev->mtu >= 1024)
+                props->active_mtu = IB_MTU_1024;
+        else if (netdev->mtu >= 512)
+                props->active_mtu = IB_MTU_512;
+        else
+                props->active_mtu = IB_MTU_256;
+
+        if (!netif_carrier_ok(netdev))
+                props->state = IB_PORT_DOWN;
+        else {
+                inetdev = in_dev_get(netdev);
+                if (inetdev) {
+                        if (inetdev->ifa_list)
+                                props->state = IB_PORT_ACTIVE;
+                        else
+                                props->state = IB_PORT_INIT;
+                        in_dev_put(inetdev);
+                } else
+                        props->state = IB_PORT_INIT;
+        }
+
+        props->port_cap_flags =
+            IB_PORT_CM_SUP |
+            IB_PORT_SNMP_TUNNEL_SUP |
+            IB_PORT_REINIT_SUP |
+            IB_PORT_DEVICE_MGMT_SUP |
+            IB_PORT_VENDOR_CLASS_SUP | IB_PORT_BOOT_MGMT_SUP;
+        props->gid_tbl_len = 1;
+        props->pkey_tbl_len = 1;
+        props->active_width = 2;
+        props->active_speed = 2;
+        props->max_msg_sz = -1;
+
+        return 0;
+}
+
+static ssize_t show_rev(struct device *dev, struct device_attribute *attr,
+                        char *buf)
+{
+        struct c4iw_dev *c4iw_dev = container_of(dev, struct c4iw_dev,
+                                                 ibdev.dev);
+        PDBG("%s dev 0x%p\n", __func__, dev);
+        return sprintf(buf, "%d\n", c4iw_dev->rdev.lldi.adapter_type);
+}
+
+static ssize_t show_fw_ver(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct c4iw_dev *c4iw_dev = container_of(dev, struct c4iw_dev,
+                                                 ibdev.dev);
+        PDBG("%s dev 0x%p\n", __func__, dev);
+
+        return sprintf(buf, "%u.%u.%u.%u\n",
+                        FW_HDR_FW_VER_MAJOR_GET(c4iw_dev->rdev.lldi.fw_vers),
+                        FW_HDR_FW_VER_MINOR_GET(c4iw_dev->rdev.lldi.fw_vers),
+                        FW_HDR_FW_VER_MICRO_GET(c4iw_dev->rdev.lldi.fw_vers),
+                        FW_HDR_FW_VER_BUILD_GET(c4iw_dev->rdev.lldi.fw_vers));
+}
+
+static ssize_t show_hca(struct device *dev, struct device_attribute *attr,
+                        char *buf)
+{
+        struct c4iw_dev *c4iw_dev = container_of(dev, struct c4iw_dev,
+                                                 ibdev.dev);
+        struct ethtool_drvinfo info;
+        struct net_device *lldev = c4iw_dev->rdev.lldi.ports[0];
+
+        PDBG("%s dev 0x%p\n", __func__, dev);
+        lldev->ethtool_ops->get_drvinfo(lldev, &info);
+        return sprintf(buf, "%s\n", info.driver);
+}
+
+static ssize_t show_board(struct device *dev, struct device_attribute *attr,
+                          char *buf)
+{
+        struct c4iw_dev *c4iw_dev = container_of(dev, struct c4iw_dev,
+                                                 ibdev.dev);
+        PDBG("%s dev 0x%p\n", __func__, dev);
+        return sprintf(buf, "%x.%x\n", c4iw_dev->rdev.lldi.pdev->vendor,
+                       c4iw_dev->rdev.lldi.pdev->device);
+}
+
+static int c4iw_get_mib(struct ib_device *ibdev,
+                        union rdma_protocol_stats *stats)
+{
+        return -ENOSYS;
+}
+
+static DEVICE_ATTR(hw_rev, S_IRUGO, show_rev, NULL);
+static DEVICE_ATTR(fw_ver, S_IRUGO, show_fw_ver, NULL);
+static DEVICE_ATTR(hca_type, S_IRUGO, show_hca, NULL);
+static DEVICE_ATTR(board_id, S_IRUGO, show_board, NULL);
+
+static struct device_attribute *c4iw_class_attributes[] = {
+        &dev_attr_hw_rev,
+        &dev_attr_fw_ver,
+        &dev_attr_hca_type,
+        &dev_attr_board_id,
+};
+
+int c4iw_register_device(struct c4iw_dev *dev)
+{
+        int ret;
+        int i;
+
+        PDBG("%s c4iw_dev %p\n", __func__, dev);
+        BUG_ON(!dev->rdev.lldi.ports[0]);
+        strlcpy(dev->ibdev.name, "cxgb4_%d", IB_DEVICE_NAME_MAX);
+        memset(&dev->ibdev.node_guid, 0, sizeof(dev->ibdev.node_guid));
+        memcpy(&dev->ibdev.node_guid, dev->rdev.lldi.ports[0]->dev_addr, 6);
+        dev->ibdev.owner = THIS_MODULE;
+        dev->device_cap_flags = IB_DEVICE_LOCAL_DMA_LKEY | IB_DEVICE_MEM_WINDOW;
+        if (fastreg_support)
+                dev->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS;
+        dev->ibdev.local_dma_lkey = 0;
+        dev->ibdev.uverbs_cmd_mask =
+            (1ull << IB_USER_VERBS_CMD_GET_CONTEXT) |
+            (1ull << IB_USER_VERBS_CMD_QUERY_DEVICE) |
+            (1ull << IB_USER_VERBS_CMD_QUERY_PORT) |
+            (1ull << IB_USER_VERBS_CMD_ALLOC_PD) |
+            (1ull << IB_USER_VERBS_CMD_DEALLOC_PD) |
+            (1ull << IB_USER_VERBS_CMD_REG_MR) |
+            (1ull << IB_USER_VERBS_CMD_DEREG_MR) |
+            (1ull << IB_USER_VERBS_CMD_CREATE_COMP_CHANNEL) |
+            (1ull << IB_USER_VERBS_CMD_CREATE_CQ) |
+            (1ull << IB_USER_VERBS_CMD_DESTROY_CQ) |
+            (1ull << IB_USER_VERBS_CMD_REQ_NOTIFY_CQ) |
+            (1ull << IB_USER_VERBS_CMD_CREATE_QP) |
+            (1ull << IB_USER_VERBS_CMD_MODIFY_QP) |
+            (1ull << IB_USER_VERBS_CMD_POLL_CQ) |
+            (1ull << IB_USER_VERBS_CMD_DESTROY_QP) |
+            (1ull << IB_USER_VERBS_CMD_POST_SEND) |
+            (1ull << IB_USER_VERBS_CMD_POST_RECV);
+        dev->ibdev.node_type = RDMA_NODE_RNIC;
+        memcpy(dev->ibdev.node_desc, C4IW_NODE_DESC, sizeof(C4IW_NODE_DESC));
+        dev->ibdev.phys_port_cnt = dev->rdev.lldi.nports;
+        dev->ibdev.num_comp_vectors = 1;
+        dev->ibdev.dma_device = &(dev->rdev.lldi.pdev->dev);
+        dev->ibdev.query_device = c4iw_query_device;
+        dev->ibdev.query_port = c4iw_query_port;
+        dev->ibdev.modify_port = c4iw_modify_port;
+        dev->ibdev.query_pkey = c4iw_query_pkey;
+        dev->ibdev.query_gid = c4iw_query_gid;
+        dev->ibdev.alloc_ucontext = c4iw_alloc_ucontext;
+        dev->ibdev.dealloc_ucontext = c4iw_dealloc_ucontext;
+        dev->ibdev.mmap = c4iw_mmap;
+        dev->ibdev.alloc_pd = c4iw_allocate_pd;
+        dev->ibdev.dealloc_pd = c4iw_deallocate_pd;
+        dev->ibdev.create_ah = c4iw_ah_create;
+        dev->ibdev.destroy_ah = c4iw_ah_destroy;
+        dev->ibdev.create_qp = c4iw_create_qp;
+        dev->ibdev.modify_qp = c4iw_ib_modify_qp;
+        dev->ibdev.destroy_qp = c4iw_destroy_qp;
+        dev->ibdev.create_cq = c4iw_create_cq;
+        dev->ibdev.destroy_cq = c4iw_destroy_cq;
+        dev->ibdev.resize_cq = c4iw_resize_cq;
+        dev->ibdev.poll_cq = c4iw_poll_cq;
+        dev->ibdev.get_dma_mr = c4iw_get_dma_mr;
+        dev->ibdev.reg_phys_mr = c4iw_register_phys_mem;
+        dev->ibdev.rereg_phys_mr = c4iw_reregister_phys_mem;
+        dev->ibdev.reg_user_mr = c4iw_reg_user_mr;
+        dev->ibdev.dereg_mr = c4iw_dereg_mr;
+        dev->ibdev.alloc_mw = c4iw_alloc_mw;
+        dev->ibdev.bind_mw = c4iw_bind_mw;
+        dev->ibdev.dealloc_mw = c4iw_dealloc_mw;
+        dev->ibdev.alloc_fast_reg_mr = c4iw_alloc_fast_reg_mr;
+        dev->ibdev.alloc_fast_reg_page_list = c4iw_alloc_fastreg_pbl;
+        dev->ibdev.free_fast_reg_page_list = c4iw_free_fastreg_pbl;
+        dev->ibdev.attach_mcast = c4iw_multicast_attach;
+        dev->ibdev.detach_mcast = c4iw_multicast_detach;
+        dev->ibdev.process_mad = c4iw_process_mad;
+        dev->ibdev.req_notify_cq = c4iw_arm_cq;
+        dev->ibdev.post_send = c4iw_post_send;
+        dev->ibdev.post_recv = c4iw_post_receive;
+        dev->ibdev.get_protocol_stats = c4iw_get_mib;
+
+        dev->ibdev.iwcm = kmalloc(sizeof(struct iw_cm_verbs), GFP_KERNEL);
+        if (!dev->ibdev.iwcm)
+                return -ENOMEM;
+
+        dev->ibdev.iwcm->connect = c4iw_connect;
+        dev->ibdev.iwcm->accept = c4iw_accept_cr;
+        dev->ibdev.iwcm->reject = c4iw_reject_cr;
+        dev->ibdev.iwcm->create_listen = c4iw_create_listen;
+        dev->ibdev.iwcm->destroy_listen = c4iw_destroy_listen;
+        dev->ibdev.iwcm->add_ref = c4iw_qp_add_ref;
+        dev->ibdev.iwcm->rem_ref = c4iw_qp_rem_ref;
+        dev->ibdev.iwcm->get_qp = c4iw_get_qp;
+
+        ret = ib_register_device(&dev->ibdev);
+        if (ret)
+                goto bail1;
+
+        for (i = 0; i < ARRAY_SIZE(c4iw_class_attributes); ++i) {
+                ret = device_create_file(&dev->ibdev.dev,
+                                         c4iw_class_attributes[i]);
+                if (ret)
+                        goto bail2;
+        }
+        return 0;
+bail2:
+        ib_unregister_device(&dev->ibdev);
+bail1:
+        kfree(dev->ibdev.iwcm);
+        return ret;
+}
+
+void c4iw_unregister_device(struct c4iw_dev *dev)
+{
+        int i;
+
+        PDBG("%s c4iw_dev %p\n", __func__, dev);
+        for (i = 0; i < ARRAY_SIZE(c4iw_class_attributes); ++i)
+                device_remove_file(&dev->ibdev.dev,
+                                   c4iw_class_attributes[i]);
+        ib_unregister_device(&dev->ibdev);
+        kfree(dev->ibdev.iwcm);
+        return;
+}
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
new file mode 100644
index 000000000000..83a01dc0c4c1
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -0,0 +1,1577 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include "iw_cxgb4.h"
+
+static int destroy_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
+                      struct c4iw_dev_ucontext *uctx)
+{
+        /*
+         * uP clears EQ contexts when the connection exits rdma mode,
+         * so no need to post a RESET WR for these EQs.
+         */
+        dma_free_coherent(&(rdev->lldi.pdev->dev),
+                          wq->rq.memsize, wq->rq.queue,
+                          pci_unmap_addr(&wq->rq, mapping));
+        dma_free_coherent(&(rdev->lldi.pdev->dev),
+                          wq->sq.memsize, wq->sq.queue,
+                          pci_unmap_addr(&wq->sq, mapping));
+        c4iw_rqtpool_free(rdev, wq->rq.rqt_hwaddr, wq->rq.rqt_size);
+        kfree(wq->rq.sw_rq);
+        kfree(wq->sq.sw_sq);
+        c4iw_put_qpid(rdev, wq->rq.qid, uctx);
+        c4iw_put_qpid(rdev, wq->sq.qid, uctx);
+        return 0;
+}
+
+static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
+                     struct t4_cq *rcq, struct t4_cq *scq,
+                     struct c4iw_dev_ucontext *uctx)
+{
+        int user = (uctx != &rdev->uctx);
+        struct fw_ri_res_wr *res_wr;
+        struct fw_ri_res *res;
+        int wr_len;
+        struct c4iw_wr_wait wr_wait;
+        struct sk_buff *skb;
+        int ret;
+        int eqsize;
+
+        wq->sq.qid = c4iw_get_qpid(rdev, uctx);
+        if (!wq->sq.qid)
+                return -ENOMEM;
+
+        wq->rq.qid = c4iw_get_qpid(rdev, uctx);
+        if (!wq->rq.qid)
+                goto err1;
+
+        if (!user) {
+                wq->sq.sw_sq = kzalloc(wq->sq.size * sizeof *wq->sq.sw_sq,
+                                 GFP_KERNEL);
+                if (!wq->sq.sw_sq)
+                        goto err2;
+
+                wq->rq.sw_rq = kzalloc(wq->rq.size * sizeof *wq->rq.sw_rq,
+                                 GFP_KERNEL);
+                if (!wq->rq.sw_rq)
+                        goto err3;
+        }
+
+        /*
+         * RQT must be a power of 2.
+         */
+        wq->rq.rqt_size = roundup_pow_of_two(wq->rq.size);
+        wq->rq.rqt_hwaddr = c4iw_rqtpool_alloc(rdev, wq->rq.rqt_size);
+        if (!wq->rq.rqt_hwaddr)
+                goto err4;
+
+        wq->sq.queue = dma_alloc_coherent(&(rdev->lldi.pdev->dev),
+                                          wq->sq.memsize, &(wq->sq.dma_addr),
+                                          GFP_KERNEL);
+        if (!wq->sq.queue)
+                goto err5;
+        memset(wq->sq.queue, 0, wq->sq.memsize);
+        pci_unmap_addr_set(&wq->sq, mapping, wq->sq.dma_addr);
+
+        wq->rq.queue = dma_alloc_coherent(&(rdev->lldi.pdev->dev),
+                                          wq->rq.memsize, &(wq->rq.dma_addr),
+                                          GFP_KERNEL);
+        if (!wq->rq.queue)
+                goto err6;
+        PDBG("%s sq base va 0x%p pa 0x%llx rq base va 0x%p pa 0x%llx\n",
+                __func__, wq->sq.queue,
+                (unsigned long long)virt_to_phys(wq->sq.queue),
+                wq->rq.queue,
+                (unsigned long long)virt_to_phys(wq->rq.queue));
+        memset(wq->rq.queue, 0, wq->rq.memsize);
+        pci_unmap_addr_set(&wq->rq, mapping, wq->rq.dma_addr);
+
+        wq->db = rdev->lldi.db_reg;
+        wq->gts = rdev->lldi.gts_reg;
+        if (user) {
+                wq->sq.udb = (u64)pci_resource_start(rdev->lldi.pdev, 2) +
+                                        (wq->sq.qid << rdev->qpshift);
+                wq->sq.udb &= PAGE_MASK;
+                wq->rq.udb = (u64)pci_resource_start(rdev->lldi.pdev, 2) +
+                                        (wq->rq.qid << rdev->qpshift);
+                wq->rq.udb &= PAGE_MASK;
+        }
+        wq->rdev = rdev;
+        wq->rq.msn = 1;
+
+        /* build fw_ri_res_wr */
+        wr_len = sizeof *res_wr + 2 * sizeof *res;
+
+        skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
+        if (!skb) {
+                ret = -ENOMEM;
+                goto err7;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
+
+        res_wr = (struct fw_ri_res_wr *)__skb_put(skb, wr_len);
+        memset(res_wr, 0, wr_len);
+        res_wr->op_nres = cpu_to_be32(
+                        FW_WR_OP(FW_RI_RES_WR) |
+                        V_FW_RI_RES_WR_NRES(2) |
+                        FW_WR_COMPL(1));
+        res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
+        res_wr->cookie = (u64)&wr_wait;
+        res = res_wr->res;
+        res->u.sqrq.restype = FW_RI_RES_TYPE_SQ;
+        res->u.sqrq.op = FW_RI_RES_OP_WRITE;
+
+        /*
+         * eqsize is the number of 64B entries plus the status page size.
+         */
+        eqsize = wq->sq.size * T4_SQ_NUM_SLOTS + T4_EQ_STATUS_ENTRIES;
+
+        res->u.sqrq.fetchszm_to_iqid = cpu_to_be32(
+                V_FW_RI_RES_WR_HOSTFCMODE(0) |  /* no host cidx updates */
+                V_FW_RI_RES_WR_CPRIO(0) |       /* don't keep in chip cache */
+                V_FW_RI_RES_WR_PCIECHN(0) |     /* set by uP at ri_init time */
+                V_FW_RI_RES_WR_IQID(scq->cqid));
+        res->u.sqrq.dcaen_to_eqsize = cpu_to_be32(
+                V_FW_RI_RES_WR_DCAEN(0) |
+                V_FW_RI_RES_WR_DCACPU(0) |
+                V_FW_RI_RES_WR_FBMIN(3) |
+                V_FW_RI_RES_WR_FBMAX(3) |
+                V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
+                V_FW_RI_RES_WR_CIDXFTHRESH(0) |
+                V_FW_RI_RES_WR_EQSIZE(eqsize));
+        res->u.sqrq.eqid = cpu_to_be32(wq->sq.qid);
+        res->u.sqrq.eqaddr = cpu_to_be64(wq->sq.dma_addr);
+        res++;
+        res->u.sqrq.restype = FW_RI_RES_TYPE_RQ;
+        res->u.sqrq.op = FW_RI_RES_OP_WRITE;
+
+        /*
+         * eqsize is the number of 64B entries plus the status page size.
+         */
+        eqsize = wq->rq.size * T4_RQ_NUM_SLOTS + T4_EQ_STATUS_ENTRIES;
+        res->u.sqrq.fetchszm_to_iqid = cpu_to_be32(
+                V_FW_RI_RES_WR_HOSTFCMODE(0) |  /* no host cidx updates */
+                V_FW_RI_RES_WR_CPRIO(0) |       /* don't keep in chip cache */
+                V_FW_RI_RES_WR_PCIECHN(0) |     /* set by uP at ri_init time */
+                V_FW_RI_RES_WR_IQID(rcq->cqid));
+        res->u.sqrq.dcaen_to_eqsize = cpu_to_be32(
+                V_FW_RI_RES_WR_DCAEN(0) |
+                V_FW_RI_RES_WR_DCACPU(0) |
+                V_FW_RI_RES_WR_FBMIN(3) |
+                V_FW_RI_RES_WR_FBMAX(3) |
+                V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
+                V_FW_RI_RES_WR_CIDXFTHRESH(0) |
+                V_FW_RI_RES_WR_EQSIZE(eqsize));
+        res->u.sqrq.eqid = cpu_to_be32(wq->rq.qid);
+        res->u.sqrq.eqaddr = cpu_to_be64(wq->rq.dma_addr);
+
+        c4iw_init_wr_wait(&wr_wait);
+
+        ret = c4iw_ofld_send(rdev, skb);
+        if (ret)
+                goto err7;
+        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+        if (!wr_wait.done) {
+                printk(KERN_ERR MOD "Device %s not responding!\n",
+                       pci_name(rdev->lldi.pdev));
+                rdev->flags = T4_FATAL_ERROR;
+                ret = -EIO;
+        } else
+                ret = wr_wait.ret;
+        if (ret)
+                goto err7;
+
+        PDBG("%s sqid 0x%x rqid 0x%x kdb 0x%p squdb 0x%llx rqudb 0x%llx\n",
+             __func__, wq->sq.qid, wq->rq.qid, wq->db,
+             (unsigned long long)wq->sq.udb, (unsigned long long)wq->rq.udb);
+
+        return 0;
+err7:
+        dma_free_coherent(&(rdev->lldi.pdev->dev),
+                          wq->rq.memsize, wq->rq.queue,
+                          pci_unmap_addr(&wq->rq, mapping));
+err6:
+        dma_free_coherent(&(rdev->lldi.pdev->dev),
+                          wq->sq.memsize, wq->sq.queue,
+                          pci_unmap_addr(&wq->sq, mapping));
+err5:
+        c4iw_rqtpool_free(rdev, wq->rq.rqt_hwaddr, wq->rq.rqt_size);
+err4:
+        kfree(wq->rq.sw_rq);
+err3:
+        kfree(wq->sq.sw_sq);
+err2:
+        c4iw_put_qpid(rdev, wq->rq.qid, uctx);
+err1:
+        c4iw_put_qpid(rdev, wq->sq.qid, uctx);
+        return -ENOMEM;
+}
+
+static int build_rdma_send(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
+{
+        int i;
+        u32 plen;
+        int size;
+        u8 *datap;
+
+        if (wr->num_sge > T4_MAX_SEND_SGE)
+                return -EINVAL;
+        switch (wr->opcode) {
+        case IB_WR_SEND:
+                if (wr->send_flags & IB_SEND_SOLICITED)
+                        wqe->send.sendop_pkd = cpu_to_be32(
+                                V_FW_RI_SEND_WR_SENDOP(FW_RI_SEND_WITH_SE));
+                else
+                        wqe->send.sendop_pkd = cpu_to_be32(
+                                V_FW_RI_SEND_WR_SENDOP(FW_RI_SEND));
+                wqe->send.stag_inv = 0;
+                break;
+        case IB_WR_SEND_WITH_INV:
+                if (wr->send_flags & IB_SEND_SOLICITED)
+                        wqe->send.sendop_pkd = cpu_to_be32(
+                                V_FW_RI_SEND_WR_SENDOP(FW_RI_SEND_WITH_SE_INV));
+                else
+                        wqe->send.sendop_pkd = cpu_to_be32(
+                                V_FW_RI_SEND_WR_SENDOP(FW_RI_SEND_WITH_INV));
+                wqe->send.stag_inv = cpu_to_be32(wr->ex.invalidate_rkey);
+                break;
+
+        default:
+                return -EINVAL;
+        }
+        plen = 0;
+        if (wr->num_sge) {
+                if (wr->send_flags & IB_SEND_INLINE) {
+                        datap = (u8 *)wqe->send.u.immd_src[0].data;
+                        for (i = 0; i < wr->num_sge; i++) {
+                                if ((plen + wr->sg_list[i].length) >
+                                    T4_MAX_SEND_INLINE) {
+                                        return -EMSGSIZE;
+                                }
+                                plen += wr->sg_list[i].length;
+                                memcpy(datap,
+                                     (void *)(unsigned long)wr->sg_list[i].addr,
+                                     wr->sg_list[i].length);
+                                datap += wr->sg_list[i].length;
+                        }
+                        wqe->send.u.immd_src[0].op = FW_RI_DATA_IMMD;
+                        wqe->send.u.immd_src[0].r1 = 0;
+                        wqe->send.u.immd_src[0].r2 = 0;
+                        wqe->send.u.immd_src[0].immdlen = cpu_to_be32(plen);
+                        size = sizeof wqe->send + sizeof(struct fw_ri_immd) +
+                               plen;
+                } else {
+                        for (i = 0; i < wr->num_sge; i++) {
+                                if ((plen + wr->sg_list[i].length) < plen)
+                                        return -EMSGSIZE;
+                                plen += wr->sg_list[i].length;
+                                wqe->send.u.isgl_src[0].sge[i].stag =
+                                        cpu_to_be32(wr->sg_list[i].lkey);
+                                wqe->send.u.isgl_src[0].sge[i].len =
+                                        cpu_to_be32(wr->sg_list[i].length);
+                                wqe->send.u.isgl_src[0].sge[i].to =
+                                        cpu_to_be64(wr->sg_list[i].addr);
+                        }
+                        wqe->send.u.isgl_src[0].op = FW_RI_DATA_ISGL;
+                        wqe->send.u.isgl_src[0].r1 = 0;
+                        wqe->send.u.isgl_src[0].nsge = cpu_to_be16(wr->num_sge);
+                        wqe->send.u.isgl_src[0].r2 = 0;
+                        size = sizeof wqe->send + sizeof(struct fw_ri_isgl) +
+                               wr->num_sge * sizeof(struct fw_ri_sge);
+                }
+        } else {
+                wqe->send.u.immd_src[0].op = FW_RI_DATA_IMMD;
+                wqe->send.u.immd_src[0].r1 = 0;
+                wqe->send.u.immd_src[0].r2 = 0;
+                wqe->send.u.immd_src[0].immdlen = 0;
+                size = sizeof wqe->send + sizeof(struct fw_ri_immd);
+        }
+        *len16 = DIV_ROUND_UP(size, 16);
+        wqe->send.plen = cpu_to_be32(plen);
+        return 0;
+}
+
+static int build_rdma_write(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
+{
+        int i;
+        u32 plen;
+        int size;
+        u8 *datap;
+
+        if (wr->num_sge > T4_MAX_WRITE_SGE)
+                return -EINVAL;
+        wqe->write.r2 = 0;
+        wqe->write.stag_sink = cpu_to_be32(wr->wr.rdma.rkey);
+        wqe->write.to_sink = cpu_to_be64(wr->wr.rdma.remote_addr);
+        plen = 0;
+        if (wr->num_sge) {
+                if (wr->send_flags & IB_SEND_INLINE) {
+                        datap = (u8 *)wqe->write.u.immd_src[0].data;
+                        for (i = 0; i < wr->num_sge; i++) {
+                                if ((plen + wr->sg_list[i].length) >
+                                    T4_MAX_WRITE_INLINE) {
+                                        return -EMSGSIZE;
+                                }
+                                plen += wr->sg_list[i].length;
+                                memcpy(datap,
+                                     (void *)(unsigned long)wr->sg_list[i].addr,
+                                     wr->sg_list[i].length);
+                                datap += wr->sg_list[i].length;
+                        }
+                        wqe->write.u.immd_src[0].op = FW_RI_DATA_IMMD;
+                        wqe->write.u.immd_src[0].r1 = 0;
+                        wqe->write.u.immd_src[0].r2 = 0;
+                        wqe->write.u.immd_src[0].immdlen = cpu_to_be32(plen);
+                        size = sizeof wqe->write + sizeof(struct fw_ri_immd) +
+                               plen;
+                } else {
+                        for (i = 0; i < wr->num_sge; i++) {
+                                if ((plen + wr->sg_list[i].length) < plen)
+                                        return -EMSGSIZE;
+                                plen += wr->sg_list[i].length;
+                                wqe->write.u.isgl_src[0].sge[i].stag =
+                                        cpu_to_be32(wr->sg_list[i].lkey);
+                                wqe->write.u.isgl_src[0].sge[i].len =
+                                        cpu_to_be32(wr->sg_list[i].length);
+                                wqe->write.u.isgl_src[0].sge[i].to =
+                                        cpu_to_be64(wr->sg_list[i].addr);
+                        }
+                        wqe->write.u.isgl_src[0].op = FW_RI_DATA_ISGL;
+                        wqe->write.u.isgl_src[0].r1 = 0;
+                        wqe->write.u.isgl_src[0].nsge =
+                                                       cpu_to_be16(wr->num_sge);
+                        wqe->write.u.isgl_src[0].r2 = 0;
+                        size = sizeof wqe->write + sizeof(struct fw_ri_isgl) +
+                               wr->num_sge * sizeof(struct fw_ri_sge);
+                }
+        } else {
+                wqe->write.u.immd_src[0].op = FW_RI_DATA_IMMD;
+                wqe->write.u.immd_src[0].r1 = 0;
+                wqe->write.u.immd_src[0].r2 = 0;
+                wqe->write.u.immd_src[0].immdlen = 0;
+                size = sizeof wqe->write + sizeof(struct fw_ri_immd);
+        }
+        *len16 = DIV_ROUND_UP(size, 16);
+        wqe->write.plen = cpu_to_be32(plen);
+        return 0;
+}
+
+static int build_rdma_read(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
+{
+        if (wr->num_sge > 1)
+                return -EINVAL;
+        if (wr->num_sge) {
+                wqe->read.stag_src = cpu_to_be32(wr->wr.rdma.rkey);
+                wqe->read.to_src_hi = cpu_to_be32((u32)(wr->wr.rdma.remote_addr
+                                                        >> 32));
+                wqe->read.to_src_lo = cpu_to_be32((u32)wr->wr.rdma.remote_addr);
+                wqe->read.stag_sink = cpu_to_be32(wr->sg_list[0].lkey);
+                wqe->read.plen = cpu_to_be32(wr->sg_list[0].length);
+                wqe->read.to_sink_hi = cpu_to_be32((u32)(wr->sg_list[0].addr
+                                                         >> 32));
+                wqe->read.to_sink_lo = cpu_to_be32((u32)(wr->sg_list[0].addr));
+        } else {
+                wqe->read.stag_src = cpu_to_be32(2);
+                wqe->read.to_src_hi = 0;
+                wqe->read.to_src_lo = 0;
+                wqe->read.stag_sink = cpu_to_be32(2);
+                wqe->read.plen = 0;
+                wqe->read.to_sink_hi = 0;
+                wqe->read.to_sink_lo = 0;
+        }
+        wqe->read.r2 = 0;
+        wqe->read.r5 = 0;
+        *len16 = DIV_ROUND_UP(sizeof wqe->read, 16);
+        return 0;
+}
+
+static int build_rdma_recv(struct c4iw_qp *qhp, union t4_recv_wr *wqe,
+                           struct ib_recv_wr *wr, u8 *len16)
+{
+        int i;
+        int plen = 0;
+
+        for (i = 0; i < wr->num_sge; i++) {
+                if ((plen + wr->sg_list[i].length) < plen)
+                        return -EMSGSIZE;
+                plen += wr->sg_list[i].length;
+                wqe->recv.isgl.sge[i].stag =
+                        cpu_to_be32(wr->sg_list[i].lkey);
+                wqe->recv.isgl.sge[i].len =
+                        cpu_to_be32(wr->sg_list[i].length);
+                wqe->recv.isgl.sge[i].to =
+                        cpu_to_be64(wr->sg_list[i].addr);
+        }
+        for (; i < T4_MAX_RECV_SGE; i++) {
+                wqe->recv.isgl.sge[i].stag = 0;
+                wqe->recv.isgl.sge[i].len = 0;
+                wqe->recv.isgl.sge[i].to = 0;
+        }
+        wqe->recv.isgl.op = FW_RI_DATA_ISGL;
+        wqe->recv.isgl.r1 = 0;
+        wqe->recv.isgl.nsge = cpu_to_be16(wr->num_sge);
+        wqe->recv.isgl.r2 = 0;
+        *len16 = DIV_ROUND_UP(sizeof wqe->recv +
+                              wr->num_sge * sizeof(struct fw_ri_sge), 16);
+        return 0;
+}
+
+static int build_fastreg(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
+{
+
+        struct fw_ri_immd *imdp;
+        __be64 *p;
+        int i;
+        int pbllen = roundup(wr->wr.fast_reg.page_list_len * sizeof(u64), 32);
+
+        if (wr->wr.fast_reg.page_list_len > T4_MAX_FR_DEPTH)
+                return -EINVAL;
+
+        wqe->fr.qpbinde_to_dcacpu = 0;
+        wqe->fr.pgsz_shift = wr->wr.fast_reg.page_shift - 12;
+        wqe->fr.addr_type = FW_RI_VA_BASED_TO;
+        wqe->fr.mem_perms = c4iw_ib_to_tpt_access(wr->wr.fast_reg.access_flags);
+        wqe->fr.len_hi = 0;
+        wqe->fr.len_lo = cpu_to_be32(wr->wr.fast_reg.length);
+        wqe->fr.stag = cpu_to_be32(wr->wr.fast_reg.rkey);
+        wqe->fr.va_hi = cpu_to_be32(wr->wr.fast_reg.iova_start >> 32);
+        wqe->fr.va_lo_fbo = cpu_to_be32(wr->wr.fast_reg.iova_start &
+                                        0xffffffff);
+        if (pbllen > T4_MAX_FR_IMMD) {
+                struct c4iw_fr_page_list *c4pl =
+                                to_c4iw_fr_page_list(wr->wr.fast_reg.page_list);
+                struct fw_ri_dsgl *sglp;
+
+                sglp = (struct fw_ri_dsgl *)(&wqe->fr + 1);
+                sglp->op = FW_RI_DATA_DSGL;
+                sglp->r1 = 0;
+                sglp->nsge = cpu_to_be16(1);
+                sglp->addr0 = cpu_to_be64(c4pl->dma_addr);
+                sglp->len0 = cpu_to_be32(pbllen);
+
+                *len16 = DIV_ROUND_UP(sizeof wqe->fr + sizeof *sglp, 16);
+        } else {
+                imdp = (struct fw_ri_immd *)(&wqe->fr + 1);
+                imdp->op = FW_RI_DATA_IMMD;
+                imdp->r1 = 0;
+                imdp->r2 = 0;
+                imdp->immdlen = cpu_to_be32(pbllen);
+                p = (__be64 *)(imdp + 1);
+                for (i = 0; i < wr->wr.fast_reg.page_list_len; i++, p++)
+                        *p = cpu_to_be64(
+                                (u64)wr->wr.fast_reg.page_list->page_list[i]);
+                *len16 = DIV_ROUND_UP(sizeof wqe->fr + sizeof *imdp + pbllen,
+                                      16);
+        }
+        return 0;
+}
+
+static int build_inv_stag(union t4_wr *wqe, struct ib_send_wr *wr,
+                          u8 *len16)
+{
+        wqe->inv.stag_inv = cpu_to_be32(wr->ex.invalidate_rkey);
+        wqe->inv.r2 = 0;
+        *len16 = DIV_ROUND_UP(sizeof wqe->inv, 16);
+        return 0;
+}
+
+void c4iw_qp_add_ref(struct ib_qp *qp)
+{
+        PDBG("%s ib_qp %p\n", __func__, qp);
+        atomic_inc(&(to_c4iw_qp(qp)->refcnt));
+}
+
+void c4iw_qp_rem_ref(struct ib_qp *qp)
+{
+        PDBG("%s ib_qp %p\n", __func__, qp);
+        if (atomic_dec_and_test(&(to_c4iw_qp(qp)->refcnt)))
+                wake_up(&(to_c4iw_qp(qp)->wait));
+}
+
+int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
+                   struct ib_send_wr **bad_wr)
+{
+        int err = 0;
+        u8 len16 = 0;
+        enum fw_wr_opcodes fw_opcode = 0;
+        enum fw_ri_wr_flags fw_flags;
+        struct c4iw_qp *qhp;
+        union t4_wr *wqe;
+        u32 num_wrs;
+        struct t4_swsqe *swsqe;
+        unsigned long flag;
+        u16 idx = 0;
+
+        qhp = to_c4iw_qp(ibqp);
+        spin_lock_irqsave(&qhp->lock, flag);
+        if (t4_wq_in_error(&qhp->wq)) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -EINVAL;
+        }
+        num_wrs = t4_sq_avail(&qhp->wq);
+        if (num_wrs == 0) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -ENOMEM;
+        }
+        while (wr) {
+                if (num_wrs == 0) {
+                        err = -ENOMEM;
+                        *bad_wr = wr;
+                        break;
+                }
+                wqe = &qhp->wq.sq.queue[qhp->wq.sq.pidx];
+                fw_flags = 0;
+                if (wr->send_flags & IB_SEND_SOLICITED)
+                        fw_flags |= FW_RI_SOLICITED_EVENT_FLAG;
+                if (wr->send_flags & IB_SEND_SIGNALED)
+                        fw_flags |= FW_RI_COMPLETION_FLAG;
+                swsqe = &qhp->wq.sq.sw_sq[qhp->wq.sq.pidx];
+                switch (wr->opcode) {
+                case IB_WR_SEND_WITH_INV:
+                case IB_WR_SEND:
+                        if (wr->send_flags & IB_SEND_FENCE)
+                                fw_flags |= FW_RI_READ_FENCE_FLAG;
+                        fw_opcode = FW_RI_SEND_WR;
+                        if (wr->opcode == IB_WR_SEND)
+                                swsqe->opcode = FW_RI_SEND;
+                        else
+                                swsqe->opcode = FW_RI_SEND_WITH_INV;
+                        err = build_rdma_send(wqe, wr, &len16);
+                        break;
+                case IB_WR_RDMA_WRITE:
+                        fw_opcode = FW_RI_RDMA_WRITE_WR;
+                        swsqe->opcode = FW_RI_RDMA_WRITE;
+                        err = build_rdma_write(wqe, wr, &len16);
+                        break;
+                case IB_WR_RDMA_READ:
+                        fw_opcode = FW_RI_RDMA_READ_WR;
+                        swsqe->opcode = FW_RI_READ_REQ;
+                        fw_flags = 0;
+                        err = build_rdma_read(wqe, wr, &len16);
+                        if (err)
+                                break;
+                        swsqe->read_len = wr->sg_list[0].length;
+                        if (!qhp->wq.sq.oldest_read)
+                                qhp->wq.sq.oldest_read = swsqe;
+                        break;
+                case IB_WR_FAST_REG_MR:
+                        fw_opcode = FW_RI_FR_NSMR_WR;
+                        swsqe->opcode = FW_RI_FAST_REGISTER;
+                        err = build_fastreg(wqe, wr, &len16);
+                        break;
+                case IB_WR_LOCAL_INV:
+                        fw_opcode = FW_RI_INV_LSTAG_WR;
+                        swsqe->opcode = FW_RI_LOCAL_INV;
+                        err = build_inv_stag(wqe, wr, &len16);
+                        break;
+                default:
+                        PDBG("%s post of type=%d TBD!\n", __func__,
+                             wr->opcode);
+                        err = -EINVAL;
+                }
+                if (err) {
+                        *bad_wr = wr;
+                        break;
+                }
+                swsqe->idx = qhp->wq.sq.pidx;
+                swsqe->complete = 0;
+                swsqe->signaled = (wr->send_flags & IB_SEND_SIGNALED);
+                swsqe->wr_id = wr->wr_id;
+
+                init_wr_hdr(wqe, qhp->wq.sq.pidx, fw_opcode, fw_flags, len16);
+
+                PDBG("%s cookie 0x%llx pidx 0x%x opcode 0x%x read_len %u\n",
+                     __func__, (unsigned long long)wr->wr_id, qhp->wq.sq.pidx,
+                     swsqe->opcode, swsqe->read_len);
+                wr = wr->next;
+                num_wrs--;
+                t4_sq_produce(&qhp->wq);
+                idx++;
+        }
+        if (t4_wq_db_enabled(&qhp->wq))
+                t4_ring_sq_db(&qhp->wq, idx);
+        spin_unlock_irqrestore(&qhp->lock, flag);
+        return err;
+}
+
+int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
+                      struct ib_recv_wr **bad_wr)
+{
+        int err = 0;
+        struct c4iw_qp *qhp;
+        union t4_recv_wr *wqe;
+        u32 num_wrs;
+        u8 len16 = 0;
+        unsigned long flag;
+        u16 idx = 0;
+
+        qhp = to_c4iw_qp(ibqp);
+        spin_lock_irqsave(&qhp->lock, flag);
+        if (t4_wq_in_error(&qhp->wq)) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -EINVAL;
+        }
+        num_wrs = t4_rq_avail(&qhp->wq);
+        if (num_wrs == 0) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -ENOMEM;
+        }
+        while (wr) {
+                if (wr->num_sge > T4_MAX_RECV_SGE) {
+                        err = -EINVAL;
+                        *bad_wr = wr;
+                        break;
+                }
+                wqe = &qhp->wq.rq.queue[qhp->wq.rq.pidx];
+                if (num_wrs)
+                        err = build_rdma_recv(qhp, wqe, wr, &len16);
+                else
+                        err = -ENOMEM;
+                if (err) {
+                        *bad_wr = wr;
+                        break;
+                }
+
+                qhp->wq.rq.sw_rq[qhp->wq.rq.pidx].wr_id = wr->wr_id;
+
+                wqe->recv.opcode = FW_RI_RECV_WR;
+                wqe->recv.r1 = 0;
+                wqe->recv.wrid = qhp->wq.rq.pidx;
+                wqe->recv.r2[0] = 0;
+                wqe->recv.r2[1] = 0;
+                wqe->recv.r2[2] = 0;
+                wqe->recv.len16 = len16;
+                if (len16 < 5)
+                        wqe->flits[8] = 0;
+
+                PDBG("%s cookie 0x%llx pidx %u\n", __func__,
+                     (unsigned long long) wr->wr_id, qhp->wq.rq.pidx);
+                t4_rq_produce(&qhp->wq);
+                wr = wr->next;
+                num_wrs--;
+                idx++;
+        }
+        if (t4_wq_db_enabled(&qhp->wq))
+                t4_ring_rq_db(&qhp->wq, idx);
+        spin_unlock_irqrestore(&qhp->lock, flag);
+        return err;
+}
+
+int c4iw_bind_mw(struct ib_qp *qp, struct ib_mw *mw, struct ib_mw_bind *mw_bind)
+{
+        return -ENOSYS;
+}
+
+static inline void build_term_codes(struct t4_cqe *err_cqe, u8 *layer_type,
+                                    u8 *ecode)
+{
+        int status;
+        int tagged;
+        int opcode;
+        int rqtype;
+        int send_inv;
+
+        if (!err_cqe) {
+                *layer_type = LAYER_RDMAP|DDP_LOCAL_CATA;
+                *ecode = 0;
+                return;
+        }
+
+        status = CQE_STATUS(err_cqe);
+        opcode = CQE_OPCODE(err_cqe);
+        rqtype = RQ_TYPE(err_cqe);
+        send_inv = (opcode == FW_RI_SEND_WITH_INV) ||
+                   (opcode == FW_RI_SEND_WITH_SE_INV);
+        tagged = (opcode == FW_RI_RDMA_WRITE) ||
+                 (rqtype && (opcode == FW_RI_READ_RESP));
+
+        switch (status) {
+        case T4_ERR_STAG:
+                if (send_inv) {
+                        *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                        *ecode = RDMAP_CANT_INV_STAG;
+                } else {
+                        *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                        *ecode = RDMAP_INV_STAG;
+                }
+                break;
+        case T4_ERR_PDID:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                if ((opcode == FW_RI_SEND_WITH_INV) ||
+                    (opcode == FW_RI_SEND_WITH_SE_INV))
+                        *ecode = RDMAP_CANT_INV_STAG;
+                else
+                        *ecode = RDMAP_STAG_NOT_ASSOC;
+                break;
+        case T4_ERR_QPID:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                *ecode = RDMAP_STAG_NOT_ASSOC;
+                break;
+        case T4_ERR_ACCESS:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                *ecode = RDMAP_ACC_VIOL;
+                break;
+        case T4_ERR_WRAP:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                *ecode = RDMAP_TO_WRAP;
+                break;
+        case T4_ERR_BOUND:
+                if (tagged) {
+                        *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                        *ecode = DDPT_BASE_BOUNDS;
+                } else {
+                        *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                        *ecode = RDMAP_BASE_BOUNDS;
+                }
+                break;
+        case T4_ERR_INVALIDATE_SHARED_MR:
+        case T4_ERR_INVALIDATE_MR_WITH_MW_BOUND:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                *ecode = RDMAP_CANT_INV_STAG;
+                break;
+        case T4_ERR_ECC:
+        case T4_ERR_ECC_PSTAG:
+        case T4_ERR_INTERNAL_ERR:
+                *layer_type = LAYER_RDMAP|RDMAP_LOCAL_CATA;
+                *ecode = 0;
+                break;
+        case T4_ERR_OUT_OF_RQE:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_MSN_NOBUF;
+                break;
+        case T4_ERR_PBL_ADDR_BOUND:
+                *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                *ecode = DDPT_BASE_BOUNDS;
+                break;
+        case T4_ERR_CRC:
+                *layer_type = LAYER_MPA|DDP_LLP;
+                *ecode = MPA_CRC_ERR;
+                break;
+        case T4_ERR_MARKER:
+                *layer_type = LAYER_MPA|DDP_LLP;
+                *ecode = MPA_MARKER_ERR;
+                break;
+        case T4_ERR_PDU_LEN_ERR:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_MSG_TOOBIG;
+                break;
+        case T4_ERR_DDP_VERSION:
+                if (tagged) {
+                        *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                        *ecode = DDPT_INV_VERS;
+                } else {
+                        *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                        *ecode = DDPU_INV_VERS;
+                }
+                break;
+        case T4_ERR_RDMA_VERSION:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                *ecode = RDMAP_INV_VERS;
+                break;
+        case T4_ERR_OPCODE:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                *ecode = RDMAP_INV_OPCODE;
+                break;
+        case T4_ERR_DDP_QUEUE_NUM:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_QN;
+                break;
+        case T4_ERR_MSN:
+        case T4_ERR_MSN_GAP:
+        case T4_ERR_MSN_RANGE:
+        case T4_ERR_IRD_OVERFLOW:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_MSN_RANGE;
+                break;
+        case T4_ERR_TBIT:
+                *layer_type = LAYER_DDP|DDP_LOCAL_CATA;
+                *ecode = 0;
+                break;
+        case T4_ERR_MO:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_MO;
+                break;
+        default:
+                *layer_type = LAYER_RDMAP|DDP_LOCAL_CATA;
+                *ecode = 0;
+                break;
+        }
+}
+
+int c4iw_post_zb_read(struct c4iw_qp *qhp)
+{
+        union t4_wr *wqe;
+        struct sk_buff *skb;
+        u8 len16;
+
+        PDBG("%s enter\n", __func__);
+        skb = alloc_skb(40, GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR "%s cannot send zb_read!!\n", __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, qhp->ep->txq_idx);
+
+        wqe = (union t4_wr *)skb_put(skb, sizeof wqe->read);
+        memset(wqe, 0, sizeof wqe->read);
+        wqe->read.r2 = cpu_to_be64(0);
+        wqe->read.stag_sink = cpu_to_be32(1);
+        wqe->read.to_sink_hi = cpu_to_be32(0);
+        wqe->read.to_sink_lo = cpu_to_be32(1);
+        wqe->read.stag_src = cpu_to_be32(1);
+        wqe->read.plen = cpu_to_be32(0);
+        wqe->read.to_src_hi = cpu_to_be32(0);
+        wqe->read.to_src_lo = cpu_to_be32(1);
+        len16 = DIV_ROUND_UP(sizeof wqe->read, 16);
+        init_wr_hdr(wqe, 0, FW_RI_RDMA_READ_WR, FW_RI_COMPLETION_FLAG, len16);
+
+        return c4iw_ofld_send(&qhp->rhp->rdev, skb);
+}
+
+static void post_terminate(struct c4iw_qp *qhp, struct t4_cqe *err_cqe,
+                           gfp_t gfp)
+{
+        struct fw_ri_wr *wqe;
+        struct sk_buff *skb;
+        struct terminate_message *term;
+
+        PDBG("%s qhp %p qid 0x%x tid %u\n", __func__, qhp, qhp->wq.sq.qid,
+             qhp->ep->hwtid);
+
+        skb = alloc_skb(sizeof *wqe, gfp);
+        if (!skb)
+                return;
+        set_wr_txq(skb, CPL_PRIORITY_DATA, qhp->ep->txq_idx);
+
+        wqe = (struct fw_ri_wr *)__skb_put(skb, sizeof(*wqe));
+        memset(wqe, 0, sizeof *wqe);
+        wqe->op_compl = cpu_to_be32(FW_WR_OP(FW_RI_INIT_WR));
+        wqe->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(qhp->ep->hwtid) |
+                FW_WR_LEN16(DIV_ROUND_UP(sizeof *wqe, 16)));
+
+        wqe->u.terminate.type = FW_RI_TYPE_TERMINATE;
+        wqe->u.terminate.immdlen = cpu_to_be32(sizeof *term);
+        term = (struct terminate_message *)wqe->u.terminate.termmsg;
+        build_term_codes(err_cqe, &term->layer_etype, &term->ecode);
+        c4iw_ofld_send(&qhp->rhp->rdev, skb);
+}
+
+/*
+ * Assumes qhp lock is held.
+ */
+static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
+                       struct c4iw_cq *schp, unsigned long *flag)
+{
+        int count;
+        int flushed;
+
+        PDBG("%s qhp %p rchp %p schp %p\n", __func__, qhp, rchp, schp);
+        /* take a ref on the qhp since we must release the lock */
+        atomic_inc(&qhp->refcnt);
+        spin_unlock_irqrestore(&qhp->lock, *flag);
+
+        /* locking heirarchy: cq lock first, then qp lock. */
+        spin_lock_irqsave(&rchp->lock, *flag);
+        spin_lock(&qhp->lock);
+        c4iw_flush_hw_cq(&rchp->cq);
+        c4iw_count_rcqes(&rchp->cq, &qhp->wq, &count);
+        flushed = c4iw_flush_rq(&qhp->wq, &rchp->cq, count);
+        spin_unlock(&qhp->lock);
+        spin_unlock_irqrestore(&rchp->lock, *flag);
+        if (flushed)
+                (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
+
+        /* locking heirarchy: cq lock first, then qp lock. */
+        spin_lock_irqsave(&schp->lock, *flag);
+        spin_lock(&qhp->lock);
+        c4iw_flush_hw_cq(&schp->cq);
+        c4iw_count_scqes(&schp->cq, &qhp->wq, &count);
+        flushed = c4iw_flush_sq(&qhp->wq, &schp->cq, count);
+        spin_unlock(&qhp->lock);
+        spin_unlock_irqrestore(&schp->lock, *flag);
+        if (flushed)
+                (*schp->ibcq.comp_handler)(&schp->ibcq, schp->ibcq.cq_context);
+
+        /* deref */
+        if (atomic_dec_and_test(&qhp->refcnt))
+                wake_up(&qhp->wait);
+
+        spin_lock_irqsave(&qhp->lock, *flag);
+}
+
+static void flush_qp(struct c4iw_qp *qhp, unsigned long *flag)
+{
+        struct c4iw_cq *rchp, *schp;
+
+        rchp = get_chp(qhp->rhp, qhp->attr.rcq);
+        schp = get_chp(qhp->rhp, qhp->attr.scq);
+
+        if (qhp->ibqp.uobject) {
+                t4_set_wq_in_error(&qhp->wq);
+                t4_set_cq_in_error(&rchp->cq);
+                if (schp != rchp)
+                        t4_set_cq_in_error(&schp->cq);
+                return;
+        }
+        __flush_qp(qhp, rchp, schp, flag);
+}
+
+static int rdma_fini(struct c4iw_dev *rhp, struct c4iw_qp *qhp)
+{
+        struct fw_ri_wr *wqe;
+        int ret;
+        struct c4iw_wr_wait wr_wait;
+        struct sk_buff *skb;
+
+        PDBG("%s qhp %p qid 0x%x tid %u\n", __func__, qhp, qhp->wq.sq.qid,
+             qhp->ep->hwtid);
+
+        skb = alloc_skb(sizeof *wqe, GFP_KERNEL | __GFP_NOFAIL);
+        if (!skb)
+                return -ENOMEM;
+        set_wr_txq(skb, CPL_PRIORITY_DATA, qhp->ep->txq_idx);
+
+        wqe = (struct fw_ri_wr *)__skb_put(skb, sizeof(*wqe));
+        memset(wqe, 0, sizeof *wqe);
+        wqe->op_compl = cpu_to_be32(
+                FW_WR_OP(FW_RI_INIT_WR) |
+                FW_WR_COMPL(1));
+        wqe->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(qhp->ep->hwtid) |
+                FW_WR_LEN16(DIV_ROUND_UP(sizeof *wqe, 16)));
+        wqe->cookie = (u64)&wr_wait;
+
+        wqe->u.fini.type = FW_RI_TYPE_FINI;
+        c4iw_init_wr_wait(&wr_wait);
+        ret = c4iw_ofld_send(&rhp->rdev, skb);
+        if (ret)
+                goto out;
+
+        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+        if (!wr_wait.done) {
+                printk(KERN_ERR MOD "Device %s not responding!\n",
+                       pci_name(rhp->rdev.lldi.pdev));
+                rhp->rdev.flags = T4_FATAL_ERROR;
+                ret = -EIO;
+        } else {
+                ret = wr_wait.ret;
+                if (ret)
+                        printk(KERN_WARNING MOD
+                               "%s: Abnormal close qpid %d ret %u\n",
+                               pci_name(rhp->rdev.lldi.pdev), qhp->wq.sq.qid,
+                               ret);
+        }
+out:
+        PDBG("%s ret %d\n", __func__, ret);
+        return ret;
+}
+
+static void build_rtr_msg(u8 p2p_type, struct fw_ri_init *init)
+{
+        memset(&init->u, 0, sizeof init->u);
+        switch (p2p_type) {
+        case FW_RI_INIT_P2PTYPE_RDMA_WRITE:
+                init->u.write.opcode = FW_RI_RDMA_WRITE_WR;
+                init->u.write.stag_sink = cpu_to_be32(1);
+                init->u.write.to_sink = cpu_to_be64(1);
+                init->u.write.u.immd_src[0].op = FW_RI_DATA_IMMD;
+                init->u.write.len16 = DIV_ROUND_UP(sizeof init->u.write +
+                                                   sizeof(struct fw_ri_immd),
+                                                   16);
+                break;
+        case FW_RI_INIT_P2PTYPE_READ_REQ:
+                init->u.write.opcode = FW_RI_RDMA_READ_WR;
+                init->u.read.stag_src = cpu_to_be32(1);
+                init->u.read.to_src_lo = cpu_to_be32(1);
+                init->u.read.stag_sink = cpu_to_be32(1);
+                init->u.read.to_sink_lo = cpu_to_be32(1);
+                init->u.read.len16 = DIV_ROUND_UP(sizeof init->u.read, 16);
+                break;
+        }
+}
+
+static int rdma_init(struct c4iw_dev *rhp, struct c4iw_qp *qhp)
+{
+        struct fw_ri_wr *wqe;
+        int ret;
+        struct c4iw_wr_wait wr_wait;
+        struct sk_buff *skb;
+
+        PDBG("%s qhp %p qid 0x%x tid %u\n", __func__, qhp, qhp->wq.sq.qid,
+             qhp->ep->hwtid);
+
+        skb = alloc_skb(sizeof *wqe, GFP_KERNEL | __GFP_NOFAIL);
+        if (!skb)
+                return -ENOMEM;
+        set_wr_txq(skb, CPL_PRIORITY_DATA, qhp->ep->txq_idx);
+
+        wqe = (struct fw_ri_wr *)__skb_put(skb, sizeof(*wqe));
+        memset(wqe, 0, sizeof *wqe);
+        wqe->op_compl = cpu_to_be32(
+                FW_WR_OP(FW_RI_INIT_WR) |
+                FW_WR_COMPL(1));
+        wqe->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(qhp->ep->hwtid) |
+                FW_WR_LEN16(DIV_ROUND_UP(sizeof *wqe, 16)));
+
+        wqe->cookie = (u64)&wr_wait;
+
+        wqe->u.init.type = FW_RI_TYPE_INIT;
+        wqe->u.init.mpareqbit_p2ptype =
+                V_FW_RI_WR_MPAREQBIT(qhp->attr.mpa_attr.initiator) |
+                V_FW_RI_WR_P2PTYPE(qhp->attr.mpa_attr.p2p_type);
+        wqe->u.init.mpa_attrs = FW_RI_MPA_IETF_ENABLE;
+        if (qhp->attr.mpa_attr.recv_marker_enabled)
+                wqe->u.init.mpa_attrs |= FW_RI_MPA_RX_MARKER_ENABLE;
+        if (qhp->attr.mpa_attr.xmit_marker_enabled)
+                wqe->u.init.mpa_attrs |= FW_RI_MPA_TX_MARKER_ENABLE;
+        if (qhp->attr.mpa_attr.crc_enabled)
+                wqe->u.init.mpa_attrs |= FW_RI_MPA_CRC_ENABLE;
+
+        wqe->u.init.qp_caps = FW_RI_QP_RDMA_READ_ENABLE |
+                            FW_RI_QP_RDMA_WRITE_ENABLE |
+                            FW_RI_QP_BIND_ENABLE;
+        if (!qhp->ibqp.uobject)
+                wqe->u.init.qp_caps |= FW_RI_QP_FAST_REGISTER_ENABLE |
+                                     FW_RI_QP_STAG0_ENABLE;
+        wqe->u.init.nrqe = cpu_to_be16(t4_rqes_posted(&qhp->wq));
+        wqe->u.init.pdid = cpu_to_be32(qhp->attr.pd);
+        wqe->u.init.qpid = cpu_to_be32(qhp->wq.sq.qid);
+        wqe->u.init.sq_eqid = cpu_to_be32(qhp->wq.sq.qid);
+        wqe->u.init.rq_eqid = cpu_to_be32(qhp->wq.rq.qid);
+        wqe->u.init.scqid = cpu_to_be32(qhp->attr.scq);
+        wqe->u.init.rcqid = cpu_to_be32(qhp->attr.rcq);
+        wqe->u.init.ord_max = cpu_to_be32(qhp->attr.max_ord);
+        wqe->u.init.ird_max = cpu_to_be32(qhp->attr.max_ird);
+        wqe->u.init.iss = cpu_to_be32(qhp->ep->snd_seq);
+        wqe->u.init.irs = cpu_to_be32(qhp->ep->rcv_seq);
+        wqe->u.init.hwrqsize = cpu_to_be32(qhp->wq.rq.rqt_size);
+        wqe->u.init.hwrqaddr = cpu_to_be32(qhp->wq.rq.rqt_hwaddr -
+                                         rhp->rdev.lldi.vr->rq.start);
+        if (qhp->attr.mpa_attr.initiator)
+                build_rtr_msg(qhp->attr.mpa_attr.p2p_type, &wqe->u.init);
+
+        c4iw_init_wr_wait(&wr_wait);
+        ret = c4iw_ofld_send(&rhp->rdev, skb);
+        if (ret)
+                goto out;
+
+        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+        if (!wr_wait.done) {
+                printk(KERN_ERR MOD "Device %s not responding!\n",
+                       pci_name(rhp->rdev.lldi.pdev));
+                rhp->rdev.flags = T4_FATAL_ERROR;
+                ret = -EIO;
+        } else
+                ret = wr_wait.ret;
+out:
+        PDBG("%s ret %d\n", __func__, ret);
+        return ret;
+}
+
+int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
+                   enum c4iw_qp_attr_mask mask,
+                   struct c4iw_qp_attributes *attrs,
+                   int internal)
+{
+        int ret = 0;
+        struct c4iw_qp_attributes newattr = qhp->attr;
+        unsigned long flag;
+        int disconnect = 0;
+        int terminate = 0;
+        int abort = 0;
+        int free = 0;
+        struct c4iw_ep *ep = NULL;
+
+        PDBG("%s qhp %p sqid 0x%x rqid 0x%x ep %p state %d -> %d\n", __func__,
+             qhp, qhp->wq.sq.qid, qhp->wq.rq.qid, qhp->ep, qhp->attr.state,
+             (mask & C4IW_QP_ATTR_NEXT_STATE) ? attrs->next_state : -1);
+
+        spin_lock_irqsave(&qhp->lock, flag);
+
+        /* Process attr changes if in IDLE */
+        if (mask & C4IW_QP_ATTR_VALID_MODIFY) {
+                if (qhp->attr.state != C4IW_QP_STATE_IDLE) {
+                        ret = -EIO;
+                        goto out;
+                }
+                if (mask & C4IW_QP_ATTR_ENABLE_RDMA_READ)
+                        newattr.enable_rdma_read = attrs->enable_rdma_read;
+                if (mask & C4IW_QP_ATTR_ENABLE_RDMA_WRITE)
+                        newattr.enable_rdma_write = attrs->enable_rdma_write;
+                if (mask & C4IW_QP_ATTR_ENABLE_RDMA_BIND)
+                        newattr.enable_bind = attrs->enable_bind;
+                if (mask & C4IW_QP_ATTR_MAX_ORD) {
+                        if (attrs->max_ord > c4iw_max_read_depth) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        newattr.max_ord = attrs->max_ord;
+                }
+                if (mask & C4IW_QP_ATTR_MAX_IRD) {
+                        if (attrs->max_ird > c4iw_max_read_depth) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        newattr.max_ird = attrs->max_ird;
+                }
+                qhp->attr = newattr;
+        }
+
+        if (!(mask & C4IW_QP_ATTR_NEXT_STATE))
+                goto out;
+        if (qhp->attr.state == attrs->next_state)
+                goto out;
+
+        switch (qhp->attr.state) {
+        case C4IW_QP_STATE_IDLE:
+                switch (attrs->next_state) {
+                case C4IW_QP_STATE_RTS:
+                        if (!(mask & C4IW_QP_ATTR_LLP_STREAM_HANDLE)) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        if (!(mask & C4IW_QP_ATTR_MPA_ATTR)) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        qhp->attr.mpa_attr = attrs->mpa_attr;
+                        qhp->attr.llp_stream_handle = attrs->llp_stream_handle;
+                        qhp->ep = qhp->attr.llp_stream_handle;
+                        qhp->attr.state = C4IW_QP_STATE_RTS;
+
+                        /*
+                         * Ref the endpoint here and deref when we
+                         * disassociate the endpoint from the QP.  This
+                         * happens in CLOSING->IDLE transition or *->ERROR
+                         * transition.
+                         */
+                        c4iw_get_ep(&qhp->ep->com);
+                        spin_unlock_irqrestore(&qhp->lock, flag);
+                        ret = rdma_init(rhp, qhp);
+                        spin_lock_irqsave(&qhp->lock, flag);
+                        if (ret)
+                                goto err;
+                        break;
+                case C4IW_QP_STATE_ERROR:
+                        qhp->attr.state = C4IW_QP_STATE_ERROR;
+                        flush_qp(qhp, &flag);
+                        break;
+                default:
+                        ret = -EINVAL;
+                        goto out;
+                }
+                break;
+        case C4IW_QP_STATE_RTS:
+                switch (attrs->next_state) {
+                case C4IW_QP_STATE_CLOSING:
+                        BUG_ON(atomic_read(&qhp->ep->com.kref.refcount) < 2);
+                        qhp->attr.state = C4IW_QP_STATE_CLOSING;
+                        if (!internal) {
+                                abort = 0;
+                                disconnect = 1;
+                                ep = qhp->ep;
+                                c4iw_get_ep(&ep->com);
+                        }
+                        spin_unlock_irqrestore(&qhp->lock, flag);
+                        ret = rdma_fini(rhp, qhp);
+                        spin_lock_irqsave(&qhp->lock, flag);
+                        if (ret) {
+                                ep = qhp->ep;
+                                c4iw_get_ep(&ep->com);
+                                disconnect = abort = 1;
+                                goto err;
+                        }
+                        break;
+                case C4IW_QP_STATE_TERMINATE:
+                        qhp->attr.state = C4IW_QP_STATE_TERMINATE;
+                        if (qhp->ibqp.uobject)
+                                t4_set_wq_in_error(&qhp->wq);
+                        ep = qhp->ep;
+                        c4iw_get_ep(&ep->com);
+                        terminate = 1;
+                        disconnect = 1;
+                        break;
+                case C4IW_QP_STATE_ERROR:
+                        qhp->attr.state = C4IW_QP_STATE_ERROR;
+                        if (!internal) {
+                                abort = 1;
+                                disconnect = 1;
+                                ep = qhp->ep;
+                                c4iw_get_ep(&ep->com);
+                        }
+                        goto err;
+                        break;
+                default:
+                        ret = -EINVAL;
+                        goto out;
+                }
+                break;
+        case C4IW_QP_STATE_CLOSING:
+                if (!internal) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                switch (attrs->next_state) {
+                case C4IW_QP_STATE_IDLE:
+                        flush_qp(qhp, &flag);
+                        qhp->attr.state = C4IW_QP_STATE_IDLE;
+                        qhp->attr.llp_stream_handle = NULL;
+                        c4iw_put_ep(&qhp->ep->com);
+                        qhp->ep = NULL;
+                        wake_up(&qhp->wait);
+                        break;
+                case C4IW_QP_STATE_ERROR:
+                        goto err;
+                default:
+                        ret = -EINVAL;
+                        goto err;
+                }
+                break;
+        case C4IW_QP_STATE_ERROR:
+                if (attrs->next_state != C4IW_QP_STATE_IDLE) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                if (!t4_sq_empty(&qhp->wq) || !t4_rq_empty(&qhp->wq)) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                qhp->attr.state = C4IW_QP_STATE_IDLE;
+                break;
+        case C4IW_QP_STATE_TERMINATE:
+                if (!internal) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                goto err;
+                break;
+        default:
+                printk(KERN_ERR "%s in a bad state %d\n",
+                       __func__, qhp->attr.state);
+                ret = -EINVAL;
+                goto err;
+                break;
+        }
+        goto out;
+err:
+        PDBG("%s disassociating ep %p qpid 0x%x\n", __func__, qhp->ep,
+             qhp->wq.sq.qid);
+
+        /* disassociate the LLP connection */
+        qhp->attr.llp_stream_handle = NULL;
+        ep = qhp->ep;
+        qhp->ep = NULL;
+        qhp->attr.state = C4IW_QP_STATE_ERROR;
+        free = 1;
+        wake_up(&qhp->wait);
+        BUG_ON(!ep);
+        flush_qp(qhp, &flag);
+out:
+        spin_unlock_irqrestore(&qhp->lock, flag);
+
+        if (terminate)
+                post_terminate(qhp, NULL, internal ? GFP_ATOMIC : GFP_KERNEL);
+
+        /*
+         * If disconnect is 1, then we need to initiate a disconnect
+         * on the EP.  This can be a normal close (RTS->CLOSING) or
+         * an abnormal close (RTS/CLOSING->ERROR).
+         */
+        if (disconnect) {
+                c4iw_ep_disconnect(ep, abort, internal ? GFP_ATOMIC :
+                                                         GFP_KERNEL);
+                c4iw_put_ep(&ep->com);
+        }
+
+        /*
+         * If free is 1, then we've disassociated the EP from the QP
+         * and we need to dereference the EP.
+         */
+        if (free)
+                c4iw_put_ep(&ep->com);
+
+        PDBG("%s exit state %d\n", __func__, qhp->attr.state);
+        return ret;
+}
+
+int c4iw_destroy_qp(struct ib_qp *ib_qp)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_qp *qhp;
+        struct c4iw_qp_attributes attrs;
+        struct c4iw_ucontext *ucontext;
+
+        qhp = to_c4iw_qp(ib_qp);
+        rhp = qhp->rhp;
+
+        attrs.next_state = C4IW_QP_STATE_ERROR;
+        c4iw_modify_qp(rhp, qhp, C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+        wait_event(qhp->wait, !qhp->ep);
+
+        remove_handle(rhp, &rhp->qpidr, qhp->wq.sq.qid);
+        remove_handle(rhp, &rhp->qpidr, qhp->wq.rq.qid);
+        atomic_dec(&qhp->refcnt);
+        wait_event(qhp->wait, !atomic_read(&qhp->refcnt));
+
+        ucontext = ib_qp->uobject ?
+                   to_c4iw_ucontext(ib_qp->uobject->context) : NULL;
+        destroy_qp(&rhp->rdev, &qhp->wq,
+                   ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+
+        PDBG("%s ib_qp %p qpid 0x%0x\n", __func__, ib_qp, qhp->wq.sq.qid);
+        kfree(qhp);
+        return 0;
+}
+
+struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
+                             struct ib_udata *udata)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_qp *qhp;
+        struct c4iw_pd *php;
+        struct c4iw_cq *schp;
+        struct c4iw_cq *rchp;
+        struct c4iw_create_qp_resp uresp;
+        int sqsize, rqsize;
+        struct c4iw_ucontext *ucontext;
+        int ret;
+        struct c4iw_mm_entry *mm1, *mm2, *mm3, *mm4;
+
+        PDBG("%s ib_pd %p\n", __func__, pd);
+
+        if (attrs->qp_type != IB_QPT_RC)
+                return ERR_PTR(-EINVAL);
+
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+        schp = get_chp(rhp, ((struct c4iw_cq *)attrs->send_cq)->cq.cqid);
+        rchp = get_chp(rhp, ((struct c4iw_cq *)attrs->recv_cq)->cq.cqid);
+        if (!schp || !rchp)
+                return ERR_PTR(-EINVAL);
+
+        if (attrs->cap.max_inline_data > T4_MAX_SEND_INLINE)
+                return ERR_PTR(-EINVAL);
+
+        rqsize = roundup(attrs->cap.max_recv_wr + 1, 16);
+        if (rqsize > T4_MAX_RQ_SIZE)
+                return ERR_PTR(-E2BIG);
+
+        sqsize = roundup(attrs->cap.max_send_wr + 1, 16);
+        if (sqsize > T4_MAX_SQ_SIZE)
+                return ERR_PTR(-E2BIG);
+
+        ucontext = pd->uobject ? to_c4iw_ucontext(pd->uobject->context) : NULL;
+
+
+        qhp = kzalloc(sizeof(*qhp), GFP_KERNEL);
+        if (!qhp)
+                return ERR_PTR(-ENOMEM);
+        qhp->wq.sq.size = sqsize;
+        qhp->wq.sq.memsize = (sqsize + 1) * sizeof *qhp->wq.sq.queue;
+        qhp->wq.rq.size = rqsize;
+        qhp->wq.rq.memsize = (rqsize + 1) * sizeof *qhp->wq.rq.queue;
+
+        if (ucontext) {
+                qhp->wq.sq.memsize = roundup(qhp->wq.sq.memsize, PAGE_SIZE);
+                qhp->wq.rq.memsize = roundup(qhp->wq.rq.memsize, PAGE_SIZE);
+        }
+
+        PDBG("%s sqsize %u sqmemsize %zu rqsize %u rqmemsize %zu\n",
+             __func__, sqsize, qhp->wq.sq.memsize, rqsize, qhp->wq.rq.memsize);
+
+        ret = create_qp(&rhp->rdev, &qhp->wq, &schp->cq, &rchp->cq,
+                        ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+        if (ret)
+                goto err1;
+
+        attrs->cap.max_recv_wr = rqsize - 1;
+        attrs->cap.max_send_wr = sqsize - 1;
+        attrs->cap.max_inline_data = T4_MAX_SEND_INLINE;
+
+        qhp->rhp = rhp;
+        qhp->attr.pd = php->pdid;
+        qhp->attr.scq = ((struct c4iw_cq *) attrs->send_cq)->cq.cqid;
+        qhp->attr.rcq = ((struct c4iw_cq *) attrs->recv_cq)->cq.cqid;
+        qhp->attr.sq_num_entries = attrs->cap.max_send_wr;
+        qhp->attr.rq_num_entries = attrs->cap.max_recv_wr;
+        qhp->attr.sq_max_sges = attrs->cap.max_send_sge;
+        qhp->attr.sq_max_sges_rdma_write = attrs->cap.max_send_sge;
+        qhp->attr.rq_max_sges = attrs->cap.max_recv_sge;
+        qhp->attr.state = C4IW_QP_STATE_IDLE;
+        qhp->attr.next_state = C4IW_QP_STATE_IDLE;
+        qhp->attr.enable_rdma_read = 1;
+        qhp->attr.enable_rdma_write = 1;
+        qhp->attr.enable_bind = 1;
+        qhp->attr.max_ord = 1;
+        qhp->attr.max_ird = 1;
+        spin_lock_init(&qhp->lock);
+        init_waitqueue_head(&qhp->wait);
+        atomic_set(&qhp->refcnt, 1);
+
+        ret = insert_handle(rhp, &rhp->qpidr, qhp, qhp->wq.sq.qid);
+        if (ret)
+                goto err2;
+
+        ret = insert_handle(rhp, &rhp->qpidr, qhp, qhp->wq.rq.qid);
+        if (ret)
+                goto err3;
+
+        if (udata) {
+                mm1 = kmalloc(sizeof *mm1, GFP_KERNEL);
+                if (!mm1) {
+                        ret = -ENOMEM;
+                        goto err4;
+                }
+                mm2 = kmalloc(sizeof *mm2, GFP_KERNEL);
+                if (!mm2) {
+                        ret = -ENOMEM;
+                        goto err5;
+                }
+                mm3 = kmalloc(sizeof *mm3, GFP_KERNEL);
+                if (!mm3) {
+                        ret = -ENOMEM;
+                        goto err6;
+                }
+                mm4 = kmalloc(sizeof *mm4, GFP_KERNEL);
+                if (!mm4) {
+                        ret = -ENOMEM;
+                        goto err7;
+                }
+
+                uresp.qid_mask = rhp->rdev.qpmask;
+                uresp.sqid = qhp->wq.sq.qid;
+                uresp.sq_size = qhp->wq.sq.size;
+                uresp.sq_memsize = qhp->wq.sq.memsize;
+                uresp.rqid = qhp->wq.rq.qid;
+                uresp.rq_size = qhp->wq.rq.size;
+                uresp.rq_memsize = qhp->wq.rq.memsize;
+                spin_lock(&ucontext->mmap_lock);
+                uresp.sq_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                uresp.rq_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                uresp.sq_db_gts_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                uresp.rq_db_gts_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                spin_unlock(&ucontext->mmap_lock);
+                ret = ib_copy_to_udata(udata, &uresp, sizeof uresp);
+                if (ret)
+                        goto err8;
+                mm1->key = uresp.sq_key;
+                mm1->addr = virt_to_phys(qhp->wq.sq.queue);
+                mm1->len = PAGE_ALIGN(qhp->wq.sq.memsize);
+                insert_mmap(ucontext, mm1);
+                mm2->key = uresp.rq_key;
+                mm2->addr = virt_to_phys(qhp->wq.rq.queue);
+                mm2->len = PAGE_ALIGN(qhp->wq.rq.memsize);
+                insert_mmap(ucontext, mm2);
+                mm3->key = uresp.sq_db_gts_key;
+                mm3->addr = qhp->wq.sq.udb;
+                mm3->len = PAGE_SIZE;
+                insert_mmap(ucontext, mm3);
+                mm4->key = uresp.rq_db_gts_key;
+                mm4->addr = qhp->wq.rq.udb;
+                mm4->len = PAGE_SIZE;
+                insert_mmap(ucontext, mm4);
+        }
+        qhp->ibqp.qp_num = qhp->wq.sq.qid;
+        init_timer(&(qhp->timer));
+        PDBG("%s qhp %p sq_num_entries %d, rq_num_entries %d qpid 0x%0x\n",
+             __func__, qhp, qhp->attr.sq_num_entries, qhp->attr.rq_num_entries,
+             qhp->wq.sq.qid);
+        return &qhp->ibqp;
+err8:
+        kfree(mm4);
+err7:
+        kfree(mm3);
+err6:
+        kfree(mm2);
+err5:
+        kfree(mm1);
+err4:
+        remove_handle(rhp, &rhp->qpidr, qhp->wq.rq.qid);
+err3:
+        remove_handle(rhp, &rhp->qpidr, qhp->wq.sq.qid);
+err2:
+        destroy_qp(&rhp->rdev, &qhp->wq,
+                   ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+err1:
+        kfree(qhp);
+        return ERR_PTR(ret);
+}
+
+int c4iw_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                      int attr_mask, struct ib_udata *udata)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_qp *qhp;
+        enum c4iw_qp_attr_mask mask = 0;
+        struct c4iw_qp_attributes attrs;
+
+        PDBG("%s ib_qp %p\n", __func__, ibqp);
+
+        /* iwarp does not support the RTR state */
+        if ((attr_mask & IB_QP_STATE) && (attr->qp_state == IB_QPS_RTR))
+                attr_mask &= ~IB_QP_STATE;
+
+        /* Make sure we still have something left to do */
+        if (!attr_mask)
+                return 0;
+
+        memset(&attrs, 0, sizeof attrs);
+        qhp = to_c4iw_qp(ibqp);
+        rhp = qhp->rhp;
+
+        attrs.next_state = c4iw_convert_state(attr->qp_state);
+        attrs.enable_rdma_read = (attr->qp_access_flags &
+                               IB_ACCESS_REMOTE_READ) ?  1 : 0;
+        attrs.enable_rdma_write = (attr->qp_access_flags &
+                                IB_ACCESS_REMOTE_WRITE) ? 1 : 0;
+        attrs.enable_bind = (attr->qp_access_flags & IB_ACCESS_MW_BIND) ? 1 : 0;
+
+
+        mask |= (attr_mask & IB_QP_STATE) ? C4IW_QP_ATTR_NEXT_STATE : 0;
+        mask |= (attr_mask & IB_QP_ACCESS_FLAGS) ?
+                        (C4IW_QP_ATTR_ENABLE_RDMA_READ |
+                         C4IW_QP_ATTR_ENABLE_RDMA_WRITE |
+                         C4IW_QP_ATTR_ENABLE_RDMA_BIND) : 0;
+
+        return c4iw_modify_qp(rhp, qhp, mask, &attrs, 0);
+}
+
+struct ib_qp *c4iw_get_qp(struct ib_device *dev, int qpn)
+{
+        PDBG("%s ib_dev %p qpn 0x%x\n", __func__, dev, qpn);
+        return (struct ib_qp *)get_qhp(to_c4iw_dev(dev), qpn);
+}
diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
new file mode 100644
index 000000000000..fb195d1d9015
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/resource.c
@@ -0,0 +1,417 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+/* Crude resource management */
+#include <linux/kernel.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+#include <linux/kfifo.h>
+#include <linux/spinlock.h>
+#include <linux/errno.h>
+#include <linux/genalloc.h>
+#include "iw_cxgb4.h"
+
+#define RANDOM_SIZE 16
+
+static int __c4iw_init_resource_fifo(struct kfifo *fifo,
+                                   spinlock_t *fifo_lock,
+                                   u32 nr, u32 skip_low,
+                                   u32 skip_high,
+                                   int random)
+{
+        u32 i, j, entry = 0, idx;
+        u32 random_bytes;
+        u32 rarray[16];
+        spin_lock_init(fifo_lock);
+
+        if (kfifo_alloc(fifo, nr * sizeof(u32), GFP_KERNEL))
+                return -ENOMEM;
+
+        for (i = 0; i < skip_low + skip_high; i++)
+                kfifo_in(fifo, (unsigned char *) &entry, sizeof(u32));
+        if (random) {
+                j = 0;
+                random_bytes = random32();
+                for (i = 0; i < RANDOM_SIZE; i++)
+                        rarray[i] = i + skip_low;
+                for (i = skip_low + RANDOM_SIZE; i < nr - skip_high; i++) {
+                        if (j >= RANDOM_SIZE) {
+                                j = 0;
+                                random_bytes = random32();
+                        }
+                        idx = (random_bytes >> (j * 2)) & 0xF;
+                        kfifo_in(fifo,
+                                (unsigned char *) &rarray[idx],
+                                sizeof(u32));
+                        rarray[idx] = i;
+                        j++;
+                }
+                for (i = 0; i < RANDOM_SIZE; i++)
+                        kfifo_in(fifo,
+                                (unsigned char *) &rarray[i],
+                                sizeof(u32));
+        } else
+                for (i = skip_low; i < nr - skip_high; i++)
+                        kfifo_in(fifo, (unsigned char *) &i, sizeof(u32));
+
+        for (i = 0; i < skip_low + skip_high; i++)
+                if (kfifo_out_locked(fifo, (unsigned char *) &entry,
+                                     sizeof(u32), fifo_lock))
+                        break;
+        return 0;
+}
+
+static int c4iw_init_resource_fifo(struct kfifo *fifo, spinlock_t * fifo_lock,
+                                   u32 nr, u32 skip_low, u32 skip_high)
+{
+        return __c4iw_init_resource_fifo(fifo, fifo_lock, nr, skip_low,
+                                          skip_high, 0);
+}
+
+static int c4iw_init_resource_fifo_random(struct kfifo *fifo,
+                                   spinlock_t *fifo_lock,
+                                   u32 nr, u32 skip_low, u32 skip_high)
+{
+        return __c4iw_init_resource_fifo(fifo, fifo_lock, nr, skip_low,
+                                          skip_high, 1);
+}
+
+static int c4iw_init_qid_fifo(struct c4iw_rdev *rdev)
+{
+        u32 i;
+
+        spin_lock_init(&rdev->resource.qid_fifo_lock);
+
+        if (kfifo_alloc(&rdev->resource.qid_fifo, T4_MAX_QIDS * sizeof(u32),
+                        GFP_KERNEL))
+                return -ENOMEM;
+
+        for (i = T4_QID_BASE; i < T4_QID_BASE + T4_MAX_QIDS; i++)
+                if (!(i & rdev->qpmask))
+                        kfifo_in(&rdev->resource.qid_fifo,
+                                    (unsigned char *) &i, sizeof(u32));
+        return 0;
+}
+
+/* nr_* must be power of 2 */
+int c4iw_init_resource(struct c4iw_rdev *rdev, u32 nr_tpt, u32 nr_pdid)
+{
+        int err = 0;
+        err = c4iw_init_resource_fifo_random(&rdev->resource.tpt_fifo,
+                                             &rdev->resource.tpt_fifo_lock,
+                                             nr_tpt, 1, 0);
+        if (err)
+                goto tpt_err;
+        err = c4iw_init_qid_fifo(rdev);
+        if (err)
+                goto qid_err;
+        err = c4iw_init_resource_fifo(&rdev->resource.pdid_fifo,
+                                      &rdev->resource.pdid_fifo_lock,
+                                      nr_pdid, 1, 0);
+        if (err)
+                goto pdid_err;
+        return 0;
+pdid_err:
+        kfifo_free(&rdev->resource.qid_fifo);
+qid_err:
+        kfifo_free(&rdev->resource.tpt_fifo);
+tpt_err:
+        return -ENOMEM;
+}
+
+/*
+ * returns 0 if no resource available
+ */
+u32 c4iw_get_resource(struct kfifo *fifo, spinlock_t *lock)
+{
+        u32 entry;
+        if (kfifo_out_locked(fifo, (unsigned char *) &entry, sizeof(u32), lock))
+                return entry;
+        else
+                return 0;
+}
+
+void c4iw_put_resource(struct kfifo *fifo, u32 entry, spinlock_t *lock)
+{
+        PDBG("%s entry 0x%x\n", __func__, entry);
+        kfifo_in_locked(fifo, (unsigned char *) &entry, sizeof(u32), lock);
+}
+
+u32 c4iw_get_cqid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx)
+{
+        struct c4iw_qid_list *entry;
+        u32 qid;
+        int i;
+
+        mutex_lock(&uctx->lock);
+        if (!list_empty(&uctx->cqids)) {
+                entry = list_entry(uctx->cqids.next, struct c4iw_qid_list,
+                                   entry);
+                list_del(&entry->entry);
+                qid = entry->qid;
+                kfree(entry);
+        } else {
+                qid = c4iw_get_resource(&rdev->resource.qid_fifo,
+                                        &rdev->resource.qid_fifo_lock);
+                if (!qid)
+                        goto out;
+                for (i = qid+1; i & rdev->qpmask; i++) {
+                        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                        if (!entry)
+                                goto out;
+                        entry->qid = i;
+                        list_add_tail(&entry->entry, &uctx->cqids);
+                }
+
+                /*
+                 * now put the same ids on the qp list since they all
+                 * map to the same db/gts page.
+                 */
+                entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                if (!entry)
+                        goto out;
+                entry->qid = qid;
+                list_add_tail(&entry->entry, &uctx->qpids);
+                for (i = qid+1; i & rdev->qpmask; i++) {
+                        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                        if (!entry)
+                                goto out;
+                        entry->qid = i;
+                        list_add_tail(&entry->entry, &uctx->qpids);
+                }
+        }
+out:
+        mutex_unlock(&uctx->lock);
+        PDBG("%s qid 0x%x\n", __func__, qid);
+        return qid;
+}
+
+void c4iw_put_cqid(struct c4iw_rdev *rdev, u32 qid,
+                   struct c4iw_dev_ucontext *uctx)
+{
+        struct c4iw_qid_list *entry;
+
+        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+        if (!entry)
+                return;
+        PDBG("%s qid 0x%x\n", __func__, qid);
+        entry->qid = qid;
+        mutex_lock(&uctx->lock);
+        list_add_tail(&entry->entry, &uctx->cqids);
+        mutex_unlock(&uctx->lock);
+}
+
+u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx)
+{
+        struct c4iw_qid_list *entry;
+        u32 qid;
+        int i;
+
+        mutex_lock(&uctx->lock);
+        if (!list_empty(&uctx->qpids)) {
+                entry = list_entry(uctx->qpids.next, struct c4iw_qid_list,
+                                   entry);
+                list_del(&entry->entry);
+                qid = entry->qid;
+                kfree(entry);
+        } else {
+                qid = c4iw_get_resource(&rdev->resource.qid_fifo,
+                                        &rdev->resource.qid_fifo_lock);
+                if (!qid)
+                        goto out;
+                for (i = qid+1; i & rdev->qpmask; i++) {
+                        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                        if (!entry)
+                                goto out;
+                        entry->qid = i;
+                        list_add_tail(&entry->entry, &uctx->qpids);
+                }
+
+                /*
+                 * now put the same ids on the cq list since they all
+                 * map to the same db/gts page.
+                 */
+                entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                if (!entry)
+                        goto out;
+                entry->qid = qid;
+                list_add_tail(&entry->entry, &uctx->cqids);
+                for (i = qid; i & rdev->qpmask; i++) {
+                        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                        if (!entry)
+                                goto out;
+                        entry->qid = i;
+                        list_add_tail(&entry->entry, &uctx->cqids);
+                }
+        }
+out:
+        mutex_unlock(&uctx->lock);
+        PDBG("%s qid 0x%x\n", __func__, qid);
+        return qid;
+}
+
+void c4iw_put_qpid(struct c4iw_rdev *rdev, u32 qid,
+                   struct c4iw_dev_ucontext *uctx)
+{
+        struct c4iw_qid_list *entry;
+
+        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+        if (!entry)
+                return;
+        PDBG("%s qid 0x%x\n", __func__, qid);
+        entry->qid = qid;
+        mutex_lock(&uctx->lock);
+        list_add_tail(&entry->entry, &uctx->qpids);
+        mutex_unlock(&uctx->lock);
+}
+
+void c4iw_destroy_resource(struct c4iw_resource *rscp)
+{
+        kfifo_free(&rscp->tpt_fifo);
+        kfifo_free(&rscp->qid_fifo);
+        kfifo_free(&rscp->pdid_fifo);
+}
+
+/*
+ * PBL Memory Manager.  Uses Linux generic allocator.
+ */
+
+#define MIN_PBL_SHIFT 8                 /* 256B == min PBL size (32 entries) */
+
+u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size)
+{
+        unsigned long addr = gen_pool_alloc(rdev->pbl_pool, size);
+        PDBG("%s addr 0x%x size %d\n", __func__, (u32)addr, size);
+        return (u32)addr;
+}
+
+void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
+{
+        PDBG("%s addr 0x%x size %d\n", __func__, addr, size);
+        gen_pool_free(rdev->pbl_pool, (unsigned long)addr, size);
+}
+
+int c4iw_pblpool_create(struct c4iw_rdev *rdev)
+{
+        unsigned pbl_start, pbl_chunk, pbl_top;
+
+        rdev->pbl_pool = gen_pool_create(MIN_PBL_SHIFT, -1);
+        if (!rdev->pbl_pool)
+                return -ENOMEM;
+
+        pbl_start = rdev->lldi.vr->pbl.start;
+        pbl_chunk = rdev->lldi.vr->pbl.size;
+        pbl_top = pbl_start + pbl_chunk;
+
+        while (pbl_start < pbl_top) {
+                pbl_chunk = min(pbl_top - pbl_start + 1, pbl_chunk);
+                if (gen_pool_add(rdev->pbl_pool, pbl_start, pbl_chunk, -1)) {
+                        PDBG("%s failed to add PBL chunk (%x/%x)\n",
+                             __func__, pbl_start, pbl_chunk);
+                        if (pbl_chunk <= 1024 << MIN_PBL_SHIFT) {
+                                printk(KERN_WARNING MOD
+                                       "Failed to add all PBL chunks (%x/%x)\n",
+                                       pbl_start,
+                                       pbl_top - pbl_start);
+                                return 0;
+                        }
+                        pbl_chunk >>= 1;
+                } else {
+                        PDBG("%s added PBL chunk (%x/%x)\n",
+                             __func__, pbl_start, pbl_chunk);
+                        pbl_start += pbl_chunk;
+                }
+        }
+
+        return 0;
+}
+
+void c4iw_pblpool_destroy(struct c4iw_rdev *rdev)
+{
+        gen_pool_destroy(rdev->pbl_pool);
+}
+
+/*
+ * RQT Memory Manager.  Uses Linux generic allocator.
+ */
+
+#define MIN_RQT_SHIFT 10        /* 1KB == min RQT size (16 entries) */
+
+u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size)
+{
+        unsigned long addr = gen_pool_alloc(rdev->rqt_pool, size << 6);
+        PDBG("%s addr 0x%x size %d\n", __func__, (u32)addr, size << 6);
+        return (u32)addr;
+}
+
+void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
+{
+        PDBG("%s addr 0x%x size %d\n", __func__, addr, size << 6);
+        gen_pool_free(rdev->rqt_pool, (unsigned long)addr, size << 6);
+}
+
+int c4iw_rqtpool_create(struct c4iw_rdev *rdev)
+{
+        unsigned rqt_start, rqt_chunk, rqt_top;
+
+        rdev->rqt_pool = gen_pool_create(MIN_RQT_SHIFT, -1);
+        if (!rdev->rqt_pool)
+                return -ENOMEM;
+
+        rqt_start = rdev->lldi.vr->rq.start;
+        rqt_chunk = rdev->lldi.vr->rq.size;
+        rqt_top = rqt_start + rqt_chunk;
+
+        while (rqt_start < rqt_top) {
+                rqt_chunk = min(rqt_top - rqt_start + 1, rqt_chunk);
+                if (gen_pool_add(rdev->rqt_pool, rqt_start, rqt_chunk, -1)) {
+                        PDBG("%s failed to add RQT chunk (%x/%x)\n",
+                             __func__, rqt_start, rqt_chunk);
+                        if (rqt_chunk <= 1024 << MIN_RQT_SHIFT) {
+                                printk(KERN_WARNING MOD
+                                       "Failed to add all RQT chunks (%x/%x)\n",
+                                       rqt_start, rqt_top - rqt_start);
+                                return 0;
+                        }
+                        rqt_chunk >>= 1;
+                } else {
+                        PDBG("%s added RQT chunk (%x/%x)\n",
+                             __func__, rqt_start, rqt_chunk);
+                        rqt_start += rqt_chunk;
+                }
+        }
+        return 0;
+}
+
+void c4iw_rqtpool_destroy(struct c4iw_rdev *rdev)
+{
+        gen_pool_destroy(rdev->rqt_pool);
+}
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
new file mode 100644
index 000000000000..d0e8af352408
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -0,0 +1,550 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __T4_H__
+#define __T4_H__
+
+#include "t4_hw.h"
+#include "t4_regs.h"
+#include "t4_msg.h"
+#include "t4fw_ri_api.h"
+
+#define T4_QID_BASE 1024
+#define T4_MAX_QIDS 256
+#define T4_MAX_NUM_QP (1<<16)
+#define T4_MAX_NUM_CQ (1<<15)
+#define T4_MAX_NUM_PD (1<<15)
+#define T4_MAX_PBL_SIZE 256
+#define T4_MAX_RQ_SIZE 1024
+#define T4_MAX_SQ_SIZE 1024
+#define T4_MAX_QP_DEPTH (T4_MAX_RQ_SIZE-1)
+#define T4_MAX_CQ_DEPTH 8192
+#define T4_MAX_NUM_STAG (1<<15)
+#define T4_MAX_MR_SIZE (~0ULL - 1)
+#define T4_PAGESIZE_MASK 0xffff000  /* 4KB-128MB */
+#define T4_STAG_UNSET 0xffffffff
+#define T4_FW_MAJ 0
+#define T4_EQ_STATUS_ENTRIES (L1_CACHE_BYTES > 64 ? 2 : 1)
+
+struct t4_status_page {
+        __be32 rsvd1;   /* flit 0 - hw owns */
+        __be16 rsvd2;
+        __be16 qid;
+        __be16 cidx;
+        __be16 pidx;
+        u8 qp_err;      /* flit 1 - sw owns */
+        u8 db_off;
+};
+
+#define T4_EQ_SIZE 64
+
+#define T4_SQ_NUM_SLOTS 4
+#define T4_SQ_NUM_BYTES (T4_EQ_SIZE * T4_SQ_NUM_SLOTS)
+#define T4_MAX_SEND_SGE ((T4_SQ_NUM_BYTES - sizeof(struct fw_ri_send_wr) - \
+                        sizeof(struct fw_ri_isgl)) / sizeof(struct fw_ri_sge))
+#define T4_MAX_SEND_INLINE ((T4_SQ_NUM_BYTES - sizeof(struct fw_ri_send_wr) - \
+                        sizeof(struct fw_ri_immd)))
+#define T4_MAX_WRITE_INLINE ((T4_SQ_NUM_BYTES - \
+                        sizeof(struct fw_ri_rdma_write_wr) - \
+                        sizeof(struct fw_ri_immd)))
+#define T4_MAX_WRITE_SGE ((T4_SQ_NUM_BYTES - \
+                        sizeof(struct fw_ri_rdma_write_wr) - \
+                        sizeof(struct fw_ri_isgl)) / sizeof(struct fw_ri_sge))
+#define T4_MAX_FR_IMMD ((T4_SQ_NUM_BYTES - sizeof(struct fw_ri_fr_nsmr_wr) - \
+                        sizeof(struct fw_ri_immd)))
+#define T4_MAX_FR_DEPTH 255
+
+#define T4_RQ_NUM_SLOTS 2
+#define T4_RQ_NUM_BYTES (T4_EQ_SIZE * T4_RQ_NUM_SLOTS)
+#define T4_MAX_RECV_SGE ((T4_RQ_NUM_BYTES - sizeof(struct fw_ri_recv_wr) - \
+                        sizeof(struct fw_ri_isgl)) / sizeof(struct fw_ri_sge))
+
+union t4_wr {
+        struct fw_ri_res_wr res;
+        struct fw_ri_wr ri;
+        struct fw_ri_rdma_write_wr write;
+        struct fw_ri_send_wr send;
+        struct fw_ri_rdma_read_wr read;
+        struct fw_ri_bind_mw_wr bind;
+        struct fw_ri_fr_nsmr_wr fr;
+        struct fw_ri_inv_lstag_wr inv;
+        struct t4_status_page status;
+        __be64 flits[T4_EQ_SIZE / sizeof(__be64) * T4_SQ_NUM_SLOTS];
+};
+
+union t4_recv_wr {
+        struct fw_ri_recv_wr recv;
+        struct t4_status_page status;
+        __be64 flits[T4_EQ_SIZE / sizeof(__be64) * T4_RQ_NUM_SLOTS];
+};
+
+static inline void init_wr_hdr(union t4_wr *wqe, u16 wrid,
+                               enum fw_wr_opcodes opcode, u8 flags, u8 len16)
+{
+        int slots_used;
+
+        wqe->send.opcode = (u8)opcode;
+        wqe->send.flags = flags;
+        wqe->send.wrid = wrid;
+        wqe->send.r1[0] = 0;
+        wqe->send.r1[1] = 0;
+        wqe->send.r1[2] = 0;
+        wqe->send.len16 = len16;
+
+        slots_used = DIV_ROUND_UP(len16*16, T4_EQ_SIZE);
+        while (slots_used < T4_SQ_NUM_SLOTS) {
+                wqe->flits[slots_used * T4_EQ_SIZE / sizeof(__be64)] = 0;
+                slots_used++;
+        }
+}
+
+/* CQE/AE status codes */
+#define T4_ERR_SUCCESS                     0x0
+#define T4_ERR_STAG                        0x1  /* STAG invalid: either the */
+                                                /* STAG is offlimt, being 0, */
+                                                /* or STAG_key mismatch */
+#define T4_ERR_PDID                        0x2  /* PDID mismatch */
+#define T4_ERR_QPID                        0x3  /* QPID mismatch */
+#define T4_ERR_ACCESS                      0x4  /* Invalid access right */
+#define T4_ERR_WRAP                        0x5  /* Wrap error */
+#define T4_ERR_BOUND                       0x6  /* base and bounds voilation */
+#define T4_ERR_INVALIDATE_SHARED_MR        0x7  /* attempt to invalidate a  */
+                                                /* shared memory region */
+#define T4_ERR_INVALIDATE_MR_WITH_MW_BOUND 0x8  /* attempt to invalidate a  */
+                                                /* shared memory region */
+#define T4_ERR_ECC                         0x9  /* ECC error detected */
+#define T4_ERR_ECC_PSTAG                   0xA  /* ECC error detected when  */
+                                                /* reading PSTAG for a MW  */
+                                                /* Invalidate */
+#define T4_ERR_PBL_ADDR_BOUND              0xB  /* pbl addr out of bounds:  */
+                                                /* software error */
+#define T4_ERR_SWFLUSH                     0xC  /* SW FLUSHED */
+#define T4_ERR_CRC                         0x10 /* CRC error */
+#define T4_ERR_MARKER                      0x11 /* Marker error */
+#define T4_ERR_PDU_LEN_ERR                 0x12 /* invalid PDU length */
+#define T4_ERR_OUT_OF_RQE                  0x13 /* out of RQE */
+#define T4_ERR_DDP_VERSION                 0x14 /* wrong DDP version */
+#define T4_ERR_RDMA_VERSION                0x15 /* wrong RDMA version */
+#define T4_ERR_OPCODE                      0x16 /* invalid rdma opcode */
+#define T4_ERR_DDP_QUEUE_NUM               0x17 /* invalid ddp queue number */
+#define T4_ERR_MSN                         0x18 /* MSN error */
+#define T4_ERR_TBIT                        0x19 /* tag bit not set correctly */
+#define T4_ERR_MO                          0x1A /* MO not 0 for TERMINATE  */
+                                                /* or READ_REQ */
+#define T4_ERR_MSN_GAP                     0x1B
+#define T4_ERR_MSN_RANGE                   0x1C
+#define T4_ERR_IRD_OVERFLOW                0x1D
+#define T4_ERR_RQE_ADDR_BOUND              0x1E /* RQE addr out of bounds:  */
+                                                /* software error */
+#define T4_ERR_INTERNAL_ERR                0x1F /* internal error (opcode  */
+                                                /* mismatch) */
+/*
+ * CQE defs
+ */
+struct t4_cqe {
+        __be32 header;
+        __be32 len;
+        union {
+                struct {
+                        __be32 stag;
+                        __be32 msn;
+                } rcqe;
+                struct {
+                        u32 nada1;
+                        u16 nada2;
+                        u16 cidx;
+                } scqe;
+                struct {
+                        __be32 wrid_hi;
+                        __be32 wrid_low;
+                } gen;
+        } u;
+        __be64 reserved;
+        __be64 bits_type_ts;
+};
+
+/* macros for flit 0 of the cqe */
+
+#define S_CQE_QPID        12
+#define M_CQE_QPID        0xFFFFF
+#define G_CQE_QPID(x)     ((((x) >> S_CQE_QPID)) & M_CQE_QPID)
+#define V_CQE_QPID(x)     ((x)<<S_CQE_QPID)
+
+#define S_CQE_SWCQE       11
+#define M_CQE_SWCQE       0x1
+#define G_CQE_SWCQE(x)    ((((x) >> S_CQE_SWCQE)) & M_CQE_SWCQE)
+#define V_CQE_SWCQE(x)    ((x)<<S_CQE_SWCQE)
+
+#define S_CQE_STATUS      5
+#define M_CQE_STATUS      0x1F
+#define G_CQE_STATUS(x)   ((((x) >> S_CQE_STATUS)) & M_CQE_STATUS)
+#define V_CQE_STATUS(x)   ((x)<<S_CQE_STATUS)
+
+#define S_CQE_TYPE        4
+#define M_CQE_TYPE        0x1
+#define G_CQE_TYPE(x)     ((((x) >> S_CQE_TYPE)) & M_CQE_TYPE)
+#define V_CQE_TYPE(x)     ((x)<<S_CQE_TYPE)
+
+#define S_CQE_OPCODE      0
+#define M_CQE_OPCODE      0xF
+#define G_CQE_OPCODE(x)   ((((x) >> S_CQE_OPCODE)) & M_CQE_OPCODE)
+#define V_CQE_OPCODE(x)   ((x)<<S_CQE_OPCODE)
+
+#define SW_CQE(x)         (G_CQE_SWCQE(be32_to_cpu((x)->header)))
+#define CQE_QPID(x)       (G_CQE_QPID(be32_to_cpu((x)->header)))
+#define CQE_TYPE(x)       (G_CQE_TYPE(be32_to_cpu((x)->header)))
+#define SQ_TYPE(x)        (CQE_TYPE((x)))
+#define RQ_TYPE(x)        (!CQE_TYPE((x)))
+#define CQE_STATUS(x)     (G_CQE_STATUS(be32_to_cpu((x)->header)))
+#define CQE_OPCODE(x)     (G_CQE_OPCODE(be32_to_cpu((x)->header)))
+
+#define CQE_SEND_OPCODE(x)( \
+        (G_CQE_OPCODE(be32_to_cpu((x)->header)) == FW_RI_SEND) || \
+        (G_CQE_OPCODE(be32_to_cpu((x)->header)) == FW_RI_SEND_WITH_SE) || \
+        (G_CQE_OPCODE(be32_to_cpu((x)->header)) == FW_RI_SEND_WITH_INV) || \
+        (G_CQE_OPCODE(be32_to_cpu((x)->header)) == FW_RI_SEND_WITH_SE_INV))
+
+#define CQE_LEN(x)        (be32_to_cpu((x)->len))
+
+/* used for RQ completion processing */
+#define CQE_WRID_STAG(x)  (be32_to_cpu((x)->u.rcqe.stag))
+#define CQE_WRID_MSN(x)   (be32_to_cpu((x)->u.rcqe.msn))
+
+/* used for SQ completion processing */
+#define CQE_WRID_SQ_IDX(x)      ((x)->u.scqe.cidx)
+
+/* generic accessor macros */
+#define CQE_WRID_HI(x)          ((x)->u.gen.wrid_hi)
+#define CQE_WRID_LOW(x)         ((x)->u.gen.wrid_low)
+
+/* macros for flit 3 of the cqe */
+#define S_CQE_GENBIT    63
+#define M_CQE_GENBIT    0x1
+#define G_CQE_GENBIT(x) (((x) >> S_CQE_GENBIT) & M_CQE_GENBIT)
+#define V_CQE_GENBIT(x) ((x)<<S_CQE_GENBIT)
+
+#define S_CQE_OVFBIT    62
+#define M_CQE_OVFBIT    0x1
+#define G_CQE_OVFBIT(x) ((((x) >> S_CQE_OVFBIT)) & M_CQE_OVFBIT)
+
+#define S_CQE_IQTYPE    60
+#define M_CQE_IQTYPE    0x3
+#define G_CQE_IQTYPE(x) ((((x) >> S_CQE_IQTYPE)) & M_CQE_IQTYPE)
+
+#define M_CQE_TS        0x0fffffffffffffffULL
+#define G_CQE_TS(x)     ((x) & M_CQE_TS)
+
+#define CQE_OVFBIT(x)   ((unsigned)G_CQE_OVFBIT(be64_to_cpu((x)->bits_type_ts)))
+#define CQE_GENBIT(x)   ((unsigned)G_CQE_GENBIT(be64_to_cpu((x)->bits_type_ts)))
+#define CQE_TS(x)       (G_CQE_TS(be64_to_cpu((x)->bits_type_ts)))
+
+struct t4_swsqe {
+        u64                     wr_id;
+        struct t4_cqe           cqe;
+        int                     read_len;
+        int                     opcode;
+        int                     complete;
+        int                     signaled;
+        u16                     idx;
+};
+
+struct t4_sq {
+        union t4_wr *queue;
+        dma_addr_t dma_addr;
+        DECLARE_PCI_UNMAP_ADDR(mapping);
+        struct t4_swsqe *sw_sq;
+        struct t4_swsqe *oldest_read;
+        u64 udb;
+        size_t memsize;
+        u32 qid;
+        u16 in_use;
+        u16 size;
+        u16 cidx;
+        u16 pidx;
+};
+
+struct t4_swrqe {
+        u64 wr_id;
+};
+
+struct t4_rq {
+        union  t4_recv_wr *queue;
+        dma_addr_t dma_addr;
+        DECLARE_PCI_UNMAP_ADDR(mapping);
+        struct t4_swrqe *sw_rq;
+        u64 udb;
+        size_t memsize;
+        u32 qid;
+        u32 msn;
+        u32 rqt_hwaddr;
+        u16 rqt_size;
+        u16 in_use;
+        u16 size;
+        u16 cidx;
+        u16 pidx;
+};
+
+struct t4_wq {
+        struct t4_sq sq;
+        struct t4_rq rq;
+        void __iomem *db;
+        void __iomem *gts;
+        struct c4iw_rdev *rdev;
+};
+
+static inline int t4_rqes_posted(struct t4_wq *wq)
+{
+        return wq->rq.in_use;
+}
+
+static inline int t4_rq_empty(struct t4_wq *wq)
+{
+        return wq->rq.in_use == 0;
+}
+
+static inline int t4_rq_full(struct t4_wq *wq)
+{
+        return wq->rq.in_use == (wq->rq.size - 1);
+}
+
+static inline u32 t4_rq_avail(struct t4_wq *wq)
+{
+        return wq->rq.size - 1 - wq->rq.in_use;
+}
+
+static inline void t4_rq_produce(struct t4_wq *wq)
+{
+        wq->rq.in_use++;
+        if (++wq->rq.pidx == wq->rq.size)
+                wq->rq.pidx = 0;
+}
+
+static inline void t4_rq_consume(struct t4_wq *wq)
+{
+        wq->rq.in_use--;
+        wq->rq.msn++;
+        if (++wq->rq.cidx == wq->rq.size)
+                wq->rq.cidx = 0;
+}
+
+static inline int t4_sq_empty(struct t4_wq *wq)
+{
+        return wq->sq.in_use == 0;
+}
+
+static inline int t4_sq_full(struct t4_wq *wq)
+{
+        return wq->sq.in_use == (wq->sq.size - 1);
+}
+
+static inline u32 t4_sq_avail(struct t4_wq *wq)
+{
+        return wq->sq.size - 1 - wq->sq.in_use;
+}
+
+static inline void t4_sq_produce(struct t4_wq *wq)
+{
+        wq->sq.in_use++;
+        if (++wq->sq.pidx == wq->sq.size)
+                wq->sq.pidx = 0;
+}
+
+static inline void t4_sq_consume(struct t4_wq *wq)
+{
+        wq->sq.in_use--;
+        if (++wq->sq.cidx == wq->sq.size)
+                wq->sq.cidx = 0;
+}
+
+static inline void t4_ring_sq_db(struct t4_wq *wq, u16 inc)
+{
+        inc *= T4_SQ_NUM_SLOTS;
+        wmb();
+        writel(QID(wq->sq.qid) | PIDX(inc), wq->db);
+}
+
+static inline void t4_ring_rq_db(struct t4_wq *wq, u16 inc)
+{
+        inc *= T4_RQ_NUM_SLOTS;
+        wmb();
+        writel(QID(wq->rq.qid) | PIDX(inc), wq->db);
+}
+
+static inline int t4_wq_in_error(struct t4_wq *wq)
+{
+        return wq->sq.queue[wq->sq.size].status.qp_err;
+}
+
+static inline void t4_set_wq_in_error(struct t4_wq *wq)
+{
+        wq->sq.queue[wq->sq.size].status.qp_err = 1;
+        wq->rq.queue[wq->rq.size].status.qp_err = 1;
+}
+
+static inline void t4_disable_wq_db(struct t4_wq *wq)
+{
+        wq->sq.queue[wq->sq.size].status.db_off = 1;
+        wq->rq.queue[wq->rq.size].status.db_off = 1;
+}
+
+static inline void t4_enable_wq_db(struct t4_wq *wq)
+{
+        wq->sq.queue[wq->sq.size].status.db_off = 0;
+        wq->rq.queue[wq->rq.size].status.db_off = 0;
+}
+
+static inline int t4_wq_db_enabled(struct t4_wq *wq)
+{
+        return !wq->sq.queue[wq->sq.size].status.db_off;
+}
+
+struct t4_cq {
+        struct t4_cqe *queue;
+        dma_addr_t dma_addr;
+        DECLARE_PCI_UNMAP_ADDR(mapping);
+        struct t4_cqe *sw_queue;
+        void __iomem *gts;
+        struct c4iw_rdev *rdev;
+        u64 ugts;
+        size_t memsize;
+        u64 timestamp;
+        u32 cqid;
+        u16 size; /* including status page */
+        u16 cidx;
+        u16 sw_pidx;
+        u16 sw_cidx;
+        u16 sw_in_use;
+        u16 cidx_inc;
+        u8 gen;
+        u8 error;
+};
+
+static inline int t4_arm_cq(struct t4_cq *cq, int se)
+{
+        u32 val;
+        u16 inc;
+
+        do {
+                /*
+                 * inc must be less the both the max update value -and-
+                 * the size of the CQ.
+                 */
+                inc = cq->cidx_inc <= CIDXINC_MASK ? cq->cidx_inc :
+                                                     CIDXINC_MASK;
+                inc = inc <= (cq->size - 1) ? inc : (cq->size - 1);
+                if (inc == cq->cidx_inc)
+                        val = SEINTARM(se) | CIDXINC(inc) | TIMERREG(6) |
+                              INGRESSQID(cq->cqid);
+                else
+                        val = SEINTARM(0) | CIDXINC(inc) | TIMERREG(7) |
+                              INGRESSQID(cq->cqid);
+                cq->cidx_inc -= inc;
+                writel(val, cq->gts);
+        } while (cq->cidx_inc);
+        return 0;
+}
+
+static inline void t4_swcq_produce(struct t4_cq *cq)
+{
+        cq->sw_in_use++;
+        if (++cq->sw_pidx == cq->size)
+                cq->sw_pidx = 0;
+}
+
+static inline void t4_swcq_consume(struct t4_cq *cq)
+{
+        cq->sw_in_use--;
+        if (++cq->sw_cidx == cq->size)
+                cq->sw_cidx = 0;
+}
+
+static inline void t4_hwcq_consume(struct t4_cq *cq)
+{
+        cq->cidx_inc++;
+        if (++cq->cidx == cq->size) {
+                cq->cidx = 0;
+                cq->gen ^= 1;
+        }
+}
+
+static inline int t4_valid_cqe(struct t4_cq *cq, struct t4_cqe *cqe)
+{
+        return (CQE_GENBIT(cqe) == cq->gen);
+}
+
+static inline int t4_next_hw_cqe(struct t4_cq *cq, struct t4_cqe **cqe)
+{
+        int ret = 0;
+        u64 bits_type_ts = be64_to_cpu(cq->queue[cq->cidx].bits_type_ts);
+
+        if (G_CQE_GENBIT(bits_type_ts) == cq->gen) {
+                *cqe = &cq->queue[cq->cidx];
+                cq->timestamp = G_CQE_TS(bits_type_ts);
+        } else if (G_CQE_TS(bits_type_ts) > cq->timestamp)
+                ret = -EOVERFLOW;
+        else
+                ret = -ENODATA;
+        if (ret == -EOVERFLOW) {
+                printk(KERN_ERR MOD "cq overflow cqid %u\n", cq->cqid);
+                cq->error = 1;
+        }
+        return ret;
+}
+
+static inline struct t4_cqe *t4_next_sw_cqe(struct t4_cq *cq)
+{
+        if (cq->sw_in_use)
+                return &cq->sw_queue[cq->sw_cidx];
+        return NULL;
+}
+
+static inline int t4_next_cqe(struct t4_cq *cq, struct t4_cqe **cqe)
+{
+        int ret = 0;
+
+        if (cq->error)
+                ret = -ENODATA;
+        else if (cq->sw_in_use)
+                *cqe = &cq->sw_queue[cq->sw_cidx];
+        else
+                ret = t4_next_hw_cqe(cq, cqe);
+        return ret;
+}
+
+static inline int t4_cq_in_error(struct t4_cq *cq)
+{
+        return ((struct t4_status_page *)&cq->queue[cq->size])->qp_err;
+}
+
+static inline void t4_set_cq_in_error(struct t4_cq *cq)
+{
+        ((struct t4_status_page *)&cq->queue[cq->size])->qp_err = 1;
+}
+#endif
diff --git a/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
new file mode 100644
index 000000000000..fc706bd07fae
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
@@ -0,0 +1,829 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _T4FW_RI_API_H_
+#define _T4FW_RI_API_H_
+
+#include "t4fw_api.h"
+
+enum fw_ri_wr_opcode {
+        FW_RI_RDMA_WRITE                = 0x0,  /* IETF RDMAP v1.0 ... */
+        FW_RI_READ_REQ                  = 0x1,
+        FW_RI_READ_RESP                 = 0x2,
+        FW_RI_SEND                      = 0x3,
+        FW_RI_SEND_WITH_INV             = 0x4,
+        FW_RI_SEND_WITH_SE              = 0x5,
+        FW_RI_SEND_WITH_SE_INV          = 0x6,
+        FW_RI_TERMINATE                 = 0x7,
+        FW_RI_RDMA_INIT                 = 0x8,  /* CHELSIO RI specific ... */
+        FW_RI_BIND_MW                   = 0x9,
+        FW_RI_FAST_REGISTER             = 0xa,
+        FW_RI_LOCAL_INV                 = 0xb,
+        FW_RI_QP_MODIFY                 = 0xc,
+        FW_RI_BYPASS                    = 0xd,
+        FW_RI_RECEIVE                   = 0xe,
+
+        FW_RI_SGE_EC_CR_RETURN          = 0xf
+};
+
+enum fw_ri_wr_flags {
+        FW_RI_COMPLETION_FLAG           = 0x01,
+        FW_RI_NOTIFICATION_FLAG         = 0x02,
+        FW_RI_SOLICITED_EVENT_FLAG      = 0x04,
+        FW_RI_READ_FENCE_FLAG           = 0x08,
+        FW_RI_LOCAL_FENCE_FLAG          = 0x10,
+        FW_RI_RDMA_READ_INVALIDATE      = 0x20
+};
+
+enum fw_ri_mpa_attrs {
+        FW_RI_MPA_RX_MARKER_ENABLE      = 0x01,
+        FW_RI_MPA_TX_MARKER_ENABLE      = 0x02,
+        FW_RI_MPA_CRC_ENABLE            = 0x04,
+        FW_RI_MPA_IETF_ENABLE           = 0x08
+};
+
+enum fw_ri_qp_caps {
+        FW_RI_QP_RDMA_READ_ENABLE       = 0x01,
+        FW_RI_QP_RDMA_WRITE_ENABLE      = 0x02,
+        FW_RI_QP_BIND_ENABLE            = 0x04,
+        FW_RI_QP_FAST_REGISTER_ENABLE   = 0x08,
+        FW_RI_QP_STAG0_ENABLE           = 0x10
+};
+
+enum fw_ri_addr_type {
+        FW_RI_ZERO_BASED_TO             = 0x00,
+        FW_RI_VA_BASED_TO               = 0x01
+};
+
+enum fw_ri_mem_perms {
+        FW_RI_MEM_ACCESS_REM_WRITE      = 0x01,
+        FW_RI_MEM_ACCESS_REM_READ       = 0x02,
+        FW_RI_MEM_ACCESS_REM            = 0x03,
+        FW_RI_MEM_ACCESS_LOCAL_WRITE    = 0x04,
+        FW_RI_MEM_ACCESS_LOCAL_READ     = 0x08,
+        FW_RI_MEM_ACCESS_LOCAL          = 0x0C
+};
+
+enum fw_ri_stag_type {
+        FW_RI_STAG_NSMR                 = 0x00,
+        FW_RI_STAG_SMR                  = 0x01,
+        FW_RI_STAG_MW                   = 0x02,
+        FW_RI_STAG_MW_RELAXED           = 0x03
+};
+
+enum fw_ri_data_op {
+        FW_RI_DATA_IMMD                 = 0x81,
+        FW_RI_DATA_DSGL                 = 0x82,
+        FW_RI_DATA_ISGL                 = 0x83
+};
+
+enum fw_ri_sgl_depth {
+        FW_RI_SGL_DEPTH_MAX_SQ          = 16,
+        FW_RI_SGL_DEPTH_MAX_RQ          = 4
+};
+
+struct fw_ri_dsge_pair {
+        __be32  len[2];
+        __be64  addr[2];
+};
+
+struct fw_ri_dsgl {
+        __u8    op;
+        __u8    r1;
+        __be16  nsge;
+        __be32  len0;
+        __be64  addr0;
+#ifndef C99_NOT_SUPPORTED
+        struct fw_ri_dsge_pair sge[0];
+#endif
+};
+
+struct fw_ri_sge {
+        __be32 stag;
+        __be32 len;
+        __be64 to;
+};
+
+struct fw_ri_isgl {
+        __u8    op;
+        __u8    r1;
+        __be16  nsge;
+        __be32  r2;
+#ifndef C99_NOT_SUPPORTED
+        struct fw_ri_sge sge[0];
+#endif
+};
+
+struct fw_ri_immd {
+        __u8    op;
+        __u8    r1;
+        __be16  r2;
+        __be32  immdlen;
+#ifndef C99_NOT_SUPPORTED
+        __u8    data[0];
+#endif
+};
+
+struct fw_ri_tpte {
+        __be32 valid_to_pdid;
+        __be32 locread_to_qpid;
+        __be32 nosnoop_pbladdr;
+        __be32 len_lo;
+        __be32 va_hi;
+        __be32 va_lo_fbo;
+        __be32 dca_mwbcnt_pstag;
+        __be32 len_hi;
+};
+
+#define S_FW_RI_TPTE_VALID              31
+#define M_FW_RI_TPTE_VALID              0x1
+#define V_FW_RI_TPTE_VALID(x)           ((x) << S_FW_RI_TPTE_VALID)
+#define G_FW_RI_TPTE_VALID(x)           \
+    (((x) >> S_FW_RI_TPTE_VALID) & M_FW_RI_TPTE_VALID)
+#define F_FW_RI_TPTE_VALID              V_FW_RI_TPTE_VALID(1U)
+
+#define S_FW_RI_TPTE_STAGKEY            23
+#define M_FW_RI_TPTE_STAGKEY            0xff
+#define V_FW_RI_TPTE_STAGKEY(x)         ((x) << S_FW_RI_TPTE_STAGKEY)
+#define G_FW_RI_TPTE_STAGKEY(x)         \
+    (((x) >> S_FW_RI_TPTE_STAGKEY) & M_FW_RI_TPTE_STAGKEY)
+
+#define S_FW_RI_TPTE_STAGSTATE          22
+#define M_FW_RI_TPTE_STAGSTATE          0x1
+#define V_FW_RI_TPTE_STAGSTATE(x)       ((x) << S_FW_RI_TPTE_STAGSTATE)
+#define G_FW_RI_TPTE_STAGSTATE(x)       \
+    (((x) >> S_FW_RI_TPTE_STAGSTATE) & M_FW_RI_TPTE_STAGSTATE)
+#define F_FW_RI_TPTE_STAGSTATE          V_FW_RI_TPTE_STAGSTATE(1U)
+
+#define S_FW_RI_TPTE_STAGTYPE           20
+#define M_FW_RI_TPTE_STAGTYPE           0x3
+#define V_FW_RI_TPTE_STAGTYPE(x)        ((x) << S_FW_RI_TPTE_STAGTYPE)
+#define G_FW_RI_TPTE_STAGTYPE(x)        \
+    (((x) >> S_FW_RI_TPTE_STAGTYPE) & M_FW_RI_TPTE_STAGTYPE)
+
+#define S_FW_RI_TPTE_PDID               0
+#define M_FW_RI_TPTE_PDID               0xfffff
+#define V_FW_RI_TPTE_PDID(x)            ((x) << S_FW_RI_TPTE_PDID)
+#define G_FW_RI_TPTE_PDID(x)            \
+    (((x) >> S_FW_RI_TPTE_PDID) & M_FW_RI_TPTE_PDID)
+
+#define S_FW_RI_TPTE_PERM               28
+#define M_FW_RI_TPTE_PERM               0xf
+#define V_FW_RI_TPTE_PERM(x)            ((x) << S_FW_RI_TPTE_PERM)
+#define G_FW_RI_TPTE_PERM(x)            \
+    (((x) >> S_FW_RI_TPTE_PERM) & M_FW_RI_TPTE_PERM)
+
+#define S_FW_RI_TPTE_REMINVDIS          27
+#define M_FW_RI_TPTE_REMINVDIS          0x1
+#define V_FW_RI_TPTE_REMINVDIS(x)       ((x) << S_FW_RI_TPTE_REMINVDIS)
+#define G_FW_RI_TPTE_REMINVDIS(x)       \
+    (((x) >> S_FW_RI_TPTE_REMINVDIS) & M_FW_RI_TPTE_REMINVDIS)
+#define F_FW_RI_TPTE_REMINVDIS          V_FW_RI_TPTE_REMINVDIS(1U)
+
+#define S_FW_RI_TPTE_ADDRTYPE           26
+#define M_FW_RI_TPTE_ADDRTYPE           1
+#define V_FW_RI_TPTE_ADDRTYPE(x)        ((x) << S_FW_RI_TPTE_ADDRTYPE)
+#define G_FW_RI_TPTE_ADDRTYPE(x)        \
+    (((x) >> S_FW_RI_TPTE_ADDRTYPE) & M_FW_RI_TPTE_ADDRTYPE)
+#define F_FW_RI_TPTE_ADDRTYPE           V_FW_RI_TPTE_ADDRTYPE(1U)
+
+#define S_FW_RI_TPTE_MWBINDEN           25
+#define M_FW_RI_TPTE_MWBINDEN           0x1
+#define V_FW_RI_TPTE_MWBINDEN(x)        ((x) << S_FW_RI_TPTE_MWBINDEN)
+#define G_FW_RI_TPTE_MWBINDEN(x)        \
+    (((x) >> S_FW_RI_TPTE_MWBINDEN) & M_FW_RI_TPTE_MWBINDEN)
+#define F_FW_RI_TPTE_MWBINDEN           V_FW_RI_TPTE_MWBINDEN(1U)
+
+#define S_FW_RI_TPTE_PS                 20
+#define M_FW_RI_TPTE_PS                 0x1f
+#define V_FW_RI_TPTE_PS(x)              ((x) << S_FW_RI_TPTE_PS)
+#define G_FW_RI_TPTE_PS(x)              \
+    (((x) >> S_FW_RI_TPTE_PS) & M_FW_RI_TPTE_PS)
+
+#define S_FW_RI_TPTE_QPID               0
+#define M_FW_RI_TPTE_QPID               0xfffff
+#define V_FW_RI_TPTE_QPID(x)            ((x) << S_FW_RI_TPTE_QPID)
+#define G_FW_RI_TPTE_QPID(x)            \
+    (((x) >> S_FW_RI_TPTE_QPID) & M_FW_RI_TPTE_QPID)
+
+#define S_FW_RI_TPTE_NOSNOOP            30
+#define M_FW_RI_TPTE_NOSNOOP            0x1
+#define V_FW_RI_TPTE_NOSNOOP(x)         ((x) << S_FW_RI_TPTE_NOSNOOP)
+#define G_FW_RI_TPTE_NOSNOOP(x)         \
+    (((x) >> S_FW_RI_TPTE_NOSNOOP) & M_FW_RI_TPTE_NOSNOOP)
+#define F_FW_RI_TPTE_NOSNOOP            V_FW_RI_TPTE_NOSNOOP(1U)
+
+#define S_FW_RI_TPTE_PBLADDR            0
+#define M_FW_RI_TPTE_PBLADDR            0x1fffffff
+#define V_FW_RI_TPTE_PBLADDR(x)         ((x) << S_FW_RI_TPTE_PBLADDR)
+#define G_FW_RI_TPTE_PBLADDR(x)         \
+    (((x) >> S_FW_RI_TPTE_PBLADDR) & M_FW_RI_TPTE_PBLADDR)
+
+#define S_FW_RI_TPTE_DCA                24
+#define M_FW_RI_TPTE_DCA                0x1f
+#define V_FW_RI_TPTE_DCA(x)             ((x) << S_FW_RI_TPTE_DCA)
+#define G_FW_RI_TPTE_DCA(x)             \
+    (((x) >> S_FW_RI_TPTE_DCA) & M_FW_RI_TPTE_DCA)
+
+#define S_FW_RI_TPTE_MWBCNT_PSTAG       0
+#define M_FW_RI_TPTE_MWBCNT_PSTAG       0xffffff
+#define V_FW_RI_TPTE_MWBCNT_PSTAT(x)    \
+    ((x) << S_FW_RI_TPTE_MWBCNT_PSTAG)
+#define G_FW_RI_TPTE_MWBCNT_PSTAG(x)    \
+    (((x) >> S_FW_RI_TPTE_MWBCNT_PSTAG) & M_FW_RI_TPTE_MWBCNT_PSTAG)
+
+enum fw_ri_res_type {
+        FW_RI_RES_TYPE_SQ,
+        FW_RI_RES_TYPE_RQ,
+        FW_RI_RES_TYPE_CQ,
+};
+
+enum fw_ri_res_op {
+        FW_RI_RES_OP_WRITE,
+        FW_RI_RES_OP_RESET,
+};
+
+struct fw_ri_res {
+        union fw_ri_restype {
+                struct fw_ri_res_sqrq {
+                        __u8   restype;
+                        __u8   op;
+                        __be16 r3;
+                        __be32 eqid;
+                        __be32 r4[2];
+                        __be32 fetchszm_to_iqid;
+                        __be32 dcaen_to_eqsize;
+                        __be64 eqaddr;
+                } sqrq;
+                struct fw_ri_res_cq {
+                        __u8   restype;
+                        __u8   op;
+                        __be16 r3;
+                        __be32 iqid;
+                        __be32 r4[2];
+                        __be32 iqandst_to_iqandstindex;
+                        __be16 iqdroprss_to_iqesize;
+                        __be16 iqsize;
+                        __be64 iqaddr;
+                        __be32 iqns_iqro;
+                        __be32 r6_lo;
+                        __be64 r7;
+                } cq;
+        } u;
+};
+
+struct fw_ri_res_wr {
+        __be32 op_nres;
+        __be32 len16_pkd;
+        __u64  cookie;
+#ifndef C99_NOT_SUPPORTED
+        struct fw_ri_res res[0];
+#endif
+};
+
+#define S_FW_RI_RES_WR_NRES     0
+#define M_FW_RI_RES_WR_NRES     0xff
+#define V_FW_RI_RES_WR_NRES(x)  ((x) << S_FW_RI_RES_WR_NRES)
+#define G_FW_RI_RES_WR_NRES(x)  \
+    (((x) >> S_FW_RI_RES_WR_NRES) & M_FW_RI_RES_WR_NRES)
+
+#define S_FW_RI_RES_WR_FETCHSZM         26
+#define M_FW_RI_RES_WR_FETCHSZM         0x1
+#define V_FW_RI_RES_WR_FETCHSZM(x)      ((x) << S_FW_RI_RES_WR_FETCHSZM)
+#define G_FW_RI_RES_WR_FETCHSZM(x)      \
+    (((x) >> S_FW_RI_RES_WR_FETCHSZM) & M_FW_RI_RES_WR_FETCHSZM)
+#define F_FW_RI_RES_WR_FETCHSZM V_FW_RI_RES_WR_FETCHSZM(1U)
+
+#define S_FW_RI_RES_WR_STATUSPGNS       25
+#define M_FW_RI_RES_WR_STATUSPGNS       0x1
+#define V_FW_RI_RES_WR_STATUSPGNS(x)    ((x) << S_FW_RI_RES_WR_STATUSPGNS)
+#define G_FW_RI_RES_WR_STATUSPGNS(x)    \
+    (((x) >> S_FW_RI_RES_WR_STATUSPGNS) & M_FW_RI_RES_WR_STATUSPGNS)
+#define F_FW_RI_RES_WR_STATUSPGNS       V_FW_RI_RES_WR_STATUSPGNS(1U)
+
+#define S_FW_RI_RES_WR_STATUSPGRO       24
+#define M_FW_RI_RES_WR_STATUSPGRO       0x1
+#define V_FW_RI_RES_WR_STATUSPGRO(x)    ((x) << S_FW_RI_RES_WR_STATUSPGRO)
+#define G_FW_RI_RES_WR_STATUSPGRO(x)    \
+    (((x) >> S_FW_RI_RES_WR_STATUSPGRO) & M_FW_RI_RES_WR_STATUSPGRO)
+#define F_FW_RI_RES_WR_STATUSPGRO       V_FW_RI_RES_WR_STATUSPGRO(1U)
+
+#define S_FW_RI_RES_WR_FETCHNS          23
+#define M_FW_RI_RES_WR_FETCHNS          0x1
+#define V_FW_RI_RES_WR_FETCHNS(x)       ((x) << S_FW_RI_RES_WR_FETCHNS)
+#define G_FW_RI_RES_WR_FETCHNS(x)       \
+    (((x) >> S_FW_RI_RES_WR_FETCHNS) & M_FW_RI_RES_WR_FETCHNS)
+#define F_FW_RI_RES_WR_FETCHNS  V_FW_RI_RES_WR_FETCHNS(1U)
+
+#define S_FW_RI_RES_WR_FETCHRO          22
+#define M_FW_RI_RES_WR_FETCHRO          0x1
+#define V_FW_RI_RES_WR_FETCHRO(x)       ((x) << S_FW_RI_RES_WR_FETCHRO)
+#define G_FW_RI_RES_WR_FETCHRO(x)       \
+    (((x) >> S_FW_RI_RES_WR_FETCHRO) & M_FW_RI_RES_WR_FETCHRO)
+#define F_FW_RI_RES_WR_FETCHRO  V_FW_RI_RES_WR_FETCHRO(1U)
+
+#define S_FW_RI_RES_WR_HOSTFCMODE       20
+#define M_FW_RI_RES_WR_HOSTFCMODE       0x3
+#define V_FW_RI_RES_WR_HOSTFCMODE(x)    ((x) << S_FW_RI_RES_WR_HOSTFCMODE)
+#define G_FW_RI_RES_WR_HOSTFCMODE(x)    \
+    (((x) >> S_FW_RI_RES_WR_HOSTFCMODE) & M_FW_RI_RES_WR_HOSTFCMODE)
+
+#define S_FW_RI_RES_WR_CPRIO    19
+#define M_FW_RI_RES_WR_CPRIO    0x1
+#define V_FW_RI_RES_WR_CPRIO(x) ((x) << S_FW_RI_RES_WR_CPRIO)
+#define G_FW_RI_RES_WR_CPRIO(x) \
+    (((x) >> S_FW_RI_RES_WR_CPRIO) & M_FW_RI_RES_WR_CPRIO)
+#define F_FW_RI_RES_WR_CPRIO    V_FW_RI_RES_WR_CPRIO(1U)
+
+#define S_FW_RI_RES_WR_ONCHIP           18
+#define M_FW_RI_RES_WR_ONCHIP           0x1
+#define V_FW_RI_RES_WR_ONCHIP(x)        ((x) << S_FW_RI_RES_WR_ONCHIP)
+#define G_FW_RI_RES_WR_ONCHIP(x)        \
+    (((x) >> S_FW_RI_RES_WR_ONCHIP) & M_FW_RI_RES_WR_ONCHIP)
+#define F_FW_RI_RES_WR_ONCHIP   V_FW_RI_RES_WR_ONCHIP(1U)
+
+#define S_FW_RI_RES_WR_PCIECHN          16
+#define M_FW_RI_RES_WR_PCIECHN          0x3
+#define V_FW_RI_RES_WR_PCIECHN(x)       ((x) << S_FW_RI_RES_WR_PCIECHN)
+#define G_FW_RI_RES_WR_PCIECHN(x)       \
+    (((x) >> S_FW_RI_RES_WR_PCIECHN) & M_FW_RI_RES_WR_PCIECHN)
+
+#define S_FW_RI_RES_WR_IQID     0
+#define M_FW_RI_RES_WR_IQID     0xffff
+#define V_FW_RI_RES_WR_IQID(x)  ((x) << S_FW_RI_RES_WR_IQID)
+#define G_FW_RI_RES_WR_IQID(x)  \
+    (((x) >> S_FW_RI_RES_WR_IQID) & M_FW_RI_RES_WR_IQID)
+
+#define S_FW_RI_RES_WR_DCAEN    31
+#define M_FW_RI_RES_WR_DCAEN    0x1
+#define V_FW_RI_RES_WR_DCAEN(x) ((x) << S_FW_RI_RES_WR_DCAEN)
+#define G_FW_RI_RES_WR_DCAEN(x) \
+    (((x) >> S_FW_RI_RES_WR_DCAEN) & M_FW_RI_RES_WR_DCAEN)
+#define F_FW_RI_RES_WR_DCAEN    V_FW_RI_RES_WR_DCAEN(1U)
+
+#define S_FW_RI_RES_WR_DCACPU           26
+#define M_FW_RI_RES_WR_DCACPU           0x1f
+#define V_FW_RI_RES_WR_DCACPU(x)        ((x) << S_FW_RI_RES_WR_DCACPU)
+#define G_FW_RI_RES_WR_DCACPU(x)        \
+    (((x) >> S_FW_RI_RES_WR_DCACPU) & M_FW_RI_RES_WR_DCACPU)
+
+#define S_FW_RI_RES_WR_FBMIN    23
+#define M_FW_RI_RES_WR_FBMIN    0x7
+#define V_FW_RI_RES_WR_FBMIN(x) ((x) << S_FW_RI_RES_WR_FBMIN)
+#define G_FW_RI_RES_WR_FBMIN(x) \
+    (((x) >> S_FW_RI_RES_WR_FBMIN) & M_FW_RI_RES_WR_FBMIN)
+
+#define S_FW_RI_RES_WR_FBMAX    20
+#define M_FW_RI_RES_WR_FBMAX    0x7
+#define V_FW_RI_RES_WR_FBMAX(x) ((x) << S_FW_RI_RES_WR_FBMAX)
+#define G_FW_RI_RES_WR_FBMAX(x) \
+    (((x) >> S_FW_RI_RES_WR_FBMAX) & M_FW_RI_RES_WR_FBMAX)
+
+#define S_FW_RI_RES_WR_CIDXFTHRESHO     19
+#define M_FW_RI_RES_WR_CIDXFTHRESHO     0x1
+#define V_FW_RI_RES_WR_CIDXFTHRESHO(x)  ((x) << S_FW_RI_RES_WR_CIDXFTHRESHO)
+#define G_FW_RI_RES_WR_CIDXFTHRESHO(x)  \
+    (((x) >> S_FW_RI_RES_WR_CIDXFTHRESHO) & M_FW_RI_RES_WR_CIDXFTHRESHO)
+#define F_FW_RI_RES_WR_CIDXFTHRESHO     V_FW_RI_RES_WR_CIDXFTHRESHO(1U)
+
+#define S_FW_RI_RES_WR_CIDXFTHRESH      16
+#define M_FW_RI_RES_WR_CIDXFTHRESH      0x7
+#define V_FW_RI_RES_WR_CIDXFTHRESH(x)   ((x) << S_FW_RI_RES_WR_CIDXFTHRESH)
+#define G_FW_RI_RES_WR_CIDXFTHRESH(x)   \
+    (((x) >> S_FW_RI_RES_WR_CIDXFTHRESH) & M_FW_RI_RES_WR_CIDXFTHRESH)
+
+#define S_FW_RI_RES_WR_EQSIZE           0
+#define M_FW_RI_RES_WR_EQSIZE           0xffff
+#define V_FW_RI_RES_WR_EQSIZE(x)        ((x) << S_FW_RI_RES_WR_EQSIZE)
+#define G_FW_RI_RES_WR_EQSIZE(x)        \
+    (((x) >> S_FW_RI_RES_WR_EQSIZE) & M_FW_RI_RES_WR_EQSIZE)
+
+#define S_FW_RI_RES_WR_IQANDST          15
+#define M_FW_RI_RES_WR_IQANDST          0x1
+#define V_FW_RI_RES_WR_IQANDST(x)       ((x) << S_FW_RI_RES_WR_IQANDST)
+#define G_FW_RI_RES_WR_IQANDST(x)       \
+    (((x) >> S_FW_RI_RES_WR_IQANDST) & M_FW_RI_RES_WR_IQANDST)
+#define F_FW_RI_RES_WR_IQANDST  V_FW_RI_RES_WR_IQANDST(1U)
+
+#define S_FW_RI_RES_WR_IQANUS           14
+#define M_FW_RI_RES_WR_IQANUS           0x1
+#define V_FW_RI_RES_WR_IQANUS(x)        ((x) << S_FW_RI_RES_WR_IQANUS)
+#define G_FW_RI_RES_WR_IQANUS(x)        \
+    (((x) >> S_FW_RI_RES_WR_IQANUS) & M_FW_RI_RES_WR_IQANUS)
+#define F_FW_RI_RES_WR_IQANUS   V_FW_RI_RES_WR_IQANUS(1U)
+
+#define S_FW_RI_RES_WR_IQANUD           12
+#define M_FW_RI_RES_WR_IQANUD           0x3
+#define V_FW_RI_RES_WR_IQANUD(x)        ((x) << S_FW_RI_RES_WR_IQANUD)
+#define G_FW_RI_RES_WR_IQANUD(x)        \
+    (((x) >> S_FW_RI_RES_WR_IQANUD) & M_FW_RI_RES_WR_IQANUD)
+
+#define S_FW_RI_RES_WR_IQANDSTINDEX     0
+#define M_FW_RI_RES_WR_IQANDSTINDEX     0xfff
+#define V_FW_RI_RES_WR_IQANDSTINDEX(x)  ((x) << S_FW_RI_RES_WR_IQANDSTINDEX)
+#define G_FW_RI_RES_WR_IQANDSTINDEX(x)  \
+    (((x) >> S_FW_RI_RES_WR_IQANDSTINDEX) & M_FW_RI_RES_WR_IQANDSTINDEX)
+
+#define S_FW_RI_RES_WR_IQDROPRSS        15
+#define M_FW_RI_RES_WR_IQDROPRSS        0x1
+#define V_FW_RI_RES_WR_IQDROPRSS(x)     ((x) << S_FW_RI_RES_WR_IQDROPRSS)
+#define G_FW_RI_RES_WR_IQDROPRSS(x)     \
+    (((x) >> S_FW_RI_RES_WR_IQDROPRSS) & M_FW_RI_RES_WR_IQDROPRSS)
+#define F_FW_RI_RES_WR_IQDROPRSS        V_FW_RI_RES_WR_IQDROPRSS(1U)
+
+#define S_FW_RI_RES_WR_IQGTSMODE        14
+#define M_FW_RI_RES_WR_IQGTSMODE        0x1
+#define V_FW_RI_RES_WR_IQGTSMODE(x)     ((x) << S_FW_RI_RES_WR_IQGTSMODE)
+#define G_FW_RI_RES_WR_IQGTSMODE(x)     \
+    (((x) >> S_FW_RI_RES_WR_IQGTSMODE) & M_FW_RI_RES_WR_IQGTSMODE)
+#define F_FW_RI_RES_WR_IQGTSMODE        V_FW_RI_RES_WR_IQGTSMODE(1U)
+
+#define S_FW_RI_RES_WR_IQPCIECH         12
+#define M_FW_RI_RES_WR_IQPCIECH         0x3
+#define V_FW_RI_RES_WR_IQPCIECH(x)      ((x) << S_FW_RI_RES_WR_IQPCIECH)
+#define G_FW_RI_RES_WR_IQPCIECH(x)      \
+    (((x) >> S_FW_RI_RES_WR_IQPCIECH) & M_FW_RI_RES_WR_IQPCIECH)
+
+#define S_FW_RI_RES_WR_IQDCAEN          11
+#define M_FW_RI_RES_WR_IQDCAEN          0x1
+#define V_FW_RI_RES_WR_IQDCAEN(x)       ((x) << S_FW_RI_RES_WR_IQDCAEN)
+#define G_FW_RI_RES_WR_IQDCAEN(x)       \
+    (((x) >> S_FW_RI_RES_WR_IQDCAEN) & M_FW_RI_RES_WR_IQDCAEN)
+#define F_FW_RI_RES_WR_IQDCAEN  V_FW_RI_RES_WR_IQDCAEN(1U)
+
+#define S_FW_RI_RES_WR_IQDCACPU         6
+#define M_FW_RI_RES_WR_IQDCACPU         0x1f
+#define V_FW_RI_RES_WR_IQDCACPU(x)      ((x) << S_FW_RI_RES_WR_IQDCACPU)
+#define G_FW_RI_RES_WR_IQDCACPU(x)      \
+    (((x) >> S_FW_RI_RES_WR_IQDCACPU) & M_FW_RI_RES_WR_IQDCACPU)
+
+#define S_FW_RI_RES_WR_IQINTCNTTHRESH           4
+#define M_FW_RI_RES_WR_IQINTCNTTHRESH           0x3
+#define V_FW_RI_RES_WR_IQINTCNTTHRESH(x)        \
+    ((x) << S_FW_RI_RES_WR_IQINTCNTTHRESH)
+#define G_FW_RI_RES_WR_IQINTCNTTHRESH(x)        \
+    (((x) >> S_FW_RI_RES_WR_IQINTCNTTHRESH) & M_FW_RI_RES_WR_IQINTCNTTHRESH)
+
+#define S_FW_RI_RES_WR_IQO      3
+#define M_FW_RI_RES_WR_IQO      0x1
+#define V_FW_RI_RES_WR_IQO(x)   ((x) << S_FW_RI_RES_WR_IQO)
+#define G_FW_RI_RES_WR_IQO(x)   \
+    (((x) >> S_FW_RI_RES_WR_IQO) & M_FW_RI_RES_WR_IQO)
+#define F_FW_RI_RES_WR_IQO      V_FW_RI_RES_WR_IQO(1U)
+
+#define S_FW_RI_RES_WR_IQCPRIO          2
+#define M_FW_RI_RES_WR_IQCPRIO          0x1
+#define V_FW_RI_RES_WR_IQCPRIO(x)       ((x) << S_FW_RI_RES_WR_IQCPRIO)
+#define G_FW_RI_RES_WR_IQCPRIO(x)       \
+    (((x) >> S_FW_RI_RES_WR_IQCPRIO) & M_FW_RI_RES_WR_IQCPRIO)
+#define F_FW_RI_RES_WR_IQCPRIO  V_FW_RI_RES_WR_IQCPRIO(1U)
+
+#define S_FW_RI_RES_WR_IQESIZE          0
+#define M_FW_RI_RES_WR_IQESIZE          0x3
+#define V_FW_RI_RES_WR_IQESIZE(x)       ((x) << S_FW_RI_RES_WR_IQESIZE)
+#define G_FW_RI_RES_WR_IQESIZE(x)       \
+    (((x) >> S_FW_RI_RES_WR_IQESIZE) & M_FW_RI_RES_WR_IQESIZE)
+
+#define S_FW_RI_RES_WR_IQNS     31
+#define M_FW_RI_RES_WR_IQNS     0x1
+#define V_FW_RI_RES_WR_IQNS(x)  ((x) << S_FW_RI_RES_WR_IQNS)
+#define G_FW_RI_RES_WR_IQNS(x)  \
+    (((x) >> S_FW_RI_RES_WR_IQNS) & M_FW_RI_RES_WR_IQNS)
+#define F_FW_RI_RES_WR_IQNS     V_FW_RI_RES_WR_IQNS(1U)
+
+#define S_FW_RI_RES_WR_IQRO     30
+#define M_FW_RI_RES_WR_IQRO     0x1
+#define V_FW_RI_RES_WR_IQRO(x)  ((x) << S_FW_RI_RES_WR_IQRO)
+#define G_FW_RI_RES_WR_IQRO(x)  \
+    (((x) >> S_FW_RI_RES_WR_IQRO) & M_FW_RI_RES_WR_IQRO)
+#define F_FW_RI_RES_WR_IQRO     V_FW_RI_RES_WR_IQRO(1U)
+
+struct fw_ri_rdma_write_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __be64 r2;
+        __be32 plen;
+        __be32 stag_sink;
+        __be64 to_sink;
+#ifndef C99_NOT_SUPPORTED
+        union {
+                struct fw_ri_immd immd_src[0];
+                struct fw_ri_isgl isgl_src[0];
+        } u;
+#endif
+};
+
+struct fw_ri_send_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __be32 sendop_pkd;
+        __be32 stag_inv;
+        __be32 plen;
+        __be32 r3;
+        __be64 r4;
+#ifndef C99_NOT_SUPPORTED
+        union {
+                struct fw_ri_immd immd_src[0];
+                struct fw_ri_isgl isgl_src[0];
+        } u;
+#endif
+};
+
+#define S_FW_RI_SEND_WR_SENDOP          0
+#define M_FW_RI_SEND_WR_SENDOP          0xf
+#define V_FW_RI_SEND_WR_SENDOP(x)       ((x) << S_FW_RI_SEND_WR_SENDOP)
+#define G_FW_RI_SEND_WR_SENDOP(x)       \
+    (((x) >> S_FW_RI_SEND_WR_SENDOP) & M_FW_RI_SEND_WR_SENDOP)
+
+struct fw_ri_rdma_read_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __be64 r2;
+        __be32 stag_sink;
+        __be32 to_sink_hi;
+        __be32 to_sink_lo;
+        __be32 plen;
+        __be32 stag_src;
+        __be32 to_src_hi;
+        __be32 to_src_lo;
+        __be32 r5;
+};
+
+struct fw_ri_recv_wr {
+        __u8   opcode;
+        __u8   r1;
+        __u16  wrid;
+        __u8   r2[3];
+        __u8   len16;
+        struct fw_ri_isgl isgl;
+};
+
+struct fw_ri_bind_mw_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __u8   qpbinde_to_dcacpu;
+        __u8   pgsz_shift;
+        __u8   addr_type;
+        __u8   mem_perms;
+        __be32 stag_mr;
+        __be32 stag_mw;
+        __be32 r3;
+        __be64 len_mw;
+        __be64 va_fbo;
+        __be64 r4;
+};
+
+#define S_FW_RI_BIND_MW_WR_QPBINDE      6
+#define M_FW_RI_BIND_MW_WR_QPBINDE      0x1
+#define V_FW_RI_BIND_MW_WR_QPBINDE(x)   ((x) << S_FW_RI_BIND_MW_WR_QPBINDE)
+#define G_FW_RI_BIND_MW_WR_QPBINDE(x)   \
+    (((x) >> S_FW_RI_BIND_MW_WR_QPBINDE) & M_FW_RI_BIND_MW_WR_QPBINDE)
+#define F_FW_RI_BIND_MW_WR_QPBINDE      V_FW_RI_BIND_MW_WR_QPBINDE(1U)
+
+#define S_FW_RI_BIND_MW_WR_NS           5
+#define M_FW_RI_BIND_MW_WR_NS           0x1
+#define V_FW_RI_BIND_MW_WR_NS(x)        ((x) << S_FW_RI_BIND_MW_WR_NS)
+#define G_FW_RI_BIND_MW_WR_NS(x)        \
+    (((x) >> S_FW_RI_BIND_MW_WR_NS) & M_FW_RI_BIND_MW_WR_NS)
+#define F_FW_RI_BIND_MW_WR_NS   V_FW_RI_BIND_MW_WR_NS(1U)
+
+#define S_FW_RI_BIND_MW_WR_DCACPU       0
+#define M_FW_RI_BIND_MW_WR_DCACPU       0x1f
+#define V_FW_RI_BIND_MW_WR_DCACPU(x)    ((x) << S_FW_RI_BIND_MW_WR_DCACPU)
+#define G_FW_RI_BIND_MW_WR_DCACPU(x)    \
+    (((x) >> S_FW_RI_BIND_MW_WR_DCACPU) & M_FW_RI_BIND_MW_WR_DCACPU)
+
+struct fw_ri_fr_nsmr_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __u8   qpbinde_to_dcacpu;
+        __u8   pgsz_shift;
+        __u8   addr_type;
+        __u8   mem_perms;
+        __be32 stag;
+        __be32 len_hi;
+        __be32 len_lo;
+        __be32 va_hi;
+        __be32 va_lo_fbo;
+};
+
+#define S_FW_RI_FR_NSMR_WR_QPBINDE      6
+#define M_FW_RI_FR_NSMR_WR_QPBINDE      0x1
+#define V_FW_RI_FR_NSMR_WR_QPBINDE(x)   ((x) << S_FW_RI_FR_NSMR_WR_QPBINDE)
+#define G_FW_RI_FR_NSMR_WR_QPBINDE(x)   \
+    (((x) >> S_FW_RI_FR_NSMR_WR_QPBINDE) & M_FW_RI_FR_NSMR_WR_QPBINDE)
+#define F_FW_RI_FR_NSMR_WR_QPBINDE      V_FW_RI_FR_NSMR_WR_QPBINDE(1U)
+
+#define S_FW_RI_FR_NSMR_WR_NS           5
+#define M_FW_RI_FR_NSMR_WR_NS           0x1
+#define V_FW_RI_FR_NSMR_WR_NS(x)        ((x) << S_FW_RI_FR_NSMR_WR_NS)
+#define G_FW_RI_FR_NSMR_WR_NS(x)        \
+    (((x) >> S_FW_RI_FR_NSMR_WR_NS) & M_FW_RI_FR_NSMR_WR_NS)
+#define F_FW_RI_FR_NSMR_WR_NS   V_FW_RI_FR_NSMR_WR_NS(1U)
+
+#define S_FW_RI_FR_NSMR_WR_DCACPU       0
+#define M_FW_RI_FR_NSMR_WR_DCACPU       0x1f
+#define V_FW_RI_FR_NSMR_WR_DCACPU(x)    ((x) << S_FW_RI_FR_NSMR_WR_DCACPU)
+#define G_FW_RI_FR_NSMR_WR_DCACPU(x)    \
+    (((x) >> S_FW_RI_FR_NSMR_WR_DCACPU) & M_FW_RI_FR_NSMR_WR_DCACPU)
+
+struct fw_ri_inv_lstag_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __be32 r2;
+        __be32 stag_inv;
+};
+
+enum fw_ri_type {
+        FW_RI_TYPE_INIT,
+        FW_RI_TYPE_FINI,
+        FW_RI_TYPE_TERMINATE
+};
+
+enum fw_ri_init_p2ptype {
+        FW_RI_INIT_P2PTYPE_RDMA_WRITE           = FW_RI_RDMA_WRITE,
+        FW_RI_INIT_P2PTYPE_READ_REQ             = FW_RI_READ_REQ,
+        FW_RI_INIT_P2PTYPE_SEND                 = FW_RI_SEND,
+        FW_RI_INIT_P2PTYPE_SEND_WITH_INV        = FW_RI_SEND_WITH_INV,
+        FW_RI_INIT_P2PTYPE_SEND_WITH_SE         = FW_RI_SEND_WITH_SE,
+        FW_RI_INIT_P2PTYPE_SEND_WITH_SE_INV     = FW_RI_SEND_WITH_SE_INV,
+        FW_RI_INIT_P2PTYPE_DISABLED             = 0xf,
+};
+
+struct fw_ri_wr {
+        __be32 op_compl;
+        __be32 flowid_len16;
+        __u64  cookie;
+        union fw_ri {
+                struct fw_ri_init {
+                        __u8   type;
+                        __u8   mpareqbit_p2ptype;
+                        __u8   r4[2];
+                        __u8   mpa_attrs;
+                        __u8   qp_caps;
+                        __be16 nrqe;
+                        __be32 pdid;
+                        __be32 qpid;
+                        __be32 sq_eqid;
+                        __be32 rq_eqid;
+                        __be32 scqid;
+                        __be32 rcqid;
+                        __be32 ord_max;
+                        __be32 ird_max;
+                        __be32 iss;
+                        __be32 irs;
+                        __be32 hwrqsize;
+                        __be32 hwrqaddr;
+                        __be64 r5;
+                        union fw_ri_init_p2p {
+                                struct fw_ri_rdma_write_wr write;
+                                struct fw_ri_rdma_read_wr read;
+                                struct fw_ri_send_wr send;
+                        } u;
+                } init;
+                struct fw_ri_fini {
+                        __u8   type;
+                        __u8   r3[7];
+                        __be64 r4;
+                } fini;
+                struct fw_ri_terminate {
+                        __u8   type;
+                        __u8   r3[3];
+                        __be32 immdlen;
+                        __u8   termmsg[40];
+                } terminate;
+        } u;
+};
+
+#define S_FW_RI_WR_MPAREQBIT    7
+#define M_FW_RI_WR_MPAREQBIT    0x1
+#define V_FW_RI_WR_MPAREQBIT(x) ((x) << S_FW_RI_WR_MPAREQBIT)
+#define G_FW_RI_WR_MPAREQBIT(x) \
+    (((x) >> S_FW_RI_WR_MPAREQBIT) & M_FW_RI_WR_MPAREQBIT)
+#define F_FW_RI_WR_MPAREQBIT    V_FW_RI_WR_MPAREQBIT(1U)
+
+#define S_FW_RI_WR_P2PTYPE      0
+#define M_FW_RI_WR_P2PTYPE      0xf
+#define V_FW_RI_WR_P2PTYPE(x)   ((x) << S_FW_RI_WR_P2PTYPE)
+#define G_FW_RI_WR_P2PTYPE(x)   \
+    (((x) >> S_FW_RI_WR_P2PTYPE) & M_FW_RI_WR_P2PTYPE)
+
+struct tcp_options {
+        __be16 mss;
+        __u8 wsf;
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        __u8:4;
+        __u8 unknown:1;
+        __u8:1;
+        __u8 sack:1;
+        __u8 tstamp:1;
+#else
+        __u8 tstamp:1;
+        __u8 sack:1;
+        __u8:1;
+        __u8 unknown:1;
+        __u8:4;
+#endif
+};
+
+struct cpl_pass_accept_req {
+        union opcode_tid ot;
+        __be16 rsvd;
+        __be16 len;
+        __be32 hdr_len;
+        __be16 vlan;
+        __be16 l2info;
+        __be32 tos_stid;
+        struct tcp_options tcpopt;
+};
+
+/* cpl_pass_accept_req.hdr_len fields */
+#define S_SYN_RX_CHAN    0
+#define M_SYN_RX_CHAN    0xF
+#define V_SYN_RX_CHAN(x) ((x) << S_SYN_RX_CHAN)
+#define G_SYN_RX_CHAN(x) (((x) >> S_SYN_RX_CHAN) & M_SYN_RX_CHAN)
+
+#define S_TCP_HDR_LEN    10
+#define M_TCP_HDR_LEN    0x3F
+#define V_TCP_HDR_LEN(x) ((x) << S_TCP_HDR_LEN)
+#define G_TCP_HDR_LEN(x) (((x) >> S_TCP_HDR_LEN) & M_TCP_HDR_LEN)
+
+#define S_IP_HDR_LEN    16
+#define M_IP_HDR_LEN    0x3FF
+#define V_IP_HDR_LEN(x) ((x) << S_IP_HDR_LEN)
+#define G_IP_HDR_LEN(x) (((x) >> S_IP_HDR_LEN) & M_IP_HDR_LEN)
+
+#define S_ETH_HDR_LEN    26
+#define M_ETH_HDR_LEN    0x1F
+#define V_ETH_HDR_LEN(x) ((x) << S_ETH_HDR_LEN)
+#define G_ETH_HDR_LEN(x) (((x) >> S_ETH_HDR_LEN) & M_ETH_HDR_LEN)
+
+/* cpl_pass_accept_req.l2info fields */
+#define S_SYN_MAC_IDX    0
+#define M_SYN_MAC_IDX    0x1FF
+#define V_SYN_MAC_IDX(x) ((x) << S_SYN_MAC_IDX)
+#define G_SYN_MAC_IDX(x) (((x) >> S_SYN_MAC_IDX) & M_SYN_MAC_IDX)
+
+#define S_SYN_XACT_MATCH    9
+#define V_SYN_XACT_MATCH(x) ((x) << S_SYN_XACT_MATCH)
+#define F_SYN_XACT_MATCH    V_SYN_XACT_MATCH(1U)
+
+#define S_SYN_INTF    12
+#define M_SYN_INTF    0xF
+#define V_SYN_INTF(x) ((x) << S_SYN_INTF)
+#define G_SYN_INTF(x) (((x) >> S_SYN_INTF) & M_SYN_INTF)
+
+struct ulptx_idata {
+        __be32 cmd_more;
+        __be32 len;
+};
+
+#define S_ULPTX_NSGE    0
+#define M_ULPTX_NSGE    0xFFFF
+#define V_ULPTX_NSGE(x) ((x) << S_ULPTX_NSGE)
+#endif /* _T4FW_RI_API_H_ */
diff --git a/drivers/infiniband/hw/cxgb4/user.h b/drivers/infiniband/hw/cxgb4/user.h
new file mode 100644
index 000000000000..ed6414abde02
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/user.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __C4IW_USER_H__
+#define __C4IW_USER_H__
+
+#define C4IW_UVERBS_ABI_VERSION 1
+
+/*
+ * Make sure that all structs defined in this file remain laid out so
+ * that they pack the same way on 32-bit and 64-bit architectures (to
+ * avoid incompatibility between 32-bit userspace and 64-bit kernels).
+ * In particular do not use pointer types -- pass pointers in __u64
+ * instead.
+ */
+struct c4iw_create_cq_resp {
+        __u64 key;
+        __u64 gts_key;
+        __u64 memsize;
+        __u32 cqid;
+        __u32 size;
+        __u32 qid_mask;
+};
+
+struct c4iw_create_qp_resp {
+        __u64 sq_key;
+        __u64 rq_key;
+        __u64 sq_db_gts_key;
+        __u64 rq_db_gts_key;
+        __u64 sq_memsize;
+        __u64 rq_memsize;
+        __u32 sqid;
+        __u32 rqid;
+        __u32 sq_size;
+        __u32 rq_size;
+        __u32 qid_mask;
+};
+#endif
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index cc2ddd29ac57..5a219a2fdf16 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -661,6 +661,14 @@ repoll:
                         wc->opcode    = IB_WC_FETCH_ADD;
                         wc->byte_len  = 8;
                         break;
+                case MLX4_OPCODE_MASKED_ATOMIC_CS:
+                        wc->opcode    = IB_WC_MASKED_COMP_SWAP;
+                        wc->byte_len  = 8;
+                        break;
+                case MLX4_OPCODE_MASKED_ATOMIC_FA:
+                        wc->opcode    = IB_WC_MASKED_FETCH_ADD;
+                        wc->byte_len  = 8;
+                        break;
                 case MLX4_OPCODE_BIND_MW:
                         wc->opcode    = IB_WC_BIND_MW;
                         break;
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 01f2a3f93355..39051417054c 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -139,6 +139,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->local_ca_ack_delay  = dev->dev->caps.local_ca_ack_delay;
         props->atomic_cap          = dev->dev->caps.flags & MLX4_DEV_CAP_FLAG_ATOMIC ?
                 IB_ATOMIC_HCA : IB_ATOMIC_NONE;
+        props->masked_atomic_cap   = IB_ATOMIC_HCA;
         props->max_pkeys           = dev->dev->caps.pkey_table_len[1];
         props->max_mcast_grp       = dev->dev->caps.num_mgms + dev->dev->caps.num_amgms;
         props->max_mcast_qp_attach = dev->dev->caps.num_qp_per_mgm;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 5643f4a8ffef..6a60827b2301 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -74,17 +74,19 @@ enum {
 };
 
 static const __be32 mlx4_ib_opcode[] = {
-        [IB_WR_SEND]                    = cpu_to_be32(MLX4_OPCODE_SEND),
-        [IB_WR_LSO]                     = cpu_to_be32(MLX4_OPCODE_LSO),
-        [IB_WR_SEND_WITH_IMM]           = cpu_to_be32(MLX4_OPCODE_SEND_IMM),
-        [IB_WR_RDMA_WRITE]              = cpu_to_be32(MLX4_OPCODE_RDMA_WRITE),
-        [IB_WR_RDMA_WRITE_WITH_IMM]     = cpu_to_be32(MLX4_OPCODE_RDMA_WRITE_IMM),
-        [IB_WR_RDMA_READ]               = cpu_to_be32(MLX4_OPCODE_RDMA_READ),
-        [IB_WR_ATOMIC_CMP_AND_SWP]      = cpu_to_be32(MLX4_OPCODE_ATOMIC_CS),
-        [IB_WR_ATOMIC_FETCH_AND_ADD]    = cpu_to_be32(MLX4_OPCODE_ATOMIC_FA),
-        [IB_WR_SEND_WITH_INV]           = cpu_to_be32(MLX4_OPCODE_SEND_INVAL),
-        [IB_WR_LOCAL_INV]               = cpu_to_be32(MLX4_OPCODE_LOCAL_INVAL),
-        [IB_WR_FAST_REG_MR]             = cpu_to_be32(MLX4_OPCODE_FMR),
+        [IB_WR_SEND]                            = cpu_to_be32(MLX4_OPCODE_SEND),
+        [IB_WR_LSO]                             = cpu_to_be32(MLX4_OPCODE_LSO),
+        [IB_WR_SEND_WITH_IMM]                   = cpu_to_be32(MLX4_OPCODE_SEND_IMM),
+        [IB_WR_RDMA_WRITE]                      = cpu_to_be32(MLX4_OPCODE_RDMA_WRITE),
+        [IB_WR_RDMA_WRITE_WITH_IMM]             = cpu_to_be32(MLX4_OPCODE_RDMA_WRITE_IMM),
+        [IB_WR_RDMA_READ]                       = cpu_to_be32(MLX4_OPCODE_RDMA_READ),
+        [IB_WR_ATOMIC_CMP_AND_SWP]              = cpu_to_be32(MLX4_OPCODE_ATOMIC_CS),
+        [IB_WR_ATOMIC_FETCH_AND_ADD]            = cpu_to_be32(MLX4_OPCODE_ATOMIC_FA),
+        [IB_WR_SEND_WITH_INV]                   = cpu_to_be32(MLX4_OPCODE_SEND_INVAL),
+        [IB_WR_LOCAL_INV]                       = cpu_to_be32(MLX4_OPCODE_LOCAL_INVAL),
+        [IB_WR_FAST_REG_MR]                     = cpu_to_be32(MLX4_OPCODE_FMR),
+        [IB_WR_MASKED_ATOMIC_CMP_AND_SWP]       = cpu_to_be32(MLX4_OPCODE_MASKED_ATOMIC_CS),
+        [IB_WR_MASKED_ATOMIC_FETCH_AND_ADD]     = cpu_to_be32(MLX4_OPCODE_MASKED_ATOMIC_FA),
 };
 
 static struct mlx4_ib_sqp *to_msqp(struct mlx4_ib_qp *mqp)
@@ -1407,6 +1409,9 @@ static void set_atomic_seg(struct mlx4_wqe_atomic_seg *aseg, struct ib_send_wr *
         if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP) {
                 aseg->swap_add = cpu_to_be64(wr->wr.atomic.swap);
                 aseg->compare  = cpu_to_be64(wr->wr.atomic.compare_add);
+        } else if (wr->opcode == IB_WR_MASKED_ATOMIC_FETCH_AND_ADD) {
+                aseg->swap_add = cpu_to_be64(wr->wr.atomic.compare_add);
+                aseg->compare  = cpu_to_be64(wr->wr.atomic.compare_add_mask);
         } else {
                 aseg->swap_add = cpu_to_be64(wr->wr.atomic.compare_add);
                 aseg->compare  = 0;
@@ -1414,6 +1419,15 @@ static void set_atomic_seg(struct mlx4_wqe_atomic_seg *aseg, struct ib_send_wr *
 
 }
 
+static void set_masked_atomic_seg(struct mlx4_wqe_masked_atomic_seg *aseg,
+                                  struct ib_send_wr *wr)
+{
+        aseg->swap_add          = cpu_to_be64(wr->wr.atomic.swap);
+        aseg->swap_add_mask     = cpu_to_be64(wr->wr.atomic.swap_mask);
+        aseg->compare           = cpu_to_be64(wr->wr.atomic.compare_add);
+        aseg->compare_mask      = cpu_to_be64(wr->wr.atomic.compare_add_mask);
+}
+
 static void set_datagram_seg(struct mlx4_wqe_datagram_seg *dseg,
                              struct ib_send_wr *wr)
 {
@@ -1567,6 +1581,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         switch (wr->opcode) {
                         case IB_WR_ATOMIC_CMP_AND_SWP:
                         case IB_WR_ATOMIC_FETCH_AND_ADD:
+                        case IB_WR_MASKED_ATOMIC_FETCH_AND_ADD:
                                 set_raddr_seg(wqe, wr->wr.atomic.remote_addr,
                                               wr->wr.atomic.rkey);
                                 wqe  += sizeof (struct mlx4_wqe_raddr_seg);
@@ -1579,6 +1594,19 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
                                 break;
 
+                        case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
+                                set_raddr_seg(wqe, wr->wr.atomic.remote_addr,
+                                              wr->wr.atomic.rkey);
+                                wqe  += sizeof (struct mlx4_wqe_raddr_seg);
+
+                                set_masked_atomic_seg(wqe, wr);
+                                wqe  += sizeof (struct mlx4_wqe_masked_atomic_seg);
+
+                                size += (sizeof (struct mlx4_wqe_raddr_seg) +
+                                         sizeof (struct mlx4_wqe_masked_atomic_seg)) / 16;
+
+                                break;
+
                         case IB_WR_RDMA_READ:
                         case IB_WR_RDMA_WRITE:
                         case IB_WR_RDMA_WRITE_WITH_IMM:
diff --git a/drivers/infiniband/hw/mthca/mthca_allocator.c b/drivers/infiniband/hw/mthca/mthca_allocator.c
index c5ccc2daab60..b4e0cf4e95cd 100644
--- a/drivers/infiniband/hw/mthca/mthca_allocator.c
+++ b/drivers/infiniband/hw/mthca/mthca_allocator.c
@@ -211,7 +211,7 @@ int mthca_buf_alloc(struct mthca_dev *dev, int size, int max_direct,
                 if (!buf->direct.buf)
                         return -ENOMEM;
 
-                pci_unmap_addr_set(&buf->direct, mapping, t);
+                dma_unmap_addr_set(&buf->direct, mapping, t);
 
                 memset(buf->direct.buf, 0, size);
 
@@ -251,7 +251,7 @@ int mthca_buf_alloc(struct mthca_dev *dev, int size, int max_direct,
                                 goto err_free;
 
                         dma_list[i] = t;
-                        pci_unmap_addr_set(&buf->page_list[i], mapping, t);
+                        dma_unmap_addr_set(&buf->page_list[i], mapping, t);
 
                         clear_page(buf->page_list[i].buf);
                 }
@@ -289,12 +289,12 @@ void mthca_buf_free(struct mthca_dev *dev, int size, union mthca_buf *buf,
 
         if (is_direct)
                 dma_free_coherent(&dev->pdev->dev, size, buf->direct.buf,
-                                  pci_unmap_addr(&buf->direct, mapping));
+                                  dma_unmap_addr(&buf->direct, mapping));
         else {
                 for (i = 0; i < (size + PAGE_SIZE - 1) / PAGE_SIZE; ++i)
                         dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
                                           buf->page_list[i].buf,
-                                          pci_unmap_addr(&buf->page_list[i],
+                                          dma_unmap_addr(&buf->page_list[i],
                                                          mapping));
                 kfree(buf->page_list);
         }
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 9388164b6053..8e8c728aff88 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -504,7 +504,7 @@ static int mthca_create_eq(struct mthca_dev *dev,
                         goto err_out_free_pages;
 
                 dma_list[i] = t;
-                pci_unmap_addr_set(&eq->page_list[i], mapping, t);
+                dma_unmap_addr_set(&eq->page_list[i], mapping, t);
 
                 clear_page(eq->page_list[i].buf);
         }
@@ -579,7 +579,7 @@ static int mthca_create_eq(struct mthca_dev *dev,
                 if (eq->page_list[i].buf)
                         dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
                                           eq->page_list[i].buf,
-                                          pci_unmap_addr(&eq->page_list[i],
+                                          dma_unmap_addr(&eq->page_list[i],
                                                          mapping));
 
         mthca_free_mailbox(dev, mailbox);
@@ -629,7 +629,7 @@ static void mthca_free_eq(struct mthca_dev *dev,
         for (i = 0; i < npages; ++i)
                 pci_free_consistent(dev->pdev, PAGE_SIZE,
                                     eq->page_list[i].buf,
-                                    pci_unmap_addr(&eq->page_list[i], mapping));
+                                    dma_unmap_addr(&eq->page_list[i], mapping));
 
         kfree(eq->page_list);
         mthca_free_mailbox(dev, mailbox);
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.h b/drivers/infiniband/hw/mthca/mthca_provider.h
index 90f4c4d2e983..596acc45569b 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.h
+++ b/drivers/infiniband/hw/mthca/mthca_provider.h
@@ -46,7 +46,7 @@
 
 struct mthca_buf_list {
         void *buf;
-        DECLARE_PCI_UNMAP_ADDR(mapping)
+        DEFINE_DMA_UNMAP_ADDR(mapping);
 };
 
 union mthca_buf {
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index c36a3f514929..86acb7d57064 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -1297,7 +1297,7 @@ int nes_destroy_cqp(struct nes_device *nesdev)
 /**
  * nes_init_1g_phy
  */
-int nes_init_1g_phy(struct nes_device *nesdev, u8 phy_type, u8 phy_index)
+static int nes_init_1g_phy(struct nes_device *nesdev, u8 phy_type, u8 phy_index)
 {
         u32 counter = 0;
         u16 phy_data;
@@ -1351,7 +1351,7 @@ int nes_init_1g_phy(struct nes_device *nesdev, u8 phy_type, u8 phy_index)
 /**
  * nes_init_2025_phy
  */
-int nes_init_2025_phy(struct nes_device *nesdev, u8 phy_type, u8 phy_index)
+static int nes_init_2025_phy(struct nes_device *nesdev, u8 phy_type, u8 phy_index)
 {
         u32 temp_phy_data = 0;
         u32 temp_phy_data2 = 0;
@@ -2458,7 +2458,6 @@ static void nes_process_mac_intr(struct nes_device *nesdev, u32 mac_number)
                 return;
         }
         nesadapter->mac_sw_state[mac_number] = NES_MAC_SW_INTERRUPT;
-        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
 
         /* ack the MAC interrupt */
         mac_status = nes_read_indexed(nesdev, NES_IDX_MAC_INT_STATUS + (mac_index * 0x200));
@@ -2469,11 +2468,9 @@ static void nes_process_mac_intr(struct nes_device *nesdev, u32 mac_number)
 
         if (mac_status & (NES_MAC_INT_LINK_STAT_CHG | NES_MAC_INT_XGMII_EXT)) {
                 nesdev->link_status_interrupts++;
-                if (0 == (++nesadapter->link_interrupt_count[mac_index] % ((u16)NES_MAX_LINK_INTERRUPTS))) {
-                        spin_lock_irqsave(&nesadapter->phy_lock, flags);
+                if (0 == (++nesadapter->link_interrupt_count[mac_index] % ((u16)NES_MAX_LINK_INTERRUPTS)))
                         nes_reset_link(nesdev, mac_index);
-                        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
-                }
+
                 /* read the PHY interrupt status register */
                 if ((nesadapter->OneG_Mode) &&
                 (nesadapter->phy_type[mac_index] != NES_PHY_TYPE_PUMA_1G)) {
@@ -2587,6 +2584,7 @@ static void nes_process_mac_intr(struct nes_device *nesdev, u32 mac_number)
                                 break;
                         }
                 }
+                spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
 
                 if (phy_data & 0x0004) {
                         if (wide_ppm_offset &&
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index b7c813f4be43..9f4cadf9f851 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -1461,11 +1461,14 @@ static int nes_netdev_get_settings(struct net_device *netdev, struct ethtool_cmd
                         et_cmd->transceiver = XCVR_INTERNAL;
                         et_cmd->phy_address = mac_index;
                 } else {
+                        unsigned long flags;
                         et_cmd->supported   = SUPPORTED_1000baseT_Full
                                             | SUPPORTED_Autoneg;
                         et_cmd->advertising = ADVERTISED_1000baseT_Full
                                             | ADVERTISED_Autoneg;
+                        spin_lock_irqsave(&nesadapter->phy_lock, flags);
                         nes_read_1G_phy_reg(nesdev, 0, phy_index, &phy_data);
+                        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
                         if (phy_data & 0x1000)
                                 et_cmd->autoneg = AUTONEG_ENABLE;
                         else
@@ -1503,12 +1506,15 @@ static int nes_netdev_set_settings(struct net_device *netdev, struct ethtool_cmd
         struct nes_vnic *nesvnic = netdev_priv(netdev);
         struct nes_device *nesdev = nesvnic->nesdev;
         struct nes_adapter *nesadapter = nesdev->nesadapter;
-        u16 phy_data;
 
         if ((nesadapter->OneG_Mode) &&
             (nesadapter->phy_type[nesdev->mac_index] != NES_PHY_TYPE_PUMA_1G)) {
-                nes_read_1G_phy_reg(nesdev, 0, nesadapter->phy_index[nesdev->mac_index],
-                                &phy_data);
+                unsigned long flags;
+                u16 phy_data;
+                u8 phy_index = nesadapter->phy_index[nesdev->mac_index];
+
+                spin_lock_irqsave(&nesadapter->phy_lock, flags);
+                nes_read_1G_phy_reg(nesdev, 0, phy_index, &phy_data);
                 if (et_cmd->autoneg) {
                         /* Turn on Full duplex, Autoneg, and restart autonegotiation */
                         phy_data |= 0x1300;
@@ -1516,8 +1522,8 @@ static int nes_netdev_set_settings(struct net_device *netdev, struct ethtool_cmd
                         /* Turn off autoneg */
                         phy_data &= ~0x1000;
                 }
-                nes_write_1G_phy_reg(nesdev, 0, nesadapter->phy_index[nesdev->mac_index],
-                                phy_data);
+                nes_write_1G_phy_reg(nesdev, 0, phy_index, phy_data);
+                spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
         }
 
         return 0;
diff --git a/drivers/infiniband/hw/nes/nes_utils.c b/drivers/infiniband/hw/nes/nes_utils.c
index 186623d86959..a9f5dd272f1a 100644
--- a/drivers/infiniband/hw/nes/nes_utils.c
+++ b/drivers/infiniband/hw/nes/nes_utils.c
@@ -381,12 +381,8 @@ static u16 nes_read16_eeprom(void __iomem *addr, u16 offset)
  */
 void nes_write_1G_phy_reg(struct nes_device *nesdev, u8 phy_reg, u8 phy_addr, u16 data)
 {
-        struct nes_adapter *nesadapter = nesdev->nesadapter;
         u32 u32temp;
         u32 counter;
-        unsigned long flags;
-
-        spin_lock_irqsave(&nesadapter->phy_lock, flags);
 
         nes_write_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL,
                         0x50020000 | data | ((u32)phy_reg << 18) | ((u32)phy_addr << 23));
@@ -402,8 +398,6 @@ void nes_write_1G_phy_reg(struct nes_device *nesdev, u8 phy_reg, u8 phy_addr, u1
         if (!(u32temp & 1))
                 nes_debug(NES_DBG_PHY, "Phy is not responding. interrupt status = 0x%X.\n",
                                 u32temp);
-
-        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
 }
 
 
@@ -414,14 +408,11 @@ void nes_write_1G_phy_reg(struct nes_device *nesdev, u8 phy_reg, u8 phy_addr, u1
  */
 void nes_read_1G_phy_reg(struct nes_device *nesdev, u8 phy_reg, u8 phy_addr, u16 *data)
 {
-        struct nes_adapter *nesadapter = nesdev->nesadapter;
         u32 u32temp;
         u32 counter;
-        unsigned long flags;
 
         /* nes_debug(NES_DBG_PHY, "phy addr = %d, mac_index = %d\n",
                         phy_addr, nesdev->mac_index); */
-        spin_lock_irqsave(&nesadapter->phy_lock, flags);
 
         nes_write_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL,
                         0x60020000 | ((u32)phy_reg << 18) | ((u32)phy_addr << 23));
@@ -441,7 +432,6 @@ void nes_read_1G_phy_reg(struct nes_device *nesdev, u8 phy_reg, u8 phy_addr, u16
         } else {
                 *data = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
         }
-        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
 }
 
 
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index e54f312e4bdc..925e1f2d1d55 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -374,7 +374,7 @@ static int alloc_fast_reg_mr(struct nes_device *nesdev, struct nes_pd *nespd,
 /*
  * nes_alloc_fast_reg_mr
  */
-struct ib_mr *nes_alloc_fast_reg_mr(struct ib_pd *ibpd, int max_page_list_len)
+static struct ib_mr *nes_alloc_fast_reg_mr(struct ib_pd *ibpd, int max_page_list_len)
 {
         struct nes_pd *nespd = to_nespd(ibpd);
         struct nes_vnic *nesvnic = to_nesvnic(ibpd->device);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
index d10b4ec68d28..40e858492f90 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
@@ -49,6 +49,25 @@ static u32 ipoib_get_rx_csum(struct net_device *dev)
                 !test_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags);
 }
 
+static int ipoib_set_tso(struct net_device *dev, u32 data)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+
+        if (data) {
+                if (!test_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags) &&
+                    (dev->features & NETIF_F_SG) &&
+                    (priv->hca_caps & IB_DEVICE_UD_TSO)) {
+                        dev->features |= NETIF_F_TSO;
+                } else {
+                        ipoib_warn(priv, "can't set TSO on\n");
+                        return -EOPNOTSUPP;
+                }
+        } else
+                dev->features &= ~NETIF_F_TSO;
+
+        return 0;
+}
+
 static int ipoib_get_coalesce(struct net_device *dev,
                               struct ethtool_coalesce *coal)
 {
@@ -131,6 +150,7 @@ static void ipoib_get_ethtool_stats(struct net_device *dev,
 static const struct ethtool_ops ipoib_ethtool_ops = {
         .get_drvinfo            = ipoib_get_drvinfo,
         .get_rx_csum            = ipoib_get_rx_csum,
+        .set_tso                = ipoib_set_tso,
         .get_coalesce           = ipoib_get_coalesce,
         .set_coalesce           = ipoib_set_coalesce,
         .get_flags              = ethtool_op_get_flags,
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index 93399dff0c6f..7b2fc98e2f2b 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -325,7 +325,7 @@ iscsi_iser_conn_destroy(struct iscsi_cls_conn *cls_conn)
          */
         if (ib_conn) {
                 ib_conn->iser_conn = NULL;
-                iser_conn_put(ib_conn);
+                iser_conn_put(ib_conn, 1); /* deref iscsi/ib conn unbinding */
         }
 }
 
@@ -357,11 +357,12 @@ iscsi_iser_conn_bind(struct iscsi_cls_session *cls_session,
         /* binds the iSER connection retrieved from the previously
          * connected ep_handle to the iSCSI layer connection. exchanges
          * connection pointers */
-        iser_err("binding iscsi conn %p to iser_conn %p\n",conn,ib_conn);
+        iser_err("binding iscsi/iser conn %p %p to ib_conn %p\n",
+                                        conn, conn->dd_data, ib_conn);
         iser_conn = conn->dd_data;
         ib_conn->iser_conn = iser_conn;
         iser_conn->ib_conn  = ib_conn;
-        iser_conn_get(ib_conn);
+        iser_conn_get(ib_conn); /* ref iscsi/ib conn binding */
         return 0;
 }
 
@@ -382,7 +383,7 @@ iscsi_iser_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
                  * There is no unbind event so the stop callback
                  * must release the ref from the bind.
                  */
-                iser_conn_put(ib_conn);
+                iser_conn_put(ib_conn, 1); /* deref iscsi/ib conn unbinding */
         }
         iser_conn->ib_conn = NULL;
 }
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 036934cdcb92..f1df01567bb6 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -232,6 +232,7 @@ struct iser_device {
         struct ib_cq                 *tx_cq;
         struct ib_mr                 *mr;
         struct tasklet_struct        cq_tasklet;
+        struct ib_event_handler      event_handler;
         struct list_head             ig_list; /* entry in ig devices list */
         int                          refcount;
 };
@@ -246,7 +247,6 @@ struct iser_conn {
         struct rdma_cm_id            *cma_id;       /* CMA ID                  */
         struct ib_qp                 *qp;           /* QP                      */
         struct ib_fmr_pool           *fmr_pool;     /* pool of IB FMRs         */
-        int                          disc_evt_flag; /* disconn event delivered */
         wait_queue_head_t            wait;          /* waitq for conn/disconn  */
         int                          post_recv_buf_count; /* posted rx count  */
         atomic_t                     post_send_buf_count; /* posted tx count   */
@@ -320,7 +320,7 @@ void iser_conn_init(struct iser_conn *ib_conn);
 
 void iser_conn_get(struct iser_conn *ib_conn);
 
-void iser_conn_put(struct iser_conn *ib_conn);
+int iser_conn_put(struct iser_conn *ib_conn, int destroy_cma_id_allowed);
 
 void iser_conn_terminate(struct iser_conn *ib_conn);
 
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index b89d76b39a13..9876865732f7 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -54,6 +54,13 @@ static void iser_qp_event_callback(struct ib_event *cause, void *context)
         iser_err("got qp event %d\n",cause->event);
 }
 
+static void iser_event_handler(struct ib_event_handler *handler,
+                                struct ib_event *event)
+{
+        iser_err("async event %d on device %s port %d\n", event->event,
+                event->device->name, event->element.port_num);
+}
+
 /**
  * iser_create_device_ib_res - creates Protection Domain (PD), Completion
  * Queue (CQ), DMA Memory Region (DMA MR) with the device associated with
@@ -96,8 +103,15 @@ static int iser_create_device_ib_res(struct iser_device *device)
         if (IS_ERR(device->mr))
                 goto dma_mr_err;
 
+        INIT_IB_EVENT_HANDLER(&device->event_handler, device->ib_device,
+                                iser_event_handler);
+        if (ib_register_event_handler(&device->event_handler))
+                goto handler_err;
+
         return 0;
 
+handler_err:
+        ib_dereg_mr(device->mr);
 dma_mr_err:
         tasklet_kill(&device->cq_tasklet);
 cq_arm_err:
@@ -120,7 +134,7 @@ static void iser_free_device_ib_res(struct iser_device *device)
         BUG_ON(device->mr == NULL);
 
         tasklet_kill(&device->cq_tasklet);
-
+        (void)ib_unregister_event_handler(&device->event_handler);
         (void)ib_dereg_mr(device->mr);
         (void)ib_destroy_cq(device->tx_cq);
         (void)ib_destroy_cq(device->rx_cq);
@@ -149,10 +163,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
         device = ib_conn->device;
 
         ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
-        if (!ib_conn->login_buf) {
-                goto alloc_err;
-                ret = -ENOMEM;
-        }
+        if (!ib_conn->login_buf)
+                goto out_err;
 
         ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
                                 (void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,
@@ -161,10 +173,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
         ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
                                     (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
                                     GFP_KERNEL);
-        if (!ib_conn->page_vec) {
-                ret = -ENOMEM;
-                goto alloc_err;
-        }
+        if (!ib_conn->page_vec)
+                goto out_err;
+
         ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
 
         params.page_shift        = SHIFT_4K;
@@ -184,7 +195,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
         ib_conn->fmr_pool = ib_create_fmr_pool(device->pd, &params);
         if (IS_ERR(ib_conn->fmr_pool)) {
                 ret = PTR_ERR(ib_conn->fmr_pool);
-                goto fmr_pool_err;
+                ib_conn->fmr_pool = NULL;
+                goto out_err;
         }
 
         memset(&init_attr, 0, sizeof init_attr);
@@ -202,7 +214,7 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 
         ret = rdma_create_qp(ib_conn->cma_id, device->pd, &init_attr);
         if (ret)
-                goto qp_err;
+                goto out_err;
 
         ib_conn->qp = ib_conn->cma_id->qp;
         iser_err("setting conn %p cma_id %p: fmr_pool %p qp %p\n",
@@ -210,12 +222,7 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
                  ib_conn->fmr_pool, ib_conn->cma_id->qp);
         return ret;
 
-qp_err:
-        (void)ib_destroy_fmr_pool(ib_conn->fmr_pool);
-fmr_pool_err:
-        kfree(ib_conn->page_vec);
-        kfree(ib_conn->login_buf);
-alloc_err:
+out_err:
         iser_err("unable to alloc mem or create resource, err %d\n", ret);
         return ret;
 }
@@ -224,7 +231,7 @@ alloc_err:
  * releases the FMR pool, QP and CMA ID objects, returns 0 on success,
  * -1 on failure
  */
-static int iser_free_ib_conn_res(struct iser_conn *ib_conn)
+static int iser_free_ib_conn_res(struct iser_conn *ib_conn, int can_destroy_id)
 {
         BUG_ON(ib_conn == NULL);
 
@@ -239,7 +246,8 @@ static int iser_free_ib_conn_res(struct iser_conn *ib_conn)
         if (ib_conn->qp != NULL)
                 rdma_destroy_qp(ib_conn->cma_id);
 
-        if (ib_conn->cma_id != NULL)
+        /* if cma handler context, the caller acts s.t the cma destroy the id */
+        if (ib_conn->cma_id != NULL && can_destroy_id)
                 rdma_destroy_id(ib_conn->cma_id);
 
         ib_conn->fmr_pool = NULL;
@@ -317,7 +325,7 @@ static int iser_conn_state_comp_exch(struct iser_conn *ib_conn,
 /**
  * Frees all conn objects and deallocs conn descriptor
  */
-static void iser_conn_release(struct iser_conn *ib_conn)
+static void iser_conn_release(struct iser_conn *ib_conn, int can_destroy_id)
 {
         struct iser_device  *device = ib_conn->device;
 
@@ -327,13 +335,11 @@ static void iser_conn_release(struct iser_conn *ib_conn)
         list_del(&ib_conn->conn_list);
         mutex_unlock(&ig.connlist_mutex);
         iser_free_rx_descriptors(ib_conn);
-        iser_free_ib_conn_res(ib_conn);
+        iser_free_ib_conn_res(ib_conn, can_destroy_id);
         ib_conn->device = NULL;
         /* on EVENT_ADDR_ERROR there's no device yet for this conn */
         if (device != NULL)
                 iser_device_try_release(device);
-        if (ib_conn->iser_conn)
-                ib_conn->iser_conn->ib_conn = NULL;
         iscsi_destroy_endpoint(ib_conn->ep);
 }
 
@@ -342,10 +348,13 @@ void iser_conn_get(struct iser_conn *ib_conn)
         atomic_inc(&ib_conn->refcount);
 }
 
-void iser_conn_put(struct iser_conn *ib_conn)
+int iser_conn_put(struct iser_conn *ib_conn, int can_destroy_id)
 {
-        if (atomic_dec_and_test(&ib_conn->refcount))
-                iser_conn_release(ib_conn);
+        if (atomic_dec_and_test(&ib_conn->refcount)) {
+                iser_conn_release(ib_conn, can_destroy_id);
+                return 1;
+        }
+        return 0;
 }
 
 /**
@@ -369,19 +378,20 @@ void iser_conn_terminate(struct iser_conn *ib_conn)
         wait_event_interruptible(ib_conn->wait,
                                  ib_conn->state == ISER_CONN_DOWN);
 
-        iser_conn_put(ib_conn);
+        iser_conn_put(ib_conn, 1); /* deref ib conn deallocate */
 }
 
-static void iser_connect_error(struct rdma_cm_id *cma_id)
+static int iser_connect_error(struct rdma_cm_id *cma_id)
 {
         struct iser_conn *ib_conn;
         ib_conn = (struct iser_conn *)cma_id->context;
 
         ib_conn->state = ISER_CONN_DOWN;
         wake_up_interruptible(&ib_conn->wait);
+        return iser_conn_put(ib_conn, 0); /* deref ib conn's cma id */
 }
 
-static void iser_addr_handler(struct rdma_cm_id *cma_id)
+static int iser_addr_handler(struct rdma_cm_id *cma_id)
 {
         struct iser_device *device;
         struct iser_conn   *ib_conn;
@@ -390,8 +400,7 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
         device = iser_device_find_by_ib_device(cma_id);
         if (!device) {
                 iser_err("device lookup/creation failed\n");
-                iser_connect_error(cma_id);
-                return;
+                return iser_connect_error(cma_id);
         }
 
         ib_conn = (struct iser_conn *)cma_id->context;
@@ -400,11 +409,13 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
         ret = rdma_resolve_route(cma_id, 1000);
         if (ret) {
                 iser_err("resolve route failed: %d\n", ret);
-                iser_connect_error(cma_id);
+                return iser_connect_error(cma_id);
         }
+
+        return 0;
 }
 
-static void iser_route_handler(struct rdma_cm_id *cma_id)
+static int iser_route_handler(struct rdma_cm_id *cma_id)
 {
         struct rdma_conn_param conn_param;
         int    ret;
@@ -425,9 +436,9 @@ static void iser_route_handler(struct rdma_cm_id *cma_id)
                 goto failure;
         }
 
-        return;
+        return 0;
 failure:
-        iser_connect_error(cma_id);
+        return iser_connect_error(cma_id);
 }
 
 static void iser_connected_handler(struct rdma_cm_id *cma_id)
@@ -439,12 +450,12 @@ static void iser_connected_handler(struct rdma_cm_id *cma_id)
         wake_up_interruptible(&ib_conn->wait);
 }
 
-static void iser_disconnected_handler(struct rdma_cm_id *cma_id)
+static int iser_disconnected_handler(struct rdma_cm_id *cma_id)
 {
         struct iser_conn *ib_conn;
+        int ret;
 
         ib_conn = (struct iser_conn *)cma_id->context;
-        ib_conn->disc_evt_flag = 1;
 
         /* getting here when the state is UP means that the conn is being *
          * terminated asynchronously from the iSCSI layer's perspective.  */
@@ -459,20 +470,24 @@ static void iser_disconnected_handler(struct rdma_cm_id *cma_id)
                 ib_conn->state = ISER_CONN_DOWN;
                 wake_up_interruptible(&ib_conn->wait);
         }
+
+        ret = iser_conn_put(ib_conn, 0); /* deref ib conn's cma id */
+        return ret;
 }
 
 static int iser_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 {
         int ret = 0;
 
-        iser_err("event %d conn %p id %p\n",event->event,cma_id->context,cma_id);
+        iser_err("event %d status %d conn %p id %p\n",
+                event->event, event->status, cma_id->context, cma_id);
 
         switch (event->event) {
         case RDMA_CM_EVENT_ADDR_RESOLVED:
-                iser_addr_handler(cma_id);
+                ret = iser_addr_handler(cma_id);
                 break;
         case RDMA_CM_EVENT_ROUTE_RESOLVED:
-                iser_route_handler(cma_id);
+                ret = iser_route_handler(cma_id);
                 break;
         case RDMA_CM_EVENT_ESTABLISHED:
                 iser_connected_handler(cma_id);
@@ -482,13 +497,12 @@ static int iser_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *eve
         case RDMA_CM_EVENT_CONNECT_ERROR:
         case RDMA_CM_EVENT_UNREACHABLE:
         case RDMA_CM_EVENT_REJECTED:
-                iser_err("event: %d, error: %d\n", event->event, event->status);
-                iser_connect_error(cma_id);
+                ret = iser_connect_error(cma_id);
                 break;
         case RDMA_CM_EVENT_DISCONNECTED:
         case RDMA_CM_EVENT_DEVICE_REMOVAL:
         case RDMA_CM_EVENT_ADDR_CHANGE:
-                iser_disconnected_handler(cma_id);
+                ret = iser_disconnected_handler(cma_id);
                 break;
         default:
                 iser_err("Unexpected RDMA CM event (%d)\n", event->event);
@@ -503,7 +517,7 @@ void iser_conn_init(struct iser_conn *ib_conn)
         init_waitqueue_head(&ib_conn->wait);
         ib_conn->post_recv_buf_count = 0;
         atomic_set(&ib_conn->post_send_buf_count, 0);
-        atomic_set(&ib_conn->refcount, 1);
+        atomic_set(&ib_conn->refcount, 1); /* ref ib conn allocation */
         INIT_LIST_HEAD(&ib_conn->conn_list);
         spin_lock_init(&ib_conn->lock);
 }
@@ -531,6 +545,7 @@ int iser_connect(struct iser_conn   *ib_conn,
 
         ib_conn->state = ISER_CONN_PENDING;
 
+        iser_conn_get(ib_conn); /* ref ib conn's cma id */
         ib_conn->cma_id = rdma_create_id(iser_cma_handler,
                                              (void *)ib_conn,
                                              RDMA_PS_TCP);
@@ -568,7 +583,7 @@ id_failure:
 addr_failure:
         ib_conn->state = ISER_CONN_DOWN;
 connect_failure:
-        iser_conn_release(ib_conn);
+        iser_conn_release(ib_conn, 1);
         return err;
 }
 
@@ -737,12 +752,10 @@ static void iser_handle_comp_error(struct iser_tx_desc *desc,
                         iscsi_conn_failure(ib_conn->iser_conn->iscsi_conn,
                                            ISCSI_ERR_CONN_FAILED);
 
-                /* complete the termination process if disconnect event was delivered *
-                 * note there are no more non completed posts to the QP               */
-                if (ib_conn->disc_evt_flag) {
-                        ib_conn->state = ISER_CONN_DOWN;
-                        wake_up_interruptible(&ib_conn->wait);
-                }
+                /* no more non completed posts to the QP, complete the
+                 * termination process w.o worrying on disconnect event */
+                ib_conn->state = ISER_CONN_DOWN;
+                wake_up_interruptible(&ib_conn->wait);
         }
 }
 
diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
index 7e18bcf05a66..46239e47a260 100644
--- a/drivers/input/gameport/gameport.c
+++ b/drivers/input/gameport/gameport.c
@@ -59,11 +59,11 @@ static unsigned int get_time_pit(void)
         unsigned long flags;
         unsigned int count;
 
-        spin_lock_irqsave(&i8253_lock, flags);
+        raw_spin_lock_irqsave(&i8253_lock, flags);
         outb_p(0x00, 0x43);
         count = inb_p(0x40);
         count |= inb_p(0x40) << 8;
-        spin_unlock_irqrestore(&i8253_lock, flags);
+        raw_spin_unlock_irqrestore(&i8253_lock, flags);
 
         return count;
 }
diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c
index 1c0b529c06aa..4afe0a3b4884 100644
--- a/drivers/input/joystick/analog.c
+++ b/drivers/input/joystick/analog.c
@@ -146,11 +146,11 @@ static unsigned int get_time_pit(void)
         unsigned long flags;
         unsigned int count;
 
-        spin_lock_irqsave(&i8253_lock, flags);
+        raw_spin_lock_irqsave(&i8253_lock, flags);
         outb_p(0x00, 0x43);
         count = inb_p(0x40);
         count |= inb_p(0x40) << 8;
-        spin_unlock_irqrestore(&i8253_lock, flags);
+        raw_spin_unlock_irqrestore(&i8253_lock, flags);
 
         return count;
 }
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index b1edd778639c..405febd94f24 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -54,6 +54,9 @@ static signed short btn_avb_wheel[] =
 static signed short abs_joystick[] =
 { ABS_X, ABS_Y, ABS_THROTTLE, ABS_HAT0X, ABS_HAT0Y, -1 };
 
+static signed short abs_joystick_rudder[] =
+{ ABS_X, ABS_Y, ABS_THROTTLE, ABS_RUDDER, ABS_HAT0X, ABS_HAT0Y, -1 };
+
 static signed short abs_avb_pegasus[] =
 { ABS_X, ABS_Y, ABS_THROTTLE, ABS_RUDDER, ABS_HAT0X, ABS_HAT0Y,
   ABS_HAT1X, ABS_HAT1Y, -1 };
@@ -76,8 +79,9 @@ static struct iforce_device iforce_device[] = {
         { 0x061c, 0xc0a4, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce }, //?
         { 0x061c, 0xc084, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce },
         { 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback",       btn_wheel, abs_wheel, ff_iforce }, //?
+        { 0x06f8, 0x0001, "Guillemot Jet Leader Force Feedback",        btn_joystick, abs_joystick_rudder, ff_iforce },
         { 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel",      btn_wheel, abs_wheel, ff_iforce }, //?
-        { 0x06f8, 0x0004, "Gullemot Jet Leader 3D",                     btn_joystick, abs_joystick, ff_iforce }, //?
+        { 0x06f8, 0xa302, "Guillemot Jet Leader 3D",                    btn_joystick, abs_joystick, ff_iforce }, //?
         { 0x06d6, 0x29bc, "Trust Force Feedback Race Master",           btn_wheel, abs_wheel, ff_iforce },
         { 0x0000, 0x0000, "Unknown I-Force Device [%04x:%04x]",         btn_joystick, abs_joystick, ff_iforce }
 };
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index b41303d3ec54..6c96631ae5d9 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -212,6 +212,7 @@ static struct usb_device_id iforce_usb_ids [] = {
         { USB_DEVICE(0x061c, 0xc0a4) },         /* ACT LABS Force RS */
         { USB_DEVICE(0x061c, 0xc084) },         /* ACT LABS Force RS */
         { USB_DEVICE(0x06f8, 0x0001) },         /* Guillemot Race Leader Force Feedback */
+        { USB_DEVICE(0x06f8, 0x0003) },         /* Guillemot Jet Leader Force Feedback */
         { USB_DEVICE(0x06f8, 0x0004) },         /* Guillemot Force Feedback Racing Wheel */
         { USB_DEVICE(0x06f8, 0xa302) },         /* Guillemot Jet Leader 3D */
         { }                                     /* Terminating entry */
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 64c102355f53..a8293388d019 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -143,19 +143,6 @@ config KEYBOARD_BFIN
           To compile this driver as a module, choose M here: the
           module will be called bf54x-keys.
 
-config KEYBOARD_CORGI
-        tristate "Corgi keyboard (deprecated)"
-        depends on PXA_SHARPSL
-        help
-          Say Y here to enable the keyboard on the Sharp Zaurus SL-C7xx
-          series of PDAs.
-
-          This driver is now deprecated, use generic GPIO based matrix
-          keyboard driver instead.
-
-          To compile this driver as a module, choose M here: the
-          module will be called corgikbd.
-
 config KEYBOARD_LKKBD
         tristate "DECstation/VAXstation LK201/LK401 keyboard"
         select SERIO
@@ -339,19 +326,6 @@ config KEYBOARD_PXA930_ROTARY
           To compile this driver as a module, choose M here: the
           module will be called pxa930_rotary.
 
-config KEYBOARD_SPITZ
-        tristate "Spitz keyboard (deprecated)"
-        depends on PXA_SHARPSL
-        help
-          Say Y here to enable the keyboard on the Sharp Zaurus SL-C1000,
-          SL-C3000 and Sl-C3100 series of PDAs.
-
-          This driver is now deprecated, use generic GPIO based matrix
-          keyboard driver instead.
-
-          To compile this driver as a module, choose M here: the
-          module will be called spitzkbd.
-
 config KEYBOARD_STOWAWAY
         tristate "Stowaway keyboard"
         select SERIO
@@ -414,28 +388,6 @@ config KEYBOARD_TWL4030
           To compile this driver as a module, choose M here: the
           module will be called twl4030_keypad.
 
-config KEYBOARD_TOSA
-        tristate "Tosa keyboard (deprecated)"
-        depends on MACH_TOSA
-        help
-          Say Y here to enable the keyboard on the Sharp Zaurus SL-6000x (Tosa)
-
-          This driver is now deprecated, use generic GPIO based matrix
-          keyboard driver instead.
-
-          To compile this driver as a module, choose M here: the
-          module will be called tosakbd.
-
-config KEYBOARD_TOSA_USE_EXT_KEYCODES
-        bool "Tosa keyboard: use extended keycodes"
-        depends on KEYBOARD_TOSA
-        help
-          Say Y here to enable the tosa keyboard driver to generate extended
-          (>= 127) keycodes. Be aware, that they can't be correctly interpreted
-          by either console keyboard driver or by Kdrive keybd driver.
-
-          Say Y only if you know, what you are doing!
-
 config KEYBOARD_XTKBD
         tristate "XT keyboard"
         select SERIO
diff --git a/drivers/input/keyboard/Makefile b/drivers/input/keyboard/Makefile
index 706c6b5ed5f4..9a74127e4d17 100644
--- a/drivers/input/keyboard/Makefile
+++ b/drivers/input/keyboard/Makefile
@@ -11,7 +11,6 @@ obj-$(CONFIG_KEYBOARD_AMIGA)		+= amikbd.o
 obj-$(CONFIG_KEYBOARD_ATARI)            += atakbd.o
 obj-$(CONFIG_KEYBOARD_ATKBD)            += atkbd.o
 obj-$(CONFIG_KEYBOARD_BFIN)             += bf54x-keys.o
-obj-$(CONFIG_KEYBOARD_CORGI)            += corgikbd.o
 obj-$(CONFIG_KEYBOARD_DAVINCI)          += davinci_keyscan.o
 obj-$(CONFIG_KEYBOARD_EP93XX)           += ep93xx_keypad.o
 obj-$(CONFIG_KEYBOARD_GPIO)             += gpio_keys.o
@@ -33,10 +32,8 @@ obj-$(CONFIG_KEYBOARD_PXA27x)		+= pxa27x_keypad.o
 obj-$(CONFIG_KEYBOARD_PXA930_ROTARY)    += pxa930_rotary.o
 obj-$(CONFIG_KEYBOARD_QT2160)           += qt2160.o
 obj-$(CONFIG_KEYBOARD_SH_KEYSC)         += sh_keysc.o
-obj-$(CONFIG_KEYBOARD_SPITZ)            += spitzkbd.o
 obj-$(CONFIG_KEYBOARD_STOWAWAY)         += stowaway.o
 obj-$(CONFIG_KEYBOARD_SUNKBD)           += sunkbd.o
-obj-$(CONFIG_KEYBOARD_TOSA)             += tosakbd.o
 obj-$(CONFIG_KEYBOARD_TWL4030)          += twl4030_keypad.o
 obj-$(CONFIG_KEYBOARD_XTKBD)            += xtkbd.o
 obj-$(CONFIG_KEYBOARD_W90P910)          += w90p910_keypad.o
diff --git a/drivers/input/keyboard/corgikbd.c b/drivers/input/keyboard/corgikbd.c
deleted file mode 100644
index 634af6a8e6b3..000000000000
--- a/drivers/input/keyboard/corgikbd.c
+++ /dev/null
@@ -1,414 +0,0 @@
-/*
- *  Keyboard driver for Sharp Corgi models (SL-C7xx)
- *
- *  Copyright (c) 2004-2005 Richard Purdie
- *
- *  Based on xtkbd.c/locomkbd.c
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 as
- *  published by the Free Software Foundation.
- *
- */
-
-#include <linux/delay.h>
-#include <linux/platform_device.h>
-#include <linux/init.h>
-#include <linux/input.h>
-#include <linux/interrupt.h>
-#include <linux/jiffies.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-
-#include <mach/corgi.h>
-#include <mach/pxa2xx-gpio.h>
-#include <asm/hardware/scoop.h>
-
-#define KB_ROWS                         8
-#define KB_COLS                         12
-#define KB_ROWMASK(r)           (1 << (r))
-#define SCANCODE(r,c)           ( ((r)<<4) + (c) + 1 )
-/* zero code, 124 scancodes */
-#define NR_SCANCODES            ( SCANCODE(KB_ROWS-1,KB_COLS-1) +1 +1 )
-
-#define SCAN_INTERVAL           (50) /* ms */
-#define HINGE_SCAN_INTERVAL     (250) /* ms */
-
-#define CORGI_KEY_CALENDER      KEY_F1
-#define CORGI_KEY_ADDRESS       KEY_F2
-#define CORGI_KEY_FN            KEY_F3
-#define CORGI_KEY_CANCEL        KEY_F4
-#define CORGI_KEY_OFF           KEY_SUSPEND
-#define CORGI_KEY_EXOK          KEY_F5
-#define CORGI_KEY_EXCANCEL      KEY_F6
-#define CORGI_KEY_EXJOGDOWN     KEY_F7
-#define CORGI_KEY_EXJOGUP       KEY_F8
-#define CORGI_KEY_JAP1          KEY_LEFTCTRL
-#define CORGI_KEY_JAP2          KEY_LEFTALT
-#define CORGI_KEY_MAIL          KEY_F10
-#define CORGI_KEY_OK            KEY_F11
-#define CORGI_KEY_MENU          KEY_F12
-
-static unsigned char corgikbd_keycode[NR_SCANCODES] = {
-        0,                                                                                                                /* 0 */
-        0, KEY_1, KEY_3, KEY_5, KEY_6, KEY_7, KEY_9, KEY_0, KEY_BACKSPACE, 0, 0, 0, 0, 0, 0, 0,                               /* 1-16 */
-        0, KEY_2, KEY_4, KEY_R, KEY_Y, KEY_8, KEY_I, KEY_O, KEY_P, 0, 0, 0, 0, 0, 0, 0,                                   /* 17-32 */
-        KEY_TAB, KEY_Q, KEY_E, KEY_T, KEY_G, KEY_U, KEY_J, KEY_K, 0, 0, 0, 0, 0, 0, 0, 0,                                 /* 33-48 */
-        CORGI_KEY_CALENDER, KEY_W, KEY_S, KEY_F, KEY_V, KEY_H, KEY_M, KEY_L, 0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0, 0,         /* 49-64 */
-        CORGI_KEY_ADDRESS, KEY_A, KEY_D, KEY_C, KEY_B, KEY_N, KEY_DOT, 0, KEY_ENTER, 0, KEY_LEFTSHIFT, 0, 0, 0, 0, 0,     /* 65-80 */
-        CORGI_KEY_MAIL, KEY_Z, KEY_X, KEY_MINUS, KEY_SPACE, KEY_COMMA, 0, KEY_UP, 0, 0, 0, CORGI_KEY_FN, 0, 0, 0, 0,            /* 81-96 */
-        KEY_SYSRQ, CORGI_KEY_JAP1, CORGI_KEY_JAP2, CORGI_KEY_CANCEL, CORGI_KEY_OK, CORGI_KEY_MENU, KEY_LEFT, KEY_DOWN, KEY_RIGHT, 0, 0, 0, 0, 0, 0, 0,  /* 97-112 */
-        CORGI_KEY_OFF, CORGI_KEY_EXOK, CORGI_KEY_EXCANCEL, CORGI_KEY_EXJOGDOWN, CORGI_KEY_EXJOGUP, 0, 0, 0, 0, 0, 0, 0,   /* 113-124 */
-};
-
-
-struct corgikbd {
-        unsigned char keycode[ARRAY_SIZE(corgikbd_keycode)];
-        struct input_dev *input;
-
-        spinlock_t lock;
-        struct timer_list timer;
-        struct timer_list htimer;
-
-        unsigned int suspended;
-        unsigned long suspend_jiffies;
-};
-
-#define KB_DISCHARGE_DELAY      10
-#define KB_ACTIVATE_DELAY       10
-
-/* Helper functions for reading the keyboard matrix
- * Note: We should really be using the generic gpio functions to alter
- *       GPDR but it requires a function call per GPIO bit which is
- *       excessive when we need to access 12 bits at once, multiple times.
- * These functions must be called within local_irq_save()/local_irq_restore()
- * or similar.
- */
-static inline void corgikbd_discharge_all(void)
-{
-        /* STROBE All HiZ */
-        GPCR2  = CORGI_GPIO_ALL_STROBE_BIT;
-        GPDR2 &= ~CORGI_GPIO_ALL_STROBE_BIT;
-}
-
-static inline void corgikbd_activate_all(void)
-{
-        /* STROBE ALL -> High */
-        GPSR2  = CORGI_GPIO_ALL_STROBE_BIT;
-        GPDR2 |= CORGI_GPIO_ALL_STROBE_BIT;
-
-        udelay(KB_DISCHARGE_DELAY);
-
-        /* Clear any interrupts we may have triggered when altering the GPIO lines */
-        GEDR1 = CORGI_GPIO_HIGH_SENSE_BIT;
-        GEDR2 = CORGI_GPIO_LOW_SENSE_BIT;
-}
-
-static inline void corgikbd_activate_col(int col)
-{
-        /* STROBE col -> High, not col -> HiZ */
-        GPSR2 = CORGI_GPIO_STROBE_BIT(col);
-        GPDR2 = (GPDR2 & ~CORGI_GPIO_ALL_STROBE_BIT) | CORGI_GPIO_STROBE_BIT(col);
-}
-
-static inline void corgikbd_reset_col(int col)
-{
-        /* STROBE col -> Low */
-        GPCR2 = CORGI_GPIO_STROBE_BIT(col);
-        /* STROBE col -> out, not col -> HiZ */
-        GPDR2 = (GPDR2 & ~CORGI_GPIO_ALL_STROBE_BIT) | CORGI_GPIO_STROBE_BIT(col);
-}
-
-#define GET_ROWS_STATUS(c)      (((GPLR1 & CORGI_GPIO_HIGH_SENSE_BIT) >> CORGI_GPIO_HIGH_SENSE_RSHIFT) | ((GPLR2 & CORGI_GPIO_LOW_SENSE_BIT) << CORGI_GPIO_LOW_SENSE_LSHIFT))
-
-/*
- * The corgi keyboard only generates interrupts when a key is pressed.
- * When a key is pressed, we enable a timer which then scans the
- * keyboard to detect when the key is released.
- */
-
-/* Scan the hardware keyboard and push any changes up through the input layer */
-static void corgikbd_scankeyboard(struct corgikbd *corgikbd_data)
-{
-        unsigned int row, col, rowd;
-        unsigned long flags;
-        unsigned int num_pressed;
-
-        if (corgikbd_data->suspended)
-                return;
-
-        spin_lock_irqsave(&corgikbd_data->lock, flags);
-
-        num_pressed = 0;
-        for (col = 0; col < KB_COLS; col++) {
-                /*
-                 * Discharge the output driver capacitatance
-                 * in the keyboard matrix. (Yes it is significant..)
-                 */
-
-                corgikbd_discharge_all();
-                udelay(KB_DISCHARGE_DELAY);
-
-                corgikbd_activate_col(col);
-                udelay(KB_ACTIVATE_DELAY);
-
-                rowd = GET_ROWS_STATUS(col);
-                for (row = 0; row < KB_ROWS; row++) {
-                        unsigned int scancode, pressed;
-
-                        scancode = SCANCODE(row, col);
-                        pressed = rowd & KB_ROWMASK(row);
-
-                        input_report_key(corgikbd_data->input, corgikbd_data->keycode[scancode], pressed);
-
-                        if (pressed)
-                                num_pressed++;
-
-                        if (pressed && (corgikbd_data->keycode[scancode] == CORGI_KEY_OFF)
-                                        && time_after(jiffies, corgikbd_data->suspend_jiffies + HZ)) {
-                                input_event(corgikbd_data->input, EV_PWR, CORGI_KEY_OFF, 1);
-                                corgikbd_data->suspend_jiffies=jiffies;
-                        }
-                }
-                corgikbd_reset_col(col);
-        }
-
-        corgikbd_activate_all();
-
-        input_sync(corgikbd_data->input);
-
-        /* if any keys are pressed, enable the timer */
-        if (num_pressed)
-                mod_timer(&corgikbd_data->timer, jiffies + msecs_to_jiffies(SCAN_INTERVAL));
-
-        spin_unlock_irqrestore(&corgikbd_data->lock, flags);
-}
-
-/*
- * corgi keyboard interrupt handler.
- */
-static irqreturn_t corgikbd_interrupt(int irq, void *dev_id)
-{
-        struct corgikbd *corgikbd_data = dev_id;
-
-        if (!timer_pending(&corgikbd_data->timer)) {
-                /** wait chattering delay **/
-                udelay(20);
-                corgikbd_scankeyboard(corgikbd_data);
-        }
-
-        return IRQ_HANDLED;
-}
-
-/*
- * corgi timer checking for released keys
- */
-static void corgikbd_timer_callback(unsigned long data)
-{
-        struct corgikbd *corgikbd_data = (struct corgikbd *) data;
-        corgikbd_scankeyboard(corgikbd_data);
-}
-
-/*
- * The hinge switches generate no interrupt so they need to be
- * monitored by a timer.
- *
- * We debounce the switches and pass them to the input system.
- *
- *  gprr == 0x00 - Keyboard with Landscape Screen
- *          0x08 - No Keyboard with Portrait Screen
- *          0x0c - Keyboard and Screen Closed
- */
-
-#define READ_GPIO_BIT(x)    (GPLR(x) & GPIO_bit(x))
-#define HINGE_STABLE_COUNT 2
-static int sharpsl_hinge_state;
-static int hinge_count;
-
-static void corgikbd_hinge_timer(unsigned long data)
-{
-        struct corgikbd *corgikbd_data = (struct corgikbd *) data;
-        unsigned long gprr;
-        unsigned long flags;
-
-        gprr = read_scoop_reg(&corgiscoop_device.dev, SCOOP_GPRR) & (CORGI_SCP_SWA | CORGI_SCP_SWB);
-        gprr |= (READ_GPIO_BIT(CORGI_GPIO_AK_INT) != 0);
-        if (gprr != sharpsl_hinge_state) {
-                hinge_count = 0;
-                sharpsl_hinge_state = gprr;
-        } else if (hinge_count < HINGE_STABLE_COUNT) {
-                hinge_count++;
-                if (hinge_count >= HINGE_STABLE_COUNT) {
-                        spin_lock_irqsave(&corgikbd_data->lock, flags);
-
-                        input_report_switch(corgikbd_data->input, SW_LID, ((sharpsl_hinge_state & CORGI_SCP_SWA) != 0));
-                        input_report_switch(corgikbd_data->input, SW_TABLET_MODE, ((sharpsl_hinge_state & CORGI_SCP_SWB) != 0));
-                        input_report_switch(corgikbd_data->input, SW_HEADPHONE_INSERT, (READ_GPIO_BIT(CORGI_GPIO_AK_INT) != 0));
-                        input_sync(corgikbd_data->input);
-
-                        spin_unlock_irqrestore(&corgikbd_data->lock, flags);
-                }
-        }
-        mod_timer(&corgikbd_data->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
-}
-
-#ifdef CONFIG_PM
-static int corgikbd_suspend(struct platform_device *dev, pm_message_t state)
-{
-        int i;
-        struct corgikbd *corgikbd = platform_get_drvdata(dev);
-
-        corgikbd->suspended = 1;
-        /* strobe 0 is the power key so this can't be made an input for
-           powersaving therefore i = 1 */
-        for (i = 1; i < CORGI_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(CORGI_GPIO_KEY_STROBE(i) | GPIO_IN);
-
-        return 0;
-}
-
-static int corgikbd_resume(struct platform_device *dev)
-{
-        int i;
-        struct corgikbd *corgikbd = platform_get_drvdata(dev);
-
-        for (i = 1; i < CORGI_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(CORGI_GPIO_KEY_STROBE(i) | GPIO_OUT | GPIO_DFLT_HIGH);
-
-        /* Upon resume, ignore the suspend key for a short while */
-        corgikbd->suspend_jiffies=jiffies;
-        corgikbd->suspended = 0;
-
-        return 0;
-}
-#else
-#define corgikbd_suspend        NULL
-#define corgikbd_resume         NULL
-#endif
-
-static int __devinit corgikbd_probe(struct platform_device *pdev)
-{
-        struct corgikbd *corgikbd;
-        struct input_dev *input_dev;
-        int i, err = -ENOMEM;
-
-        corgikbd = kzalloc(sizeof(struct corgikbd), GFP_KERNEL);
-        input_dev = input_allocate_device();
-        if (!corgikbd || !input_dev)
-                goto fail;
-
-        platform_set_drvdata(pdev, corgikbd);
-
-        corgikbd->input = input_dev;
-        spin_lock_init(&corgikbd->lock);
-
-        /* Init Keyboard rescan timer */
-        init_timer(&corgikbd->timer);
-        corgikbd->timer.function = corgikbd_timer_callback;
-        corgikbd->timer.data = (unsigned long) corgikbd;
-
-        /* Init Hinge Timer */
-        init_timer(&corgikbd->htimer);
-        corgikbd->htimer.function = corgikbd_hinge_timer;
-        corgikbd->htimer.data = (unsigned long) corgikbd;
-
-        corgikbd->suspend_jiffies=jiffies;
-
-        memcpy(corgikbd->keycode, corgikbd_keycode, sizeof(corgikbd->keycode));
-
-        input_dev->name = "Corgi Keyboard";
-        input_dev->phys = "corgikbd/input0";
-        input_dev->id.bustype = BUS_HOST;
-        input_dev->id.vendor = 0x0001;
-        input_dev->id.product = 0x0001;
-        input_dev->id.version = 0x0100;
-        input_dev->dev.parent = &pdev->dev;
-
-        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP) |
-                BIT_MASK(EV_PWR) | BIT_MASK(EV_SW);
-        input_dev->keycode = corgikbd->keycode;
-        input_dev->keycodesize = sizeof(unsigned char);
-        input_dev->keycodemax = ARRAY_SIZE(corgikbd_keycode);
-
-        for (i = 0; i < ARRAY_SIZE(corgikbd_keycode); i++)
-                set_bit(corgikbd->keycode[i], input_dev->keybit);
-        clear_bit(0, input_dev->keybit);
-        set_bit(SW_LID, input_dev->swbit);
-        set_bit(SW_TABLET_MODE, input_dev->swbit);
-        set_bit(SW_HEADPHONE_INSERT, input_dev->swbit);
-
-        err = input_register_device(corgikbd->input);
-        if (err)
-                goto fail;
-
-        mod_timer(&corgikbd->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
-
-        /* Setup sense interrupts - RisingEdge Detect, sense lines as inputs */
-        for (i = 0; i < CORGI_KEY_SENSE_NUM; i++) {
-                pxa_gpio_mode(CORGI_GPIO_KEY_SENSE(i) | GPIO_IN);
-                if (request_irq(CORGI_IRQ_GPIO_KEY_SENSE(i), corgikbd_interrupt,
-                                IRQF_DISABLED | IRQF_TRIGGER_RISING,
-                                "corgikbd", corgikbd))
-                        printk(KERN_WARNING "corgikbd: Can't get IRQ: %d!\n", i);
-        }
-
-        /* Set Strobe lines as outputs - set high */
-        for (i = 0; i < CORGI_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(CORGI_GPIO_KEY_STROBE(i) | GPIO_OUT | GPIO_DFLT_HIGH);
-
-        /* Setup the headphone jack as an input */
-        pxa_gpio_mode(CORGI_GPIO_AK_INT | GPIO_IN);
-
-        return 0;
-
- fail:  input_free_device(input_dev);
-        kfree(corgikbd);
-        return err;
-}
-
-static int __devexit corgikbd_remove(struct platform_device *pdev)
-{
-        int i;
-        struct corgikbd *corgikbd = platform_get_drvdata(pdev);
-
-        for (i = 0; i < CORGI_KEY_SENSE_NUM; i++)
-                free_irq(CORGI_IRQ_GPIO_KEY_SENSE(i), corgikbd);
-
-        del_timer_sync(&corgikbd->htimer);
-        del_timer_sync(&corgikbd->timer);
-
-        input_unregister_device(corgikbd->input);
-
-        kfree(corgikbd);
-
-        return 0;
-}
-
-static struct platform_driver corgikbd_driver = {
-        .probe          = corgikbd_probe,
-        .remove         = __devexit_p(corgikbd_remove),
-        .suspend        = corgikbd_suspend,
-        .resume         = corgikbd_resume,
-        .driver         = {
-                .name   = "corgi-keyboard",
-                .owner  = THIS_MODULE,
-        },
-};
-
-static int __init corgikbd_init(void)
-{
-        return platform_driver_register(&corgikbd_driver);
-}
-
-static void __exit corgikbd_exit(void)
-{
-        platform_driver_unregister(&corgikbd_driver);
-}
-
-module_init(corgikbd_init);
-module_exit(corgikbd_exit);
-
-MODULE_AUTHOR("Richard Purdie <rpurdie@rpsys.net>");
-MODULE_DESCRIPTION("Corgi Keyboard Driver");
-MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:corgi-keyboard");
diff --git a/drivers/input/keyboard/spitzkbd.c b/drivers/input/keyboard/spitzkbd.c
deleted file mode 100644
index 13967422658c..000000000000
--- a/drivers/input/keyboard/spitzkbd.c
+++ /dev/null
@@ -1,496 +0,0 @@
-/*
- *  Keyboard driver for Sharp Spitz, Borzoi and Akita (SL-Cxx00 series)
- *
- *  Copyright (c) 2005 Richard Purdie
- *
- *  Based on corgikbd.c
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 as
- *  published by the Free Software Foundation.
- *
- */
-
-#include <linux/delay.h>
-#include <linux/platform_device.h>
-#include <linux/init.h>
-#include <linux/input.h>
-#include <linux/interrupt.h>
-#include <linux/jiffies.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-
-#include <mach/spitz.h>
-#include <mach/pxa2xx-gpio.h>
-
-#define KB_ROWS                 7
-#define KB_COLS                 11
-#define KB_ROWMASK(r)           (1 << (r))
-#define SCANCODE(r,c)           (((r)<<4) + (c) + 1)
-#define NR_SCANCODES            ((KB_ROWS<<4) + 1)
-
-#define SCAN_INTERVAL           (50) /* ms */
-#define HINGE_SCAN_INTERVAL     (150) /* ms */
-
-#define SPITZ_KEY_CALENDER      KEY_F1
-#define SPITZ_KEY_ADDRESS       KEY_F2
-#define SPITZ_KEY_FN            KEY_F3
-#define SPITZ_KEY_CANCEL        KEY_F4
-#define SPITZ_KEY_EXOK          KEY_F5
-#define SPITZ_KEY_EXCANCEL      KEY_F6
-#define SPITZ_KEY_EXJOGDOWN     KEY_F7
-#define SPITZ_KEY_EXJOGUP       KEY_F8
-#define SPITZ_KEY_JAP1          KEY_LEFTALT
-#define SPITZ_KEY_JAP2          KEY_RIGHTCTRL
-#define SPITZ_KEY_SYNC          KEY_F9
-#define SPITZ_KEY_MAIL          KEY_F10
-#define SPITZ_KEY_OK            KEY_F11
-#define SPITZ_KEY_MENU          KEY_F12
-
-static unsigned char spitzkbd_keycode[NR_SCANCODES] = {
-        0,                                                                                                                /* 0 */
-        KEY_LEFTCTRL, KEY_1, KEY_3, KEY_5, KEY_6, KEY_7, KEY_9, KEY_0, KEY_BACKSPACE, SPITZ_KEY_EXOK, SPITZ_KEY_EXCANCEL, 0, 0, 0, 0, 0,  /* 1-16 */
-        0, KEY_2, KEY_4, KEY_R, KEY_Y, KEY_8, KEY_I, KEY_O, KEY_P, SPITZ_KEY_EXJOGDOWN, SPITZ_KEY_EXJOGUP, 0, 0, 0, 0, 0, /* 17-32 */
-        KEY_TAB, KEY_Q, KEY_E, KEY_T, KEY_G, KEY_U, KEY_J, KEY_K, 0, 0, 0, 0, 0, 0, 0, 0,                                 /* 33-48 */
-        SPITZ_KEY_ADDRESS, KEY_W, KEY_S, KEY_F, KEY_V, KEY_H, KEY_M, KEY_L, 0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0, 0,         /* 49-64 */
-        SPITZ_KEY_CALENDER, KEY_A, KEY_D, KEY_C, KEY_B, KEY_N, KEY_DOT, 0, KEY_ENTER, KEY_LEFTSHIFT, 0, 0, 0, 0, 0, 0,    /* 65-80 */
-        SPITZ_KEY_MAIL, KEY_Z, KEY_X, KEY_MINUS, KEY_SPACE, KEY_COMMA, 0, KEY_UP, 0, 0, SPITZ_KEY_FN, 0, 0, 0, 0, 0,      /* 81-96 */
-        KEY_SYSRQ, SPITZ_KEY_JAP1, SPITZ_KEY_JAP2, SPITZ_KEY_CANCEL, SPITZ_KEY_OK, SPITZ_KEY_MENU, KEY_LEFT, KEY_DOWN, KEY_RIGHT, 0, 0, 0, 0, 0, 0, 0  /* 97-112 */
-};
-
-static int spitz_strobes[] = {
-        SPITZ_GPIO_KEY_STROBE0,
-        SPITZ_GPIO_KEY_STROBE1,
-        SPITZ_GPIO_KEY_STROBE2,
-        SPITZ_GPIO_KEY_STROBE3,
-        SPITZ_GPIO_KEY_STROBE4,
-        SPITZ_GPIO_KEY_STROBE5,
-        SPITZ_GPIO_KEY_STROBE6,
-        SPITZ_GPIO_KEY_STROBE7,
-        SPITZ_GPIO_KEY_STROBE8,
-        SPITZ_GPIO_KEY_STROBE9,
-        SPITZ_GPIO_KEY_STROBE10,
-};
-
-static int spitz_senses[] = {
-        SPITZ_GPIO_KEY_SENSE0,
-        SPITZ_GPIO_KEY_SENSE1,
-        SPITZ_GPIO_KEY_SENSE2,
-        SPITZ_GPIO_KEY_SENSE3,
-        SPITZ_GPIO_KEY_SENSE4,
-        SPITZ_GPIO_KEY_SENSE5,
-        SPITZ_GPIO_KEY_SENSE6,
-};
-
-struct spitzkbd {
-        unsigned char keycode[ARRAY_SIZE(spitzkbd_keycode)];
-        struct input_dev *input;
-        char phys[32];
-
-        spinlock_t lock;
-        struct timer_list timer;
-        struct timer_list htimer;
-
-        unsigned int suspended;
-        unsigned long suspend_jiffies;
-};
-
-#define KB_DISCHARGE_DELAY      10
-#define KB_ACTIVATE_DELAY       10
-
-/* Helper functions for reading the keyboard matrix
- * Note: We should really be using the generic gpio functions to alter
- *       GPDR but it requires a function call per GPIO bit which is
- *       excessive when we need to access 11 bits at once, multiple times.
- * These functions must be called within local_irq_save()/local_irq_restore()
- * or similar.
- */
-static inline void spitzkbd_discharge_all(void)
-{
-        /* STROBE All HiZ */
-        GPCR0  =  SPITZ_GPIO_G0_STROBE_BIT;
-        GPDR0 &= ~SPITZ_GPIO_G0_STROBE_BIT;
-        GPCR1  =  SPITZ_GPIO_G1_STROBE_BIT;
-        GPDR1 &= ~SPITZ_GPIO_G1_STROBE_BIT;
-        GPCR2  =  SPITZ_GPIO_G2_STROBE_BIT;
-        GPDR2 &= ~SPITZ_GPIO_G2_STROBE_BIT;
-        GPCR3  =  SPITZ_GPIO_G3_STROBE_BIT;
-        GPDR3 &= ~SPITZ_GPIO_G3_STROBE_BIT;
-}
-
-static inline void spitzkbd_activate_all(void)
-{
-        /* STROBE ALL -> High */
-        GPSR0  =  SPITZ_GPIO_G0_STROBE_BIT;
-        GPDR0 |=  SPITZ_GPIO_G0_STROBE_BIT;
-        GPSR1  =  SPITZ_GPIO_G1_STROBE_BIT;
-        GPDR1 |=  SPITZ_GPIO_G1_STROBE_BIT;
-        GPSR2  =  SPITZ_GPIO_G2_STROBE_BIT;
-        GPDR2 |=  SPITZ_GPIO_G2_STROBE_BIT;
-        GPSR3  =  SPITZ_GPIO_G3_STROBE_BIT;
-        GPDR3 |=  SPITZ_GPIO_G3_STROBE_BIT;
-
-        udelay(KB_DISCHARGE_DELAY);
-
-        /* Clear any interrupts we may have triggered when altering the GPIO lines */
-        GEDR0 = SPITZ_GPIO_G0_SENSE_BIT;
-        GEDR1 = SPITZ_GPIO_G1_SENSE_BIT;
-        GEDR2 = SPITZ_GPIO_G2_SENSE_BIT;
-        GEDR3 = SPITZ_GPIO_G3_SENSE_BIT;
-}
-
-static inline void spitzkbd_activate_col(int col)
-{
-        int gpio = spitz_strobes[col];
-        GPDR0 &= ~SPITZ_GPIO_G0_STROBE_BIT;
-        GPDR1 &= ~SPITZ_GPIO_G1_STROBE_BIT;
-        GPDR2 &= ~SPITZ_GPIO_G2_STROBE_BIT;
-        GPDR3 &= ~SPITZ_GPIO_G3_STROBE_BIT;
-        GPSR(gpio) = GPIO_bit(gpio);
-        GPDR(gpio) |= GPIO_bit(gpio);
-}
-
-static inline void spitzkbd_reset_col(int col)
-{
-        int gpio = spitz_strobes[col];
-        GPDR0 &= ~SPITZ_GPIO_G0_STROBE_BIT;
-        GPDR1 &= ~SPITZ_GPIO_G1_STROBE_BIT;
-        GPDR2 &= ~SPITZ_GPIO_G2_STROBE_BIT;
-        GPDR3 &= ~SPITZ_GPIO_G3_STROBE_BIT;
-        GPCR(gpio) = GPIO_bit(gpio);
-        GPDR(gpio) |= GPIO_bit(gpio);
-}
-
-static inline int spitzkbd_get_row_status(int col)
-{
-        return ((GPLR0 >> 12) & 0x01) | ((GPLR0 >> 16) & 0x02)
-                | ((GPLR2 >> 25) & 0x04) | ((GPLR1 << 1) & 0x08)
-                | ((GPLR1 >> 0) & 0x10) | ((GPLR1 >> 1) & 0x60);
-}
-
-/*
- * The spitz keyboard only generates interrupts when a key is pressed.
- * When a key is pressed, we enable a timer which then scans the
- * keyboard to detect when the key is released.
- */
-
-/* Scan the hardware keyboard and push any changes up through the input layer */
-static void spitzkbd_scankeyboard(struct spitzkbd *spitzkbd_data)
-{
-        unsigned int row, col, rowd;
-        unsigned long flags;
-        unsigned int num_pressed, pwrkey = ((GPLR(SPITZ_GPIO_ON_KEY) & GPIO_bit(SPITZ_GPIO_ON_KEY)) != 0);
-
-        if (spitzkbd_data->suspended)
-                return;
-
-        spin_lock_irqsave(&spitzkbd_data->lock, flags);
-
-        num_pressed = 0;
-        for (col = 0; col < KB_COLS; col++) {
-                /*
-                 * Discharge the output driver capacitatance
-                 * in the keyboard matrix. (Yes it is significant..)
-                 */
-
-                spitzkbd_discharge_all();
-                udelay(KB_DISCHARGE_DELAY);
-
-                spitzkbd_activate_col(col);
-                udelay(KB_ACTIVATE_DELAY);
-
-                rowd = spitzkbd_get_row_status(col);
-                for (row = 0; row < KB_ROWS; row++) {
-                        unsigned int scancode, pressed;
-
-                        scancode = SCANCODE(row, col);
-                        pressed = rowd & KB_ROWMASK(row);
-
-                        input_report_key(spitzkbd_data->input, spitzkbd_data->keycode[scancode], pressed);
-
-                        if (pressed)
-                                num_pressed++;
-                }
-                spitzkbd_reset_col(col);
-        }
-
-        spitzkbd_activate_all();
-
-        input_report_key(spitzkbd_data->input, SPITZ_KEY_SYNC, (GPLR(SPITZ_GPIO_SYNC) & GPIO_bit(SPITZ_GPIO_SYNC)) != 0 );
-        input_report_key(spitzkbd_data->input, KEY_SUSPEND, pwrkey);
-
-        if (pwrkey && time_after(jiffies, spitzkbd_data->suspend_jiffies + msecs_to_jiffies(1000))) {
-                input_event(spitzkbd_data->input, EV_PWR, KEY_SUSPEND, 1);
-                spitzkbd_data->suspend_jiffies = jiffies;
-        }
-
-        input_sync(spitzkbd_data->input);
-
-        /* if any keys are pressed, enable the timer */
-        if (num_pressed)
-                mod_timer(&spitzkbd_data->timer, jiffies + msecs_to_jiffies(SCAN_INTERVAL));
-
-        spin_unlock_irqrestore(&spitzkbd_data->lock, flags);
-}
-
-/*
- * spitz keyboard interrupt handler.
- */
-static irqreturn_t spitzkbd_interrupt(int irq, void *dev_id)
-{
-        struct spitzkbd *spitzkbd_data = dev_id;
-
-        if (!timer_pending(&spitzkbd_data->timer)) {
-                /** wait chattering delay **/
-                udelay(20);
-                spitzkbd_scankeyboard(spitzkbd_data);
-        }
-
-        return IRQ_HANDLED;
-}
-
-/*
- * spitz timer checking for released keys
- */
-static void spitzkbd_timer_callback(unsigned long data)
-{
-        struct spitzkbd *spitzkbd_data = (struct spitzkbd *) data;
-
-        spitzkbd_scankeyboard(spitzkbd_data);
-}
-
-/*
- * The hinge switches generate an interrupt.
- * We debounce the switches and pass them to the input system.
- */
-
-static irqreturn_t spitzkbd_hinge_isr(int irq, void *dev_id)
-{
-        struct spitzkbd *spitzkbd_data = dev_id;
-
-        if (!timer_pending(&spitzkbd_data->htimer))
-                mod_timer(&spitzkbd_data->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
-
-        return IRQ_HANDLED;
-}
-
-#define HINGE_STABLE_COUNT 2
-static int sharpsl_hinge_state;
-static int hinge_count;
-
-static void spitzkbd_hinge_timer(unsigned long data)
-{
-        struct spitzkbd *spitzkbd_data = (struct spitzkbd *) data;
-        unsigned long state;
-        unsigned long flags;
-
-        state = GPLR(SPITZ_GPIO_SWA) & (GPIO_bit(SPITZ_GPIO_SWA)|GPIO_bit(SPITZ_GPIO_SWB));
-        state |= (GPLR(SPITZ_GPIO_AK_INT) & GPIO_bit(SPITZ_GPIO_AK_INT));
-        if (state != sharpsl_hinge_state) {
-                hinge_count = 0;
-                sharpsl_hinge_state = state;
-        } else if (hinge_count < HINGE_STABLE_COUNT) {
-                hinge_count++;
-        }
-
-        if (hinge_count >= HINGE_STABLE_COUNT) {
-                spin_lock_irqsave(&spitzkbd_data->lock, flags);
-
-                input_report_switch(spitzkbd_data->input, SW_LID, ((GPLR(SPITZ_GPIO_SWA) & GPIO_bit(SPITZ_GPIO_SWA)) != 0));
-                input_report_switch(spitzkbd_data->input, SW_TABLET_MODE, ((GPLR(SPITZ_GPIO_SWB) & GPIO_bit(SPITZ_GPIO_SWB)) != 0));
-                input_report_switch(spitzkbd_data->input, SW_HEADPHONE_INSERT, ((GPLR(SPITZ_GPIO_AK_INT) & GPIO_bit(SPITZ_GPIO_AK_INT)) != 0));
-                input_sync(spitzkbd_data->input);
-
-                spin_unlock_irqrestore(&spitzkbd_data->lock, flags);
-        } else {
-                mod_timer(&spitzkbd_data->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
-        }
-}
-
-#ifdef CONFIG_PM
-static int spitzkbd_suspend(struct platform_device *dev, pm_message_t state)
-{
-        int i;
-        struct spitzkbd *spitzkbd = platform_get_drvdata(dev);
-        spitzkbd->suspended = 1;
-
-        /* Set Strobe lines as inputs - *except* strobe line 0 leave this
-           enabled so we can detect a power button press for resume */
-        for (i = 1; i < SPITZ_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(spitz_strobes[i] | GPIO_IN);
-
-        return 0;
-}
-
-static int spitzkbd_resume(struct platform_device *dev)
-{
-        int i;
-        struct spitzkbd *spitzkbd = platform_get_drvdata(dev);
-
-        for (i = 0; i < SPITZ_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(spitz_strobes[i] | GPIO_OUT | GPIO_DFLT_HIGH);
-
-        /* Upon resume, ignore the suspend key for a short while */
-        spitzkbd->suspend_jiffies = jiffies;
-        spitzkbd->suspended = 0;
-
-        return 0;
-}
-#else
-#define spitzkbd_suspend        NULL
-#define spitzkbd_resume         NULL
-#endif
-
-static int __devinit spitzkbd_probe(struct platform_device *dev)
-{
-        struct spitzkbd *spitzkbd;
-        struct input_dev *input_dev;
-        int i, err = -ENOMEM;
-
-        spitzkbd = kzalloc(sizeof(struct spitzkbd), GFP_KERNEL);
-        input_dev = input_allocate_device();
-        if (!spitzkbd || !input_dev)
-                goto fail;
-
-        platform_set_drvdata(dev, spitzkbd);
-        strcpy(spitzkbd->phys, "spitzkbd/input0");
-
-        spin_lock_init(&spitzkbd->lock);
-
-        /* Init Keyboard rescan timer */
-        init_timer(&spitzkbd->timer);
-        spitzkbd->timer.function = spitzkbd_timer_callback;
-        spitzkbd->timer.data = (unsigned long) spitzkbd;
-
-        /* Init Hinge Timer */
-        init_timer(&spitzkbd->htimer);
-        spitzkbd->htimer.function = spitzkbd_hinge_timer;
-        spitzkbd->htimer.data = (unsigned long) spitzkbd;
-
-        spitzkbd->suspend_jiffies = jiffies;
-
-        spitzkbd->input = input_dev;
-
-        input_dev->name = "Spitz Keyboard";
-        input_dev->phys = spitzkbd->phys;
-        input_dev->dev.parent = &dev->dev;
-
-        input_dev->id.bustype = BUS_HOST;
-        input_dev->id.vendor = 0x0001;
-        input_dev->id.product = 0x0001;
-        input_dev->id.version = 0x0100;
-
-        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP) |
-                BIT_MASK(EV_PWR) | BIT_MASK(EV_SW);
-        input_dev->keycode = spitzkbd->keycode;
-        input_dev->keycodesize = sizeof(unsigned char);
-        input_dev->keycodemax = ARRAY_SIZE(spitzkbd_keycode);
-
-        memcpy(spitzkbd->keycode, spitzkbd_keycode, sizeof(spitzkbd->keycode));
-        for (i = 0; i < ARRAY_SIZE(spitzkbd_keycode); i++)
-                set_bit(spitzkbd->keycode[i], input_dev->keybit);
-        clear_bit(0, input_dev->keybit);
-        set_bit(KEY_SUSPEND, input_dev->keybit);
-        set_bit(SW_LID, input_dev->swbit);
-        set_bit(SW_TABLET_MODE, input_dev->swbit);
-        set_bit(SW_HEADPHONE_INSERT, input_dev->swbit);
-
-        err = input_register_device(input_dev);
-        if (err)
-                goto fail;
-
-        mod_timer(&spitzkbd->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
-
-        /* Setup sense interrupts - RisingEdge Detect, sense lines as inputs */
-        for (i = 0; i < SPITZ_KEY_SENSE_NUM; i++) {
-                pxa_gpio_mode(spitz_senses[i] | GPIO_IN);
-                if (request_irq(IRQ_GPIO(spitz_senses[i]), spitzkbd_interrupt,
-                                IRQF_DISABLED|IRQF_TRIGGER_RISING,
-                                "Spitzkbd Sense", spitzkbd))
-                        printk(KERN_WARNING "spitzkbd: Can't get Sense IRQ: %d!\n", i);
-        }
-
-        /* Set Strobe lines as outputs - set high */
-        for (i = 0; i < SPITZ_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(spitz_strobes[i] | GPIO_OUT | GPIO_DFLT_HIGH);
-
-        pxa_gpio_mode(SPITZ_GPIO_SYNC | GPIO_IN);
-        pxa_gpio_mode(SPITZ_GPIO_ON_KEY | GPIO_IN);
-        pxa_gpio_mode(SPITZ_GPIO_SWA | GPIO_IN);
-        pxa_gpio_mode(SPITZ_GPIO_SWB | GPIO_IN);
-
-        request_irq(SPITZ_IRQ_GPIO_SYNC, spitzkbd_interrupt,
-                    IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                    "Spitzkbd Sync", spitzkbd);
-        request_irq(SPITZ_IRQ_GPIO_ON_KEY, spitzkbd_interrupt,
-                    IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                    "Spitzkbd PwrOn", spitzkbd);
-        request_irq(SPITZ_IRQ_GPIO_SWA, spitzkbd_hinge_isr,
-                    IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                    "Spitzkbd SWA", spitzkbd);
-        request_irq(SPITZ_IRQ_GPIO_SWB, spitzkbd_hinge_isr,
-                    IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                    "Spitzkbd SWB", spitzkbd);
-        request_irq(SPITZ_IRQ_GPIO_AK_INT, spitzkbd_hinge_isr,
-                    IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                    "Spitzkbd HP", spitzkbd);
-
-        return 0;
-
- fail:  input_free_device(input_dev);
-        kfree(spitzkbd);
-        return err;
-}
-
-static int __devexit spitzkbd_remove(struct platform_device *dev)
-{
-        int i;
-        struct spitzkbd *spitzkbd = platform_get_drvdata(dev);
-
-        for (i = 0; i < SPITZ_KEY_SENSE_NUM; i++)
-                free_irq(IRQ_GPIO(spitz_senses[i]), spitzkbd);
-
-        free_irq(SPITZ_IRQ_GPIO_SYNC, spitzkbd);
-        free_irq(SPITZ_IRQ_GPIO_ON_KEY, spitzkbd);
-        free_irq(SPITZ_IRQ_GPIO_SWA, spitzkbd);
-        free_irq(SPITZ_IRQ_GPIO_SWB, spitzkbd);
-        free_irq(SPITZ_IRQ_GPIO_AK_INT, spitzkbd);
-
-        del_timer_sync(&spitzkbd->htimer);
-        del_timer_sync(&spitzkbd->timer);
-
-        input_unregister_device(spitzkbd->input);
-
-        kfree(spitzkbd);
-
-        return 0;
-}
-
-static struct platform_driver spitzkbd_driver = {
-        .probe          = spitzkbd_probe,
-        .remove         = __devexit_p(spitzkbd_remove),
-        .suspend        = spitzkbd_suspend,
-        .resume         = spitzkbd_resume,
-        .driver         = {
-                .name   = "spitz-keyboard",
-                .owner  = THIS_MODULE,
-        },
-};
-
-static int __init spitzkbd_init(void)
-{
-        return platform_driver_register(&spitzkbd_driver);
-}
-
-static void __exit spitzkbd_exit(void)
-{
-        platform_driver_unregister(&spitzkbd_driver);
-}
-
-module_init(spitzkbd_init);
-module_exit(spitzkbd_exit);
-
-MODULE_AUTHOR("Richard Purdie <rpurdie@rpsys.net>");
-MODULE_DESCRIPTION("Spitz Keyboard Driver");
-MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:spitz-keyboard");
diff --git a/drivers/input/keyboard/tosakbd.c b/drivers/input/keyboard/tosakbd.c
deleted file mode 100644
index 3910f269cfc8..000000000000
--- a/drivers/input/keyboard/tosakbd.c
+++ /dev/null
@@ -1,431 +0,0 @@
-/*
- *  Keyboard driver for Sharp Tosa models (SL-6000x)
- *
- *  Copyright (c) 2005 Dirk Opfer
- *  Copyright (c) 2007 Dmitry Baryshkov
- *
- *  Based on xtkbd.c/locomkbd.c/corgikbd.c
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 as
- *  published by the Free Software Foundation.
- *
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/input.h>
-#include <linux/delay.h>
-#include <linux/interrupt.h>
-#include <linux/slab.h>
-
-#include <mach/gpio.h>
-#include <mach/tosa.h>
-
-#define KB_ROWMASK(r)           (1 << (r))
-#define SCANCODE(r, c)          (((r)<<4) + (c) + 1)
-#define NR_SCANCODES            SCANCODE(TOSA_KEY_SENSE_NUM - 1, TOSA_KEY_STROBE_NUM - 1) + 1
-
-#define SCAN_INTERVAL           (HZ/10)
-
-#define KB_DISCHARGE_DELAY      10
-#define KB_ACTIVATE_DELAY       10
-
-static unsigned short tosakbd_keycode[NR_SCANCODES] = {
-0,
-0, KEY_W, 0, 0, 0, KEY_K, KEY_BACKSPACE, KEY_P,
-0, 0, 0, 0, 0, 0, 0, 0,
-KEY_Q, KEY_E, KEY_T, KEY_Y, 0, KEY_O, KEY_I, KEY_COMMA,
-0, 0, 0, 0, 0, 0, 0, 0,
-KEY_A, KEY_D, KEY_G, KEY_U, 0, KEY_L, KEY_ENTER, KEY_DOT,
-0, 0, 0, 0, 0, 0, 0, 0,
-KEY_Z, KEY_C, KEY_V, KEY_J, TOSA_KEY_ADDRESSBOOK, TOSA_KEY_CANCEL, TOSA_KEY_CENTER, TOSA_KEY_OK,
-KEY_LEFTSHIFT, 0, 0, 0, 0, 0, 0, 0,
-KEY_S, KEY_R, KEY_B, KEY_N, TOSA_KEY_CALENDAR, TOSA_KEY_HOMEPAGE, KEY_LEFTCTRL, TOSA_KEY_LIGHT,
-0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0, 0,
-KEY_TAB, KEY_SLASH, KEY_H, KEY_M, TOSA_KEY_MENU, 0, KEY_UP, 0,
-0, 0, TOSA_KEY_FN, 0, 0, 0, 0, 0,
-KEY_X, KEY_F, KEY_SPACE, KEY_APOSTROPHE, TOSA_KEY_MAIL, KEY_LEFT, KEY_DOWN, KEY_RIGHT,
-0, 0, 0,
-};
-
-struct tosakbd {
-        unsigned short keycode[ARRAY_SIZE(tosakbd_keycode)];
-        struct input_dev *input;
-        bool suspended;
-        spinlock_t lock; /* protect kbd scanning */
-        struct timer_list timer;
-};
-
-
-/* Helper functions for reading the keyboard matrix
- * Note: We should really be using the generic gpio functions to alter
- *       GPDR but it requires a function call per GPIO bit which is
- *       excessive when we need to access 12 bits at once, multiple times.
- * These functions must be called within local_irq_save()/local_irq_restore()
- * or similar.
- */
-#define GET_ROWS_STATUS(c)      ((GPLR2 & TOSA_GPIO_ALL_SENSE_BIT) >> TOSA_GPIO_ALL_SENSE_RSHIFT)
-
-static inline void tosakbd_discharge_all(void)
-{
-        /* STROBE All HiZ */
-        GPCR1  = TOSA_GPIO_HIGH_STROBE_BIT;
-        GPDR1 &= ~TOSA_GPIO_HIGH_STROBE_BIT;
-        GPCR2  = TOSA_GPIO_LOW_STROBE_BIT;
-        GPDR2 &= ~TOSA_GPIO_LOW_STROBE_BIT;
-}
-
-static inline void tosakbd_activate_all(void)
-{
-        /* STROBE ALL -> High */
-        GPSR1  = TOSA_GPIO_HIGH_STROBE_BIT;
-        GPDR1 |= TOSA_GPIO_HIGH_STROBE_BIT;
-        GPSR2  = TOSA_GPIO_LOW_STROBE_BIT;
-        GPDR2 |= TOSA_GPIO_LOW_STROBE_BIT;
-
-        udelay(KB_DISCHARGE_DELAY);
-
-        /* STATE CLEAR */
-        GEDR2 |= TOSA_GPIO_ALL_SENSE_BIT;
-}
-
-static inline void tosakbd_activate_col(int col)
-{
-        if (col <= 5) {
-                /* STROBE col -> High, not col -> HiZ */
-                GPSR1 = TOSA_GPIO_STROBE_BIT(col);
-                GPDR1 = (GPDR1 & ~TOSA_GPIO_HIGH_STROBE_BIT) | TOSA_GPIO_STROBE_BIT(col);
-        } else {
-                /* STROBE col -> High, not col -> HiZ */
-                GPSR2 = TOSA_GPIO_STROBE_BIT(col);
-                GPDR2 = (GPDR2 & ~TOSA_GPIO_LOW_STROBE_BIT) | TOSA_GPIO_STROBE_BIT(col);
-        }
-}
-
-static inline void tosakbd_reset_col(int col)
-{
-        if (col <= 5) {
-                /* STROBE col -> Low */
-                GPCR1 = TOSA_GPIO_STROBE_BIT(col);
-                /* STROBE col -> out, not col -> HiZ */
-                GPDR1 = (GPDR1 & ~TOSA_GPIO_HIGH_STROBE_BIT) | TOSA_GPIO_STROBE_BIT(col);
-        } else {
-                /* STROBE col -> Low */
-                GPCR2 = TOSA_GPIO_STROBE_BIT(col);
-                /* STROBE col -> out, not col -> HiZ */
-                GPDR2 = (GPDR2 & ~TOSA_GPIO_LOW_STROBE_BIT) | TOSA_GPIO_STROBE_BIT(col);
-        }
-}
-/*
- * The tosa keyboard only generates interrupts when a key is pressed.
- * So when a key is pressed, we enable a timer.  This timer scans the
- * keyboard, and this is how we detect when the key is released.
- */
-
-/* Scan the hardware keyboard and push any changes up through the input layer */
-static void tosakbd_scankeyboard(struct platform_device *dev)
-{
-        struct tosakbd *tosakbd = platform_get_drvdata(dev);
-        unsigned int row, col, rowd;
-        unsigned long flags;
-        unsigned int num_pressed = 0;
-
-        spin_lock_irqsave(&tosakbd->lock, flags);
-
-        if (tosakbd->suspended)
-                goto out;
-
-        for (col = 0; col < TOSA_KEY_STROBE_NUM; col++) {
-                /*
-                 * Discharge the output driver capacitatance
-                 * in the keyboard matrix. (Yes it is significant..)
-                 */
-                tosakbd_discharge_all();
-                udelay(KB_DISCHARGE_DELAY);
-
-                tosakbd_activate_col(col);
-                udelay(KB_ACTIVATE_DELAY);
-
-                rowd = GET_ROWS_STATUS(col);
-
-                for (row = 0; row < TOSA_KEY_SENSE_NUM; row++) {
-                        unsigned int scancode, pressed;
-                        scancode = SCANCODE(row, col);
-                        pressed = rowd & KB_ROWMASK(row);
-
-                        if (pressed && !tosakbd->keycode[scancode])
-                                dev_warn(&dev->dev,
-                                                "unhandled scancode: 0x%02x\n",
-                                                scancode);
-
-                        input_report_key(tosakbd->input,
-                                        tosakbd->keycode[scancode],
-                                        pressed);
-                        if (pressed)
-                                num_pressed++;
-                }
-
-                tosakbd_reset_col(col);
-        }
-
-        tosakbd_activate_all();
-
-        input_sync(tosakbd->input);
-
-        /* if any keys are pressed, enable the timer */
-        if (num_pressed)
-                mod_timer(&tosakbd->timer, jiffies + SCAN_INTERVAL);
-
- out:
-        spin_unlock_irqrestore(&tosakbd->lock, flags);
-}
-
-/*
- * tosa keyboard interrupt handler.
- */
-static irqreturn_t tosakbd_interrupt(int irq, void *__dev)
-{
-        struct platform_device *dev = __dev;
-        struct tosakbd *tosakbd = platform_get_drvdata(dev);
-
-        if (!timer_pending(&tosakbd->timer)) {
-                /** wait chattering delay **/
-                udelay(20);
-                tosakbd_scankeyboard(dev);
-        }
-
-        return IRQ_HANDLED;
-}
-
-/*
- * tosa timer checking for released keys
- */
-static void tosakbd_timer_callback(unsigned long __dev)
-{
-        struct platform_device *dev = (struct platform_device *)__dev;
-
-        tosakbd_scankeyboard(dev);
-}
-
-#ifdef CONFIG_PM
-static int tosakbd_suspend(struct platform_device *dev, pm_message_t state)
-{
-        struct tosakbd *tosakbd = platform_get_drvdata(dev);
-        unsigned long flags;
-
-        spin_lock_irqsave(&tosakbd->lock, flags);
-        tosakbd->suspended = true;
-        spin_unlock_irqrestore(&tosakbd->lock, flags);
-
-        del_timer_sync(&tosakbd->timer);
-
-        return 0;
-}
-
-static int tosakbd_resume(struct platform_device *dev)
-{
-        struct tosakbd *tosakbd = platform_get_drvdata(dev);
-
-        tosakbd->suspended = false;
-        tosakbd_scankeyboard(dev);
-
-        return 0;
-}
-#else
-#define tosakbd_suspend         NULL
-#define tosakbd_resume          NULL
-#endif
-
-static int __devinit tosakbd_probe(struct platform_device *pdev) {
-
-        int i;
-        struct tosakbd *tosakbd;
-        struct input_dev *input_dev;
-        int error;
-
-        tosakbd = kzalloc(sizeof(struct tosakbd), GFP_KERNEL);
-        if (!tosakbd)
-                return -ENOMEM;
-
-        input_dev = input_allocate_device();
-        if (!input_dev) {
-                kfree(tosakbd);
-                return -ENOMEM;
-        }
-
-        platform_set_drvdata(pdev, tosakbd);
-
-        spin_lock_init(&tosakbd->lock);
-
-        /* Init Keyboard rescan timer */
-        init_timer(&tosakbd->timer);
-        tosakbd->timer.function = tosakbd_timer_callback;
-        tosakbd->timer.data = (unsigned long) pdev;
-
-        tosakbd->input = input_dev;
-
-        input_set_drvdata(input_dev, tosakbd);
-        input_dev->name = "Tosa Keyboard";
-        input_dev->phys = "tosakbd/input0";
-        input_dev->dev.parent = &pdev->dev;
-
-        input_dev->id.bustype = BUS_HOST;
-        input_dev->id.vendor = 0x0001;
-        input_dev->id.product = 0x0001;
-        input_dev->id.version = 0x0100;
-
-        input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REP);
-        input_dev->keycode = tosakbd->keycode;
-        input_dev->keycodesize = sizeof(tosakbd->keycode[0]);
-        input_dev->keycodemax = ARRAY_SIZE(tosakbd_keycode);
-
-        memcpy(tosakbd->keycode, tosakbd_keycode, sizeof(tosakbd_keycode));
-
-        for (i = 0; i < ARRAY_SIZE(tosakbd_keycode); i++)
-                __set_bit(tosakbd->keycode[i], input_dev->keybit);
-        __clear_bit(KEY_RESERVED, input_dev->keybit);
-
-        /* Setup sense interrupts - RisingEdge Detect, sense lines as inputs */
-        for (i = 0; i < TOSA_KEY_SENSE_NUM; i++) {
-                int gpio = TOSA_GPIO_KEY_SENSE(i);
-                int irq;
-                error = gpio_request(gpio, "tosakbd");
-                if (error < 0) {
-                        printk(KERN_ERR "tosakbd: failed to request GPIO %d, "
-                                " error %d\n", gpio, error);
-                        goto fail;
-                }
-
-                error = gpio_direction_input(TOSA_GPIO_KEY_SENSE(i));
-                if (error < 0) {
-                        printk(KERN_ERR "tosakbd: failed to configure input"
-                                " direction for GPIO %d, error %d\n",
-                                gpio, error);
-                        gpio_free(gpio);
-                        goto fail;
-                }
-
-                irq = gpio_to_irq(gpio);
-                if (irq < 0) {
-                        error = irq;
-                        printk(KERN_ERR "gpio-keys: Unable to get irq number"
-                                " for GPIO %d, error %d\n",
-                                gpio, error);
-                        gpio_free(gpio);
-                        goto fail;
-                }
-
-                error = request_irq(irq, tosakbd_interrupt,
-                                        IRQF_DISABLED | IRQF_TRIGGER_RISING,
-                                        "tosakbd", pdev);
-
-                if (error) {
-                        printk("tosakbd: Can't get IRQ: %d: error %d!\n",
-                                        irq, error);
-                        gpio_free(gpio);
-                        goto fail;
-                }
-        }
-
-        /* Set Strobe lines as outputs - set high */
-        for (i = 0; i < TOSA_KEY_STROBE_NUM; i++) {
-                int gpio = TOSA_GPIO_KEY_STROBE(i);
-                error = gpio_request(gpio, "tosakbd");
-                if (error < 0) {
-                        printk(KERN_ERR "tosakbd: failed to request GPIO %d, "
-                                " error %d\n", gpio, error);
-                        goto fail2;
-                }
-
-                error = gpio_direction_output(gpio, 1);
-                if (error < 0) {
-                        printk(KERN_ERR "tosakbd: failed to configure input"
-                                " direction for GPIO %d, error %d\n",
-                                gpio, error);
-                        gpio_free(gpio);
-                        goto fail2;
-                }
-
-        }
-
-        error = input_register_device(input_dev);
-        if (error) {
-                printk(KERN_ERR "tosakbd: Unable to register input device, "
-                        "error: %d\n", error);
-                goto fail2;
-        }
-
-        printk(KERN_INFO "input: Tosa Keyboard Registered\n");
-
-        return 0;
-
-fail2:
-        while (--i >= 0)
-                gpio_free(TOSA_GPIO_KEY_STROBE(i));
-
-        i = TOSA_KEY_SENSE_NUM;
-fail:
-        while (--i >= 0) {
-                free_irq(gpio_to_irq(TOSA_GPIO_KEY_SENSE(i)), pdev);
-                gpio_free(TOSA_GPIO_KEY_SENSE(i));
-        }
-
-        platform_set_drvdata(pdev, NULL);
-        input_free_device(input_dev);
-        kfree(tosakbd);
-
-        return error;
-}
-
-static int __devexit tosakbd_remove(struct platform_device *dev)
-{
-        int i;
-        struct tosakbd *tosakbd = platform_get_drvdata(dev);
-
-        for (i = 0; i < TOSA_KEY_STROBE_NUM; i++)
-                gpio_free(TOSA_GPIO_KEY_STROBE(i));
-
-        for (i = 0; i < TOSA_KEY_SENSE_NUM; i++) {
-                free_irq(gpio_to_irq(TOSA_GPIO_KEY_SENSE(i)), dev);
-                gpio_free(TOSA_GPIO_KEY_SENSE(i));
-        }
-
-        del_timer_sync(&tosakbd->timer);
-
-        input_unregister_device(tosakbd->input);
-
-        kfree(tosakbd);
-
-        return 0;
-}
-
-static struct platform_driver tosakbd_driver = {
-        .probe          = tosakbd_probe,
-        .remove         = __devexit_p(tosakbd_remove),
-        .suspend        = tosakbd_suspend,
-        .resume         = tosakbd_resume,
-        .driver         = {
-                .name   = "tosa-keyboard",
-                .owner  = THIS_MODULE,
-        },
-};
-
-static int __devinit tosakbd_init(void)
-{
-        return platform_driver_register(&tosakbd_driver);
-}
-
-static void __exit tosakbd_exit(void)
-{
-        platform_driver_unregister(&tosakbd_driver);
-}
-
-module_init(tosakbd_init);
-module_exit(tosakbd_exit);
-
-MODULE_AUTHOR("Dirk Opfer <Dirk@Opfer-Online.de>");
-MODULE_DESCRIPTION("Tosa Keyboard Driver");
-MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:tosa-keyboard");
diff --git a/drivers/input/misc/pcspkr.c b/drivers/input/misc/pcspkr.c
index ea4e1fd12651..f080dd31499b 100644
--- a/drivers/input/misc/pcspkr.c
+++ b/drivers/input/misc/pcspkr.c
@@ -30,7 +30,7 @@ MODULE_ALIAS("platform:pcspkr");
 #include <asm/i8253.h>
 #else
 #include <asm/8253pit.h>
-static DEFINE_SPINLOCK(i8253_lock);
+static DEFINE_RAW_SPINLOCK(i8253_lock);
 #endif
 
 static int pcspkr_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
@@ -50,7 +50,7 @@ static int pcspkr_event(struct input_dev *dev, unsigned int type, unsigned int c
         if (value > 20 && value < 32767)
                 count = PIT_TICK_RATE / value;
 
-        spin_lock_irqsave(&i8253_lock, flags);
+        raw_spin_lock_irqsave(&i8253_lock, flags);
 
         if (count) {
                 /* set command for counter 2, 2 byte write */
@@ -65,7 +65,7 @@ static int pcspkr_event(struct input_dev *dev, unsigned int type, unsigned int c
                 outb(inb_p(0x61) & 0xFC, 0x61);
         }
 
-        spin_unlock_irqrestore(&i8253_lock, flags);
+        raw_spin_unlock_irqrestore(&i8253_lock, flags);
 
         return 0;
 }
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 0520c2e19927..112b4ee52ff2 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -185,7 +185,7 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         int fingers;
         static int old_fingers;
 
-        if (etd->fw_version_maj == 0x01) {
+        if (etd->fw_version < 0x020000) {
                 /*
                  * byte 0:  D   U  p1  p2   1  p3   R   L
                  * byte 1:  f   0  th  tw  x9  x8  y9  y8
@@ -227,7 +227,7 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
         input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
 
-        if ((etd->fw_version_maj == 0x01) &&
+        if (etd->fw_version < 0x020000 &&
             (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
                 /* rocker up */
                 input_report_key(dev, BTN_FORWARD, packet[0] & 0x40);
@@ -321,7 +321,7 @@ static int elantech_check_parity_v1(struct psmouse *psmouse)
         unsigned char p1, p2, p3;
 
         /* Parity bits are placed differently */
-        if (etd->fw_version_maj == 0x01) {
+        if (etd->fw_version < 0x020000) {
                 /* byte 0:  D   U  p1  p2   1  p3   R   L */
                 p1 = (packet[0] & 0x20) >> 5;
                 p2 = (packet[0] & 0x10) >> 4;
@@ -457,7 +457,7 @@ static void elantech_set_input_params(struct psmouse *psmouse)
         switch (etd->hw_version) {
         case 1:
                 /* Rocker button */
-                if ((etd->fw_version_maj == 0x01) &&
+                if (etd->fw_version < 0x020000 &&
                     (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
                         __set_bit(BTN_FORWARD, dev->keybit);
                         __set_bit(BTN_BACK, dev->keybit);
@@ -686,15 +686,14 @@ int elantech_init(struct psmouse *psmouse)
                 pr_err("elantech.c: failed to query firmware version.\n");
                 goto init_fail;
         }
-        etd->fw_version_maj = param[0];
-        etd->fw_version_min = param[2];
+
+        etd->fw_version = (param[0] << 16) | (param[1] << 8) | param[2];
 
         /*
          * Assume every version greater than this is new EeePC style
          * hardware with 6 byte packets
          */
-        if ((etd->fw_version_maj == 0x02 && etd->fw_version_min >= 0x30) ||
-            etd->fw_version_maj > 0x02) {
+        if (etd->fw_version >= 0x020030) {
                 etd->hw_version = 2;
                 /* For now show extra debug information */
                 etd->debug = 1;
@@ -704,8 +703,9 @@ int elantech_init(struct psmouse *psmouse)
                 etd->hw_version = 1;
                 etd->paritycheck = 1;
         }
-        pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d\n",
-                etd->hw_version, etd->fw_version_maj, etd->fw_version_min);
+
+        pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d.%d\n",
+                etd->hw_version, param[0], param[1], param[2]);
 
         if (synaptics_send_cmd(psmouse, ETP_CAPABILITIES_QUERY, param)) {
                 pr_err("elantech.c: failed to query capabilities.\n");
@@ -720,8 +720,8 @@ int elantech_init(struct psmouse *psmouse)
          * a touch action starts causing the mouse cursor or scrolled page
          * to jump. Enable a workaround.
          */
-        if (etd->fw_version_maj == 0x02 && etd->fw_version_min == 0x22) {
-                pr_info("elantech.c: firmware version 2.34 detected, "
+        if (etd->fw_version == 0x020022) {
+                pr_info("elantech.c: firmware version 2.0.34 detected, "
                         "enabling jumpy cursor workaround\n");
                 etd->jumpy_cursor = 1;
         }
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index feac5f7af966..ac57bde1bb9f 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -100,11 +100,10 @@ struct elantech_data {
         unsigned char reg_26;
         unsigned char debug;
         unsigned char capabilities;
-        unsigned char fw_version_maj;
-        unsigned char fw_version_min;
-        unsigned char hw_version;
         unsigned char paritycheck;
         unsigned char jumpy_cursor;
+        unsigned char hw_version;
+        unsigned int  fw_version;
         unsigned char parity[256];
 };
 
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index cbc807264940..a3c97315a473 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1394,6 +1394,7 @@ static int psmouse_reconnect(struct serio *serio)
         struct psmouse *psmouse = serio_get_drvdata(serio);
         struct psmouse *parent = NULL;
         struct serio_driver *drv = serio->drv;
+        unsigned char type;
         int rc = -1;
 
         if (!drv || !psmouse) {
@@ -1413,10 +1414,15 @@ static int psmouse_reconnect(struct serio *serio)
         if (psmouse->reconnect) {
                 if (psmouse->reconnect(psmouse))
                         goto out;
-        } else if (psmouse_probe(psmouse) < 0 ||
-                   psmouse->type != psmouse_extensions(psmouse,
-                                                psmouse_max_proto, false)) {
-                goto out;
+        } else {
+                psmouse_reset(psmouse);
+
+                if (psmouse_probe(psmouse) < 0)
+                        goto out;
+
+                type = psmouse_extensions(psmouse, psmouse_max_proto, false);
+                if (psmouse->type != type)
+                        goto out;
         }
 
         /* ok, the device type (and capabilities) match the old one,
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 8a8fa4d2d6a8..6c0f1712f55b 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -99,22 +99,6 @@ config TOUCHSCREEN_BITSY
           To compile this driver as a module, choose M here: the
           module will be called h3600_ts_input.
 
-config TOUCHSCREEN_CORGI
-        tristate "SharpSL (Corgi and Spitz series) touchscreen driver (DEPRECATED)"
-        depends on PXA_SHARPSL
-        select CORGI_SSP_DEPRECATED
-        help
-          Say Y here to enable the driver for the touchscreen on the
-          Sharp SL-C7xx and SL-Cxx00 series of PDAs.
-
-          If unsure, say N.
-
-          To compile this driver as a module, choose M here: the
-          module will be called corgi_ts.
-
-          NOTE: this driver is deprecated, try enable SPI and generic
-          ADS7846-based touchscreen driver.
-
 config TOUCHSCREEN_DA9034
         tristate "Touchscreen support for Dialog Semiconductor DA9034"
         depends on PMIC_DA903X
@@ -158,8 +142,8 @@ config TOUCHSCREEN_FUJITSU
           module will be called fujitsu-ts.
 
 config TOUCHSCREEN_S3C2410
-        tristate "Samsung S3C2410 touchscreen input driver"
-        depends on ARCH_S3C2410
+        tristate "Samsung S3C2410/generic touchscreen input driver"
+        depends on ARCH_S3C2410 || SAMSUNG_DEV_TS
         select S3C24XX_ADC
         help
           Say Y here if you have the s3c2410 touchscreen.
diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
index 7fef7d5cca23..41145d074dec 100644
--- a/drivers/input/touchscreen/Makefile
+++ b/drivers/input/touchscreen/Makefile
@@ -12,7 +12,6 @@ obj-$(CONFIG_TOUCHSCREEN_AD7879)	+= ad7879.o
 obj-$(CONFIG_TOUCHSCREEN_ADS7846)       += ads7846.o
 obj-$(CONFIG_TOUCHSCREEN_ATMEL_TSADCC)  += atmel_tsadcc.o
 obj-$(CONFIG_TOUCHSCREEN_BITSY)         += h3600_ts_input.o
-obj-$(CONFIG_TOUCHSCREEN_CORGI)         += corgi_ts.o
 obj-$(CONFIG_TOUCHSCREEN_DYNAPRO)       += dynapro.o
 obj-$(CONFIG_TOUCHSCREEN_GUNZE)         += gunze.o
 obj-$(CONFIG_TOUCHSCREEN_EETI)          += eeti_ts.o
diff --git a/drivers/input/touchscreen/ad7877.c b/drivers/input/touchscreen/ad7877.c
index e019d53d1ab4..0d2d7e54b465 100644
--- a/drivers/input/touchscreen/ad7877.c
+++ b/drivers/input/touchscreen/ad7877.c
@@ -156,9 +156,14 @@ struct ser_req {
         u16                     reset;
         u16                     ref_on;
         u16                     command;
-        u16                     sample;
         struct spi_message      msg;
         struct spi_transfer     xfer[6];
+
+        /*
+         * DMA (thus cache coherency maintenance) requires the
+         * transfer buffers to live in their own cache lines.
+         */
+        u16 sample ____cacheline_aligned;
 };
 
 struct ad7877 {
@@ -182,8 +187,6 @@ struct ad7877 {
         u8                      averaging;
         u8                      pen_down_acc_interval;
 
-        u16                     conversion_data[AD7877_NR_SENSE];
-
         struct spi_transfer     xfer[AD7877_NR_SENSE + 2];
         struct spi_message      msg;
 
@@ -195,6 +198,12 @@ struct ad7877 {
         spinlock_t              lock;
         struct timer_list       timer;          /* P: lock */
         unsigned                pending:1;      /* P: lock */
+
+        /*
+         * DMA (thus cache coherency maintenance) requires the
+         * transfer buffers to live in their own cache lines.
+         */
+        u16 conversion_data[AD7877_NR_SENSE] ____cacheline_aligned;
 };
 
 static int gpio3;
diff --git a/drivers/input/touchscreen/corgi_ts.c b/drivers/input/touchscreen/corgi_ts.c
deleted file mode 100644
index 94a1919d439d..000000000000
--- a/drivers/input/touchscreen/corgi_ts.c
+++ /dev/null
@@ -1,385 +0,0 @@
-/*
- *  Touchscreen driver for Sharp SL-C7xx and SL-Cxx00 models
- *
- *  Copyright (c) 2004-2005 Richard Purdie
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 as
- *  published by the Free Software Foundation.
- *
- */
-
-
-#include <linux/delay.h>
-#include <linux/platform_device.h>
-#include <linux/init.h>
-#include <linux/input.h>
-#include <linux/interrupt.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/irq.h>
-
-#include <mach/sharpsl.h>
-#include <mach/hardware.h>
-#include <mach/pxa2xx-gpio.h>
-
-
-#define PWR_MODE_ACTIVE         0
-#define PWR_MODE_SUSPEND        1
-
-#define X_AXIS_MAX              3830
-#define X_AXIS_MIN              150
-#define Y_AXIS_MAX              3830
-#define Y_AXIS_MIN              190
-#define PRESSURE_MIN            0
-#define PRESSURE_MAX            15000
-
-struct ts_event {
-        short pressure;
-        short x;
-        short y;
-};
-
-struct corgi_ts {
-        struct input_dev *input;
-        struct timer_list timer;
-        struct ts_event tc;
-        int pendown;
-        int power_mode;
-        int irq_gpio;
-        struct corgits_machinfo *machinfo;
-};
-
-#ifdef CONFIG_PXA25x
-#define CCNT(a)         asm volatile ("mrc p14, 0, %0, C1, C0, 0" : "=r"(a))
-#define PMNC_GET(x)     asm volatile ("mrc p14, 0, %0, C0, C0, 0" : "=r"(x))
-#define PMNC_SET(x)     asm volatile ("mcr p14, 0, %0, C0, C0, 0" : : "r"(x))
-#endif
-#ifdef CONFIG_PXA27x
-#define CCNT(a)         asm volatile ("mrc p14, 0, %0, C1, C1, 0" : "=r"(a))
-#define PMNC_GET(x)     asm volatile ("mrc p14, 0, %0, C0, C1, 0" : "=r"(x))
-#define PMNC_SET(x)     asm volatile ("mcr p14, 0, %0, C0, C1, 0" : : "r"(x))
-#endif
-
-/* ADS7846 Touch Screen Controller bit definitions */
-#define ADSCTRL_PD0             (1u << 0)       /* PD0 */
-#define ADSCTRL_PD1             (1u << 1)       /* PD1 */
-#define ADSCTRL_DFR             (1u << 2)       /* SER/DFR */
-#define ADSCTRL_MOD             (1u << 3)       /* Mode */
-#define ADSCTRL_ADR_SH  4       /* Address setting */
-#define ADSCTRL_STS             (1u << 7)       /* Start Bit */
-
-/* External Functions */
-extern unsigned int get_clk_frequency_khz(int info);
-
-static unsigned long calc_waittime(struct corgi_ts *corgi_ts)
-{
-        unsigned long hsync_invperiod = corgi_ts->machinfo->get_hsync_invperiod();
-
-        if (hsync_invperiod)
-                return get_clk_frequency_khz(0)*1000/hsync_invperiod;
-        else
-                return 0;
-}
-
-static int sync_receive_data_send_cmd(struct corgi_ts *corgi_ts, int doRecive, int doSend,
-                unsigned int address, unsigned long wait_time)
-{
-        unsigned long timer1 = 0, timer2, pmnc = 0;
-        int pos = 0;
-
-        if (wait_time && doSend) {
-                PMNC_GET(pmnc);
-                if (!(pmnc & 0x01))
-                        PMNC_SET(0x01);
-
-                /* polling HSync */
-                corgi_ts->machinfo->wait_hsync();
-                /* get CCNT */
-                CCNT(timer1);
-        }
-
-        if (doRecive)
-                pos = corgi_ssp_ads7846_get();
-
-        if (doSend) {
-                int cmd = ADSCTRL_PD0 | ADSCTRL_PD1 | (address << ADSCTRL_ADR_SH) | ADSCTRL_STS;
-                /* dummy command */
-                corgi_ssp_ads7846_put(cmd);
-                corgi_ssp_ads7846_get();
-
-                if (wait_time) {
-                        /* Wait after HSync */
-                        CCNT(timer2);
-                        if (timer2-timer1 > wait_time) {
-                                /* too slow - timeout, try again */
-                                corgi_ts->machinfo->wait_hsync();
-                                /* get CCNT */
-                                CCNT(timer1);
-                                /* Wait after HSync */
-                                CCNT(timer2);
-                        }
-                        while (timer2 - timer1 < wait_time)
-                                CCNT(timer2);
-                }
-                corgi_ssp_ads7846_put(cmd);
-                if (wait_time && !(pmnc & 0x01))
-                        PMNC_SET(pmnc);
-        }
-        return pos;
-}
-
-static int read_xydata(struct corgi_ts *corgi_ts)
-{
-        unsigned int x, y, z1, z2;
-        unsigned long flags, wait_time;
-
-        /* critical section */
-        local_irq_save(flags);
-        corgi_ssp_ads7846_lock();
-        wait_time = calc_waittime(corgi_ts);
-
-        /* Y-axis */
-        sync_receive_data_send_cmd(corgi_ts, 0, 1, 1u, wait_time);
-
-        /* Y-axis */
-        sync_receive_data_send_cmd(corgi_ts, 1, 1, 1u, wait_time);
-
-        /* X-axis */
-        y = sync_receive_data_send_cmd(corgi_ts, 1, 1, 5u, wait_time);
-
-        /* Z1 */
-        x = sync_receive_data_send_cmd(corgi_ts, 1, 1, 3u, wait_time);
-
-        /* Z2 */
-        z1 = sync_receive_data_send_cmd(corgi_ts, 1, 1, 4u, wait_time);
-        z2 = sync_receive_data_send_cmd(corgi_ts, 1, 0, 4u, wait_time);
-
-        /* Power-Down Enable */
-        corgi_ssp_ads7846_put((1u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        corgi_ssp_ads7846_get();
-
-        corgi_ssp_ads7846_unlock();
-        local_irq_restore(flags);
-
-        if (x== 0 || y == 0 || z1 == 0 || (x * (z2 - z1) / z1) >= 15000) {
-                corgi_ts->tc.pressure = 0;
-                return 0;
-        }
-
-        corgi_ts->tc.x = x;
-        corgi_ts->tc.y = y;
-        corgi_ts->tc.pressure = (x * (z2 - z1)) / z1;
-        return 1;
-}
-
-static void new_data(struct corgi_ts *corgi_ts)
-{
-        struct input_dev *dev = corgi_ts->input;
-
-        if (corgi_ts->power_mode != PWR_MODE_ACTIVE)
-                return;
-
-        if (!corgi_ts->tc.pressure && corgi_ts->pendown == 0)
-                return;
-
-        input_report_abs(dev, ABS_X, corgi_ts->tc.x);
-        input_report_abs(dev, ABS_Y, corgi_ts->tc.y);
-        input_report_abs(dev, ABS_PRESSURE, corgi_ts->tc.pressure);
-        input_report_key(dev, BTN_TOUCH, corgi_ts->pendown);
-        input_sync(dev);
-}
-
-static void ts_interrupt_main(struct corgi_ts *corgi_ts, int isTimer)
-{
-        if ((GPLR(IRQ_TO_GPIO(corgi_ts->irq_gpio)) & GPIO_bit(IRQ_TO_GPIO(corgi_ts->irq_gpio))) == 0) {
-                /* Disable Interrupt */
-                set_irq_type(corgi_ts->irq_gpio, IRQ_TYPE_NONE);
-                if (read_xydata(corgi_ts)) {
-                        corgi_ts->pendown = 1;
-                        new_data(corgi_ts);
-                }
-                mod_timer(&corgi_ts->timer, jiffies + HZ / 100);
-        } else {
-                if (corgi_ts->pendown == 1 || corgi_ts->pendown == 2) {
-                        mod_timer(&corgi_ts->timer, jiffies + HZ / 100);
-                        corgi_ts->pendown++;
-                        return;
-                }
-
-                if (corgi_ts->pendown) {
-                        corgi_ts->tc.pressure = 0;
-                        new_data(corgi_ts);
-                }
-
-                /* Enable Falling Edge */
-                set_irq_type(corgi_ts->irq_gpio, IRQ_TYPE_EDGE_FALLING);
-                corgi_ts->pendown = 0;
-        }
-}
-
-static void corgi_ts_timer(unsigned long data)
-{
-        struct corgi_ts *corgits_data = (struct corgi_ts *) data;
-
-        ts_interrupt_main(corgits_data, 1);
-}
-
-static irqreturn_t ts_interrupt(int irq, void *dev_id)
-{
-        struct corgi_ts *corgits_data = dev_id;
-
-        ts_interrupt_main(corgits_data, 0);
-        return IRQ_HANDLED;
-}
-
-#ifdef CONFIG_PM
-static int corgits_suspend(struct platform_device *dev, pm_message_t state)
-{
-        struct corgi_ts *corgi_ts = platform_get_drvdata(dev);
-
-        if (corgi_ts->pendown) {
-                del_timer_sync(&corgi_ts->timer);
-                corgi_ts->tc.pressure = 0;
-                new_data(corgi_ts);
-                corgi_ts->pendown = 0;
-        }
-        corgi_ts->power_mode = PWR_MODE_SUSPEND;
-
-        corgi_ssp_ads7846_putget((1u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-
-        return 0;
-}
-
-static int corgits_resume(struct platform_device *dev)
-{
-        struct corgi_ts *corgi_ts = platform_get_drvdata(dev);
-
-        corgi_ssp_ads7846_putget((4u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        /* Enable Falling Edge */
-        set_irq_type(corgi_ts->irq_gpio, IRQ_TYPE_EDGE_FALLING);
-        corgi_ts->power_mode = PWR_MODE_ACTIVE;
-
-        return 0;
-}
-#else
-#define corgits_suspend         NULL
-#define corgits_resume          NULL
-#endif
-
-static int __devinit corgits_probe(struct platform_device *pdev)
-{
-        struct corgi_ts *corgi_ts;
-        struct input_dev *input_dev;
-        int err = -ENOMEM;
-
-        corgi_ts = kzalloc(sizeof(struct corgi_ts), GFP_KERNEL);
-        input_dev = input_allocate_device();
-        if (!corgi_ts || !input_dev)
-                goto fail1;
-
-        platform_set_drvdata(pdev, corgi_ts);
-
-        corgi_ts->machinfo = pdev->dev.platform_data;
-        corgi_ts->irq_gpio = platform_get_irq(pdev, 0);
-
-        if (corgi_ts->irq_gpio < 0) {
-                err = -ENODEV;
-                goto fail1;
-        }
-
-        corgi_ts->input = input_dev;
-
-        init_timer(&corgi_ts->timer);
-        corgi_ts->timer.data = (unsigned long) corgi_ts;
-        corgi_ts->timer.function = corgi_ts_timer;
-
-        input_dev->name = "Corgi Touchscreen";
-        input_dev->phys = "corgits/input0";
-        input_dev->id.bustype = BUS_HOST;
-        input_dev->id.vendor = 0x0001;
-        input_dev->id.product = 0x0002;
-        input_dev->id.version = 0x0100;
-        input_dev->dev.parent = &pdev->dev;
-
-        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
-        input_dev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
-        input_set_abs_params(input_dev, ABS_X, X_AXIS_MIN, X_AXIS_MAX, 0, 0);
-        input_set_abs_params(input_dev, ABS_Y, Y_AXIS_MIN, Y_AXIS_MAX, 0, 0);
-        input_set_abs_params(input_dev, ABS_PRESSURE, PRESSURE_MIN, PRESSURE_MAX, 0, 0);
-
-        pxa_gpio_mode(IRQ_TO_GPIO(corgi_ts->irq_gpio) | GPIO_IN);
-
-        /* Initiaize ADS7846 Difference Reference mode */
-        corgi_ssp_ads7846_putget((1u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        mdelay(5);
-        corgi_ssp_ads7846_putget((3u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        mdelay(5);
-        corgi_ssp_ads7846_putget((4u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        mdelay(5);
-        corgi_ssp_ads7846_putget((5u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        mdelay(5);
-
-        if (request_irq(corgi_ts->irq_gpio, ts_interrupt, IRQF_DISABLED, "ts", corgi_ts)) {
-                err = -EBUSY;
-                goto fail1;
-        }
-
-        err = input_register_device(corgi_ts->input);
-        if (err)
-                goto fail2;
-
-        corgi_ts->power_mode = PWR_MODE_ACTIVE;
-
-        /* Enable Falling Edge */
-        set_irq_type(corgi_ts->irq_gpio, IRQ_TYPE_EDGE_FALLING);
-
-        return 0;
-
- fail2: free_irq(corgi_ts->irq_gpio, corgi_ts);
- fail1: input_free_device(input_dev);
-        kfree(corgi_ts);
-        return err;
-}
-
-static int __devexit corgits_remove(struct platform_device *pdev)
-{
-        struct corgi_ts *corgi_ts = platform_get_drvdata(pdev);
-
-        free_irq(corgi_ts->irq_gpio, corgi_ts);
-        del_timer_sync(&corgi_ts->timer);
-        corgi_ts->machinfo->put_hsync();
-        input_unregister_device(corgi_ts->input);
-        kfree(corgi_ts);
-
-        return 0;
-}
-
-static struct platform_driver corgits_driver = {
-        .probe          = corgits_probe,
-        .remove         = __devexit_p(corgits_remove),
-        .suspend        = corgits_suspend,
-        .resume         = corgits_resume,
-        .driver         = {
-                .name   = "corgi-ts",
-                .owner  = THIS_MODULE,
-        },
-};
-
-static int __init corgits_init(void)
-{
-        return platform_driver_register(&corgits_driver);
-}
-
-static void __exit corgits_exit(void)
-{
-        platform_driver_unregister(&corgits_driver);
-}
-
-module_init(corgits_init);
-module_exit(corgits_exit);
-
-MODULE_AUTHOR("Richard Purdie <rpurdie@rpsys.net>");
-MODULE_DESCRIPTION("Corgi TouchScreen Driver");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:corgi-ts");
diff --git a/drivers/input/touchscreen/s3c2410_ts.c b/drivers/input/touchscreen/s3c2410_ts.c
index 98a7d1279486..e0b7c834111d 100644
--- a/drivers/input/touchscreen/s3c2410_ts.c
+++ b/drivers/input/touchscreen/s3c2410_ts.c
@@ -37,9 +37,7 @@
 
 #include <plat/adc.h>
 #include <plat/regs-adc.h>
-
-#include <mach/regs-gpio.h>
-#include <mach/ts.h>
+#include <plat/ts.h>
 
 #define TSC_SLEEP  (S3C2410_ADCTSC_PULL_UP_DISABLE | S3C2410_ADCTSC_XY_PST(0))
 
@@ -57,6 +55,8 @@
                          S3C2410_ADCTSC_AUTO_PST | \
                          S3C2410_ADCTSC_XY_PST(0))
 
+#define FEAT_PEN_IRQ    (1 << 0)        /* HAS ADCCLRINTPNDNUP */
+
 /* Per-touchscreen data. */
 
 /**
@@ -71,6 +71,7 @@
  * @irq_tc: The interrupt number for pen up/down interrupt
  * @count: The number of samples collected.
  * @shift: The log2 of the maximum count to read in one go.
+ * @features: The features supported by the TSADC MOdule.
  */
 struct s3c2410ts {
         struct s3c_adc_client *client;
@@ -83,26 +84,12 @@ struct s3c2410ts {
         int irq_tc;
         int count;
         int shift;
+        int features;
 };
 
 static struct s3c2410ts ts;
 
 /**
- * s3c2410_ts_connect - configure gpio for s3c2410 systems
- *
- * Configure the GPIO for the S3C2410 system, where we have external FETs
- * connected to the device (later systems such as the S3C2440 integrate
- * these into the device).
-*/
-static inline void s3c2410_ts_connect(void)
-{
-        s3c2410_gpio_cfgpin(S3C2410_GPG(12), S3C2410_GPG12_XMON);
-        s3c2410_gpio_cfgpin(S3C2410_GPG(13), S3C2410_GPG13_nXPON);
-        s3c2410_gpio_cfgpin(S3C2410_GPG(14), S3C2410_GPG14_YMON);
-        s3c2410_gpio_cfgpin(S3C2410_GPG(15), S3C2410_GPG15_nYPON);
-}
-
-/**
  * get_down - return the down state of the pen
  * @data0: The data read from ADCDAT0 register.
  * @data1: The data read from ADCDAT1 register.
@@ -188,6 +175,11 @@ static irqreturn_t stylus_irq(int irq, void *dev_id)
         else
                 dev_info(ts.dev, "%s: count=%d\n", __func__, ts.count);
 
+        if (ts.features & FEAT_PEN_IRQ) {
+                /* Clear pen down/up interrupt */
+                writel(0x0, ts.io + S3C64XX_ADCCLRINTPNDNUP);
+        }
+
         return IRQ_HANDLED;
 }
 
@@ -296,9 +288,9 @@ static int __devinit s3c2410ts_probe(struct platform_device *pdev)
                 goto err_clk;
         }
 
-        /* Configure the touchscreen external FETs on the S3C2410 */
-        if (!platform_get_device_id(pdev)->driver_data)
-                s3c2410_ts_connect();
+        /* inititalise the gpio */
+        if (info->cfg_gpio)
+                info->cfg_gpio(to_platform_device(ts.dev));
 
         ts.client = s3c_adc_register(pdev, s3c24xx_ts_select,
                                      s3c24xx_ts_conversion, 1);
@@ -334,6 +326,7 @@ static int __devinit s3c2410ts_probe(struct platform_device *pdev)
         ts.input->id.version = 0x0102;
 
         ts.shift = info->oversampling_shift;
+        ts.features = platform_get_device_id(pdev)->driver_data;
 
         ret = request_irq(ts.irq_tc, stylus_irq, IRQF_DISABLED,
                           "s3c2410_ts_pen", ts.input);
@@ -420,15 +413,14 @@ static struct dev_pm_ops s3c_ts_pmops = {
 #endif
 
 static struct platform_device_id s3cts_driver_ids[] = {
-        { "s3c2410-ts", 0 },
-        { "s3c2440-ts", 1 },
+        { "s3c64xx-ts", FEAT_PEN_IRQ },
         { }
 };
 MODULE_DEVICE_TABLE(platform, s3cts_driver_ids);
 
 static struct platform_driver s3c_ts_driver = {
         .driver         = {
-                .name   = "s3c24xx-ts",
+                .name   = "samsung-ts",
                 .owner  = THIS_MODULE,
 #ifdef CONFIG_PM
                 .pm     = &s3c_ts_pmops,
diff --git a/drivers/isdn/divert/divert_procfs.c b/drivers/isdn/divert/divert_procfs.c
index 9f49d9065791..c53e2417e7d4 100644
--- a/drivers/isdn/divert/divert_procfs.c
+++ b/drivers/isdn/divert/divert_procfs.c
@@ -20,6 +20,7 @@
 #include <linux/sched.h>
 #include <linux/isdnif.h>
 #include <net/net_namespace.h>
+#include <linux/smp_lock.h>
 #include "isdn_divert.h"
 
 
@@ -177,9 +178,7 @@ isdn_divert_close(struct inode *ino, struct file *filep)
 /*********/
 /* IOCTL */
 /*********/
-static int
-isdn_divert_ioctl(struct inode *inode, struct file *file,
-                  uint cmd, ulong arg)
+static int isdn_divert_ioctl_unlocked(struct file *file, uint cmd, ulong arg)
 {
         divert_ioctl dioctl;
         int i;
@@ -258,6 +257,17 @@ isdn_divert_ioctl(struct inode *inode, struct file *file,
         return copy_to_user((void __user *)arg, &dioctl, sizeof(dioctl)) ? -EFAULT : 0;
 }                               /* isdn_divert_ioctl */
 
+static long isdn_divert_ioctl(struct file *file, uint cmd, ulong arg)
+{
+        long ret;
+
+        lock_kernel();
+        ret = isdn_divert_ioctl_unlocked(file, cmd, arg);
+        unlock_kernel();
+
+        return ret;
+}
+
 static const struct file_operations isdn_fops =
 {
         .owner          = THIS_MODULE,
@@ -265,7 +275,7 @@ static const struct file_operations isdn_fops =
         .read           = isdn_divert_read,
         .write          = isdn_divert_write,
         .poll           = isdn_divert_poll,
-        .ioctl          = isdn_divert_ioctl,
+        .unlocked_ioctl = isdn_divert_ioctl,
         .open           = isdn_divert_open,
         .release        = isdn_divert_close,                                      
 };
diff --git a/drivers/mfd/wm831x-core.c b/drivers/mfd/wm831x-core.c
index a3d5728b6449..f2ab025ad97a 100644
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -349,6 +349,9 @@ int wm831x_auxadc_read(struct wm831x *wm831x, enum wm831x_auxadc input)
                 goto disable;
         }
 
+        /* If an interrupt arrived late clean up after it */
+        try_wait_for_completion(&wm831x->auxadc_done);
+
         /* Ignore the result to allow us to soldier on without IRQ hookup */
         wait_for_completion_timeout(&wm831x->auxadc_done, msecs_to_jiffies(5));
 
diff --git a/drivers/mfd/wm8350-core.c b/drivers/mfd/wm8350-core.c
index e400a3bed063..b5807484b4c9 100644
--- a/drivers/mfd/wm8350-core.c
+++ b/drivers/mfd/wm8350-core.c
@@ -363,6 +363,10 @@ int wm8350_read_auxadc(struct wm8350 *wm8350, int channel, int scale, int vref)
         reg |= 1 << channel | WM8350_AUXADC_POLL;
         wm8350_reg_write(wm8350, WM8350_DIGITISER_CONTROL_1, reg);
 
+        /* If a late IRQ left the completion signalled then consume
+         * the completion. */
+        try_wait_for_completion(&wm8350->auxadc_done);
+
         /* We ignore the result of the completion and just check for a
          * conversion result, allowing us to soldier on if the IRQ
          * infrastructure is not set up for the chip. */
diff --git a/drivers/misc/vmware_balloon.c b/drivers/misc/vmware_balloon.c
index e7161c4e3798..db9cd0240c6f 100644
--- a/drivers/misc/vmware_balloon.c
+++ b/drivers/misc/vmware_balloon.c
@@ -41,7 +41,7 @@
 #include <linux/workqueue.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
-#include <asm/vmware.h>
+#include <asm/hypervisor.h>
 
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMware Memory Control (Balloon) Driver");
@@ -767,7 +767,7 @@ static int __init vmballoon_init(void)
          * Check if we are running on VMware's hypervisor and bail out
          * if we are not.
          */
-        if (!vmware_platform())
+        if (x86_hyper != &x86_hyper_vmware)
                 return -ENODEV;
 
         vmballoon_wq = create_freezeable_workqueue("vmmemctl");
diff --git a/drivers/mmc/host/at91_mci.c b/drivers/mmc/host/at91_mci.c
index a6dd7da37357..336d9f553f3e 100644
--- a/drivers/mmc/host/at91_mci.c
+++ b/drivers/mmc/host/at91_mci.c
@@ -314,8 +314,8 @@ static void at91_mci_post_dma_read(struct at91mci_host *host)
                         dmabuf = (unsigned *)tmpv;
                 }
 
+                flush_kernel_dcache_page(sg_page(sg));
                 kunmap_atomic(sgbuffer, KM_BIO_SRC_IRQ);
-                dmac_flush_range((void *)sgbuffer, ((void *)sgbuffer) + amount);
                 data->bytes_xfered += amount;
                 if (size == 0)
                         break;
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 88be37d9e9a5..fb279f4ed8b3 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -266,7 +266,7 @@ static int atmci_req_show(struct seq_file *s, void *v)
                                 "CMD%u(0x%x) flg %x rsp %x %x %x %x err %d\n",
                                 cmd->opcode, cmd->arg, cmd->flags,
                                 cmd->resp[0], cmd->resp[1], cmd->resp[2],
-                                cmd->resp[2], cmd->error);
+                                cmd->resp[3], cmd->error);
                 if (data)
                         seq_printf(s, "DATA %u / %u * %u flg %x err %d\n",
                                 data->bytes_xfered, data->blocks,
@@ -276,7 +276,7 @@ static int atmci_req_show(struct seq_file *s, void *v)
                                 "CMD%u(0x%x) flg %x rsp %x %x %x %x err %d\n",
                                 stop->opcode, stop->arg, stop->flags,
                                 stop->resp[0], stop->resp[1], stop->resp[2],
-                                stop->resp[2], stop->error);
+                                stop->resp[3], stop->error);
         }
 
         spin_unlock_bh(&slot->host->lock);
@@ -569,9 +569,10 @@ static void atmci_dma_cleanup(struct atmel_mci *host)
 {
         struct mmc_data                 *data = host->data;
 
-        dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
-                     ((data->flags & MMC_DATA_WRITE)
-                      ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
+        if (data)
+                dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
+                             ((data->flags & MMC_DATA_WRITE)
+                              ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
 }
 
 static void atmci_stop_dma(struct atmel_mci *host)
@@ -1099,8 +1100,8 @@ static void atmci_command_complete(struct atmel_mci *host,
                         "command error: status=0x%08x\n", status);
 
                 if (cmd->data) {
-                        host->data = NULL;
                         atmci_stop_dma(host);
+                        host->data = NULL;
                         mci_writel(host, IDR, MCI_NOTBUSY
                                         | MCI_TXRDY | MCI_RXRDY
                                         | ATMCI_DATA_ERROR_FLAGS);
@@ -1293,6 +1294,7 @@ static void atmci_tasklet_func(unsigned long priv)
                         } else {
                                 data->bytes_xfered = data->blocks * data->blksz;
                                 data->error = 0;
+                                mci_writel(host, IDR, ATMCI_DATA_ERROR_FLAGS);
                         }
 
                         if (!data->stop) {
@@ -1751,13 +1753,13 @@ static int __init atmci_probe(struct platform_device *pdev)
         ret = -ENODEV;
         if (pdata->slot[0].bus_width) {
                 ret = atmci_init_slot(host, &pdata->slot[0],
-                                MCI_SDCSEL_SLOT_A, 0);
+                                0, MCI_SDCSEL_SLOT_A);
                 if (!ret)
                         nr_slots++;
         }
         if (pdata->slot[1].bus_width) {
                 ret = atmci_init_slot(host, &pdata->slot[1],
-                                MCI_SDCSEL_SLOT_B, 1);
+                                1, MCI_SDCSEL_SLOT_B);
                 if (!ret)
                         nr_slots++;
         }
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 84c103a7ee13..ff115d920888 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -55,14 +55,16 @@ static void mmci_set_clkreg(struct mmci_host *host, unsigned int desired)
                         host->cclk = host->mclk / (2 * (clk + 1));
                 }
                 if (host->hw_designer == AMBA_VENDOR_ST)
-                        clk |= MCI_FCEN; /* Bug fix in ST IP block */
+                        clk |= MCI_ST_FCEN; /* Bug fix in ST IP block */
                 clk |= MCI_CLK_ENABLE;
                 /* This hasn't proven to be worthwhile */
                 /* clk |= MCI_CLK_PWRSAVE; */
         }
 
         if (host->mmc->ios.bus_width == MMC_BUS_WIDTH_4)
-                clk |= MCI_WIDE_BUS;
+                clk |= MCI_4BIT_BUS;
+        if (host->mmc->ios.bus_width == MMC_BUS_WIDTH_8)
+                clk |= MCI_ST_8BIT_BUS;
 
         writel(clk, host->base + MMCICLOCK);
 }
@@ -629,7 +631,18 @@ static int __devinit mmci_probe(struct amba_device *dev, struct amba_id *id)
 
         mmc->ops = &mmci_ops;
         mmc->f_min = (host->mclk + 511) / 512;
-        mmc->f_max = min(host->mclk, fmax);
+        /*
+         * If the platform data supplies a maximum operating
+         * frequency, this takes precedence. Else, we fall back
+         * to using the module parameter, which has a (low)
+         * default value in case it is not specified. Either
+         * value must not exceed the clock rate into the block,
+         * of course.
+         */
+        if (plat->f_max)
+                mmc->f_max = min(host->mclk, plat->f_max);
+        else
+                mmc->f_max = min(host->mclk, fmax);
         dev_dbg(mmc_dev(mmc), "clocking block at %u Hz\n", mmc->f_max);
 
 #ifdef CONFIG_REGULATOR
diff --git a/drivers/mmc/host/mmci.h b/drivers/mmc/host/mmci.h
index 1ceb9a90f59b..d77062e5e3af 100644
--- a/drivers/mmc/host/mmci.h
+++ b/drivers/mmc/host/mmci.h
@@ -25,9 +25,11 @@
 #define MCI_CLK_ENABLE          (1 << 8)
 #define MCI_CLK_PWRSAVE         (1 << 9)
 #define MCI_CLK_BYPASS          (1 << 10)
-#define MCI_WIDE_BUS            (1 << 11)
+#define MCI_4BIT_BUS            (1 << 11)
+/* 8bit wide buses supported in ST Micro versions */
+#define MCI_ST_8BIT_BUS         (1 << 12)
 /* HW flow control on the ST Micro version */
-#define MCI_FCEN                (1 << 13)
+#define MCI_ST_FCEN             (1 << 13)
 
 #define MMCIARGUMENT            0x008
 #define MMCICOMMAND             0x00c
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 0ed48959b590..e4f00e70a749 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -544,7 +544,7 @@ static irqreturn_t pxamci_detect_irq(int irq, void *devid)
 {
         struct pxamci_host *host = mmc_priv(devid);
 
-        mmc_detect_change(devid, host->pdata->detect_delay);
+        mmc_detect_change(devid, msecs_to_jiffies(host->pdata->detect_delay_ms));
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/net/a2065.c b/drivers/net/a2065.c
index ed5e9742be2c..a8f0512bad38 100644
--- a/drivers/net/a2065.c
+++ b/drivers/net/a2065.c
@@ -674,6 +674,7 @@ static struct zorro_device_id a2065_zorro_tbl[] __devinitdata = {
         { ZORRO_PROD_AMERISTAR_A2065 },
         { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, a2065_zorro_tbl);
 
 static struct zorro_driver a2065_driver = {
         .name           = "a2065",
diff --git a/drivers/net/ariadne.c b/drivers/net/ariadne.c
index fa1a2354f5f9..4b30a46486e2 100644
--- a/drivers/net/ariadne.c
+++ b/drivers/net/ariadne.c
@@ -145,6 +145,7 @@ static struct zorro_device_id ariadne_zorro_tbl[] __devinitdata = {
     { ZORRO_PROD_VILLAGE_TRONIC_ARIADNE },
     { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, ariadne_zorro_tbl);
 
 static struct zorro_driver ariadne_driver = {
     .name       = "ariadne",
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index dbf81788bb40..d5d55c6a373f 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2524,12 +2524,12 @@ static void e1000_configure_rx(struct e1000_adapter *adapter)
                          * excessive C-state transition latencies result in
                          * dropped transactions.
                          */
-                        pm_qos_update_requirement(PM_QOS_CPU_DMA_LATENCY,
-                                                  adapter->netdev->name, 55);
+                        pm_qos_update_request(
+                                adapter->netdev->pm_qos_req, 55);
                 } else {
-                        pm_qos_update_requirement(PM_QOS_CPU_DMA_LATENCY,
-                                                  adapter->netdev->name,
-                                                  PM_QOS_DEFAULT_VALUE);
+                        pm_qos_update_request(
+                                adapter->netdev->pm_qos_req,
+                                PM_QOS_DEFAULT_VALUE);
                 }
         }
 
@@ -2824,8 +2824,8 @@ int e1000e_up(struct e1000_adapter *adapter)
 
         /* DMA latency requirement to workaround early-receive/jumbo issue */
         if (adapter->flags & FLAG_HAS_ERT)
-                pm_qos_add_requirement(PM_QOS_CPU_DMA_LATENCY,
-                                       adapter->netdev->name,
+                adapter->netdev->pm_qos_req =
+                        pm_qos_add_request(PM_QOS_CPU_DMA_LATENCY,
                                        PM_QOS_DEFAULT_VALUE);
 
         /* hardware has been reset, we need to reload some things */
@@ -2887,9 +2887,11 @@ void e1000e_down(struct e1000_adapter *adapter)
         e1000_clean_tx_ring(adapter);
         e1000_clean_rx_ring(adapter);
 
-        if (adapter->flags & FLAG_HAS_ERT)
-                pm_qos_remove_requirement(PM_QOS_CPU_DMA_LATENCY,
-                                          adapter->netdev->name);
+        if (adapter->flags & FLAG_HAS_ERT) {
+                pm_qos_remove_request(
+                              adapter->netdev->pm_qos_req);
+                adapter->netdev->pm_qos_req = NULL;
+        }
 
         /*
          * TODO: for power management, we could drop the link and
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 4e97ca182997..5d3763fb3472 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1649,6 +1649,7 @@ static void free_skb_resources(struct gfar_private *priv)
                         sizeof(struct rxbd8) * priv->total_rx_ring_size,
                         priv->tx_queue[0]->tx_bd_base,
                         priv->tx_queue[0]->tx_bd_dma_base);
+        skb_queue_purge(&priv->rx_recycle);
 }
 
 void gfar_start(struct net_device *dev)
@@ -2088,7 +2089,6 @@ static int gfar_close(struct net_device *dev)
 
         disable_napi(priv);
 
-        skb_queue_purge(&priv->rx_recycle);
         cancel_work_sync(&priv->reset_task);
         stop_gfar(dev);
 
diff --git a/drivers/net/hydra.c b/drivers/net/hydra.c
index 24724b4ad709..07d8e5b634f3 100644
--- a/drivers/net/hydra.c
+++ b/drivers/net/hydra.c
@@ -71,6 +71,7 @@ static struct zorro_device_id hydra_zorro_tbl[] __devinitdata = {
     { ZORRO_PROD_HYDRA_SYSTEMS_AMIGANET },
     { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, hydra_zorro_tbl);
 
 static struct zorro_driver hydra_driver = {
     .name       = "hydra",
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index 1b1edad1eb5e..f16e981812a9 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -48,6 +48,7 @@
 #define DRV_VERSION "1.0.0-k0"
 char igbvf_driver_name[] = "igbvf";
 const char igbvf_driver_version[] = DRV_VERSION;
+struct pm_qos_request_list *igbvf_driver_pm_qos_req;
 static const char igbvf_driver_string[] =
                                 "Intel(R) Virtual Function Network Driver";
 static const char igbvf_copyright[] = "Copyright (c) 2009 Intel Corporation.";
@@ -2899,7 +2900,7 @@ static int __init igbvf_init_module(void)
         printk(KERN_INFO "%s\n", igbvf_copyright);
 
         ret = pci_register_driver(&igbvf_driver);
-        pm_qos_add_requirement(PM_QOS_CPU_DMA_LATENCY, igbvf_driver_name,
+        igbvf_driver_pm_qos_req = pm_qos_add_request(PM_QOS_CPU_DMA_LATENCY,
                                PM_QOS_DEFAULT_VALUE);
 
         return ret;
@@ -2915,7 +2916,8 @@ module_init(igbvf_init_module);
 static void __exit igbvf_exit_module(void)
 {
         pci_unregister_driver(&igbvf_driver);
-        pm_qos_remove_requirement(PM_QOS_CPU_DMA_LATENCY, igbvf_driver_name);
+        pm_qos_remove_request(igbvf_driver_pm_qos_req);
+        igbvf_driver_pm_qos_req = NULL;
 }
 module_exit(igbvf_exit_module);
 
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 0cd80e4d71d9..e67691dca4ab 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -32,6 +32,7 @@ static int kszphy_config_init(struct phy_device *phydev)
 
 static struct phy_driver ks8001_driver = {
         .phy_id         = PHY_ID_KS8001,
+        .name           = "Micrel KS8001",
         .phy_id_mask    = 0x00fffff0,
         .features       = PHY_BASIC_FEATURES,
         .flags          = PHY_POLL,
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index f9f0730b53d5..5ec542dd5b50 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -187,7 +187,6 @@ tx_drop:
         return NETDEV_TX_OK;
 
 rx_drop:
-        kfree_skb(skb);
         rcv_stats->rx_dropped++;
         return NETDEV_TX_OK;
 }
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 99a6da464bd3..e1c2fcaa8bed 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -727,12 +727,16 @@ static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
 {
         struct device *parent = aru->udev->dev.parent;
 
+        complete(&aru->firmware_loading_complete);
+
         /* unbind anything failed */
         if (parent)
                 down(&parent->sem);
         device_release_driver(&aru->udev->dev);
         if (parent)
                 up(&parent->sem);
+
+        usb_put_dev(aru->udev);
 }
 
 static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
@@ -761,6 +765,8 @@ static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
         if (err)
                 goto err_unrx;
 
+        complete(&aru->firmware_loading_complete);
+        usb_put_dev(aru->udev);
         return;
 
  err_unrx:
@@ -858,6 +864,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         init_usb_anchor(&aru->tx_pending);
         init_usb_anchor(&aru->tx_submitted);
         init_completion(&aru->cmd_wait);
+        init_completion(&aru->firmware_loading_complete);
         spin_lock_init(&aru->tx_urb_lock);
 
         aru->tx_pending_urbs = 0;
@@ -877,6 +884,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         if (err)
                 goto err_freehw;
 
+        usb_get_dev(aru->udev);
         return request_firmware_nowait(THIS_MODULE, 1, "ar9170.fw",
                                        &aru->udev->dev, GFP_KERNEL, aru,
                                        ar9170_usb_firmware_step2);
@@ -896,6 +904,9 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
                 return;
 
         aru->common.state = AR9170_IDLE;
+
+        wait_for_completion(&aru->firmware_loading_complete);
+
         ar9170_unregister(&aru->common);
         ar9170_usb_cancel_urbs(aru);
 
diff --git a/drivers/net/wireless/ath/ar9170/usb.h b/drivers/net/wireless/ath/ar9170/usb.h
index a2ce3b169ceb..919b06046eb3 100644
--- a/drivers/net/wireless/ath/ar9170/usb.h
+++ b/drivers/net/wireless/ath/ar9170/usb.h
@@ -71,6 +71,7 @@ struct ar9170_usb {
         unsigned int tx_pending_urbs;
 
         struct completion cmd_wait;
+        struct completion firmware_loading_complete;
         int readlen;
         u8 *readbuf;
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 9b72c45a7748..2b05fe5e994c 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -174,6 +174,8 @@ that only one external action is invoked at a time.
 #define DRV_DESCRIPTION "Intel(R) PRO/Wireless 2100 Network Driver"
 #define DRV_COPYRIGHT   "Copyright(c) 2003-2006 Intel Corporation"
 
+struct pm_qos_request_list *ipw2100_pm_qos_req;
+
 /* Debugging stuff */
 #ifdef CONFIG_IPW2100_DEBUG
 #define IPW2100_RX_DEBUG        /* Reception debugging */
@@ -1739,7 +1741,7 @@ static int ipw2100_up(struct ipw2100_priv *priv, int deferred)
         /* the ipw2100 hardware really doesn't want power management delays
          * longer than 175usec
          */
-        pm_qos_update_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100", 175);
+        pm_qos_update_request(ipw2100_pm_qos_req, 175);
 
         /* If the interrupt is enabled, turn it off... */
         spin_lock_irqsave(&priv->low_lock, flags);
@@ -1887,8 +1889,7 @@ static void ipw2100_down(struct ipw2100_priv *priv)
         ipw2100_disable_interrupts(priv);
         spin_unlock_irqrestore(&priv->low_lock, flags);
 
-        pm_qos_update_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100",
-                        PM_QOS_DEFAULT_VALUE);
+        pm_qos_update_request(ipw2100_pm_qos_req, PM_QOS_DEFAULT_VALUE);
 
         /* We have to signal any supplicant if we are disassociating */
         if (associated)
@@ -6669,7 +6670,7 @@ static int __init ipw2100_init(void)
         if (ret)
                 goto out;
 
-        pm_qos_add_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100",
+        ipw2100_pm_qos_req = pm_qos_add_request(PM_QOS_CPU_DMA_LATENCY,
                         PM_QOS_DEFAULT_VALUE);
 #ifdef CONFIG_IPW2100_DEBUG
         ipw2100_debug_level = debug;
@@ -6692,7 +6693,7 @@ static void __exit ipw2100_exit(void)
                            &driver_attr_debug_level);
 #endif
         pci_unregister_driver(&ipw2100_pci_driver);
-        pm_qos_remove_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100");
+        pm_qos_remove_request(ipw2100_pm_qos_req);
 }
 
 module_init(ipw2100_init);
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 6383d9f8c9b3..f4e59ae07f8e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -2621,7 +2621,9 @@ struct iwl_ssid_ie {
 #define PROBE_OPTION_MAX_3945           4
 #define PROBE_OPTION_MAX                20
 #define TX_CMD_LIFE_TIME_INFINITE       cpu_to_le32(0xFFFFFFFF)
-#define IWL_GOOD_CRC_TH                 cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_DISABLED        0
+#define IWL_GOOD_CRC_TH_DEFAULT         cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_NEVER           cpu_to_le16(0xffff)
 #define IWL_MAX_SCAN_SIZE 1024
 #define IWL_MAX_CMD_SIZE 4096
 #define IWL_MAX_PROBE_REQUEST           200
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 12e455a4b90e..741e65ec8301 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -813,16 +813,29 @@ static void iwl_bg_request_scan(struct work_struct *data)
                         rate = IWL_RATE_1M_PLCP;
                         rate_flags = RATE_MCS_CCK_MSK;
                 }
-                scan->good_CRC_th = 0;
+                scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
         } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                 band = IEEE80211_BAND_5GHZ;
                 rate = IWL_RATE_6M_PLCP;
                 /*
-                 * If active scaning is requested but a certain channel
-                 * is marked passive, we can do active scanning if we
-                 * detect transmissions.
+                 * If active scanning is requested but a certain channel is
+                 * marked passive, we can do active scanning if we detect
+                 * transmissions.
+                 *
+                 * There is an issue with some firmware versions that triggers
+                 * a sysassert on a "good CRC threshold" of zero (== disabled),
+                 * on a radar channel even though this means that we should NOT
+                 * send probes.
+                 *
+                 * The "good CRC threshold" is the number of frames that we
+                 * need to receive during our dwell time on a channel before
+                 * sending out probes -- setting this to a huge value will
+                 * mean we never reach it, but at the same time work around
+                 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+                 * here instead of IWL_GOOD_CRC_TH_DISABLED.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_NEVER;
 
                 /* Force use of chains B and C (0x6) for scan Rx for 4965
                  * Avoid A (0x1) because of its off-channel reception on A-band.
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index b55e4f39a9e1..b74a56c48d26 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -2967,7 +2967,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                  * is marked passive, we can do active scanning if we
                  * detect transmissions.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_DISABLED;
                 band = IEEE80211_BAND_5GHZ;
         } else {
                 IWL_WARN(priv, "Invalid scan band count\n");
diff --git a/drivers/net/zorro8390.c b/drivers/net/zorro8390.c
index 81c753a617ab..9548cbb5012a 100644
--- a/drivers/net/zorro8390.c
+++ b/drivers/net/zorro8390.c
@@ -102,6 +102,7 @@ static struct zorro_device_id zorro8390_zorro_tbl[] __devinitdata = {
     { ZORRO_PROD_INDIVIDUAL_COMPUTERS_X_SURF, },
     { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, zorro8390_zorro_tbl);
 
 static struct zorro_driver zorro8390_driver = {
     .name       = "zorro8390",
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index 166b67ea622f..219f79e2210a 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -30,23 +30,7 @@
 
 #define OP_BUFFER_FLAGS 0
 
-/*
- * Read and write access is using spin locking. Thus, writing to the
- * buffer by NMI handler (x86) could occur also during critical
- * sections when reading the buffer. To avoid this, there are 2
- * buffers for independent read and write access. Read access is in
- * process context only, write access only in the NMI handler. If the
- * read buffer runs empty, both buffers are swapped atomically. There
- * is potentially a small window during swapping where the buffers are
- * disabled and samples could be lost.
- *
- * Using 2 buffers is a little bit overhead, but the solution is clear
- * and does not require changes in the ring buffer implementation. It
- * can be changed to a single buffer solution when the ring buffer
- * access is implemented as non-locking atomic code.
- */
-static struct ring_buffer *op_ring_buffer_read;
-static struct ring_buffer *op_ring_buffer_write;
+static struct ring_buffer *op_ring_buffer;
 DEFINE_PER_CPU(struct oprofile_cpu_buffer, op_cpu_buffer);
 
 static void wq_sync_buffer(struct work_struct *work);
@@ -68,12 +52,9 @@ void oprofile_cpu_buffer_inc_smpl_lost(void)
 
 void free_cpu_buffers(void)
 {
-        if (op_ring_buffer_read)
-                ring_buffer_free(op_ring_buffer_read);
-        op_ring_buffer_read = NULL;
-        if (op_ring_buffer_write)
-                ring_buffer_free(op_ring_buffer_write);
-        op_ring_buffer_write = NULL;
+        if (op_ring_buffer)
+                ring_buffer_free(op_ring_buffer);
+        op_ring_buffer = NULL;
 }
 
 #define RB_EVENT_HDR_SIZE 4
@@ -86,11 +67,8 @@ int alloc_cpu_buffers(void)
         unsigned long byte_size = buffer_size * (sizeof(struct op_sample) +
                                                  RB_EVENT_HDR_SIZE);
 
-        op_ring_buffer_read = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
-        if (!op_ring_buffer_read)
-                goto fail;
-        op_ring_buffer_write = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
-        if (!op_ring_buffer_write)
+        op_ring_buffer = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
+        if (!op_ring_buffer)
                 goto fail;
 
         for_each_possible_cpu(i) {
@@ -162,16 +140,11 @@ struct op_sample
 *op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size)
 {
         entry->event = ring_buffer_lock_reserve
-                (op_ring_buffer_write, sizeof(struct op_sample) +
+                (op_ring_buffer, sizeof(struct op_sample) +
                  size * sizeof(entry->sample->data[0]));
-        if (entry->event)
-                entry->sample = ring_buffer_event_data(entry->event);
-        else
-                entry->sample = NULL;
-
-        if (!entry->sample)
+        if (!entry->event)
                 return NULL;
-
+        entry->sample = ring_buffer_event_data(entry->event);
         entry->size = size;
         entry->data = entry->sample->data;
 
@@ -180,25 +153,16 @@ struct op_sample
 
 int op_cpu_buffer_write_commit(struct op_entry *entry)
 {
-        return ring_buffer_unlock_commit(op_ring_buffer_write, entry->event);
+        return ring_buffer_unlock_commit(op_ring_buffer, entry->event);
 }
 
 struct op_sample *op_cpu_buffer_read_entry(struct op_entry *entry, int cpu)
 {
         struct ring_buffer_event *e;
-        e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL);
-        if (e)
-                goto event;
-        if (ring_buffer_swap_cpu(op_ring_buffer_read,
-                                 op_ring_buffer_write,
-                                 cpu))
+        e = ring_buffer_consume(op_ring_buffer, cpu, NULL, NULL);
+        if (!e)
                 return NULL;
-        e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL);
-        if (e)
-                goto event;
-        return NULL;
 
-event:
         entry->event = e;
         entry->sample = ring_buffer_event_data(e);
         entry->size = (ring_buffer_event_length(e) - sizeof(struct op_sample))
@@ -209,8 +173,7 @@ event:
 
 unsigned long op_cpu_buffer_entries(int cpu)
 {
-        return ring_buffer_entries_cpu(op_ring_buffer_read, cpu)
-                + ring_buffer_entries_cpu(op_ring_buffer_write, cpu);
+        return ring_buffer_entries_cpu(op_ring_buffer, cpu);
 }
 
 static int
@@ -356,8 +319,16 @@ void oprofile_add_ext_sample(unsigned long pc, struct pt_regs * const regs,
 
 void oprofile_add_sample(struct pt_regs * const regs, unsigned long event)
 {
-        int is_kernel = !user_mode(regs);
-        unsigned long pc = profile_pc(regs);
+        int is_kernel;
+        unsigned long pc;
+
+        if (likely(regs)) {
+                is_kernel = !user_mode(regs);
+                pc = profile_pc(regs);
+        } else {
+                is_kernel = 0;    /* This value will not be used */
+                pc = ESCAPE_CODE; /* as this causes an early return. */
+        }
 
         __oprofile_add_ext_sample(pc, regs, event, is_kernel);
 }
diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
index dc8a0428260d..b336cd9ee7a1 100644
--- a/drivers/oprofile/oprof.c
+++ b/drivers/oprofile/oprof.c
@@ -253,22 +253,26 @@ static int __init oprofile_init(void)
         int err;
 
         err = oprofile_arch_init(&oprofile_ops);
-
         if (err < 0 || timer) {
                 printk(KERN_INFO "oprofile: using timer interrupt.\n");
-                oprofile_timer_init(&oprofile_ops);
+                err = oprofile_timer_init(&oprofile_ops);
+                if (err)
+                        goto out_arch;
         }
-
         err = oprofilefs_register();
         if (err)
-                oprofile_arch_exit();
+                goto out_arch;
+        return 0;
 
+out_arch:
+        oprofile_arch_exit();
         return err;
 }
 
 
 static void __exit oprofile_exit(void)
 {
+        oprofile_timer_exit();
         oprofilefs_unregister();
         oprofile_arch_exit();
 }
diff --git a/drivers/oprofile/oprof.h b/drivers/oprofile/oprof.h
index cb92f5c98c1a..47e12cb4ee8b 100644
--- a/drivers/oprofile/oprof.h
+++ b/drivers/oprofile/oprof.h
@@ -34,7 +34,8 @@ struct super_block;
 struct dentry;
 
 void oprofile_create_files(struct super_block *sb, struct dentry *root);
-void oprofile_timer_init(struct oprofile_operations *ops);
+int oprofile_timer_init(struct oprofile_operations *ops);
+void oprofile_timer_exit(void);
 
 int oprofile_set_backtrace(unsigned long depth);
 int oprofile_set_timeout(unsigned long time);
diff --git a/drivers/oprofile/timer_int.c b/drivers/oprofile/timer_int.c
index 333f915568c7..dc0ae4d14dff 100644
--- a/drivers/oprofile/timer_int.c
+++ b/drivers/oprofile/timer_int.c
@@ -13,34 +13,94 @@
 #include <linux/oprofile.h>
 #include <linux/profile.h>
 #include <linux/init.h>
+#include <linux/cpu.h>
+#include <linux/hrtimer.h>
+#include <asm/irq_regs.h>
 #include <asm/ptrace.h>
 
 #include "oprof.h"
 
-static int timer_notify(struct pt_regs *regs)
+static DEFINE_PER_CPU(struct hrtimer, oprofile_hrtimer);
+
+static enum hrtimer_restart oprofile_hrtimer_notify(struct hrtimer *hrtimer)
+{
+        oprofile_add_sample(get_irq_regs(), 0);
+        hrtimer_forward_now(hrtimer, ns_to_ktime(TICK_NSEC));
+        return HRTIMER_RESTART;
+}
+
+static void __oprofile_hrtimer_start(void *unused)
+{
+        struct hrtimer *hrtimer = &__get_cpu_var(oprofile_hrtimer);
+
+        hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        hrtimer->function = oprofile_hrtimer_notify;
+
+        hrtimer_start(hrtimer, ns_to_ktime(TICK_NSEC),
+                      HRTIMER_MODE_REL_PINNED);
+}
+
+static int oprofile_hrtimer_start(void)
 {
-        oprofile_add_sample(regs, 0);
+        on_each_cpu(__oprofile_hrtimer_start, NULL, 1);
         return 0;
 }
 
-static int timer_start(void)
+static void __oprofile_hrtimer_stop(int cpu)
 {
-        return register_timer_hook(timer_notify);
+        struct hrtimer *hrtimer = &per_cpu(oprofile_hrtimer, cpu);
+
+        hrtimer_cancel(hrtimer);
 }
 
+static void oprofile_hrtimer_stop(void)
+{
+        int cpu;
+
+        for_each_online_cpu(cpu)
+                __oprofile_hrtimer_stop(cpu);
+}
 
-static void timer_stop(void)
+static int __cpuinit oprofile_cpu_notify(struct notifier_block *self,
+                                         unsigned long action, void *hcpu)
 {
-        unregister_timer_hook(timer_notify);
+        long cpu = (long) hcpu;
+
+        switch (action) {
+        case CPU_ONLINE:
+        case CPU_ONLINE_FROZEN:
+                smp_call_function_single(cpu, __oprofile_hrtimer_start,
+                                         NULL, 1);
+                break;
+        case CPU_DEAD:
+        case CPU_DEAD_FROZEN:
+                __oprofile_hrtimer_stop(cpu);
+                break;
+        }
+        return NOTIFY_OK;
 }
 
+static struct notifier_block __refdata oprofile_cpu_notifier = {
+        .notifier_call = oprofile_cpu_notify,
+};
 
-void __init oprofile_timer_init(struct oprofile_operations *ops)
+int __init oprofile_timer_init(struct oprofile_operations *ops)
 {
+        int rc;
+
+        rc = register_hotcpu_notifier(&oprofile_cpu_notifier);
+        if (rc)
+                return rc;
         ops->create_files = NULL;
         ops->setup = NULL;
         ops->shutdown = NULL;
-        ops->start = timer_start;
-        ops->stop = timer_stop;
+        ops->start = oprofile_hrtimer_start;
+        ops->stop = oprofile_hrtimer_stop;
         ops->cpu_type = "timer";
+        return 0;
+}
+
+void __exit oprofile_timer_exit(void)
+{
+        unregister_hotcpu_notifier(&oprofile_cpu_notifier);
 }
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 417312528ddf..371dc564e2e4 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -3626,14 +3626,15 @@ static void intel_iommu_detach_device(struct iommu_domain *domain,
         domain_remove_one_dev_info(dmar_domain, pdev);
 }
 
-static int intel_iommu_map_range(struct iommu_domain *domain,
-                                 unsigned long iova, phys_addr_t hpa,
-                                 size_t size, int iommu_prot)
+static int intel_iommu_map(struct iommu_domain *domain,
+                           unsigned long iova, phys_addr_t hpa,
+                           int gfp_order, int iommu_prot)
 {
         struct dmar_domain *dmar_domain = domain->priv;
         u64 max_addr;
         int addr_width;
         int prot = 0;
+        size_t size;
         int ret;
 
         if (iommu_prot & IOMMU_READ)
@@ -3643,6 +3644,7 @@ static int intel_iommu_map_range(struct iommu_domain *domain,
         if ((iommu_prot & IOMMU_CACHE) && dmar_domain->iommu_snooping)
                 prot |= DMA_PTE_SNP;
 
+        size     = PAGE_SIZE << gfp_order;
         max_addr = iova + size;
         if (dmar_domain->max_addr < max_addr) {
                 int min_agaw;
@@ -3669,19 +3671,19 @@ static int intel_iommu_map_range(struct iommu_domain *domain,
         return ret;
 }
 
-static void intel_iommu_unmap_range(struct iommu_domain *domain,
-                                    unsigned long iova, size_t size)
+static int intel_iommu_unmap(struct iommu_domain *domain,
+                             unsigned long iova, int gfp_order)
 {
         struct dmar_domain *dmar_domain = domain->priv;
-
-        if (!size)
-                return;
+        size_t size = PAGE_SIZE << gfp_order;
 
         dma_pte_clear_range(dmar_domain, iova >> VTD_PAGE_SHIFT,
                             (iova + size - 1) >> VTD_PAGE_SHIFT);
 
         if (dmar_domain->max_addr == iova + size)
                 dmar_domain->max_addr = iova;
+
+        return gfp_order;
 }
 
 static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
@@ -3714,8 +3716,8 @@ static struct iommu_ops intel_iommu_ops = {
         .domain_destroy = intel_iommu_domain_destroy,
         .attach_dev     = intel_iommu_attach_device,
         .detach_dev     = intel_iommu_detach_device,
-        .map            = intel_iommu_map_range,
-        .unmap          = intel_iommu_unmap_range,
+        .map            = intel_iommu_map,
+        .unmap          = intel_iommu_unmap,
         .iova_to_phys   = intel_iommu_iova_to_phys,
         .domain_has_cap = intel_iommu_domain_has_cap,
 };
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 4fe36d2e1049..19b111383f62 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -838,65 +838,11 @@ static void pci_bus_dump_resources(struct pci_bus *bus)
         }
 }
 
-static int __init pci_bus_get_depth(struct pci_bus *bus)
-{
-        int depth = 0;
-        struct pci_dev *dev;
-
-        list_for_each_entry(dev, &bus->devices, bus_list) {
-                int ret;
-                struct pci_bus *b = dev->subordinate;
-                if (!b)
-                        continue;
-
-                ret = pci_bus_get_depth(b);
-                if (ret + 1 > depth)
-                        depth = ret + 1;
-        }
-
-        return depth;
-}
-static int __init pci_get_max_depth(void)
-{
-        int depth = 0;
-        struct pci_bus *bus;
-
-        list_for_each_entry(bus, &pci_root_buses, node) {
-                int ret;
-
-                ret = pci_bus_get_depth(bus);
-                if (ret > depth)
-                        depth = ret;
-        }
-
-        return depth;
-}
-
-/*
- * first try will not touch pci bridge res
- * second  and later try will clear small leaf bridge res
- * will stop till to the max  deepth if can not find good one
- */
 void __init
 pci_assign_unassigned_resources(void)
 {
         struct pci_bus *bus;
-        int tried_times = 0;
-        enum release_type rel_type = leaf_only;
-        struct resource_list_x head, *list;
-        unsigned long type_mask = IORESOURCE_IO | IORESOURCE_MEM |
-                                  IORESOURCE_PREFETCH;
-        unsigned long failed_type;
-        int max_depth = pci_get_max_depth();
-        int pci_try_num;
 
-        head.next = NULL;
-
-        pci_try_num = max_depth + 1;
-        printk(KERN_DEBUG "PCI: max bus depth: %d pci_try_num: %d\n",
-                 max_depth, pci_try_num);
-
-again:
         /* Depth first, calculate sizes and alignments of all
            subordinate buses. */
         list_for_each_entry(bus, &pci_root_buses, node) {
@@ -904,65 +850,9 @@ again:
         }
         /* Depth last, allocate resources and update the hardware. */
         list_for_each_entry(bus, &pci_root_buses, node) {
-                __pci_bus_assign_resources(bus, &head);
-        }
-        tried_times++;
-
-        /* any device complain? */
-        if (!head.next)
-                goto enable_and_dump;
-        failed_type = 0;
-        for (list = head.next; list;) {
-                failed_type |= list->flags;
-                list = list->next;
-        }
-        /*
-         * io port are tight, don't try extra
-         * or if reach the limit, don't want to try more
-         */
-        failed_type &= type_mask;
-        if ((failed_type == IORESOURCE_IO) || (tried_times >= pci_try_num)) {
-                free_failed_list(&head);
-                goto enable_and_dump;
-        }
-
-        printk(KERN_DEBUG "PCI: No. %d try to assign unassigned res\n",
-                         tried_times + 1);
-
-        /* third times and later will not check if it is leaf */
-        if ((tried_times + 1) > 2)
-                rel_type = whole_subtree;
-
-        /*
-         * Try to release leaf bridge's resources that doesn't fit resource of
-         * child device under that bridge
-         */
-        for (list = head.next; list;) {
-                bus = list->dev->bus;
-                pci_bus_release_bridge_resources(bus, list->flags & type_mask,
-                                                  rel_type);
-                list = list->next;
-        }
-        /* restore size and flags */
-        for (list = head.next; list;) {
-                struct resource *res = list->res;
-
-                res->start = list->start;
-                res->end = list->end;
-                res->flags = list->flags;
-                if (list->dev->subordinate)
-                        res->flags = 0;
-
-                list = list->next;
-        }
-        free_failed_list(&head);
-
-        goto again;
-
-enable_and_dump:
-        /* Depth last, update the hardware. */
-        list_for_each_entry(bus, &pci_root_buses, node)
+                pci_bus_assign_resources(bus);
                 pci_enable_bridges(bus);
+        }
 
         /* dump the resource on buses */
         list_for_each_entry(bus, &pci_root_buses, node) {
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index caca50eaa0e7..d0f5ad306078 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -214,7 +214,8 @@ config PCMCIA_PXA2XX
         depends on ARM && ARCH_PXA && PCMCIA
         depends on (ARCH_LUBBOCK || MACH_MAINSTONE || PXA_SHARPSL \
                     || MACH_ARMCORE || ARCH_PXA_PALM || TRIZEPS_PCMCIA \
-                    || ARCOM_PCMCIA || ARCH_PXA_ESERIES || MACH_STARGATE2)
+                    || ARCOM_PCMCIA || ARCH_PXA_ESERIES || MACH_STARGATE2 \
+                    || MACH_VPAC270)
         select PCMCIA_SOC_COMMON
         help
           Say Y here to include support for the PXA2xx PCMCIA controller
diff --git a/drivers/pcmcia/Makefile b/drivers/pcmcia/Makefile
index 7031d0a4f4b0..d006e8beab9c 100644
--- a/drivers/pcmcia/Makefile
+++ b/drivers/pcmcia/Makefile
@@ -69,6 +69,7 @@ pxa2xx-obj-$(CONFIG_MACH_PALMTC)		+= pxa2xx_palmtc.o
 pxa2xx-obj-$(CONFIG_MACH_PALMLD)                += pxa2xx_palmld.o
 pxa2xx-obj-$(CONFIG_MACH_E740)                  += pxa2xx_e740.o
 pxa2xx-obj-$(CONFIG_MACH_STARGATE2)             += pxa2xx_stargate2.o
+pxa2xx-obj-$(CONFIG_MACH_VPAC270)               += pxa2xx_vpac270.o
 
 obj-$(CONFIG_PCMCIA_PXA2XX)                     += pxa2xx_base.o $(pxa2xx-obj-y)
 
diff --git a/drivers/pcmcia/pxa2xx_vpac270.c b/drivers/pcmcia/pxa2xx_vpac270.c
new file mode 100644
index 000000000000..55627eccee8e
--- /dev/null
+++ b/drivers/pcmcia/pxa2xx_vpac270.c
@@ -0,0 +1,229 @@
+/*
+ * linux/drivers/pcmcia/pxa2xx_vpac270.c
+ *
+ * Driver for Voipac PXA270 PCMCIA and CF sockets
+ *
+ * Copyright (C) 2010
+ * Marek Vasut <marek.vasut@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <asm/mach-types.h>
+
+#include <mach/gpio.h>
+#include <mach/vpac270.h>
+
+#include "soc_common.h"
+
+static struct pcmcia_irqs cd_irqs[] = {
+        {
+                .sock = 0,
+                .irq  = IRQ_GPIO(GPIO84_VPAC270_PCMCIA_CD),
+                .str  = "PCMCIA CD"
+        },
+        {
+                .sock = 1,
+                .irq  = IRQ_GPIO(GPIO17_VPAC270_CF_CD),
+                .str  = "CF CD"
+        },
+};
+
+static int vpac270_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
+{
+        int ret;
+
+        if (skt->nr == 0) {
+                ret = gpio_request(GPIO84_VPAC270_PCMCIA_CD, "PCMCIA CD");
+                if (ret)
+                        goto err1;
+                ret = gpio_direction_input(GPIO84_VPAC270_PCMCIA_CD);
+                if (ret)
+                        goto err2;
+
+                ret = gpio_request(GPIO35_VPAC270_PCMCIA_RDY, "PCMCIA RDY");
+                if (ret)
+                        goto err2;
+                ret = gpio_direction_input(GPIO35_VPAC270_PCMCIA_RDY);
+                if (ret)
+                        goto err3;
+
+                ret = gpio_request(GPIO107_VPAC270_PCMCIA_PPEN, "PCMCIA PPEN");
+                if (ret)
+                        goto err3;
+                ret = gpio_direction_output(GPIO107_VPAC270_PCMCIA_PPEN, 0);
+                if (ret)
+                        goto err4;
+
+                ret = gpio_request(GPIO11_VPAC270_PCMCIA_RESET, "PCMCIA RESET");
+                if (ret)
+                        goto err4;
+                ret = gpio_direction_output(GPIO11_VPAC270_PCMCIA_RESET, 0);
+                if (ret)
+                        goto err5;
+
+                skt->socket.pci_irq = gpio_to_irq(GPIO35_VPAC270_PCMCIA_RDY);
+
+                return soc_pcmcia_request_irqs(skt, &cd_irqs[0], 1);
+
+err5:
+                gpio_free(GPIO11_VPAC270_PCMCIA_RESET);
+err4:
+                gpio_free(GPIO107_VPAC270_PCMCIA_PPEN);
+err3:
+                gpio_free(GPIO35_VPAC270_PCMCIA_RDY);
+err2:
+                gpio_free(GPIO84_VPAC270_PCMCIA_CD);
+err1:
+                return ret;
+
+        } else {
+                ret = gpio_request(GPIO17_VPAC270_CF_CD, "CF CD");
+                if (ret)
+                        goto err6;
+                ret = gpio_direction_input(GPIO17_VPAC270_CF_CD);
+                if (ret)
+                        goto err7;
+
+                ret = gpio_request(GPIO12_VPAC270_CF_RDY, "CF RDY");
+                if (ret)
+                        goto err7;
+                ret = gpio_direction_input(GPIO12_VPAC270_CF_RDY);
+                if (ret)
+                        goto err8;
+
+                ret = gpio_request(GPIO16_VPAC270_CF_RESET, "CF RESET");
+                if (ret)
+                        goto err8;
+                ret = gpio_direction_output(GPIO16_VPAC270_CF_RESET, 0);
+                if (ret)
+                        goto err9;
+
+                skt->socket.pci_irq = gpio_to_irq(GPIO12_VPAC270_CF_RDY);
+
+                return soc_pcmcia_request_irqs(skt, &cd_irqs[1], 1);
+
+err9:
+                gpio_free(GPIO16_VPAC270_CF_RESET);
+err8:
+                gpio_free(GPIO12_VPAC270_CF_RDY);
+err7:
+                gpio_free(GPIO17_VPAC270_CF_CD);
+err6:
+                return ret;
+
+        }
+}
+
+static void vpac270_pcmcia_hw_shutdown(struct soc_pcmcia_socket *skt)
+{
+        gpio_free(GPIO11_VPAC270_PCMCIA_RESET);
+        gpio_free(GPIO107_VPAC270_PCMCIA_PPEN);
+        gpio_free(GPIO35_VPAC270_PCMCIA_RDY);
+        gpio_free(GPIO84_VPAC270_PCMCIA_CD);
+        gpio_free(GPIO16_VPAC270_CF_RESET);
+        gpio_free(GPIO12_VPAC270_CF_RDY);
+        gpio_free(GPIO17_VPAC270_CF_CD);
+}
+
+static void vpac270_pcmcia_socket_state(struct soc_pcmcia_socket *skt,
+                                        struct pcmcia_state *state)
+{
+        if (skt->nr == 0) {
+                state->detect = !gpio_get_value(GPIO84_VPAC270_PCMCIA_CD);
+                state->ready  = !!gpio_get_value(GPIO35_VPAC270_PCMCIA_RDY);
+        } else {
+                state->detect = !gpio_get_value(GPIO17_VPAC270_CF_CD);
+                state->ready  = !!gpio_get_value(GPIO12_VPAC270_CF_RDY);
+        }
+        state->bvd1   = 1;
+        state->bvd2   = 1;
+        state->wrprot = 0;
+        state->vs_3v  = 1;
+        state->vs_Xv  = 0;
+}
+
+static int
+vpac270_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
+                                const socket_state_t *state)
+{
+        if (skt->nr == 0) {
+                gpio_set_value(GPIO11_VPAC270_PCMCIA_RESET,
+                        (state->flags & SS_RESET));
+                gpio_set_value(GPIO107_VPAC270_PCMCIA_PPEN,
+                        !(state->Vcc == 33 || state->Vcc == 50));
+        } else {
+                gpio_set_value(GPIO16_VPAC270_CF_RESET,
+                        (state->flags & SS_RESET));
+        }
+
+        return 0;
+}
+
+static void vpac270_pcmcia_socket_init(struct soc_pcmcia_socket *skt)
+{
+}
+
+static void vpac270_pcmcia_socket_suspend(struct soc_pcmcia_socket *skt)
+{
+}
+
+static struct pcmcia_low_level vpac270_pcmcia_ops = {
+        .owner                  = THIS_MODULE,
+
+        .first                  = 0,
+        .nr                     = 2,
+
+        .hw_init                = vpac270_pcmcia_hw_init,
+        .hw_shutdown            = vpac270_pcmcia_hw_shutdown,
+
+        .socket_state           = vpac270_pcmcia_socket_state,
+        .configure_socket       = vpac270_pcmcia_configure_socket,
+
+        .socket_init            = vpac270_pcmcia_socket_init,
+        .socket_suspend         = vpac270_pcmcia_socket_suspend,
+};
+
+static struct platform_device *vpac270_pcmcia_device;
+
+static int __init vpac270_pcmcia_init(void)
+{
+        int ret;
+
+        if (!machine_is_vpac270())
+                return -ENODEV;
+
+        vpac270_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
+        if (!vpac270_pcmcia_device)
+                return -ENOMEM;
+
+        ret = platform_device_add_data(vpac270_pcmcia_device,
+                &vpac270_pcmcia_ops, sizeof(vpac270_pcmcia_ops));
+
+        if (!ret)
+                ret = platform_device_add(vpac270_pcmcia_device);
+
+        if (ret)
+                platform_device_put(vpac270_pcmcia_device);
+
+        return ret;
+}
+
+static void __exit vpac270_pcmcia_exit(void)
+{
+        platform_device_unregister(vpac270_pcmcia_device);
+}
+
+module_init(vpac270_pcmcia_init);
+module_exit(vpac270_pcmcia_exit);
+
+MODULE_AUTHOR("Marek Vasut <marek.vasut@gmail.com>");
+MODULE_DESCRIPTION("PCMCIA support for Voipac PXA270");
+MODULE_ALIAS("platform:pxa2xx-pcmcia");
+MODULE_LICENSE("GPL");
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 6a1303759432..50ac047cd136 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -620,6 +620,16 @@ config RTC_DRV_NUC900
 
 comment "on-CPU RTC drivers"
 
+config RTC_DRV_DAVINCI
+        tristate "TI DaVinci RTC"
+        depends on ARCH_DAVINCI_DM365
+        help
+          If you say yes here you get support for the RTC on the
+          DaVinci platforms (DM365).
+
+          This driver can also be built as a module. If so, the module
+          will be called rtc-davinci.
+
 config RTC_DRV_OMAP
         tristate "TI OMAP1"
         depends on ARCH_OMAP15XX || ARCH_OMAP16XX || ARCH_OMAP730 || ARCH_DAVINCI_DA8XX
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index 44ef194a9573..245311a1348f 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_RTC_DRV_BQ32K)	+= rtc-bq32k.o
 obj-$(CONFIG_RTC_DRV_BQ4802)    += rtc-bq4802.o
 obj-$(CONFIG_RTC_DRV_CMOS)      += rtc-cmos.o
 obj-$(CONFIG_RTC_DRV_COH901331) += rtc-coh901331.o
+obj-$(CONFIG_RTC_DRV_DAVINCI)   += rtc-davinci.o
 obj-$(CONFIG_RTC_DRV_DM355EVM)  += rtc-dm355evm.o
 obj-$(CONFIG_RTC_DRV_DS1216)    += rtc-ds1216.o
 obj-$(CONFIG_RTC_DRV_DS1286)    += rtc-ds1286.o
diff --git a/drivers/rtc/rtc-davinci.c b/drivers/rtc/rtc-davinci.c
new file mode 100644
index 000000000000..92a8f6cacda9
--- /dev/null
+++ b/drivers/rtc/rtc-davinci.c
@@ -0,0 +1,673 @@
+/*
+ * DaVinci Power Management and Real Time Clock Driver for TI platforms
+ *
+ * Copyright (C) 2009 Texas Instruments, Inc
+ *
+ * Author: Miguel Aguilar <miguel.aguilar@ridgerun.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/ioport.h>
+#include <linux/delay.h>
+#include <linux/spinlock.h>
+#include <linux/rtc.h>
+#include <linux/bcd.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+
+/*
+ * The DaVinci RTC is a simple RTC with the following
+ * Sec: 0 - 59 : BCD count
+ * Min: 0 - 59 : BCD count
+ * Hour: 0 - 23 : BCD count
+ * Day: 0 - 0x7FFF(32767) : Binary count ( Over 89 years )
+ */
+
+/* PRTC interface registers */
+#define DAVINCI_PRTCIF_PID              0x00
+#define PRTCIF_CTLR                     0x04
+#define PRTCIF_LDATA                    0x08
+#define PRTCIF_UDATA                    0x0C
+#define PRTCIF_INTEN                    0x10
+#define PRTCIF_INTFLG                   0x14
+
+/* PRTCIF_CTLR bit fields */
+#define PRTCIF_CTLR_BUSY                BIT(31)
+#define PRTCIF_CTLR_SIZE                BIT(25)
+#define PRTCIF_CTLR_DIR                 BIT(24)
+#define PRTCIF_CTLR_BENU_MSB            BIT(23)
+#define PRTCIF_CTLR_BENU_3RD_BYTE       BIT(22)
+#define PRTCIF_CTLR_BENU_2ND_BYTE       BIT(21)
+#define PRTCIF_CTLR_BENU_LSB            BIT(20)
+#define PRTCIF_CTLR_BENU_MASK           (0x00F00000)
+#define PRTCIF_CTLR_BENL_MSB            BIT(19)
+#define PRTCIF_CTLR_BENL_3RD_BYTE       BIT(18)
+#define PRTCIF_CTLR_BENL_2ND_BYTE       BIT(17)
+#define PRTCIF_CTLR_BENL_LSB            BIT(16)
+#define PRTCIF_CTLR_BENL_MASK           (0x000F0000)
+
+/* PRTCIF_INTEN bit fields */
+#define PRTCIF_INTEN_RTCSS              BIT(1)
+#define PRTCIF_INTEN_RTCIF              BIT(0)
+#define PRTCIF_INTEN_MASK               (PRTCIF_INTEN_RTCSS \
+                                        | PRTCIF_INTEN_RTCIF)
+
+/* PRTCIF_INTFLG bit fields */
+#define PRTCIF_INTFLG_RTCSS             BIT(1)
+#define PRTCIF_INTFLG_RTCIF             BIT(0)
+#define PRTCIF_INTFLG_MASK              (PRTCIF_INTFLG_RTCSS \
+                                        | PRTCIF_INTFLG_RTCIF)
+
+/* PRTC subsystem registers */
+#define PRTCSS_RTC_INTC_EXTENA1         (0x0C)
+#define PRTCSS_RTC_CTRL                 (0x10)
+#define PRTCSS_RTC_WDT                  (0x11)
+#define PRTCSS_RTC_TMR0                 (0x12)
+#define PRTCSS_RTC_TMR1                 (0x13)
+#define PRTCSS_RTC_CCTRL                (0x14)
+#define PRTCSS_RTC_SEC                  (0x15)
+#define PRTCSS_RTC_MIN                  (0x16)
+#define PRTCSS_RTC_HOUR                 (0x17)
+#define PRTCSS_RTC_DAY0                 (0x18)
+#define PRTCSS_RTC_DAY1                 (0x19)
+#define PRTCSS_RTC_AMIN                 (0x1A)
+#define PRTCSS_RTC_AHOUR                (0x1B)
+#define PRTCSS_RTC_ADAY0                (0x1C)
+#define PRTCSS_RTC_ADAY1                (0x1D)
+#define PRTCSS_RTC_CLKC_CNT             (0x20)
+
+/* PRTCSS_RTC_INTC_EXTENA1 */
+#define PRTCSS_RTC_INTC_EXTENA1_MASK    (0x07)
+
+/* PRTCSS_RTC_CTRL bit fields */
+#define PRTCSS_RTC_CTRL_WDTBUS          BIT(7)
+#define PRTCSS_RTC_CTRL_WEN             BIT(6)
+#define PRTCSS_RTC_CTRL_WDRT            BIT(5)
+#define PRTCSS_RTC_CTRL_WDTFLG          BIT(4)
+#define PRTCSS_RTC_CTRL_TE              BIT(3)
+#define PRTCSS_RTC_CTRL_TIEN            BIT(2)
+#define PRTCSS_RTC_CTRL_TMRFLG          BIT(1)
+#define PRTCSS_RTC_CTRL_TMMD            BIT(0)
+
+/* PRTCSS_RTC_CCTRL bit fields */
+#define PRTCSS_RTC_CCTRL_CALBUSY        BIT(7)
+#define PRTCSS_RTC_CCTRL_DAEN           BIT(5)
+#define PRTCSS_RTC_CCTRL_HAEN           BIT(4)
+#define PRTCSS_RTC_CCTRL_MAEN           BIT(3)
+#define PRTCSS_RTC_CCTRL_ALMFLG         BIT(2)
+#define PRTCSS_RTC_CCTRL_AIEN           BIT(1)
+#define PRTCSS_RTC_CCTRL_CAEN           BIT(0)
+
+static DEFINE_SPINLOCK(davinci_rtc_lock);
+
+struct davinci_rtc {
+        struct rtc_device               *rtc;
+        void __iomem                    *base;
+        resource_size_t                 pbase;
+        size_t                          base_size;
+        int                             irq;
+};
+
+static inline void rtcif_write(struct davinci_rtc *davinci_rtc,
+                               u32 val, u32 addr)
+{
+        writel(val, davinci_rtc->base + addr);
+}
+
+static inline u32 rtcif_read(struct davinci_rtc *davinci_rtc, u32 addr)
+{
+        return readl(davinci_rtc->base + addr);
+}
+
+static inline void rtcif_wait(struct davinci_rtc *davinci_rtc)
+{
+        while (rtcif_read(davinci_rtc, PRTCIF_CTLR) & PRTCIF_CTLR_BUSY)
+                cpu_relax();
+}
+
+static inline void rtcss_write(struct davinci_rtc *davinci_rtc,
+                               unsigned long val, u8 addr)
+{
+        rtcif_wait(davinci_rtc);
+
+        rtcif_write(davinci_rtc, PRTCIF_CTLR_BENL_LSB | addr, PRTCIF_CTLR);
+        rtcif_write(davinci_rtc, val, PRTCIF_LDATA);
+
+        rtcif_wait(davinci_rtc);
+}
+
+static inline u8 rtcss_read(struct davinci_rtc *davinci_rtc, u8 addr)
+{
+        rtcif_wait(davinci_rtc);
+
+        rtcif_write(davinci_rtc, PRTCIF_CTLR_DIR | PRTCIF_CTLR_BENL_LSB | addr,
+                    PRTCIF_CTLR);
+
+        rtcif_wait(davinci_rtc);
+
+        return rtcif_read(davinci_rtc, PRTCIF_LDATA);
+}
+
+static inline void davinci_rtcss_calendar_wait(struct davinci_rtc *davinci_rtc)
+{
+        while (rtcss_read(davinci_rtc, PRTCSS_RTC_CCTRL) &
+               PRTCSS_RTC_CCTRL_CALBUSY)
+                cpu_relax();
+}
+
+static irqreturn_t davinci_rtc_interrupt(int irq, void *class_dev)
+{
+        struct davinci_rtc *davinci_rtc = class_dev;
+        unsigned long events = 0;
+        u32 irq_flg;
+        u8 alm_irq, tmr_irq;
+        u8 rtc_ctrl, rtc_cctrl;
+        int ret = IRQ_NONE;
+
+        irq_flg = rtcif_read(davinci_rtc, PRTCIF_INTFLG) &
+                  PRTCIF_INTFLG_RTCSS;
+
+        alm_irq = rtcss_read(davinci_rtc, PRTCSS_RTC_CCTRL) &
+                  PRTCSS_RTC_CCTRL_ALMFLG;
+
+        tmr_irq = rtcss_read(davinci_rtc, PRTCSS_RTC_CTRL) &
+                  PRTCSS_RTC_CTRL_TMRFLG;
+
+        if (irq_flg) {
+                if (alm_irq) {
+                        events |= RTC_IRQF | RTC_AF;
+                        rtc_cctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CCTRL);
+                        rtc_cctrl |=  PRTCSS_RTC_CCTRL_ALMFLG;
+                        rtcss_write(davinci_rtc, rtc_cctrl, PRTCSS_RTC_CCTRL);
+                } else if (tmr_irq) {
+                        events |= RTC_IRQF | RTC_PF;
+                        rtc_ctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CTRL);
+                        rtc_ctrl |=  PRTCSS_RTC_CTRL_TMRFLG;
+                        rtcss_write(davinci_rtc, rtc_ctrl, PRTCSS_RTC_CTRL);
+                }
+
+                rtcif_write(davinci_rtc, PRTCIF_INTFLG_RTCSS,
+                                    PRTCIF_INTFLG);
+                rtc_update_irq(davinci_rtc->rtc, 1, events);
+
+                ret = IRQ_HANDLED;
+        }
+
+        return ret;
+}
+
+static int
+davinci_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        u8 rtc_ctrl;
+        unsigned long flags;
+        int ret = 0;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        rtc_ctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CTRL);
+
+        switch (cmd) {
+        case RTC_WIE_ON:
+                rtc_ctrl |= PRTCSS_RTC_CTRL_WEN | PRTCSS_RTC_CTRL_WDTFLG;
+                break;
+        case RTC_WIE_OFF:
+                rtc_ctrl &= ~PRTCSS_RTC_CTRL_WEN;
+                break;
+        case RTC_UIE_OFF:
+        case RTC_UIE_ON:
+                ret = -ENOTTY;
+                break;
+        default:
+                ret = -ENOIOCTLCMD;
+        }
+
+        rtcss_write(davinci_rtc, rtc_ctrl, PRTCSS_RTC_CTRL);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return ret;
+}
+
+static int convertfromdays(u16 days, struct rtc_time *tm)
+{
+        int tmp_days, year, mon;
+
+        for (year = 2000;; year++) {
+                tmp_days = rtc_year_days(1, 12, year);
+                if (days >= tmp_days)
+                        days -= tmp_days;
+                else {
+                        for (mon = 0;; mon++) {
+                                tmp_days = rtc_month_days(mon, year);
+                                if (days >= tmp_days) {
+                                        days -= tmp_days;
+                                } else {
+                                        tm->tm_year = year - 1900;
+                                        tm->tm_mon = mon;
+                                        tm->tm_mday = days + 1;
+                                        break;
+                                }
+                        }
+                        break;
+                }
+        }
+        return 0;
+}
+
+static int convert2days(u16 *days, struct rtc_time *tm)
+{
+        int i;
+        *days = 0;
+
+        /* epoch == 1900 */
+        if (tm->tm_year < 100 || tm->tm_year > 199)
+                return -EINVAL;
+
+        for (i = 2000; i < 1900 + tm->tm_year; i++)
+                *days += rtc_year_days(1, 12, i);
+
+        *days += rtc_year_days(tm->tm_mday, tm->tm_mon, 1900 + tm->tm_year);
+
+        return 0;
+}
+
+static int davinci_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        u16 days = 0;
+        u8 day0, day1;
+        unsigned long flags;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        tm->tm_sec = bcd2bin(rtcss_read(davinci_rtc, PRTCSS_RTC_SEC));
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        tm->tm_min = bcd2bin(rtcss_read(davinci_rtc, PRTCSS_RTC_MIN));
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        tm->tm_hour = bcd2bin(rtcss_read(davinci_rtc, PRTCSS_RTC_HOUR));
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        day0 = rtcss_read(davinci_rtc, PRTCSS_RTC_DAY0);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        day1 = rtcss_read(davinci_rtc, PRTCSS_RTC_DAY1);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        days |= day1;
+        days <<= 8;
+        days |= day0;
+
+        if (convertfromdays(days, tm) < 0)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int davinci_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        u16 days;
+        u8 rtc_cctrl;
+        unsigned long flags;
+
+        if (convert2days(&days, tm) < 0)
+                return -EINVAL;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, bin2bcd(tm->tm_sec), PRTCSS_RTC_SEC);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, bin2bcd(tm->tm_min), PRTCSS_RTC_MIN);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, bin2bcd(tm->tm_hour), PRTCSS_RTC_HOUR);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, days & 0xFF, PRTCSS_RTC_DAY0);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, (days & 0xFF00) >> 8, PRTCSS_RTC_DAY1);
+
+        rtc_cctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CCTRL);
+        rtc_cctrl |= PRTCSS_RTC_CCTRL_CAEN;
+        rtcss_write(davinci_rtc, rtc_cctrl, PRTCSS_RTC_CCTRL);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return 0;
+}
+
+static int davinci_rtc_alarm_irq_enable(struct device *dev,
+                                        unsigned int enabled)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        unsigned long flags;
+        u8 rtc_cctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CCTRL);
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        if (enabled)
+                rtc_cctrl |= PRTCSS_RTC_CCTRL_DAEN |
+                             PRTCSS_RTC_CCTRL_HAEN |
+                             PRTCSS_RTC_CCTRL_MAEN |
+                             PRTCSS_RTC_CCTRL_ALMFLG |
+                             PRTCSS_RTC_CCTRL_AIEN;
+        else
+                rtc_cctrl &= ~PRTCSS_RTC_CCTRL_AIEN;
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, rtc_cctrl, PRTCSS_RTC_CCTRL);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return 0;
+}
+
+static int davinci_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alm)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        u16 days = 0;
+        u8 day0, day1;
+        unsigned long flags;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        alm->time.tm_min = bcd2bin(rtcss_read(davinci_rtc, PRTCSS_RTC_AMIN));
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        alm->time.tm_hour = bcd2bin(rtcss_read(davinci_rtc, PRTCSS_RTC_AHOUR));
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        day0 = rtcss_read(davinci_rtc, PRTCSS_RTC_ADAY0);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        day1 = rtcss_read(davinci_rtc, PRTCSS_RTC_ADAY1);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+        days |= day1;
+        days <<= 8;
+        days |= day0;
+
+        if (convertfromdays(days, &alm->time) < 0)
+                return -EINVAL;
+
+        alm->pending = !!(rtcss_read(davinci_rtc,
+                          PRTCSS_RTC_CCTRL) &
+                        PRTCSS_RTC_CCTRL_AIEN);
+        alm->enabled = alm->pending && device_may_wakeup(dev);
+
+        return 0;
+}
+
+static int davinci_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alm)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        unsigned long flags;
+        u16 days;
+
+        if (alm->time.tm_mday <= 0 && alm->time.tm_mon < 0
+            && alm->time.tm_year < 0) {
+                struct rtc_time tm;
+                unsigned long now, then;
+
+                davinci_rtc_read_time(dev, &tm);
+                rtc_tm_to_time(&tm, &now);
+
+                alm->time.tm_mday = tm.tm_mday;
+                alm->time.tm_mon = tm.tm_mon;
+                alm->time.tm_year = tm.tm_year;
+                rtc_tm_to_time(&alm->time, &then);
+
+                if (then < now) {
+                        rtc_time_to_tm(now + 24 * 60 * 60, &tm);
+                        alm->time.tm_mday = tm.tm_mday;
+                        alm->time.tm_mon = tm.tm_mon;
+                        alm->time.tm_year = tm.tm_year;
+                }
+        }
+
+        if (convert2days(&days, &alm->time) < 0)
+                return -EINVAL;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, bin2bcd(alm->time.tm_min), PRTCSS_RTC_AMIN);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, bin2bcd(alm->time.tm_hour), PRTCSS_RTC_AHOUR);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, days & 0xFF, PRTCSS_RTC_ADAY0);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, (days & 0xFF00) >> 8, PRTCSS_RTC_ADAY1);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return 0;
+}
+
+static int davinci_rtc_irq_set_state(struct device *dev, int enabled)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        unsigned long flags;
+        u8 rtc_ctrl;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        rtc_ctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CTRL);
+
+        if (enabled) {
+                while (rtcss_read(davinci_rtc, PRTCSS_RTC_CTRL)
+                       & PRTCSS_RTC_CTRL_WDTBUS)
+                        cpu_relax();
+
+                rtc_ctrl |= PRTCSS_RTC_CTRL_TE;
+                rtcss_write(davinci_rtc, rtc_ctrl, PRTCSS_RTC_CTRL);
+
+                rtcss_write(davinci_rtc, 0x0, PRTCSS_RTC_CLKC_CNT);
+
+                rtc_ctrl |= PRTCSS_RTC_CTRL_TIEN |
+                            PRTCSS_RTC_CTRL_TMMD |
+                            PRTCSS_RTC_CTRL_TMRFLG;
+        } else
+                rtc_ctrl &= ~PRTCSS_RTC_CTRL_TIEN;
+
+        rtcss_write(davinci_rtc, rtc_ctrl, PRTCSS_RTC_CTRL);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return 0;
+}
+
+static int davinci_rtc_irq_set_freq(struct device *dev, int freq)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        unsigned long flags;
+        u16 tmr_counter = (0x8000 >> (ffs(freq) - 1));
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        rtcss_write(davinci_rtc, tmr_counter & 0xFF, PRTCSS_RTC_TMR0);
+        rtcss_write(davinci_rtc, (tmr_counter & 0xFF00) >> 8, PRTCSS_RTC_TMR1);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return 0;
+}
+
+static struct rtc_class_ops davinci_rtc_ops = {
+        .ioctl                  = davinci_rtc_ioctl,
+        .read_time              = davinci_rtc_read_time,
+        .set_time               = davinci_rtc_set_time,
+        .alarm_irq_enable       = davinci_rtc_alarm_irq_enable,
+        .read_alarm             = davinci_rtc_read_alarm,
+        .set_alarm              = davinci_rtc_set_alarm,
+        .irq_set_state          = davinci_rtc_irq_set_state,
+        .irq_set_freq           = davinci_rtc_irq_set_freq,
+};
+
+static int __init davinci_rtc_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct davinci_rtc *davinci_rtc;
+        struct resource *res, *mem;
+        int ret = 0;
+
+        davinci_rtc = kzalloc(sizeof(struct davinci_rtc), GFP_KERNEL);
+        if (!davinci_rtc) {
+                dev_dbg(dev, "could not allocate memory for private data\n");
+                return -ENOMEM;
+        }
+
+        davinci_rtc->irq = platform_get_irq(pdev, 0);
+        if (davinci_rtc->irq < 0) {
+                dev_err(dev, "no RTC irq\n");
+                ret = davinci_rtc->irq;
+                goto fail1;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(dev, "no mem resource\n");
+                ret = -EINVAL;
+                goto fail1;
+        }
+
+        davinci_rtc->pbase = res->start;
+        davinci_rtc->base_size = resource_size(res);
+
+        mem = request_mem_region(davinci_rtc->pbase, davinci_rtc->base_size,
+                                 pdev->name);
+        if (!mem) {
+                dev_err(dev, "RTC registers at %08x are not free\n",
+                        davinci_rtc->pbase);
+                ret = -EBUSY;
+                goto fail1;
+        }
+
+        davinci_rtc->base = ioremap(davinci_rtc->pbase, davinci_rtc->base_size);
+        if (!davinci_rtc->base) {
+                dev_err(dev, "unable to ioremap MEM resource\n");
+                ret = -ENOMEM;
+                goto fail2;
+        }
+
+        davinci_rtc->rtc = rtc_device_register(pdev->name, &pdev->dev,
+                                    &davinci_rtc_ops, THIS_MODULE);
+        if (IS_ERR(davinci_rtc->rtc)) {
+                dev_err(dev, "unable to register RTC device, err %ld\n",
+                                PTR_ERR(davinci_rtc->rtc));
+                goto fail3;
+        }
+
+        rtcif_write(davinci_rtc, PRTCIF_INTFLG_RTCSS, PRTCIF_INTFLG);
+        rtcif_write(davinci_rtc, 0, PRTCIF_INTEN);
+        rtcss_write(davinci_rtc, 0, PRTCSS_RTC_INTC_EXTENA1);
+
+        rtcss_write(davinci_rtc, 0, PRTCSS_RTC_CTRL);
+        rtcss_write(davinci_rtc, 0, PRTCSS_RTC_CCTRL);
+
+        ret = request_irq(davinci_rtc->irq, davinci_rtc_interrupt,
+                          IRQF_DISABLED, "davinci_rtc", davinci_rtc);
+        if (ret < 0) {
+                dev_err(dev, "unable to register davinci RTC interrupt\n");
+                goto fail4;
+        }
+
+        /* Enable interrupts */
+        rtcif_write(davinci_rtc, PRTCIF_INTEN_RTCSS, PRTCIF_INTEN);
+        rtcss_write(davinci_rtc, PRTCSS_RTC_INTC_EXTENA1_MASK,
+                            PRTCSS_RTC_INTC_EXTENA1);
+
+        rtcss_write(davinci_rtc, PRTCSS_RTC_CCTRL_CAEN, PRTCSS_RTC_CCTRL);
+
+        platform_set_drvdata(pdev, davinci_rtc);
+
+        device_init_wakeup(&pdev->dev, 0);
+
+        return 0;
+
+fail4:
+        rtc_device_unregister(davinci_rtc->rtc);
+fail3:
+        iounmap(davinci_rtc->base);
+fail2:
+        release_mem_region(davinci_rtc->pbase, davinci_rtc->base_size);
+fail1:
+        kfree(davinci_rtc);
+
+        return ret;
+}
+
+static int __devexit davinci_rtc_remove(struct platform_device *pdev)
+{
+        struct davinci_rtc *davinci_rtc = platform_get_drvdata(pdev);
+
+        device_init_wakeup(&pdev->dev, 0);
+
+        rtcif_write(davinci_rtc, 0, PRTCIF_INTEN);
+
+        free_irq(davinci_rtc->irq, davinci_rtc);
+
+        rtc_device_unregister(davinci_rtc->rtc);
+
+        iounmap(davinci_rtc->base);
+        release_mem_region(davinci_rtc->pbase, davinci_rtc->base_size);
+
+        platform_set_drvdata(pdev, NULL);
+
+        kfree(davinci_rtc);
+
+        return 0;
+}
+
+static struct platform_driver davinci_rtc_driver = {
+        .probe          = davinci_rtc_probe,
+        .remove         = __devexit_p(davinci_rtc_remove),
+        .driver         = {
+                .name = "rtc_davinci",
+                .owner = THIS_MODULE,
+        },
+};
+
+static int __init rtc_init(void)
+{
+        return platform_driver_probe(&davinci_rtc_driver, davinci_rtc_probe);
+}
+module_init(rtc_init);
+
+static void __exit rtc_exit(void)
+{
+        platform_driver_unregister(&davinci_rtc_driver);
+}
+module_exit(rtc_exit);
+
+MODULE_AUTHOR("Miguel Aguilar <miguel.aguilar@ridgerun.com>");
+MODULE_DESCRIPTION("Texas Instruments DaVinci PRTC Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index acf222f91f5a..0e86247d791e 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -37,6 +37,9 @@
  */
 #define DASD_CHANQ_MAX_SIZE 4
 
+#define DASD_SLEEPON_START_TAG  (void *) 1
+#define DASD_SLEEPON_END_TAG    (void *) 2
+
 /*
  * SECTION: exported variables of dasd.c
  */
@@ -62,6 +65,7 @@ static void dasd_device_tasklet(struct dasd_device *);
 static void dasd_block_tasklet(struct dasd_block *);
 static void do_kick_device(struct work_struct *);
 static void do_restore_device(struct work_struct *);
+static void do_reload_device(struct work_struct *);
 static void dasd_return_cqr_cb(struct dasd_ccw_req *, void *);
 static void dasd_device_timeout(unsigned long);
 static void dasd_block_timeout(unsigned long);
@@ -112,6 +116,7 @@ struct dasd_device *dasd_alloc_device(void)
         device->timer.data = (unsigned long) device;
         INIT_WORK(&device->kick_work, do_kick_device);
         INIT_WORK(&device->restore_device, do_restore_device);
+        INIT_WORK(&device->reload_device, do_reload_device);
         device->state = DASD_STATE_NEW;
         device->target = DASD_STATE_NEW;
         mutex_init(&device->state_mutex);
@@ -518,6 +523,26 @@ void dasd_kick_device(struct dasd_device *device)
 }
 
 /*
+ * dasd_reload_device will schedule a call do do_reload_device to the kernel
+ * event daemon.
+ */
+static void do_reload_device(struct work_struct *work)
+{
+        struct dasd_device *device = container_of(work, struct dasd_device,
+                                                  reload_device);
+        device->discipline->reload(device);
+        dasd_put_device(device);
+}
+
+void dasd_reload_device(struct dasd_device *device)
+{
+        dasd_get_device(device);
+        /* queue call to dasd_reload_device to the kernel event daemon. */
+        schedule_work(&device->reload_device);
+}
+EXPORT_SYMBOL(dasd_reload_device);
+
+/*
  * dasd_restore_device will schedule a call do do_restore_device to the kernel
  * event daemon.
  */
@@ -1472,7 +1497,10 @@ void dasd_add_request_tail(struct dasd_ccw_req *cqr)
  */
 static void dasd_wakeup_cb(struct dasd_ccw_req *cqr, void *data)
 {
-        wake_up((wait_queue_head_t *) data);
+        spin_lock_irq(get_ccwdev_lock(cqr->startdev->cdev));
+        cqr->callback_data = DASD_SLEEPON_END_TAG;
+        spin_unlock_irq(get_ccwdev_lock(cqr->startdev->cdev));
+        wake_up(&generic_waitq);
 }
 
 static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
@@ -1482,10 +1510,7 @@ static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
 
         device = cqr->startdev;
         spin_lock_irq(get_ccwdev_lock(device->cdev));
-        rc = ((cqr->status == DASD_CQR_DONE ||
-               cqr->status == DASD_CQR_NEED_ERP ||
-               cqr->status == DASD_CQR_TERMINATED) &&
-              list_empty(&cqr->devlist));
+        rc = (cqr->callback_data == DASD_SLEEPON_END_TAG);
         spin_unlock_irq(get_ccwdev_lock(device->cdev));
         return rc;
 }
@@ -1573,7 +1598,7 @@ static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
                         wait_event(generic_waitq, !(device->stopped));
 
                 cqr->callback = dasd_wakeup_cb;
-                cqr->callback_data = (void *) &generic_waitq;
+                cqr->callback_data = DASD_SLEEPON_START_TAG;
                 dasd_add_request_tail(cqr);
                 if (interruptible) {
                         rc = wait_event_interruptible(
@@ -1652,7 +1677,7 @@ int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
         }
 
         cqr->callback = dasd_wakeup_cb;
-        cqr->callback_data = (void *) &generic_waitq;
+        cqr->callback_data = DASD_SLEEPON_START_TAG;
         cqr->status = DASD_CQR_QUEUED;
         list_add(&cqr->devlist, &device->ccw_queue);
 
diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
index 6632649dd6aa..85bfd8794856 100644
--- a/drivers/s390/block/dasd_3990_erp.c
+++ b/drivers/s390/block/dasd_3990_erp.c
@@ -1418,9 +1418,29 @@ static struct dasd_ccw_req *dasd_3990_erp_inspect_alias(
                                                 struct dasd_ccw_req *erp)
 {
         struct dasd_ccw_req *cqr = erp->refers;
+        char *sense;
 
         if (cqr->block &&
             (cqr->block->base != cqr->startdev)) {
+
+                sense = dasd_get_sense(&erp->refers->irb);
+                /*
+                 * dynamic pav may have changed base alias mapping
+                 */
+                if (!test_bit(DASD_FLAG_OFFLINE, &cqr->startdev->flags) && sense
+                    && (sense[0] == 0x10) && (sense[7] == 0x0F)
+                    && (sense[8] == 0x67)) {
+                        /*
+                         * remove device from alias handling to prevent new
+                         * requests from being scheduled on the
+                         * wrong alias device
+                         */
+                        dasd_alias_remove_device(cqr->startdev);
+
+                        /* schedule worker to reload device */
+                        dasd_reload_device(cqr->startdev);
+                }
+
                 if (cqr->startdev->features & DASD_FEATURE_ERPLOG) {
                         DBF_DEV_EVENT(DBF_ERR, cqr->startdev,
                                     "ERP on alias device for request %p,"
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 8c4814258e93..4155805dcdff 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -190,20 +190,21 @@ int dasd_alias_make_device_known_to_lcu(struct dasd_device *device)
         struct alias_server *server, *newserver;
         struct alias_lcu *lcu, *newlcu;
         int is_lcu_known;
-        struct dasd_uid *uid;
+        struct dasd_uid uid;
 
         private = (struct dasd_eckd_private *) device->private;
-        uid = &private->uid;
+
+        device->discipline->get_uid(device, &uid);
         spin_lock_irqsave(&aliastree.lock, flags);
         is_lcu_known = 1;
-        server = _find_server(uid);
+        server = _find_server(&uid);
         if (!server) {
                 spin_unlock_irqrestore(&aliastree.lock, flags);
-                newserver = _allocate_server(uid);
+                newserver = _allocate_server(&uid);
                 if (IS_ERR(newserver))
                         return PTR_ERR(newserver);
                 spin_lock_irqsave(&aliastree.lock, flags);
-                server = _find_server(uid);
+                server = _find_server(&uid);
                 if (!server) {
                         list_add(&newserver->server, &aliastree.serverlist);
                         server = newserver;
@@ -214,14 +215,14 @@ int dasd_alias_make_device_known_to_lcu(struct dasd_device *device)
                 }
         }
 
-        lcu = _find_lcu(server, uid);
+        lcu = _find_lcu(server, &uid);
         if (!lcu) {
                 spin_unlock_irqrestore(&aliastree.lock, flags);
-                newlcu = _allocate_lcu(uid);
+                newlcu = _allocate_lcu(&uid);
                 if (IS_ERR(newlcu))
                         return PTR_ERR(newlcu);
                 spin_lock_irqsave(&aliastree.lock, flags);
-                lcu = _find_lcu(server, uid);
+                lcu = _find_lcu(server, &uid);
                 if (!lcu) {
                         list_add(&newlcu->lcu, &server->lculist);
                         lcu = newlcu;
@@ -256,20 +257,20 @@ void dasd_alias_lcu_setup_complete(struct dasd_device *device)
         unsigned long flags;
         struct alias_server *server;
         struct alias_lcu *lcu;
-        struct dasd_uid *uid;
+        struct dasd_uid uid;
 
         private = (struct dasd_eckd_private *) device->private;
-        uid = &private->uid;
+        device->discipline->get_uid(device, &uid);
         lcu = NULL;
         spin_lock_irqsave(&aliastree.lock, flags);
-        server = _find_server(uid);
+        server = _find_server(&uid);
         if (server)
-                lcu = _find_lcu(server, uid);
+                lcu = _find_lcu(server, &uid);
         spin_unlock_irqrestore(&aliastree.lock, flags);
         if (!lcu) {
                 DBF_EVENT_DEVID(DBF_ERR, device->cdev,
                                 "could not find lcu for %04x %02x",
-                                uid->ssid, uid->real_unit_addr);
+                                uid.ssid, uid.real_unit_addr);
                 WARN_ON(1);
                 return;
         }
@@ -282,20 +283,20 @@ void dasd_alias_wait_for_lcu_setup(struct dasd_device *device)
         unsigned long flags;
         struct alias_server *server;
         struct alias_lcu *lcu;
-        struct dasd_uid *uid;
+        struct dasd_uid uid;
 
         private = (struct dasd_eckd_private *) device->private;
-        uid = &private->uid;
+        device->discipline->get_uid(device, &uid);
         lcu = NULL;
         spin_lock_irqsave(&aliastree.lock, flags);
-        server = _find_server(uid);
+        server = _find_server(&uid);
         if (server)
-                lcu = _find_lcu(server, uid);
+                lcu = _find_lcu(server, &uid);
         spin_unlock_irqrestore(&aliastree.lock, flags);
         if (!lcu) {
                 DBF_EVENT_DEVID(DBF_ERR, device->cdev,
                                 "could not find lcu for %04x %02x",
-                                uid->ssid, uid->real_unit_addr);
+                                uid.ssid, uid.real_unit_addr);
                 WARN_ON(1);
                 return;
         }
@@ -314,9 +315,11 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
         struct alias_lcu *lcu;
         struct alias_server *server;
         int was_pending;
+        struct dasd_uid uid;
 
         private = (struct dasd_eckd_private *) device->private;
         lcu = private->lcu;
+        device->discipline->get_uid(device, &uid);
         spin_lock_irqsave(&lcu->lock, flags);
         list_del_init(&device->alias_list);
         /* make sure that the workers don't use this device */
@@ -353,7 +356,7 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
                         _schedule_lcu_update(lcu, NULL);
                 spin_unlock(&lcu->lock);
         }
-        server = _find_server(&private->uid);
+        server = _find_server(&uid);
         if (server && list_empty(&server->lculist)) {
                 list_del(&server->server);
                 _free_server(server);
@@ -366,19 +369,30 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
  * in the lcu is up to date and will update the device uid before
  * adding it to a pav group.
  */
+
 static int _add_device_to_lcu(struct alias_lcu *lcu,
-                              struct dasd_device *device)
+                              struct dasd_device *device,
+                              struct dasd_device *pos)
 {
 
         struct dasd_eckd_private *private;
         struct alias_pav_group *group;
-        struct dasd_uid *uid;
+        struct dasd_uid uid;
+        unsigned long flags;
 
         private = (struct dasd_eckd_private *) device->private;
-        uid = &private->uid;
-        uid->type = lcu->uac->unit[uid->real_unit_addr].ua_type;
-        uid->base_unit_addr = lcu->uac->unit[uid->real_unit_addr].base_ua;
-        dasd_set_uid(device->cdev, &private->uid);
+
+        /* only lock if not already locked */
+        if (device != pos)
+                spin_lock_irqsave_nested(get_ccwdev_lock(device->cdev), flags,
+                                         CDEV_NESTED_SECOND);
+        private->uid.type = lcu->uac->unit[private->uid.real_unit_addr].ua_type;
+        private->uid.base_unit_addr =
+                lcu->uac->unit[private->uid.real_unit_addr].base_ua;
+        uid = private->uid;
+
+        if (device != pos)
+                spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
 
         /* if we have no PAV anyway, we don't need to bother with PAV groups */
         if (lcu->pav == NO_PAV) {
@@ -386,25 +400,25 @@ static int _add_device_to_lcu(struct alias_lcu *lcu,
                 return 0;
         }
 
-        group = _find_group(lcu, uid);
+        group = _find_group(lcu, &uid);
         if (!group) {
                 group = kzalloc(sizeof(*group), GFP_ATOMIC);
                 if (!group)
                         return -ENOMEM;
-                memcpy(group->uid.vendor, uid->vendor, sizeof(uid->vendor));
-                memcpy(group->uid.serial, uid->serial, sizeof(uid->serial));
-                group->uid.ssid = uid->ssid;
-                if (uid->type == UA_BASE_DEVICE)
-                        group->uid.base_unit_addr = uid->real_unit_addr;
+                memcpy(group->uid.vendor, uid.vendor, sizeof(uid.vendor));
+                memcpy(group->uid.serial, uid.serial, sizeof(uid.serial));
+                group->uid.ssid = uid.ssid;
+                if (uid.type == UA_BASE_DEVICE)
+                        group->uid.base_unit_addr = uid.real_unit_addr;
                 else
-                        group->uid.base_unit_addr = uid->base_unit_addr;
-                memcpy(group->uid.vduit, uid->vduit, sizeof(uid->vduit));
+                        group->uid.base_unit_addr = uid.base_unit_addr;
+                memcpy(group->uid.vduit, uid.vduit, sizeof(uid.vduit));
                 INIT_LIST_HEAD(&group->group);
                 INIT_LIST_HEAD(&group->baselist);
                 INIT_LIST_HEAD(&group->aliaslist);
                 list_add(&group->group, &lcu->grouplist);
         }
-        if (uid->type == UA_BASE_DEVICE)
+        if (uid.type == UA_BASE_DEVICE)
                 list_move(&device->alias_list, &group->baselist);
         else
                 list_move(&device->alias_list, &group->aliaslist);
@@ -525,7 +539,10 @@ static int _lcu_update(struct dasd_device *refdev, struct alias_lcu *lcu)
         if (rc)
                 return rc;
 
-        spin_lock_irqsave(&lcu->lock, flags);
+        /* need to take cdev lock before lcu lock */
+        spin_lock_irqsave_nested(get_ccwdev_lock(refdev->cdev), flags,
+                                 CDEV_NESTED_FIRST);
+        spin_lock(&lcu->lock);
         lcu->pav = NO_PAV;
         for (i = 0; i < MAX_DEVICES_PER_LCU; ++i) {
                 switch (lcu->uac->unit[i].ua_type) {
@@ -542,9 +559,10 @@ static int _lcu_update(struct dasd_device *refdev, struct alias_lcu *lcu)
 
         list_for_each_entry_safe(device, tempdev, &lcu->active_devices,
                                  alias_list) {
-                _add_device_to_lcu(lcu, device);
+                _add_device_to_lcu(lcu, device, refdev);
         }
-        spin_unlock_irqrestore(&lcu->lock, flags);
+        spin_unlock(&lcu->lock);
+        spin_unlock_irqrestore(get_ccwdev_lock(refdev->cdev), flags);
         return 0;
 }
 
@@ -628,9 +646,12 @@ int dasd_alias_add_device(struct dasd_device *device)
         private = (struct dasd_eckd_private *) device->private;
         lcu = private->lcu;
         rc = 0;
-        spin_lock_irqsave(&lcu->lock, flags);
+
+        /* need to take cdev lock before lcu lock */
+        spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+        spin_lock(&lcu->lock);
         if (!(lcu->flags & UPDATE_PENDING)) {
-                rc = _add_device_to_lcu(lcu, device);
+                rc = _add_device_to_lcu(lcu, device, device);
                 if (rc)
                         lcu->flags |= UPDATE_PENDING;
         }
@@ -638,10 +659,19 @@ int dasd_alias_add_device(struct dasd_device *device)
                 list_move(&device->alias_list, &lcu->active_devices);
                 _schedule_lcu_update(lcu, device);
         }
-        spin_unlock_irqrestore(&lcu->lock, flags);
+        spin_unlock(&lcu->lock);
+        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
         return rc;
 }
 
+int dasd_alias_update_add_device(struct dasd_device *device)
+{
+        struct dasd_eckd_private *private;
+        private = (struct dasd_eckd_private *) device->private;
+        private->lcu->flags |= UPDATE_PENDING;
+        return dasd_alias_add_device(device);
+}
+
 int dasd_alias_remove_device(struct dasd_device *device)
 {
         struct dasd_eckd_private *private;
@@ -740,19 +770,30 @@ static void _restart_all_base_devices_on_lcu(struct alias_lcu *lcu)
         struct alias_pav_group *pavgroup;
         struct dasd_device *device;
         struct dasd_eckd_private *private;
+        unsigned long flags;
 
         /* active and inactive list can contain alias as well as base devices */
         list_for_each_entry(device, &lcu->active_devices, alias_list) {
                 private = (struct dasd_eckd_private *) device->private;
-                if (private->uid.type != UA_BASE_DEVICE)
+                spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+                if (private->uid.type != UA_BASE_DEVICE) {
+                        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev),
+                                               flags);
                         continue;
+                }
+                spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
                 dasd_schedule_block_bh(device->block);
                 dasd_schedule_device_bh(device);
         }
         list_for_each_entry(device, &lcu->inactive_devices, alias_list) {
                 private = (struct dasd_eckd_private *) device->private;
-                if (private->uid.type != UA_BASE_DEVICE)
+                spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+                if (private->uid.type != UA_BASE_DEVICE) {
+                        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev),
+                                               flags);
                         continue;
+                }
+                spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
                 dasd_schedule_block_bh(device->block);
                 dasd_schedule_device_bh(device);
         }
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index eff9c812c5c2..34d51dd4c539 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -49,7 +49,6 @@ struct dasd_devmap {
         unsigned int devindex;
         unsigned short features;
         struct dasd_device *device;
-        struct dasd_uid uid;
 };
 
 /*
@@ -936,42 +935,46 @@ dasd_device_status_show(struct device *dev, struct device_attribute *attr,
 
 static DEVICE_ATTR(status, 0444, dasd_device_status_show, NULL);
 
-static ssize_t
-dasd_alias_show(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t dasd_alias_show(struct device *dev,
+                               struct device_attribute *attr, char *buf)
 {
-        struct dasd_devmap *devmap;
-        int alias;
+        struct dasd_device *device;
+        struct dasd_uid uid;
 
-        devmap = dasd_find_busid(dev_name(dev));
-        spin_lock(&dasd_devmap_lock);
-        if (IS_ERR(devmap) || strlen(devmap->uid.vendor) == 0) {
-                spin_unlock(&dasd_devmap_lock);
+        device = dasd_device_from_cdev(to_ccwdev(dev));
+        if (IS_ERR(device))
                 return sprintf(buf, "0\n");
+
+        if (device->discipline && device->discipline->get_uid &&
+            !device->discipline->get_uid(device, &uid)) {
+                if (uid.type == UA_BASE_PAV_ALIAS ||
+                    uid.type == UA_HYPER_PAV_ALIAS)
+                        return sprintf(buf, "1\n");
         }
-        if (devmap->uid.type == UA_BASE_PAV_ALIAS ||
-            devmap->uid.type == UA_HYPER_PAV_ALIAS)
-                alias = 1;
-        else
-                alias = 0;
-        spin_unlock(&dasd_devmap_lock);
-        return sprintf(buf, alias ? "1\n" : "0\n");
+        dasd_put_device(device);
+
+        return sprintf(buf, "0\n");
 }
 
 static DEVICE_ATTR(alias, 0444, dasd_alias_show, NULL);
 
-static ssize_t
-dasd_vendor_show(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t dasd_vendor_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
 {
-        struct dasd_devmap *devmap;
+        struct dasd_device *device;
+        struct dasd_uid uid;
         char *vendor;
 
-        devmap = dasd_find_busid(dev_name(dev));
-        spin_lock(&dasd_devmap_lock);
-        if (!IS_ERR(devmap) && strlen(devmap->uid.vendor) > 0)
-                vendor = devmap->uid.vendor;
-        else
-                vendor = "";
-        spin_unlock(&dasd_devmap_lock);
+        device = dasd_device_from_cdev(to_ccwdev(dev));
+        vendor = "";
+        if (IS_ERR(device))
+                return snprintf(buf, PAGE_SIZE, "%s\n", vendor);
+
+        if (device->discipline && device->discipline->get_uid &&
+            !device->discipline->get_uid(device, &uid))
+                        vendor = uid.vendor;
+
+        dasd_put_device(device);
 
         return snprintf(buf, PAGE_SIZE, "%s\n", vendor);
 }
@@ -985,48 +988,51 @@ static DEVICE_ATTR(vendor, 0444, dasd_vendor_show, NULL);
 static ssize_t
 dasd_uid_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct dasd_devmap *devmap;
+        struct dasd_device *device;
+        struct dasd_uid uid;
         char uid_string[UID_STRLEN];
         char ua_string[3];
-        struct dasd_uid *uid;
 
-        devmap = dasd_find_busid(dev_name(dev));
-        spin_lock(&dasd_devmap_lock);
-        if (IS_ERR(devmap) || strlen(devmap->uid.vendor) == 0) {
-                spin_unlock(&dasd_devmap_lock);
-                return sprintf(buf, "\n");
-        }
-        uid = &devmap->uid;
-        switch (uid->type) {
-        case UA_BASE_DEVICE:
-                sprintf(ua_string, "%02x", uid->real_unit_addr);
-                break;
-        case UA_BASE_PAV_ALIAS:
-                sprintf(ua_string, "%02x", uid->base_unit_addr);
-                break;
-        case UA_HYPER_PAV_ALIAS:
-                sprintf(ua_string, "xx");
-                break;
-        default:
-                /* should not happen, treat like base device */
-                sprintf(ua_string, "%02x", uid->real_unit_addr);
-                break;
+        device = dasd_device_from_cdev(to_ccwdev(dev));
+        uid_string[0] = 0;
+        if (IS_ERR(device))
+                return snprintf(buf, PAGE_SIZE, "%s\n", uid_string);
+
+        if (device->discipline && device->discipline->get_uid &&
+            !device->discipline->get_uid(device, &uid)) {
+                switch (uid.type) {
+                case UA_BASE_DEVICE:
+                        snprintf(ua_string, sizeof(ua_string), "%02x",
+                                 uid.real_unit_addr);
+                        break;
+                case UA_BASE_PAV_ALIAS:
+                        snprintf(ua_string, sizeof(ua_string), "%02x",
+                                 uid.base_unit_addr);
+                        break;
+                case UA_HYPER_PAV_ALIAS:
+                        snprintf(ua_string, sizeof(ua_string), "xx");
+                        break;
+                default:
+                        /* should not happen, treat like base device */
+                        snprintf(ua_string, sizeof(ua_string), "%02x",
+                                 uid.real_unit_addr);
+                        break;
+                }
+
+                if (strlen(uid.vduit) > 0)
+                        snprintf(uid_string, sizeof(uid_string),
+                                 "%s.%s.%04x.%s.%s",
+                                 uid.vendor, uid.serial, uid.ssid, ua_string,
+                                 uid.vduit);
+                else
+                        snprintf(uid_string, sizeof(uid_string),
+                                 "%s.%s.%04x.%s",
+                                 uid.vendor, uid.serial, uid.ssid, ua_string);
         }
-        if (strlen(uid->vduit) > 0)
-                snprintf(uid_string, sizeof(uid_string),
-                         "%s.%s.%04x.%s.%s",
-                         uid->vendor, uid->serial,
-                         uid->ssid, ua_string,
-                         uid->vduit);
-        else
-                snprintf(uid_string, sizeof(uid_string),
-                         "%s.%s.%04x.%s",
-                         uid->vendor, uid->serial,
-                         uid->ssid, ua_string);
-        spin_unlock(&dasd_devmap_lock);
+        dasd_put_device(device);
+
         return snprintf(buf, PAGE_SIZE, "%s\n", uid_string);
 }
-
 static DEVICE_ATTR(uid, 0444, dasd_uid_show, NULL);
 
 /*
@@ -1094,50 +1100,6 @@ static struct attribute_group dasd_attr_group = {
 };
 
 /*
- * Return copy of the device unique identifier.
- */
-int
-dasd_get_uid(struct ccw_device *cdev, struct dasd_uid *uid)
-{
-        struct dasd_devmap *devmap;
-
-        devmap = dasd_find_busid(dev_name(&cdev->dev));
-        if (IS_ERR(devmap))
-                return PTR_ERR(devmap);
-        spin_lock(&dasd_devmap_lock);
-        *uid = devmap->uid;
-        spin_unlock(&dasd_devmap_lock);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(dasd_get_uid);
-
-/*
- * Register the given device unique identifier into devmap struct.
- * In addition check if the related storage server subsystem ID is already
- * contained in the dasd_server_ssid_list. If subsystem ID is not contained,
- * create new entry.
- * Return 0 if server was already in serverlist,
- *        1 if the server was added successful
- *       <0 in case of error.
- */
-int
-dasd_set_uid(struct ccw_device *cdev, struct dasd_uid *uid)
-{
-        struct dasd_devmap *devmap;
-
-        devmap = dasd_find_busid(dev_name(&cdev->dev));
-        if (IS_ERR(devmap))
-                return PTR_ERR(devmap);
-
-        spin_lock(&dasd_devmap_lock);
-        devmap->uid = *uid;
-        spin_unlock(&dasd_devmap_lock);
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(dasd_set_uid);
-
-/*
  * Return value of the specified feature.
  */
 int
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 0cb233116855..5b1cd8d6e971 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -692,18 +692,20 @@ dasd_eckd_cdl_reclen(int recid)
 /*
  * Generate device unique id that specifies the physical device.
  */
-static int dasd_eckd_generate_uid(struct dasd_device *device,
-                                  struct dasd_uid *uid)
+static int dasd_eckd_generate_uid(struct dasd_device *device)
 {
         struct dasd_eckd_private *private;
+        struct dasd_uid *uid;
         int count;
+        unsigned long flags;
 
         private = (struct dasd_eckd_private *) device->private;
         if (!private)
                 return -ENODEV;
         if (!private->ned || !private->gneq)
                 return -ENODEV;
-
+        uid = &private->uid;
+        spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
         memset(uid, 0, sizeof(struct dasd_uid));
         memcpy(uid->vendor, private->ned->HDA_manufacturer,
                sizeof(uid->vendor) - 1);
@@ -726,9 +728,25 @@ static int dasd_eckd_generate_uid(struct dasd_device *device,
                                 private->vdsneq->uit[count]);
                 }
         }
+        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
         return 0;
 }
 
+static int dasd_eckd_get_uid(struct dasd_device *device, struct dasd_uid *uid)
+{
+        struct dasd_eckd_private *private;
+        unsigned long flags;
+
+        if (device->private) {
+                private = (struct dasd_eckd_private *)device->private;
+                spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+                *uid = private->uid;
+                spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
+                return 0;
+        }
+        return -EINVAL;
+}
+
 static struct dasd_ccw_req *dasd_eckd_build_rcd_lpm(struct dasd_device *device,
                                                     void *rcd_buffer,
                                                     struct ciw *ciw, __u8 lpm)
@@ -1088,6 +1106,7 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
 {
         struct dasd_eckd_private *private;
         struct dasd_block *block;
+        struct dasd_uid temp_uid;
         int is_known, rc;
         int readonly;
 
@@ -1124,13 +1143,13 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
         if (rc)
                 goto out_err1;
 
-        /* Generate device unique id and register in devmap */
-        rc = dasd_eckd_generate_uid(device, &private->uid);
+        /* Generate device unique id */
+        rc = dasd_eckd_generate_uid(device);
         if (rc)
                 goto out_err1;
-        dasd_set_uid(device->cdev, &private->uid);
 
-        if (private->uid.type == UA_BASE_DEVICE) {
+        dasd_eckd_get_uid(device, &temp_uid);
+        if (temp_uid.type == UA_BASE_DEVICE) {
                 block = dasd_alloc_block();
                 if (IS_ERR(block)) {
                         DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
@@ -1451,6 +1470,7 @@ static int dasd_eckd_ready_to_online(struct dasd_device *device)
 
 static int dasd_eckd_online_to_ready(struct dasd_device *device)
 {
+        cancel_work_sync(&device->reload_device);
         return dasd_alias_remove_device(device);
 };
 
@@ -1709,10 +1729,27 @@ static void dasd_eckd_handle_unsolicited_interrupt(struct dasd_device *device,
 {
         char mask;
         char *sense = NULL;
+        struct dasd_eckd_private *private;
 
+        private = (struct dasd_eckd_private *) device->private;
         /* first of all check for state change pending interrupt */
         mask = DEV_STAT_ATTENTION | DEV_STAT_DEV_END | DEV_STAT_UNIT_EXCEP;
         if ((scsw_dstat(&irb->scsw) & mask) == mask) {
+                /* for alias only and not in offline processing*/
+                if (!device->block && private->lcu &&
+                    !test_bit(DASD_FLAG_OFFLINE, &device->flags)) {
+                        /*
+                         * the state change could be caused by an alias
+                         * reassignment remove device from alias handling
+                         * to prevent new requests from being scheduled on
+                         * the wrong alias device
+                         */
+                        dasd_alias_remove_device(device);
+
+                        /* schedule worker to reload device */
+                        dasd_reload_device(device);
+                }
+
                 dasd_generic_handle_state_change(device);
                 return;
         }
@@ -3259,7 +3296,7 @@ static void dasd_eckd_dump_sense(struct dasd_device *device,
                 dasd_eckd_dump_sense_ccw(device, req, irb);
 }
 
-int dasd_eckd_pm_freeze(struct dasd_device *device)
+static int dasd_eckd_pm_freeze(struct dasd_device *device)
 {
         /*
          * the device should be disconnected from our LCU structure
@@ -3272,7 +3309,7 @@ int dasd_eckd_pm_freeze(struct dasd_device *device)
         return 0;
 }
 
-int dasd_eckd_restore_device(struct dasd_device *device)
+static int dasd_eckd_restore_device(struct dasd_device *device)
 {
         struct dasd_eckd_private *private;
         struct dasd_eckd_characteristics temp_rdc_data;
@@ -3287,15 +3324,16 @@ int dasd_eckd_restore_device(struct dasd_device *device)
         if (rc)
                 goto out_err;
 
-        /* Generate device unique id and register in devmap */
-        rc = dasd_eckd_generate_uid(device, &private->uid);
-        dasd_get_uid(device->cdev, &temp_uid);
+        dasd_eckd_get_uid(device, &temp_uid);
+        /* Generate device unique id */
+        rc = dasd_eckd_generate_uid(device);
+        spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
         if (memcmp(&private->uid, &temp_uid, sizeof(struct dasd_uid)) != 0)
                 dev_err(&device->cdev->dev, "The UID of the DASD has "
                         "changed\n");
+        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
         if (rc)
                 goto out_err;
-        dasd_set_uid(device->cdev, &private->uid);
 
         /* register lcu with alias handling, enable PAV if this is a new lcu */
         is_known = dasd_alias_make_device_known_to_lcu(device);
@@ -3336,6 +3374,56 @@ out_err:
         return -1;
 }
 
+static int dasd_eckd_reload_device(struct dasd_device *device)
+{
+        struct dasd_eckd_private *private;
+        int rc, old_base;
+        char print_uid[60];
+        struct dasd_uid uid;
+        unsigned long flags;
+
+        private = (struct dasd_eckd_private *) device->private;
+
+        spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+        old_base = private->uid.base_unit_addr;
+        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
+
+        /* Read Configuration Data */
+        rc = dasd_eckd_read_conf(device);
+        if (rc)
+                goto out_err;
+
+        rc = dasd_eckd_generate_uid(device);
+        if (rc)
+                goto out_err;
+        /*
+         * update unit address configuration and
+         * add device to alias management
+         */
+        dasd_alias_update_add_device(device);
+
+        dasd_eckd_get_uid(device, &uid);
+
+        if (old_base != uid.base_unit_addr) {
+                if (strlen(uid.vduit) > 0)
+                        snprintf(print_uid, sizeof(print_uid),
+                                 "%s.%s.%04x.%02x.%s", uid.vendor, uid.serial,
+                                 uid.ssid, uid.base_unit_addr, uid.vduit);
+                else
+                        snprintf(print_uid, sizeof(print_uid),
+                                 "%s.%s.%04x.%02x", uid.vendor, uid.serial,
+                                 uid.ssid, uid.base_unit_addr);
+
+                dev_info(&device->cdev->dev,
+                         "An Alias device was reassigned to a new base device "
+                         "with UID: %s\n", print_uid);
+        }
+        return 0;
+
+out_err:
+        return -1;
+}
+
 static struct ccw_driver dasd_eckd_driver = {
         .name        = "dasd-eckd",
         .owner       = THIS_MODULE,
@@ -3389,6 +3477,8 @@ static struct dasd_discipline dasd_eckd_discipline = {
         .ioctl = dasd_eckd_ioctl,
         .freeze = dasd_eckd_pm_freeze,
         .restore = dasd_eckd_restore_device,
+        .reload = dasd_eckd_reload_device,
+        .get_uid = dasd_eckd_get_uid,
 };
 
 static int __init
diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
index 864d53c04201..dd6385a5af14 100644
--- a/drivers/s390/block/dasd_eckd.h
+++ b/drivers/s390/block/dasd_eckd.h
@@ -426,7 +426,6 @@ struct alias_pav_group {
         struct dasd_device *next;
 };
 
-
 struct dasd_eckd_private {
         struct dasd_eckd_characteristics rdc_data;
         u8 *conf_data;
@@ -463,4 +462,5 @@ void dasd_alias_handle_summary_unit_check(struct dasd_device *, struct irb *);
 void dasd_eckd_reset_ccw_to_base_io(struct dasd_ccw_req *);
 void dasd_alias_lcu_setup_complete(struct dasd_device *);
 void dasd_alias_wait_for_lcu_setup(struct dasd_device *);
+int dasd_alias_update_add_device(struct dasd_device *);
 #endif                          /* DASD_ECKD_H */
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index a91d4a97d4f2..32fac186ba3f 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -81,6 +81,10 @@ struct dasd_block;
 #define DASD_SIM_MSG_TO_OP 0x03
 #define DASD_SIM_LOG 0x0C
 
+/* lock class for nested cdev lock */
+#define CDEV_NESTED_FIRST 1
+#define CDEV_NESTED_SECOND 2
+
 /*
  * SECTION: MACROs for klogd and s390 debug feature (dbf)
  */
@@ -229,6 +233,24 @@ struct dasd_ccw_req {
 typedef struct dasd_ccw_req *(*dasd_erp_fn_t) (struct dasd_ccw_req *);
 
 /*
+ * Unique identifier for dasd device.
+ */
+#define UA_NOT_CONFIGURED  0x00
+#define UA_BASE_DEVICE     0x01
+#define UA_BASE_PAV_ALIAS  0x02
+#define UA_HYPER_PAV_ALIAS 0x03
+
+struct dasd_uid {
+        __u8 type;
+        char vendor[4];
+        char serial[15];
+        __u16 ssid;
+        __u8 real_unit_addr;
+        __u8 base_unit_addr;
+        char vduit[33];
+};
+
+/*
  * the struct dasd_discipline is
  * sth like a table of virtual functions, if you think of dasd_eckd
  * inheriting dasd...
@@ -312,28 +334,15 @@ struct dasd_discipline {
         /* suspend/resume functions */
         int (*freeze) (struct dasd_device *);
         int (*restore) (struct dasd_device *);
-};
 
-extern struct dasd_discipline *dasd_diag_discipline_pointer;
-
-/*
- * Unique identifier for dasd device.
- */
-#define UA_NOT_CONFIGURED  0x00
-#define UA_BASE_DEVICE     0x01
-#define UA_BASE_PAV_ALIAS  0x02
-#define UA_HYPER_PAV_ALIAS 0x03
+        /* reload device after state change */
+        int (*reload) (struct dasd_device *);
 
-struct dasd_uid {
-        __u8 type;
-        char vendor[4];
-        char serial[15];
-        __u16 ssid;
-        __u8 real_unit_addr;
-        __u8 base_unit_addr;
-        char vduit[33];
+        int (*get_uid) (struct dasd_device *, struct dasd_uid *);
 };
 
+extern struct dasd_discipline *dasd_diag_discipline_pointer;
+
 /*
  * Notification numbers for extended error reporting notifications:
  * The DASD_EER_DISABLE notification is sent before a dasd_device (and it's
@@ -386,6 +395,7 @@ struct dasd_device {
         struct tasklet_struct tasklet;
         struct work_struct kick_work;
         struct work_struct restore_device;
+        struct work_struct reload_device;
         struct timer_list timer;
 
         debug_info_t *debug_area;
@@ -582,6 +592,7 @@ void dasd_enable_device(struct dasd_device *);
 void dasd_set_target_state(struct dasd_device *, int);
 void dasd_kick_device(struct dasd_device *);
 void dasd_restore_device(struct dasd_device *);
+void dasd_reload_device(struct dasd_device *);
 
 void dasd_add_request_head(struct dasd_ccw_req *);
 void dasd_add_request_tail(struct dasd_ccw_req *);
@@ -629,8 +640,6 @@ void dasd_devmap_exit(void);
 struct dasd_device *dasd_create_device(struct ccw_device *);
 void dasd_delete_device(struct dasd_device *);
 
-int dasd_get_uid(struct ccw_device *, struct dasd_uid *);
-int dasd_set_uid(struct ccw_device *, struct dasd_uid *);
 int dasd_get_feature(struct ccw_device *, int);
 int dasd_set_feature(struct ccw_device *, int, int);
 
diff --git a/drivers/s390/char/Kconfig b/drivers/s390/char/Kconfig
index 4e34d3686c23..40834f18754c 100644
--- a/drivers/s390/char/Kconfig
+++ b/drivers/s390/char/Kconfig
@@ -148,13 +148,12 @@ config VMLOGRDR
           This driver depends on the IUCV support driver.
 
 config VMCP
-        tristate "Support for the z/VM CP interface (VM only)"
+        bool "Support for the z/VM CP interface"
         depends on S390
         help
           Select this option if you want to be able to interact with the control
           program on z/VM
 
-
 config MONREADER
         tristate "API for reading z/VM monitor service records"
         depends on IUCV
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index 0eabcca3c92d..857dfcb7b359 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -484,6 +484,7 @@ fs3270_open(struct inode *inode, struct file *filp)
                 raw3270_del_view(&fp->view);
                 goto out;
         }
+        nonseekable_open(inode, filp);
         filp->private_data = fp;
 out:
         mutex_unlock(&fs3270_mutex);
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index cb6bffe7141a..18d9a497863b 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -49,7 +49,7 @@ static unsigned char ret_diacr[NR_DEAD] = {
 struct kbd_data *
 kbd_alloc(void) {
         struct kbd_data *kbd;
-        int i, len;
+        int i;
 
         kbd = kzalloc(sizeof(struct kbd_data), GFP_KERNEL);
         if (!kbd)
@@ -59,12 +59,11 @@ kbd_alloc(void) {
                 goto out_kbd;
         for (i = 0; i < ARRAY_SIZE(key_maps); i++) {
                 if (key_maps[i]) {
-                        kbd->key_maps[i] =
-                                kmalloc(sizeof(u_short)*NR_KEYS, GFP_KERNEL);
+                        kbd->key_maps[i] = kmemdup(key_maps[i],
+                                                   sizeof(u_short) * NR_KEYS,
+                                                   GFP_KERNEL);
                         if (!kbd->key_maps[i])
                                 goto out_maps;
-                        memcpy(kbd->key_maps[i], key_maps[i],
-                               sizeof(u_short)*NR_KEYS);
                 }
         }
         kbd->func_table = kzalloc(sizeof(func_table), GFP_KERNEL);
@@ -72,23 +71,21 @@ kbd_alloc(void) {
                 goto out_maps;
         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
                 if (func_table[i]) {
-                        len = strlen(func_table[i]) + 1;
-                        kbd->func_table[i] = kmalloc(len, GFP_KERNEL);
+                        kbd->func_table[i] = kstrdup(func_table[i],
+                                                     GFP_KERNEL);
                         if (!kbd->func_table[i])
                                 goto out_func;
-                        memcpy(kbd->func_table[i], func_table[i], len);
                 }
         }
         kbd->fn_handler =
                 kzalloc(sizeof(fn_handler_fn *) * NR_FN_HANDLER, GFP_KERNEL);
         if (!kbd->fn_handler)
                 goto out_func;
-        kbd->accent_table =
-                kmalloc(sizeof(struct kbdiacruc)*MAX_DIACR, GFP_KERNEL);
+        kbd->accent_table = kmemdup(accent_table,
+                                    sizeof(struct kbdiacruc) * MAX_DIACR,
+                                    GFP_KERNEL);
         if (!kbd->accent_table)
                 goto out_fn_handler;
-        memcpy(kbd->accent_table, accent_table,
-               sizeof(struct kbdiacruc)*MAX_DIACR);
         kbd->accent_table_size = accent_table_size;
         return kbd;
 
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index 5bb59d36a6d4..04e532eec032 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -1,24 +1,20 @@
 /*
- * Copyright IBM Corp. 2004,2007
+ * Copyright IBM Corp. 2004,2010
  * Interface implementation for communication with the z/VM control program
- * Author(s): Christian Borntraeger <borntraeger@de.ibm.com>
  *
+ * Author(s): Christian Borntraeger <borntraeger@de.ibm.com>
  *
  * z/VMs CP offers the possibility to issue commands via the diagnose code 8
  * this driver implements a character device that issues these commands and
  * returns the answer of CP.
-
+ *
  * The idea of this driver is based on cpint from Neale Ferguson and #CP in CMS
  */
 
-#define KMSG_COMPONENT "vmcp"
-#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
-
 #include <linux/fs.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
-#include <linux/module.h>
 #include <linux/slab.h>
 #include <asm/compat.h>
 #include <asm/cpcmd.h>
@@ -26,10 +22,6 @@
 #include <asm/uaccess.h>
 #include "vmcp.h"
 
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Christian Borntraeger <borntraeger@de.ibm.com>");
-MODULE_DESCRIPTION("z/VM CP interface");
-
 static debug_info_t *vmcp_debug;
 
 static int vmcp_open(struct inode *inode, struct file *file)
@@ -197,11 +189,8 @@ static int __init vmcp_init(void)
 {
         int ret;
 
-        if (!MACHINE_IS_VM) {
-                pr_warning("The z/VM CP interface device driver cannot be "
-                           "loaded without z/VM\n");
-                return -ENODEV;
-        }
+        if (!MACHINE_IS_VM)
+                return 0;
 
         vmcp_debug = debug_register("vmcp", 1, 1, 240);
         if (!vmcp_debug)
@@ -214,19 +203,8 @@ static int __init vmcp_init(void)
         }
 
         ret = misc_register(&vmcp_dev);
-        if (ret) {
+        if (ret)
                 debug_unregister(vmcp_debug);
-                return ret;
-        }
-
-        return 0;
-}
-
-static void __exit vmcp_exit(void)
-{
-        misc_deregister(&vmcp_dev);
-        debug_unregister(vmcp_debug);
+        return ret;
 }
-
-module_init(vmcp_init);
-module_exit(vmcp_exit);
+device_initcall(vmcp_init);
diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index 7217966f7d31..f5ea3384a4b9 100644
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -445,7 +445,7 @@ static int zcore_memmap_open(struct inode *inode, struct file *filp)
         }
         kfree(chunk_array);
         filp->private_data = buf;
-        return 0;
+        return nonseekable_open(inode, filp);
 }
 
 static int zcore_memmap_release(struct inode *inode, struct file *filp)
@@ -473,7 +473,7 @@ static ssize_t zcore_reipl_write(struct file *filp, const char __user *buf,
 
 static int zcore_reipl_open(struct inode *inode, struct file *filp)
 {
-        return 0;
+        return nonseekable_open(inode, filp);
 }
 
 static int zcore_reipl_release(struct inode *inode, struct file *filp)
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index 3b6f4adc5094..a83877c664a6 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -803,6 +803,7 @@ static long chsc_ioctl(struct file *filp, unsigned int cmd,
 
 static const struct file_operations chsc_fops = {
         .owner = THIS_MODULE,
+        .open = nonseekable_open,
         .unlocked_ioctl = chsc_ioctl,
         .compat_ioctl = chsc_ioctl,
 };
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 5feea1a371e1..f4e6cf3aceb8 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -616,7 +616,8 @@ void __irq_entry do_IRQ(struct pt_regs *regs)
         struct pt_regs *old_regs;
 
         old_regs = set_irq_regs(regs);
-        s390_idle_check();
+        s390_idle_check(regs, S390_lowcore.int_clock,
+                        S390_lowcore.async_enter_timer);
         irq_enter();
         __get_cpu_var(s390_idle).nohz_delay = 1;
         if (S390_lowcore.int_clock >= S390_lowcore.clock_comparator)
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 511649115bd7..ac94ac751459 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -648,6 +648,8 @@ static void css_process_crw(struct crw *crw0, struct crw *crw1, int overflow)
 static void __init
 css_generate_pgid(struct channel_subsystem *css, u32 tod_high)
 {
+        struct cpuid cpu_id;
+
         if (css_general_characteristics.mcss) {
                 css->global_pgid.pgid_high.ext_cssid.version = 0x80;
                 css->global_pgid.pgid_high.ext_cssid.cssid = css->cssid;
@@ -658,8 +660,9 @@ css_generate_pgid(struct channel_subsystem *css, u32 tod_high)
                 css->global_pgid.pgid_high.cpu_addr = 0;
 #endif
         }
-        css->global_pgid.cpu_id = S390_lowcore.cpu_id.ident;
-        css->global_pgid.cpu_model = S390_lowcore.cpu_id.machine;
+        get_cpu_id(&cpu_id);
+        css->global_pgid.cpu_id = cpu_id.ident;
+        css->global_pgid.cpu_model = cpu_id.machine;
         css->global_pgid.tod_high = tod_high;
 
 }
@@ -1062,6 +1065,7 @@ static ssize_t cio_settle_write(struct file *file, const char __user *buf,
 }
 
 static const struct file_operations cio_settle_proc_fops = {
+        .open = nonseekable_open,
         .write = cio_settle_write,
 };
 
diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
index 48aa0647432b..f0037eefd44e 100644
--- a/drivers/s390/cio/qdio.h
+++ b/drivers/s390/cio/qdio.h
@@ -13,8 +13,8 @@
 #include <asm/debug.h>
 #include "chsc.h"
 
-#define QDIO_BUSY_BIT_PATIENCE          100     /* 100 microseconds */
-#define QDIO_INPUT_THRESHOLD            500     /* 500 microseconds */
+#define QDIO_BUSY_BIT_PATIENCE          (100 << 12)     /* 100 microseconds */
+#define QDIO_INPUT_THRESHOLD            (500 << 12)     /* 500 microseconds */
 
 /*
  * if an asynchronous HiperSockets queue runs full, the 10 seconds timer wait
@@ -296,10 +296,8 @@ struct qdio_q {
         struct qdio_irq *irq_ptr;
         struct sl *sl;
         /*
-         * Warning: Leave this member at the end so it won't be cleared in
-         * qdio_fill_qs. A page is allocated under this pointer and used for
-         * slib and sl. slib is 2048 bytes big and sl points to offset
-         * PAGE_SIZE / 2.
+         * A page is allocated under this pointer and used for slib and sl.
+         * slib is 2048 bytes big and sl points to offset PAGE_SIZE / 2.
          */
         struct slib *slib;
 } __attribute__ ((aligned(256)));
@@ -372,11 +370,6 @@ static inline int multicast_outbound(struct qdio_q *q)
                (q->nr == q->irq_ptr->nr_output_qs - 1);
 }
 
-static inline unsigned long long get_usecs(void)
-{
-        return monotonic_clock() >> 12;
-}
-
 #define pci_out_supported(q) \
         (q->irq_ptr->qib.ac & QIB_AC_OUTBOUND_PCI_SUPPORTED)
 #define is_qebsm(q)                     (q->irq_ptr->sch_token != 0)
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 88be7b9ea6e1..00520f9a7a8e 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -336,10 +336,10 @@ again:
                 WARN_ON(queue_type(q) != QDIO_IQDIO_QFMT || cc != 2);
 
                 if (!start_time) {
-                        start_time = get_usecs();
+                        start_time = get_clock();
                         goto again;
                 }
-                if ((get_usecs() - start_time) < QDIO_BUSY_BIT_PATIENCE)
+                if ((get_clock() - start_time) < QDIO_BUSY_BIT_PATIENCE)
                         goto again;
         }
         return cc;
@@ -536,7 +536,7 @@ static int qdio_inbound_q_moved(struct qdio_q *q)
         if ((bufnr != q->last_move) || q->qdio_error) {
                 q->last_move = bufnr;
                 if (!is_thinint_irq(q->irq_ptr) && MACHINE_IS_LPAR)
-                        q->u.in.timestamp = get_usecs();
+                        q->u.in.timestamp = get_clock();
                 return 1;
         } else
                 return 0;
@@ -567,7 +567,7 @@ static inline int qdio_inbound_q_done(struct qdio_q *q)
          * At this point we know, that inbound first_to_check
          * has (probably) not moved (see qdio_inbound_processing).
          */
-        if (get_usecs() > q->u.in.timestamp + QDIO_INPUT_THRESHOLD) {
+        if (get_clock() > q->u.in.timestamp + QDIO_INPUT_THRESHOLD) {
                 DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "in done:%02x",
                               q->first_to_check);
                 return 1;
@@ -606,7 +606,7 @@ static void qdio_kick_handler(struct qdio_q *q)
 static void __qdio_inbound_processing(struct qdio_q *q)
 {
         qperf_inc(q, tasklet_inbound);
-again:
+
         if (!qdio_inbound_q_moved(q))
                 return;
 
@@ -615,7 +615,10 @@ again:
         if (!qdio_inbound_q_done(q)) {
                 /* means poll time is not yet over */
                 qperf_inc(q, tasklet_inbound_resched);
-                goto again;
+                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED)) {
+                        tasklet_schedule(&q->tasklet);
+                        return;
+                }
         }
 
         qdio_stop_polling(q);
@@ -625,7 +628,8 @@ again:
          */
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched2);
-                goto again;
+                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED))
+                        tasklet_schedule(&q->tasklet);
         }
 }
 
@@ -955,6 +959,9 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
                 return;
         }
 
+        if (irq_ptr->perf_stat_enabled)
+                irq_ptr->perf_stat.qdio_int++;
+
         if (IS_ERR(irb)) {
                 switch (PTR_ERR(irb)) {
                 case -EIO:
@@ -1016,30 +1023,6 @@ int qdio_get_ssqd_desc(struct ccw_device *cdev,
 }
 EXPORT_SYMBOL_GPL(qdio_get_ssqd_desc);
 
-/**
- * qdio_cleanup - shutdown queues and free data structures
- * @cdev: associated ccw device
- * @how: use halt or clear to shutdown
- *
- * This function calls qdio_shutdown() for @cdev with method @how.
- * and qdio_free(). The qdio_free() return value is ignored since
- * !irq_ptr is already checked.
- */
-int qdio_cleanup(struct ccw_device *cdev, int how)
-{
-        struct qdio_irq *irq_ptr = cdev->private->qdio_data;
-        int rc;
-
-        if (!irq_ptr)
-                return -ENODEV;
-
-        rc = qdio_shutdown(cdev, how);
-
-        qdio_free(cdev);
-        return rc;
-}
-EXPORT_SYMBOL_GPL(qdio_cleanup);
-
 static void qdio_shutdown_queues(struct ccw_device *cdev)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
@@ -1157,28 +1140,6 @@ int qdio_free(struct ccw_device *cdev)
 EXPORT_SYMBOL_GPL(qdio_free);
 
 /**
- * qdio_initialize - allocate and establish queues for a qdio subchannel
- * @init_data: initialization data
- *
- * This function first allocates queues via qdio_allocate() and on success
- * establishes them via qdio_establish().
- */
-int qdio_initialize(struct qdio_initialize *init_data)
-{
-        int rc;
-
-        rc = qdio_allocate(init_data);
-        if (rc)
-                return rc;
-
-        rc = qdio_establish(init_data);
-        if (rc)
-                qdio_free(init_data->cdev);
-        return rc;
-}
-EXPORT_SYMBOL_GPL(qdio_initialize);
-
-/**
  * qdio_allocate - allocate qdio queues and associated data
  * @init_data: initialization data
  */
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index 7f4a75465140..6326b67c45d2 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -106,10 +106,12 @@ int qdio_allocate_qs(struct qdio_irq *irq_ptr, int nr_input_qs, int nr_output_qs
 static void setup_queues_misc(struct qdio_q *q, struct qdio_irq *irq_ptr,
                               qdio_handler_t *handler, int i)
 {
-        /* must be cleared by every qdio_establish */
-        memset(q, 0, ((char *)&q->slib) - ((char *)q));
-        memset(q->slib, 0, PAGE_SIZE);
+        struct slib *slib = q->slib;
 
+        /* queue must be cleared for qdio_establish */
+        memset(q, 0, sizeof(*q));
+        memset(slib, 0, PAGE_SIZE);
+        q->slib = slib;
         q->irq_ptr = irq_ptr;
         q->mask = 1 << (31 - i);
         q->nr = i;
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index ce5f8910ff83..8daf1b99f153 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -95,7 +95,7 @@ void tiqdio_add_input_queues(struct qdio_irq *irq_ptr)
         for_each_input_queue(irq_ptr, q, i)
                 list_add_rcu(&q->entry, &tiq_list);
         mutex_unlock(&tiq_list_lock);
-        xchg(irq_ptr->dsci, 1);
+        xchg(irq_ptr->dsci, 1 << 7);
 }
 
 void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr)
@@ -173,7 +173,7 @@ static void tiqdio_thinint_handler(void *ind, void *drv_data)
 
                 /* prevent racing */
                 if (*tiqdio_alsi)
-                        xchg(&q_indicators[TIQDIO_SHARED_IND].ind, 1);
+                        xchg(&q_indicators[TIQDIO_SHARED_IND].ind, 1 << 7);
         }
 }
 
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 304caf549973..41e0aaefafd5 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -302,7 +302,7 @@ static ssize_t zcrypt_write(struct file *filp, const char __user *buf,
 static int zcrypt_open(struct inode *inode, struct file *filp)
 {
         atomic_inc(&zcrypt_open_count);
-        return 0;
+        return nonseekable_open(inode, filp);
 }
 
 /**
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 3ba738b2e271..28f71349fdec 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1292,13 +1292,14 @@ int qeth_qdio_clear_card(struct qeth_card *card, int use_halt)
                 QETH_QDIO_CLEANING)) {
         case QETH_QDIO_ESTABLISHED:
                 if (card->info.type == QETH_CARD_TYPE_IQD)
-                        rc = qdio_cleanup(CARD_DDEV(card),
+                        rc = qdio_shutdown(CARD_DDEV(card),
                                 QDIO_FLAG_CLEANUP_USING_HALT);
                 else
-                        rc = qdio_cleanup(CARD_DDEV(card),
+                        rc = qdio_shutdown(CARD_DDEV(card),
                                 QDIO_FLAG_CLEANUP_USING_CLEAR);
                 if (rc)
                         QETH_DBF_TEXT_(TRACE, 3, "1err%d", rc);
+                qdio_free(CARD_DDEV(card));
                 atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
                 break;
         case QETH_QDIO_CLEANING:
@@ -3810,10 +3811,18 @@ static int qeth_qdio_establish(struct qeth_card *card)
 
         if (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_ALLOCATED,
                 QETH_QDIO_ESTABLISHED) == QETH_QDIO_ALLOCATED) {
-                rc = qdio_initialize(&init_data);
-                if (rc)
+                rc = qdio_allocate(&init_data);
+                if (rc) {
+                        atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
+                        goto out;
+                }
+                rc = qdio_establish(&init_data);
+                if (rc) {
                         atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
+                        qdio_free(CARD_DDEV(card));
+                }
         }
+out:
         kfree(out_sbal_ptrs);
         kfree(in_sbal_ptrs);
         kfree(qib_param_field);
diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
index 25d9e0ae9c57..1a2db0a35737 100644
--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -254,6 +254,7 @@ static long zfcp_cfdc_dev_ioctl(struct file *file, unsigned int command,
 }
 
 static const struct file_operations zfcp_cfdc_fops = {
+        .open = nonseekable_open,
         .unlocked_ioctl = zfcp_cfdc_dev_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = zfcp_cfdc_dev_ioctl
diff --git a/drivers/sbus/char/flash.c b/drivers/sbus/char/flash.c
index 19f255b97c86..d3b62eb0fba7 100644
--- a/drivers/sbus/char/flash.c
+++ b/drivers/sbus/char/flash.c
@@ -105,9 +105,9 @@ static ssize_t
 flash_read(struct file * file, char __user * buf,
            size_t count, loff_t *ppos)
 {
-        unsigned long p = file->f_pos;
+        loff_t p = *ppos;
         int i;
-        
+
         if (count > flash.read_size - p)
                 count = flash.read_size - p;
 
@@ -118,7 +118,7 @@ flash_read(struct file * file, char __user * buf,
                 buf++;
         }
 
-        file->f_pos += count;
+        *ppos += count;
         return count;
 }
 
diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c
index 105449c15fa9..e17764d71476 100644
--- a/drivers/scsi/zorro7xx.c
+++ b/drivers/scsi/zorro7xx.c
@@ -69,6 +69,7 @@ static struct zorro_device_id zorro7xx_zorro_tbl[] __devinitdata = {
         },
         { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, zorro7xx_zorro_tbl);
 
 static int __devinit zorro7xx_init_one(struct zorro_dev *z,
                                        const struct zorro_device_id *ent)
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index f55c49475a8c..302836a80693 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -518,12 +518,13 @@ config SERIAL_S3C2412
           Serial port support for the Samsung S3C2412 and S3C2413 SoC
 
 config SERIAL_S3C2440
-        tristate "Samsung S3C2440/S3C2442 Serial port support"
-        depends on SERIAL_SAMSUNG && (CPU_S3C2440 || CPU_S3C2442)
+        tristate "Samsung S3C2440/S3C2442/S3C2416 Serial port support"
+        depends on SERIAL_SAMSUNG && (CPU_S3C2440 || CPU_S3C2442 || CPU_S3C2416)
         default y if CPU_S3C2440
         default y if CPU_S3C2442
+        select SERIAL_SAMSUNG_UARTS_4 if CPU_S3C2416
         help
-          Serial port support for the Samsung S3C2440 and S3C2442 SoC
+          Serial port support for the Samsung S3C2440, S3C2416 and S3C2442 SoC
 
 config SERIAL_S3C24A0
         tristate "Samsung S3C24A0 Serial port support"
@@ -533,21 +534,13 @@ config SERIAL_S3C24A0
           Serial port support for the Samsung S3C24A0 SoC
 
 config SERIAL_S3C6400
-        tristate "Samsung S3C6400/S3C6410/S5P6440 Seria port support"
-        depends on SERIAL_SAMSUNG && (CPU_S3C6400 || CPU_S3C6410 || CPU_S5P6440)
+        tristate "Samsung S3C6400/S3C6410/S5P6440/S5PC100 Serial port support"
+        depends on SERIAL_SAMSUNG && (CPU_S3C6400 || CPU_S3C6410 || CPU_S5P6440 || CPU_S5PC100)
         select SERIAL_SAMSUNG_UARTS_4
         default y
         help
-          Serial port support for the Samsung S3C6400, S3C6410 and S5P6440
-          SoCs
-
-config SERIAL_S5PC100
-        tristate "Samsung S5PC100 Serial port support"
-        depends on SERIAL_SAMSUNG && CPU_S5PC100
-        select SERIAL_SAMSUNG_UARTS_4
-        default y
-        help
-          Serial port support for the Samsung S5PC100 SoCs
+          Serial port support for the Samsung S3C6400, S3C6410, S5P6440
+          and S5PC100 SoCs
 
 config SERIAL_S5PV210
         tristate "Samsung S5PV210 Serial port support"
diff --git a/drivers/serial/Makefile b/drivers/serial/Makefile
index 6aa4723b74ee..328f107346c4 100644
--- a/drivers/serial/Makefile
+++ b/drivers/serial/Makefile
@@ -44,7 +44,6 @@ obj-$(CONFIG_SERIAL_S3C2412) += s3c2412.o
 obj-$(CONFIG_SERIAL_S3C2440) += s3c2440.o
 obj-$(CONFIG_SERIAL_S3C24A0) += s3c24a0.o
 obj-$(CONFIG_SERIAL_S3C6400) += s3c6400.o
-obj-$(CONFIG_SERIAL_S5PC100) += s3c6400.o
 obj-$(CONFIG_SERIAL_S5PV210) += s5pv210.o
 obj-$(CONFIG_SERIAL_MAX3100) += max3100.o
 obj-$(CONFIG_SERIAL_IP22_ZILOG) += ip22zilog.o
diff --git a/drivers/serial/atmel_serial.c b/drivers/serial/atmel_serial.c
index 2c9bf9b68327..eed3c2d8dd1c 100644
--- a/drivers/serial/atmel_serial.c
+++ b/drivers/serial/atmel_serial.c
@@ -38,6 +38,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/atmel_pdc.h>
 #include <linux/atmel_serial.h>
+#include <linux/uaccess.h>
 
 #include <asm/io.h>
 
@@ -59,6 +60,9 @@
 
 #include <linux/serial_core.h>
 
+static void atmel_start_rx(struct uart_port *port);
+static void atmel_stop_rx(struct uart_port *port);
+
 #ifdef CONFIG_SERIAL_ATMEL_TTYAT
 
 /* Use device name ttyAT, major 204 and minor 154-169.  This is necessary if we
@@ -93,6 +97,7 @@
 #define UART_GET_BRGR(port)     __raw_readl((port)->membase + ATMEL_US_BRGR)
 #define UART_PUT_BRGR(port,v)   __raw_writel(v, (port)->membase + ATMEL_US_BRGR)
 #define UART_PUT_RTOR(port,v)   __raw_writel(v, (port)->membase + ATMEL_US_RTOR)
+#define UART_PUT_TTGR(port, v)  __raw_writel(v, (port)->membase + ATMEL_US_TTGR)
 
  /* PDC registers */
 #define UART_PUT_PTCR(port,v)   __raw_writel(v, (port)->membase + ATMEL_PDC_PTCR)
@@ -147,6 +152,9 @@ struct atmel_uart_port {
         unsigned int            irq_status_prev;
 
         struct circ_buf         rx_ring;
+
+        struct serial_rs485     rs485;          /* rs485 settings */
+        unsigned int            tx_done_mask;
 };
 
 static struct atmel_uart_port atmel_ports[ATMEL_MAX_UART];
@@ -187,6 +195,46 @@ static bool atmel_use_dma_tx(struct uart_port *port)
 }
 #endif
 
+/* Enable or disable the rs485 support */
+void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+{
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+        unsigned int mode;
+
+        spin_lock(&port->lock);
+
+        /* Disable interrupts */
+        UART_PUT_IDR(port, atmel_port->tx_done_mask);
+
+        mode = UART_GET_MR(port);
+
+        /* Resetting serial mode to RS232 (0x0) */
+        mode &= ~ATMEL_US_USMODE;
+
+        atmel_port->rs485 = *rs485conf;
+
+        if (rs485conf->flags & SER_RS485_ENABLED) {
+                dev_dbg(port->dev, "Setting UART to RS485\n");
+                atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
+                UART_PUT_TTGR(port, rs485conf->delay_rts_before_send);
+                mode |= ATMEL_US_USMODE_RS485;
+        } else {
+                dev_dbg(port->dev, "Setting UART to RS232\n");
+                if (atmel_use_dma_tx(port))
+                        atmel_port->tx_done_mask = ATMEL_US_ENDTX |
+                                ATMEL_US_TXBUFE;
+                else
+                        atmel_port->tx_done_mask = ATMEL_US_TXRDY;
+        }
+        UART_PUT_MR(port, mode);
+
+        /* Enable interrupts */
+        UART_PUT_IER(port, atmel_port->tx_done_mask);
+
+        spin_unlock(&port->lock);
+
+}
+
 /*
  * Return TIOCSER_TEMT when transmitter FIFO and Shift register is empty.
  */
@@ -202,6 +250,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl)
 {
         unsigned int control = 0;
         unsigned int mode;
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
 #ifdef CONFIG_ARCH_AT91RM9200
         if (cpu_is_at91rm9200()) {
@@ -236,6 +285,17 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl)
                 mode |= ATMEL_US_CHMODE_LOC_LOOP;
         else
                 mode |= ATMEL_US_CHMODE_NORMAL;
+
+        /* Resetting serial mode to RS232 (0x0) */
+        mode &= ~ATMEL_US_USMODE;
+
+        if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
+                dev_dbg(port->dev, "Setting UART to RS485\n");
+                UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_before_send);
+                mode |= ATMEL_US_USMODE_RS485;
+        } else {
+                dev_dbg(port->dev, "Setting UART to RS232\n");
+        }
         UART_PUT_MR(port, mode);
 }
 
@@ -268,12 +328,17 @@ static u_int atmel_get_mctrl(struct uart_port *port)
  */
 static void atmel_stop_tx(struct uart_port *port)
 {
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+
         if (atmel_use_dma_tx(port)) {
                 /* disable PDC transmit */
                 UART_PUT_PTCR(port, ATMEL_PDC_TXTDIS);
-                UART_PUT_IDR(port, ATMEL_US_ENDTX | ATMEL_US_TXBUFE);
-        } else
-                UART_PUT_IDR(port, ATMEL_US_TXRDY);
+        }
+        /* Disable interrupts */
+        UART_PUT_IDR(port, atmel_port->tx_done_mask);
+
+        if (atmel_port->rs485.flags & SER_RS485_ENABLED)
+                atmel_start_rx(port);
 }
 
 /*
@@ -281,17 +346,39 @@ static void atmel_stop_tx(struct uart_port *port)
  */
 static void atmel_start_tx(struct uart_port *port)
 {
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+
         if (atmel_use_dma_tx(port)) {
                 if (UART_GET_PTSR(port) & ATMEL_PDC_TXTEN)
                         /* The transmitter is already running.  Yes, we
                            really need this.*/
                         return;
 
-                UART_PUT_IER(port, ATMEL_US_ENDTX | ATMEL_US_TXBUFE);
+                if (atmel_port->rs485.flags & SER_RS485_ENABLED)
+                        atmel_stop_rx(port);
+
                 /* re-enable PDC transmit */
                 UART_PUT_PTCR(port, ATMEL_PDC_TXTEN);
-        } else
-                UART_PUT_IER(port, ATMEL_US_TXRDY);
+        }
+        /* Enable interrupts */
+        UART_PUT_IER(port, atmel_port->tx_done_mask);
+}
+
+/*
+ * start receiving - port is in process of being opened.
+ */
+static void atmel_start_rx(struct uart_port *port)
+{
+        UART_PUT_CR(port, ATMEL_US_RSTSTA);  /* reset status and receiver */
+
+        if (atmel_use_dma_rx(port)) {
+                /* enable PDC controller */
+                UART_PUT_IER(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT |
+                        port->read_status_mask);
+                UART_PUT_PTCR(port, ATMEL_PDC_RXTEN);
+        } else {
+                UART_PUT_IER(port, ATMEL_US_RXRDY);
+        }
 }
 
 /*
@@ -302,9 +389,11 @@ static void atmel_stop_rx(struct uart_port *port)
         if (atmel_use_dma_rx(port)) {
                 /* disable PDC receive */
                 UART_PUT_PTCR(port, ATMEL_PDC_RXTDIS);
-                UART_PUT_IDR(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT);
-        } else
+                UART_PUT_IDR(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT |
+                        port->read_status_mask);
+        } else {
                 UART_PUT_IDR(port, ATMEL_US_RXRDY);
+        }
 }
 
 /*
@@ -428,8 +517,9 @@ static void atmel_rx_chars(struct uart_port *port)
 static void atmel_tx_chars(struct uart_port *port)
 {
         struct circ_buf *xmit = &port->state->xmit;
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
-        if (port->x_char && UART_GET_CSR(port) & ATMEL_US_TXRDY) {
+        if (port->x_char && UART_GET_CSR(port) & atmel_port->tx_done_mask) {
                 UART_PUT_CHAR(port, port->x_char);
                 port->icount.tx++;
                 port->x_char = 0;
@@ -437,7 +527,7 @@ static void atmel_tx_chars(struct uart_port *port)
         if (uart_circ_empty(xmit) || uart_tx_stopped(port))
                 return;
 
-        while (UART_GET_CSR(port) & ATMEL_US_TXRDY) {
+        while (UART_GET_CSR(port) & atmel_port->tx_done_mask) {
                 UART_PUT_CHAR(port, xmit->buf[xmit->tail]);
                 xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
                 port->icount.tx++;
@@ -449,7 +539,8 @@ static void atmel_tx_chars(struct uart_port *port)
                 uart_write_wakeup(port);
 
         if (!uart_circ_empty(xmit))
-                UART_PUT_IER(port, ATMEL_US_TXRDY);
+                /* Enable interrupts */
+                UART_PUT_IER(port, atmel_port->tx_done_mask);
 }
 
 /*
@@ -501,18 +592,10 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending)
 {
         struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
-        if (atmel_use_dma_tx(port)) {
-                /* PDC transmit */
-                if (pending & (ATMEL_US_ENDTX | ATMEL_US_TXBUFE)) {
-                        UART_PUT_IDR(port, ATMEL_US_ENDTX | ATMEL_US_TXBUFE);
-                        tasklet_schedule(&atmel_port->tasklet);
-                }
-        } else {
-                /* Interrupt transmit */
-                if (pending & ATMEL_US_TXRDY) {
-                        UART_PUT_IDR(port, ATMEL_US_TXRDY);
-                        tasklet_schedule(&atmel_port->tasklet);
-                }
+        if (pending & atmel_port->tx_done_mask) {
+                /* Either PDC or interrupt transmission */
+                UART_PUT_IDR(port, atmel_port->tx_done_mask);
+                tasklet_schedule(&atmel_port->tasklet);
         }
 }
 
@@ -590,9 +673,15 @@ static void atmel_tx_dma(struct uart_port *port)
 
                 UART_PUT_TPR(port, pdc->dma_addr + xmit->tail);
                 UART_PUT_TCR(port, count);
-                /* re-enable PDC transmit and interrupts */
+                /* re-enable PDC transmit */
                 UART_PUT_PTCR(port, ATMEL_PDC_TXTEN);
-                UART_PUT_IER(port, ATMEL_US_ENDTX | ATMEL_US_TXBUFE);
+                /* Enable interrupts */
+                UART_PUT_IER(port, atmel_port->tx_done_mask);
+        } else {
+                if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
+                        /* DMA done, stop TX, start RX for RS485 */
+                        atmel_start_rx(port);
+                }
         }
 
         if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
@@ -1017,6 +1106,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
 {
         unsigned long flags;
         unsigned int mode, imr, quot, baud;
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
         /* Get current mode register */
         mode = UART_GET_MR(port) & ~(ATMEL_US_USCLKS | ATMEL_US_CHRL
@@ -1115,6 +1205,17 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
         /* disable receiver and transmitter */
         UART_PUT_CR(port, ATMEL_US_TXDIS | ATMEL_US_RXDIS);
 
+        /* Resetting serial mode to RS232 (0x0) */
+        mode &= ~ATMEL_US_USMODE;
+
+        if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
+                dev_dbg(port->dev, "Setting UART to RS485\n");
+                UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_before_send);
+                mode |= ATMEL_US_USMODE_RS485;
+        } else {
+                dev_dbg(port->dev, "Setting UART to RS232\n");
+        }
+
         /* set the parity, stop bits and data size */
         UART_PUT_MR(port, mode);
 
@@ -1231,6 +1332,35 @@ static void atmel_poll_put_char(struct uart_port *port, unsigned char ch)
 }
 #endif
 
+static int
+atmel_ioctl(struct uart_port *port, unsigned int cmd, unsigned long arg)
+{
+        struct serial_rs485 rs485conf;
+
+        switch (cmd) {
+        case TIOCSRS485:
+                if (copy_from_user(&rs485conf, (struct serial_rs485 *) arg,
+                                        sizeof(rs485conf)))
+                        return -EFAULT;
+
+                atmel_config_rs485(port, &rs485conf);
+                break;
+
+        case TIOCGRS485:
+                if (copy_to_user((struct serial_rs485 *) arg,
+                                        &(to_atmel_uart_port(port)->rs485),
+                                        sizeof(rs485conf)))
+                        return -EFAULT;
+                break;
+
+        default:
+                return -ENOIOCTLCMD;
+        }
+        return 0;
+}
+
+
+
 static struct uart_ops atmel_pops = {
         .tx_empty       = atmel_tx_empty,
         .set_mctrl      = atmel_set_mctrl,
@@ -1250,6 +1380,7 @@ static struct uart_ops atmel_pops = {
         .config_port    = atmel_config_port,
         .verify_port    = atmel_verify_port,
         .pm             = atmel_serial_pm,
+        .ioctl          = atmel_ioctl,
 #ifdef CONFIG_CONSOLE_POLL
         .poll_get_char  = atmel_poll_get_char,
         .poll_put_char  = atmel_poll_put_char,
@@ -1265,13 +1396,12 @@ static void __devinit atmel_init_port(struct atmel_uart_port *atmel_port,
         struct uart_port *port = &atmel_port->uart;
         struct atmel_uart_data *data = pdev->dev.platform_data;
 
-        port->iotype    = UPIO_MEM;
-        port->flags     = UPF_BOOT_AUTOCONF;
-        port->ops       = &atmel_pops;
-        port->fifosize  = 1;
-        port->line      = pdev->id;
-        port->dev       = &pdev->dev;
-
+        port->iotype            = UPIO_MEM;
+        port->flags             = UPF_BOOT_AUTOCONF;
+        port->ops               = &atmel_pops;
+        port->fifosize          = 1;
+        port->line              = pdev->id;
+        port->dev               = &pdev->dev;
         port->mapbase   = pdev->resource[0].start;
         port->irq       = pdev->resource[1].start;
 
@@ -1299,8 +1429,16 @@ static void __devinit atmel_init_port(struct atmel_uart_port *atmel_port,
 
         atmel_port->use_dma_rx = data->use_dma_rx;
         atmel_port->use_dma_tx = data->use_dma_tx;
-        if (atmel_use_dma_tx(port))
+        atmel_port->rs485       = data->rs485;
+        /* Use TXEMPTY for interrupt when rs485 else TXRDY or ENDTX|TXBUFE */
+        if (atmel_port->rs485.flags & SER_RS485_ENABLED)
+                atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
+        else if (atmel_use_dma_tx(port)) {
                 port->fifosize = PDC_BUFFER_SIZE;
+                atmel_port->tx_done_mask = ATMEL_US_ENDTX | ATMEL_US_TXBUFE;
+        } else {
+                atmel_port->tx_done_mask = ATMEL_US_TXRDY;
+        }
 }
 
 /*
@@ -1334,6 +1472,7 @@ static void atmel_console_putchar(struct uart_port *port, int ch)
 static void atmel_console_write(struct console *co, const char *s, u_int count)
 {
         struct uart_port *port = &atmel_ports[co->index].uart;
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
         unsigned int status, imr;
         unsigned int pdc_tx;
 
@@ -1341,7 +1480,7 @@ static void atmel_console_write(struct console *co, const char *s, u_int count)
          * First, save IMR and then disable interrupts
          */
         imr = UART_GET_IMR(port);
-        UART_PUT_IDR(port, ATMEL_US_RXRDY | ATMEL_US_TXRDY);
+        UART_PUT_IDR(port, ATMEL_US_RXRDY | atmel_port->tx_done_mask);
 
         /* Store PDC transmit status and disable it */
         pdc_tx = UART_GET_PTSR(port) & ATMEL_PDC_TXTEN;
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 4315b23590bd..eacb588a9345 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -120,7 +120,8 @@
 #define  MX2_UCR3_RXDMUXSEL      (1<<2)  /* RXD Muxed Input Select, on mx2/mx3 */
 #define  UCR3_INVT       (1<<1)  /* Inverted Infrared transmission */
 #define  UCR3_BPEN       (1<<0)  /* Preset registers enable */
-#define  UCR4_CTSTL_32   (32<<10) /* CTS trigger level (32 chars) */
+#define  UCR4_CTSTL_SHF  10      /* CTS trigger level shift */
+#define  UCR4_CTSTL_MASK 0x3F    /* CTS trigger is 6 bits wide */
 #define  UCR4_INVR       (1<<9)  /* Inverted infrared reception */
 #define  UCR4_ENIRI      (1<<8)  /* Serial infrared interrupt enable */
 #define  UCR4_WKEN       (1<<7)  /* Wake interrupt enable */
@@ -591,6 +592,9 @@ static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
         return 0;
 }
 
+/* half the RX buffer size */
+#define CTSTL 16
+
 static int imx_startup(struct uart_port *port)
 {
         struct imx_port *sport = (struct imx_port *)port;
@@ -607,6 +611,10 @@ static int imx_startup(struct uart_port *port)
         if (USE_IRDA(sport))
                 temp |= UCR4_IRSC;
 
+        /* set the trigger level for CTS */
+        temp &= ~(UCR4_CTSTL_MASK<<  UCR4_CTSTL_SHF);
+        temp |= CTSTL<<  UCR4_CTSTL_SHF;
+
         writel(temp & ~UCR4_DREN, sport->port.membase + UCR4);
 
         if (USE_IRDA(sport)) {
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index a176ab4bd65b..02469c31bf0b 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -1467,7 +1467,7 @@ mpc52xx_uart_init(void)
         /*
          * Map the PSC FIFO Controller and init if on MPC512x.
          */
-        if (psc_ops->fifoc_init) {
+        if (psc_ops && psc_ops->fifoc_init) {
                 ret = psc_ops->fifoc_init();
                 if (ret)
                         return ret;
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 8eb094c1f61b..8d993c4cceac 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -83,16 +83,16 @@ struct sci_port {
 
         /* Interface clock */
         struct clk              *iclk;
-        /* Data clock */
-        struct clk              *dclk;
+        /* Function clock */
+        struct clk              *fclk;
 
         struct list_head        node;
         struct dma_chan                 *chan_tx;
         struct dma_chan                 *chan_rx;
 #ifdef CONFIG_SERIAL_SH_SCI_DMA
         struct device                   *dma_dev;
-        enum sh_dmae_slave_chan_id      slave_tx;
-        enum sh_dmae_slave_chan_id      slave_rx;
+        unsigned int                    slave_tx;
+        unsigned int                    slave_rx;
         struct dma_async_tx_descriptor  *desc_tx;
         struct dma_async_tx_descriptor  *desc_rx[2];
         dma_cookie_t                    cookie_tx;
@@ -107,6 +107,7 @@ struct sci_port {
         struct work_struct              work_tx;
         struct work_struct              work_rx;
         struct timer_list               rx_timer;
+        unsigned int                    rx_timeout;
 #endif
 };
 
@@ -674,22 +675,22 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
         struct sci_port *s = to_sci_port(port);
 
         if (s->chan_rx) {
-                unsigned long tout;
                 u16 scr = sci_in(port, SCSCR);
                 u16 ssr = sci_in(port, SCxSR);
 
                 /* Disable future Rx interrupts */
-                sci_out(port, SCSCR, scr & ~SCI_CTRL_FLAGS_RIE);
+                if (port->type == PORT_SCIFA) {
+                        disable_irq_nosync(irq);
+                        scr |= 0x4000;
+                } else {
+                        scr &= ~SCI_CTRL_FLAGS_RIE;
+                }
+                sci_out(port, SCSCR, scr);
                 /* Clear current interrupt */
                 sci_out(port, SCxSR, ssr & ~(1 | SCxSR_RDxF(port)));
-                /* Calculate delay for 1.5 DMA buffers */
-                tout = (port->timeout - HZ / 50) * s->buf_len_rx * 3 /
-                        port->fifosize / 2;
-                dev_dbg(port->dev, "Rx IRQ: setup timeout in %lu ms\n",
-                        tout * 1000 / HZ);
-                if (tout < 2)
-                        tout = 2;
-                mod_timer(&s->rx_timer, jiffies + tout);
+                dev_dbg(port->dev, "Rx IRQ %lu: setup t-out in %u jiffies\n",
+                        jiffies, s->rx_timeout);
+                mod_timer(&s->rx_timer, jiffies + s->rx_timeout);
 
                 return IRQ_HANDLED;
         }
@@ -799,7 +800,7 @@ static int sci_notifier(struct notifier_block *self,
             (phase == CPUFREQ_RESUMECHANGE)) {
                 spin_lock_irqsave(&priv->lock, flags);
                 list_for_each_entry(sci_port, &priv->ports, node)
-                        sci_port->port.uartclk = clk_get_rate(sci_port->dclk);
+                        sci_port->port.uartclk = clk_get_rate(sci_port->iclk);
                 spin_unlock_irqrestore(&priv->lock, flags);
         }
 
@@ -810,21 +811,17 @@ static void sci_clk_enable(struct uart_port *port)
 {
         struct sci_port *sci_port = to_sci_port(port);
 
-        clk_enable(sci_port->dclk);
-        sci_port->port.uartclk = clk_get_rate(sci_port->dclk);
-
-        if (sci_port->iclk)
-                clk_enable(sci_port->iclk);
+        clk_enable(sci_port->iclk);
+        sci_port->port.uartclk = clk_get_rate(sci_port->iclk);
+        clk_enable(sci_port->fclk);
 }
 
 static void sci_clk_disable(struct uart_port *port)
 {
         struct sci_port *sci_port = to_sci_port(port);
 
-        if (sci_port->iclk)
-                clk_disable(sci_port->iclk);
-
-        clk_disable(sci_port->dclk);
+        clk_disable(sci_port->fclk);
+        clk_disable(sci_port->iclk);
 }
 
 static int sci_request_irq(struct sci_port *port)
@@ -913,22 +910,26 @@ static void sci_dma_tx_complete(void *arg)
 
         spin_lock_irqsave(&port->lock, flags);
 
-        xmit->tail += s->sg_tx.length;
+        xmit->tail += sg_dma_len(&s->sg_tx);
         xmit->tail &= UART_XMIT_SIZE - 1;
 
-        port->icount.tx += s->sg_tx.length;
+        port->icount.tx += sg_dma_len(&s->sg_tx);
 
         async_tx_ack(s->desc_tx);
         s->cookie_tx = -EINVAL;
         s->desc_tx = NULL;
 
-        spin_unlock_irqrestore(&port->lock, flags);
-
         if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
                 uart_write_wakeup(port);
 
-        if (uart_circ_chars_pending(xmit))
+        if (!uart_circ_empty(xmit)) {
                 schedule_work(&s->work_tx);
+        } else if (port->type == PORT_SCIFA) {
+                u16 ctrl = sci_in(port, SCSCR);
+                sci_out(port, SCSCR, ctrl & ~SCI_CTRL_FLAGS_TIE);
+        }
+
+        spin_unlock_irqrestore(&port->lock, flags);
 }
 
 /* Locking: called with port lock held */
@@ -972,13 +973,13 @@ static void sci_dma_rx_complete(void *arg)
         unsigned long flags;
         int count;
 
-        dev_dbg(port->dev, "%s(%d)\n", __func__, port->line);
+        dev_dbg(port->dev, "%s(%d) active #%d\n", __func__, port->line, s->active_rx);
 
         spin_lock_irqsave(&port->lock, flags);
 
         count = sci_dma_rx_push(s, tty, s->buf_len_rx);
 
-        mod_timer(&s->rx_timer, jiffies + msecs_to_jiffies(5));
+        mod_timer(&s->rx_timer, jiffies + s->rx_timeout);
 
         spin_unlock_irqrestore(&port->lock, flags);
 
@@ -1050,6 +1051,8 @@ static void sci_submit_rx(struct sci_port *s)
                         sci_rx_dma_release(s, true);
                         return;
                 }
+                dev_dbg(s->port.dev, "%s(): cookie %d to #%d\n", __func__,
+                        s->cookie_rx[i], i);
         }
 
         s->active_rx = s->cookie_rx[0];
@@ -1107,10 +1110,10 @@ static void work_fn_rx(struct work_struct *work)
                 return;
         }
 
-        dev_dbg(port->dev, "%s: cookie %d #%d\n", __func__,
-                s->cookie_rx[new], new);
-
         s->active_rx = s->cookie_rx[!new];
+
+        dev_dbg(port->dev, "%s: cookie %d #%d, new active #%d\n", __func__,
+                s->cookie_rx[new], new, s->active_rx);
 }
 
 static void work_fn_tx(struct work_struct *work)
@@ -1131,14 +1134,13 @@ static void work_fn_tx(struct work_struct *work)
          */
         spin_lock_irq(&port->lock);
         sg->offset = xmit->tail & (UART_XMIT_SIZE - 1);
-        sg->dma_address = (sg_dma_address(sg) & ~(UART_XMIT_SIZE - 1)) +
+        sg_dma_address(sg) = (sg_dma_address(sg) & ~(UART_XMIT_SIZE - 1)) +
                 sg->offset;
-        sg->length = min((int)CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE),
+        sg_dma_len(sg) = min((int)CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE),
                 CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE));
-        sg->dma_length = sg->length;
         spin_unlock_irq(&port->lock);
 
-        BUG_ON(!sg->length);
+        BUG_ON(!sg_dma_len(sg));
 
         desc = chan->device->device_prep_slave_sg(chan,
                         sg, s->sg_len_tx, DMA_TO_DEVICE,
@@ -1173,23 +1175,28 @@ static void work_fn_tx(struct work_struct *work)
 
 static void sci_start_tx(struct uart_port *port)
 {
+        struct sci_port *s = to_sci_port(port);
         unsigned short ctrl;
 
 #ifdef CONFIG_SERIAL_SH_SCI_DMA
-        struct sci_port *s = to_sci_port(port);
-
-        if (s->chan_tx) {
-                if (!uart_circ_empty(&s->port.state->xmit) && s->cookie_tx < 0)
-                        schedule_work(&s->work_tx);
-
-                return;
+        if (port->type == PORT_SCIFA) {
+                u16 new, scr = sci_in(port, SCSCR);
+                if (s->chan_tx)
+                        new = scr | 0x8000;
+                else
+                        new = scr & ~0x8000;
+                if (new != scr)
+                        sci_out(port, SCSCR, new);
         }
+        if (s->chan_tx && !uart_circ_empty(&s->port.state->xmit) &&
+            s->cookie_tx < 0)
+                schedule_work(&s->work_tx);
 #endif
-
-        /* Set TIE (Transmit Interrupt Enable) bit in SCSCR */
-        ctrl = sci_in(port, SCSCR);
-        ctrl |= SCI_CTRL_FLAGS_TIE;
-        sci_out(port, SCSCR, ctrl);
+        if (!s->chan_tx || port->type == PORT_SCIFA) {
+                /* Set TIE (Transmit Interrupt Enable) bit in SCSCR */
+                ctrl = sci_in(port, SCSCR);
+                sci_out(port, SCSCR, ctrl | SCI_CTRL_FLAGS_TIE);
+        }
 }
 
 static void sci_stop_tx(struct uart_port *port)
@@ -1198,6 +1205,8 @@ static void sci_stop_tx(struct uart_port *port)
 
         /* Clear TIE (Transmit Interrupt Enable) bit in SCSCR */
         ctrl = sci_in(port, SCSCR);
+        if (port->type == PORT_SCIFA)
+                ctrl &= ~0x8000;
         ctrl &= ~SCI_CTRL_FLAGS_TIE;
         sci_out(port, SCSCR, ctrl);
 }
@@ -1208,6 +1217,8 @@ static void sci_start_rx(struct uart_port *port)
 
         /* Set RIE (Receive Interrupt Enable) bit in SCSCR */
         ctrl |= sci_in(port, SCSCR);
+        if (port->type == PORT_SCIFA)
+                ctrl &= ~0x4000;
         sci_out(port, SCSCR, ctrl);
 }
 
@@ -1217,6 +1228,8 @@ static void sci_stop_rx(struct uart_port *port)
 
         /* Clear RIE (Receive Interrupt Enable) bit in SCSCR */
         ctrl = sci_in(port, SCSCR);
+        if (port->type == PORT_SCIFA)
+                ctrl &= ~0x4000;
         ctrl &= ~(SCI_CTRL_FLAGS_RIE | SCI_CTRL_FLAGS_REIE);
         sci_out(port, SCSCR, ctrl);
 }
@@ -1251,8 +1264,12 @@ static void rx_timer_fn(unsigned long arg)
 {
         struct sci_port *s = (struct sci_port *)arg;
         struct uart_port *port = &s->port;
-
         u16 scr = sci_in(port, SCSCR);
+
+        if (port->type == PORT_SCIFA) {
+                scr &= ~0x4000;
+                enable_irq(s->irqs[1]);
+        }
         sci_out(port, SCSCR, scr | SCI_CTRL_FLAGS_RIE);
         dev_dbg(port->dev, "DMA Rx timed out\n");
         schedule_work(&s->work_rx);
@@ -1339,8 +1356,7 @@ static void sci_request_dma(struct uart_port *port)
                         sg_init_table(sg, 1);
                         sg_set_page(sg, virt_to_page(buf[i]), s->buf_len_rx,
                                     (int)buf[i] & ~PAGE_MASK);
-                        sg->dma_address = dma[i];
-                        sg->dma_length = sg->length;
+                        sg_dma_address(sg) = dma[i];
                 }
 
                 INIT_WORK(&s->work_rx, work_fn_rx);
@@ -1403,8 +1419,12 @@ static void sci_shutdown(struct uart_port *port)
 static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
                             struct ktermios *old)
 {
+#ifdef CONFIG_SERIAL_SH_SCI_DMA
+        struct sci_port *s = to_sci_port(port);
+#endif
         unsigned int status, baud, smr_val, max_baud;
         int t = -1;
+        u16 scfcr = 0;
 
         /*
          * earlyprintk comes here early on with port->uartclk set to zero.
@@ -1427,7 +1447,7 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
         sci_out(port, SCSCR, 0x00);     /* TE=0, RE=0, CKE1=0 */
 
         if (port->type != PORT_SCI)
-                sci_out(port, SCFCR, SCFCR_RFRST | SCFCR_TFRST);
+                sci_out(port, SCFCR, scfcr | SCFCR_RFRST | SCFCR_TFRST);
 
         smr_val = sci_in(port, SCSMR) & 3;
         if ((termios->c_cflag & CSIZE) == CS7)
@@ -1458,10 +1478,32 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
         }
 
         sci_init_pins(port, termios->c_cflag);
-        sci_out(port, SCFCR, (termios->c_cflag & CRTSCTS) ? SCFCR_MCE : 0);
+        sci_out(port, SCFCR, scfcr | ((termios->c_cflag & CRTSCTS) ? SCFCR_MCE : 0));
 
         sci_out(port, SCSCR, SCSCR_INIT(port));
 
+#ifdef CONFIG_SERIAL_SH_SCI_DMA
+        /*
+         * Calculate delay for 1.5 DMA buffers: see
+         * drivers/serial/serial_core.c::uart_update_timeout(). With 10 bits
+         * (CS8), 250Hz, 115200 baud and 64 bytes FIFO, the above function
+         * calculates 1 jiffie for the data plus 5 jiffies for the "slop(e)."
+         * Then below we calculate 3 jiffies (12ms) for 1.5 DMA buffers (3 FIFO
+         * sizes), but it has been found out experimentally, that this is not
+         * enough: the driver too often needlessly runs on a DMA timeout. 20ms
+         * as a minimum seem to work perfectly.
+         */
+        if (s->chan_rx) {
+                s->rx_timeout = (port->timeout - HZ / 50) * s->buf_len_rx * 3 /
+                        port->fifosize / 2;
+                dev_dbg(port->dev,
+                        "DMA Rx t-out %ums, tty t-out %u jiffies\n",
+                        s->rx_timeout * 1000 / HZ, port->timeout);
+                if (s->rx_timeout < msecs_to_jiffies(20))
+                        s->rx_timeout = msecs_to_jiffies(20);
+        }
+#endif
+
         if ((termios->c_cflag & CREAD) != 0)
                 sci_start_rx(port);
 }
@@ -1553,10 +1595,10 @@ static struct uart_ops sci_uart_ops = {
 #endif
 };
 
-static void __devinit sci_init_single(struct platform_device *dev,
-                                      struct sci_port *sci_port,
-                                      unsigned int index,
-                                      struct plat_sci_port *p)
+static int __devinit sci_init_single(struct platform_device *dev,
+                                     struct sci_port *sci_port,
+                                     unsigned int index,
+                                     struct plat_sci_port *p)
 {
         struct uart_port *port = &sci_port->port;
 
@@ -1577,8 +1619,23 @@ static void __devinit sci_init_single(struct platform_device *dev,
         }
 
         if (dev) {
-                sci_port->iclk = p->clk ? clk_get(&dev->dev, p->clk) : NULL;
-                sci_port->dclk = clk_get(&dev->dev, "peripheral_clk");
+                sci_port->iclk = clk_get(&dev->dev, "sci_ick");
+                if (IS_ERR(sci_port->iclk)) {
+                        sci_port->iclk = clk_get(&dev->dev, "peripheral_clk");
+                        if (IS_ERR(sci_port->iclk)) {
+                                dev_err(&dev->dev, "can't get iclk\n");
+                                return PTR_ERR(sci_port->iclk);
+                        }
+                }
+
+                /*
+                 * The function clock is optional, ignore it if we can't
+                 * find it.
+                 */
+                sci_port->fclk = clk_get(&dev->dev, "sci_fck");
+                if (IS_ERR(sci_port->fclk))
+                        sci_port->fclk = NULL;
+
                 sci_port->enable = sci_clk_enable;
                 sci_port->disable = sci_clk_disable;
                 port->dev = &dev->dev;
@@ -1605,6 +1662,7 @@ static void __devinit sci_init_single(struct platform_device *dev,
 #endif
 
         memcpy(&sci_port->irqs, &p->irqs, sizeof(p->irqs));
+        return 0;
 }
 
 #ifdef CONFIG_SERIAL_SH_SCI_CONSOLE
@@ -1754,8 +1812,11 @@ static int sci_remove(struct platform_device *dev)
         cpufreq_unregister_notifier(&priv->clk_nb, CPUFREQ_TRANSITION_NOTIFIER);
 
         spin_lock_irqsave(&priv->lock, flags);
-        list_for_each_entry(p, &priv->ports, node)
+        list_for_each_entry(p, &priv->ports, node) {
                 uart_remove_one_port(&sci_uart_driver, &p->port);
+                clk_put(p->iclk);
+                clk_put(p->fclk);
+        }
         spin_unlock_irqrestore(&priv->lock, flags);
 
         kfree(priv);
@@ -1781,7 +1842,9 @@ static int __devinit sci_probe_single(struct platform_device *dev,
                 return 0;
         }
 
-        sci_init_single(dev, sciport, index, p);
+        ret = sci_init_single(dev, sciport, index, p);
+        if (ret)
+                return ret;
 
         ret = uart_add_one_port(&sci_uart_driver, &sciport->port);
         if (ret)
diff --git a/drivers/sh/Kconfig b/drivers/sh/Kconfig
new file mode 100644
index 000000000000..a54de0b9b3df
--- /dev/null
+++ b/drivers/sh/Kconfig
@@ -0,0 +1,24 @@
+config INTC_USERIMASK
+        bool "Userspace interrupt masking support"
+        depends on ARCH_SHMOBILE || (SUPERH && CPU_SH4A)
+        help
+          This enables support for hardware-assisted userspace hardirq
+          masking.
+
+          SH-4A and newer interrupt blocks all support a special shadowed
+          page with all non-masking registers obscured when mapped in to
+          userspace. This is primarily for use by userspace device
+          drivers that are using special priority levels.
+
+          If in doubt, say N.
+
+config INTC_BALANCING
+        bool "Hardware IRQ balancing support"
+        depends on SMP && SUPERH && CPU_SUBTYPE_SH7786
+        help
+          This enables support for IRQ auto-distribution mode on SH-X3
+          SMP parts. All of the balancing and CPU wakeup decisions are
+          taken care of automatically by hardware for distributed
+          vectors.
+
+          If in doubt, say N.
diff --git a/drivers/sh/Makefile b/drivers/sh/Makefile
index 4956bf1f2134..78bb5127abd0 100644
--- a/drivers/sh/Makefile
+++ b/drivers/sh/Makefile
@@ -4,4 +4,6 @@
 obj-$(CONFIG_SUPERHYWAY)        += superhyway/
 obj-$(CONFIG_MAPLE)             += maple/
 obj-$(CONFIG_GENERIC_GPIO)      += pfc.o
+obj-$(CONFIG_SUPERH)            += clk.o
+obj-$(CONFIG_SH_CLK_CPG)        += clk-cpg.o
 obj-y                           += intc.o
diff --git a/drivers/sh/clk-cpg.c b/drivers/sh/clk-cpg.c
new file mode 100644
index 000000000000..f5c80ba9ab1c
--- /dev/null
+++ b/drivers/sh/clk-cpg.c
@@ -0,0 +1,298 @@
+#include <linux/clk.h>
+#include <linux/compiler.h>
+#include <linux/slab.h>
+#include <linux/io.h>
+#include <linux/sh_clk.h>
+
+static int sh_clk_mstp32_enable(struct clk *clk)
+{
+        __raw_writel(__raw_readl(clk->enable_reg) & ~(1 << clk->enable_bit),
+                     clk->enable_reg);
+        return 0;
+}
+
+static void sh_clk_mstp32_disable(struct clk *clk)
+{
+        __raw_writel(__raw_readl(clk->enable_reg) | (1 << clk->enable_bit),
+                     clk->enable_reg);
+}
+
+static struct clk_ops sh_clk_mstp32_clk_ops = {
+        .enable         = sh_clk_mstp32_enable,
+        .disable        = sh_clk_mstp32_disable,
+        .recalc         = followparent_recalc,
+};
+
+int __init sh_clk_mstp32_register(struct clk *clks, int nr)
+{
+        struct clk *clkp;
+        int ret = 0;
+        int k;
+
+        for (k = 0; !ret && (k < nr); k++) {
+                clkp = clks + k;
+                clkp->ops = &sh_clk_mstp32_clk_ops;
+                ret |= clk_register(clkp);
+        }
+
+        return ret;
+}
+
+static long sh_clk_div_round_rate(struct clk *clk, unsigned long rate)
+{
+        return clk_rate_table_round(clk, clk->freq_table, rate);
+}
+
+static int sh_clk_div6_divisors[64] = {
+        1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+        17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32,
+        33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48,
+        49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64
+};
+
+static struct clk_div_mult_table sh_clk_div6_table = {
+        .divisors = sh_clk_div6_divisors,
+        .nr_divisors = ARRAY_SIZE(sh_clk_div6_divisors),
+};
+
+static unsigned long sh_clk_div6_recalc(struct clk *clk)
+{
+        struct clk_div_mult_table *table = &sh_clk_div6_table;
+        unsigned int idx;
+
+        clk_rate_table_build(clk, clk->freq_table, table->nr_divisors,
+                             table, NULL);
+
+        idx = __raw_readl(clk->enable_reg) & 0x003f;
+
+        return clk->freq_table[idx].frequency;
+}
+
+static int sh_clk_div6_set_rate(struct clk *clk,
+                                unsigned long rate, int algo_id)
+{
+        unsigned long value;
+        int idx;
+
+        idx = clk_rate_table_find(clk, clk->freq_table, rate);
+        if (idx < 0)
+                return idx;
+
+        value = __raw_readl(clk->enable_reg);
+        value &= ~0x3f;
+        value |= idx;
+        __raw_writel(value, clk->enable_reg);
+        return 0;
+}
+
+static int sh_clk_div6_enable(struct clk *clk)
+{
+        unsigned long value;
+        int ret;
+
+        ret = sh_clk_div6_set_rate(clk, clk->rate, 0);
+        if (ret == 0) {
+                value = __raw_readl(clk->enable_reg);
+                value &= ~0x100; /* clear stop bit to enable clock */
+                __raw_writel(value, clk->enable_reg);
+        }
+        return ret;
+}
+
+static void sh_clk_div6_disable(struct clk *clk)
+{
+        unsigned long value;
+
+        value = __raw_readl(clk->enable_reg);
+        value |= 0x100; /* stop clock */
+        value |= 0x3f; /* VDIV bits must be non-zero, overwrite divider */
+        __raw_writel(value, clk->enable_reg);
+}
+
+static struct clk_ops sh_clk_div6_clk_ops = {
+        .recalc         = sh_clk_div6_recalc,
+        .round_rate     = sh_clk_div_round_rate,
+        .set_rate       = sh_clk_div6_set_rate,
+        .enable         = sh_clk_div6_enable,
+        .disable        = sh_clk_div6_disable,
+};
+
+int __init sh_clk_div6_register(struct clk *clks, int nr)
+{
+        struct clk *clkp;
+        void *freq_table;
+        int nr_divs = sh_clk_div6_table.nr_divisors;
+        int freq_table_size = sizeof(struct cpufreq_frequency_table);
+        int ret = 0;
+        int k;
+
+        freq_table_size *= (nr_divs + 1);
+        freq_table = kzalloc(freq_table_size * nr, GFP_KERNEL);
+        if (!freq_table) {
+                pr_err("sh_clk_div6_register: unable to alloc memory\n");
+                return -ENOMEM;
+        }
+
+        for (k = 0; !ret && (k < nr); k++) {
+                clkp = clks + k;
+
+                clkp->ops = &sh_clk_div6_clk_ops;
+                clkp->id = -1;
+                clkp->freq_table = freq_table + (k * freq_table_size);
+                clkp->freq_table[nr_divs].frequency = CPUFREQ_TABLE_END;
+
+                ret = clk_register(clkp);
+        }
+
+        return ret;
+}
+
+static unsigned long sh_clk_div4_recalc(struct clk *clk)
+{
+        struct clk_div4_table *d4t = clk->priv;
+        struct clk_div_mult_table *table = d4t->div_mult_table;
+        unsigned int idx;
+
+        clk_rate_table_build(clk, clk->freq_table, table->nr_divisors,
+                             table, &clk->arch_flags);
+
+        idx = (__raw_readl(clk->enable_reg) >> clk->enable_bit) & 0x000f;
+
+        return clk->freq_table[idx].frequency;
+}
+
+static int sh_clk_div4_set_parent(struct clk *clk, struct clk *parent)
+{
+        struct clk_div4_table *d4t = clk->priv;
+        struct clk_div_mult_table *table = d4t->div_mult_table;
+        u32 value;
+        int ret;
+
+        /* we really need a better way to determine parent index, but for
+         * now assume internal parent comes with CLK_ENABLE_ON_INIT set,
+         * no CLK_ENABLE_ON_INIT means external clock...
+         */
+
+        if (parent->flags & CLK_ENABLE_ON_INIT)
+                value = __raw_readl(clk->enable_reg) & ~(1 << 7);
+        else
+                value = __raw_readl(clk->enable_reg) | (1 << 7);
+
+        ret = clk_reparent(clk, parent);
+        if (ret < 0)
+                return ret;
+
+        __raw_writel(value, clk->enable_reg);
+
+        /* Rebiuld the frequency table */
+        clk_rate_table_build(clk, clk->freq_table, table->nr_divisors,
+                             table, &clk->arch_flags);
+
+        return 0;
+}
+
+static int sh_clk_div4_set_rate(struct clk *clk, unsigned long rate, int algo_id)
+{
+        struct clk_div4_table *d4t = clk->priv;
+        unsigned long value;
+        int idx = clk_rate_table_find(clk, clk->freq_table, rate);
+        if (idx < 0)
+                return idx;
+
+        value = __raw_readl(clk->enable_reg);
+        value &= ~(0xf << clk->enable_bit);
+        value |= (idx << clk->enable_bit);
+        __raw_writel(value, clk->enable_reg);
+
+        if (d4t->kick)
+                d4t->kick(clk);
+
+        return 0;
+}
+
+static int sh_clk_div4_enable(struct clk *clk)
+{
+        __raw_writel(__raw_readl(clk->enable_reg) & ~(1 << 8), clk->enable_reg);
+        return 0;
+}
+
+static void sh_clk_div4_disable(struct clk *clk)
+{
+        __raw_writel(__raw_readl(clk->enable_reg) | (1 << 8), clk->enable_reg);
+}
+
+static struct clk_ops sh_clk_div4_clk_ops = {
+        .recalc         = sh_clk_div4_recalc,
+        .set_rate       = sh_clk_div4_set_rate,
+        .round_rate     = sh_clk_div_round_rate,
+};
+
+static struct clk_ops sh_clk_div4_enable_clk_ops = {
+        .recalc         = sh_clk_div4_recalc,
+        .set_rate       = sh_clk_div4_set_rate,
+        .round_rate     = sh_clk_div_round_rate,
+        .enable         = sh_clk_div4_enable,
+        .disable        = sh_clk_div4_disable,
+};
+
+static struct clk_ops sh_clk_div4_reparent_clk_ops = {
+        .recalc         = sh_clk_div4_recalc,
+        .set_rate       = sh_clk_div4_set_rate,
+        .round_rate     = sh_clk_div_round_rate,
+        .enable         = sh_clk_div4_enable,
+        .disable        = sh_clk_div4_disable,
+        .set_parent     = sh_clk_div4_set_parent,
+};
+
+static int __init sh_clk_div4_register_ops(struct clk *clks, int nr,
+                        struct clk_div4_table *table, struct clk_ops *ops)
+{
+        struct clk *clkp;
+        void *freq_table;
+        int nr_divs = table->div_mult_table->nr_divisors;
+        int freq_table_size = sizeof(struct cpufreq_frequency_table);
+        int ret = 0;
+        int k;
+
+        freq_table_size *= (nr_divs + 1);
+        freq_table = kzalloc(freq_table_size * nr, GFP_KERNEL);
+        if (!freq_table) {
+                pr_err("sh_clk_div4_register: unable to alloc memory\n");
+                return -ENOMEM;
+        }
+
+        for (k = 0; !ret && (k < nr); k++) {
+                clkp = clks + k;
+
+                clkp->ops = ops;
+                clkp->id = -1;
+                clkp->priv = table;
+
+                clkp->freq_table = freq_table + (k * freq_table_size);
+                clkp->freq_table[nr_divs].frequency = CPUFREQ_TABLE_END;
+
+                ret = clk_register(clkp);
+        }
+
+        return ret;
+}
+
+int __init sh_clk_div4_register(struct clk *clks, int nr,
+                                struct clk_div4_table *table)
+{
+        return sh_clk_div4_register_ops(clks, nr, table, &sh_clk_div4_clk_ops);
+}
+
+int __init sh_clk_div4_enable_register(struct clk *clks, int nr,
+                                struct clk_div4_table *table)
+{
+        return sh_clk_div4_register_ops(clks, nr, table,
+                                        &sh_clk_div4_enable_clk_ops);
+}
+
+int __init sh_clk_div4_reparent_register(struct clk *clks, int nr,
+                                struct clk_div4_table *table)
+{
+        return sh_clk_div4_register_ops(clks, nr, table,
+                                        &sh_clk_div4_reparent_clk_ops);
+}
diff --git a/drivers/sh/clk.c b/drivers/sh/clk.c
new file mode 100644
index 000000000000..5d84adac9ec4
--- /dev/null
+++ b/drivers/sh/clk.c
@@ -0,0 +1,545 @@
+/*
+ * drivers/sh/clk.c - SuperH clock framework
+ *
+ *  Copyright (C) 2005 - 2009  Paul Mundt
+ *
+ * This clock framework is derived from the OMAP version by:
+ *
+ *      Copyright (C) 2004 - 2008 Nokia Corporation
+ *      Written by Tuukka Tikkanen <tuukka.tikkanen@elektrobit.com>
+ *
+ *  Modified for omap shared clock framework by Tony Lindgren <tony@atomide.com>
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/kobject.h>
+#include <linux/sysdev.h>
+#include <linux/seq_file.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/debugfs.h>
+#include <linux/cpufreq.h>
+#include <linux/clk.h>
+#include <linux/sh_clk.h>
+
+static LIST_HEAD(clock_list);
+static DEFINE_SPINLOCK(clock_lock);
+static DEFINE_MUTEX(clock_list_sem);
+
+void clk_rate_table_build(struct clk *clk,
+                          struct cpufreq_frequency_table *freq_table,
+                          int nr_freqs,
+                          struct clk_div_mult_table *src_table,
+                          unsigned long *bitmap)
+{
+        unsigned long mult, div;
+        unsigned long freq;
+        int i;
+
+        for (i = 0; i < nr_freqs; i++) {
+                div = 1;
+                mult = 1;
+
+                if (src_table->divisors && i < src_table->nr_divisors)
+                        div = src_table->divisors[i];
+
+                if (src_table->multipliers && i < src_table->nr_multipliers)
+                        mult = src_table->multipliers[i];
+
+                if (!div || !mult || (bitmap && !test_bit(i, bitmap)))
+                        freq = CPUFREQ_ENTRY_INVALID;
+                else
+                        freq = clk->parent->rate * mult / div;
+
+                freq_table[i].index = i;
+                freq_table[i].frequency = freq;
+        }
+
+        /* Termination entry */
+        freq_table[i].index = i;
+        freq_table[i].frequency = CPUFREQ_TABLE_END;
+}
+
+long clk_rate_table_round(struct clk *clk,
+                          struct cpufreq_frequency_table *freq_table,
+                          unsigned long rate)
+{
+        unsigned long rate_error, rate_error_prev = ~0UL;
+        unsigned long rate_best_fit = rate;
+        unsigned long highest, lowest;
+        int i;
+
+        highest = lowest = 0;
+
+        for (i = 0; freq_table[i].frequency != CPUFREQ_TABLE_END; i++) {
+                unsigned long freq = freq_table[i].frequency;
+
+                if (freq == CPUFREQ_ENTRY_INVALID)
+                        continue;
+
+                if (freq > highest)
+                        highest = freq;
+                if (freq < lowest)
+                        lowest = freq;
+
+                rate_error = abs(freq - rate);
+                if (rate_error < rate_error_prev) {
+                        rate_best_fit = freq;
+                        rate_error_prev = rate_error;
+                }
+
+                if (rate_error == 0)
+                        break;
+        }
+
+        if (rate >= highest)
+                rate_best_fit = highest;
+        if (rate <= lowest)
+                rate_best_fit = lowest;
+
+        return rate_best_fit;
+}
+
+int clk_rate_table_find(struct clk *clk,
+                        struct cpufreq_frequency_table *freq_table,
+                        unsigned long rate)
+{
+        int i;
+
+        for (i = 0; freq_table[i].frequency != CPUFREQ_TABLE_END; i++) {
+                unsigned long freq = freq_table[i].frequency;
+
+                if (freq == CPUFREQ_ENTRY_INVALID)
+                        continue;
+
+                if (freq == rate)
+                        return i;
+        }
+
+        return -ENOENT;
+}
+
+/* Used for clocks that always have same value as the parent clock */
+unsigned long followparent_recalc(struct clk *clk)
+{
+        return clk->parent ? clk->parent->rate : 0;
+}
+
+int clk_reparent(struct clk *child, struct clk *parent)
+{
+        list_del_init(&child->sibling);
+        if (parent)
+                list_add(&child->sibling, &parent->children);
+        child->parent = parent;
+
+        /* now do the debugfs renaming to reattach the child
+           to the proper parent */
+
+        return 0;
+}
+
+/* Propagate rate to children */
+void propagate_rate(struct clk *tclk)
+{
+        struct clk *clkp;
+
+        list_for_each_entry(clkp, &tclk->children, sibling) {
+                if (clkp->ops && clkp->ops->recalc)
+                        clkp->rate = clkp->ops->recalc(clkp);
+
+                propagate_rate(clkp);
+        }
+}
+
+static void __clk_disable(struct clk *clk)
+{
+        if (WARN(!clk->usecount, "Trying to disable clock %s with 0 usecount\n",
+                 clk->name))
+                return;
+
+        if (!(--clk->usecount)) {
+                if (likely(clk->ops && clk->ops->disable))
+                        clk->ops->disable(clk);
+                if (likely(clk->parent))
+                        __clk_disable(clk->parent);
+        }
+}
+
+void clk_disable(struct clk *clk)
+{
+        unsigned long flags;
+
+        if (!clk)
+                return;
+
+        spin_lock_irqsave(&clock_lock, flags);
+        __clk_disable(clk);
+        spin_unlock_irqrestore(&clock_lock, flags);
+}
+EXPORT_SYMBOL_GPL(clk_disable);
+
+static int __clk_enable(struct clk *clk)
+{
+        int ret = 0;
+
+        if (clk->usecount++ == 0) {
+                if (clk->parent) {
+                        ret = __clk_enable(clk->parent);
+                        if (unlikely(ret))
+                                goto err;
+                }
+
+                if (clk->ops && clk->ops->enable) {
+                        ret = clk->ops->enable(clk);
+                        if (ret) {
+                                if (clk->parent)
+                                        __clk_disable(clk->parent);
+                                goto err;
+                        }
+                }
+        }
+
+        return ret;
+err:
+        clk->usecount--;
+        return ret;
+}
+
+int clk_enable(struct clk *clk)
+{
+        unsigned long flags;
+        int ret;
+
+        if (!clk)
+                return -EINVAL;
+
+        spin_lock_irqsave(&clock_lock, flags);
+        ret = __clk_enable(clk);
+        spin_unlock_irqrestore(&clock_lock, flags);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(clk_enable);
+
+static LIST_HEAD(root_clks);
+
+/**
+ * recalculate_root_clocks - recalculate and propagate all root clocks
+ *
+ * Recalculates all root clocks (clocks with no parent), which if the
+ * clock's .recalc is set correctly, should also propagate their rates.
+ * Called at init.
+ */
+void recalculate_root_clocks(void)
+{
+        struct clk *clkp;
+
+        list_for_each_entry(clkp, &root_clks, sibling) {
+                if (clkp->ops && clkp->ops->recalc)
+                        clkp->rate = clkp->ops->recalc(clkp);
+                propagate_rate(clkp);
+        }
+}
+
+int clk_register(struct clk *clk)
+{
+        if (clk == NULL || IS_ERR(clk))
+                return -EINVAL;
+
+        /*
+         * trap out already registered clocks
+         */
+        if (clk->node.next || clk->node.prev)
+                return 0;
+
+        mutex_lock(&clock_list_sem);
+
+        INIT_LIST_HEAD(&clk->children);
+        clk->usecount = 0;
+
+        if (clk->parent)
+                list_add(&clk->sibling, &clk->parent->children);
+        else
+                list_add(&clk->sibling, &root_clks);
+
+        list_add(&clk->node, &clock_list);
+        if (clk->ops && clk->ops->init)
+                clk->ops->init(clk);
+        mutex_unlock(&clock_list_sem);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(clk_register);
+
+void clk_unregister(struct clk *clk)
+{
+        mutex_lock(&clock_list_sem);
+        list_del(&clk->sibling);
+        list_del(&clk->node);
+        mutex_unlock(&clock_list_sem);
+}
+EXPORT_SYMBOL_GPL(clk_unregister);
+
+void clk_enable_init_clocks(void)
+{
+        struct clk *clkp;
+
+        list_for_each_entry(clkp, &clock_list, node)
+                if (clkp->flags & CLK_ENABLE_ON_INIT)
+                        clk_enable(clkp);
+}
+
+unsigned long clk_get_rate(struct clk *clk)
+{
+        return clk->rate;
+}
+EXPORT_SYMBOL_GPL(clk_get_rate);
+
+int clk_set_rate(struct clk *clk, unsigned long rate)
+{
+        return clk_set_rate_ex(clk, rate, 0);
+}
+EXPORT_SYMBOL_GPL(clk_set_rate);
+
+int clk_set_rate_ex(struct clk *clk, unsigned long rate, int algo_id)
+{
+        int ret = -EOPNOTSUPP;
+        unsigned long flags;
+
+        spin_lock_irqsave(&clock_lock, flags);
+
+        if (likely(clk->ops && clk->ops->set_rate)) {
+                ret = clk->ops->set_rate(clk, rate, algo_id);
+                if (ret != 0)
+                        goto out_unlock;
+        } else {
+                clk->rate = rate;
+                ret = 0;
+        }
+
+        if (clk->ops && clk->ops->recalc)
+                clk->rate = clk->ops->recalc(clk);
+
+        propagate_rate(clk);
+
+out_unlock:
+        spin_unlock_irqrestore(&clock_lock, flags);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(clk_set_rate_ex);
+
+int clk_set_parent(struct clk *clk, struct clk *parent)
+{
+        unsigned long flags;
+        int ret = -EINVAL;
+
+        if (!parent || !clk)
+                return ret;
+        if (clk->parent == parent)
+                return 0;
+
+        spin_lock_irqsave(&clock_lock, flags);
+        if (clk->usecount == 0) {
+                if (clk->ops->set_parent)
+                        ret = clk->ops->set_parent(clk, parent);
+                else
+                        ret = clk_reparent(clk, parent);
+
+                if (ret == 0) {
+                        pr_debug("clock: set parent of %s to %s (new rate %ld)\n",
+                                 clk->name, clk->parent->name, clk->rate);
+                        if (clk->ops->recalc)
+                                clk->rate = clk->ops->recalc(clk);
+                        propagate_rate(clk);
+                }
+        } else
+                ret = -EBUSY;
+        spin_unlock_irqrestore(&clock_lock, flags);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(clk_set_parent);
+
+struct clk *clk_get_parent(struct clk *clk)
+{
+        return clk->parent;
+}
+EXPORT_SYMBOL_GPL(clk_get_parent);
+
+long clk_round_rate(struct clk *clk, unsigned long rate)
+{
+        if (likely(clk->ops && clk->ops->round_rate)) {
+                unsigned long flags, rounded;
+
+                spin_lock_irqsave(&clock_lock, flags);
+                rounded = clk->ops->round_rate(clk, rate);
+                spin_unlock_irqrestore(&clock_lock, flags);
+
+                return rounded;
+        }
+
+        return clk_get_rate(clk);
+}
+EXPORT_SYMBOL_GPL(clk_round_rate);
+
+#ifdef CONFIG_PM
+static int clks_sysdev_suspend(struct sys_device *dev, pm_message_t state)
+{
+        static pm_message_t prev_state;
+        struct clk *clkp;
+
+        switch (state.event) {
+        case PM_EVENT_ON:
+                /* Resumeing from hibernation */
+                if (prev_state.event != PM_EVENT_FREEZE)
+                        break;
+
+                list_for_each_entry(clkp, &clock_list, node) {
+                        if (likely(clkp->ops)) {
+                                unsigned long rate = clkp->rate;
+
+                                if (likely(clkp->ops->set_parent))
+                                        clkp->ops->set_parent(clkp,
+                                                clkp->parent);
+                                if (likely(clkp->ops->set_rate))
+                                        clkp->ops->set_rate(clkp,
+                                                rate, NO_CHANGE);
+                                else if (likely(clkp->ops->recalc))
+                                        clkp->rate = clkp->ops->recalc(clkp);
+                        }
+                }
+                break;
+        case PM_EVENT_FREEZE:
+                break;
+        case PM_EVENT_SUSPEND:
+                break;
+        }
+
+        prev_state = state;
+        return 0;
+}
+
+static int clks_sysdev_resume(struct sys_device *dev)
+{
+        return clks_sysdev_suspend(dev, PMSG_ON);
+}
+
+static struct sysdev_class clks_sysdev_class = {
+        .name = "clks",
+};
+
+static struct sysdev_driver clks_sysdev_driver = {
+        .suspend = clks_sysdev_suspend,
+        .resume = clks_sysdev_resume,
+};
+
+static struct sys_device clks_sysdev_dev = {
+        .cls = &clks_sysdev_class,
+};
+
+static int __init clk_sysdev_init(void)
+{
+        sysdev_class_register(&clks_sysdev_class);
+        sysdev_driver_register(&clks_sysdev_class, &clks_sysdev_driver);
+        sysdev_register(&clks_sysdev_dev);
+
+        return 0;
+}
+subsys_initcall(clk_sysdev_init);
+#endif
+
+/*
+ *      debugfs support to trace clock tree hierarchy and attributes
+ */
+static struct dentry *clk_debugfs_root;
+
+static int clk_debugfs_register_one(struct clk *c)
+{
+        int err;
+        struct dentry *d, *child, *child_tmp;
+        struct clk *pa = c->parent;
+        char s[255];
+        char *p = s;
+
+        p += sprintf(p, "%s", c->name);
+        if (c->id >= 0)
+                sprintf(p, ":%d", c->id);
+        d = debugfs_create_dir(s, pa ? pa->dentry : clk_debugfs_root);
+        if (!d)
+                return -ENOMEM;
+        c->dentry = d;
+
+        d = debugfs_create_u8("usecount", S_IRUGO, c->dentry, (u8 *)&c->usecount);
+        if (!d) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+        d = debugfs_create_u32("rate", S_IRUGO, c->dentry, (u32 *)&c->rate);
+        if (!d) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+        d = debugfs_create_x32("flags", S_IRUGO, c->dentry, (u32 *)&c->flags);
+        if (!d) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+        return 0;
+
+err_out:
+        d = c->dentry;
+        list_for_each_entry_safe(child, child_tmp, &d->d_subdirs, d_u.d_child)
+                debugfs_remove(child);
+        debugfs_remove(c->dentry);
+        return err;
+}
+
+static int clk_debugfs_register(struct clk *c)
+{
+        int err;
+        struct clk *pa = c->parent;
+
+        if (pa && !pa->dentry) {
+                err = clk_debugfs_register(pa);
+                if (err)
+                        return err;
+        }
+
+        if (!c->dentry && c->name) {
+                err = clk_debugfs_register_one(c);
+                if (err)
+                        return err;
+        }
+        return 0;
+}
+
+static int __init clk_debugfs_init(void)
+{
+        struct clk *c;
+        struct dentry *d;
+        int err;
+
+        d = debugfs_create_dir("clock", NULL);
+        if (!d)
+                return -ENOMEM;
+        clk_debugfs_root = d;
+
+        list_for_each_entry(c, &clock_list, node) {
+                err = clk_debugfs_register(c);
+                if (err)
+                        goto err_out;
+        }
+        return 0;
+err_out:
+        debugfs_remove_recursive(clk_debugfs_root);
+        return err;
+}
+late_initcall(clk_debugfs_init);
diff --git a/drivers/sh/intc.c b/drivers/sh/intc.c
index 94ad6bd86a00..c585574b9aed 100644
--- a/drivers/sh/intc.c
+++ b/drivers/sh/intc.c
@@ -28,6 +28,7 @@
 #include <linux/topology.h>
 #include <linux/bitmap.h>
 #include <linux/cpumask.h>
+#include <asm/sizes.h>
 
 #define _INTC_MK(fn, mode, addr_e, addr_d, width, shift) \
         ((shift) | ((width) << 5) | ((fn) << 9) | ((mode) << 13) | \
@@ -45,6 +46,12 @@ struct intc_handle_int {
         unsigned long handle;
 };
 
+struct intc_window {
+        phys_addr_t phys;
+        void __iomem *virt;
+        unsigned long size;
+};
+
 struct intc_desc_int {
         struct list_head list;
         struct sys_device sysdev;
@@ -58,6 +65,8 @@ struct intc_desc_int {
         unsigned int nr_prio;
         struct intc_handle_int *sense;
         unsigned int nr_sense;
+        struct intc_window *window;
+        unsigned int nr_windows;
         struct irq_chip chip;
 };
 
@@ -87,8 +96,12 @@ static DEFINE_SPINLOCK(vector_lock);
 #define SMP_NR(d, x) 1
 #endif
 
-static unsigned int intc_prio_level[NR_IRQS]; /* for now */
+static unsigned int intc_prio_level[NR_IRQS];   /* for now */
+static unsigned int default_prio_level = 2;     /* 2 - 16 */
 static unsigned long ack_handle[NR_IRQS];
+#ifdef CONFIG_INTC_BALANCING
+static unsigned long dist_handle[NR_IRQS];
+#endif
 
 static inline struct intc_desc_int *get_intc_desc(unsigned int irq)
 {
@@ -96,6 +109,47 @@ static inline struct intc_desc_int *get_intc_desc(unsigned int irq)
         return container_of(chip, struct intc_desc_int, chip);
 }
 
+static unsigned long intc_phys_to_virt(struct intc_desc_int *d,
+                                       unsigned long address)
+{
+        struct intc_window *window;
+        int k;
+
+        /* scan through physical windows and convert address */
+        for (k = 0; k < d->nr_windows; k++) {
+                window = d->window + k;
+
+                if (address < window->phys)
+                        continue;
+
+                if (address >= (window->phys + window->size))
+                        continue;
+
+                address -= window->phys;
+                address += (unsigned long)window->virt;
+
+                return address;
+        }
+
+        /* no windows defined, register must be 1:1 mapped virt:phys */
+        return address;
+}
+
+static unsigned int intc_get_reg(struct intc_desc_int *d, unsigned long address)
+{
+        unsigned int k;
+
+        address = intc_phys_to_virt(d, address);
+
+        for (k = 0; k < d->nr_reg; k++) {
+                if (d->reg[k] == address)
+                        return k;
+        }
+
+        BUG();
+        return 0;
+}
+
 static inline unsigned int set_field(unsigned int value,
                                      unsigned int field_value,
                                      unsigned int handle)
@@ -229,6 +283,85 @@ static void (*intc_disable_fns[])(unsigned long addr,
         [MODE_PCLR_REG] = intc_mode_field,
 };
 
+#ifdef CONFIG_INTC_BALANCING
+static inline void intc_balancing_enable(unsigned int irq)
+{
+        struct intc_desc_int *d = get_intc_desc(irq);
+        unsigned long handle = dist_handle[irq];
+        unsigned long addr;
+
+        if (irq_balancing_disabled(irq) || !handle)
+                return;
+
+        addr = INTC_REG(d, _INTC_ADDR_D(handle), 0);
+        intc_reg_fns[_INTC_FN(handle)](addr, handle, 1);
+}
+
+static inline void intc_balancing_disable(unsigned int irq)
+{
+        struct intc_desc_int *d = get_intc_desc(irq);
+        unsigned long handle = dist_handle[irq];
+        unsigned long addr;
+
+        if (irq_balancing_disabled(irq) || !handle)
+                return;
+
+        addr = INTC_REG(d, _INTC_ADDR_D(handle), 0);
+        intc_reg_fns[_INTC_FN(handle)](addr, handle, 0);
+}
+
+static unsigned int intc_dist_data(struct intc_desc *desc,
+                                   struct intc_desc_int *d,
+                                   intc_enum enum_id)
+{
+        struct intc_mask_reg *mr = desc->hw.mask_regs;
+        unsigned int i, j, fn, mode;
+        unsigned long reg_e, reg_d;
+
+        for (i = 0; mr && enum_id && i < desc->hw.nr_mask_regs; i++) {
+                mr = desc->hw.mask_regs + i;
+
+                /*
+                 * Skip this entry if there's no auto-distribution
+                 * register associated with it.
+                 */
+                if (!mr->dist_reg)
+                        continue;
+
+                for (j = 0; j < ARRAY_SIZE(mr->enum_ids); j++) {
+                        if (mr->enum_ids[j] != enum_id)
+                                continue;
+
+                        fn = REG_FN_MODIFY_BASE;
+                        mode = MODE_ENABLE_REG;
+                        reg_e = mr->dist_reg;
+                        reg_d = mr->dist_reg;
+
+                        fn += (mr->reg_width >> 3) - 1;
+                        return _INTC_MK(fn, mode,
+                                        intc_get_reg(d, reg_e),
+                                        intc_get_reg(d, reg_d),
+                                        1,
+                                        (mr->reg_width - 1) - j);
+                }
+        }
+
+        /*
+         * It's possible we've gotten here with no distribution options
+         * available for the IRQ in question, so we just skip over those.
+         */
+        return 0;
+}
+#else
+static inline void intc_balancing_enable(unsigned int irq)
+{
+}
+
+static inline void intc_balancing_disable(unsigned int irq)
+{
+}
+#endif
+
 static inline void _intc_enable(unsigned int irq, unsigned long handle)
 {
         struct intc_desc_int *d = get_intc_desc(irq);
@@ -244,6 +377,8 @@ static inline void _intc_enable(unsigned int irq, unsigned long handle)
                 intc_enable_fns[_INTC_MODE(handle)](addr, handle, intc_reg_fns\
                                                     [_INTC_FN(handle)], irq);
         }
+
+        intc_balancing_enable(irq);
 }
 
 static void intc_enable(unsigned int irq)
@@ -254,10 +389,12 @@ static void intc_enable(unsigned int irq)
 static void intc_disable(unsigned int irq)
 {
         struct intc_desc_int *d = get_intc_desc(irq);
-        unsigned long handle = (unsigned long) get_irq_chip_data(irq);
+        unsigned long handle = (unsigned long)get_irq_chip_data(irq);
         unsigned long addr;
         unsigned int cpu;
 
+        intc_balancing_disable(irq);
+
         for (cpu = 0; cpu < SMP_NR(d, _INTC_ADDR_D(handle)); cpu++) {
 #ifdef CONFIG_SMP
                 if (!cpumask_test_cpu(cpu, irq_to_desc(irq)->affinity))
@@ -336,8 +473,7 @@ static void intc_mask_ack(unsigned int irq)
 
         intc_disable(irq);
 
-        /* read register and write zero only to the assocaited bit */
-
+        /* read register and write zero only to the associated bit */
         if (handle) {
                 addr = INTC_REG(d, _INTC_ADDR_D(handle), 0);
                 switch (_INTC_FN(handle)) {
@@ -366,7 +502,8 @@ static struct intc_handle_int *intc_find_irq(struct intc_handle_int *hp,
 {
         int i;
 
-        /* this doesn't scale well, but...
+        /*
+         * this doesn't scale well, but...
          *
          * this function should only be used for cerain uncommon
          * operations such as intc_set_priority() and intc_set_sense()
@@ -377,7 +514,6 @@ static struct intc_handle_int *intc_find_irq(struct intc_handle_int *hp,
          * memory footprint down is to make sure the array is sorted
          * and then perform a bisect to lookup the irq.
          */
-
         for (i = 0; i < nr_hp; i++) {
                 if ((hp + i)->irq != irq)
                         continue;
@@ -408,7 +544,6 @@ int intc_set_priority(unsigned int irq, unsigned int prio)
                  * primary masking method is using intc_prio_level[irq]
                  * priority level will be set during next enable()
                  */
-
                 if (_INTC_FN(ihp->handle) != REG_FN_ERR)
                         _intc_enable(irq, ihp->handle);
         }
@@ -447,20 +582,6 @@ static int intc_set_sense(unsigned int irq, unsigned int type)
         return 0;
 }
 
-static unsigned int __init intc_get_reg(struct intc_desc_int *d,
-                                 unsigned long address)
-{
-        unsigned int k;
-
-        for (k = 0; k < d->nr_reg; k++) {
-                if (d->reg[k] == address)
-                        return k;
-        }
-
-        BUG();
-        return 0;
-}
-
 static intc_enum __init intc_grp_id(struct intc_desc *desc,
                                     intc_enum enum_id)
 {
@@ -718,13 +839,14 @@ static void __init intc_register_irq(struct intc_desc *desc,
          */
         set_bit(irq, intc_irq_map);
 
-        /* Prefer single interrupt source bitmap over other combinations:
+        /*
+         * Prefer single interrupt source bitmap over other combinations:
+         *
          * 1. bitmap, single interrupt source
          * 2. priority, single interrupt source
          * 3. bitmap, multiple interrupt sources (groups)
          * 4. priority, multiple interrupt sources (groups)
          */
-
         data[0] = intc_mask_data(desc, d, enum_id, 0);
         data[1] = intc_prio_data(desc, d, enum_id, 0);
 
@@ -749,10 +871,11 @@ static void __init intc_register_irq(struct intc_desc *desc,
                                       handle_level_irq, "level");
         set_irq_chip_data(irq, (void *)data[primary]);
 
-        /* set priority level
+        /*
+         * set priority level
          * - this needs to be at least 2 for 5-bit priorities on 7780
          */
-        intc_prio_level[irq] = 2;
+        intc_prio_level[irq] = default_prio_level;
 
         /* enable secondary masking method if present */
         if (data[!primary])
@@ -769,7 +892,6 @@ static void __init intc_register_irq(struct intc_desc *desc,
                          * only secondary priority should access registers, so
                          * set _INTC_FN(h) = REG_FN_ERR for intc_set_priority()
                          */
-
                         hp->handle &= ~_INTC_MK(0x0f, 0, 0, 0, 0, 0);
                         hp->handle |= _INTC_MK(REG_FN_ERR, 0, 0, 0, 0, 0);
                 }
@@ -790,6 +912,11 @@ static void __init intc_register_irq(struct intc_desc *desc,
         if (desc->hw.ack_regs)
                 ack_handle[irq] = intc_ack_data(desc, d, enum_id);
 
+#ifdef CONFIG_INTC_BALANCING
+        if (desc->hw.mask_regs)
+                dist_handle[irq] = intc_dist_data(desc, d, enum_id);
+#endif
+
 #ifdef CONFIG_ARM
         set_irq_flags(irq, IRQF_VALID); /* Enable IRQ on ARM systems */
 #endif
@@ -801,6 +928,8 @@ static unsigned int __init save_reg(struct intc_desc_int *d,
                                     unsigned int smp)
 {
         if (value) {
+                value = intc_phys_to_virt(d, value);
+
                 d->reg[cnt] = value;
 #ifdef CONFIG_SMP
                 d->smp[cnt] = smp;
@@ -816,25 +945,59 @@ static void intc_redirect_irq(unsigned int irq, struct irq_desc *desc)
         generic_handle_irq((unsigned int)get_irq_data(irq));
 }
 
-void __init register_intc_controller(struct intc_desc *desc)
+int __init register_intc_controller(struct intc_desc *desc)
 {
         unsigned int i, k, smp;
         struct intc_hw_desc *hw = &desc->hw;
         struct intc_desc_int *d;
+        struct resource *res;
+
+        pr_info("intc: Registered controller '%s' with %u IRQs\n",
+                desc->name, hw->nr_vectors);
 
         d = kzalloc(sizeof(*d), GFP_NOWAIT);
+        if (!d)
+                goto err0;
 
         INIT_LIST_HEAD(&d->list);
         list_add(&d->list, &intc_list);
 
+        if (desc->num_resources) {
+                d->nr_windows = desc->num_resources;
+                d->window = kzalloc(d->nr_windows * sizeof(*d->window),
+                                    GFP_NOWAIT);
+                if (!d->window)
+                        goto err1;
+
+                for (k = 0; k < d->nr_windows; k++) {
+                        res = desc->resource + k;
+                        WARN_ON(resource_type(res) != IORESOURCE_MEM);
+                        d->window[k].phys = res->start;
+                        d->window[k].size = resource_size(res);
+                        d->window[k].virt = ioremap_nocache(res->start,
+                                                         resource_size(res));
+                        if (!d->window[k].virt)
+                                goto err2;
+                }
+        }
+
         d->nr_reg = hw->mask_regs ? hw->nr_mask_regs * 2 : 0;
+#ifdef CONFIG_INTC_BALANCING
+        if (d->nr_reg)
+                d->nr_reg += hw->nr_mask_regs;
+#endif
         d->nr_reg += hw->prio_regs ? hw->nr_prio_regs * 2 : 0;
         d->nr_reg += hw->sense_regs ? hw->nr_sense_regs : 0;
         d->nr_reg += hw->ack_regs ? hw->nr_ack_regs : 0;
 
         d->reg = kzalloc(d->nr_reg * sizeof(*d->reg), GFP_NOWAIT);
+        if (!d->reg)
+                goto err2;
+
 #ifdef CONFIG_SMP
         d->smp = kzalloc(d->nr_reg * sizeof(*d->smp), GFP_NOWAIT);
+        if (!d->smp)
+                goto err3;
 #endif
         k = 0;
 
@@ -843,12 +1006,17 @@ void __init register_intc_controller(struct intc_desc *desc)
                         smp = IS_SMP(hw->mask_regs[i]);
                         k += save_reg(d, k, hw->mask_regs[i].set_reg, smp);
                         k += save_reg(d, k, hw->mask_regs[i].clr_reg, smp);
+#ifdef CONFIG_INTC_BALANCING
+                        k += save_reg(d, k, hw->mask_regs[i].dist_reg, 0);
+#endif
                 }
         }
 
         if (hw->prio_regs) {
                 d->prio = kzalloc(hw->nr_vectors * sizeof(*d->prio),
                                   GFP_NOWAIT);
+                if (!d->prio)
+                        goto err4;
 
                 for (i = 0; i < hw->nr_prio_regs; i++) {
                         smp = IS_SMP(hw->prio_regs[i]);
@@ -860,6 +1028,8 @@ void __init register_intc_controller(struct intc_desc *desc)
         if (hw->sense_regs) {
                 d->sense = kzalloc(hw->nr_vectors * sizeof(*d->sense),
                                    GFP_NOWAIT);
+                if (!d->sense)
+                        goto err5;
 
                 for (i = 0; i < hw->nr_sense_regs; i++)
                         k += save_reg(d, k, hw->sense_regs[i].reg, 0);
@@ -906,7 +1076,7 @@ void __init register_intc_controller(struct intc_desc *desc)
 
                 irq_desc = irq_to_desc_alloc_node(irq, numa_node_id());
                 if (unlikely(!irq_desc)) {
-                        pr_info("can't get irq_desc for %d\n", irq);
+                        pr_err("can't get irq_desc for %d\n", irq);
                         continue;
                 }
 
@@ -926,7 +1096,7 @@ void __init register_intc_controller(struct intc_desc *desc)
                          */
                         irq_desc = irq_to_desc_alloc_node(irq2, numa_node_id());
                         if (unlikely(!irq_desc)) {
-                                pr_info("can't get irq_desc for %d\n", irq2);
+                                pr_err("can't get irq_desc for %d\n", irq2);
                                 continue;
                         }
 
@@ -942,8 +1112,100 @@ void __init register_intc_controller(struct intc_desc *desc)
         /* enable bits matching force_enable after registering irqs */
         if (desc->force_enable)
                 intc_enable_disable_enum(desc, d, desc->force_enable, 1);
+
+        return 0;
+err5:
+        kfree(d->prio);
+err4:
+#ifdef CONFIG_SMP
+        kfree(d->smp);
+err3:
+#endif
+        kfree(d->reg);
+err2:
+        for (k = 0; k < d->nr_windows; k++)
+                if (d->window[k].virt)
+                        iounmap(d->window[k].virt);
+
+        kfree(d->window);
+err1:
+        kfree(d);
+err0:
+        pr_err("unable to allocate INTC memory\n");
+
+        return -ENOMEM;
+}
+
+#ifdef CONFIG_INTC_USERIMASK
+static void __iomem *uimask;
+
+int register_intc_userimask(unsigned long addr)
+{
+        if (unlikely(uimask))
+                return -EBUSY;
+
+        uimask = ioremap_nocache(addr, SZ_4K);
+        if (unlikely(!uimask))
+                return -ENOMEM;
+
+        pr_info("intc: userimask support registered for levels 0 -> %d\n",
+                default_prio_level - 1);
+
+        return 0;
+}
+
+static ssize_t
+show_intc_userimask(struct sysdev_class *cls,
+                    struct sysdev_class_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", (__raw_readl(uimask) >> 4) & 0xf);
+}
+
+static ssize_t
+store_intc_userimask(struct sysdev_class *cls,
+                     struct sysdev_class_attribute *attr,
+                     const char *buf, size_t count)
+{
+        unsigned long level;
+
+        level = simple_strtoul(buf, NULL, 10);
+
+        /*
+         * Minimal acceptable IRQ levels are in the 2 - 16 range, but
+         * these are chomped so as to not interfere with normal IRQs.
+         *
+         * Level 1 is a special case on some CPUs in that it's not
+         * directly settable, but given that USERIMASK cuts off below a
+         * certain level, we don't care about this limitation here.
+         * Level 0 on the other hand equates to user masking disabled.
+         *
+         * We use default_prio_level as a cut off so that only special
+         * case opt-in IRQs can be mangled.
+         */
+        if (level >= default_prio_level)
+                return -EINVAL;
+
+        __raw_writel(0xa5 << 24 | level << 4, uimask);
+
+        return count;
 }
 
+static SYSDEV_CLASS_ATTR(userimask, S_IRUSR | S_IWUSR,
+                         show_intc_userimask, store_intc_userimask);
+#endif
+
+static ssize_t
+show_intc_name(struct sys_device *dev, struct sysdev_attribute *attr, char *buf)
+{
+        struct intc_desc_int *d;
+
+        d = container_of(dev, struct intc_desc_int, sysdev);
+
+        return sprintf(buf, "%s\n", d->chip.name);
+}
+
+static SYSDEV_ATTR(name, S_IRUGO, show_intc_name, NULL);
+
 static int intc_suspend(struct sys_device *dev, pm_message_t state)
 {
         struct intc_desc_int *d;
@@ -1003,19 +1265,28 @@ static int __init register_intc_sysdevs(void)
         int id = 0;
 
         error = sysdev_class_register(&intc_sysdev_class);
+#ifdef CONFIG_INTC_USERIMASK
+        if (!error && uimask)
+                error = sysdev_class_create_file(&intc_sysdev_class,
+                                                 &attr_userimask);
+#endif
         if (!error) {
                 list_for_each_entry(d, &intc_list, list) {
                         d->sysdev.id = id;
                         d->sysdev.cls = &intc_sysdev_class;
                         error = sysdev_register(&d->sysdev);
+                        if (error == 0)
+                                error = sysdev_create_file(&d->sysdev,
+                                                           &attr_name);
                         if (error)
                                 break;
+
                         id++;
                 }
         }
 
         if (error)
-                pr_warning("intc: sysdev registration error\n");
+                pr_err("intc: sysdev registration error\n");
 
         return error;
 }
@@ -1048,7 +1319,7 @@ unsigned int create_irq_nr(unsigned int irq_want, int node)
 
         desc = irq_to_desc_alloc_node(new, node);
         if (unlikely(!desc)) {
-                pr_info("can't get irq_desc for %d\n", new);
+                pr_err("can't get irq_desc for %d\n", new);
                 goto out_unlock;
         }
 
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 36828358a4d8..e76b1afafe07 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -36,8 +36,7 @@
 #include <asm/delay.h>
 
 #include <mach/dma.h>
-#include <mach/regs-ssp.h>
-#include <mach/ssp.h>
+#include <plat/ssp.h>
 #include <mach/pxa2xx_spi.h>
 
 MODULE_AUTHOR("Stephen Street");
@@ -1318,14 +1317,14 @@ static int setup(struct spi_device *spi)
         /* NOTE:  PXA25x_SSP _could_ use external clocking ... */
         if (drv_data->ssp_type != PXA25x_SSP)
                 dev_dbg(&spi->dev, "%ld Hz actual, %s\n",
-                                clk_get_rate(ssp->clk)
-                                        / (1 + ((chip->cr0 & SSCR0_SCR) >> 8)),
-                                chip->enable_dma ? "DMA" : "PIO");
+                        clk_get_rate(ssp->clk)
+                                / (1 + ((chip->cr0 & SSCR0_SCR(0xfff)) >> 8)),
+                        chip->enable_dma ? "DMA" : "PIO");
         else
                 dev_dbg(&spi->dev, "%ld Hz actual, %s\n",
-                                clk_get_rate(ssp->clk) / 2
-                                        / (1 + ((chip->cr0 & SSCR0_SCR) >> 8)),
-                                chip->enable_dma ? "DMA" : "PIO");
+                        clk_get_rate(ssp->clk) / 2
+                                / (1 + ((chip->cr0 & SSCR0_SCR(0x0ff)) >> 8)),
+                        chip->enable_dma ? "DMA" : "PIO");
 
         if (spi->bits_per_word <= 8) {
                 chip->n_bytes = 1;
@@ -1466,7 +1465,7 @@ static int __init pxa2xx_spi_probe(struct platform_device *pdev)
 
         platform_info = dev->platform_data;
 
-        ssp = ssp_request(pdev->id, pdev->name);
+        ssp = pxa_ssp_request(pdev->id, pdev->name);
         if (ssp == NULL) {
                 dev_err(&pdev->dev, "failed to request SSP%d\n", pdev->id);
                 return -ENODEV;
@@ -1476,7 +1475,7 @@ static int __init pxa2xx_spi_probe(struct platform_device *pdev)
         master = spi_alloc_master(dev, sizeof(struct driver_data) + 16);
         if (!master) {
                 dev_err(&pdev->dev, "cannot alloc spi_master\n");
-                ssp_free(ssp);
+                pxa_ssp_free(ssp);
                 return -ENOMEM;
         }
         drv_data = spi_master_get_devdata(master);
@@ -1558,7 +1557,7 @@ static int __init pxa2xx_spi_probe(struct platform_device *pdev)
         write_SSCR1(SSCR1_RxTresh(RX_THRESH_DFLT) |
                                 SSCR1_TxTresh(TX_THRESH_DFLT),
                                 drv_data->ioaddr);
-        write_SSCR0(SSCR0_SerClkDiv(2)
+        write_SSCR0(SSCR0_SCR(2)
                         | SSCR0_Motorola
                         | SSCR0_DataSize(8),
                         drv_data->ioaddr);
@@ -1605,7 +1604,7 @@ out_error_irq_alloc:
 
 out_error_master_alloc:
         spi_master_put(master);
-        ssp_free(ssp);
+        pxa_ssp_free(ssp);
         return status;
 }
 
@@ -1649,7 +1648,7 @@ static int pxa2xx_spi_remove(struct platform_device *pdev)
         free_irq(ssp->irq, drv_data);
 
         /* Release SSP */
-        ssp_free(ssp);
+        pxa_ssp_free(ssp);
 
         /* Disconnect from the SPI framework */
         spi_unregister_master(drv_data->master);
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index 4a6366a42129..111a01a747fc 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -380,6 +380,7 @@ static int usbfs_rmdir(struct inode *dir, struct dentry *dentry)
         mutex_lock(&inode->i_mutex);
         dentry_unhash(dentry);
         if (usbfs_empty(dentry)) {
+                dont_mount(dentry);
                 drop_nlink(dentry->d_inode);
                 drop_nlink(dentry->d_inode);
                 dput(dentry);
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index df1bae9b048e..eaa79c8a9b8c 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -366,6 +366,13 @@ rescan:
         if (is_done)
                 done(ep, req, 0);
         else if (ep->is_pingpong) {
+                /*
+                 * One dummy read to delay the code because of a HW glitch:
+                 * CSR returns bad RXCOUNT when read too soon after updating
+                 * RX_DATA_BK flags.
+                 */
+                csr = __raw_readl(creg);
+
                 bufferspace -= count;
                 buf += count;
                 goto rescan;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index e69d238c5af0..49fa953aaf6e 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1035,7 +1035,12 @@ int vhost_add_used(struct vhost_virtqueue *vq, unsigned int head, int len)
 /* This actually signals the guest, using eventfd. */
 void vhost_signal(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
-        __u16 flags = 0;
+        __u16 flags;
+        /* Flush out used index updates. This is paired
+         * with the barrier that the Guest executes when enabling
+         * interrupts. */
+        smp_mb();
+
         if (get_user(flags, &vq->avail->flags)) {
                 vq_err(vq, "Failed to get flags");
                 return;
diff --git a/drivers/video/amifb.c b/drivers/video/amifb.c
index dca48df98444..e5d6b56d4447 100644
--- a/drivers/video/amifb.c
+++ b/drivers/video/amifb.c
@@ -50,8 +50,9 @@
 #include <linux/fb.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
-
+#include <linux/platform_device.h>
 #include <linux/uaccess.h>
+
 #include <asm/system.h>
 #include <asm/irq.h>
 #include <asm/amigahw.h>
@@ -1135,7 +1136,7 @@ static int amifb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg
          * Interface to the low level console driver
          */
 
-static void amifb_deinit(void);
+static void amifb_deinit(struct platform_device *pdev);
 
         /*
          * Internal routines
@@ -2246,7 +2247,7 @@ static inline void chipfree(void)
          * Initialisation
          */
 
-static int __init amifb_init(void)
+static int __init amifb_probe(struct platform_device *pdev)
 {
         int tag, i, err = 0;
         u_long chipptr;
@@ -2261,16 +2262,6 @@ static int __init amifb_init(void)
         }
         amifb_setup(option);
 #endif
-        if (!MACH_IS_AMIGA || !AMIGAHW_PRESENT(AMI_VIDEO))
-                return -ENODEV;
-
-        /*
-         * We request all registers starting from bplpt[0]
-         */
-        if (!request_mem_region(CUSTOM_PHYSADDR+0xe0, 0x120,
-                                "amifb [Denise/Lisa]"))
-                return -EBUSY;
-
         custom.dmacon = DMAF_ALL | DMAF_MASTER;
 
         switch (amiga_chipset) {
@@ -2377,6 +2368,7 @@ default_chipset:
         fb_info.fbops = &amifb_ops;
         fb_info.par = &currentpar;
         fb_info.flags = FBINFO_DEFAULT;
+        fb_info.device = &pdev->dev;
 
         if (!fb_find_mode(&fb_info.var, &fb_info, mode_option, ami_modedb,
                           NUM_TOTAL_MODES, &ami_modedb[defmode], 4)) {
@@ -2451,18 +2443,18 @@ default_chipset:
         return 0;
 
 amifb_error:
-        amifb_deinit();
+        amifb_deinit(pdev);
         return err;
 }
 
-static void amifb_deinit(void)
+static void amifb_deinit(struct platform_device *pdev)
 {
         if (fb_info.cmap.len)
                 fb_dealloc_cmap(&fb_info.cmap);
+        fb_dealloc_cmap(&fb_info.cmap);
         chipfree();
         if (videomemory)
                 iounmap((void*)videomemory);
-        release_mem_region(CUSTOM_PHYSADDR+0xe0, 0x120);
         custom.dmacon = DMAF_ALL | DMAF_MASTER;
 }
 
@@ -3794,14 +3786,35 @@ static void ami_rebuild_copper(void)
         }
 }
 
-static void __exit amifb_exit(void)
+static int __exit amifb_remove(struct platform_device *pdev)
 {
         unregister_framebuffer(&fb_info);
-        amifb_deinit();
+        amifb_deinit(pdev);
         amifb_video_off();
+        return 0;
+}
+
+static struct platform_driver amifb_driver = {
+        .remove = __exit_p(amifb_remove),
+        .driver   = {
+                .name   = "amiga-video",
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init amifb_init(void)
+{
+        return platform_driver_probe(&amifb_driver, amifb_probe);
 }
 
 module_init(amifb_init);
+
+static void __exit amifb_exit(void)
+{
+        platform_driver_unregister(&amifb_driver);
+}
+
 module_exit(amifb_exit);
 
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:amiga-video");
diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
index 44e49c28b2a7..c2ec3dcd4e91 100644
--- a/drivers/video/bfin-t350mcqb-fb.c
+++ b/drivers/video/bfin-t350mcqb-fb.c
@@ -488,9 +488,9 @@ static int __devinit bfin_t350mcqb_probe(struct platform_device *pdev)
         fbinfo->fbops = &bfin_t350mcqb_fb_ops;
         fbinfo->flags = FBINFO_FLAG_DEFAULT;
 
-        info->fb_buffer =
-            dma_alloc_coherent(NULL, fbinfo->fix.smem_len, &info->dma_handle,
-                               GFP_KERNEL);
+        info->fb_buffer = dma_alloc_coherent(NULL, fbinfo->fix.smem_len +
+                                ACTIVE_VIDEO_MEM_OFFSET,
+                                &info->dma_handle, GFP_KERNEL);
 
         if (NULL == info->fb_buffer) {
                 printk(KERN_ERR DRIVER_NAME
@@ -568,8 +568,8 @@ out7:
 out6:
         fb_dealloc_cmap(&fbinfo->cmap);
 out4:
-        dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
-                          info->dma_handle);
+        dma_free_coherent(NULL, fbinfo->fix.smem_len + ACTIVE_VIDEO_MEM_OFFSET,
+                         info->fb_buffer, info->dma_handle);
 out3:
         framebuffer_release(fbinfo);
 out2:
@@ -592,8 +592,9 @@ static int __devexit bfin_t350mcqb_remove(struct platform_device *pdev)
         free_irq(info->irq, info);
 
         if (info->fb_buffer != NULL)
-                dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
-                                  info->dma_handle);
+                dma_free_coherent(NULL, fbinfo->fix.smem_len +
+                        ACTIVE_VIDEO_MEM_OFFSET, info->fb_buffer,
+                        info->dma_handle);
 
         fb_dealloc_cmap(&fbinfo->cmap);
 
diff --git a/drivers/video/cirrusfb.c b/drivers/video/cirrusfb.c
index 8d8dfda2f868..6df7c54db0a3 100644
--- a/drivers/video/cirrusfb.c
+++ b/drivers/video/cirrusfb.c
@@ -299,6 +299,7 @@ static const struct zorro_device_id cirrusfb_zorro_table[] = {
         },
         { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, cirrusfb_zorro_table);
 
 static const struct {
         zorro_id id2;
diff --git a/drivers/video/fm2fb.c b/drivers/video/fm2fb.c
index 6c91c61cdb63..1b0feb8e7244 100644
--- a/drivers/video/fm2fb.c
+++ b/drivers/video/fm2fb.c
@@ -219,6 +219,7 @@ static struct zorro_device_id fm2fb_devices[] __devinitdata = {
         { ZORRO_PROD_HELFRICH_RAINBOW_II },
         { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, fm2fb_devices);
 
 static struct zorro_driver fm2fb_driver = {
         .name           = "fm2fb",
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 0bf5020d0d32..b87ba23442d2 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -175,7 +175,7 @@ config SA1100_WATCHDOG
 
 config MPCORE_WATCHDOG
         tristate "MPcore watchdog"
-        depends on ARM_MPCORE_PLATFORM && LOCAL_TIMERS
+        depends on HAVE_ARM_TWD
         help
           Watchdog timer embedded into the MPcore system.
 
diff --git a/drivers/watchdog/mpcore_wdt.c b/drivers/watchdog/mpcore_wdt.c
index 016c6a791cab..b8ec7aca3c8e 100644
--- a/drivers/watchdog/mpcore_wdt.c
+++ b/drivers/watchdog/mpcore_wdt.c
@@ -31,8 +31,9 @@
 #include <linux/platform_device.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
+#include <linux/io.h>
 
-#include <asm/hardware/arm_twd.h>
+#include <asm/smp_twd.h>
 
 struct mpcore_wdt {
         unsigned long   timer_alive;
@@ -44,7 +45,7 @@ struct mpcore_wdt {
 };
 
 static struct platform_device *mpcore_wdt_dev;
-extern unsigned int mpcore_timer_rate;
+static DEFINE_SPINLOCK(wdt_lock);
 
 #define TIMER_MARGIN    60
 static int mpcore_margin = TIMER_MARGIN;
@@ -94,13 +95,15 @@ static irqreturn_t mpcore_wdt_fire(int irq, void *arg)
  */
 static void mpcore_wdt_keepalive(struct mpcore_wdt *wdt)
 {
-        unsigned int count;
+        unsigned long count;
 
+        spin_lock(&wdt_lock);
         /* Assume prescale is set to 256 */
-        count = (mpcore_timer_rate / 256) * mpcore_margin;
+        count =  __raw_readl(wdt->base + TWD_WDOG_COUNTER);
+        count = (0xFFFFFFFFU - count) * (HZ / 5);
+        count = (count / 256) * mpcore_margin;
 
         /* Reload the counter */
-        spin_lock(&wdt_lock);
         writel(count + wdt->perturb, wdt->base + TWD_WDOG_LOAD);
         wdt->perturb = wdt->perturb ? 0 : 1;
         spin_unlock(&wdt_lock);
@@ -119,7 +122,6 @@ static void mpcore_wdt_start(struct mpcore_wdt *wdt)
 {
         dev_printk(KERN_INFO, wdt->dev, "enabling watchdog.\n");
 
-        spin_lock(&wdt_lock);
         /* This loads the count register but does NOT start the count yet */
         mpcore_wdt_keepalive(wdt);
 
@@ -130,7 +132,6 @@ static void mpcore_wdt_start(struct mpcore_wdt *wdt)
                 /* Enable watchdog - prescale=256, watchdog mode=1, enable=1 */
                 writel(0x0000FF09, wdt->base + TWD_WDOG_CONTROL);
         }
-        spin_unlock(&wdt_lock);
 }
 
 static int mpcore_wdt_set_heartbeat(int t)
@@ -360,7 +361,7 @@ static int __devinit mpcore_wdt_probe(struct platform_device *dev)
         mpcore_wdt_miscdev.parent = &dev->dev;
         ret = misc_register(&mpcore_wdt_miscdev);
         if (ret) {
-                dev_printk(KERN_ERR, _dev,
+                dev_printk(KERN_ERR, wdt->dev,
                         "cannot register miscdev on minor=%d (err=%d)\n",
                                                         WATCHDOG_MINOR, ret);
                 goto err_misc;
@@ -369,13 +370,13 @@ static int __devinit mpcore_wdt_probe(struct platform_device *dev)
         ret = request_irq(wdt->irq, mpcore_wdt_fire, IRQF_DISABLED,
                                                         "mpcore_wdt", wdt);
         if (ret) {
-                dev_printk(KERN_ERR, _dev,
+                dev_printk(KERN_ERR, wdt->dev,
                         "cannot register IRQ%d for watchdog\n", wdt->irq);
                 goto err_irq;
         }
 
         mpcore_wdt_stop(wdt);
-        platform_set_drvdata(&dev->dev, wdt);
+        platform_set_drvdata(dev, wdt);
         mpcore_wdt_dev = dev;
 
         return 0;
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index 2ac4440e7b08..8943b8ccee1a 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -80,12 +80,6 @@ static void do_suspend(void)
 
         shutting_down = SHUTDOWN_SUSPEND;
 
-        err = stop_machine_create();
-        if (err) {
-                printk(KERN_ERR "xen suspend: failed to setup stop_machine %d\n", err);
-                goto out;
-        }
-
 #ifdef CONFIG_PREEMPT
         /* If the kernel is preemptible, we need to freeze all the processes
            to prevent them from being in the middle of a pagetable update
@@ -93,7 +87,7 @@ static void do_suspend(void)
         err = freeze_processes();
         if (err) {
                 printk(KERN_ERR "xen suspend: freeze failed %d\n", err);
-                goto out_destroy_sm;
+                goto out;
         }
 #endif
 
@@ -136,12 +130,8 @@ out_resume:
 out_thaw:
 #ifdef CONFIG_PREEMPT
         thaw_processes();
-
-out_destroy_sm:
-#endif
-        stop_machine_destroy();
-
 out:
+#endif
         shutting_down = SHUTDOWN_INVALID;
 }
 #endif  /* CONFIG_PM_SLEEP */
diff --git a/drivers/zorro/proc.c b/drivers/zorro/proc.c
index d47c47fc048f..3c7046d79654 100644
--- a/drivers/zorro/proc.c
+++ b/drivers/zorro/proc.c
@@ -97,7 +97,7 @@ static void zorro_seq_stop(struct seq_file *m, void *v)
 
 static int zorro_seq_show(struct seq_file *m, void *v)
 {
-        u_int slot = *(loff_t *)v;
+        unsigned int slot = *(loff_t *)v;
         struct zorro_dev *z = &zorro_autocon[slot];
 
         seq_printf(m, "%02x\t%08x\t%08lx\t%08lx\t%02x\n", slot, z->id,
@@ -129,7 +129,7 @@ static const struct file_operations zorro_devices_proc_fops = {
 
 static struct proc_dir_entry *proc_bus_zorro_dir;
 
-static int __init zorro_proc_attach_device(u_int slot)
+static int __init zorro_proc_attach_device(unsigned int slot)
 {
         struct proc_dir_entry *entry;
         char name[4];
@@ -146,7 +146,7 @@ static int __init zorro_proc_attach_device(u_int slot)
 
 static int __init zorro_proc_init(void)
 {
-        u_int slot;
+        unsigned int slot;
 
         if (MACH_IS_AMIGA && AMIGAHW_PRESENT(ZORRO)) {
                 proc_bus_zorro_dir = proc_mkdir("bus/zorro", NULL);
diff --git a/drivers/zorro/zorro-driver.c b/drivers/zorro/zorro-driver.c
index 53180a37cc9a..7ee2b6e71786 100644
--- a/drivers/zorro/zorro-driver.c
+++ b/drivers/zorro/zorro-driver.c
@@ -137,10 +137,34 @@ static int zorro_bus_match(struct device *dev, struct device_driver *drv)
         return 0;
 }
 
+static int zorro_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+#ifdef CONFIG_HOTPLUG
+        struct zorro_dev *z;
+
+        if (!dev)
+                return -ENODEV;
+
+        z = to_zorro_dev(dev);
+        if (!z)
+                return -ENODEV;
+
+        if (add_uevent_var(env, "ZORRO_ID=%08X", z->id) ||
+            add_uevent_var(env, "ZORRO_SLOT_NAME=%s", dev_name(dev)) ||
+            add_uevent_var(env, "ZORRO_SLOT_ADDR=%04X", z->slotaddr) ||
+            add_uevent_var(env, "MODALIAS=" ZORRO_DEVICE_MODALIAS_FMT, z->id))
+                return -ENOMEM;
+
+        return 0;
+#else /* !CONFIG_HOTPLUG */
+        return -ENODEV;
+#endif /* !CONFIG_HOTPLUG */
+}
 
 struct bus_type zorro_bus_type = {
         .name   = "zorro",
         .match  = zorro_bus_match,
+        .uevent = zorro_uevent,
         .probe  = zorro_device_probe,
         .remove = zorro_device_remove,
 };
diff --git a/drivers/zorro/zorro-sysfs.c b/drivers/zorro/zorro-sysfs.c
index 1d2a772ea14c..eb924e0a64ce 100644
--- a/drivers/zorro/zorro-sysfs.c
+++ b/drivers/zorro/zorro-sysfs.c
@@ -77,6 +77,16 @@ static struct bin_attribute zorro_config_attr = {
         .read = zorro_read_config,
 };
 
+static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
+                             char *buf)
+{
+        struct zorro_dev *z = to_zorro_dev(dev);
+
+        return sprintf(buf, ZORRO_DEVICE_MODALIAS_FMT "\n", z->id);
+}
+
+static DEVICE_ATTR(modalias, S_IRUGO, modalias_show, NULL);
+
 int zorro_create_sysfs_dev_files(struct zorro_dev *z)
 {
         struct device *dev = &z->dev;
@@ -89,6 +99,7 @@ int zorro_create_sysfs_dev_files(struct zorro_dev *z)
             (error = device_create_file(dev, &dev_attr_slotaddr)) ||
             (error = device_create_file(dev, &dev_attr_slotsize)) ||
             (error = device_create_file(dev, &dev_attr_resource)) ||
+            (error = device_create_file(dev, &dev_attr_modalias)) ||
             (error = sysfs_create_bin_file(&dev->kobj, &zorro_config_attr)))
                 return error;
 
diff --git a/drivers/zorro/zorro.c b/drivers/zorro/zorro.c
index d45fb34e2d23..6455f3a244c5 100644
--- a/drivers/zorro/zorro.c
+++ b/drivers/zorro/zorro.c
@@ -15,6 +15,8 @@
 #include <linux/zorro.h>
 #include <linux/bitops.h>
 #include <linux/string.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
 
 #include <asm/setup.h>
 #include <asm/amigahw.h>
@@ -26,24 +28,17 @@
      *  Zorro Expansion Devices
      */
 
-u_int zorro_num_autocon = 0;
+unsigned int zorro_num_autocon;
 struct zorro_dev zorro_autocon[ZORRO_NUM_AUTO];
 
 
     /*
-     *  Single Zorro bus
+     *  Zorro bus
      */
 
-struct zorro_bus zorro_bus = {\
-    .resources = {
-        /* Zorro II regions (on Zorro II/III) */
-        { .name = "Zorro II exp", .start = 0x00e80000, .end = 0x00efffff },
-        { .name = "Zorro II mem", .start = 0x00200000, .end = 0x009fffff },
-        /* Zorro III regions (on Zorro III only) */
-        { .name = "Zorro III exp", .start = 0xff000000, .end = 0xffffffff },
-        { .name = "Zorro III cfg", .start = 0x40000000, .end = 0x7fffffff }
-    },
-    .name = "Zorro bus"
+struct zorro_bus {
+        struct list_head devices;       /* list of devices on this bus */
+        struct device dev;
 };
 
 
@@ -53,18 +48,19 @@ struct zorro_bus zorro_bus = {\
 
 struct zorro_dev *zorro_find_device(zorro_id id, struct zorro_dev *from)
 {
-    struct zorro_dev *z;
+        struct zorro_dev *z;
 
-    if (!MACH_IS_AMIGA || !AMIGAHW_PRESENT(ZORRO))
-        return NULL;
+        if (!zorro_num_autocon)
+                return NULL;
 
-    for (z = from ? from+1 : &zorro_autocon[0];
-         z < zorro_autocon+zorro_num_autocon;
-         z++)
-        if (id == ZORRO_WILDCARD || id == z->id)
-            return z;
-    return NULL;
+        for (z = from ? from+1 : &zorro_autocon[0];
+             z < zorro_autocon+zorro_num_autocon;
+             z++)
+                if (id == ZORRO_WILDCARD || id == z->id)
+                        return z;
+        return NULL;
 }
+EXPORT_SYMBOL(zorro_find_device);
 
 
     /*
@@ -83,121 +79,138 @@ struct zorro_dev *zorro_find_device(zorro_id id, struct zorro_dev *from)
      */
 
 DECLARE_BITMAP(zorro_unused_z2ram, 128);
+EXPORT_SYMBOL(zorro_unused_z2ram);
 
 
 static void __init mark_region(unsigned long start, unsigned long end,
                                int flag)
 {
-    if (flag)
-        start += Z2RAM_CHUNKMASK;
-    else
-        end += Z2RAM_CHUNKMASK;
-    start &= ~Z2RAM_CHUNKMASK;
-    end &= ~Z2RAM_CHUNKMASK;
-
-    if (end <= Z2RAM_START || start >= Z2RAM_END)
-        return;
-    start = start < Z2RAM_START ? 0x00000000 : start-Z2RAM_START;
-    end = end > Z2RAM_END ? Z2RAM_SIZE : end-Z2RAM_START;
-    while (start < end) {
-        u32 chunk = start>>Z2RAM_CHUNKSHIFT;
         if (flag)
-            set_bit(chunk, zorro_unused_z2ram);
+                start += Z2RAM_CHUNKMASK;
         else
-            clear_bit(chunk, zorro_unused_z2ram);
-        start += Z2RAM_CHUNKSIZE;
-    }
+                end += Z2RAM_CHUNKMASK;
+        start &= ~Z2RAM_CHUNKMASK;
+        end &= ~Z2RAM_CHUNKMASK;
+
+        if (end <= Z2RAM_START || start >= Z2RAM_END)
+                return;
+        start = start < Z2RAM_START ? 0x00000000 : start-Z2RAM_START;
+        end = end > Z2RAM_END ? Z2RAM_SIZE : end-Z2RAM_START;
+        while (start < end) {
+                u32 chunk = start>>Z2RAM_CHUNKSHIFT;
+                if (flag)
+                        set_bit(chunk, zorro_unused_z2ram);
+                else
+                        clear_bit(chunk, zorro_unused_z2ram);
+                start += Z2RAM_CHUNKSIZE;
+        }
 }
 
 
-static struct resource __init *zorro_find_parent_resource(struct zorro_dev *z)
+static struct resource __init *zorro_find_parent_resource(
+        struct platform_device *bridge, struct zorro_dev *z)
 {
-    int i;
+        int i;
 
-    for (i = 0; i < zorro_bus.num_resources; i++)
-        if (zorro_resource_start(z) >= zorro_bus.resources[i].start &&
-            zorro_resource_end(z) <= zorro_bus.resources[i].end)
-                return &zorro_bus.resources[i];
-    return &iomem_resource;
+        for (i = 0; i < bridge->num_resources; i++) {
+                struct resource *r = &bridge->resource[i];
+                if (zorro_resource_start(z) >= r->start &&
+                    zorro_resource_end(z) <= r->end)
+                        return r;
+        }
+        return &iomem_resource;
 }
 
 
-    /*
-     *  Initialization
-     */
 
-static int __init zorro_init(void)
+static int __init amiga_zorro_probe(struct platform_device *pdev)
 {
-    struct zorro_dev *z;
-    unsigned int i;
-    int error;
-
-    if (!MACH_IS_AMIGA || !AMIGAHW_PRESENT(ZORRO))
-        return 0;
-
-    pr_info("Zorro: Probing AutoConfig expansion devices: %d device%s\n",
-           zorro_num_autocon, zorro_num_autocon == 1 ? "" : "s");
-
-    /* Initialize the Zorro bus */
-    INIT_LIST_HEAD(&zorro_bus.devices);
-    dev_set_name(&zorro_bus.dev, "zorro");
-    error = device_register(&zorro_bus.dev);
-    if (error) {
-        pr_err("Zorro: Error registering zorro_bus\n");
-        return error;
-    }
-
-    /* Request the resources */
-    zorro_bus.num_resources = AMIGAHW_PRESENT(ZORRO3) ? 4 : 2;
-    for (i = 0; i < zorro_bus.num_resources; i++)
-        request_resource(&iomem_resource, &zorro_bus.resources[i]);
-
-    /* Register all devices */
-    for (i = 0; i < zorro_num_autocon; i++) {
-        z = &zorro_autocon[i];
-        z->id = (z->rom.er_Manufacturer<<16) | (z->rom.er_Product<<8);
-        if (z->id == ZORRO_PROD_GVP_EPC_BASE) {
-            /* GVP quirk */
-            unsigned long magic = zorro_resource_start(z)+0x8000;
-            z->id |= *(u16 *)ZTWO_VADDR(magic) & GVP_PRODMASK;
-        }
-        sprintf(z->name, "Zorro device %08x", z->id);
-        zorro_name_device(z);
-        z->resource.name = z->name;
-        if (request_resource(zorro_find_parent_resource(z), &z->resource))
-            pr_err("Zorro: Address space collision on device %s %pR\n",
-                   z->name, &z->resource);
-        dev_set_name(&z->dev, "%02x", i);
-        z->dev.parent = &zorro_bus.dev;
-        z->dev.bus = &zorro_bus_type;
-        error = device_register(&z->dev);
+        struct zorro_bus *bus;
+        struct zorro_dev *z;
+        struct resource *r;
+        unsigned int i;
+        int error;
+
+        /* Initialize the Zorro bus */
+        bus = kzalloc(sizeof(*bus), GFP_KERNEL);
+        if (!bus)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&bus->devices);
+        bus->dev.parent = &pdev->dev;
+        dev_set_name(&bus->dev, "zorro");
+        error = device_register(&bus->dev);
         if (error) {
-            pr_err("Zorro: Error registering device %s\n", z->name);
-            continue;
+                pr_err("Zorro: Error registering zorro_bus\n");
+                kfree(bus);
+                return error;
         }
-        error = zorro_create_sysfs_dev_files(z);
-        if (error)
-            dev_err(&z->dev, "Error creating sysfs files\n");
-    }
-
-    /* Mark all available Zorro II memory */
-    zorro_for_each_dev(z) {
-        if (z->rom.er_Type & ERTF_MEMLIST)
-            mark_region(zorro_resource_start(z), zorro_resource_end(z)+1, 1);
-    }
-
-    /* Unmark all used Zorro II memory */
-    for (i = 0; i < m68k_num_memory; i++)
-        if (m68k_memory[i].addr < 16*1024*1024)
-            mark_region(m68k_memory[i].addr,
-                        m68k_memory[i].addr+m68k_memory[i].size, 0);
-
-    return 0;
+        platform_set_drvdata(pdev, bus);
+
+        /* Register all devices */
+        pr_info("Zorro: Probing AutoConfig expansion devices: %u device%s\n",
+                 zorro_num_autocon, zorro_num_autocon == 1 ? "" : "s");
+
+        for (i = 0; i < zorro_num_autocon; i++) {
+                z = &zorro_autocon[i];
+                z->id = (z->rom.er_Manufacturer<<16) | (z->rom.er_Product<<8);
+                if (z->id == ZORRO_PROD_GVP_EPC_BASE) {
+                        /* GVP quirk */
+                        unsigned long magic = zorro_resource_start(z)+0x8000;
+                        z->id |= *(u16 *)ZTWO_VADDR(magic) & GVP_PRODMASK;
+                }
+                sprintf(z->name, "Zorro device %08x", z->id);
+                zorro_name_device(z);
+                z->resource.name = z->name;
+                r = zorro_find_parent_resource(pdev, z);
+                error = request_resource(r, &z->resource);
+                if (error)
+                        dev_err(&bus->dev,
+                                "Address space collision on device %s %pR\n",
+                                z->name, &z->resource);
+                dev_set_name(&z->dev, "%02x", i);
+                z->dev.parent = &bus->dev;
+                z->dev.bus = &zorro_bus_type;
+                error = device_register(&z->dev);
+                if (error) {
+                        dev_err(&bus->dev, "Error registering device %s\n",
+                                z->name);
+                        continue;
+                }
+                error = zorro_create_sysfs_dev_files(z);
+                if (error)
+                        dev_err(&z->dev, "Error creating sysfs files\n");
+        }
+
+        /* Mark all available Zorro II memory */
+        zorro_for_each_dev(z) {
+                if (z->rom.er_Type & ERTF_MEMLIST)
+                        mark_region(zorro_resource_start(z),
+                                    zorro_resource_end(z)+1, 1);
+        }
+
+        /* Unmark all used Zorro II memory */
+        for (i = 0; i < m68k_num_memory; i++)
+                if (m68k_memory[i].addr < 16*1024*1024)
+                        mark_region(m68k_memory[i].addr,
+                                    m68k_memory[i].addr+m68k_memory[i].size,
+                                    0);
+
+        return 0;
 }
 
-subsys_initcall(zorro_init);
+static struct platform_driver amiga_zorro_driver = {
+        .driver   = {
+                .name   = "amiga-zorro",
+                .owner  = THIS_MODULE,
+        },
+};
 
-EXPORT_SYMBOL(zorro_find_device);
-EXPORT_SYMBOL(zorro_unused_z2ram);
+static int __init amiga_zorro_init(void)
+{
+        return platform_driver_probe(&amiga_zorro_driver, amiga_zorro_probe);
+}
+
+module_init(amiga_zorro_init);
 
 MODULE_LICENSE("GPL");