Merge commit 'v2.6.30' into next

288 files changed, 11827 insertions, 1133 deletions

diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile
index 17e50824a6f..72ac28da14e 100644
--- a/drivers/acpi/acpica/Makefile
+++ b/drivers/acpi/acpica/Makefile
@@ -5,40 +5,43 @@
 ccflags-y                       := -Os
 ccflags-$(CONFIG_ACPI_DEBUG)    += -DACPI_DEBUG_OUTPUT
 
-obj-y := dsfield.o   dsmthdat.o  dsopcode.o  dswexec.o  dswscope.o \
+# use acpi.o to put all files here into acpi.o modparam namespace
+obj-y   += acpi.o
+
+acpi-y := dsfield.o   dsmthdat.o  dsopcode.o  dswexec.o  dswscope.o \
          dsmethod.o  dsobject.o  dsutils.o   dswload.o  dswstate.o \
          dsinit.o
 
-obj-y += evevent.o  evregion.o  evsci.o    evxfevnt.o \
+acpi-y += evevent.o  evregion.o  evsci.o    evxfevnt.o \
          evmisc.o   evrgnini.o  evxface.o  evxfregn.o \
          evgpe.o    evgpeblk.o
 
-obj-y += exconfig.o  exfield.o  exnames.o   exoparg6.o  exresolv.o  exstorob.o\
+acpi-y += exconfig.o  exfield.o  exnames.o   exoparg6.o  exresolv.o  exstorob.o\
          exconvrt.o  exfldio.o  exoparg1.o  exprep.o    exresop.o   exsystem.o\
          excreate.o  exmisc.o   exoparg2.o  exregion.o  exstore.o   exutils.o \
          exdump.o    exmutex.o  exoparg3.o  exresnte.o  exstoren.o
 
-obj-y += hwacpi.o  hwgpe.o  hwregs.o  hwsleep.o hwxface.o hwvalid.o
+acpi-y += hwacpi.o  hwgpe.o  hwregs.o  hwsleep.o hwxface.o hwvalid.o
 
-obj-$(ACPI_FUTURE_USAGE) += hwtimer.o
+acpi-$(ACPI_FUTURE_USAGE) += hwtimer.o
 
-obj-y += nsaccess.o  nsload.o    nssearch.o  nsxfeval.o \
+acpi-y += nsaccess.o  nsload.o    nssearch.o  nsxfeval.o \
          nsalloc.o   nseval.o    nsnames.o   nsutils.o   nsxfname.o \
          nsdump.o    nsinit.o    nsobject.o  nswalk.o    nsxfobj.o  \
          nsparse.o   nspredef.o
 
-obj-$(ACPI_FUTURE_USAGE) += nsdumpdv.o
+acpi-$(ACPI_FUTURE_USAGE) += nsdumpdv.o
 
-obj-y += psargs.o    psparse.o  psloop.o pstree.o   pswalk.o  \
+acpi-y += psargs.o    psparse.o  psloop.o pstree.o   pswalk.o  \
          psopcode.o  psscope.o  psutils.o  psxface.o
 
-obj-y += rsaddr.o rscreate.o rsinfo.o rsio.o rslist.o rsmisc.o rsxface.o \
+acpi-y += rsaddr.o rscreate.o rsinfo.o rsio.o rslist.o rsmisc.o rsxface.o \
          rscalc.o  rsirq.o  rsmemory.o  rsutils.o
 
-obj-$(ACPI_FUTURE_USAGE) += rsdump.o
+acpi-$(ACPI_FUTURE_USAGE) += rsdump.o
 
-obj-y += tbxface.o tbinstal.o tbutils.o tbfind.o tbfadt.o tbxfroot.o
+acpi-y += tbxface.o tbinstal.o tbutils.o tbfind.o tbfadt.o tbxfroot.o
 
-obj-y += utalloc.o utdebug.o uteval.o utinit.o utmisc.o utxface.o \
+acpi-y += utalloc.o utdebug.o uteval.o utinit.o utmisc.o utxface.o \
                 utcopy.o utdelete.o utglobal.o utmath.o utobject.o \
                 utstate.o utmutex.o utobject.o utresrc.o utlock.o
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index 772ee5c4ccc..2ec394a328e 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -787,7 +787,12 @@ struct acpi_bit_register_info {
 
 /* For control registers, both ignored and reserved bits must be preserved */
 
-#define ACPI_PM1_CONTROL_IGNORED_BITS           0x0201  /* Bits 9, 0(SCI_EN) */
+/*
+ * The ACPI spec says to ignore PM1_CTL.SCI_EN (bit 0)
+ * but we need to be able to write ACPI_BITREG_SCI_ENABLE directly
+ * as a BIOS workaround on some machines.
+ */
+#define ACPI_PM1_CONTROL_IGNORED_BITS           0x0200  /* Bits 9 */
 #define ACPI_PM1_CONTROL_RESERVED_BITS          0xC1F8  /* Bits 14-15, 3-8 */
 #define ACPI_PM1_CONTROL_PRESERVED_BITS \
                (ACPI_PM1_CONTROL_IGNORED_BITS | ACPI_PM1_CONTROL_RESERVED_BITS)
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index e8f7b64e92d..ae862f1798d 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -312,7 +312,7 @@ int acpi_bus_set_power(acpi_handle handle, int state)
       end:
         if (result)
                 printk(KERN_WARNING PREFIX
-                              "Transitioning device [%s] to D%d\n",
+                              "Device [%s] failed to transition to D%d\n",
                               device->pnp.bus_id, state);
         else {
                 device->power.state = state;
diff --git a/drivers/acpi/pci_bind.c b/drivers/acpi/pci_bind.c
index 95650f83ce2..bc46de3d967 100644
--- a/drivers/acpi/pci_bind.c
+++ b/drivers/acpi/pci_bind.c
@@ -116,9 +116,6 @@ int acpi_pci_bind(struct acpi_device *device)
         struct acpi_pci_data *pdata;
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
         acpi_handle handle;
-        struct pci_dev *dev;
-        struct pci_bus *bus;
-
 
         if (!device || !device->parent)
                 return -EINVAL;
@@ -176,20 +173,9 @@ int acpi_pci_bind(struct acpi_device *device)
          * Locate matching device in PCI namespace.  If it doesn't exist
          * this typically means that the device isn't currently inserted
          * (e.g. docking station, port replicator, etc.).
-         * We cannot simply search the global pci device list, since
-         * PCI devices are added to the global pci list when the root
-         * bridge start ops are run, which may not have happened yet.
          */
-        bus = pci_find_bus(data->id.segment, data->id.bus);
-        if (bus) {
-                list_for_each_entry(dev, &bus->devices, bus_list) {
-                        if (dev->devfn == PCI_DEVFN(data->id.device,
-                                                    data->id.function)) {
-                                data->dev = dev;
-                                break;
-                        }
-                }
-        }
+        data->dev = pci_get_slot(pdata->bus,
+                                PCI_DEVFN(data->id.device, data->id.function));
         if (!data->dev) {
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                   "Device %04x:%02x:%02x.%d not present in PCI namespace\n",
@@ -259,9 +245,10 @@ int acpi_pci_bind(struct acpi_device *device)
 
       end:
         kfree(buffer.pointer);
-        if (result)
+        if (result) {
+                pci_dev_put(data->dev);
                 kfree(data);
-
+        }
         return result;
 }
 
@@ -303,6 +290,7 @@ static int acpi_pci_unbind(struct acpi_device *device)
         if (data->dev->subordinate) {
                 acpi_pci_irq_del_prt(data->id.segment, data->bus->number);
         }
+        pci_dev_put(data->dev);
         kfree(data);
 
       end:
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 45ad3288c5f..23f0fb84f1c 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -844,7 +844,7 @@ static int acpi_processor_add(struct acpi_device *device)
         if (!pr)
                 return -ENOMEM;
 
-        if (!alloc_cpumask_var(&pr->throttling.shared_cpu_map, GFP_KERNEL)) {
+        if (!zalloc_cpumask_var(&pr->throttling.shared_cpu_map, GFP_KERNEL)) {
                 kfree(pr);
                 return -ENOMEM;
         }
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index f7ca8c55956..10a2d913635 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -148,6 +148,9 @@ static void acpi_timer_check_state(int state, struct acpi_processor *pr,
         if (cpu_has(&cpu_data(pr->id), X86_FEATURE_ARAT))
                 return;
 
+        if (boot_cpu_has(X86_FEATURE_AMDC1E))
+                type = ACPI_STATE_C1;
+
         /*
          * Check, if one of the previous states already marked the lapic
          * unstable
@@ -202,21 +205,44 @@ static void acpi_state_timer_broadcast(struct acpi_processor *pr,
  * Suspend / resume control
  */
 static int acpi_idle_suspend;
+static u32 saved_bm_rld;
+
+static void acpi_idle_bm_rld_save(void)
+{
+        acpi_read_bit_register(ACPI_BITREG_BUS_MASTER_RLD, &saved_bm_rld);
+}
+static void acpi_idle_bm_rld_restore(void)
+{
+        u32 resumed_bm_rld;
+
+        acpi_read_bit_register(ACPI_BITREG_BUS_MASTER_RLD, &resumed_bm_rld);
+
+        if (resumed_bm_rld != saved_bm_rld)
+                acpi_write_bit_register(ACPI_BITREG_BUS_MASTER_RLD, saved_bm_rld);
+}
 
 int acpi_processor_suspend(struct acpi_device * device, pm_message_t state)
 {
+        if (acpi_idle_suspend == 1)
+                return 0;
+
+        acpi_idle_bm_rld_save();
         acpi_idle_suspend = 1;
         return 0;
 }
 
 int acpi_processor_resume(struct acpi_device * device)
 {
+        if (acpi_idle_suspend == 0)
+                return 0;
+
+        acpi_idle_bm_rld_restore();
         acpi_idle_suspend = 0;
         return 0;
 }
 
 #if defined (CONFIG_GENERIC_TIME) && defined (CONFIG_X86)
-static int tsc_halts_in_c(int state)
+static void tsc_check_state(int state)
 {
         switch (boot_cpu_data.x86_vendor) {
         case X86_VENDOR_AMD:
@@ -226,13 +252,17 @@ static int tsc_halts_in_c(int state)
                  * C/P/S0/S1 states when this bit is set.
                  */
                 if (boot_cpu_has(X86_FEATURE_NONSTOP_TSC))
-                        return 0;
+                        return;
 
                 /*FALL THROUGH*/
         default:
-                return state > ACPI_STATE_C1;
+                /* TSC could halt in idle, so notify users */
+                if (state > ACPI_STATE_C1)
+                        mark_tsc_unstable("TSC halts in idle");
         }
 }
+#else
+static void tsc_check_state(int state) { return; }
 #endif
 
 static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
@@ -578,17 +608,13 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
 
         pr->power.timer_broadcast_on_state = INT_MAX;
 
-        for (i = 1; i < ACPI_PROCESSOR_MAX_POWER; i++) {
+        for (i = 1; i < ACPI_PROCESSOR_MAX_POWER && i <= max_cstate; i++) {
                 struct acpi_processor_cx *cx = &pr->power.states[i];
 
-#if defined (CONFIG_GENERIC_TIME) && defined (CONFIG_X86)
-                /* TSC could halt in idle, so notify users */
-                if (tsc_halts_in_c(cx->type))
-                        mark_tsc_unstable("TSC halts in idle");;
-#endif
                 switch (cx->type) {
                 case ACPI_STATE_C1:
                         cx->valid = 1;
+                        acpi_timer_check_state(i, pr, cx);
                         break;
 
                 case ACPI_STATE_C2:
@@ -603,6 +629,8 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
                                 acpi_timer_check_state(i, pr, cx);
                         break;
                 }
+                if (cx->valid)
+                        tsc_check_state(cx->type);
 
                 if (cx->valid)
                         working++;
@@ -806,11 +834,12 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
 
         /* Do not access any ACPI IO ports in suspend path */
         if (acpi_idle_suspend) {
-                acpi_safe_halt();
                 local_irq_enable();
+                cpu_relax();
                 return 0;
         }
 
+        acpi_state_timer_broadcast(pr, cx, 1);
         kt1 = ktime_get_real();
         acpi_idle_do_entry(cx);
         kt2 = ktime_get_real();
@@ -818,6 +847,7 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
 
         local_irq_enable();
         cx->usage++;
+        acpi_state_timer_broadcast(pr, cx, 0);
 
         return idle_time;
 }
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index cafb41000f6..60e543d3234 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -309,9 +309,15 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
                                   (u32) px->bus_master_latency,
                                   (u32) px->control, (u32) px->status));
 
-                if (!px->core_frequency) {
-                        printk(KERN_ERR PREFIX
-                                    "Invalid _PSS data: freq is zero\n");
+                /*
+                 * Check that ACPI's u64 MHz will be valid as u32 KHz in cpufreq
+                 */
+                if (!px->core_frequency ||
+                    ((u32)(px->core_frequency * 1000) !=
+                     (px->core_frequency * 1000))) {
+                        printk(KERN_ERR FW_BUG PREFIX
+                               "Invalid BIOS _PSS frequency: 0x%llx MHz\n",
+                               px->core_frequency);
                         result = -EFAULT;
                         kfree(pr->performance->states);
                         goto end;
diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
index d0d1f4d5043..227543789ba 100644
--- a/drivers/acpi/processor_throttling.c
+++ b/drivers/acpi/processor_throttling.c
@@ -45,6 +45,14 @@
 #define _COMPONENT              ACPI_PROCESSOR_COMPONENT
 ACPI_MODULE_NAME("processor_throttling");
 
+/* ignore_tpc:
+ *  0 -> acpi processor driver doesn't ignore _TPC values
+ *  1 -> acpi processor driver ignores _TPC values
+ */
+static int ignore_tpc;
+module_param(ignore_tpc, int, 0644);
+MODULE_PARM_DESC(ignore_tpc, "Disable broken BIOS _TPC throttling support");
+
 struct throttling_tstate {
         unsigned int cpu;               /* cpu nr */
         int target_state;               /* target T-state */
@@ -283,6 +291,10 @@ static int acpi_processor_get_platform_limit(struct acpi_processor *pr)
 
         if (!pr)
                 return -EINVAL;
+
+        if (ignore_tpc)
+                goto end;
+
         status = acpi_evaluate_integer(pr->handle, "_TPC", NULL, &tpc);
         if (ACPI_FAILURE(status)) {
                 if (status != AE_NOT_FOUND) {
@@ -290,6 +302,8 @@ static int acpi_processor_get_platform_limit(struct acpi_processor *pr)
                 }
                 return -ENODEV;
         }
+
+end:
         pr->throttling_platform_limit = (int)tpc;
         return 0;
 }
@@ -302,6 +316,9 @@ int acpi_processor_tstate_has_changed(struct acpi_processor *pr)
         struct acpi_processor_limit *limit;
         int target_state;
 
+        if (ignore_tpc)
+                return 0;
+
         result = acpi_processor_get_platform_limit(pr);
         if (result) {
                 /* Throttling Limit is unsupported */
@@ -821,6 +838,14 @@ static int acpi_processor_get_throttling_ptc(struct acpi_processor *pr)
         ret = acpi_read_throttling_status(pr, &value);
         if (ret >= 0) {
                 state = acpi_get_throttling_state(pr, value);
+                if (state == -1) {
+                        ACPI_WARNING((AE_INFO,
+                                "Invalid throttling state, reset"));
+                        state = 0;
+                        ret = acpi_processor_set_throttling(pr, state);
+                        if (ret)
+                                return ret;
+                }
                 pr->throttling.state = state;
         }
 
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index d7ff61c0d57..1bdfb37377e 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -538,6 +538,57 @@ acpi_video_device_lcd_set_level(struct acpi_video_device *device, int level)
         return -EINVAL;
 }
 
+/*
+ * For some buggy _BQC methods, we need to add a constant value to
+ * the _BQC return value to get the actual current brightness level
+ */
+
+static int bqc_offset_aml_bug_workaround;
+static int __init video_set_bqc_offset(const struct dmi_system_id *d)
+{
+        bqc_offset_aml_bug_workaround = 9;
+        return 0;
+}
+
+static struct dmi_system_id video_dmi_table[] __initdata = {
+        /*
+         * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
+         */
+        {
+         .callback = video_set_bqc_offset,
+         .ident = "Acer Aspire 5720",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5720"),
+                },
+        },
+        {
+         .callback = video_set_bqc_offset,
+         .ident = "Acer Aspire 5710Z",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5710Z"),
+                },
+        },
+        {
+         .callback = video_set_bqc_offset,
+         .ident = "eMachines E510",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "EMACHINES"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "eMachines E510"),
+                },
+        },
+        {
+         .callback = video_set_bqc_offset,
+         .ident = "Acer Aspire 5315",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5315"),
+                },
+        },
+        {}
+};
+
 static int
 acpi_video_device_lcd_get_level_current(struct acpi_video_device *device,
                                         unsigned long long *level)
@@ -557,6 +608,7 @@ acpi_video_device_lcd_get_level_current(struct acpi_video_device *device,
                                 *level = device->brightness->levels[*level + 2];
 
                         }
+                        *level += bqc_offset_aml_bug_workaround;
                         device->brightness->curr = *level;
                         return 0;
                 } else {
@@ -2290,13 +2342,15 @@ EXPORT_SYMBOL(acpi_video_register);
 
 static int __init acpi_video_init(void)
 {
+        dmi_check_system(video_dmi_table);
+
         if (intel_opregion_present())
                 return 0;
 
         return acpi_video_register();
 }
 
-void __exit acpi_video_exit(void)
+void acpi_video_exit(void)
 {
 
         acpi_bus_unregister_driver(&acpi_video_bus);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 08186ecbaf8..6b91c26a463 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -220,6 +220,7 @@ enum {
         AHCI_HFLAG_NO_HOTPLUG           = (1 << 7), /* ignore PxSERR.DIAG.N */
         AHCI_HFLAG_SECT255              = (1 << 8), /* max 255 sectors */
         AHCI_HFLAG_YES_NCQ              = (1 << 9), /* force NCQ cap on */
+        AHCI_HFLAG_NO_SUSPEND           = (1 << 10), /* don't suspend */
 
         /* ap->flags bits */
 
@@ -2316,9 +2317,17 @@ static int ahci_port_suspend(struct ata_port *ap, pm_message_t mesg)
 static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg)
 {
         struct ata_host *host = dev_get_drvdata(&pdev->dev);
+        struct ahci_host_priv *hpriv = host->private_data;
         void __iomem *mmio = host->iomap[AHCI_PCI_BAR];
         u32 ctl;
 
+        if (mesg.event & PM_EVENT_SUSPEND &&
+            hpriv->flags & AHCI_HFLAG_NO_SUSPEND) {
+                dev_printk(KERN_ERR, &pdev->dev,
+                           "BIOS update required for suspend/resume\n");
+                return -EIO;
+        }
+
         if (mesg.event & PM_EVENT_SLEEP) {
                 /* AHCI spec rev1.1 section 8.3.3:
                  * Software must disable interrupts prior to requesting a
@@ -2610,6 +2619,63 @@ static bool ahci_broken_system_poweroff(struct pci_dev *pdev)
         return false;
 }
 
+static bool ahci_broken_suspend(struct pci_dev *pdev)
+{
+        static const struct dmi_system_id sysids[] = {
+                /*
+                 * On HP dv[4-6] and HDX18 with earlier BIOSen, link
+                 * to the harddisk doesn't become online after
+                 * resuming from STR.  Warn and fail suspend.
+                 */
+                {
+                        .ident = "dv4",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                                DMI_MATCH(DMI_PRODUCT_NAME,
+                                          "HP Pavilion dv4 Notebook PC"),
+                        },
+                        .driver_data = "F.30", /* cutoff BIOS version */
+                },
+                {
+                        .ident = "dv5",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                                DMI_MATCH(DMI_PRODUCT_NAME,
+                                          "HP Pavilion dv5 Notebook PC"),
+                        },
+                        .driver_data = "F.16", /* cutoff BIOS version */
+                },
+                {
+                        .ident = "dv6",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                                DMI_MATCH(DMI_PRODUCT_NAME,
+                                          "HP Pavilion dv6 Notebook PC"),
+                        },
+                        .driver_data = "F.21",  /* cutoff BIOS version */
+                },
+                {
+                        .ident = "HDX18",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                                DMI_MATCH(DMI_PRODUCT_NAME,
+                                          "HP HDX18 Notebook PC"),
+                        },
+                        .driver_data = "F.23",  /* cutoff BIOS version */
+                },
+                { }     /* terminate list */
+        };
+        const struct dmi_system_id *dmi = dmi_first_match(sysids);
+        const char *ver;
+
+        if (!dmi || pdev->bus->number || pdev->devfn != PCI_DEVFN(0x1f, 2))
+                return false;
+
+        ver = dmi_get_system_info(DMI_BIOS_VERSION);
+
+        return !ver || strcmp(ver, dmi->driver_data) < 0;
+}
+
 static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         static int printed_version;
@@ -2715,6 +2781,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                         "quirky BIOS, skipping spindown on poweroff\n");
         }
 
+        if (ahci_broken_suspend(pdev)) {
+                hpriv->flags |= AHCI_HFLAG_NO_SUSPEND;
+                dev_printk(KERN_WARNING, &pdev->dev,
+                           "BIOS update required for suspend/resume\n");
+        }
+
         /* CAP.NP sometimes indicate the index of the last enabled
          * port, at other times, that of the last possible port, so
          * determining the maximum port number requires looking at
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 942d14ac879..1aeb7082b0c 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -72,6 +72,7 @@
  *      ICH2    spec c #20      - IDE PRD must not cross a 64K boundary
  *                                and must be dword aligned
  *      ICH2    spec c #24      - UDMA mode 4,5 t85/86 should be 6ns not 3.3
+ *      ICH7    errata #16      - MWDMA1 timings are incorrect
  *
  * Should have been BIOS fixed:
  *      450NX:  errata #19      - DMA hangs on old 450NX
@@ -94,7 +95,7 @@
 #include <linux/dmi.h>
 
 #define DRV_NAME        "ata_piix"
-#define DRV_VERSION     "2.12"
+#define DRV_VERSION     "2.13"
 
 enum {
         PIIX_IOCFG              = 0x54, /* IDE I/O configuration register */
@@ -136,6 +137,7 @@ enum piix_controller_ids {
         ich_pata_33,            /* ICH up to UDMA 33 only */
         ich_pata_66,            /* ICH up to 66 Mhz */
         ich_pata_100,           /* ICH up to UDMA 100 */
+        ich_pata_100_nomwdma1,  /* ICH up to UDMA 100 but with no MWDMA1*/
         ich5_sata,
         ich6_sata,
         ich6m_sata,
@@ -216,8 +218,8 @@ static const struct pci_device_id piix_pci_tbl[] = {
         /* ICH6 (and 6) (i915) UDMA 100 */
         { 0x8086, 0x266F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
         /* ICH7/7-R (i945, i975) UDMA 100*/
-        { 0x8086, 0x27DF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
-        { 0x8086, 0x269E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
+        { 0x8086, 0x27DF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100_nomwdma1 },
+        { 0x8086, 0x269E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100_nomwdma1 },
         /* ICH8 Mobile PATA Controller */
         { 0x8086, 0x2850, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
 
@@ -487,6 +489,15 @@ static struct ata_port_info piix_port_info[] = {
                 .port_ops       = &ich_pata_ops,
         },
 
+        [ich_pata_100_nomwdma1] =
+        {
+                .flags          = PIIX_PATA_FLAGS | PIIX_FLAG_CHECKINTR,
+                .pio_mask       = ATA_PIO4,
+                .mwdma_mask     = ATA_MWDMA2_ONLY,
+                .udma_mask      = ATA_UDMA5,
+                .port_ops       = &ich_pata_ops,
+        },
+
         [ich5_sata] =
         {
                 .flags          = PIIX_SATA_FLAGS,
@@ -594,6 +605,7 @@ static const struct ich_laptop ich_laptop[] = {
         { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
         { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
         { 0x2653, 0x1043, 0x82D8 },     /* ICH6M on Asus Eee 701 */
+        { 0x27df, 0x104d, 0x900e },     /* ICH7 on Sony TZ-90 */
         /* end marker */
         { 0, }
 };
@@ -1443,6 +1455,15 @@ static bool piix_broken_system_poweroff(struct pci_dev *pdev)
                         /* PCI slot number of the controller */
                         .driver_data = (void *)0x1FUL,
                 },
+                {
+                        .ident = "HP Compaq nc6000",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq nc6000"),
+                        },
+                        /* PCI slot number of the controller */
+                        .driver_data = (void *)0x1FUL,
+                },
 
                 { }     /* terminate list */
         };
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 17c5d48a75d..c9242301cfa 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4091,7 +4091,9 @@ int ata_dev_revalidate(struct ata_device *dev, unsigned int new_class,
 
         /* fail early if !ATA && !ATAPI to avoid issuing [P]IDENTIFY to PMP */
         if (ata_class_enabled(new_class) &&
-            new_class != ATA_DEV_ATA && new_class != ATA_DEV_ATAPI) {
+            new_class != ATA_DEV_ATA &&
+            new_class != ATA_DEV_ATAPI &&
+            new_class != ATA_DEV_SEMB) {
                 ata_dev_printk(dev, KERN_INFO, "class mismatch %u != %u\n",
                                dev->class, new_class);
                 rc = -ENODEV;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 01831312c36..94919ad03df 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2783,6 +2783,12 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                 } else if (dev->class == ATA_DEV_UNKNOWN &&
                            ehc->tries[dev->devno] &&
                            ata_class_enabled(ehc->classes[dev->devno])) {
+                        /* Temporarily set dev->class, it will be
+                         * permanently set once all configurations are
+                         * complete.  This is necessary because new
+                         * device configuration is done in two
+                         * separate loops.
+                         */
                         dev->class = ehc->classes[dev->devno];
 
                         if (dev->class == ATA_DEV_PMP)
@@ -2790,6 +2796,11 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                         else
                                 rc = ata_dev_read_id(dev, &dev->class,
                                                      readid_flags, dev->id);
+
+                        /* read_id might have changed class, store and reset */
+                        ehc->classes[dev->devno] = dev->class;
+                        dev->class = ATA_DEV_UNKNOWN;
+
                         switch (rc) {
                         case 0:
                                 /* clear error info accumulated during probe */
@@ -2799,13 +2810,11 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                         case -ENOENT:
                                 /* IDENTIFY was issued to non-existent
                                  * device.  No need to reset.  Just
-                                 * thaw and kill the device.
+                                 * thaw and ignore the device.
                                  */
                                 ata_eh_thaw_port(ap);
-                                dev->class = ATA_DEV_UNKNOWN;
                                 break;
                         default:
-                                dev->class = ATA_DEV_UNKNOWN;
                                 goto err;
                         }
                 }
@@ -2826,11 +2835,15 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                     dev->class == ATA_DEV_PMP)
                         continue;
 
+                dev->class = ehc->classes[dev->devno];
+
                 ehc->i.flags |= ATA_EHI_PRINTINFO;
                 rc = ata_dev_configure(dev);
                 ehc->i.flags &= ~ATA_EHI_PRINTINFO;
-                if (rc)
+                if (rc) {
+                        dev->class = ATA_DEV_UNKNOWN;
                         goto err;
+                }
 
                 spin_lock_irqsave(ap->lock, flags);
                 ap->pflags |= ATA_PFLAG_SCSI_HOTPLUG;
@@ -3494,6 +3507,8 @@ static void ata_eh_handle_port_suspend(struct ata_port *ap)
  */
 static void ata_eh_handle_port_resume(struct ata_port *ap)
 {
+        struct ata_link *link;
+        struct ata_device *dev;
         unsigned long flags;
         int rc = 0;
 
@@ -3508,6 +3523,17 @@ static void ata_eh_handle_port_resume(struct ata_port *ap)
 
         WARN_ON(!(ap->pflags & ATA_PFLAG_SUSPENDED));
 
+        /*
+         * Error timestamps are in jiffies which doesn't run while
+         * suspended and PHY events during resume isn't too uncommon.
+         * When the two are combined, it can lead to unnecessary speed
+         * downs if the machine is suspended and resumed repeatedly.
+         * Clear error history.
+         */
+        ata_for_each_link(link, ap, HOST_FIRST)
+                ata_for_each_dev(dev, link, ALL)
+                        ata_ering_clear(&dev->ering);
+
         ata_acpi_set_state(ap, PMSG_ON);
 
         if (ap->ops->port_resume)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 2733b0c90b7..342316064e9 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -313,7 +313,7 @@ ata_scsi_em_message_show(struct device *dev, struct device_attribute *attr,
                 return ap->ops->em_show(ap, buf);
         return -EINVAL;
 }
-DEVICE_ATTR(em_message, S_IRUGO | S_IWUGO,
+DEVICE_ATTR(em_message, S_IRUGO | S_IWUSR,
                 ata_scsi_em_message_show, ata_scsi_em_message_store);
 EXPORT_SYMBOL_GPL(dev_attr_em_message);
 
@@ -366,7 +366,7 @@ ata_scsi_activity_store(struct device *dev, struct device_attribute *attr,
         }
         return -EINVAL;
 }
-DEVICE_ATTR(sw_activity, S_IWUGO | S_IRUGO, ata_scsi_activity_show,
+DEVICE_ATTR(sw_activity, S_IWUSR | S_IRUGO, ata_scsi_activity_show,
                         ata_scsi_activity_store);
 EXPORT_SYMBOL_GPL(dev_attr_sw_activity);
 
@@ -2142,13 +2142,14 @@ static unsigned int ata_scsiop_inq_89(struct ata_scsi_args *args, u8 *rbuf)
 
 static unsigned int ata_scsiop_inq_b1(struct ata_scsi_args *args, u8 *rbuf)
 {
+        int form_factor = ata_id_form_factor(args->id);
+        int media_rotation_rate = ata_id_rotation_rate(args->id);
+
         rbuf[1] = 0xb1;
         rbuf[3] = 0x3c;
-        if (ata_id_major_version(args->id) > 7) {
-                rbuf[4] = args->id[217] >> 8;
-                rbuf[5] = args->id[217];
-                rbuf[7] = args->id[168] & 0xf;
-        }
+        rbuf[4] = media_rotation_rate >> 8;
+        rbuf[5] = media_rotation_rate;
+        rbuf[7] = form_factor;
 
         return 0;
 }
@@ -2376,7 +2377,23 @@ saving_not_supp:
  */
 static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
 {
-        u64 last_lba = args->dev->n_sectors - 1; /* LBA of the last block */
+        struct ata_device *dev = args->dev;
+        u64 last_lba = dev->n_sectors - 1; /* LBA of the last block */
+        u8 log_per_phys = 0;
+        u16 lowest_aligned = 0;
+        u16 word_106 = dev->id[106];
+        u16 word_209 = dev->id[209];
+
+        if ((word_106 & 0xc000) == 0x4000) {
+                /* Number and offset of logical sectors per physical sector */
+                if (word_106 & (1 << 13))
+                        log_per_phys = word_106 & 0xf;
+                if ((word_209 & 0xc000) == 0x4000) {
+                        u16 first = dev->id[209] & 0x3fff;
+                        if (first > 0)
+                                lowest_aligned = (1 << log_per_phys) - first;
+                }
+        }
 
         VPRINTK("ENTER\n");
 
@@ -2407,6 +2424,11 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
                 /* sector size */
                 rbuf[10] = ATA_SECT_SIZE >> 8;
                 rbuf[11] = ATA_SECT_SIZE & 0xff;
+
+                rbuf[12] = 0;
+                rbuf[13] = log_per_phys;
+                rbuf[14] = (lowest_aligned >> 8) & 0x3f;
+                rbuf[15] = lowest_aligned;
         }
 
         return 0;
diff --git a/drivers/ata/pata_ali.c b/drivers/ata/pata_ali.c
index 751b7ea4816..fc9c5d6d7d8 100644
--- a/drivers/ata/pata_ali.c
+++ b/drivers/ata/pata_ali.c
@@ -497,14 +497,16 @@ static int ali_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         };
         /* Revision 0x20 added DMA */
         static const struct ata_port_info info_20 = {
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_PIO_LBA48,
+                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_PIO_LBA48 |
+                                                        ATA_FLAG_IGN_SIMPLEX,
                 .pio_mask = ATA_PIO4,
                 .mwdma_mask = ATA_MWDMA2,
                 .port_ops = &ali_20_port_ops
         };
         /* Revision 0x20 with support logic added UDMA */
         static const struct ata_port_info info_20_udma = {
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_PIO_LBA48,
+                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_PIO_LBA48 |
+                                                        ATA_FLAG_IGN_SIMPLEX,
                 .pio_mask = ATA_PIO4,
                 .mwdma_mask = ATA_MWDMA2,
                 .udma_mask = ATA_UDMA2,
@@ -512,7 +514,8 @@ static int ali_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         };
         /* Revision 0xC2 adds UDMA66 */
         static const struct ata_port_info info_c2 = {
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_PIO_LBA48,
+                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_PIO_LBA48 |
+                                                        ATA_FLAG_IGN_SIMPLEX,
                 .pio_mask = ATA_PIO4,
                 .mwdma_mask = ATA_MWDMA2,
                 .udma_mask = ATA_UDMA4,
@@ -520,7 +523,8 @@ static int ali_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         };
         /* Revision 0xC3 is UDMA66 for now */
         static const struct ata_port_info info_c3 = {
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_PIO_LBA48,
+                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_PIO_LBA48 |
+                                                        ATA_FLAG_IGN_SIMPLEX,
                 .pio_mask = ATA_PIO4,
                 .mwdma_mask = ATA_MWDMA2,
                 .udma_mask = ATA_UDMA4,
@@ -528,7 +532,8 @@ static int ali_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         };
         /* Revision 0xC4 is UDMA100 */
         static const struct ata_port_info info_c4 = {
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_PIO_LBA48,
+                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_PIO_LBA48 |
+                                                        ATA_FLAG_IGN_SIMPLEX,
                 .pio_mask = ATA_PIO4,
                 .mwdma_mask = ATA_MWDMA2,
                 .udma_mask = ATA_UDMA5,
@@ -536,7 +541,7 @@ static int ali_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         };
         /* Revision 0xC5 is UDMA133 with LBA48 DMA */
         static const struct ata_port_info info_c5 = {
-                .flags = ATA_FLAG_SLAVE_POSS,
+                .flags = ATA_FLAG_SLAVE_POSS |  ATA_FLAG_IGN_SIMPLEX,
                 .pio_mask = ATA_PIO4,
                 .mwdma_mask = ATA_MWDMA2,
                 .udma_mask = ATA_UDMA6,
diff --git a/drivers/ata/pata_efar.c b/drivers/ata/pata_efar.c
index 2085e0a3a05..2a6412f5d11 100644
--- a/drivers/ata/pata_efar.c
+++ b/drivers/ata/pata_efar.c
@@ -22,7 +22,7 @@
 #include <linux/ata.h>
 
 #define DRV_NAME        "pata_efar"
-#define DRV_VERSION     "0.4.4"
+#define DRV_VERSION     "0.4.5"
 
 /**
  *      efar_pre_reset  -       Enable bits
@@ -98,18 +98,17 @@ static void efar_set_piomode (struct ata_port *ap, struct ata_device *adev)
                             { 2, 1 },
                             { 2, 3 }, };
 
-        if (pio > 2)
-                control |= 1;   /* TIME1 enable */
+        if (pio > 1)
+                control |= 1;   /* TIME */
         if (ata_pio_need_iordy(adev))   /* PIO 3/4 require IORDY */
-                control |= 2;   /* IE enable */
-        /* Intel specifies that the PPE functionality is for disk only */
+                control |= 2;   /* IE */
+        /* Intel specifies that the prefetch/posting is for disk only */
         if (adev->class == ATA_DEV_ATA)
-                control |= 4;   /* PPE enable */
+                control |= 4;   /* PPE */
 
         pci_read_config_word(dev, idetm_port, &idetm_data);
 
-        /* Enable PPE, IE and TIME as appropriate */
-
+        /* Set PPE, IE, and TIME as appropriate */
         if (adev->devno == 0) {
                 idetm_data &= 0xCCF0;
                 idetm_data |= control;
@@ -129,7 +128,7 @@ static void efar_set_piomode (struct ata_port *ap, struct ata_device *adev)
                 pci_write_config_byte(dev, 0x44, slave_data);
         }
 
-        idetm_data |= 0x4000;   /* Ensure SITRE is enabled */
+        idetm_data |= 0x4000;   /* Ensure SITRE is set */
         pci_write_config_word(dev, idetm_port, idetm_data);
 }
 
diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
index f72c6c5b820..6932e56d179 100644
--- a/drivers/ata/pata_legacy.c
+++ b/drivers/ata/pata_legacy.c
@@ -48,6 +48,7 @@
  *
  */
 
+#include <linux/async.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/pci.h>
@@ -1028,6 +1029,7 @@ static __init int legacy_init_one(struct legacy_probe *probe)
                                 &legacy_sht);
         if (ret)
                 goto fail;
+        async_synchronize_full();
         ld->platform_dev = pdev;
 
         /* Nothing found means we drop the port as its probably not there */
diff --git a/drivers/ata/pata_netcell.c b/drivers/ata/pata_netcell.c
index bdb236957cb..f0d52f72f5b 100644
--- a/drivers/ata/pata_netcell.c
+++ b/drivers/ata/pata_netcell.c
@@ -20,13 +20,24 @@
 
 /* No PIO or DMA methods needed for this device */
 
+static unsigned int netcell_read_id(struct ata_device *adev,
+                                        struct ata_taskfile *tf, u16 *id)
+{
+        unsigned int err_mask = ata_do_dev_read_id(adev, tf, id);
+        /* Firmware forgets to mark words 85-87 valid */
+        if (err_mask == 0)
+                id[ATA_ID_CSF_DEFAULT] |= 0x4000;
+        return err_mask;
+}
+
 static struct scsi_host_template netcell_sht = {
         ATA_BMDMA_SHT(DRV_NAME),
 };
 
 static struct ata_port_operations netcell_ops = {
         .inherits       = &ata_bmdma_port_ops,
-        .cable_detect           = ata_cable_80wire,
+        .cable_detect   = ata_cable_80wire,
+        .read_id        = netcell_read_id,
 };
 
 
diff --git a/drivers/ata/pata_pdc202xx_old.c b/drivers/ata/pata_pdc202xx_old.c
index 5fedb3d4032..2f3c9bed63d 100644
--- a/drivers/ata/pata_pdc202xx_old.c
+++ b/drivers/ata/pata_pdc202xx_old.c
@@ -2,7 +2,7 @@
  * pata_pdc202xx_old.c  - Promise PDC202xx PATA for new ATA layer
  *                        (C) 2005 Red Hat Inc
  *                        Alan Cox <alan@lxorguk.ukuu.org.uk>
- *                        (C) 2007 Bartlomiej Zolnierkiewicz
+ *                        (C) 2007,2009 Bartlomiej Zolnierkiewicz
  *
  * Based in part on linux/drivers/ide/pci/pdc202xx_old.c
  *
@@ -158,7 +158,7 @@ static void pdc2026x_bmdma_start(struct ata_queued_cmd *qc)
         u32 len;
 
         /* Check we keep host level locking here */
-        if (adev->dma_mode >= XFER_UDMA_2)
+        if (adev->dma_mode > XFER_UDMA_2)
                 iowrite8(ioread8(clock) | sel66, clock);
         else
                 iowrite8(ioread8(clock) & ~sel66, clock);
@@ -212,7 +212,7 @@ static void pdc2026x_bmdma_stop(struct ata_queued_cmd *qc)
                 iowrite8(ioread8(clock) & ~sel66, clock);
         }
         /* Flip back to 33Mhz for PIO */
-        if (adev->dma_mode >= XFER_UDMA_2)
+        if (adev->dma_mode > XFER_UDMA_2)
                 iowrite8(ioread8(clock) & ~sel66, clock);
         ata_bmdma_stop(qc);
         pdc202xx_set_piomode(ap, adev);
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index c2e90e1fece..36b8629203b 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -205,6 +205,7 @@ struct cmdhdr_tbl_entry {
  * Description information bitdefs
  */
 enum {
+        CMD_DESC_RES = (1 << 11),
         VENDOR_SPECIFIC_BIST = (1 << 10),
         CMD_DESC_SNOOP_ENABLE = (1 << 9),
         FPDMA_QUEUED_CMD = (1 << 8),
@@ -332,13 +333,14 @@ static unsigned int sata_fsl_fill_sg(struct ata_queued_cmd *qc, void *cmd_desc,
                 dma_addr_t sg_addr = sg_dma_address(sg);
                 u32 sg_len = sg_dma_len(sg);
 
-                VPRINTK("SATA FSL : fill_sg, sg_addr = 0x%x, sg_len = %d\n",
-                        sg_addr, sg_len);
+                VPRINTK("SATA FSL : fill_sg, sg_addr = 0x%llx, sg_len = %d\n",
+                        (unsigned long long)sg_addr, sg_len);
 
                 /* warn if each s/g element is not dword aligned */
                 if (sg_addr & 0x03)
                         ata_port_printk(qc->ap, KERN_ERR,
-                                        "s/g addr unaligned : 0x%x\n", sg_addr);
+                                        "s/g addr unaligned : 0x%llx\n",
+                                        (unsigned long long)sg_addr);
                 if (sg_len & 0x03)
                         ata_port_printk(qc->ap, KERN_ERR,
                                         "s/g len unaligned : 0x%x\n", sg_len);
@@ -387,7 +389,7 @@ static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
         void __iomem *hcr_base = host_priv->hcr_base;
         unsigned int tag = sata_fsl_tag(qc->tag, hcr_base);
         struct command_desc *cd;
-        u32 desc_info = CMD_DESC_SNOOP_ENABLE;
+        u32 desc_info = CMD_DESC_RES | CMD_DESC_SNOOP_ENABLE;
         u32 num_prde = 0;
         u32 ttl_dwords = 0;
         dma_addr_t cd_paddr;
@@ -840,7 +842,7 @@ issue_srst:
 
         /* device reset/SRST is a control register update FIS, uses tag0 */
         sata_fsl_setup_cmd_hdr_entry(pp, 0,
-                                     SRST_CMD | CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
+                SRST_CMD | CMD_DESC_RES | CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
 
         tf.ctl |= ATA_SRST;     /* setup SRST bit in taskfile control reg */
         ata_tf_to_fis(&tf, pmp, 0, cfis);
@@ -886,7 +888,8 @@ issue_srst:
          * using ATA signature D2H register FIS to the host controller.
          */
 
-        sata_fsl_setup_cmd_hdr_entry(pp, 0, CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
+        sata_fsl_setup_cmd_hdr_entry(pp, 0, CMD_DESC_RES | CMD_DESC_SNOOP_ENABLE,
+                                      0, 0, 5);
 
         tf.ctl &= ~ATA_SRST;    /* 2nd H2D Ctl. register FIS */
         ata_tf_to_fis(&tf, pmp, 0, cfis);
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 870dcfd8235..23714aefb82 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -293,6 +293,10 @@ enum {
         FISCFG_WAIT_DEV_ERR     = (1 << 8),     /* wait for host on DevErr */
         FISCFG_SINGLE_SYNC      = (1 << 16),    /* SYNC on DMA activation */
 
+        PHY_MODE9_GEN2          = 0x398,
+        PHY_MODE9_GEN1          = 0x39c,
+        PHYCFG_OFS              = 0x3a0,        /* only in 65n devices */
+
         MV5_PHY_MODE            = 0x74,
         MV5_LTMODE              = 0x30,
         MV5_PHY_CTL             = 0x0C,
@@ -609,6 +613,8 @@ static int mv_soc_reset_hc(struct mv_host_priv *hpriv,
 static void mv_soc_reset_flash(struct mv_host_priv *hpriv,
                                       void __iomem *mmio);
 static void mv_soc_reset_bus(struct ata_host *host, void __iomem *mmio);
+static void mv_soc_65n_phy_errata(struct mv_host_priv *hpriv,
+                                  void __iomem *mmio, unsigned int port);
 static void mv_reset_pci_bus(struct ata_host *host, void __iomem *mmio);
 static void mv_reset_channel(struct mv_host_priv *hpriv, void __iomem *mmio,
                              unsigned int port_no);
@@ -807,6 +813,14 @@ static const struct mv_hw_ops mv_soc_ops = {
         .reset_bus              = mv_soc_reset_bus,
 };
 
+static const struct mv_hw_ops mv_soc_65n_ops = {
+        .phy_errata             = mv_soc_65n_phy_errata,
+        .enable_leds            = mv_soc_enable_leds,
+        .reset_hc               = mv_soc_reset_hc,
+        .reset_flash            = mv_soc_reset_flash,
+        .reset_bus              = mv_soc_reset_bus,
+};
+
 /*
  * Functions
  */
@@ -3397,6 +3411,53 @@ static void mv_soc_reset_bus(struct ata_host *host, void __iomem *mmio)
         return;
 }
 
+static void mv_soc_65n_phy_errata(struct mv_host_priv *hpriv,
+                                  void __iomem *mmio, unsigned int port)
+{
+        void __iomem *port_mmio = mv_port_base(mmio, port);
+        u32     reg;
+
+        reg = readl(port_mmio + PHY_MODE3);
+        reg &= ~(0x3 << 27);    /* SELMUPF (bits 28:27) to 1 */
+        reg |= (0x1 << 27);
+        reg &= ~(0x3 << 29);    /* SELMUPI (bits 30:29) to 1 */
+        reg |= (0x1 << 29);
+        writel(reg, port_mmio + PHY_MODE3);
+
+        reg = readl(port_mmio + PHY_MODE4);
+        reg &= ~0x1;    /* SATU_OD8 (bit 0) to 0, reserved bit 16 must be set */
+        reg |= (0x1 << 16);
+        writel(reg, port_mmio + PHY_MODE4);
+
+        reg = readl(port_mmio + PHY_MODE9_GEN2);
+        reg &= ~0xf;    /* TXAMP[3:0] (bits 3:0) to 8 */
+        reg |= 0x8;
+        reg &= ~(0x1 << 14);    /* TXAMP[4] (bit 14) to 0 */
+        writel(reg, port_mmio + PHY_MODE9_GEN2);
+
+        reg = readl(port_mmio + PHY_MODE9_GEN1);
+        reg &= ~0xf;    /* TXAMP[3:0] (bits 3:0) to 8 */
+        reg |= 0x8;
+        reg &= ~(0x1 << 14);    /* TXAMP[4] (bit 14) to 0 */
+        writel(reg, port_mmio + PHY_MODE9_GEN1);
+}
+
+/**
+ *      soc_is_65 - check if the soc is 65 nano device
+ *
+ *      Detect the type of the SoC, this is done by reading the PHYCFG_OFS
+ *      register, this register should contain non-zero value and it exists only
+ *      in the 65 nano devices, when reading it from older devices we get 0.
+ */
+static bool soc_is_65n(struct mv_host_priv *hpriv)
+{
+        void __iomem *port0_mmio = mv_port_base(hpriv->base, 0);
+
+        if (readl(port0_mmio + PHYCFG_OFS))
+                return true;
+        return false;
+}
+
 static void mv_setup_ifcfg(void __iomem *port_mmio, int want_gen2i)
 {
         u32 ifcfg = readl(port_mmio + SATA_IFCFG);
@@ -3737,7 +3798,10 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
                 }
                 break;
         case chip_soc:
-                hpriv->ops = &mv_soc_ops;
+                if (soc_is_65n(hpriv))
+                        hpriv->ops = &mv_soc_65n_ops;
+                else
+                        hpriv->ops = &mv_soc_ops;
                 hp_flags |= MV_HP_FLAG_SOC | MV_HP_GEN_IIE |
                         MV_HP_ERRATA_60X1C0;
                 break;
@@ -3800,7 +3864,8 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
         n_hc = mv_get_hc_count(host->ports[0]->flags);
 
         for (port = 0; port < host->n_ports; port++)
-                hpriv->ops->read_preamp(hpriv, port, mmio);
+                if (hpriv->ops->read_preamp)
+                        hpriv->ops->read_preamp(hpriv, port, mmio);
 
         rc = hpriv->ops->reset_hc(hpriv, mmio, n_hc);
         if (rc)
diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
index dce3dccced3..eb05a3c82a9 100644
--- a/drivers/ata/sata_sx4.c
+++ b/drivers/ata/sata_sx4.c
@@ -213,8 +213,9 @@ struct pdc_host_priv {
 
 
 static int pdc_sata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
-static void pdc_eng_timeout(struct ata_port *ap);
-static void pdc_20621_phy_reset(struct ata_port *ap);
+static void pdc_error_handler(struct ata_port *ap);
+static void pdc_freeze(struct ata_port *ap);
+static void pdc_thaw(struct ata_port *ap);
 static int pdc_port_start(struct ata_port *ap);
 static void pdc20621_qc_prep(struct ata_queued_cmd *qc);
 static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
@@ -233,6 +234,10 @@ static void pdc20621_put_to_dimm(struct ata_host *host,
                                  void *psource, u32 offset, u32 size);
 static void pdc20621_irq_clear(struct ata_port *ap);
 static unsigned int pdc20621_qc_issue(struct ata_queued_cmd *qc);
+static int pdc_softreset(struct ata_link *link, unsigned int *class,
+                         unsigned long deadline);
+static void pdc_post_internal_cmd(struct ata_queued_cmd *qc);
+static int pdc_check_atapi_dma(struct ata_queued_cmd *qc);
 
 
 static struct scsi_host_template pdc_sata_sht = {
@@ -243,20 +248,24 @@ static struct scsi_host_template pdc_sata_sht = {
 
 /* TODO: inherit from base port_ops after converting to new EH */
 static struct ata_port_operations pdc_20621_ops = {
-        .sff_tf_load            = pdc_tf_load_mmio,
-        .sff_tf_read            = ata_sff_tf_read,
-        .sff_check_status       = ata_sff_check_status,
-        .sff_exec_command       = pdc_exec_command_mmio,
-        .sff_dev_select         = ata_sff_dev_select,
-        .phy_reset              = pdc_20621_phy_reset,
+        .inherits               = &ata_sff_port_ops,
+
+        .check_atapi_dma        = pdc_check_atapi_dma,
         .qc_prep                = pdc20621_qc_prep,
         .qc_issue               = pdc20621_qc_issue,
-        .qc_fill_rtf            = ata_sff_qc_fill_rtf,
-        .sff_data_xfer          = ata_sff_data_xfer,
-        .eng_timeout            = pdc_eng_timeout,
-        .sff_irq_clear          = pdc20621_irq_clear,
-        .sff_irq_on             = ata_sff_irq_on,
+
+        .freeze                 = pdc_freeze,
+        .thaw                   = pdc_thaw,
+        .softreset              = pdc_softreset,
+        .error_handler          = pdc_error_handler,
+        .lost_interrupt         = ATA_OP_NULL,
+        .post_internal_cmd      = pdc_post_internal_cmd,
+
         .port_start             = pdc_port_start,
+
+        .sff_tf_load            = pdc_tf_load_mmio,
+        .sff_exec_command       = pdc_exec_command_mmio,
+        .sff_irq_clear          = pdc20621_irq_clear,
 };
 
 static const struct ata_port_info pdc_port_info[] = {
@@ -310,14 +319,6 @@ static int pdc_port_start(struct ata_port *ap)
         return 0;
 }
 
-static void pdc_20621_phy_reset(struct ata_port *ap)
-{
-        VPRINTK("ENTER\n");
-        ap->cbl = ATA_CBL_SATA;
-        ata_port_probe(ap);
-        ata_bus_reset(ap);
-}
-
 static inline void pdc20621_ata_sg(struct ata_taskfile *tf, u8 *buf,
                                    unsigned int portno,
                                            unsigned int total_len)
@@ -686,8 +687,11 @@ static void pdc20621_packet_start(struct ata_queued_cmd *qc)
 static unsigned int pdc20621_qc_issue(struct ata_queued_cmd *qc)
 {
         switch (qc->tf.protocol) {
-        case ATA_PROT_DMA:
         case ATA_PROT_NODATA:
+                if (qc->tf.flags & ATA_TFLAG_POLLING)
+                        break;
+                /*FALLTHROUGH*/
+        case ATA_PROT_DMA:
                 pdc20621_packet_start(qc);
                 return 0;
 
@@ -786,12 +790,7 @@ static inline unsigned int pdc20621_host_intr(struct ata_port *ap,
 
 static void pdc20621_irq_clear(struct ata_port *ap)
 {
-        struct ata_host *host = ap->host;
-        void __iomem *mmio = host->iomap[PDC_MMIO_BAR];
-
-        mmio += PDC_CHIP0_OFS;
-
-        readl(mmio + PDC_20621_SEQMASK);
+        ioread8(ap->ioaddr.status_addr);
 }
 
 static irqreturn_t pdc20621_interrupt(int irq, void *dev_instance)
@@ -859,46 +858,119 @@ static irqreturn_t pdc20621_interrupt(int irq, void *dev_instance)
         return IRQ_RETVAL(handled);
 }
 
-static void pdc_eng_timeout(struct ata_port *ap)
+static void pdc_freeze(struct ata_port *ap)
 {
-        u8 drv_stat;
-        struct ata_host *host = ap->host;
-        struct ata_queued_cmd *qc;
-        unsigned long flags;
+        void __iomem *mmio = ap->ioaddr.cmd_addr;
+        u32 tmp;
 
-        DPRINTK("ENTER\n");
+        /* FIXME: if all 4 ATA engines are stopped, also stop HDMA engine */
 
-        spin_lock_irqsave(&host->lock, flags);
+        tmp = readl(mmio + PDC_CTLSTAT);
+        tmp |= PDC_MASK_INT;
+        tmp &= ~PDC_DMA_ENABLE;
+        writel(tmp, mmio + PDC_CTLSTAT);
+        readl(mmio + PDC_CTLSTAT); /* flush */
+}
 
-        qc = ata_qc_from_tag(ap, ap->link.active_tag);
+static void pdc_thaw(struct ata_port *ap)
+{
+        void __iomem *mmio = ap->ioaddr.cmd_addr;
+        u32 tmp;
 
-        switch (qc->tf.protocol) {
-        case ATA_PROT_DMA:
-        case ATA_PROT_NODATA:
-                ata_port_printk(ap, KERN_ERR, "command timeout\n");
-                qc->err_mask |= __ac_err_mask(ata_wait_idle(ap));
-                break;
+        /* FIXME: start HDMA engine, if zero ATA engines running */
 
-        default:
-                drv_stat = ata_sff_busy_wait(ap, ATA_BUSY | ATA_DRQ, 1000);
+        /* clear IRQ */
+        ioread8(ap->ioaddr.status_addr);
 
-                ata_port_printk(ap, KERN_ERR,
-                                "unknown timeout, cmd 0x%x stat 0x%x\n",
-                                qc->tf.command, drv_stat);
+        /* turn IRQ back on */
+        tmp = readl(mmio + PDC_CTLSTAT);
+        tmp &= ~PDC_MASK_INT;
+        writel(tmp, mmio + PDC_CTLSTAT);
+        readl(mmio + PDC_CTLSTAT); /* flush */
+}
 
-                qc->err_mask |= ac_err_mask(drv_stat);
-                break;
+static void pdc_reset_port(struct ata_port *ap)
+{
+        void __iomem *mmio = ap->ioaddr.cmd_addr + PDC_CTLSTAT;
+        unsigned int i;
+        u32 tmp;
+
+        /* FIXME: handle HDMA copy engine */
+
+        for (i = 11; i > 0; i--) {
+                tmp = readl(mmio);
+                if (tmp & PDC_RESET)
+                        break;
+
+                udelay(100);
+
+                tmp |= PDC_RESET;
+                writel(tmp, mmio);
         }
 
-        spin_unlock_irqrestore(&host->lock, flags);
-        ata_eh_qc_complete(qc);
-        DPRINTK("EXIT\n");
+        tmp &= ~PDC_RESET;
+        writel(tmp, mmio);
+        readl(mmio);    /* flush */
+}
+
+static int pdc_softreset(struct ata_link *link, unsigned int *class,
+                         unsigned long deadline)
+{
+        pdc_reset_port(link->ap);
+        return ata_sff_softreset(link, class, deadline);
+}
+
+static void pdc_error_handler(struct ata_port *ap)
+{
+        if (!(ap->pflags & ATA_PFLAG_FROZEN))
+                pdc_reset_port(ap);
+
+        ata_std_error_handler(ap);
+}
+
+static void pdc_post_internal_cmd(struct ata_queued_cmd *qc)
+{
+        struct ata_port *ap = qc->ap;
+
+        /* make DMA engine forget about the failed command */
+        if (qc->flags & ATA_QCFLAG_FAILED)
+                pdc_reset_port(ap);
+}
+
+static int pdc_check_atapi_dma(struct ata_queued_cmd *qc)
+{
+        u8 *scsicmd = qc->scsicmd->cmnd;
+        int pio = 1; /* atapi dma off by default */
+
+        /* Whitelist commands that may use DMA. */
+        switch (scsicmd[0]) {
+        case WRITE_12:
+        case WRITE_10:
+        case WRITE_6:
+        case READ_12:
+        case READ_10:
+        case READ_6:
+        case 0xad: /* READ_DVD_STRUCTURE */
+        case 0xbe: /* READ_CD */
+                pio = 0;
+        }
+        /* -45150 (FFFF4FA2) to -1 (FFFFFFFF) shall use PIO mode */
+        if (scsicmd[0] == WRITE_10) {
+                unsigned int lba =
+                        (scsicmd[2] << 24) |
+                        (scsicmd[3] << 16) |
+                        (scsicmd[4] << 8) |
+                        scsicmd[5];
+                if (lba >= 0xFFFF4FA2)
+                        pio = 1;
+        }
+        return pio;
 }
 
 static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf)
 {
         WARN_ON(tf->protocol == ATA_PROT_DMA ||
-                tf->protocol == ATA_PROT_NODATA);
+                tf->protocol == ATAPI_PROT_DMA);
         ata_sff_tf_load(ap, tf);
 }
 
@@ -906,7 +978,7 @@ static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf)
 static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf)
 {
         WARN_ON(tf->protocol == ATA_PROT_DMA ||
-                tf->protocol == ATA_PROT_NODATA);
+                tf->protocol == ATAPI_PROT_DMA);
         ata_sff_exec_command(ap, tf);
 }
 
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index dc030f1f00f..c6599618523 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -700,8 +700,10 @@ int bus_add_driver(struct device_driver *drv)
         }
 
         kobject_uevent(&priv->kobj, KOBJ_ADD);
-        return error;
+        return 0;
 out_unregister:
+        kfree(drv->p);
+        drv->p = NULL;
         kobject_put(&priv->kobj);
 out_put_bus:
         bus_put(bus);
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 4aa527b8a91..1977d4beb89 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -879,7 +879,7 @@ int device_add(struct device *dev)
         }
 
         if (!dev_name(dev))
-                goto done;
+                goto name_error;
 
         pr_debug("device: '%s': %s\n", dev_name(dev), __func__);
 
@@ -978,6 +978,9 @@ done:
         cleanup_device_parent(dev);
         if (parent)
                 put_device(parent);
+name_error:
+        kfree(dev->p);
+        dev->p = NULL;
         goto done;
 }
 
diff --git a/drivers/base/driver.c b/drivers/base/driver.c
index c51f11bb29a..8ae0f63602e 100644
--- a/drivers/base/driver.c
+++ b/drivers/base/driver.c
@@ -257,6 +257,10 @@ EXPORT_SYMBOL_GPL(driver_register);
  */
 void driver_unregister(struct device_driver *drv)
 {
+        if (!drv || !drv->p) {
+                WARN(1, "Unexpected driver unregister!\n");
+                return;
+        }
         driver_remove_groups(drv, drv->groups);
         bus_remove_driver(drv);
 }
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index b5b6c973a2e..8b4708e0624 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -217,7 +217,6 @@ int platform_device_add_data(struct platform_device *pdev, const void *data,
         if (d) {
                 memcpy(d, data, size);
                 pdev->dev.platform_data = d;
-                pdev->platform_data = d;
         }
         return d ? 0 : -ENOMEM;
 }
@@ -247,21 +246,6 @@ int platform_device_add(struct platform_device *pdev)
         else
                 dev_set_name(&pdev->dev, pdev->name);
 
-        /* We will remove platform_data field from struct device
-        * if all platform devices pass its platform specific data
-        * from platform_device. The conversion is going to be a
-        * long time, so we allow the two cases coexist to make
-        * this kind of fix more easily*/
-        if (pdev->platform_data && pdev->dev.platform_data) {
-                printk(KERN_ERR
-                               "%s: use which platform_data?\n",
-                               dev_name(&pdev->dev));
-        } else if (pdev->platform_data) {
-                pdev->dev.platform_data = pdev->platform_data;
-        } else if (pdev->dev.platform_data) {
-                pdev->platform_data = pdev->dev.platform_data;
-        }
-
         for (i = 0; i < pdev->num_resources; i++) {
                 struct resource *p, *r = &pdev->resource[i];
 
@@ -1028,7 +1012,7 @@ static __initdata LIST_HEAD(early_platform_device_list);
 
 /**
  * early_platform_driver_register
- * @edrv: early_platform driver structure
+ * @epdrv: early_platform driver structure
  * @buf: string passed from early_param()
  */
 int __init early_platform_driver_register(struct early_platform_driver *epdrv,
@@ -1112,7 +1096,7 @@ void __init early_platform_driver_register_all(char *class_str)
 
 /**
  * early_platform_match
- * @edrv: early platform driver structure
+ * @epdrv: early platform driver structure
  * @id: id to match against
  */
 static  __init struct platform_device *
@@ -1130,7 +1114,7 @@ early_platform_match(struct early_platform_driver *epdrv, int id)
 
 /**
  * early_platform_left
- * @edrv: early platform driver structure
+ * @epdrv: early platform driver structure
  * @id: return true if id or above exists
  */
 static  __init int early_platform_left(struct early_platform_driver *epdrv,
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 69b4ddb7de3..3e4bc699bc0 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -357,6 +357,7 @@ static void dpm_power_up(pm_message_t state)
 {
         struct device *dev;
 
+        mutex_lock(&dpm_list_mtx);
         list_for_each_entry(dev, &dpm_list, power.entry)
                 if (dev->power.status > DPM_OFF) {
                         int error;
@@ -366,6 +367,7 @@ static void dpm_power_up(pm_message_t state)
                         if (error)
                                 pm_dev_err(dev, state, " early", error);
                 }
+        mutex_unlock(&dpm_list_mtx);
 }
 
 /**
@@ -614,6 +616,7 @@ int device_power_down(pm_message_t state)
         int error = 0;
 
         suspend_device_irqs();
+        mutex_lock(&dpm_list_mtx);
         list_for_each_entry_reverse(dev, &dpm_list, power.entry) {
                 error = suspend_device_noirq(dev, state);
                 if (error) {
@@ -622,6 +625,7 @@ int device_power_down(pm_message_t state)
                 }
                 dev->power.status = DPM_OFF_IRQ;
         }
+        mutex_unlock(&dpm_list_mtx);
         if (error)
                 device_power_up(resume_event(state));
         return error;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 8f905089b72..a6cbf7b808e 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -934,8 +934,6 @@ static void blkfront_closing(struct xenbus_device *dev)
 
         spin_lock_irqsave(&blkif_io_lock, flags);
 
-        del_gendisk(info->gd);
-
         /* No more blkif_request(). */
         blk_stop_queue(info->rq);
 
@@ -949,6 +947,8 @@ static void blkfront_closing(struct xenbus_device *dev)
         blk_cleanup_queue(info->rq);
         info->rq = NULL;
 
+        del_gendisk(info->gd);
+
  out:
         xenbus_frontend_closed(dev);
 }
@@ -977,8 +977,10 @@ static void backend_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateClosing:
-                if (info->gd == NULL)
-                        xenbus_dev_fatal(dev, -ENODEV, "gd is NULL");
+                if (info->gd == NULL) {
+                        xenbus_frontend_closed(dev);
+                        break;
+                }
                 bd = bdget_disk(info->gd, 0);
                 if (bd == NULL)
                         xenbus_dev_fatal(dev, -ENODEV, "bdget failed");
diff --git a/drivers/cdrom/viocd.c b/drivers/cdrom/viocd.c
index 13929356135..9b1624e0dde 100644
--- a/drivers/cdrom/viocd.c
+++ b/drivers/cdrom/viocd.c
@@ -587,7 +587,7 @@ static int viocd_probe(struct vio_dev *vdev, const struct vio_device_id *id)
         struct device_node *node = vdev->dev.archdata.of_node;
 
         deviceno = vdev->unit_address;
-        if (deviceno > VIOCD_MAX_CD)
+        if (deviceno >= VIOCD_MAX_CD)
                 return -ENODEV;
         if (!node)
                 return -ENODEV;
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index aa83a0865ec..09050797c76 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -2856,6 +2856,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
                 /* Assume a single IPMB channel at zero. */
                 intf->channels[0].medium = IPMI_CHANNEL_MEDIUM_IPMB;
                 intf->channels[0].protocol = IPMI_CHANNEL_PROTOCOL_IPMB;
+                intf->curr_channel = IPMI_MAX_CHANNELS;
         }
 
         if (rv == 0)
@@ -3648,13 +3649,13 @@ static int handle_new_recv_msg(ipmi_smi_t          intf,
                 }
 
                 /*
-                ** We need to make sure the channels have been initialized.
-                ** The channel_handler routine will set the "curr_channel"
-                ** equal to or greater than IPMI_MAX_CHANNELS when all the
-                ** channels for this interface have been initialized.
-                */
+                 * We need to make sure the channels have been initialized.
+                 * The channel_handler routine will set the "curr_channel"
+                 * equal to or greater than IPMI_MAX_CHANNELS when all the
+                 * channels for this interface have been initialized.
+                 */
                 if (intf->curr_channel < IPMI_MAX_CHANNELS) {
-                        requeue = 1;     /* Just put the message back for now */
+                        requeue = 0; /* Throw the message away */
                         goto out;
                 }
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 8f05c38c2f0..65e12bca657 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -694,6 +694,9 @@ static ssize_t read_zero(struct file * file, char __user * buf,
                 written += chunk - unwritten;
                 if (unwritten)
                         break;
+                /* Consider changing this to just 'signal_pending()' with lots of testing */
+                if (fatal_signal_pending(current))
+                        return written ? written : -EINTR;
                 buf += chunk;
                 count -= chunk;
                 cond_resched();
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index a420e8d437d..13f8871e5b2 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -2711,7 +2711,7 @@ static int __init mxser_module_init(void)
                         continue;
 
                 brd = &mxser_boards[m];
-                retval = mxser_get_ISA_conf(!ioaddr[b], brd);
+                retval = mxser_get_ISA_conf(ioaddr[b], brd);
                 if (retval <= 0) {
                         brd->info = NULL;
                         continue;
diff --git a/drivers/char/random.c b/drivers/char/random.c
index b2ced39d76b..8c7444857a4 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1673,7 +1673,7 @@ unsigned int get_random_int(void)
         int ret;
 
         keyptr = get_keyptr();
-        hash[0] += current->pid + jiffies + get_cycles() + (int)(long)&ret;
+        hash[0] += current->pid + jiffies + get_cycles();
 
         ret = half_md4_transform(hash, keyptr->secret);
         put_cpu_var(get_random_int_hash);
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index b0a6a3e5192..d6a807f4077 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -406,7 +406,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_showlocks_op,            /* d */
         &sysrq_term_op,                 /* e */
         &sysrq_moom_op,                 /* f */
-        /* g: May be registered by ppc for kgdb */
+        /* g: May be registered for the kernel debugger */
         NULL,                           /* g */
         NULL,                           /* h - reserved for help */
         &sysrq_kill_op,                 /* i */
@@ -431,7 +431,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_sync_op,                 /* s */
         &sysrq_showstate_op,            /* t */
         &sysrq_mountro_op,              /* u */
-        /* v: May be registered at init time by SMP VOYAGER */
+        /* v: May be registered for frame buffer console restore */
         NULL,                           /* v */
         &sysrq_showstate_blocked_op,    /* w */
         /* x: May be registered on ppc/powerpc for xmon */
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index ed306eb1057..0c2f55a38b9 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -212,7 +212,8 @@ static int get_event_name(char *dest, struct tcpa_event *event,
                         unsigned char * event_entry)
 {
         const char *name = "";
-        char data[40] = "";
+        /* 41 so there is room for 40 data and 1 nul */
+        char data[41] = "";
         int i, n_len = 0, d_len = 0;
         struct tcpa_pc_event *pc_event;
 
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index d270e8eb3e6..6e2ec0b1894 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -808,7 +808,7 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
                 ret = -ENOMEM;
                 goto nomem_out;
         }
-        if (!alloc_cpumask_var(&policy->related_cpus, GFP_KERNEL)) {
+        if (!zalloc_cpumask_var(&policy->related_cpus, GFP_KERNEL)) {
                 free_cpumask_var(policy->cpus);
                 kfree(policy);
                 ret = -ENOMEM;
@@ -1070,11 +1070,11 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
         spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
 #endif
 
+        unlock_policy_rwsem_write(cpu);
+
         if (cpufreq_driver->target)
                 __cpufreq_governor(data, CPUFREQ_GOV_STOP);
 
-        unlock_policy_rwsem_write(cpu);
-
         kobject_put(&data->kobj);
 
         /* we need to make sure that the underlying kobj is actually
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 2ecd95e4ab1..7a74d175287 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -91,6 +91,9 @@ static unsigned int dbs_enable;	/* number of CPUs using this policy */
  * (like __cpufreq_driver_target()) is being called with dbs_mutex taken, then
  * cpu_hotplug lock should be taken before that. Note that cpu_hotplug lock
  * is recursive for the same process. -Venki
+ * DEADLOCK ALERT! (2) : do_dbs_timer() must not take the dbs_mutex, because it
+ * would deadlock with cancel_delayed_work_sync(), which is needed for proper
+ * raceless workqueue teardown.
  */
 static DEFINE_MUTEX(dbs_mutex);
 
@@ -542,7 +545,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
         dbs_info->enable = 0;
-        cancel_delayed_work(&dbs_info->work);
+        cancel_delayed_work_sync(&dbs_info->work);
 }
 
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 338f428a15b..e741c339df7 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -98,6 +98,9 @@ static unsigned int dbs_enable;	/* number of CPUs using this policy */
  * (like __cpufreq_driver_target()) is being called with dbs_mutex taken, then
  * cpu_hotplug lock should be taken before that. Note that cpu_hotplug lock
  * is recursive for the same process. -Venki
+ * DEADLOCK ALERT! (2) : do_dbs_timer() must not take the dbs_mutex, because it
+ * would deadlock with cancel_delayed_work_sync(), which is needed for proper
+ * raceless workqueue teardown.
  */
 static DEFINE_MUTEX(dbs_mutex);
 
@@ -562,7 +565,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
         dbs_info->enable = 0;
-        cancel_delayed_work(&dbs_info->work);
+        cancel_delayed_work_sync(&dbs_info->work);
 }
 
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index f9f05d7a707..6c6656d3b1e 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -415,6 +415,7 @@ static void crypto_done_action(unsigned long arg)
 static int init_ixp_crypto(void)
 {
         int ret = -ENODEV;
+        u32 msg[2] = { 0, 0 };
 
         if (! ( ~(*IXP4XX_EXP_CFG2) & (IXP4XX_FEATURE_HASH |
                                 IXP4XX_FEATURE_AES | IXP4XX_FEATURE_DES))) {
@@ -426,9 +427,35 @@ static int init_ixp_crypto(void)
                 return ret;
 
         if (!npe_running(npe_c)) {
-                npe_load_firmware(npe_c, npe_name(npe_c), dev);
+                ret = npe_load_firmware(npe_c, npe_name(npe_c), dev);
+                if (ret) {
+                        return ret;
+                }
+                if (npe_recv_message(npe_c, msg, "STATUS_MSG"))
+                        goto npe_error;
+        } else {
+                if (npe_send_message(npe_c, msg, "STATUS_MSG"))
+                        goto npe_error;
+
+                if (npe_recv_message(npe_c, msg, "STATUS_MSG"))
+                        goto npe_error;
         }
 
+        switch ((msg[1]>>16) & 0xff) {
+        case 3:
+                printk(KERN_WARNING "Firmware of %s lacks AES support\n",
+                                npe_name(npe_c));
+                support_aes = 0;
+                break;
+        case 4:
+        case 5:
+                support_aes = 1;
+                break;
+        default:
+                printk(KERN_ERR "Firmware of %s lacks crypto support\n",
+                        npe_name(npe_c));
+                return -ENODEV;
+        }
         /* buffer_pool will also be used to sometimes store the hmac,
          * so assure it is large enough
          */
@@ -459,6 +486,10 @@ static int init_ixp_crypto(void)
 
         qmgr_enable_irq(RECV_QID);
         return 0;
+
+npe_error:
+        printk(KERN_ERR "%s not responding\n", npe_name(npe_c));
+        ret = -EIO;
 err:
         if (ctx_pool)
                 dma_pool_destroy(ctx_pool);
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 3f0fdd18255..856b3cc2558 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -489,4 +489,4 @@ MODULE_DESCRIPTION("VIA PadLock AES algorithm support");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michal Ludvig");
 
-MODULE_ALIAS("aes-all");
+MODULE_ALIAS("aes");
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 92438e9dacc..5a87384ea4f 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -804,11 +804,14 @@ dma_async_memcpy_buf_to_buf(struct dma_chan *chan, void *dest,
         dma_addr_t dma_dest, dma_src;
         dma_cookie_t cookie;
         int cpu;
+        unsigned long flags;
 
         dma_src = dma_map_single(dev->dev, src, len, DMA_TO_DEVICE);
         dma_dest = dma_map_single(dev->dev, dest, len, DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
-                                         DMA_CTRL_ACK);
+        flags = DMA_CTRL_ACK |
+                DMA_COMPL_SRC_UNMAP_SINGLE |
+                DMA_COMPL_DEST_UNMAP_SINGLE;
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
 
         if (!tx) {
                 dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
@@ -850,11 +853,12 @@ dma_async_memcpy_buf_to_pg(struct dma_chan *chan, struct page *page,
         dma_addr_t dma_dest, dma_src;
         dma_cookie_t cookie;
         int cpu;
+        unsigned long flags;
 
         dma_src = dma_map_single(dev->dev, kdata, len, DMA_TO_DEVICE);
         dma_dest = dma_map_page(dev->dev, page, offset, len, DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
-                                         DMA_CTRL_ACK);
+        flags = DMA_CTRL_ACK | DMA_COMPL_SRC_UNMAP_SINGLE;
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
 
         if (!tx) {
                 dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
@@ -898,12 +902,13 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
         dma_addr_t dma_dest, dma_src;
         dma_cookie_t cookie;
         int cpu;
+        unsigned long flags;
 
         dma_src = dma_map_page(dev->dev, src_pg, src_off, len, DMA_TO_DEVICE);
         dma_dest = dma_map_page(dev->dev, dest_pg, dest_off, len,
                                 DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
-                                         DMA_CTRL_ACK);
+        flags = DMA_CTRL_ACK;
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
 
         if (!tx) {
                 dma_unmap_page(dev->dev, dma_src, len, DMA_TO_DEVICE);
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index a27c0fb1bc1..fb7da5141e9 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -531,9 +531,7 @@ static int __init dmatest_init(void)
                 chan = dma_request_channel(mask, filter, NULL);
                 if (chan) {
                         err = dmatest_add_channel(chan);
-                        if (err == 0)
-                                continue;
-                        else {
+                        if (err) {
                                 dma_release_channel(chan);
                                 break; /* add_channel failed, punt */
                         }
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index da8a8ed9e41..f18d1bde043 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -179,9 +179,14 @@ static void dma_halt(struct fsl_dma_chan *fsl_chan)
 static void set_ld_eol(struct fsl_dma_chan *fsl_chan,
                         struct fsl_desc_sw *desc)
 {
+        u64 snoop_bits;
+
+        snoop_bits = ((fsl_chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_83XX)
+                ? FSL_DMA_SNEN : 0;
+
         desc->hw.next_ln_addr = CPU_TO_DMA(fsl_chan,
-                DMA_TO_CPU(fsl_chan, desc->hw.next_ln_addr, 64) | FSL_DMA_EOL,
-                64);
+                DMA_TO_CPU(fsl_chan, desc->hw.next_ln_addr, 64) | FSL_DMA_EOL
+                        | snoop_bits, 64);
 }
 
 static void append_ld_queue(struct fsl_dma_chan *fsl_chan,
@@ -313,8 +318,8 @@ static void fsl_chan_toggle_ext_start(struct fsl_dma_chan *fsl_chan, int enable)
 
 static dma_cookie_t fsl_dma_tx_submit(struct dma_async_tx_descriptor *tx)
 {
-        struct fsl_desc_sw *desc = tx_to_fsl_desc(tx);
         struct fsl_dma_chan *fsl_chan = to_fsl_chan(tx->chan);
+        struct fsl_desc_sw *desc;
         unsigned long flags;
         dma_cookie_t cookie;
 
@@ -322,14 +327,17 @@ static dma_cookie_t fsl_dma_tx_submit(struct dma_async_tx_descriptor *tx)
         spin_lock_irqsave(&fsl_chan->desc_lock, flags);
 
         cookie = fsl_chan->common.cookie;
-        cookie++;
-        if (cookie < 0)
-                cookie = 1;
-        desc->async_tx.cookie = cookie;
-        fsl_chan->common.cookie = desc->async_tx.cookie;
+        list_for_each_entry(desc, &tx->tx_list, node) {
+                cookie++;
+                if (cookie < 0)
+                        cookie = 1;
 
-        append_ld_queue(fsl_chan, desc);
-        list_splice_init(&desc->async_tx.tx_list, fsl_chan->ld_queue.prev);
+                desc->async_tx.cookie = cookie;
+        }
+
+        fsl_chan->common.cookie = cookie;
+        append_ld_queue(fsl_chan, tx_to_fsl_desc(tx));
+        list_splice_init(&tx->tx_list, fsl_chan->ld_queue.prev);
 
         spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
 
@@ -454,8 +462,8 @@ static struct dma_async_tx_descriptor *fsl_dma_prep_memcpy(
 {
         struct fsl_dma_chan *fsl_chan;
         struct fsl_desc_sw *first = NULL, *prev = NULL, *new;
+        struct list_head *list;
         size_t copy;
-        LIST_HEAD(link_chain);
 
         if (!chan)
                 return NULL;
@@ -472,7 +480,7 @@ static struct dma_async_tx_descriptor *fsl_dma_prep_memcpy(
                 if (!new) {
                         dev_err(fsl_chan->dev,
                                         "No free memory for link descriptor\n");
-                        return NULL;
+                        goto fail;
                 }
 #ifdef FSL_DMA_LD_DEBUG
                 dev_dbg(fsl_chan->dev, "new link desc alloc %p\n", new);
@@ -507,7 +515,19 @@ static struct dma_async_tx_descriptor *fsl_dma_prep_memcpy(
         /* Set End-of-link to the last link descriptor of new list*/
         set_ld_eol(fsl_chan, new);
 
-        return first ? &first->async_tx : NULL;
+        return &first->async_tx;
+
+fail:
+        if (!first)
+                return NULL;
+
+        list = &first->async_tx.tx_list;
+        list_for_each_entry_safe_reverse(new, prev, list, node) {
+                list_del(&new->node);
+                dma_pool_free(fsl_chan->desc_pool, new, new->async_tx.phys);
+        }
+
+        return NULL;
 }
 
 /**
@@ -598,15 +618,16 @@ static void fsl_chan_xfer_ld_queue(struct fsl_dma_chan *fsl_chan)
         dma_addr_t next_dest_addr;
         unsigned long flags;
 
+        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
+
         if (!dma_is_idle(fsl_chan))
-                return;
+                goto out_unlock;
 
         dma_halt(fsl_chan);
 
         /* If there are some link descriptors
          * not transfered in queue. We need to start it.
          */
-        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
 
         /* Find the first un-transfer desciptor */
         for (ld_node = fsl_chan->ld_queue.next;
@@ -617,19 +638,20 @@ static void fsl_chan_xfer_ld_queue(struct fsl_dma_chan *fsl_chan)
                                 fsl_chan->common.cookie) == DMA_SUCCESS);
                 ld_node = ld_node->next);
 
-        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
-
         if (ld_node != &fsl_chan->ld_queue) {
                 /* Get the ld start address from ld_queue */
                 next_dest_addr = to_fsl_desc(ld_node)->async_tx.phys;
-                dev_dbg(fsl_chan->dev, "xfer LDs staring from %p\n",
-                                (void *)next_dest_addr);
+                dev_dbg(fsl_chan->dev, "xfer LDs staring from 0x%llx\n",
+                                (unsigned long long)next_dest_addr);
                 set_cdar(fsl_chan, next_dest_addr);
                 dma_start(fsl_chan);
         } else {
                 set_cdar(fsl_chan, 0);
                 set_ndar(fsl_chan, 0);
         }
+
+out_unlock:
+        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
 }
 
 /**
@@ -734,8 +756,9 @@ static irqreturn_t fsl_dma_chan_do_interrupt(int irq, void *data)
          */
         if (stat & FSL_DMA_SR_EOSI) {
                 dev_dbg(fsl_chan->dev, "event: End-of-segments INT\n");
-                dev_dbg(fsl_chan->dev, "event: clndar %p, nlndar %p\n",
-                        (void *)get_cdar(fsl_chan), (void *)get_ndar(fsl_chan));
+                dev_dbg(fsl_chan->dev, "event: clndar 0x%llx, nlndar 0x%llx\n",
+                        (unsigned long long)get_cdar(fsl_chan),
+                        (unsigned long long)get_ndar(fsl_chan));
                 stat &= ~FSL_DMA_SR_EOSI;
                 update_cookie = 1;
         }
@@ -830,7 +853,7 @@ static int __devinit fsl_dma_chan_probe(struct fsl_dma_device *fdev,
                         new_fsl_chan->reg.end - new_fsl_chan->reg.start + 1);
 
         new_fsl_chan->id = ((new_fsl_chan->reg.start - 0x100) & 0xfff) >> 7;
-        if (new_fsl_chan->id > FSL_DMA_MAX_CHANS_PER_DEVICE) {
+        if (new_fsl_chan->id >= FSL_DMA_MAX_CHANS_PER_DEVICE) {
                 dev_err(fdev->dev, "There is no %d channel!\n",
                                 new_fsl_chan->id);
                 err = -EINVAL;
@@ -925,8 +948,8 @@ static int __devinit of_fsl_dma_probe(struct of_device *dev,
         }
 
         dev_info(&dev->dev, "Probe the Freescale DMA driver for %s "
-                        "controller at %p...\n",
-                        match->compatible, (void *)fdev->reg.start);
+                        "controller at 0x%llx...\n",
+                        match->compatible, (unsigned long long)fdev->reg.start);
         fdev->reg_base = ioremap(fdev->reg.start, fdev->reg.end
                                                 - fdev->reg.start + 1);
 
diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
index e4fc33c1c32..a600fc0f796 100644
--- a/drivers/dma/ioat_dma.c
+++ b/drivers/dma/ioat_dma.c
@@ -173,7 +173,7 @@ static int ioat_dma_enumerate_channels(struct ioatdma_device *device)
         xfercap = (xfercap_scale == 0 ? -1 : (1UL << xfercap_scale));
 
 #ifdef  CONFIG_I7300_IDLE_IOAT_CHANNEL
-        if (i7300_idle_platform_probe(NULL, NULL) == 0) {
+        if (i7300_idle_platform_probe(NULL, NULL, 1) == 0) {
                 device->common.chancnt--;
         }
 #endif
@@ -1063,22 +1063,31 @@ static void ioat_dma_cleanup_tasklet(unsigned long data)
 static void
 ioat_dma_unmap(struct ioat_dma_chan *ioat_chan, struct ioat_desc_sw *desc)
 {
-        /*
-         * yes we are unmapping both _page and _single
-         * alloc'd regions with unmap_page. Is this
-         * *really* that bad?
-         */
-        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP))
-                pci_unmap_page(ioat_chan->device->pdev,
-                                pci_unmap_addr(desc, dst),
-                                pci_unmap_len(desc, len),
-                                PCI_DMA_FROMDEVICE);
-
-        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP))
-                pci_unmap_page(ioat_chan->device->pdev,
-                                pci_unmap_addr(desc, src),
-                                pci_unmap_len(desc, len),
-                                PCI_DMA_TODEVICE);
+        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
+                if (desc->async_tx.flags & DMA_COMPL_DEST_UNMAP_SINGLE)
+                        pci_unmap_single(ioat_chan->device->pdev,
+                                         pci_unmap_addr(desc, dst),
+                                         pci_unmap_len(desc, len),
+                                         PCI_DMA_FROMDEVICE);
+                else
+                        pci_unmap_page(ioat_chan->device->pdev,
+                                       pci_unmap_addr(desc, dst),
+                                       pci_unmap_len(desc, len),
+                                       PCI_DMA_FROMDEVICE);
+        }
+
+        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
+                if (desc->async_tx.flags & DMA_COMPL_SRC_UNMAP_SINGLE)
+                        pci_unmap_single(ioat_chan->device->pdev,
+                                         pci_unmap_addr(desc, src),
+                                         pci_unmap_len(desc, len),
+                                         PCI_DMA_TODEVICE);
+                else
+                        pci_unmap_page(ioat_chan->device->pdev,
+                                       pci_unmap_addr(desc, src),
+                                       pci_unmap_len(desc, len),
+                                       PCI_DMA_TODEVICE);
+        }
 }
 
 /**
@@ -1363,6 +1372,7 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
         int err = 0;
         struct completion cmp;
         unsigned long tmo;
+        unsigned long flags;
 
         src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
         if (!src)
@@ -1392,8 +1402,9 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
                                  DMA_TO_DEVICE);
         dma_dest = dma_map_single(dma_chan->device->dev, dest, IOAT_TEST_SIZE,
                                   DMA_FROM_DEVICE);
+        flags = DMA_COMPL_SRC_UNMAP_SINGLE | DMA_COMPL_DEST_UNMAP_SINGLE;
         tx = device->common.device_prep_dma_memcpy(dma_chan, dma_dest, dma_src,
-                                                   IOAT_TEST_SIZE, 0);
+                                                   IOAT_TEST_SIZE, flags);
         if (!tx) {
                 dev_err(&device->pdev->dev,
                         "Self-test prep failed, disabling\n");
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index e202a6ce557..9a5bc1a7389 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -1272,7 +1272,8 @@ static irqreturn_t idmac_interrupt(int irq, void *dev_id)
         /* Other interrupts do not interfere with this channel */
         spin_lock(&ichan->lock);
         if (unlikely(chan_id != IDMAC_SDC_0 && chan_id != IDMAC_SDC_1 &&
-                     ((curbuf >> chan_id) & 1) == ichan->active_buffer)) {
+                     ((curbuf >> chan_id) & 1) == ichan->active_buffer &&
+                     !list_is_last(ichan->queue.next, &ichan->queue))) {
                 int i = 100;
 
                 /* This doesn't help. See comment in ipu_disable_channel() */
@@ -1547,7 +1548,7 @@ static irqreturn_t ic_sof_irq(int irq, void *dev_id)
         struct idmac_channel *ichan = dev_id;
         printk(KERN_DEBUG "Got SOF IRQ %d on Channel %d\n",
                irq, ichan->dma_chan.chan_id);
-        disable_irq(irq);
+        disable_irq_nosync(irq);
         return IRQ_HANDLED;
 }
 
@@ -1556,7 +1557,7 @@ static irqreturn_t ic_eof_irq(int irq, void *dev_id)
         struct idmac_channel *ichan = dev_id;
         printk(KERN_DEBUG "Got EOF IRQ %d on Channel %d\n",
                irq, ichan->dma_chan.chan_id);
-        disable_irq(irq);
+        disable_irq_nosync(irq);
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index e5f5c5a8ba6..956982f8739 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -192,16 +192,20 @@ config EDAC_PPC4XX
 
 config EDAC_AMD8131
         tristate "AMD8131 HyperTransport PCI-X Tunnel"
-        depends on EDAC_MM_EDAC && PCI
+        depends on EDAC_MM_EDAC && PCI && PPC_MAPLE
         help
           Support for error detection and correction on the
           AMD8131 HyperTransport PCI-X Tunnel chip.
+          Note, add more Kconfig dependency if it's adopted
+          on some machine other than Maple.
 
 config EDAC_AMD8111
         tristate "AMD8111 HyperTransport I/O Hub"
-        depends on EDAC_MM_EDAC && PCI
+        depends on EDAC_MM_EDAC && PCI && PPC_MAPLE
         help
           Support for error detection and correction on the
           AMD8111 HyperTransport I/O Hub chip.
+          Note, add more Kconfig dependency if it's adopted
+          on some machine other than Maple.
 
 endif # EDAC
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index a5fdcf02f59..59076819135 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -35,3 +35,5 @@ obj-$(CONFIG_EDAC_MPC85XX)		+= mpc85xx_edac.o
 obj-$(CONFIG_EDAC_MV64X60)              += mv64x60_edac.o
 obj-$(CONFIG_EDAC_CELL)                 += cell_edac.o
 obj-$(CONFIG_EDAC_PPC4XX)               += ppc4xx_edac.o
+obj-$(CONFIG_EDAC_AMD8111)              += amd8111_edac.o
+obj-$(CONFIG_EDAC_AMD8131)              += amd8131_edac.o
diff --git a/drivers/edac/amd8111_edac.c b/drivers/edac/amd8111_edac.c
index 61469218112..2cb58ef743e 100644
--- a/drivers/edac/amd8111_edac.c
+++ b/drivers/edac/amd8111_edac.c
@@ -389,7 +389,7 @@ static int amd8111_dev_probe(struct pci_dev *dev,
         dev_info->edac_dev->dev = &dev_info->dev->dev;
         dev_info->edac_dev->mod_name = AMD8111_EDAC_MOD_STR;
         dev_info->edac_dev->ctl_name = dev_info->ctl_name;
-        dev_info->edac_dev->dev_name = dev_info->dev->dev.bus_id;
+        dev_info->edac_dev->dev_name = dev_name(&dev_info->dev->dev);
 
         if (edac_op_state == EDAC_OPSTATE_POLL)
                 dev_info->edac_dev->edac_check = dev_info->check;
@@ -473,7 +473,7 @@ static int amd8111_pci_probe(struct pci_dev *dev,
         pci_info->edac_dev->dev = &pci_info->dev->dev;
         pci_info->edac_dev->mod_name = AMD8111_EDAC_MOD_STR;
         pci_info->edac_dev->ctl_name = pci_info->ctl_name;
-        pci_info->edac_dev->dev_name = pci_info->dev->dev.bus_id;
+        pci_info->edac_dev->dev_name = dev_name(&pci_info->dev->dev);
 
         if (edac_op_state == EDAC_OPSTATE_POLL)
                 pci_info->edac_dev->edac_check = pci_info->check;
diff --git a/drivers/edac/amd8131_edac.c b/drivers/edac/amd8131_edac.c
index c083b31cac5..b432d60c622 100644
--- a/drivers/edac/amd8131_edac.c
+++ b/drivers/edac/amd8131_edac.c
@@ -287,7 +287,7 @@ static int amd8131_probe(struct pci_dev *dev, const struct pci_device_id *id)
         dev_info->edac_dev->dev = &dev_info->dev->dev;
         dev_info->edac_dev->mod_name = AMD8131_EDAC_MOD_STR;
         dev_info->edac_dev->ctl_name = dev_info->ctl_name;
-        dev_info->edac_dev->dev_name = dev_info->dev->dev.bus_id;
+        dev_info->edac_dev->dev_name = dev_name(&dev_info->dev->dev);
 
         if (edac_op_state == EDAC_OPSTATE_POLL)
                 dev_info->edac_dev->edac_check = amd8131_chipset.check;
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 3a22eb9be37..f5d46e7199d 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -67,11 +67,18 @@ config DRM_I830
           will load the correct one.
 
 config DRM_I915
+        tristate "i915 driver"
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
         select FB
-        tristate "i915 driver"
+        select FRAMEBUFFER_CONSOLE if !EMBEDDED
+        # i915 depends on ACPI_VIDEO when ACPI is enabled
+        # but for select to work, need to select ACPI_VIDEO's dependencies, ick
+        select VIDEO_OUTPUT_CONTROL if ACPI
+        select BACKLIGHT_CLASS_DEVICE if ACPI
+        select INPUT if ACPI
+        select ACPI_VIDEO if ACPI
         help
           Choose this option if you have a system that has Intel 830M, 845G,
           852GM, 855GM 865G or 915G integrated graphics.  If M is selected, the
diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
index 6d80d17f1e9..0411d912d82 100644
--- a/drivers/gpu/drm/drm_bufs.c
+++ b/drivers/gpu/drm/drm_bufs.c
@@ -170,6 +170,14 @@ static int drm_addmap_core(struct drm_device * dev, resource_size_t offset,
         }
         DRM_DEBUG("offset = 0x%08llx, size = 0x%08lx, type = %d\n",
                   (unsigned long long)map->offset, map->size, map->type);
+
+        /* page-align _DRM_SHM maps. They are allocated here so there is no security
+         * hole created by that and it works around various broken drivers that use
+         * a non-aligned quantity to map the SAREA. --BenH
+         */
+        if (map->type == _DRM_SHM)
+                map->size = PAGE_ALIGN(map->size);
+
         if ((map->offset & (~(resource_size_t)PAGE_MASK)) || (map->size & (~PAGE_MASK))) {
                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 94a76887173..8fab7890a36 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2294,7 +2294,12 @@ int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
                 }
         }
 
-        if (connector->funcs->set_property)
+        /* Do DPMS ourselves */
+        if (property == connector->dev->mode_config.dpms_property) {
+                if (connector->funcs->dpms)
+                        (*connector->funcs->dpms)(connector, (int) out_resp->value);
+                ret = 0;
+        } else if (connector->funcs->set_property)
                 ret = connector->funcs->set_property(connector, property, out_resp->value);
 
         /* store the property value if succesful */
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 45890447fee..a6f73f1e99d 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -199,6 +199,29 @@ static void drm_helper_add_std_modes(struct drm_device *dev,
 }
 
 /**
+ * drm_helper_encoder_in_use - check if a given encoder is in use
+ * @encoder: encoder to check
+ *
+ * LOCKING:
+ * Caller must hold mode config lock.
+ *
+ * Walk @encoders's DRM device's mode_config and see if it's in use.
+ *
+ * RETURNS:
+ * True if @encoder is part of the mode_config, false otherwise.
+ */
+bool drm_helper_encoder_in_use(struct drm_encoder *encoder)
+{
+        struct drm_connector *connector;
+        struct drm_device *dev = encoder->dev;
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head)
+                if (connector->encoder == encoder)
+                        return true;
+        return false;
+}
+EXPORT_SYMBOL(drm_helper_encoder_in_use);
+
+/**
  * drm_helper_crtc_in_use - check if a given CRTC is in a mode_config
  * @crtc: CRTC to check
  *
@@ -216,7 +239,7 @@ bool drm_helper_crtc_in_use(struct drm_crtc *crtc)
         struct drm_device *dev = crtc->dev;
         /* FIXME: Locking around list access? */
         list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
-                if (encoder->crtc == crtc)
+                if (encoder->crtc == crtc && drm_helper_encoder_in_use(encoder))
                         return true;
         return false;
 }
@@ -240,7 +263,7 @@ void drm_helper_disable_unused_functions(struct drm_device *dev)
 
         list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
                 encoder_funcs = encoder->helper_private;
-                if (!encoder->crtc)
+                if (!drm_helper_encoder_in_use(encoder))
                         (*encoder_funcs->dpms)(encoder, DRM_MODE_DPMS_OFF);
         }
 
@@ -935,6 +958,88 @@ bool drm_helper_initial_config(struct drm_device *dev)
 }
 EXPORT_SYMBOL(drm_helper_initial_config);
 
+static int drm_helper_choose_encoder_dpms(struct drm_encoder *encoder)
+{
+        int dpms = DRM_MODE_DPMS_OFF;
+        struct drm_connector *connector;
+        struct drm_device *dev = encoder->dev;
+
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head)
+                if (connector->encoder == encoder)
+                        if (connector->dpms < dpms)
+                                dpms = connector->dpms;
+        return dpms;
+}
+
+static int drm_helper_choose_crtc_dpms(struct drm_crtc *crtc)
+{
+        int dpms = DRM_MODE_DPMS_OFF;
+        struct drm_connector *connector;
+        struct drm_device *dev = crtc->dev;
+
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head)
+                if (connector->encoder && connector->encoder->crtc == crtc)
+                        if (connector->dpms < dpms)
+                                dpms = connector->dpms;
+        return dpms;
+}
+
+/**
+ * drm_helper_connector_dpms
+ * @connector affected connector
+ * @mode DPMS mode
+ *
+ * Calls the low-level connector DPMS function, then
+ * calls appropriate encoder and crtc DPMS functions as well
+ */
+void drm_helper_connector_dpms(struct drm_connector *connector, int mode)
+{
+        struct drm_encoder *encoder = connector->encoder;
+        struct drm_crtc *crtc = encoder ? encoder->crtc : NULL;
+        int old_dpms;
+
+        if (mode == connector->dpms)
+                return;
+
+        old_dpms = connector->dpms;
+        connector->dpms = mode;
+
+        /* from off to on, do crtc then encoder */
+        if (mode < old_dpms) {
+                if (crtc) {
+                        struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
+                        if (crtc_funcs->dpms)
+                                (*crtc_funcs->dpms) (crtc,
+                                                     drm_helper_choose_crtc_dpms(crtc));
+                }
+                if (encoder) {
+                        struct drm_encoder_helper_funcs *encoder_funcs = encoder->helper_private;
+                        if (encoder_funcs->dpms)
+                                (*encoder_funcs->dpms) (encoder,
+                                                        drm_helper_choose_encoder_dpms(encoder));
+                }
+        }
+
+        /* from on to off, do encoder then crtc */
+        if (mode > old_dpms) {
+                if (encoder) {
+                        struct drm_encoder_helper_funcs *encoder_funcs = encoder->helper_private;
+                        if (encoder_funcs->dpms)
+                                (*encoder_funcs->dpms) (encoder,
+                                                        drm_helper_choose_encoder_dpms(encoder));
+                }
+                if (crtc) {
+                        struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
+                        if (crtc_funcs->dpms)
+                                (*crtc_funcs->dpms) (crtc,
+                                                     drm_helper_choose_crtc_dpms(crtc));
+                }
+        }
+
+        return;
+}
+EXPORT_SYMBOL(drm_helper_connector_dpms);
+
 /**
  * drm_hotplug_stage_two
  * @dev DRM device
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index f01def16a66..019b7c57823 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -481,7 +481,7 @@ int drm_ioctl(struct inode *inode, struct file *filp,
                 }
                 retcode = func(dev, kdata, file_priv);
 
-                if ((retcode == 0) && (cmd & IOC_OUT)) {
+                if (cmd & IOC_OUT) {
                         if (copy_to_user((void __user *)arg, kdata,
                                          _IOC_SIZE(cmd)) != 0)
                                 retcode = -EFAULT;
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index ca9c6165671..6f6b26479d8 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -289,6 +289,11 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
         struct drm_display_mode *mode;
         struct detailed_pixel_timing *pt = &timing->data.pixel_data;
 
+        /* ignore tiny modes */
+        if (((pt->hactive_hi << 8) | pt->hactive_lo) < 64 ||
+            ((pt->vactive_hi << 8) | pt->hactive_lo) < 64)
+                return NULL;
+
         if (pt->stereo) {
                 printk(KERN_WARNING "stereo mode not supported\n");
                 return NULL;
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 93e677a481f..fc8e5acd9d9 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -196,6 +196,7 @@ int drm_irq_install(struct drm_device *dev)
 {
         int ret = 0;
         unsigned long sh_flags = 0;
+        char *irqname;
 
         if (!drm_core_check_feature(dev, DRIVER_HAVE_IRQ))
                 return -EINVAL;
@@ -227,8 +228,13 @@ int drm_irq_install(struct drm_device *dev)
         if (drm_core_check_feature(dev, DRIVER_IRQ_SHARED))
                 sh_flags = IRQF_SHARED;
 
+        if (dev->devname)
+                irqname = dev->devname;
+        else
+                irqname = dev->driver->name;
+
         ret = request_irq(drm_dev_to_irq(dev), dev->driver->irq_handler,
-                          sh_flags, dev->devname, dev);
+                          sh_flags, irqname, dev);
 
         if (ret < 0) {
                 mutex_lock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 8f9372921f8..9987ab88083 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -147,7 +147,7 @@ static ssize_t status_show(struct device *device,
         enum drm_connector_status status;
 
         status = connector->funcs->detect(connector);
-        return snprintf(buf, PAGE_SIZE, "%s",
+        return snprintf(buf, PAGE_SIZE, "%s\n",
                         drm_get_connector_status_name(status));
 }
 
@@ -166,7 +166,7 @@ static ssize_t dpms_show(struct device *device,
         if (ret)
                 return 0;
 
-        return snprintf(buf, PAGE_SIZE, "%s",
+        return snprintf(buf, PAGE_SIZE, "%s\n",
                         drm_get_dpms_name((int)dpms_status));
 }
 
@@ -176,7 +176,7 @@ static ssize_t enabled_show(struct device *device,
 {
         struct drm_connector *connector = to_drm_connector(device);
 
-        return snprintf(buf, PAGE_SIZE, connector->encoder ? "enabled" :
+        return snprintf(buf, PAGE_SIZE, "%s\n", connector->encoder ? "enabled" :
                         "disabled");
 }
 
@@ -317,6 +317,7 @@ static struct device_attribute connector_attrs_opt1[] = {
 
 static struct bin_attribute edid_attr = {
         .attr.name = "edid",
+        .attr.mode = 0444,
         .size = 128,
         .read = edid_show,
 };
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 051134c56ae..0ccb63ee50e 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -987,12 +987,6 @@ static int i915_load_modeset_init(struct drm_device *dev)
         int fb_bar = IS_I9XX(dev) ? 2 : 0;
         int ret = 0;
 
-        dev->devname = kstrdup(DRIVER_NAME, GFP_KERNEL);
-        if (!dev->devname) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
         dev->mode_config.fb_base = drm_get_resource_start(dev, fb_bar) &
                 0xff000000;
 
@@ -1006,17 +1000,25 @@ static int i915_load_modeset_init(struct drm_device *dev)
 
         ret = i915_probe_agp(dev, &agp_size, &prealloc_size);
         if (ret)
-                goto kfree_devname;
+                goto out;
 
         /* Basic memrange allocator for stolen space (aka vram) */
         drm_mm_init(&dev_priv->vram, 0, prealloc_size);
 
-        /* Let GEM Manage from end of prealloc space to end of aperture */
-        i915_gem_do_init(dev, prealloc_size, agp_size);
+        /* Let GEM Manage from end of prealloc space to end of aperture.
+         *
+         * However, leave one page at the end still bound to the scratch page.
+         * There are a number of places where the hardware apparently
+         * prefetches past the end of the object, and we've seen multiple
+         * hangs with the GPU head pointer stuck in a batchbuffer bound
+         * at the last page of the aperture.  One page should be enough to
+         * keep any prefetching inside of the aperture.
+         */
+        i915_gem_do_init(dev, prealloc_size, agp_size - 4096);
 
         ret = i915_gem_init_ringbuffer(dev);
         if (ret)
-                goto kfree_devname;
+                goto out;
 
         /* Allow hardware batchbuffers unless told otherwise.
          */
@@ -1048,8 +1050,6 @@ static int i915_load_modeset_init(struct drm_device *dev)
 
 destroy_ringbuffer:
         i915_gem_cleanup_ringbuffer(dev);
-kfree_devname:
-        kfree(dev->devname);
 out:
         return ret;
 }
@@ -1350,6 +1350,7 @@ struct drm_ioctl_desc i915_ioctls[] = {
         DRM_IOCTL_DEF(DRM_I915_GEM_SET_TILING, i915_gem_set_tiling, 0),
         DRM_IOCTL_DEF(DRM_I915_GEM_GET_TILING, i915_gem_get_tiling, 0),
         DRM_IOCTL_DEF(DRM_I915_GEM_GET_APERTURE, i915_gem_get_aperture_ioctl, 0),
+        DRM_IOCTL_DEF(DRM_I915_GET_PIPE_FROM_CRTC_ID, intel_get_pipe_from_crtc_id, 0),
 };
 
 int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 25065923b8a..c431fa54bbb 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -180,7 +180,8 @@ typedef struct drm_i915_private {
         int backlight_duty_cycle;  /* restore backlight to this value */
         bool panel_wants_dither;
         struct drm_display_mode *panel_fixed_mode;
-        struct drm_display_mode *vbt_mode; /* if any */
+        struct drm_display_mode *lfp_lvds_vbt_mode; /* if any */
+        struct drm_display_mode *sdvo_lvds_vbt_mode; /* if any */
 
         /* Feature bits from the VBIOS */
         unsigned int int_tv_support:1;
@@ -283,6 +284,7 @@ typedef struct drm_i915_private {
         u8 saveAR[21];
         u8 saveDACMASK;
         u8 saveCR[37];
+        uint64_t saveFENCE[16];
 
         struct {
                 struct drm_mm gtt_space;
@@ -705,13 +707,8 @@ extern void intel_modeset_cleanup(struct drm_device *dev);
 #define I915_WRITE16(reg, val)  writel(val, dev_priv->regs + (reg))
 #define I915_READ8(reg)         readb(dev_priv->regs + (reg))
 #define I915_WRITE8(reg, val)   writeb(val, dev_priv->regs + (reg))
-#ifdef writeq
 #define I915_WRITE64(reg, val)  writeq(val, dev_priv->regs + (reg))
-#else
-#define I915_WRITE64(reg, val)  (writel(val, dev_priv->regs + (reg)), \
-                                 writel(upper_32_bits(val), dev_priv->regs + \
-                                        (reg) + 4))
-#endif
+#define I915_READ64(reg)        readq(dev_priv->regs + (reg))
 #define POSTING_READ(reg)       (void)I915_READ(reg)
 
 #define I915_VERBOSE 0
@@ -790,7 +787,8 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
                        (dev)->pci_device == 0x2E22 || \
                        (dev)->pci_device == 0x2E32)
 
-#define IS_I965GM(dev) ((dev)->pci_device == 0x2A02)
+#define IS_I965GM(dev) ((dev)->pci_device == 0x2A02 || \
+                        (dev)->pci_device == 0x2A12)
 
 #define IS_GM45(dev) ((dev)->pci_device == 0x2A42)
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index ee896d91c5b..39f5c658ef5 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -349,7 +349,7 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
         last_data_page = (data_ptr + args->size - 1) / PAGE_SIZE;
         num_pages = last_data_page - first_data_page + 1;
 
-        user_pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
+        user_pages = drm_calloc_large(num_pages, sizeof(struct page *));
         if (user_pages == NULL)
                 return -ENOMEM;
 
@@ -429,7 +429,7 @@ fail_put_user_pages:
                 SetPageDirty(user_pages[i]);
                 page_cache_release(user_pages[i]);
         }
-        kfree(user_pages);
+        drm_free_large(user_pages);
 
         return ret;
 }
@@ -649,7 +649,7 @@ i915_gem_gtt_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
         last_data_page = (data_ptr + args->size - 1) / PAGE_SIZE;
         num_pages = last_data_page - first_data_page + 1;
 
-        user_pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
+        user_pages = drm_calloc_large(num_pages, sizeof(struct page *));
         if (user_pages == NULL)
                 return -ENOMEM;
 
@@ -719,7 +719,7 @@ out_unlock:
 out_unpin_pages:
         for (i = 0; i < pinned_pages; i++)
                 page_cache_release(user_pages[i]);
-        kfree(user_pages);
+        drm_free_large(user_pages);
 
         return ret;
 }
@@ -824,7 +824,7 @@ i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
         last_data_page = (data_ptr + args->size - 1) / PAGE_SIZE;
         num_pages = last_data_page - first_data_page + 1;
 
-        user_pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
+        user_pages = drm_calloc_large(num_pages, sizeof(struct page *));
         if (user_pages == NULL)
                 return -ENOMEM;
 
@@ -902,7 +902,7 @@ fail_unlock:
 fail_put_user_pages:
         for (i = 0; i < pinned_pages; i++)
                 page_cache_release(user_pages[i]);
-        kfree(user_pages);
+        drm_free_large(user_pages);
 
         return ret;
 }
@@ -1145,7 +1145,14 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                         mutex_unlock(&dev->struct_mutex);
                         return VM_FAULT_SIGBUS;
                 }
-                list_add(&obj_priv->list, &dev_priv->mm.inactive_list);
+
+                ret = i915_gem_object_set_to_gtt_domain(obj, write);
+                if (ret) {
+                        mutex_unlock(&dev->struct_mutex);
+                        return VM_FAULT_SIGBUS;
+                }
+
+                list_add_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
         }
 
         /* Need a new fence register? */
@@ -1375,7 +1382,7 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
                         mutex_unlock(&dev->struct_mutex);
                         return ret;
                 }
-                list_add(&obj_priv->list, &dev_priv->mm.inactive_list);
+                list_add_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
         }
 
         drm_gem_object_unreference(obj);
@@ -1408,9 +1415,7 @@ i915_gem_object_put_pages(struct drm_gem_object *obj)
                 }
         obj_priv->dirty = 0;
 
-        drm_free(obj_priv->pages,
-                 page_count * sizeof(struct page *),
-                 DRM_MEM_DRIVER);
+        drm_free_large(obj_priv->pages);
         obj_priv->pages = NULL;
 }
 
@@ -1691,11 +1696,20 @@ static int
 i915_wait_request(struct drm_device *dev, uint32_t seqno)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
+        u32 ier;
         int ret = 0;
 
         BUG_ON(seqno == 0);
 
         if (!i915_seqno_passed(i915_get_gem_seqno(dev), seqno)) {
+                ier = I915_READ(IER);
+                if (!ier) {
+                        DRM_ERROR("something (likely vbetool) disabled "
+                                  "interrupts, re-enabling\n");
+                        i915_driver_irq_preinstall(dev);
+                        i915_driver_irq_postinstall(dev);
+                }
+
                 dev_priv->mm.waiting_gem_seqno = seqno;
                 i915_user_irq_get(dev);
                 ret = wait_event_interruptible(dev_priv->irq_queue,
@@ -2015,8 +2029,7 @@ i915_gem_object_get_pages(struct drm_gem_object *obj)
          */
         page_count = obj->size / PAGE_SIZE;
         BUG_ON(obj_priv->pages != NULL);
-        obj_priv->pages = drm_calloc(page_count, sizeof(struct page *),
-                                     DRM_MEM_DRIVER);
+        obj_priv->pages = drm_calloc_large(page_count, sizeof(struct page *));
         if (obj_priv->pages == NULL) {
                 DRM_ERROR("Faled to allocate page list\n");
                 obj_priv->pages_refcount--;
@@ -2122,8 +2135,10 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
                 return;
         }
 
-        pitch_val = (obj_priv->stride / 128) - 1;
-        WARN_ON(pitch_val & ~0x0000000f);
+        pitch_val = obj_priv->stride / 128;
+        pitch_val = ffs(pitch_val) - 1;
+        WARN_ON(pitch_val > I830_FENCE_MAX_PITCH_VAL);
+
         val = obj_priv->gtt_offset;
         if (obj_priv->tiling_mode == I915_TILING_Y)
                 val |= 1 << I830_FENCE_TILING_Y_SHIFT;
@@ -2245,9 +2260,6 @@ try_again:
                         goto try_again;
                 }
 
-                BUG_ON(old_obj_priv->active ||
-                       (reg->obj->write_domain & I915_GEM_GPU_DOMAINS));
-
                 /*
                  * Zap this virtual mapping so we can set up a fence again
                  * for this object next time we need it.
@@ -2415,6 +2427,16 @@ i915_gem_clflush_object(struct drm_gem_object *obj)
         if (obj_priv->pages == NULL)
                 return;
 
+        /* XXX: The 865 in particular appears to be weird in how it handles
+         * cache flushing.  We haven't figured it out, but the
+         * clflush+agp_chipset_flush doesn't appear to successfully get the
+         * data visible to the PGU, while wbinvd + agp_chipset_flush does.
+         */
+        if (IS_I865G(obj->dev)) {
+                wbinvd();
+                return;
+        }
+
         drm_clflush_pages(obj_priv->pages, obj->size / PAGE_SIZE);
 }
 
@@ -3102,7 +3124,7 @@ i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
                 reloc_count += exec_list[i].relocation_count;
         }
 
-        *relocs = drm_calloc(reloc_count, sizeof(**relocs), DRM_MEM_DRIVER);
+        *relocs = drm_calloc_large(reloc_count, sizeof(**relocs));
         if (*relocs == NULL)
                 return -ENOMEM;
 
@@ -3116,8 +3138,7 @@ i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
                                      exec_list[i].relocation_count *
                                      sizeof(**relocs));
                 if (ret != 0) {
-                        drm_free(*relocs, reloc_count * sizeof(**relocs),
-                                 DRM_MEM_DRIVER);
+                        drm_free_large(*relocs);
                         *relocs = NULL;
                         return -EFAULT;
                 }
@@ -3156,7 +3177,7 @@ i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object *exec_list,
         }
 
 err:
-        drm_free(relocs, reloc_count * sizeof(*relocs), DRM_MEM_DRIVER);
+        drm_free_large(relocs);
 
         return ret;
 }
@@ -3189,10 +3210,8 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
                 return -EINVAL;
         }
         /* Copy in the exec list from userland */
-        exec_list = drm_calloc(sizeof(*exec_list), args->buffer_count,
-                               DRM_MEM_DRIVER);
-        object_list = drm_calloc(sizeof(*object_list), args->buffer_count,
-                                 DRM_MEM_DRIVER);
+        exec_list = drm_calloc_large(sizeof(*exec_list), args->buffer_count);
+        object_list = drm_calloc_large(sizeof(*object_list), args->buffer_count);
         if (exec_list == NULL || object_list == NULL) {
                 DRM_ERROR("Failed to allocate exec or object list "
                           "for %d buffers\n",
@@ -3453,10 +3472,8 @@ err:
         }
 
 pre_mutex_err:
-        drm_free(object_list, sizeof(*object_list) * args->buffer_count,
-                 DRM_MEM_DRIVER);
-        drm_free(exec_list, sizeof(*exec_list) * args->buffer_count,
-                 DRM_MEM_DRIVER);
+        drm_free_large(object_list);
+        drm_free_large(exec_list);
         drm_free(cliprects, sizeof(*cliprects) * args->num_cliprects,
                  DRM_MEM_DRIVER);
 
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 52a059354e8..540dd336e6e 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -213,7 +213,8 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
         if (tiling_mode == I915_TILING_NONE)
                 return true;
 
-        if (tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev))
+        if (!IS_I9XX(dev) ||
+            (tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev)))
                 tile_width = 128;
         else
                 tile_width = 512;
@@ -225,11 +226,18 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
                 if (stride / 128 > I965_FENCE_MAX_PITCH_VAL)
                         return false;
         } else if (IS_I9XX(dev)) {
-                if (stride / tile_width > I830_FENCE_MAX_PITCH_VAL ||
+                uint32_t pitch_val = ffs(stride / tile_width) - 1;
+
+                /* XXX: For Y tiling, FENCE_MAX_PITCH_VAL is actually 6 (8KB)
+                 * instead of 4 (2KB) on 945s.
+                 */
+                if (pitch_val > I915_FENCE_MAX_PITCH_VAL ||
                     size > (I830_FENCE_MAX_SIZE_VAL << 20))
                         return false;
         } else {
-                if (stride / 128 > I830_FENCE_MAX_PITCH_VAL ||
+                uint32_t pitch_val = ffs(stride / tile_width) - 1;
+
+                if (pitch_val > I830_FENCE_MAX_PITCH_VAL ||
                     size > (I830_FENCE_MAX_SIZE_VAL << 19))
                         return false;
         }
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 52119473226..375569d01d0 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -190,7 +190,8 @@
 #define   I830_FENCE_SIZE_BITS(size)    ((ffs((size) >> 19) - 1) << 8)
 #define   I830_FENCE_PITCH_SHIFT        4
 #define   I830_FENCE_REG_VALID          (1<<0)
-#define   I830_FENCE_MAX_PITCH_VAL      0x10
+#define   I915_FENCE_MAX_PITCH_VAL      0x10
+#define   I830_FENCE_MAX_PITCH_VAL      6
 #define   I830_FENCE_MAX_SIZE_VAL       (1<<8)
 
 #define   I915_FENCE_START_MASK         0x0ff00000
@@ -526,6 +527,7 @@
 #define   DPLLA_INPUT_BUFFER_ENABLE     (1 << 0)
 #define D_STATE         0x6104
 #define CG_2D_DIS       0x6200
+#define DPCUNIT_CLOCK_GATE_DISABLE      (1 << 24)
 #define CG_3D_DIS       0x6204
 
 /*
@@ -1409,9 +1411,25 @@
 
 /* Cursor A & B regs */
 #define CURACNTR                0x70080
+/* Old style CUR*CNTR flags (desktop 8xx) */
+#define   CURSOR_ENABLE         0x80000000
+#define   CURSOR_GAMMA_ENABLE   0x40000000
+#define   CURSOR_STRIDE_MASK    0x30000000
+#define   CURSOR_FORMAT_SHIFT   24
+#define   CURSOR_FORMAT_MASK    (0x07 << CURSOR_FORMAT_SHIFT)
+#define   CURSOR_FORMAT_2C      (0x00 << CURSOR_FORMAT_SHIFT)
+#define   CURSOR_FORMAT_3C      (0x01 << CURSOR_FORMAT_SHIFT)
+#define   CURSOR_FORMAT_4C      (0x02 << CURSOR_FORMAT_SHIFT)
+#define   CURSOR_FORMAT_ARGB    (0x04 << CURSOR_FORMAT_SHIFT)
+#define   CURSOR_FORMAT_XRGB    (0x05 << CURSOR_FORMAT_SHIFT)
+/* New style CUR*CNTR flags */
+#define   CURSOR_MODE           0x27
 #define   CURSOR_MODE_DISABLE   0x00
 #define   CURSOR_MODE_64_32B_AX 0x07
 #define   CURSOR_MODE_64_ARGB_AX ((1 << 5) | CURSOR_MODE_64_32B_AX)
+#define   MCURSOR_PIPE_SELECT   (1 << 28)
+#define   MCURSOR_PIPE_A        0x00
+#define   MCURSOR_PIPE_B        (1 << 28)
 #define   MCURSOR_GAMMA_ENABLE  (1 << 26)
 #define CURABASE                0x70084
 #define CURAPOS                 0x70088
@@ -1419,6 +1437,7 @@
 #define   CURSOR_POS_SIGN       0x8000
 #define   CURSOR_X_SHIFT        0
 #define   CURSOR_Y_SHIFT        16
+#define CURSIZE                 0x700a0
 #define CURBCNTR                0x700c0
 #define CURBBASE                0x700c4
 #define CURBPOS                 0x700c8
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index d669cc2b42c..ce8a21344a7 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -349,6 +349,18 @@ int i915_save_state(struct drm_device *dev)
         for (i = 0; i < 3; i++)
                 dev_priv->saveSWF2[i] = I915_READ(SWF30 + (i << 2));
 
+        /* Fences */
+        if (IS_I965G(dev)) {
+                for (i = 0; i < 16; i++)
+                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_965_0 + (i * 8));
+        } else {
+                for (i = 0; i < 8; i++)
+                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
+
+                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
+                        for (i = 0; i < 8; i++)
+                                dev_priv->saveFENCE[i+8] = I915_READ(FENCE_REG_945_8 + (i * 4));
+        }
         i915_save_vga(dev);
 
         return 0;
@@ -371,6 +383,18 @@ int i915_restore_state(struct drm_device *dev)
         /* Display arbitration */
         I915_WRITE(DSPARB, dev_priv->saveDSPARB);
 
+        /* Fences */
+        if (IS_I965G(dev)) {
+                for (i = 0; i < 16; i++)
+                        I915_WRITE64(FENCE_REG_965_0 + (i * 8), dev_priv->saveFENCE[i]);
+        } else {
+                for (i = 0; i < 8; i++)
+                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
+                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
+                        for (i = 0; i < 8; i++)
+                                I915_WRITE(FENCE_REG_945_8 + (i * 4), dev_priv->saveFENCE[i+8]);
+        }
+
         /* Pipe & plane A info */
         /* Prime the clock */
         if (dev_priv->saveDPLL_A & DPLL_VCO_ENABLE) {
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index fc28e2bbd54..9d78cff33b2 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -57,9 +57,43 @@ find_section(struct bdb_header *bdb, int section_id)
         return NULL;
 }
 
-/* Try to find panel data */
 static void
-parse_panel_data(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
+fill_detail_timing_data(struct drm_display_mode *panel_fixed_mode,
+                        struct lvds_dvo_timing *dvo_timing)
+{
+        panel_fixed_mode->hdisplay = (dvo_timing->hactive_hi << 8) |
+                dvo_timing->hactive_lo;
+        panel_fixed_mode->hsync_start = panel_fixed_mode->hdisplay +
+                ((dvo_timing->hsync_off_hi << 8) | dvo_timing->hsync_off_lo);
+        panel_fixed_mode->hsync_end = panel_fixed_mode->hsync_start +
+                dvo_timing->hsync_pulse_width;
+        panel_fixed_mode->htotal = panel_fixed_mode->hdisplay +
+                ((dvo_timing->hblank_hi << 8) | dvo_timing->hblank_lo);
+
+        panel_fixed_mode->vdisplay = (dvo_timing->vactive_hi << 8) |
+                dvo_timing->vactive_lo;
+        panel_fixed_mode->vsync_start = panel_fixed_mode->vdisplay +
+                dvo_timing->vsync_off;
+        panel_fixed_mode->vsync_end = panel_fixed_mode->vsync_start +
+                dvo_timing->vsync_pulse_width;
+        panel_fixed_mode->vtotal = panel_fixed_mode->vdisplay +
+                ((dvo_timing->vblank_hi << 8) | dvo_timing->vblank_lo);
+        panel_fixed_mode->clock = dvo_timing->clock * 10;
+        panel_fixed_mode->type = DRM_MODE_TYPE_PREFERRED;
+
+        /* Some VBTs have bogus h/vtotal values */
+        if (panel_fixed_mode->hsync_end > panel_fixed_mode->htotal)
+                panel_fixed_mode->htotal = panel_fixed_mode->hsync_end + 1;
+        if (panel_fixed_mode->vsync_end > panel_fixed_mode->vtotal)
+                panel_fixed_mode->vtotal = panel_fixed_mode->vsync_end + 1;
+
+        drm_mode_set_name(panel_fixed_mode);
+}
+
+/* Try to find integrated panel data */
+static void
+parse_lfp_panel_data(struct drm_i915_private *dev_priv,
+                            struct bdb_header *bdb)
 {
         struct bdb_lvds_options *lvds_options;
         struct bdb_lvds_lfp_data *lvds_lfp_data;
@@ -91,38 +125,45 @@ parse_panel_data(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
         panel_fixed_mode = drm_calloc(1, sizeof(*panel_fixed_mode),
                                       DRM_MEM_DRIVER);
 
-        panel_fixed_mode->hdisplay = (dvo_timing->hactive_hi << 8) |
-                dvo_timing->hactive_lo;
-        panel_fixed_mode->hsync_start = panel_fixed_mode->hdisplay +
-                ((dvo_timing->hsync_off_hi << 8) | dvo_timing->hsync_off_lo);
-        panel_fixed_mode->hsync_end = panel_fixed_mode->hsync_start +
-                dvo_timing->hsync_pulse_width;
-        panel_fixed_mode->htotal = panel_fixed_mode->hdisplay +
-                ((dvo_timing->hblank_hi << 8) | dvo_timing->hblank_lo);
+        fill_detail_timing_data(panel_fixed_mode, dvo_timing);
 
-        panel_fixed_mode->vdisplay = (dvo_timing->vactive_hi << 8) |
-                dvo_timing->vactive_lo;
-        panel_fixed_mode->vsync_start = panel_fixed_mode->vdisplay +
-                dvo_timing->vsync_off;
-        panel_fixed_mode->vsync_end = panel_fixed_mode->vsync_start +
-                dvo_timing->vsync_pulse_width;
-        panel_fixed_mode->vtotal = panel_fixed_mode->vdisplay +
-                ((dvo_timing->vblank_hi << 8) | dvo_timing->vblank_lo);
-        panel_fixed_mode->clock = dvo_timing->clock * 10;
-        panel_fixed_mode->type = DRM_MODE_TYPE_PREFERRED;
+        dev_priv->lfp_lvds_vbt_mode = panel_fixed_mode;
 
-        /* Some VBTs have bogus h/vtotal values */
-        if (panel_fixed_mode->hsync_end > panel_fixed_mode->htotal)
-                panel_fixed_mode->htotal = panel_fixed_mode->hsync_end + 1;
-        if (panel_fixed_mode->vsync_end > panel_fixed_mode->vtotal)
-                panel_fixed_mode->vtotal = panel_fixed_mode->vsync_end + 1;
+        DRM_DEBUG("Found panel mode in BIOS VBT tables:\n");
+        drm_mode_debug_printmodeline(panel_fixed_mode);
 
-        drm_mode_set_name(panel_fixed_mode);
+        return;
+}
+
+/* Try to find sdvo panel data */
+static void
+parse_sdvo_panel_data(struct drm_i915_private *dev_priv,
+                      struct bdb_header *bdb)
+{
+        struct bdb_sdvo_lvds_options *sdvo_lvds_options;
+        struct lvds_dvo_timing *dvo_timing;
+        struct drm_display_mode *panel_fixed_mode;
 
-        dev_priv->vbt_mode = panel_fixed_mode;
+        dev_priv->sdvo_lvds_vbt_mode = NULL;
 
-        DRM_DEBUG("Found panel mode in BIOS VBT tables:\n");
-        drm_mode_debug_printmodeline(panel_fixed_mode);
+        sdvo_lvds_options = find_section(bdb, BDB_SDVO_LVDS_OPTIONS);
+        if (!sdvo_lvds_options)
+                return;
+
+        dvo_timing = find_section(bdb, BDB_SDVO_PANEL_DTDS);
+        if (!dvo_timing)
+                return;
+
+        panel_fixed_mode = drm_calloc(1, sizeof(*panel_fixed_mode),
+                                      DRM_MEM_DRIVER);
+
+        if (!panel_fixed_mode)
+                return;
+
+        fill_detail_timing_data(panel_fixed_mode,
+                        dvo_timing + sdvo_lvds_options->panel_type);
+
+        dev_priv->sdvo_lvds_vbt_mode = panel_fixed_mode;
 
         return;
 }
@@ -199,7 +240,8 @@ intel_init_bios(struct drm_device *dev)
 
         /* Grab useful general definitions */
         parse_general_features(dev_priv, bdb);
-        parse_panel_data(dev_priv, bdb);
+        parse_lfp_panel_data(dev_priv, bdb);
+        parse_sdvo_panel_data(dev_priv, bdb);
 
         pci_unmap_rom(pdev, bios);
 
diff --git a/drivers/gpu/drm/i915/intel_bios.h b/drivers/gpu/drm/i915/intel_bios.h
index de621aad85b..8ca2cde1580 100644
--- a/drivers/gpu/drm/i915/intel_bios.h
+++ b/drivers/gpu/drm/i915/intel_bios.h
@@ -279,6 +279,23 @@ struct vch_bdb_22 {
         struct vch_panel_data panels[16];
 } __attribute__((packed));
 
+struct bdb_sdvo_lvds_options {
+        u8 panel_backlight;
+        u8 h40_set_panel_type;
+        u8 panel_type;
+        u8 ssc_clk_freq;
+        u16 als_low_trip;
+        u16 als_high_trip;
+        u8 sclalarcoeff_tab_row_num;
+        u8 sclalarcoeff_tab_row_size;
+        u8 coefficient[8];
+        u8 panel_misc_bits_1;
+        u8 panel_misc_bits_2;
+        u8 panel_misc_bits_3;
+        u8 panel_misc_bits_4;
+} __attribute__((packed));
+
+
 bool intel_init_bios(struct drm_device *dev);
 
 /*
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 9bdd959260a..79acc4f4c1f 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -161,7 +161,7 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
         hotplug_en &= CRT_FORCE_HOTPLUG_MASK;
         hotplug_en |= CRT_HOTPLUG_FORCE_DETECT;
 
-        if (IS_GM45(dev))
+        if (IS_G4X(dev))
                 hotplug_en |= CRT_HOTPLUG_ACTIVATION_PERIOD_64;
 
         hotplug_en |= CRT_HOTPLUG_VOLTAGE_COMPARE_50;
@@ -198,9 +198,142 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
         return intel_ddc_probe(intel_output);
 }
 
+static enum drm_connector_status
+intel_crt_load_detect(struct drm_crtc *crtc, struct intel_output *intel_output)
+{
+        struct drm_encoder *encoder = &intel_output->enc;
+        struct drm_device *dev = encoder->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+        uint32_t pipe = intel_crtc->pipe;
+        uint32_t save_bclrpat;
+        uint32_t save_vtotal;
+        uint32_t vtotal, vactive;
+        uint32_t vsample;
+        uint32_t vblank, vblank_start, vblank_end;
+        uint32_t dsl;
+        uint32_t bclrpat_reg;
+        uint32_t vtotal_reg;
+        uint32_t vblank_reg;
+        uint32_t vsync_reg;
+        uint32_t pipeconf_reg;
+        uint32_t pipe_dsl_reg;
+        uint8_t st00;
+        enum drm_connector_status status;
+
+        if (pipe == 0) {
+                bclrpat_reg = BCLRPAT_A;
+                vtotal_reg = VTOTAL_A;
+                vblank_reg = VBLANK_A;
+                vsync_reg = VSYNC_A;
+                pipeconf_reg = PIPEACONF;
+                pipe_dsl_reg = PIPEADSL;
+        } else {
+                bclrpat_reg = BCLRPAT_B;
+                vtotal_reg = VTOTAL_B;
+                vblank_reg = VBLANK_B;
+                vsync_reg = VSYNC_B;
+                pipeconf_reg = PIPEBCONF;
+                pipe_dsl_reg = PIPEBDSL;
+        }
+
+        save_bclrpat = I915_READ(bclrpat_reg);
+        save_vtotal = I915_READ(vtotal_reg);
+        vblank = I915_READ(vblank_reg);
+
+        vtotal = ((save_vtotal >> 16) & 0xfff) + 1;
+        vactive = (save_vtotal & 0x7ff) + 1;
+
+        vblank_start = (vblank & 0xfff) + 1;
+        vblank_end = ((vblank >> 16) & 0xfff) + 1;
+
+        /* Set the border color to purple. */
+        I915_WRITE(bclrpat_reg, 0x500050);
+
+        if (IS_I9XX(dev)) {
+                uint32_t pipeconf = I915_READ(pipeconf_reg);
+                I915_WRITE(pipeconf_reg, pipeconf | PIPECONF_FORCE_BORDER);
+                /* Wait for next Vblank to substitue
+                 * border color for Color info */
+                intel_wait_for_vblank(dev);
+                st00 = I915_READ8(VGA_MSR_WRITE);
+                status = ((st00 & (1 << 4)) != 0) ?
+                        connector_status_connected :
+                        connector_status_disconnected;
+
+                I915_WRITE(pipeconf_reg, pipeconf);
+        } else {
+                bool restore_vblank = false;
+                int count, detect;
+
+                /*
+                * If there isn't any border, add some.
+                * Yes, this will flicker
+                */
+                if (vblank_start <= vactive && vblank_end >= vtotal) {
+                        uint32_t vsync = I915_READ(vsync_reg);
+                        uint32_t vsync_start = (vsync & 0xffff) + 1;
+
+                        vblank_start = vsync_start;
+                        I915_WRITE(vblank_reg,
+                                   (vblank_start - 1) |
+                                   ((vblank_end - 1) << 16));
+                        restore_vblank = true;
+                }
+                /* sample in the vertical border, selecting the larger one */
+                if (vblank_start - vactive >= vtotal - vblank_end)
+                        vsample = (vblank_start + vactive) >> 1;
+                else
+                        vsample = (vtotal + vblank_end) >> 1;
+
+                /*
+                 * Wait for the border to be displayed
+                 */
+                while (I915_READ(pipe_dsl_reg) >= vactive)
+                        ;
+                while ((dsl = I915_READ(pipe_dsl_reg)) <= vsample)
+                        ;
+                /*
+                 * Watch ST00 for an entire scanline
+                 */
+                detect = 0;
+                count = 0;
+                do {
+                        count++;
+                        /* Read the ST00 VGA status register */
+                        st00 = I915_READ8(VGA_MSR_WRITE);
+                        if (st00 & (1 << 4))
+                                detect++;
+                } while ((I915_READ(pipe_dsl_reg) == dsl));
+
+                /* restore vblank if necessary */
+                if (restore_vblank)
+                        I915_WRITE(vblank_reg, vblank);
+                /*
+                 * If more than 3/4 of the scanline detected a monitor,
+                 * then it is assumed to be present. This works even on i830,
+                 * where there isn't any way to force the border color across
+                 * the screen
+                 */
+                status = detect * 4 > count * 3 ?
+                         connector_status_connected :
+                         connector_status_disconnected;
+        }
+
+        /* Restore previous settings */
+        I915_WRITE(bclrpat_reg, save_bclrpat);
+
+        return status;
+}
+
 static enum drm_connector_status intel_crt_detect(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
+        struct intel_output *intel_output = to_intel_output(connector);
+        struct drm_encoder *encoder = &intel_output->enc;
+        struct drm_crtc *crtc;
+        int dpms_mode;
+        enum drm_connector_status status;
 
         if (IS_I9XX(dev) && !IS_I915G(dev) && !IS_I915GM(dev)) {
                 if (intel_crt_detect_hotplug(connector))
@@ -212,8 +345,20 @@ static enum drm_connector_status intel_crt_detect(struct drm_connector *connecto
         if (intel_crt_detect_ddc(connector))
                 return connector_status_connected;
 
-        /* TODO use load detect */
-        return connector_status_unknown;
+        /* for pre-945g platforms use load detect */
+        if (encoder->crtc && encoder->crtc->enabled) {
+                status = intel_crt_load_detect(encoder->crtc, intel_output);
+        } else {
+                crtc = intel_get_load_detect_pipe(intel_output,
+                                                  NULL, &dpms_mode);
+                if (crtc) {
+                        status = intel_crt_load_detect(crtc, intel_output);
+                        intel_release_load_detect_pipe(intel_output, dpms_mode);
+                } else
+                        status = connector_status_unknown;
+        }
+
+        return status;
 }
 
 static void intel_crt_destroy(struct drm_connector *connector)
@@ -236,11 +381,6 @@ static int intel_crt_set_property(struct drm_connector *connector,
                                   struct drm_property *property,
                                   uint64_t value)
 {
-        struct drm_device *dev = connector->dev;
-
-        if (property == dev->mode_config.dpms_property && connector->encoder)
-                intel_crt_dpms(connector->encoder, (uint32_t)(value & 0xf));
-
         return 0;
 }
 
@@ -257,6 +397,7 @@ static const struct drm_encoder_helper_funcs intel_crt_helper_funcs = {
 };
 
 static const struct drm_connector_funcs intel_crt_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
         .detect = intel_crt_detect,
         .fill_modes = drm_helper_probe_single_connector_modes,
         .destroy = intel_crt_destroy,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index bdcda36953b..c9d6f10ba92 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1357,7 +1357,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
         int pipe = intel_crtc->pipe;
         uint32_t control = (pipe == 0) ? CURACNTR : CURBCNTR;
         uint32_t base = (pipe == 0) ? CURABASE : CURBBASE;
-        uint32_t temp;
+        uint32_t temp = I915_READ(control);
         size_t addr;
         int ret;
 
@@ -1366,7 +1366,12 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
         /* if we want to turn off the cursor ignore width and height */
         if (!handle) {
                 DRM_DEBUG("cursor off\n");
-                temp = CURSOR_MODE_DISABLE;
+                if (IS_MOBILE(dev) || IS_I9XX(dev)) {
+                        temp &= ~(CURSOR_MODE | MCURSOR_GAMMA_ENABLE);
+                        temp |= CURSOR_MODE_DISABLE;
+                } else {
+                        temp &= ~(CURSOR_ENABLE | CURSOR_GAMMA_ENABLE);
+                }
                 addr = 0;
                 bo = NULL;
                 mutex_lock(&dev->struct_mutex);
@@ -1409,10 +1414,19 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
                 addr = obj_priv->phys_obj->handle->busaddr;
         }
 
-        temp = 0;
-        /* set the pipe for the cursor */
-        temp |= (pipe << 28);
-        temp |= CURSOR_MODE_64_ARGB_AX | MCURSOR_GAMMA_ENABLE;
+        if (!IS_I9XX(dev))
+                I915_WRITE(CURSIZE, (height << 12) | width);
+
+        /* Hooray for CUR*CNTR differences */
+        if (IS_MOBILE(dev) || IS_I9XX(dev)) {
+                temp &= ~(CURSOR_MODE | MCURSOR_PIPE_SELECT);
+                temp |= CURSOR_MODE_64_ARGB_AX | MCURSOR_GAMMA_ENABLE;
+                temp |= (pipe << 28); /* Connect to correct pipe */
+        } else {
+                temp &= ~(CURSOR_FORMAT_MASK);
+                temp |= CURSOR_ENABLE;
+                temp |= CURSOR_FORMAT_ARGB | CURSOR_GAMMA_ENABLE;
+        }
 
  finish:
         I915_WRITE(control, temp);
@@ -1804,6 +1818,37 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
         }
 }
 
+int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
+                                struct drm_file *file_priv)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_get_pipe_from_crtc_id *pipe_from_crtc_id = data;
+        struct drm_crtc *crtc = NULL;
+        int pipe = -1;
+
+        if (!dev_priv) {
+                DRM_ERROR("called with no initialization\n");
+                return -EINVAL;
+        }
+
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+                struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+                if (crtc->base.id == pipe_from_crtc_id->crtc_id) {
+                        pipe = intel_crtc->pipe;
+                        break;
+                }
+        }
+
+        if (pipe == -1) {
+                DRM_ERROR("no such CRTC id\n");
+                return -EINVAL;
+        }
+
+        pipe_from_crtc_id->pipe = pipe;
+
+       return 0;
+}
+
 struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe)
 {
         struct drm_crtc *crtc = NULL;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 957daef8edf..cd4b9c5f715 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -109,7 +109,7 @@ struct intel_i2c_chan *intel_i2c_create(struct drm_device *dev, const u32 reg,
 void intel_i2c_destroy(struct intel_i2c_chan *chan);
 int intel_ddc_get_modes(struct intel_output *intel_output);
 extern bool intel_ddc_probe(struct intel_output *intel_output);
-
+void intel_i2c_quirk_set(struct drm_device *dev, bool enable);
 extern void intel_crt_init(struct drm_device *dev);
 extern void intel_hdmi_init(struct drm_device *dev, int sdvox_reg);
 extern bool intel_sdvo_init(struct drm_device *dev, int output_device);
@@ -125,6 +125,8 @@ extern struct drm_encoder *intel_best_encoder(struct drm_connector *connector);
 
 extern struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
                                                     struct drm_crtc *crtc);
+int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
+                                struct drm_file *file_priv);
 extern void intel_wait_for_vblank(struct drm_device *dev);
 extern struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_output *intel_output,
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index 8b8d6e65cd3..1ee3007d6ec 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -316,6 +316,7 @@ static const struct drm_encoder_helper_funcs intel_dvo_helper_funcs = {
 };
 
 static const struct drm_connector_funcs intel_dvo_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
         .save = intel_dvo_save,
         .restore = intel_dvo_restore,
         .detect = intel_dvo_detect,
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 3e094beecb9..e4652dcdd9b 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -864,7 +864,7 @@ static void intelfb_sysrq(int dummy1, struct tty_struct *dummy3)
 
 static struct sysrq_key_op sysrq_intelfb_restore_op = {
         .handler = intelfb_sysrq,
-        .help_msg = "force-fb(G)",
+        .help_msg = "force-fb(V)",
         .action_msg = "Restore framebuffer console",
 };
 
@@ -898,7 +898,7 @@ int intelfb_probe(struct drm_device *dev)
                 ret = intelfb_single_fb_probe(dev);
         }
 
-        register_sysrq_key('g', &sysrq_intelfb_restore_op);
+        register_sysrq_key('v', &sysrq_intelfb_restore_op);
 
         return ret;
 }
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 55037422538..7d6bdd70532 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -155,11 +155,18 @@ intel_hdmi_detect(struct drm_connector *connector)
 
         temp = I915_READ(PORT_HOTPLUG_EN);
 
-        I915_WRITE(PORT_HOTPLUG_EN,
-                   temp |
-                   HDMIB_HOTPLUG_INT_EN |
-                   HDMIC_HOTPLUG_INT_EN |
-                   HDMID_HOTPLUG_INT_EN);
+        switch (hdmi_priv->sdvox_reg) {
+        case SDVOB:
+                temp |= HDMIB_HOTPLUG_INT_EN;
+                break;
+        case SDVOC:
+                temp |= HDMIC_HOTPLUG_INT_EN;
+                break;
+        default:
+                return connector_status_unknown;
+        }
+
+        I915_WRITE(PORT_HOTPLUG_EN, temp);
 
         POSTING_READ(PORT_HOTPLUG_EN);
 
@@ -212,6 +219,7 @@ static const struct drm_encoder_helper_funcs intel_hdmi_helper_funcs = {
 };
 
 static const struct drm_connector_funcs intel_hdmi_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
         .save = intel_hdmi_save,
         .restore = intel_hdmi_restore,
         .detect = intel_hdmi_detect,
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index 5ee9d4c2575..f7061f68d05 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -34,6 +34,21 @@
 #include "i915_drm.h"
 #include "i915_drv.h"
 
+void intel_i2c_quirk_set(struct drm_device *dev, bool enable)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        /* When using bit bashing for I2C, this bit needs to be set to 1 */
+        if (!IS_IGD(dev))
+                return;
+        if (enable)
+                I915_WRITE(CG_2D_DIS,
+                        I915_READ(CG_2D_DIS) | DPCUNIT_CLOCK_GATE_DISABLE);
+        else
+                I915_WRITE(CG_2D_DIS,
+                        I915_READ(CG_2D_DIS) & (~DPCUNIT_CLOCK_GATE_DISABLE));
+}
+
 /*
  * Intel GPIO access functions
  */
@@ -153,8 +168,10 @@ struct intel_i2c_chan *intel_i2c_create(struct drm_device *dev, const u32 reg,
                 goto out_free;
 
         /* JJJ:  raise SCL and SDA? */
+        intel_i2c_quirk_set(dev, true);
         set_data(chan, 1);
         set_clock(chan, 1);
+        intel_i2c_quirk_set(dev, false);
         udelay(20);
 
         return chan;
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 6619f26e46a..53cccfa58b9 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -343,11 +343,6 @@ static int intel_lvds_set_property(struct drm_connector *connector,
                                    struct drm_property *property,
                                    uint64_t value)
 {
-        struct drm_device *dev = connector->dev;
-
-        if (property == dev->mode_config.dpms_property && connector->encoder)
-                intel_lvds_dpms(connector->encoder, (uint32_t)(value & 0xf));
-
         return 0;
 }
 
@@ -366,6 +361,7 @@ static const struct drm_connector_helper_funcs intel_lvds_connector_helper_funcs
 };
 
 static const struct drm_connector_funcs intel_lvds_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
         .save = intel_lvds_save,
         .restore = intel_lvds_restore,
         .detect = intel_lvds_detect,
@@ -384,7 +380,51 @@ static const struct drm_encoder_funcs intel_lvds_enc_funcs = {
         .destroy = intel_lvds_enc_destroy,
 };
 
+static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
+{
+        DRM_DEBUG("Skipping LVDS initialization for %s\n", id->ident);
+        return 1;
+}
+
+/* These systems claim to have LVDS, but really don't */
+static const struct dmi_system_id intel_no_lvds[] = {
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Apple Mac Mini (Core series)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Macmini1,1"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Apple Mac Mini (Core 2 series)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Macmini2,1"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "MSI IM-945GSE-A",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "MSI"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "A9830IMS"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Dell Studio Hybrid",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Studio Hybrid 140g"),
+                },
+        },
 
+        /* FIXME: add a check for the Aopen Mini PC */
+
+        { }     /* terminating entry */
+};
 
 /**
  * intel_lvds_init - setup LVDS connectors on this device
@@ -404,15 +444,9 @@ void intel_lvds_init(struct drm_device *dev)
         u32 lvds;
         int pipe;
 
-        /* Blacklist machines that we know falsely report LVDS. */
-        /* FIXME: add a check for the Aopen Mini PC */
-
-        /* Apple Mac Mini Core Duo and Mac Mini Core 2 Duo */
-        if(dmi_match(DMI_PRODUCT_NAME, "Macmini1,1") ||
-           dmi_match(DMI_PRODUCT_NAME, "Macmini2,1")) {
-                DRM_DEBUG("Skipping LVDS initialization for Apple Mac Mini\n");
+        /* Skip init on machines we know falsely report LVDS */
+        if (dmi_check_system(intel_no_lvds))
                 return;
-        }
 
         intel_output = kzalloc(sizeof(struct intel_output), GFP_KERNEL);
         if (!intel_output) {
@@ -473,10 +507,10 @@ void intel_lvds_init(struct drm_device *dev)
         }
 
         /* Failed to get EDID, what about VBT? */
-        if (dev_priv->vbt_mode) {
+        if (dev_priv->lfp_lvds_vbt_mode) {
                 mutex_lock(&dev->mode_config.mutex);
                 dev_priv->panel_fixed_mode =
-                        drm_mode_duplicate(dev, dev_priv->vbt_mode);
+                        drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode);
                 mutex_unlock(&dev->mode_config.mutex);
                 if (dev_priv->panel_fixed_mode) {
                         dev_priv->panel_fixed_mode->type |=
diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c
index 07d7ec97616..e0910fefce8 100644
--- a/drivers/gpu/drm/i915/intel_modes.c
+++ b/drivers/gpu/drm/i915/intel_modes.c
@@ -27,6 +27,7 @@
 #include <linux/fb.h>
 #include "drmP.h"
 #include "intel_drv.h"
+#include "i915_drv.h"
 
 /**
  * intel_ddc_probe
@@ -52,7 +53,10 @@ bool intel_ddc_probe(struct intel_output *intel_output)
                 }
         };
 
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, true);
         ret = i2c_transfer(&intel_output->ddc_bus->adapter, msgs, 2);
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, false);
+
         if (ret == 2)
                 return true;
 
@@ -70,8 +74,10 @@ int intel_ddc_get_modes(struct intel_output *intel_output)
         struct edid *edid;
         int ret = 0;
 
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, true);
         edid = drm_get_edid(&intel_output->base,
                             &intel_output->ddc_bus->adapter);
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, false);
         if (edid) {
                 drm_mode_connector_update_edid_property(&intel_output->base,
                                                         edid);
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 9913651c1e1..3093b4d4a4d 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -69,6 +69,10 @@ struct intel_sdvo_priv {
          * This is set if we treat the device as HDMI, instead of DVI.
          */
         bool is_hdmi;
+        /**
+         * This is set if we detect output of sdvo device as LVDS.
+         */
+        bool is_lvds;
 
         /**
          * Returned SDTV resolutions allowed for the current format, if the
@@ -1398,10 +1402,8 @@ static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connect
 static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
 {
         struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
 
         /* set the bus switch and get the modes */
-        intel_sdvo_set_control_bus_switch(intel_output, sdvo_priv->ddc_bus);
         intel_ddc_get_modes(intel_output);
 
 #if 0
@@ -1543,6 +1545,37 @@ static void intel_sdvo_get_tv_modes(struct drm_connector *connector)
                 }
 }
 
+static void intel_sdvo_get_lvds_modes(struct drm_connector *connector)
+{
+        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct drm_i915_private *dev_priv = connector->dev->dev_private;
+
+        /*
+         * Attempt to get the mode list from DDC.
+         * Assume that the preferred modes are
+         * arranged in priority order.
+         */
+        /* set the bus switch and get the modes */
+        intel_sdvo_set_control_bus_switch(intel_output, sdvo_priv->ddc_bus);
+        intel_ddc_get_modes(intel_output);
+        if (list_empty(&connector->probed_modes) == false)
+                return;
+
+        /* Fetch modes from VBT */
+        if (dev_priv->sdvo_lvds_vbt_mode != NULL) {
+                struct drm_display_mode *newmode;
+                newmode = drm_mode_duplicate(connector->dev,
+                                             dev_priv->sdvo_lvds_vbt_mode);
+                if (newmode != NULL) {
+                        /* Guarantee the mode is preferred */
+                        newmode->type = (DRM_MODE_TYPE_PREFERRED |
+                                         DRM_MODE_TYPE_DRIVER);
+                        drm_mode_probed_add(connector, newmode);
+                }
+        }
+}
+
 static int intel_sdvo_get_modes(struct drm_connector *connector)
 {
         struct intel_output *output = to_intel_output(connector);
@@ -1550,6 +1583,8 @@ static int intel_sdvo_get_modes(struct drm_connector *connector)
 
         if (sdvo_priv->is_tv)
                 intel_sdvo_get_tv_modes(connector);
+        else if (sdvo_priv->is_lvds == true)
+                intel_sdvo_get_lvds_modes(connector);
         else
                 intel_sdvo_get_ddc_modes(connector);
 
@@ -1564,6 +1599,9 @@ static void intel_sdvo_destroy(struct drm_connector *connector)
 
         if (intel_output->i2c_bus)
                 intel_i2c_destroy(intel_output->i2c_bus);
+        if (intel_output->ddc_bus)
+                intel_i2c_destroy(intel_output->ddc_bus);
+
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
         kfree(intel_output);
@@ -1578,6 +1616,7 @@ static const struct drm_encoder_helper_funcs intel_sdvo_helper_funcs = {
 };
 
 static const struct drm_connector_funcs intel_sdvo_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
         .save = intel_sdvo_save,
         .restore = intel_sdvo_restore,
         .detect = intel_sdvo_detect,
@@ -1660,12 +1699,56 @@ intel_sdvo_get_digital_encoding_mode(struct intel_output *output)
         return true;
 }
 
+static struct intel_output *
+intel_sdvo_chan_to_intel_output(struct intel_i2c_chan *chan)
+{
+        struct drm_device *dev = chan->drm_dev;
+        struct drm_connector *connector;
+        struct intel_output *intel_output = NULL;
+
+        list_for_each_entry(connector,
+                        &dev->mode_config.connector_list, head) {
+                if (to_intel_output(connector)->ddc_bus == chan) {
+                        intel_output = to_intel_output(connector);
+                        break;
+                }
+        }
+        return intel_output;
+}
+
+static int intel_sdvo_master_xfer(struct i2c_adapter *i2c_adap,
+                                  struct i2c_msg msgs[], int num)
+{
+        struct intel_output *intel_output;
+        struct intel_sdvo_priv *sdvo_priv;
+        struct i2c_algo_bit_data *algo_data;
+        struct i2c_algorithm *algo;
+
+        algo_data = (struct i2c_algo_bit_data *)i2c_adap->algo_data;
+        intel_output =
+                intel_sdvo_chan_to_intel_output(
+                                (struct intel_i2c_chan *)(algo_data->data));
+        if (intel_output == NULL)
+                return -EINVAL;
+
+        sdvo_priv = intel_output->dev_priv;
+        algo = (struct i2c_algorithm *)intel_output->i2c_bus->adapter.algo;
+
+        intel_sdvo_set_control_bus_switch(intel_output, sdvo_priv->ddc_bus);
+        return algo->master_xfer(i2c_adap, msgs, num);
+}
+
+static struct i2c_algorithm intel_sdvo_i2c_bit_algo = {
+        .master_xfer    = intel_sdvo_master_xfer,
+};
+
 bool intel_sdvo_init(struct drm_device *dev, int output_device)
 {
         struct drm_connector *connector;
         struct intel_output *intel_output;
         struct intel_sdvo_priv *sdvo_priv;
         struct intel_i2c_chan *i2cbus = NULL;
+        struct intel_i2c_chan *ddcbus = NULL;
         int connector_type;
         u8 ch[0x40];
         int i;
@@ -1676,17 +1759,9 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                 return false;
         }
 
-        connector = &intel_output->base;
-
-        drm_connector_init(dev, connector, &intel_sdvo_connector_funcs,
-                           DRM_MODE_CONNECTOR_Unknown);
-        drm_connector_helper_add(connector, &intel_sdvo_connector_helper_funcs);
         sdvo_priv = (struct intel_sdvo_priv *)(intel_output + 1);
         intel_output->type = INTEL_OUTPUT_SDVO;
 
-        connector->interlace_allowed = 0;
-        connector->doublescan_allowed = 0;
-
         /* setup the DDC bus. */
         if (output_device == SDVOB)
                 i2cbus = intel_i2c_create(dev, GPIOE, "SDVOCTRL_E for SDVOB");
@@ -1694,7 +1769,7 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                 i2cbus = intel_i2c_create(dev, GPIOE, "SDVOCTRL_E for SDVOC");
 
         if (!i2cbus)
-                goto err_connector;
+                goto err_inteloutput;
 
         sdvo_priv->i2c_bus = i2cbus;
 
@@ -1710,7 +1785,6 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
         intel_output->i2c_bus = i2cbus;
         intel_output->dev_priv = sdvo_priv;
 
-
         /* Read the regs to test if we can talk to the device */
         for (i = 0; i < 0x40; i++) {
                 if (!intel_sdvo_read_byte(intel_output, i, &ch[i])) {
@@ -1720,6 +1794,22 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                 }
         }
 
+        /* setup the DDC bus. */
+        if (output_device == SDVOB)
+                ddcbus = intel_i2c_create(dev, GPIOE, "SDVOB DDC BUS");
+        else
+                ddcbus = intel_i2c_create(dev, GPIOE, "SDVOC DDC BUS");
+
+        if (ddcbus == NULL)
+                goto err_i2c;
+
+        intel_sdvo_i2c_bit_algo.functionality =
+                intel_output->i2c_bus->adapter.algo->functionality;
+        ddcbus->adapter.algo = &intel_sdvo_i2c_bit_algo;
+        intel_output->ddc_bus = ddcbus;
+
+        /* In defaut case sdvo lvds is false */
+        sdvo_priv->is_lvds = false;
         intel_sdvo_get_capabilities(intel_output, &sdvo_priv->caps);
 
         if (sdvo_priv->caps.output_flags &
@@ -1729,7 +1819,6 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                 else
                         sdvo_priv->controlled_output = SDVO_OUTPUT_TMDS1;
 
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                 encoder_type = DRM_MODE_ENCODER_TMDS;
                 connector_type = DRM_MODE_CONNECTOR_DVID;
 
@@ -1747,7 +1836,6 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
         else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_SVID0)
         {
                 sdvo_priv->controlled_output = SDVO_OUTPUT_SVID0;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                 encoder_type = DRM_MODE_ENCODER_TVDAC;
                 connector_type = DRM_MODE_CONNECTOR_SVIDEO;
                 sdvo_priv->is_tv = true;
@@ -1756,30 +1844,28 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
         else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB0)
         {
                 sdvo_priv->controlled_output = SDVO_OUTPUT_RGB0;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                 encoder_type = DRM_MODE_ENCODER_DAC;
                 connector_type = DRM_MODE_CONNECTOR_VGA;
         }
         else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB1)
         {
                 sdvo_priv->controlled_output = SDVO_OUTPUT_RGB1;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                 encoder_type = DRM_MODE_ENCODER_DAC;
                 connector_type = DRM_MODE_CONNECTOR_VGA;
         }
         else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_LVDS0)
         {
                 sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS0;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                 encoder_type = DRM_MODE_ENCODER_LVDS;
                 connector_type = DRM_MODE_CONNECTOR_LVDS;
+                sdvo_priv->is_lvds = true;
         }
         else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_LVDS1)
         {
                 sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS1;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                 encoder_type = DRM_MODE_ENCODER_LVDS;
                 connector_type = DRM_MODE_CONNECTOR_LVDS;
+                sdvo_priv->is_lvds = true;
         }
         else
         {
@@ -1795,9 +1881,16 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                 goto err_i2c;
         }
 
+        connector = &intel_output->base;
+        drm_connector_init(dev, connector, &intel_sdvo_connector_funcs,
+                           connector_type);
+        drm_connector_helper_add(connector, &intel_sdvo_connector_helper_funcs);
+        connector->interlace_allowed = 0;
+        connector->doublescan_allowed = 0;
+        connector->display_info.subpixel_order = SubPixelHorizontalRGB;
+
         drm_encoder_init(dev, &intel_output->enc, &intel_sdvo_enc_funcs, encoder_type);
         drm_encoder_helper_add(&intel_output->enc, &intel_sdvo_helper_funcs);
-        connector->connector_type = connector_type;
 
         drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
         drm_sysfs_connector_add(connector);
@@ -1829,14 +1922,13 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                   sdvo_priv->caps.output_flags &
                         (SDVO_OUTPUT_TMDS1 | SDVO_OUTPUT_RGB1) ? 'Y' : 'N');
 
-        intel_output->ddc_bus = i2cbus;
-
         return true;
 
 err_i2c:
+        if (ddcbus != NULL)
+                intel_i2c_destroy(intel_output->ddc_bus);
         intel_i2c_destroy(intel_output->i2c_bus);
-err_connector:
-        drm_connector_cleanup(connector);
+err_inteloutput:
         kfree(intel_output);
 
         return false;
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index d2c32983242..98ac0546b7b 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1626,6 +1626,7 @@ static const struct drm_encoder_helper_funcs intel_tv_helper_funcs = {
 };
 
 static const struct drm_connector_funcs intel_tv_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
         .save = intel_tv_save,
         .restore = intel_tv_restore,
         .detect = intel_tv_detect,
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 77a7a4d8465..aff90bb9648 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -2185,9 +2185,9 @@ void radeon_commit_ring(drm_radeon_private_t *dev_priv)
 
         /* check if the ring is padded out to 16-dword alignment */
 
-        tail_aligned = dev_priv->ring.tail & 0xf;
+        tail_aligned = dev_priv->ring.tail & (RADEON_RING_ALIGN-1);
         if (tail_aligned) {
-                int num_p2 = 16 - tail_aligned;
+                int num_p2 = RADEON_RING_ALIGN - tail_aligned;
 
                 ring = dev_priv->ring.start;
                 /* pad with some CP_PACKET2 */
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 8071d965f14..0c6bfc1de15 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -1964,11 +1964,14 @@ do {								\
 
 #define RING_LOCALS     int write, _nr, _align_nr; unsigned int mask; u32 *ring;
 
+#define RADEON_RING_ALIGN 16
+
 #define BEGIN_RING( n ) do {                                            \
         if ( RADEON_VERBOSE ) {                                         \
                 DRM_INFO( "BEGIN_RING( %d )\n", (n));                   \
         }                                                               \
-        _align_nr = (n + 0xf) & ~0xf;                                   \
+        _align_nr = RADEON_RING_ALIGN - ((dev_priv->ring.tail + n) & (RADEON_RING_ALIGN-1));    \
+        _align_nr += n;                                                 \
         if (dev_priv->ring.space <= (_align_nr * sizeof(u32))) {        \
                 COMMIT_RING();                                          \
                 radeon_wait_ring( dev_priv, _align_nr * sizeof(u32));   \
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index aa1b995dd03..4d5ee2bbc62 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -113,6 +113,11 @@
 #define USB_VENDOR_ID_BERKSHIRE         0x0c98
 #define USB_DEVICE_ID_BERKSHIRE_PCWD    0x1140
 
+#define USB_VENDOR_ID_CH                0x068e
+#define USB_DEVICE_ID_CH_PRO_PEDALS     0x00f2
+#define USB_DEVICE_ID_CH_COMBATSTICK    0x00f4
+#define USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE        0x00ff
+
 #define USB_VENDOR_ID_CHERRY            0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION   0x0023
 
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 900ce18dd54..ac8049b5f1e 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -898,7 +898,7 @@ static int usbhid_parse(struct hid_device *hid)
                 goto err;
         }
 
-        hid->quirks = quirks;
+        hid->quirks |= quirks;
 
         return 0;
 err:
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 4391717d251..d8f7423f363 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -50,6 +50,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
index b5e3b285169..a1787fdf5b9 100644
--- a/drivers/hwmon/lm78.c
+++ b/drivers/hwmon/lm78.c
@@ -182,7 +182,7 @@ static struct platform_driver lm78_isa_driver = {
                 .name   = "lm78",
         },
         .probe          = lm78_isa_probe,
-        .remove         = lm78_isa_remove,
+        .remove         = __devexit_p(lm78_isa_remove),
 };
 
 
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index a48c8aee021..f1c6ca7e285 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -467,7 +467,7 @@ config I2C_PXA_SLAVE
 
 config I2C_S3C2410
         tristate "S3C2410 I2C Driver"
-        depends on ARCH_S3C2410
+        depends on ARCH_S3C2410 || ARCH_S3C64XX
         help
           Say Y here to include support for I2C controller in the
           Samsung S3C2410 based System-on-Chip devices.
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index 3fcf78e906d..b5db8b88361 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -531,16 +531,16 @@ static int __devinit cpm_i2c_setup(struct cpm_i2c *cpm)
         rbdf = cpm->rbase;
 
         for (i = 0; i < CPM_MAXBD; i++) {
-                cpm->rxbuf[i] = dma_alloc_coherent(
-                        NULL, CPM_MAX_READ + 1, &cpm->rxdma[i], GFP_KERNEL);
+                cpm->rxbuf[i] = dma_alloc_coherent(&cpm->ofdev->dev,
+                                                   CPM_MAX_READ + 1,
+                                                   &cpm->rxdma[i], GFP_KERNEL);
                 if (!cpm->rxbuf[i]) {
                         ret = -ENOMEM;
                         goto out_muram;
                 }
                 out_be32(&rbdf[i].cbd_bufaddr, ((cpm->rxdma[i] + 1) & ~1));
 
-                cpm->txbuf[i] = (unsigned char *)dma_alloc_coherent(
-                        NULL, CPM_MAX_READ + 1, &cpm->txdma[i], GFP_KERNEL);
+                cpm->txbuf[i] = (unsigned char *)dma_alloc_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1, &cpm->txdma[i], GFP_KERNEL);
                 if (!cpm->txbuf[i]) {
                         ret = -ENOMEM;
                         goto out_muram;
@@ -585,10 +585,10 @@ static int __devinit cpm_i2c_setup(struct cpm_i2c *cpm)
 out_muram:
         for (i = 0; i < CPM_MAXBD; i++) {
                 if (cpm->rxbuf[i])
-                        dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                        dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                                 cpm->rxbuf[i], cpm->rxdma[i]);
                 if (cpm->txbuf[i])
-                        dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                        dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                                 cpm->txbuf[i], cpm->txdma[i]);
         }
         cpm_muram_free(cpm->dp_addr);
@@ -619,9 +619,9 @@ static void cpm_i2c_shutdown(struct cpm_i2c *cpm)
 
         /* Free all memory */
         for (i = 0; i < CPM_MAXBD; i++) {
-                dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                         cpm->rxbuf[i], cpm->rxdma[i]);
-                dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                         cpm->txbuf[i], cpm->txdma[i]);
         }
 
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index 4af5c09f0e8..dd778d7ae04 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -164,7 +164,7 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
         return 0;
 }
 
-#ifdef CONFIG_PPC_52xx
+#ifdef CONFIG_PPC_MPC52xx
 static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
         {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23},
         {28, 0x24}, {30, 0x01}, {32, 0x25}, {34, 0x02},
@@ -188,7 +188,7 @@ static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
 
 int mpc_i2c_get_fdr_52xx(struct device_node *node, u32 clock, int prescaler)
 {
-        const struct mpc52xx_i2c_divider *div = NULL;
+        const struct mpc_i2c_divider *div = NULL;
         unsigned int pvr = mfspr(SPRN_PVR);
         u32 divider;
         int i;
@@ -203,7 +203,7 @@ int mpc_i2c_get_fdr_52xx(struct device_node *node, u32 clock, int prescaler)
          * We want to choose an FDR/DFSR that generates an I2C bus speed that
          * is equal to or lower than the requested speed.
          */
-        for (i = 0; i < ARRAY_SIZE(mpc52xx_i2c_dividers); i++) {
+        for (i = 0; i < ARRAY_SIZE(mpc_i2c_dividers_52xx); i++) {
                 div = &mpc_i2c_dividers_52xx[i];
                 /* Old MPC5200 rev A CPUs do not support the high bits */
                 if (div->fdr & 0xc0 && pvr == 0x80822011)
@@ -219,20 +219,23 @@ static void mpc_i2c_setclock_52xx(struct device_node *node,
                                   struct mpc_i2c *i2c,
                                   u32 clock, u32 prescaler)
 {
-        int fdr = mpc52xx_i2c_get_fdr(node, clock, prescaler);
+        int ret, fdr;
+
+        ret = mpc_i2c_get_fdr_52xx(node, clock, prescaler);
+        fdr = (ret >= 0) ? ret : 0x3f; /* backward compatibility */
 
-        if (fdr < 0)
-                fdr = 0x3f; /* backward compatibility */
         writeb(fdr & 0xff, i2c->base + MPC_I2C_FDR);
-        dev_info(i2c->dev, "clock %d Hz (fdr=%d)\n", clock, fdr);
+
+        if (ret >= 0)
+                dev_info(i2c->dev, "clock %d Hz (fdr=%d)\n", clock, fdr);
 }
-#else /* !CONFIG_PPC_52xx */
+#else /* !CONFIG_PPC_MPC52xx */
 static void mpc_i2c_setclock_52xx(struct device_node *node,
                                   struct mpc_i2c *i2c,
                                   u32 clock, u32 prescaler)
 {
 }
-#endif /* CONFIG_PPC_52xx*/
+#endif /* CONFIG_PPC_MPC52xx*/
 
 #ifdef CONFIG_FSL_SOC
 static const struct mpc_i2c_divider mpc_i2c_dividers_8xxx[] = {
@@ -321,14 +324,17 @@ static void mpc_i2c_setclock_8xxx(struct device_node *node,
                                   struct mpc_i2c *i2c,
                                   u32 clock, u32 prescaler)
 {
-        int fdr = mpc_i2c_get_fdr_8xxx(node, clock, prescaler);
+        int ret, fdr;
+
+        ret = mpc_i2c_get_fdr_8xxx(node, clock, prescaler);
+        fdr = (ret >= 0) ? ret : 0x1031; /* backward compatibility */
 
-        if (fdr < 0)
-                fdr = 0x1031; /* backward compatibility */
         writeb(fdr & 0xff, i2c->base + MPC_I2C_FDR);
         writeb((fdr >> 8) & 0xff, i2c->base + MPC_I2C_DFSRR);
-        dev_info(i2c->dev, "clock %d Hz (dfsrr=%d fdr=%d)\n",
-                 clock, fdr >> 8, fdr & 0xff);
+
+        if (ret >= 0)
+                dev_info(i2c->dev, "clock %d Hz (dfsrr=%d fdr=%d)\n",
+                         clock, fdr >> 8, fdr & 0xff);
 }
 
 #else /* !CONFIG_FSL_SOC */
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index c1405c8f6ba..acc7143d965 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -265,10 +265,10 @@ static int i2c_pxa_wait_bus_not_busy(struct pxa_i2c *i2c)
                 show_state(i2c);
         }
 
-        if (timeout <= 0)
+        if (timeout < 0)
                 show_state(i2c);
 
-        return timeout <= 0 ? I2C_RETRY : 0;
+        return timeout < 0 ? I2C_RETRY : 0;
 }
 
 static int i2c_pxa_wait_master(struct pxa_i2c *i2c)
@@ -612,7 +612,7 @@ static int i2c_pxa_pio_set_master(struct pxa_i2c *i2c)
                 show_state(i2c);
         }
 
-        if (timeout <= 0) {
+        if (timeout < 0) {
                 show_state(i2c);
                 dev_err(&i2c->adap.dev,
                         "i2c_pxa: timeout waiting for bus free\n");
diff --git a/drivers/ide/icside.c b/drivers/ide/icside.c
index 4e16ce68b06..36da913cc55 100644
--- a/drivers/ide/icside.c
+++ b/drivers/ide/icside.c
@@ -466,7 +466,7 @@ icside_register_v6(struct icside_state *state, struct expansion_card *ec)
         struct ide_host *host;
         unsigned int sel = 0;
         int ret;
-        hw_regs_t hw[2], *hws[] = { &hw[0], NULL, NULL, NULL };
+        hw_regs_t hw[2], *hws[] = { &hw[0], &hw[1], NULL, NULL };
         struct ide_port_info d = icside_v6_port_info;
 
         ioc_base = ecardm_iomap(ec, ECARD_RES_IOCFAST, 0, 0);
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 35dc38d3b2c..6415a2e2ba8 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -696,7 +696,7 @@ void ide_timer_expiry (unsigned long data)
                 }
                 spin_lock_irq(&hwif->lock);
                 enable_irq(hwif->irq);
-                if (startstop == ide_stopped) {
+                if (startstop == ide_stopped && hwif->polling == 0) {
                         ide_unlock_port(hwif);
                         plug_device = 1;
                 }
@@ -868,7 +868,7 @@ irqreturn_t ide_intr (int irq, void *dev_id)
          * same irq as is currently being serviced here, and Linux
          * won't allow another of the same (on any CPU) until we return.
          */
-        if (startstop == ide_stopped) {
+        if (startstop == ide_stopped && hwif->polling == 0) {
                 BUG_ON(hwif->handler);
                 ide_unlock_port(hwif);
                 plug_device = 1;
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index c19a221b1e1..06fe002116e 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -206,8 +206,6 @@ EXPORT_SYMBOL_GPL(ide_in_drive_list);
 
 /*
  * Early UDMA66 devices don't set bit14 to 1, only bit13 is valid.
- * We list them here and depend on the device side cable detection for them.
- *
  * Some optical devices with the buggy firmwares have the same problem.
  */
 static const struct drive_list_entry ivb_list[] = {
@@ -251,10 +249,25 @@ u8 eighty_ninty_three(ide_drive_t *drive)
          * - force bit13 (80c cable present) check also for !ivb devices
          *   (unless the slave device is pre-ATA3)
          */
-        if ((id[ATA_ID_HW_CONFIG] & 0x4000) ||
-            (ivb && (id[ATA_ID_HW_CONFIG] & 0x2000)))
+        if (id[ATA_ID_HW_CONFIG] & 0x4000)
                 return 1;
 
+        if (ivb) {
+                const char *model = (char *)&id[ATA_ID_PROD];
+
+                if (strstr(model, "TSSTcorp CDDVDW SH-S202")) {
+                        /*
+                         * These ATAPI devices always report 80c cable
+                         * so we have to depend on the host in this case.
+                         */
+                        if (hwif->cbl == ATA_CBL_PATA80)
+                                return 1;
+                } else {
+                        /* Depend on the device side cable detection. */
+                        if (id[ATA_ID_HW_CONFIG] & 0x2000)
+                                return 1;
+                }
+        }
 no_80w:
         if (drive->dev_flags & IDE_DFLAG_UDMA33_WARNED)
                 return 0;
diff --git a/drivers/ide/ide-lib.c b/drivers/ide/ide-lib.c
index 56ff8c46c7d..2148df836ce 100644
--- a/drivers/ide/ide-lib.c
+++ b/drivers/ide/ide-lib.c
@@ -31,24 +31,6 @@ void ide_toggle_bounce(ide_drive_t *drive, int on)
                 blk_queue_bounce_limit(drive->queue, addr);
 }
 
-static void ide_dump_opcode(ide_drive_t *drive)
-{
-        struct request *rq = drive->hwif->rq;
-        struct ide_cmd *cmd = NULL;
-
-        if (!rq)
-                return;
-
-        if (rq->cmd_type == REQ_TYPE_ATA_TASKFILE)
-                cmd = rq->special;
-
-        printk(KERN_ERR "ide: failed opcode was: ");
-        if (cmd == NULL)
-                printk(KERN_CONT "unknown\n");
-        else
-                printk(KERN_CONT "0x%02x\n", cmd->tf.command);
-}
-
 u64 ide_get_lba_addr(struct ide_cmd *cmd, int lba48)
 {
         struct ide_taskfile *tf = &cmd->tf;
@@ -91,7 +73,7 @@ static void ide_dump_sector(ide_drive_t *drive)
 
 static void ide_dump_ata_error(ide_drive_t *drive, u8 err)
 {
-        printk(KERN_ERR "{ ");
+        printk(KERN_CONT "{ ");
         if (err & ATA_ABORTED)
                 printk(KERN_CONT "DriveStatusError ");
         if (err & ATA_ICRC)
@@ -121,7 +103,7 @@ static void ide_dump_ata_error(ide_drive_t *drive, u8 err)
 
 static void ide_dump_atapi_error(ide_drive_t *drive, u8 err)
 {
-        printk(KERN_ERR "{ ");
+        printk(KERN_CONT "{ ");
         if (err & ATAPI_ILI)
                 printk(KERN_CONT "IllegalLengthIndication ");
         if (err & ATAPI_EOM)
@@ -179,7 +161,10 @@ u8 ide_dump_status(ide_drive_t *drive, const char *msg, u8 stat)
                 else
                         ide_dump_atapi_error(drive, err);
         }
-        ide_dump_opcode(drive);
+
+        printk(KERN_ERR "%s: possibly failed opcode: 0x%02x\n",
+                drive->name, drive->hwif->cmd.tf.command);
+
         return err;
 }
 EXPORT_SYMBOL(ide_dump_status);
diff --git a/drivers/ide/ide-pci-generic.c b/drivers/ide/ide-pci-generic.c
index 61111fd2713..39d4e01f5c9 100644
--- a/drivers/ide/ide-pci-generic.c
+++ b/drivers/ide/ide-pci-generic.c
@@ -33,6 +33,16 @@ static int ide_generic_all;		/* Set to claim all devices */
 module_param_named(all_generic_ide, ide_generic_all, bool, 0444);
 MODULE_PARM_DESC(all_generic_ide, "IDE generic will claim all unknown PCI IDE storage controllers.");
 
+static void netcell_quirkproc(ide_drive_t *drive)
+{
+        /* mark words 85-87 as valid */
+        drive->id[ATA_ID_CSF_DEFAULT] |= 0x4000;
+}
+
+static const struct ide_port_ops netcell_port_ops = {
+        .quirkproc              = netcell_quirkproc,
+};
+
 #define DECLARE_GENERIC_PCI_DEV(extra_flags) \
         { \
                 .name           = DRV_NAME, \
@@ -74,6 +84,7 @@ static const struct ide_port_info generic_chipsets[] __devinitdata = {
 
         {       /* 6: Revolution */
                 .name           = DRV_NAME,
+                .port_ops       = &netcell_port_ops,
                 .host_flags     = IDE_HFLAG_CLEAR_SIMPLEX |
                                   IDE_HFLAG_TRUST_BIOS_FOR_DMA |
                                   IDE_HFLAG_OFF_BOARD,
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 7f264ed1141..c895ed52b2e 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -295,7 +295,7 @@ int ide_dev_read_id(ide_drive_t *drive, u8 cmd, u16 *id)
 
         timeout = ((cmd == ATA_CMD_ID_ATA) ? WAIT_WORSTCASE : WAIT_PIDENTIFY) / 2;
 
-        if (ide_busy_sleep(hwif, timeout, use_altstatus))
+        if (ide_busy_sleep(drive, timeout, use_altstatus))
                 return 1;
 
         /* wait for IRQ and ATA_DRQ */
@@ -316,8 +316,9 @@ int ide_dev_read_id(ide_drive_t *drive, u8 cmd, u16 *id)
         return rc;
 }
 
-int ide_busy_sleep(ide_hwif_t *hwif, unsigned long timeout, int altstatus)
+int ide_busy_sleep(ide_drive_t *drive, unsigned long timeout, int altstatus)
 {
+        ide_hwif_t *hwif = drive->hwif;
         u8 stat;
 
         timeout += jiffies;
@@ -330,6 +331,8 @@ int ide_busy_sleep(ide_hwif_t *hwif, unsigned long timeout, int altstatus)
                         return 0;
         } while (time_before(jiffies, timeout));
 
+        printk(KERN_ERR "%s: timeout in %s\n", drive->name, __func__);
+
         return 1;       /* drive timed-out */
 }
 
@@ -420,7 +423,7 @@ static int do_probe (ide_drive_t *drive, u8 cmd)
                         tp_ops->dev_select(drive);
                         msleep(50);
                         tp_ops->exec_command(hwif, ATA_CMD_DEV_RESET);
-                        (void)ide_busy_sleep(hwif, WAIT_WORSTCASE, 0);
+                        (void)ide_busy_sleep(drive, WAIT_WORSTCASE, 0);
                         rc = ide_dev_read_id(drive, cmd, id);
                 }
 
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index cb942a9b580..3a53e0834cf 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -614,12 +614,6 @@ static ide_startstop_t ide_tape_issue_pc(ide_drive_t *drive,
 {
         idetape_tape_t *tape = drive->driver_data;
 
-        if (drive->pc->c[0] == REQUEST_SENSE &&
-            pc->c[0] == REQUEST_SENSE) {
-                printk(KERN_ERR "ide-tape: possible ide-tape.c bug - "
-                        "Two request sense in serial were issued\n");
-        }
-
         if (drive->failed_pc == NULL && pc->c[0] != REQUEST_SENSE)
                 drive->failed_pc = pc;
 
diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
index 248a54bd238..b3bc96f930a 100644
--- a/drivers/ide/pdc202xx_old.c
+++ b/drivers/ide/pdc202xx_old.c
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1998-2002             Andre Hedrick <andre@linux-ide.org>
- *  Copyright (C) 2006-2007             MontaVista Software, Inc.
+ *  Copyright (C) 2006-2007, 2009       MontaVista Software, Inc.
  *  Copyright (C) 2007                  Bartlomiej Zolnierkiewicz
  *
  *  Portions Copyright (C) 1999 Promise Technology, Inc.
@@ -227,28 +227,19 @@ somebody_else:
         return (dma_stat & 4) == 4;     /* return 1 if INTR asserted */
 }
 
-static void pdc202xx_reset_host (ide_hwif_t *hwif)
+static void pdc202xx_reset(ide_drive_t *drive)
 {
+        ide_hwif_t *hwif        = drive->hwif;
         unsigned long high_16   = hwif->extra_base - 16;
         u8 udma_speed_flag      = inb(high_16 | 0x001f);
 
+        printk(KERN_WARNING "PDC202xx: software reset...\n");
+
         outb(udma_speed_flag | 0x10, high_16 | 0x001f);
         mdelay(100);
         outb(udma_speed_flag & ~0x10, high_16 | 0x001f);
         mdelay(2000);   /* 2 seconds ?! */
 
-        printk(KERN_WARNING "PDC202XX: %s channel reset.\n",
-                hwif->channel ? "Secondary" : "Primary");
-}
-
-static void pdc202xx_reset (ide_drive_t *drive)
-{
-        ide_hwif_t *hwif        = drive->hwif;
-        ide_hwif_t *mate        = hwif->mate;
-
-        pdc202xx_reset_host(hwif);
-        pdc202xx_reset_host(mate);
-
         ide_set_max_pio(drive);
 }
 
@@ -328,9 +319,8 @@ static const struct ide_dma_ops pdc20246_dma_ops = {
         .dma_start              = ide_dma_start,
         .dma_end                = ide_dma_end,
         .dma_test_irq           = pdc202xx_dma_test_irq,
-        .dma_lost_irq           = pdc202xx_dma_lost_irq,
+        .dma_lost_irq           = ide_dma_lost_irq,
         .dma_timer_expiry       = ide_dma_sff_timer_expiry,
-        .dma_clear              = pdc202xx_reset,
         .dma_sff_read_status    = ide_dma_sff_read_status,
 };
 
diff --git a/drivers/ide/piix.c b/drivers/ide/piix.c
index 2aa69993306..69860dea382 100644
--- a/drivers/ide/piix.c
+++ b/drivers/ide/piix.c
@@ -263,6 +263,7 @@ static const struct ich_laptop ich_laptop[] = {
         { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
         { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
         { 0x2653, 0x1043, 0x82D8 },     /* ICH6M on Asus Eee 701 */
+        { 0x27df, 0x104d, 0x900e },     /* ICH7 on Sony TZ-90 */
         /* end marker */
         { 0, }
 };
diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
index 3ff7231e485..028de26a25f 100644
--- a/drivers/ide/via82cxxx.c
+++ b/drivers/ide/via82cxxx.c
@@ -67,6 +67,7 @@ static struct via_isa_bridge {
         u8 udma_mask;
         u8 flags;
 } via_isa_bridges[] = {
+        { "vx855",      PCI_DEVICE_ID_VIA_VX855,    0x00, 0x2f, ATA_UDMA6, VIA_BAD_AST },
         { "vx800",      PCI_DEVICE_ID_VIA_VX800,    0x00, 0x2f, ATA_UDMA6, VIA_BAD_AST },
         { "cx700",      PCI_DEVICE_ID_VIA_CX700,    0x00, 0x2f, ATA_UDMA6, VIA_BAD_AST },
         { "vt8237s",    PCI_DEVICE_ID_VIA_8237S,    0x00, 0x2f, ATA_UDMA6, VIA_BAD_AST },
@@ -474,6 +475,7 @@ static const struct pci_device_id via_pci_tbl[] = {
         { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_82C576_1),  0 },
         { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_82C586_1),  0 },
         { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_CX700_IDE), 0 },
+        { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_VX855_IDE), 0 },
         { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_6410),      1 },
         { PCI_VDEVICE(VIA, PCI_DEVICE_ID_VIA_SATA_EIDE), 1 },
         { 0, },
diff --git a/drivers/idle/i7300_idle.c b/drivers/idle/i7300_idle.c
index bf740394d70..949c97ff57e 100644
--- a/drivers/idle/i7300_idle.c
+++ b/drivers/idle/i7300_idle.c
@@ -41,6 +41,10 @@ static int debug;
 module_param_named(debug, debug, uint, 0644);
 MODULE_PARM_DESC(debug, "Enable debug printks in this driver");
 
+static int forceload;
+module_param_named(forceload, forceload, uint, 0644);
+MODULE_PARM_DESC(debug, "Enable driver testing on unvalidated i5000");
+
 #define dprintk(fmt, arg...) \
         do { if (debug) printk(KERN_INFO I7300_PRINT fmt, ##arg); } while (0)
 
@@ -552,7 +556,7 @@ static int __init i7300_idle_init(void)
         cpus_clear(idle_cpumask);
         total_us = 0;
 
-        if (i7300_idle_platform_probe(&fbd_dev, &ioat_dev))
+        if (i7300_idle_platform_probe(&fbd_dev, &ioat_dev, forceload))
                 return -ENODEV;
 
         if (i7300_idle_thrt_save())
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 8d71086f5a1..62f9cf2f94e 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -410,6 +410,7 @@ int cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count)
         ptr = wq->sq_rptr + count;
         sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
         while (ptr != wq->sq_wptr) {
+                sqp->signaled = 0;
                 insert_sq_cqe(wq, cq, sqp);
                 ptr++;
                 sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
index 8dc2bb78160..b3684060465 100644
--- a/drivers/infiniband/hw/ipath/ipath_fs.c
+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
@@ -347,7 +347,7 @@ static int ipathfs_fill_super(struct super_block *sb, void *data,
                 spin_unlock_irqrestore(&ipath_devs_lock, flags);
                 ret = create_device_files(sb, dd);
                 if (ret) {
-                        deactivate_super(sb);
+                        deactivate_locked_super(sb);
                         goto bail;
                 }
                 spin_lock_irqsave(&ipath_devs_lock, flags);
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 9974e886b8d..8a7dd6795fa 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -86,6 +86,7 @@ struct mlx4_ib_mr {
 
 struct mlx4_ib_fast_reg_page_list {
         struct ib_fast_reg_page_list    ibfrpl;
+        __be64                         *mapped_page_list;
         dma_addr_t                      map;
 };
 
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 8e4d26d56a9..8f3666b20ea 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -231,7 +231,11 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
         if (!mfrpl)
                 return ERR_PTR(-ENOMEM);
 
-        mfrpl->ibfrpl.page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
+        mfrpl->ibfrpl.page_list = kmalloc(size, GFP_KERNEL);
+        if (!mfrpl->ibfrpl.page_list)
+                goto err_free;
+
+        mfrpl->mapped_page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
                                                      size, &mfrpl->map,
                                                      GFP_KERNEL);
         if (!mfrpl->ibfrpl.page_list)
@@ -242,6 +246,7 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
         return &mfrpl->ibfrpl;
 
 err_free:
+        kfree(mfrpl->ibfrpl.page_list);
         kfree(mfrpl);
         return ERR_PTR(-ENOMEM);
 }
@@ -252,8 +257,9 @@ void mlx4_ib_free_fast_reg_page_list(struct ib_fast_reg_page_list *page_list)
         struct mlx4_ib_fast_reg_page_list *mfrpl = to_mfrpl(page_list);
         int size = page_list->max_page_list_len * sizeof (u64);
 
-        dma_free_coherent(&dev->dev->pdev->dev, size, page_list->page_list,
+        dma_free_coherent(&dev->dev->pdev->dev, size, mfrpl->mapped_page_list,
                           mfrpl->map);
+        kfree(mfrpl->ibfrpl.page_list);
         kfree(mfrpl);
 }
 
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index f385a24d31d..20724aee76f 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1365,7 +1365,7 @@ static void set_fmr_seg(struct mlx4_wqe_fmr_seg *fseg, struct ib_send_wr *wr)
         int i;
 
         for (i = 0; i < wr->wr.fast_reg.page_list_len; ++i)
-                wr->wr.fast_reg.page_list->page_list[i] =
+                mfrpl->mapped_page_list[i] =
                         cpu_to_be64(wr->wr.fast_reg.page_list->page_list[i] |
                                     MLX4_MTT_FLAG_PRESENT);
 
diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c
index bc4e40f3ede..2d1415e1683 100644
--- a/drivers/input/ff-memless.c
+++ b/drivers/input/ff-memless.c
@@ -226,7 +226,7 @@ static int get_compatible_type(struct ff_device *ff, int effect_type)
  */
 static void ml_combine_effects(struct ff_effect *effect,
                                struct ml_effect_state *state,
-                               int gain)
+                               unsigned int gain)
 {
         struct ff_effect *new = state->effect;
         unsigned int strong, weak, i;
diff --git a/drivers/input/input.c b/drivers/input/input.c
index e54e002665b..5d445f48789 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -42,6 +42,7 @@ static unsigned int input_abs_bypass_init_data[] __initdata = {
         ABS_MT_POSITION_Y,
         ABS_MT_TOOL_TYPE,
         ABS_MT_BLOB_ID,
+        ABS_MT_TRACKING_ID,
         0
 };
 static unsigned long input_abs_bypass[BITS_TO_LONGS(ABS_CNT)];
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 15bb41195be..0e12f89276a 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -843,7 +843,13 @@ static const struct input_device_id joydev_blacklist[] = {
                                 INPUT_DEVICE_ID_MATCH_KEYBIT,
                 .evbit = { BIT_MASK(EV_KEY) },
                 .keybit = { [BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH) },
-        },      /* Avoid itouchpads, touchscreens and tablets */
+        },      /* Avoid itouchpads and touchscreens */
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_DIGI)] = BIT_MASK(BTN_DIGI) },
+        },      /* Avoid tablets, digitisers and similar devices */
         { }     /* Terminating entry */
 };
 
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 444dec07e5d..df3f8aa6811 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -895,6 +895,13 @@ static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = {
 };
 
 /*
+ * Amilo Xi 3650 key release for light touch bar not working
+ */
+static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
+        0x67, 0xed, 0x90, 0xa2, 0x99, 0xa4, 0xae, 0xb0, -1U
+};
+
+/*
  * atkbd_set_keycode_table() initializes keyboard's keycode table
  * according to the selected scancode set
  */
@@ -1560,6 +1567,15 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                 .callback = atkbd_setup_forced_release,
                 .driver_data = atkbd_amilo_pa1510_forced_release_keys,
         },
+        {
+                .ident = "Fujitsu Amilo Xi 3650",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 3650"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_amilo_xi3650_forced_release_keys,
+        },
         { }
 };
 
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index e29cdc13a19..a28c06d686e 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -107,7 +107,7 @@ static void amba_kmi_close(struct serio *io)
         clk_disable(kmi->clk);
 }
 
-static int amba_kmi_probe(struct amba_device *dev, void *id)
+static int amba_kmi_probe(struct amba_device *dev, struct amba_id *id)
 {
         struct amba_kmi_port *kmi;
         struct serio *io;
diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c
index 67248c31e19..be5bbbb8ae4 100644
--- a/drivers/input/serio/libps2.c
+++ b/drivers/input/serio/libps2.c
@@ -210,7 +210,7 @@ int ps2_command(struct ps2dev *ps2dev, unsigned char *param, int command)
         timeout = wait_event_timeout(ps2dev->wait,
                                      !(ps2dev->flags & PS2_FLAG_CMD1), timeout);
 
-        if (ps2dev->cmdcnt && timeout > 0) {
+        if (ps2dev->cmdcnt && !(ps2dev->flags & PS2_FLAG_CMD1)) {
 
                 timeout = ps2_adjust_timeout(ps2dev, command, timeout);
                 wait_event_timeout(ps2dev->wait,
diff --git a/drivers/input/touchscreen/tsc2007.c b/drivers/input/touchscreen/tsc2007.c
index edd4f64d1f4..880f58c6a7c 100644
--- a/drivers/input/touchscreen/tsc2007.c
+++ b/drivers/input/touchscreen/tsc2007.c
@@ -200,8 +200,9 @@ static int tsc2007_read_values(struct tsc2007 *tsc)
 static enum hrtimer_restart tsc2007_timer(struct hrtimer *handle)
 {
         struct tsc2007 *ts = container_of(handle, struct tsc2007, timer);
+        unsigned long flags;
 
-        spin_lock_irq(&ts->lock);
+        spin_lock_irqsave(&ts->lock, flags);
 
         if (unlikely(!ts->get_pendown_state() && ts->pendown)) {
                 struct input_dev *input = ts->input;
@@ -222,7 +223,7 @@ static enum hrtimer_restart tsc2007_timer(struct hrtimer *handle)
                 tsc2007_send_event(ts);
         }
 
-        spin_unlock_irq(&ts->lock);
+        spin_unlock_irqrestore(&ts->lock, flags);
 
         return HRTIMER_NORESTART;
 }
diff --git a/drivers/input/touchscreen/ucb1400_ts.c b/drivers/input/touchscreen/ucb1400_ts.c
index f100c7f4c1d..6954f550010 100644
--- a/drivers/input/touchscreen/ucb1400_ts.c
+++ b/drivers/input/touchscreen/ucb1400_ts.c
@@ -419,7 +419,7 @@ static int ucb1400_ts_remove(struct platform_device *dev)
 #ifdef CONFIG_PM
 static int ucb1400_ts_resume(struct platform_device *dev)
 {
-        struct ucb1400_ts *ucb = platform_get_drvdata(dev);
+        struct ucb1400_ts *ucb = dev->dev.platform_data;
 
         if (ucb->ts_task) {
                 /*
diff --git a/drivers/isdn/capi/capifs.c b/drivers/isdn/capi/capifs.c
index b129409925a..bff72d81f26 100644
--- a/drivers/isdn/capi/capifs.c
+++ b/drivers/isdn/capi/capifs.c
@@ -75,15 +75,17 @@ static int capifs_remount(struct super_block *s, int *flags, char *data)
                 }
         }
 
-        kfree(s->s_options);
-        s->s_options = new_opt;
+        mutex_lock(&s->s_root->d_inode->i_mutex);
 
+        replace_mount_options(s, new_opt);
         config.setuid  = setuid;
         config.setgid  = setgid;
         config.uid     = uid;
         config.gid     = gid;
         config.mode    = mode;
 
+        mutex_unlock(&s->s_root->d_inode->i_mutex);
+
         return 0;
 }
 
@@ -154,13 +156,16 @@ void capifs_new_ncci(unsigned int number, dev_t device)
         if (!inode)
                 return;
         inode->i_ino = number+2;
+
+        dentry = get_node(number);
+
+        /* config contents is protected by root's i_mutex */
         inode->i_uid = config.setuid ? config.uid : current_fsuid();
         inode->i_gid = config.setgid ? config.gid : current_fsgid();
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
         init_special_inode(inode, S_IFCHR|config.mode, device);
         //inode->i_op = &capifs_file_inode_operations;
 
-        dentry = get_node(number);
         if (!IS_ERR(dentry) && !dentry->d_inode)
                 d_instantiate(dentry, inode);
         mutex_unlock(&capifs_root->d_inode->i_mutex);
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index b171e75cb52..29808c4fb1c 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -175,7 +175,7 @@ int gigaset_isowbuf_getbytes(struct isowbuf_t *iwb, int size)
                 return -EINVAL;
         }
         src = iwb->read;
-        if (unlikely(limit > BAS_OUTBUFSIZE + BAS_OUTBUFPAD ||
+        if (unlikely(limit >= BAS_OUTBUFSIZE + BAS_OUTBUFPAD ||
                      (read < src && limit >= src))) {
                 pr_err("isoc write buffer frame reservation violated\n");
                 return -EFAULT;
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index 1a83910f674..eaf722fe309 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -358,6 +358,16 @@ void lguest_arch_handle_trap(struct lg_cpu *cpu)
                         if (emulate_insn(cpu))
                                 return;
                 }
+                /* If KVM is active, the vmcall instruction triggers a
+                 * General Protection Fault.  Normally it triggers an
+                 * invalid opcode fault (6): */
+        case 6:
+                /* We need to check if ring == GUEST_PL and
+                 * faulting instruction == vmcall. */
+                if (is_hypercall(cpu)) {
+                        rewrite_hypercall(cpu);
+                        return;
+                }
                 break;
         case 14: /* We've intercepted a Page Fault. */
                 /* The Guest accessed a virtual address that wasn't mapped.
@@ -403,15 +413,6 @@ void lguest_arch_handle_trap(struct lg_cpu *cpu)
                  * up the pointer now to indicate a hypercall is pending. */
                 cpu->hcall = (struct hcall_args *)cpu->regs;
                 return;
-        case 6:
-                /* kvm hypercalls trigger an invalid opcode fault (6).
-                 * We need to check if ring == GUEST_PL and
-                 * faulting instruction == vmcall. */
-                if (is_hypercall(cpu)) {
-                        rewrite_hypercall(cpu);
-                        return;
-                }
-                break;
         }
 
         /* We didn't handle the trap, so it needs to go to the Guest. */
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 47c68bc75a1..56df1cee8fb 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1097,14 +1097,12 @@ void bitmap_daemon_work(struct bitmap *bitmap)
         }
         bitmap->allclean = 1;
 
+        spin_lock_irqsave(&bitmap->lock, flags);
         for (j = 0; j < bitmap->chunks; j++) {
                 bitmap_counter_t *bmc;
-                spin_lock_irqsave(&bitmap->lock, flags);
-                if (!bitmap->filemap) {
+                if (!bitmap->filemap)
                         /* error or shutdown */
-                        spin_unlock_irqrestore(&bitmap->lock, flags);
                         break;
-                }
 
                 page = filemap_get_page(bitmap, j);
 
@@ -1121,6 +1119,8 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                                         write_page(bitmap, page, 0);
                                         bitmap->allclean = 0;
                                 }
+                                spin_lock_irqsave(&bitmap->lock, flags);
+                                j |= (PAGE_BITS - 1);
                                 continue;
                         }
 
@@ -1181,9 +1181,10 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                                         ext2_clear_bit(file_page_offset(j), paddr);
                                 kunmap_atomic(paddr, KM_USER0);
                         }
-                }
-                spin_unlock_irqrestore(&bitmap->lock, flags);
+                } else
+                        j |= PAGE_COUNTER_MASK;
         }
+        spin_unlock_irqrestore(&bitmap->lock, flags);
 
         /* now sync the final page */
         if (lastpage != NULL) {
diff --git a/drivers/md/md.c b/drivers/md/md.c
index fccc8343a25..641b211fe3f 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1375,6 +1375,9 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
 
         sb->raid_disks = cpu_to_le32(mddev->raid_disks);
         sb->size = cpu_to_le64(mddev->dev_sectors);
+        sb->chunksize = cpu_to_le32(mddev->chunk_size >> 9);
+        sb->level = cpu_to_le32(mddev->level);
+        sb->layout = cpu_to_le32(mddev->layout);
 
         if (mddev->bitmap && mddev->bitmap_file == NULL) {
                 sb->bitmap_offset = cpu_to_le32((__u32)mddev->bitmap_offset);
@@ -3303,7 +3306,9 @@ static ssize_t
 action_show(mddev_t *mddev, char *page)
 {
         char *type = "idle";
-        if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
+        if (test_bit(MD_RECOVERY_FROZEN, &mddev->recovery))
+                type = "frozen";
+        else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
             (!mddev->ro && test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))) {
                 if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery))
                         type = "reshape";
@@ -3326,7 +3331,12 @@ action_store(mddev_t *mddev, const char *page, size_t len)
         if (!mddev->pers || !mddev->pers->sync_request)
                 return -EINVAL;
 
-        if (cmd_match(page, "idle")) {
+        if (cmd_match(page, "frozen"))
+                set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+        else
+                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+
+        if (cmd_match(page, "idle") || cmd_match(page, "frozen")) {
                 if (mddev->sync_thread) {
                         set_bit(MD_RECOVERY_INTR, &mddev->recovery);
                         md_unregister_thread(mddev->sync_thread);
@@ -3680,7 +3690,7 @@ array_size_store(mddev_t *mddev, const char *buf, size_t len)
                 if (strict_blocks_to_sectors(buf, &sectors) < 0)
                         return -EINVAL;
                 if (mddev->pers && mddev->pers->size(mddev, 0, 0) < sectors)
-                        return -EINVAL;
+                        return -E2BIG;
 
                 mddev->external_size = 1;
         }
@@ -5557,7 +5567,7 @@ static struct block_device_operations md_fops =
         .owner          = THIS_MODULE,
         .open           = md_open,
         .release        = md_release,
-        .locked_ioctl   = md_ioctl,
+        .ioctl          = md_ioctl,
         .getgeo         = md_getgeo,
         .media_changed  = md_media_changed,
         .revalidate_disk= md_revalidate,
@@ -6352,12 +6362,13 @@ void md_do_sync(mddev_t *mddev)
 
                 skipped = 0;
 
-                if ((mddev->curr_resync > mddev->curr_resync_completed &&
-                     (mddev->curr_resync - mddev->curr_resync_completed)
-                    > (max_sectors >> 4)) ||
-                    (j - mddev->curr_resync_completed)*2
-                    >= mddev->resync_max - mddev->curr_resync_completed
-                        ) {
+                if (!test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
+                    ((mddev->curr_resync > mddev->curr_resync_completed &&
+                      (mddev->curr_resync - mddev->curr_resync_completed)
+                      > (max_sectors >> 4)) ||
+                     (j - mddev->curr_resync_completed)*2
+                     >= mddev->resync_max - mddev->curr_resync_completed
+                            )) {
                         /* time to update curr_resync_completed */
                         blk_unplug(mddev->queue);
                         wait_event(mddev->recovery_wait,
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4616bc3a6e7..bb37fb1b2d8 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -362,7 +362,7 @@ static void raid5_unplug_device(struct request_queue *q);
 
 static struct stripe_head *
 get_active_stripe(raid5_conf_t *conf, sector_t sector,
-                  int previous, int noblock)
+                  int previous, int noblock, int noquiesce)
 {
         struct stripe_head *sh;
 
@@ -372,7 +372,7 @@ get_active_stripe(raid5_conf_t *conf, sector_t sector,
 
         do {
                 wait_event_lock_irq(conf->wait_for_stripe,
-                                    conf->quiesce == 0,
+                                    conf->quiesce == 0 || noquiesce,
                                     conf->device_lock, /* nothing */);
                 sh = __find_stripe(conf, sector, conf->generation - previous);
                 if (!sh) {
@@ -2671,7 +2671,7 @@ static void handle_stripe_expansion(raid5_conf_t *conf, struct stripe_head *sh,
                         sector_t bn = compute_blocknr(sh, i, 1);
                         sector_t s = raid5_compute_sector(conf, bn, 0,
                                                           &dd_idx, NULL);
-                        sh2 = get_active_stripe(conf, s, 0, 1);
+                        sh2 = get_active_stripe(conf, s, 0, 1, 1);
                         if (sh2 == NULL)
                                 /* so far only the early blocks of this stripe
                                  * have been requested.  When later blocks
@@ -2944,7 +2944,7 @@ static bool handle_stripe5(struct stripe_head *sh)
         /* Finish reconstruct operations initiated by the expansion process */
         if (sh->reconstruct_state == reconstruct_state_result) {
                 struct stripe_head *sh2
-                        = get_active_stripe(conf, sh->sector, 1, 1);
+                        = get_active_stripe(conf, sh->sector, 1, 1, 1);
                 if (sh2 && test_bit(STRIPE_EXPAND_SOURCE, &sh2->state)) {
                         /* sh cannot be written until sh2 has been read.
                          * so arrange for sh to be delayed a little
@@ -3189,7 +3189,7 @@ static bool handle_stripe6(struct stripe_head *sh, struct page *tmp_page)
 
         if (s.expanded && test_bit(STRIPE_EXPANDING, &sh->state)) {
                 struct stripe_head *sh2
-                        = get_active_stripe(conf, sh->sector, 1, 1);
+                        = get_active_stripe(conf, sh->sector, 1, 1, 1);
                 if (sh2 && test_bit(STRIPE_EXPAND_SOURCE, &sh2->state)) {
                         /* sh cannot be written until sh2 has been read.
                          * so arrange for sh to be delayed a little
@@ -3288,7 +3288,7 @@ static void unplug_slaves(mddev_t *mddev)
         int i;
 
         rcu_read_lock();
-        for (i=0; i<mddev->raid_disks; i++) {
+        for (i = 0; i < conf->raid_disks; i++) {
                 mdk_rdev_t *rdev = rcu_dereference(conf->disks[i].rdev);
                 if (rdev && !test_bit(Faulty, &rdev->flags) && atomic_read(&rdev->nr_pending)) {
                         struct request_queue *r_queue = bdev_get_queue(rdev->bdev);
@@ -3675,7 +3675,7 @@ static int make_request(struct request_queue *q, struct bio * bi)
                         (unsigned long long)logical_sector);
 
                 sh = get_active_stripe(conf, new_sector, previous,
-                                       (bi->bi_rw&RWA_MASK));
+                                       (bi->bi_rw&RWA_MASK), 0);
                 if (sh) {
                         if (unlikely(previous)) {
                                 /* expansion might have moved on while waiting for a
@@ -3811,13 +3811,13 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
         safepos = conf->reshape_safe;
         sector_div(safepos, data_disks);
         if (mddev->delta_disks < 0) {
-                writepos -= reshape_sectors;
+                writepos -= min_t(sector_t, reshape_sectors, writepos);
                 readpos += reshape_sectors;
                 safepos += reshape_sectors;
         } else {
                 writepos += reshape_sectors;
-                readpos -= reshape_sectors;
-                safepos -= reshape_sectors;
+                readpos -= min_t(sector_t, reshape_sectors, readpos);
+                safepos -= min_t(sector_t, reshape_sectors, safepos);
         }
 
         /* 'writepos' is the most advanced device address we might write.
@@ -3873,7 +3873,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
         for (i = 0; i < reshape_sectors; i += STRIPE_SECTORS) {
                 int j;
                 int skipped = 0;
-                sh = get_active_stripe(conf, stripe_addr+i, 0, 0);
+                sh = get_active_stripe(conf, stripe_addr+i, 0, 0, 1);
                 set_bit(STRIPE_EXPANDING, &sh->state);
                 atomic_inc(&conf->reshape_stripes);
                 /* If any of this stripe is beyond the end of the old
@@ -3916,13 +3916,13 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                 raid5_compute_sector(conf, stripe_addr*(new_data_disks),
                                      1, &dd_idx, NULL);
         last_sector =
-                raid5_compute_sector(conf, ((stripe_addr+conf->chunk_size/512)
+                raid5_compute_sector(conf, ((stripe_addr+reshape_sectors)
                                             *(new_data_disks) - 1),
                                      1, &dd_idx, NULL);
         if (last_sector >= mddev->dev_sectors)
                 last_sector = mddev->dev_sectors - 1;
         while (first_sector <= last_sector) {
-                sh = get_active_stripe(conf, first_sector, 1, 0);
+                sh = get_active_stripe(conf, first_sector, 1, 0, 1);
                 set_bit(STRIPE_EXPAND_SOURCE, &sh->state);
                 set_bit(STRIPE_HANDLE, &sh->state);
                 release_stripe(sh);
@@ -4022,9 +4022,9 @@ static inline sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *ski
 
         bitmap_cond_end_sync(mddev->bitmap, sector_nr);
 
-        sh = get_active_stripe(conf, sector_nr, 0, 1);
+        sh = get_active_stripe(conf, sector_nr, 0, 1, 0);
         if (sh == NULL) {
-                sh = get_active_stripe(conf, sector_nr, 0, 0);
+                sh = get_active_stripe(conf, sector_nr, 0, 0, 0);
                 /* make sure we don't swamp the stripe cache if someone else
                  * is trying to get access
                  */
@@ -4034,7 +4034,7 @@ static inline sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *ski
          * We don't need to check the 'failed' flag as when that gets set,
          * recovery aborts.
          */
-        for (i=0; i<mddev->raid_disks; i++)
+        for (i = 0; i < conf->raid_disks; i++)
                 if (conf->disks[i].rdev == NULL)
                         still_degraded = 1;
 
@@ -4086,7 +4086,7 @@ static int  retry_aligned_read(raid5_conf_t *conf, struct bio *raid_bio)
                         /* already done this stripe */
                         continue;
 
-                sh = get_active_stripe(conf, sector, 0, 1);
+                sh = get_active_stripe(conf, sector, 0, 1, 0);
 
                 if (!sh) {
                         /* failed to get a stripe - must wait */
diff --git a/drivers/media/radio/radio-sf16fmi.c b/drivers/media/radio/radio-sf16fmi.c
index 1dba8f0832a..5cf6c45b91f 100644
--- a/drivers/media/radio/radio-sf16fmi.c
+++ b/drivers/media/radio/radio-sf16fmi.c
@@ -153,7 +153,7 @@ static int vidioc_g_tuner(struct file *file, void *priv,
         mult = (fmi->flags & V4L2_TUNER_CAP_LOW) ? 1 : 1000;
         v->rangelow = RSF16_MINFREQ / mult;
         v->rangehigh = RSF16_MAXFREQ / mult;
-        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_MODE_STEREO;
+        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
         v->capability = fmi->flags & V4L2_TUNER_CAP_LOW;
         v->audmode = V4L2_TUNER_MODE_STEREO;
         v->signal = fmi_getsigstr(fmi);
diff --git a/drivers/media/radio/radio-sf16fmr2.c b/drivers/media/radio/radio-sf16fmr2.c
index c09ca8600ea..935ff9bcdfc 100644
--- a/drivers/media/radio/radio-sf16fmr2.c
+++ b/drivers/media/radio/radio-sf16fmr2.c
@@ -233,7 +233,7 @@ static int vidioc_g_tuner(struct file *file, void *priv,
         mult = (fmr2->flags & V4L2_TUNER_CAP_LOW) ? 1 : 1000;
         v->rangelow = RSF16_MINFREQ / mult;
         v->rangehigh = RSF16_MAXFREQ / mult;
-        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_MODE_STEREO;
+        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
         v->capability = fmr2->flags&V4L2_TUNER_CAP_LOW;
         v->audmode = fmr2->stereo ? V4L2_TUNER_MODE_STEREO:
                                 V4L2_TUNER_MODE_MONO;
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index 5f582726985..c4d181dde1c 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -774,6 +774,7 @@ static int cafe_cam_init(struct cafe_camera *cam)
         ret = __cafe_cam_reset(cam);
         if (ret)
                 goto out;
+        chip.ident = V4L2_IDENT_NONE;
         chip.match.type = V4L2_CHIP_MATCH_I2C_ADDR;
         chip.match.addr = cam->sensor_addr;
         ret = sensor_call(cam, core, g_chip_ident, &chip);
diff --git a/drivers/media/video/cx23885/cx23885-dvb.c b/drivers/media/video/cx23885/cx23885-dvb.c
index 0c49a98213c..1dc070da865 100644
--- a/drivers/media/video/cx23885/cx23885-dvb.c
+++ b/drivers/media/video/cx23885/cx23885-dvb.c
@@ -472,7 +472,7 @@ static int dvb_register(struct cx23885_tsport *port)
                         static struct xc2028_ctrl ctl = {
                                 .fname       = XC2028_DEFAULT_FIRMWARE,
                                 .max_len     = 64,
-                                .scode_table = XC3028_FE_OREN538,
+                                .demod       = XC3028_FE_OREN538,
                         };
 
                         fe = dvb_attach(xc2028_attach,
diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
index b0195e8ee4d..db2ac9a99ac 100644
--- a/drivers/media/video/ivtv/ivtv-driver.c
+++ b/drivers/media/video/ivtv/ivtv-driver.c
@@ -305,14 +305,17 @@ int ivtv_waitq(wait_queue_head_t *waitq)
 /* Generic utility functions */
 int ivtv_msleep_timeout(unsigned int msecs, int intr)
 {
-        int ret;
         int timeout = msecs_to_jiffies(msecs);
 
         do {
                 set_current_state(intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
                 timeout = schedule_timeout(timeout);
-                if (intr && (ret = signal_pending(current)))
-                        return ret;
+                if (intr) {
+                        int ret = signal_pending(current);
+
+                        if (ret)
+                                return ret;
+                }
         } while (timeout);
         return 0;
 }
diff --git a/drivers/media/video/ivtv/ivtv-gpio.c b/drivers/media/video/ivtv/ivtv-gpio.c
index ceb05bdcaf6..85ac707228e 100644
--- a/drivers/media/video/ivtv/ivtv-gpio.c
+++ b/drivers/media/video/ivtv/ivtv-gpio.c
@@ -190,8 +190,8 @@ static int subdev_g_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
 
         mask = itv->card->gpio_audio_detect.mask;
         if (mask == 0 || (read_reg(IVTV_REG_GPIO_IN) & mask))
-                vt->rxsubchans = V4L2_TUNER_MODE_STEREO |
-                        V4L2_TUNER_MODE_LANG1 | V4L2_TUNER_MODE_LANG2;
+                vt->rxsubchans = V4L2_TUNER_SUB_STEREO |
+                        V4L2_TUNER_SUB_LANG1 | V4L2_TUNER_SUB_LANG2;
         else
                 vt->rxsubchans = V4L2_TUNER_SUB_MONO;
         return 0;
diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
index 4a2d464f055..c342a9fe983 100644
--- a/drivers/media/video/ivtv/ivtv-ioctl.c
+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
@@ -180,7 +180,7 @@ int ivtv_set_speed(struct ivtv *itv, int speed)
 
                 /* Wait for any DMA to finish */
                 prepare_to_wait(&itv->dma_waitq, &wait, TASK_INTERRUPTIBLE);
-                while (itv->i_flags & IVTV_F_I_DMA) {
+                while (test_bit(IVTV_F_I_DMA, &itv->i_flags)) {
                         got_sig = signal_pending(current);
                         if (got_sig)
                                 break;
@@ -1710,7 +1710,8 @@ static int ivtv_decoder_ioctls(struct file *filp, unsigned int cmd, void *arg)
                            we are waiting unlock first and later lock again. */
                         mutex_unlock(&itv->serialize_lock);
                         prepare_to_wait(&itv->event_waitq, &wait, TASK_INTERRUPTIBLE);
-                        if ((itv->i_flags & (IVTV_F_I_EV_DEC_STOPPED|IVTV_F_I_EV_VSYNC)) == 0)
+                        if (!test_bit(IVTV_F_I_EV_DEC_STOPPED, &itv->i_flags) &&
+                            !test_bit(IVTV_F_I_EV_VSYNC, &itv->i_flags))
                                 schedule();
                         finish_wait(&itv->event_waitq, &wait);
                         mutex_lock(&itv->serialize_lock);
diff --git a/drivers/media/video/ivtv/ivtv-irq.c b/drivers/media/video/ivtv/ivtv-irq.c
index 01c14d2b381..cd9db0bf33b 100644
--- a/drivers/media/video/ivtv/ivtv-irq.c
+++ b/drivers/media/video/ivtv/ivtv-irq.c
@@ -196,7 +196,7 @@ static int stream_enc_dma_append(struct ivtv_stream *s, u32 data[CX2341X_MBOX_MA
                                 bytes_needed, s->name);
                 return -1;
         }
-        if (rc && !s->buffers_stolen && (s->s_flags & IVTV_F_S_APPL_IO)) {
+        if (rc && !s->buffers_stolen && test_bit(IVTV_F_S_APPL_IO, &s->s_flags)) {
                 IVTV_WARN("All %s stream buffers are full. Dropping data.\n", s->name);
                 IVTV_WARN("Cause: the application is not reading fast enough.\n");
         }
diff --git a/drivers/media/video/ivtv/ivtv-queue.c b/drivers/media/video/ivtv/ivtv-queue.c
index ff7b7deded4..7fde36e6d22 100644
--- a/drivers/media/video/ivtv/ivtv-queue.c
+++ b/drivers/media/video/ivtv/ivtv-queue.c
@@ -230,7 +230,8 @@ int ivtv_stream_alloc(struct ivtv_stream *s)
                 return -ENOMEM;
         }
         if (ivtv_might_use_dma(s)) {
-                s->sg_handle = pci_map_single(itv->pdev, s->sg_dma, sizeof(struct ivtv_sg_element), s->dma);
+                s->sg_handle = pci_map_single(itv->pdev, s->sg_dma,
+                                sizeof(struct ivtv_sg_element), PCI_DMA_TODEVICE);
                 ivtv_stream_sync_for_cpu(s);
         }
 
diff --git a/drivers/media/video/ivtv/ivtv-yuv.c b/drivers/media/video/ivtv/ivtv-yuv.c
index 7912ed6b72e..c0875378acc 100644
--- a/drivers/media/video/ivtv/ivtv-yuv.c
+++ b/drivers/media/video/ivtv/ivtv-yuv.c
@@ -1063,7 +1063,8 @@ static int ivtv_yuv_udma_frame(struct ivtv *itv, struct ivtv_dma_frame *args)
         prepare_to_wait(&itv->dma_waitq, &wait, TASK_INTERRUPTIBLE);
         /* if no UDMA is pending and no UDMA is in progress, then the DMA
            is finished */
-        while (itv->i_flags & (IVTV_F_I_UDMA_PENDING | IVTV_F_I_UDMA)) {
+        while (test_bit(IVTV_F_I_UDMA_PENDING, &itv->i_flags) ||
+               test_bit(IVTV_F_I_UDMA, &itv->i_flags)) {
                 /* don't interrupt if the DMA is in progress but break off
                    a still pending DMA. */
                 got_sig = signal_pending(current);
diff --git a/drivers/media/video/ivtv/ivtvfb.c b/drivers/media/video/ivtv/ivtvfb.c
index 66e6eb51307..fa6bb85cb4b 100644
--- a/drivers/media/video/ivtv/ivtvfb.c
+++ b/drivers/media/video/ivtv/ivtvfb.c
@@ -298,7 +298,8 @@ static int ivtvfb_prep_dec_dma_to_device(struct ivtv *itv,
         prepare_to_wait(&itv->dma_waitq, &wait, TASK_INTERRUPTIBLE);
         /* if no UDMA is pending and no UDMA is in progress, then the DMA
            is finished */
-        while (itv->i_flags & (IVTV_F_I_UDMA_PENDING | IVTV_F_I_UDMA)) {
+        while (test_bit(IVTV_F_I_UDMA_PENDING, &itv->i_flags) ||
+               test_bit(IVTV_F_I_UDMA, &itv->i_flags)) {
                 /* don't interrupt if the DMA is in progress but break off
                    a still pending DMA. */
                 got_sig = signal_pending(current);
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 399412d7f02..507dc85646b 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1726,14 +1726,17 @@ static int uvc_suspend(struct usb_interface *intf, pm_message_t message)
 static int __uvc_resume(struct usb_interface *intf, int reset)
 {
         struct uvc_device *dev = usb_get_intfdata(intf);
-        int ret;
 
         uvc_trace(UVC_TRACE_SUSPEND, "Resuming interface %u\n",
                 intf->cur_altsetting->desc.bInterfaceNumber);
 
         if (intf->cur_altsetting->desc.bInterfaceSubClass == SC_VIDEOCONTROL) {
-                if (reset && (ret = uvc_ctrl_resume_device(dev)) < 0)
-                        return ret;
+                if (reset) {
+                        int ret = uvc_ctrl_resume_device(dev);
+
+                        if (ret < 0)
+                                return ret;
+                }
 
                 return uvc_status_resume(dev);
         }
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index a95e17329c5..6ce974d7362 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -742,7 +742,7 @@ static int uvc_alloc_urb_buffers(struct uvc_video_device *video,
 
         /* Buffers are already allocated, bail out. */
         if (video->urb_size)
-                return 0;
+                return video->urb_size / psize;
 
         /* Compute the number of packets. Bulk endpoints might transfer UVC
          * payloads accross multiple URBs.
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index 88f10d6cbc9..be64a502ea2 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -42,6 +42,12 @@
                         printk(KERN_DEBUG "%s: " fmt, vfd->name, ## arg);\
                 } while (0)
 
+/* Zero out the end of the struct pointed to by p.  Everthing after, but
+ * not including, the specified field is cleared. */
+#define CLEAR_AFTER_FIELD(p, field) \
+        memset((u8 *)(p) + offsetof(typeof(*(p)), field) + sizeof((p)->field), \
+        0, sizeof(*(p)) - offsetof(typeof(*(p)), field) - sizeof((p)->field))
+
 struct std_descr {
         v4l2_std_id std;
         const char *descr;
@@ -544,39 +550,39 @@ static int check_fmt(const struct v4l2_ioctl_ops *ops, enum v4l2_buf_type type)
 
         switch (type) {
         case V4L2_BUF_TYPE_VIDEO_CAPTURE:
-                if (ops->vidioc_try_fmt_vid_cap)
+                if (ops->vidioc_g_fmt_vid_cap)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VIDEO_OVERLAY:
-                if (ops->vidioc_try_fmt_vid_overlay)
+                if (ops->vidioc_g_fmt_vid_overlay)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VIDEO_OUTPUT:
-                if (ops->vidioc_try_fmt_vid_out)
+                if (ops->vidioc_g_fmt_vid_out)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
-                if (ops->vidioc_try_fmt_vid_out_overlay)
+                if (ops->vidioc_g_fmt_vid_out_overlay)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VBI_CAPTURE:
-                if (ops->vidioc_try_fmt_vbi_cap)
+                if (ops->vidioc_g_fmt_vbi_cap)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VBI_OUTPUT:
-                if (ops->vidioc_try_fmt_vbi_out)
+                if (ops->vidioc_g_fmt_vbi_out)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
-                if (ops->vidioc_try_fmt_sliced_vbi_cap)
+                if (ops->vidioc_g_fmt_sliced_vbi_cap)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
-                if (ops->vidioc_try_fmt_sliced_vbi_out)
+                if (ops->vidioc_g_fmt_sliced_vbi_out)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_PRIVATE:
-                if (ops->vidioc_try_fmt_type_private)
+                if (ops->vidioc_g_fmt_type_private)
                         return 0;
                 break;
         }
@@ -782,44 +788,53 @@ static long __video_do_ioctl(struct file *file,
 
                 switch (f->type) {
                 case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         if (ops->vidioc_s_fmt_vid_cap)
                                 ret = ops->vidioc_s_fmt_vid_cap(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_s_fmt_vid_overlay)
                                 ret = ops->vidioc_s_fmt_vid_overlay(file,
                                                                     fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         if (ops->vidioc_s_fmt_vid_out)
                                 ret = ops->vidioc_s_fmt_vid_out(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_s_fmt_vid_out_overlay)
                                 ret = ops->vidioc_s_fmt_vid_out_overlay(file,
                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_s_fmt_vbi_cap)
                                 ret = ops->vidioc_s_fmt_vbi_cap(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_s_fmt_vbi_out)
                                 ret = ops->vidioc_s_fmt_vbi_out(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_s_fmt_sliced_vbi_cap)
                                 ret = ops->vidioc_s_fmt_sliced_vbi_cap(file,
                                                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_s_fmt_sliced_vbi_out)
                                 ret = ops->vidioc_s_fmt_sliced_vbi_out(file,
                                                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_PRIVATE:
+                        /* CLEAR_AFTER_FIELD(f, fmt.raw_data); <- does nothing */
                         if (ops->vidioc_s_fmt_type_private)
                                 ret = ops->vidioc_s_fmt_type_private(file,
                                                                 fh, f);
@@ -836,46 +851,55 @@ static long __video_do_ioctl(struct file *file,
                                                 v4l2_type_names));
                 switch (f->type) {
                 case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         if (ops->vidioc_try_fmt_vid_cap)
                                 ret = ops->vidioc_try_fmt_vid_cap(file, fh, f);
                         if (!ret)
                                 v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_try_fmt_vid_overlay)
                                 ret = ops->vidioc_try_fmt_vid_overlay(file,
                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         if (ops->vidioc_try_fmt_vid_out)
                                 ret = ops->vidioc_try_fmt_vid_out(file, fh, f);
                         if (!ret)
                                 v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_try_fmt_vid_out_overlay)
                                 ret = ops->vidioc_try_fmt_vid_out_overlay(file,
                                        fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_try_fmt_vbi_cap)
                                 ret = ops->vidioc_try_fmt_vbi_cap(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_try_fmt_vbi_out)
                                 ret = ops->vidioc_try_fmt_vbi_out(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_try_fmt_sliced_vbi_cap)
                                 ret = ops->vidioc_try_fmt_sliced_vbi_cap(file,
                                                                 fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_try_fmt_sliced_vbi_out)
                                 ret = ops->vidioc_try_fmt_sliced_vbi_out(file,
                                                                 fh, f);
                         break;
                 case V4L2_BUF_TYPE_PRIVATE:
+                        /* CLEAR_AFTER_FIELD(f, fmt.raw_data); <- does nothing */
                         if (ops->vidioc_try_fmt_type_private)
                                 ret = ops->vidioc_try_fmt_type_private(file,
                                                                 fh, f);
@@ -898,6 +922,9 @@ static long __video_do_ioctl(struct file *file,
                 if (ret)
                         break;
 
+                if (p->type < V4L2_BUF_TYPE_PRIVATE)
+                        CLEAR_AFTER_FIELD(p, memory);
+
                 ret = ops->vidioc_reqbufs(file, fh, p);
                 dbgarg(cmd, "count=%d, type=%s, memory=%s\n",
                                 p->count,
diff --git a/drivers/media/video/zoran/zoran_driver.c b/drivers/media/video/zoran/zoran_driver.c
index 092333b1c34..643cccaa1aa 100644
--- a/drivers/media/video/zoran/zoran_driver.c
+++ b/drivers/media/video/zoran/zoran_driver.c
@@ -1863,22 +1863,20 @@ static int zoran_querycap(struct file *file, void *__fh, struct v4l2_capability
 
 static int zoran_enum_fmt(struct zoran *zr, struct v4l2_fmtdesc *fmt, int flag)
 {
-        int num = -1, i;
-
-        for (i = 0; i < NUM_FORMATS; i++) {
-                if (zoran_formats[i].flags & flag)
-                        num++;
-                if (num == fmt->index)
-                        break;
+        unsigned int num, i;
+
+        for (num = i = 0; i < NUM_FORMATS; i++) {
+                if (zoran_formats[i].flags & flag && num++ == fmt->index) {
+                        strncpy(fmt->description, zoran_formats[i].name,
+                                sizeof(fmt->description) - 1);
+                        /* fmt struct pre-zeroed, so adding '\0' not neeed */
+                        fmt->pixelformat = zoran_formats[i].fourcc;
+                        if (zoran_formats[i].flags & ZORAN_FORMAT_COMPRESSED)
+                                fmt->flags |= V4L2_FMT_FLAG_COMPRESSED;
+                        return 0;
+                }
         }
-        if (fmt->index < 0 /* late, but not too late */  || i == NUM_FORMATS)
-                return -EINVAL;
-
-        strncpy(fmt->description, zoran_formats[i].name, sizeof(fmt->description)-1);
-        fmt->pixelformat = zoran_formats[i].fourcc;
-        if (zoran_formats[i].flags & ZORAN_FORMAT_COMPRESSED)
-                fmt->flags |= V4L2_FMT_FLAG_COMPRESSED;
-        return 0;
+        return -EINVAL;
 }
 
 static int zoran_enum_fmt_vid_cap(struct file *file, void *__fh,
diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
index 7793932a513..11a6248cc1c 100644
--- a/drivers/mfd/pcf50633-core.c
+++ b/drivers/mfd/pcf50633-core.c
@@ -443,7 +443,7 @@ static irqreturn_t pcf50633_irq(int irq, void *data)
         dev_dbg(pcf->dev, "pcf50633_irq\n");
 
         get_device(pcf->dev);
-        disable_irq(pcf->irq);
+        disable_irq_nosync(pcf->irq);
         schedule_work(&pcf->irq_work);
 
         return IRQ_HANDLED;
diff --git a/drivers/mfd/wm8350-core.c b/drivers/mfd/wm8350-core.c
index c2be3088e2e..fe24079387c 100644
--- a/drivers/mfd/wm8350-core.c
+++ b/drivers/mfd/wm8350-core.c
@@ -79,10 +79,6 @@ static int wm8350_phys_read(struct wm8350 *wm8350, u8 reg, int num_regs,
                 /* Cache is CPU endian */
                 dest[i - reg] = be16_to_cpu(dest[i - reg]);
 
-                /* Satisfy non-volatile bits from cache */
-                dest[i - reg] &= wm8350_reg_io_map[i].vol;
-                dest[i - reg] |= wm8350->reg_cache[i];
-
                 /* Mask out non-readable bits */
                 dest[i - reg] &= wm8350_reg_io_map[i].readable;
         }
@@ -182,9 +178,6 @@ static int wm8350_write(struct wm8350 *wm8350, u8 reg, int num_regs, u16 *src)
                         (wm8350->reg_cache[i] & ~wm8350_reg_io_map[i].writable)
                         | src[i - reg];
 
-                /* Don't store volatile bits */
-                wm8350->reg_cache[i] &= ~wm8350_reg_io_map[i].vol;
-
                 src[i - reg] = cpu_to_be16(src[i - reg]);
         }
 
@@ -1261,7 +1254,6 @@ static int wm8350_create_cache(struct wm8350 *wm8350, int type, int mode)
                     (i < WM8350_CLOCK_CONTROL_1 || i > WM8350_AIF_TEST)) {
                         value = be16_to_cpu(wm8350->reg_cache[i]);
                         value &= wm8350_reg_io_map[i].readable;
-                        value &= ~wm8350_reg_io_map[i].vol;
                         wm8350->reg_cache[i] = value;
                 } else
                         wm8350->reg_cache[i] = reg_map[i];
diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
index 3cf61ece71d..348443bdb23 100644
--- a/drivers/misc/enclosure.c
+++ b/drivers/misc/enclosure.c
@@ -119,7 +119,7 @@ enclosure_register(struct device *dev, const char *name, int components,
         edev->edev.class = &enclosure_class;
         edev->edev.parent = get_device(dev);
         edev->cb = cb;
-        dev_set_name(&edev->edev, name);
+        dev_set_name(&edev->edev, "%s", name);
         err = device_register(&edev->edev);
         if (err)
                 goto err;
@@ -255,8 +255,8 @@ enclosure_component_register(struct enclosure_device *edev,
         ecomp->number = number;
         cdev = &ecomp->cdev;
         cdev->parent = get_device(&edev->edev);
-        if (name)
-                dev_set_name(cdev, name);
+        if (name && name[0])
+                dev_set_name(cdev, "%s", name);
         else
                 dev_set_name(cdev, "%u", number);
 
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 36875dcfa49..7d4febdab28 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -490,7 +490,7 @@ static void mmci_check_status(unsigned long data)
         mod_timer(&host->timer, jiffies + HZ);
 }
 
-static int __devinit mmci_probe(struct amba_device *dev, void *id)
+static int __devinit mmci_probe(struct amba_device *dev, struct amba_id *id)
 {
         struct mmc_platform_data *plat = dev->dev.platform_data;
         struct mmci_host *host;
diff --git a/drivers/mmc/host/mvsdio.c b/drivers/mmc/host/mvsdio.c
index c643d0fe118..b56d72ff06e 100644
--- a/drivers/mmc/host/mvsdio.c
+++ b/drivers/mmc/host/mvsdio.c
@@ -64,6 +64,31 @@ static int mvsd_setup_data(struct mvsd_host *host, struct mmc_data *data)
         unsigned int tmout;
         int tmout_index;
 
+        /*
+         * Hardware weirdness.  The FIFO_EMPTY bit of the HW_STATE
+         * register is sometimes not set before a while when some
+         * "unusual" data block sizes are used (such as with the SWITCH
+         * command), even despite the fact that the XFER_DONE interrupt
+         * was raised.  And if another data transfer starts before
+         * this bit comes to good sense (which eventually happens by
+         * itself) then the new transfer simply fails with a timeout.
+         */
+        if (!(mvsd_read(MVSD_HW_STATE) & (1 << 13))) {
+                unsigned long t = jiffies + HZ;
+                unsigned int hw_state,  count = 0;
+                do {
+                        if (time_after(jiffies, t)) {
+                                dev_warn(host->dev, "FIFO_EMPTY bit missing\n");
+                                break;
+                        }
+                        hw_state = mvsd_read(MVSD_HW_STATE);
+                        count++;
+                } while (!(hw_state & (1 << 13)));
+                dev_dbg(host->dev, "*** wait for FIFO_EMPTY bit "
+                                   "(hw=0x%04x, count=%d, jiffies=%ld)\n",
+                                   hw_state, count, jiffies - (t - HZ));
+        }
+
         /* If timeout=0 then maximum timeout index is used. */
         tmout = DIV_ROUND_UP(data->timeout_ns, host->ns_per_clk);
         tmout += data->timeout_clks;
@@ -620,9 +645,18 @@ static void mvsd_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         if (ios->bus_width == MMC_BUS_WIDTH_4)
                 ctrl_reg |= MVSD_HOST_CTRL_DATA_WIDTH_4_BITS;
 
+        /*
+         * The HI_SPEED_EN bit is causing trouble with many (but not all)
+         * high speed SD, SDHC and SDIO cards.  Not enabling that bit
+         * makes all cards work.  So let's just ignore that bit for now
+         * and revisit this issue if problems for not enabling this bit
+         * are ever reported.
+         */
+#if 0
         if (ios->timing == MMC_TIMING_MMC_HS ||
             ios->timing == MMC_TIMING_SD_HS)
                 ctrl_reg |= MVSD_HOST_CTRL_HI_SPEED_EN;
+#endif
 
         host->ctrl = ctrl_reg;
         mvsd_write(MVSD_HOST_CTRL, ctrl_reg);
@@ -882,3 +916,4 @@ module_param(nodma, int, 0);
 MODULE_AUTHOR("Maen Suleiman, Nicolas Pitre");
 MODULE_DESCRIPTION("Marvell MMC,SD,SDIO Host Controller driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:mvsdio");
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
index b4a615c55f2..f4cbe473670 100644
--- a/drivers/mmc/host/mxcmmc.c
+++ b/drivers/mmc/host/mxcmmc.c
@@ -140,6 +140,8 @@ struct mxcmci_host {
         struct work_struct      datawork;
 };
 
+static void mxcmci_set_clk_rate(struct mxcmci_host *host, unsigned int clk_ios);
+
 static inline int mxcmci_use_dma(struct mxcmci_host *host)
 {
         return host->do_dma;
@@ -160,7 +162,7 @@ static void mxcmci_softreset(struct mxcmci_host *host)
         writew(0xff, host->base + MMC_REG_RES_TO);
 }
 
-static void mxcmci_setup_data(struct mxcmci_host *host, struct mmc_data *data)
+static int mxcmci_setup_data(struct mxcmci_host *host, struct mmc_data *data)
 {
         unsigned int nob = data->blocks;
         unsigned int blksz = data->blksz;
@@ -168,6 +170,7 @@ static void mxcmci_setup_data(struct mxcmci_host *host, struct mmc_data *data)
 #ifdef HAS_DMA
         struct scatterlist *sg;
         int i;
+        int ret;
 #endif
         if (data->flags & MMC_DATA_STREAM)
                 nob = 0xffff;
@@ -183,7 +186,7 @@ static void mxcmci_setup_data(struct mxcmci_host *host, struct mmc_data *data)
         for_each_sg(data->sg, sg, data->sg_len, i) {
                 if (sg->offset & 3 || sg->length & 3) {
                         host->do_dma = 0;
-                        return;
+                        return 0;
                 }
         }
 
@@ -192,23 +195,30 @@ static void mxcmci_setup_data(struct mxcmci_host *host, struct mmc_data *data)
                 host->dma_nents = dma_map_sg(mmc_dev(host->mmc), data->sg,
                                              data->sg_len,  host->dma_dir);
 
-                imx_dma_setup_sg(host->dma, data->sg, host->dma_nents, datasize,
-                                 host->res->start + MMC_REG_BUFFER_ACCESS,
-                                 DMA_MODE_READ);
+                ret = imx_dma_setup_sg(host->dma, data->sg, host->dma_nents,
+                                datasize,
+                                host->res->start + MMC_REG_BUFFER_ACCESS,
+                                DMA_MODE_READ);
         } else {
                 host->dma_dir = DMA_TO_DEVICE;
                 host->dma_nents = dma_map_sg(mmc_dev(host->mmc), data->sg,
                                              data->sg_len,  host->dma_dir);
 
-                imx_dma_setup_sg(host->dma, data->sg, host->dma_nents, datasize,
-                                 host->res->start + MMC_REG_BUFFER_ACCESS,
-                                 DMA_MODE_WRITE);
+                ret = imx_dma_setup_sg(host->dma, data->sg, host->dma_nents,
+                                datasize,
+                                host->res->start + MMC_REG_BUFFER_ACCESS,
+                                DMA_MODE_WRITE);
         }
 
+        if (ret) {
+                dev_err(mmc_dev(host->mmc), "failed to setup DMA : %d\n", ret);
+                return ret;
+        }
         wmb();
 
         imx_dma_enable(host->dma);
 #endif /* HAS_DMA */
+        return 0;
 }
 
 static int mxcmci_start_cmd(struct mxcmci_host *host, struct mmc_command *cmd,
@@ -345,8 +355,11 @@ static int mxcmci_poll_status(struct mxcmci_host *host, u32 mask)
                 stat = readl(host->base + MMC_REG_STATUS);
                 if (stat & STATUS_ERR_MASK)
                         return stat;
-                if (time_after(jiffies, timeout))
+                if (time_after(jiffies, timeout)) {
+                        mxcmci_softreset(host);
+                        mxcmci_set_clk_rate(host, host->clock);
                         return STATUS_TIME_OUT_READ;
+                }
                 if (stat & mask)
                         return 0;
                 cpu_relax();
@@ -531,6 +544,7 @@ static void mxcmci_request(struct mmc_host *mmc, struct mmc_request *req)
 {
         struct mxcmci_host *host = mmc_priv(mmc);
         unsigned int cmdat = host->cmdat;
+        int error;
 
         WARN_ON(host->req != NULL);
 
@@ -540,7 +554,12 @@ static void mxcmci_request(struct mmc_host *mmc, struct mmc_request *req)
         host->do_dma = 1;
 #endif
         if (req->data) {
-                mxcmci_setup_data(host, req->data);
+                error = mxcmci_setup_data(host, req->data);
+                if (error) {
+                        req->cmd->error = error;
+                        goto out;
+                }
+
 
                 cmdat |= CMD_DAT_CONT_DATA_ENABLE;
 
@@ -548,7 +567,9 @@ static void mxcmci_request(struct mmc_host *mmc, struct mmc_request *req)
                         cmdat |= CMD_DAT_CONT_WRITE;
         }
 
-        if (mxcmci_start_cmd(host, req->cmd, cmdat))
+        error = mxcmci_start_cmd(host, req->cmd, cmdat);
+out:
+        if (error)
                 mxcmci_finish_request(host, req);
 }
 
@@ -724,7 +745,9 @@ static int mxcmci_probe(struct platform_device *pdev)
                 goto out_clk_put;
         }
 
-        mmc->f_min = clk_get_rate(host->clk) >> 7;
+        mmc->f_min = clk_get_rate(host->clk) >> 16;
+        if (mmc->f_min < 400000)
+                mmc->f_min = 400000;
         mmc->f_max = clk_get_rate(host->clk) >> 1;
 
         /* recommended in data sheet */
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index bfa25c01c87..dceb5ee3bda 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -822,7 +822,7 @@ static irqreturn_t mmc_omap_irq(int irq, void *dev_id)
                 del_timer(&host->cmd_abort_timer);
                 host->abort = 1;
                 OMAP_MMC_WRITE(host, IE, 0);
-                disable_irq(host->irq);
+                disable_irq_nosync(host->irq);
                 schedule_work(&host->cmd_abort_work);
                 return IRQ_HANDLED;
         }
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index e62a22a7f00..c40cb96255a 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -680,7 +680,7 @@ static void mmc_omap_dma_cb(int lch, u16 ch_status, void *data)
         host->dma_ch = -1;
         /*
          * DMA Callback: run in interrupt context.
-         * mutex_unlock will through a kernel warning if used.
+         * mutex_unlock will throw a kernel warning if used.
          */
         up(&host->sem);
 }
diff --git a/drivers/mmc/host/sdhci-of.c b/drivers/mmc/host/sdhci-of.c
index 3ff4ac3abe8..128c614d11a 100644
--- a/drivers/mmc/host/sdhci-of.c
+++ b/drivers/mmc/host/sdhci-of.c
@@ -55,7 +55,13 @@ static u32 esdhc_readl(struct sdhci_host *host, int reg)
 
 static u16 esdhc_readw(struct sdhci_host *host, int reg)
 {
-        return in_be16(host->ioaddr + (reg ^ 0x2));
+        u16 ret;
+
+        if (unlikely(reg == SDHCI_HOST_VERSION))
+                ret = in_be16(host->ioaddr + reg);
+        else
+                ret = in_be16(host->ioaddr + (reg ^ 0x2));
+        return ret;
 }
 
 static u8 esdhc_readb(struct sdhci_host *host, int reg)
@@ -277,6 +283,7 @@ static int __devexit sdhci_of_remove(struct of_device *ofdev)
 static const struct of_device_id sdhci_of_match[] = {
         { .compatible = "fsl,mpc8379-esdhc", .data = &sdhci_esdhc, },
         { .compatible = "fsl,mpc8536-esdhc", .data = &sdhci_esdhc, },
+        { .compatible = "fsl,esdhc", .data = &sdhci_esdhc, },
         { .compatible = "generic-sdhci", },
         {},
 };
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 62dee54af0a..43976aa4dbb 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -178,7 +178,7 @@ static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
                 /* Calculate flash page address; use block erase (for speed) if
                  * we're at a block boundary and need to erase the whole block.
                  */
-                pageaddr = div_u64(instr->len, priv->page_size);
+                pageaddr = div_u64(instr->addr, priv->page_size);
                 do_block = (pageaddr & 0x7) == 0 && instr->len >= blocksize;
                 pageaddr = pageaddr << priv->page_offset;
 
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index 92285d0089c..af8b42e0a55 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -74,8 +74,7 @@ static int get_sb_mtd_aux(struct file_system_type *fs_type, int flags,
 
         ret = fill_super(sb, data, flags & MS_SILENT ? 1 : 0);
         if (ret < 0) {
-                up_write(&sb->s_umount);
-                deactivate_super(sb);
+                deactivate_locked_super(sb);
                 return ret;
         }
 
diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
index 0119220de7d..02700f769b8 100644
--- a/drivers/mtd/nand/davinci_nand.c
+++ b/drivers/mtd/nand/davinci_nand.c
@@ -407,16 +407,17 @@ static int __init nand_davinci_probe(struct platform_device *pdev)
         }
         info->chip.ecc.mode = ecc_mode;
 
-        info->clk = clk_get(&pdev->dev, "AEMIFCLK");
+        info->clk = clk_get(&pdev->dev, "aemif");
         if (IS_ERR(info->clk)) {
                 ret = PTR_ERR(info->clk);
-                dev_dbg(&pdev->dev, "unable to get AEMIFCLK, err %d\n", ret);
+                dev_dbg(&pdev->dev, "unable to get AEMIF clock, err %d\n", ret);
                 goto err_clk;
         }
 
         ret = clk_enable(info->clk);
         if (ret < 0) {
-                dev_dbg(&pdev->dev, "unable to enable AEMIFCLK, err %d\n", ret);
+                dev_dbg(&pdev->dev, "unable to enable AEMIF clock, err %d\n",
+                        ret);
                 goto err_clk_enable;
         }
 
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index f3548d04801..40c26080ecd 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -831,6 +831,7 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
                 break;
 
         case NAND_CMD_READID:
+                host->col_addr = 0;
                 send_read_id(host);
                 break;
 
@@ -867,6 +868,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
         mtd->priv = this;
         mtd->owner = THIS_MODULE;
         mtd->dev.parent = &pdev->dev;
+        mtd->name = "mxc_nand";
 
         /* 50 us command delay time */
         this->chip_delay = 5;
@@ -882,8 +884,10 @@ static int __init mxcnd_probe(struct platform_device *pdev)
         this->verify_buf = mxc_nand_verify_buf;
 
         host->clk = clk_get(&pdev->dev, "nfc");
-        if (IS_ERR(host->clk))
+        if (IS_ERR(host->clk)) {
+                err = PTR_ERR(host->clk);
                 goto eclk;
+        }
 
         clk_enable(host->clk);
         host->clk_act = 1;
@@ -896,7 +900,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
 
         host->regs = ioremap(res->start, res->end - res->start + 1);
         if (!host->regs) {
-                err = -EIO;
+                err = -ENOMEM;
                 goto eres;
         }
 
@@ -1011,30 +1015,35 @@ static int __devexit mxcnd_remove(struct platform_device *pdev)
 #ifdef CONFIG_PM
 static int mxcnd_suspend(struct platform_device *pdev, pm_message_t state)
 {
-        struct mtd_info *info = platform_get_drvdata(pdev);
+        struct mtd_info *mtd = platform_get_drvdata(pdev);
+        struct nand_chip *nand_chip = mtd->priv;
+        struct mxc_nand_host *host = nand_chip->priv;
         int ret = 0;
 
         DEBUG(MTD_DEBUG_LEVEL0, "MXC_ND : NAND suspend\n");
-        if (info)
-                ret = info->suspend(info);
-
-        /* Disable the NFC clock */
-        clk_disable(nfc_clk);   /* FIXME */
+        if (mtd) {
+                ret = mtd->suspend(mtd);
+                /* Disable the NFC clock */
+                clk_disable(host->clk);
+        }
 
         return ret;
 }
 
 static int mxcnd_resume(struct platform_device *pdev)
 {
-        struct mtd_info *info = platform_get_drvdata(pdev);
+        struct mtd_info *mtd = platform_get_drvdata(pdev);
+        struct nand_chip *nand_chip = mtd->priv;
+        struct mxc_nand_host *host = nand_chip->priv;
         int ret = 0;
 
         DEBUG(MTD_DEBUG_LEVEL0, "MXC_ND : NAND resume\n");
-        /* Enable the NFC clock */
-        clk_enable(nfc_clk);    /* FIXME */
 
-        if (info)
-                info->resume(info);
+        if (mtd) {
+                /* Enable the NFC clock */
+                clk_enable(host->clk);
+                mtd->resume(mtd);
+        }
 
         return ret;
 }
@@ -1055,13 +1064,7 @@ static struct platform_driver mxcnd_driver = {
 
 static int __init mxc_nd_init(void)
 {
-        /* Register the device driver structure. */
-        pr_info("MXC MTD nand Driver\n");
-        if (platform_driver_probe(&mxcnd_driver, mxcnd_probe) != 0) {
-                printk(KERN_ERR "Driver register failed for mxcnd_driver\n");
-                return -ENODEV;
-        }
-        return 0;
+        return platform_driver_probe(&mxcnd_driver, mxcnd_probe);
 }
 
 static void __exit mxc_nd_cleanup(void)
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index fbb37192199..682aad89708 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -480,9 +480,13 @@ static int pnp_registered;
 
 #ifdef CONFIG_EISA
 static struct eisa_device_id el3_eisa_ids[] = {
+                { "TCM5090" },
+                { "TCM5091" },
                 { "TCM5092" },
                 { "TCM5093" },
+                { "TCM5094" },
                 { "TCM5095" },
+                { "TCM5098" },
                 { "" }
 };
 MODULE_DEVICE_TABLE(eisa, el3_eisa_ids);
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 1fc4602a6ff..a1c25cb4669 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -102,7 +102,7 @@ obj-$(CONFIG_HAMACHI) += hamachi.o
 obj-$(CONFIG_NET) += Space.o loopback.o
 obj-$(CONFIG_SEEQ8005) += seeq8005.o
 obj-$(CONFIG_NET_SB1000) += sb1000.o
-obj-$(CONFIG_MAC8390) += mac8390.o 8390.o
+obj-$(CONFIG_MAC8390) += mac8390.o
 obj-$(CONFIG_APNE) += apne.o 8390.o
 obj-$(CONFIG_PCMCIA_PCNET) += 8390.o
 obj-$(CONFIG_HP100) += hp100.o
diff --git a/drivers/net/arm/ixp4xx_eth.c b/drivers/net/arm/ixp4xx_eth.c
index 448487e22fa..a740053d3af 100644
--- a/drivers/net/arm/ixp4xx_eth.c
+++ b/drivers/net/arm/ixp4xx_eth.c
@@ -338,12 +338,12 @@ static int ixp4xx_mdio_register(void)
         if (cpu_is_ixp43x()) {
                 /* IXP43x lacks NPE-B and uses NPE-C for MII PHY access */
                 if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEC_ETH))
-                        return -ENOSYS;
+                        return -ENODEV;
                 mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
         } else {
                 /* All MII PHY accesses use NPE-B Ethernet registers */
                 if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEB_ETH0))
-                        return -ENOSYS;
+                        return -ENODEV;
                 mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
         }
 
@@ -1174,7 +1174,7 @@ static int __devinit eth_init_one(struct platform_device *pdev)
                 regs_phys  = IXP4XX_EthC_BASE_PHYS;
                 break;
         default:
-                err = -ENOSYS;
+                err = -ENODEV;
                 goto err_free;
         }
 
@@ -1189,15 +1189,10 @@ static int __devinit eth_init_one(struct platform_device *pdev)
                 goto err_free;
         }
 
-        if (register_netdev(dev)) {
-                err = -EIO;
-                goto err_npe_rel;
-        }
-
         port->mem_res = request_mem_region(regs_phys, REGS_SIZE, dev->name);
         if (!port->mem_res) {
                 err = -EBUSY;
-                goto err_unreg;
+                goto err_npe_rel;
         }
 
         port->plat = plat;
@@ -1215,20 +1210,25 @@ static int __devinit eth_init_one(struct platform_device *pdev)
         snprintf(phy_id, BUS_ID_SIZE, PHY_ID_FMT, "0", plat->phy);
         port->phydev = phy_connect(dev, phy_id, &ixp4xx_adjust_link, 0,
                                    PHY_INTERFACE_MODE_MII);
-        if (IS_ERR(port->phydev)) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return PTR_ERR(port->phydev);
-        }
+        if ((err = IS_ERR(port->phydev)))
+                goto err_free_mem;
 
         port->phydev->irq = PHY_POLL;
 
+        if ((err = register_netdev(dev)))
+                goto err_phy_dis;
+
         printk(KERN_INFO "%s: MII PHY %i on %s\n", dev->name, plat->phy,
                npe_name(port->npe));
 
         return 0;
 
-err_unreg:
-        unregister_netdev(dev);
+err_phy_dis:
+        phy_disconnect(port->phydev);
+err_free_mem:
+        npe_port_tab[NPE_ID(port->id)] = NULL;
+        platform_set_drvdata(pdev, NULL);
+        release_resource(port->mem_res);
 err_npe_rel:
         npe_release(port->npe);
 err_free:
@@ -1242,6 +1242,7 @@ static int __devexit eth_remove_one(struct platform_device *pdev)
         struct port *port = netdev_priv(dev);
 
         unregister_netdev(dev);
+        phy_disconnect(port->phydev);
         npe_port_tab[NPE_ID(port->id)] = NULL;
         platform_set_drvdata(pdev, NULL);
         npe_release(port->npe);
diff --git a/drivers/net/atl1e/atl1e_main.c b/drivers/net/atl1e/atl1e_main.c
index fb57b750866..1342418fb20 100644
--- a/drivers/net/atl1e/atl1e_main.c
+++ b/drivers/net/atl1e/atl1e_main.c
@@ -37,6 +37,7 @@ char atl1e_driver_version[] = DRV_VERSION;
  */
 static struct pci_device_id atl1e_pci_tbl[] = {
         {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, PCI_DEVICE_ID_ATTANSIC_L1E)},
+        {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, 0x1066)},
         /* required last entry */
         { 0 }
 };
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 0ab22540bf5..4e817126e28 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -82,6 +82,12 @@
 
 #include "atl1.h"
 
+#define ATLX_DRIVER_VERSION "2.1.3"
+MODULE_AUTHOR("Xiong Huang <xiong.huang@atheros.com>, \
+        Chris Snook <csnook@redhat.com>, Jay Cliburn <jcliburn@gmail.com>");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(ATLX_DRIVER_VERSION);
+
 /* Temporary hack for merging atl1 and atl2 */
 #include "atlx.c"
 
diff --git a/drivers/net/atlx/atlx.h b/drivers/net/atlx/atlx.h
index 297a03da6b7..14054b75aa6 100644
--- a/drivers/net/atlx/atlx.h
+++ b/drivers/net/atlx/atlx.h
@@ -29,12 +29,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 
-#define ATLX_DRIVER_VERSION "2.1.3"
-MODULE_AUTHOR("Xiong Huang <xiong.huang@atheros.com>, \
-        Chris Snook <csnook@redhat.com>, Jay Cliburn <jcliburn@gmail.com>");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(ATLX_DRIVER_VERSION);
-
 #define ATLX_ERR_PHY                    2
 #define ATLX_ERR_PHY_SPEED              7
 #define ATLX_ERR_PHY_RES                8
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index c49ddd08b2a..b4bb06fdf30 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -35,8 +35,22 @@
 #define DRV_VER                 "2.0.348"
 #define DRV_NAME                "be2net"
 #define BE_NAME                 "ServerEngines BladeEngine2 10Gbps NIC"
+#define OC_NAME                 "Emulex OneConnect 10Gbps NIC"
 #define DRV_DESC                BE_NAME "Driver"
 
+#define BE_VENDOR_ID            0x19a2
+#define BE_DEVICE_ID1           0x211
+#define OC_DEVICE_ID1           0x700
+#define OC_DEVICE_ID2           0x701
+
+static inline char *nic_name(struct pci_dev *pdev)
+{
+        if (pdev->device == OC_DEVICE_ID1 || pdev->device == OC_DEVICE_ID2)
+                return OC_NAME;
+        else
+                return BE_NAME;
+}
+
 /* Number of bytes of an RX frame that are copied to skb->data */
 #define BE_HDR_LEN              64
 #define BE_MAX_JUMBO_FRAME_SIZE 9018
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 30d0c81c989..5c378b5e8e4 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -28,10 +28,10 @@ static unsigned int rx_frag_size = 2048;
 module_param(rx_frag_size, uint, S_IRUGO);
 MODULE_PARM_DESC(rx_frag_size, "Size of a fragment that holds rcvd data.");
 
-#define BE_VENDOR_ID            0x19a2
-#define BE2_DEVICE_ID_1         0x0211
 static DEFINE_PCI_DEVICE_TABLE(be_dev_ids) = {
-        { PCI_DEVICE(BE_VENDOR_ID, BE2_DEVICE_ID_1) },
+        { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID1) },
+        { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID1) },
+        { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID2) },
         { 0 }
 };
 MODULE_DEVICE_TABLE(pci, be_dev_ids);
@@ -1859,7 +1859,7 @@ static int __devinit be_probe(struct pci_dev *pdev,
         if (status != 0)
                 goto stats_clean;
 
-        dev_info(&pdev->dev, BE_NAME " port %d\n", adapter->port_num);
+        dev_info(&pdev->dev, "%s port %d\n", nic_name(pdev), adapter->port_num);
         return 0;
 
 stats_clean:
@@ -1873,7 +1873,7 @@ rel_reg:
 disable_dev:
         pci_disable_device(pdev);
 do_none:
-        dev_warn(&pdev->dev, BE_NAME " initialization failed\n");
+        dev_err(&pdev->dev, "%s initialization failed\n", nic_name(pdev));
         return status;
 }
 
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 9f971ed6b58..b4da1821332 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -979,22 +979,7 @@ static int bfin_mac_open(struct net_device *dev)
         return 0;
 }
 
-static const struct net_device_ops bfin_mac_netdev_ops = {
-        .ndo_open               = bfin_mac_open,
-        .ndo_stop               = bfin_mac_close,
-        .ndo_start_xmit         = bfin_mac_hard_start_xmit,
-        .ndo_set_mac_address    = bfin_mac_set_mac_address,
-        .ndo_tx_timeout         = bfin_mac_timeout,
-        .ndo_set_multicast_list = bfin_mac_set_multicast_list,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_change_mtu         = eth_change_mtu,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = bfin_mac_poll,
-#endif
-};
-
 /*
- *
  * this makes the board clean up everything that it can
  * and not talk to the outside world.   Caused by
  * an 'ifconfig ethX down'
@@ -1019,6 +1004,20 @@ static int bfin_mac_close(struct net_device *dev)
         return 0;
 }
 
+static const struct net_device_ops bfin_mac_netdev_ops = {
+        .ndo_open               = bfin_mac_open,
+        .ndo_stop               = bfin_mac_close,
+        .ndo_start_xmit         = bfin_mac_hard_start_xmit,
+        .ndo_set_mac_address    = bfin_mac_set_mac_address,
+        .ndo_tx_timeout         = bfin_mac_timeout,
+        .ndo_set_multicast_list = bfin_mac_set_multicast_list,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_change_mtu         = eth_change_mtu,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = bfin_mac_poll,
+#endif
+};
+
 static int __devinit bfin_mac_probe(struct platform_device *pdev)
 {
         struct net_device *ndev;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index d47839184a0..b0cb29d4cc0 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "2.0.0"
-#define DRV_MODULE_RELDATE      "April 2, 2009"
+#define DRV_MODULE_VERSION      "2.0.1"
+#define DRV_MODULE_RELDATE      "May 6, 2009"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-4.6.16.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-4.6.16.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-4.6.17.fw"
@@ -2600,6 +2600,7 @@ bnx2_get_hw_tx_cons(struct bnx2_napi *bnapi)
         /* Tell compiler that status block fields can change. */
         barrier();
         cons = *bnapi->hw_tx_cons_ptr;
+        barrier();
         if (unlikely((cons & MAX_TX_DESC_CNT) == MAX_TX_DESC_CNT))
                 cons++;
         return cons;
@@ -2879,6 +2880,7 @@ bnx2_get_hw_rx_cons(struct bnx2_napi *bnapi)
         /* Tell compiler that status block fields can change. */
         barrier();
         cons = *bnapi->hw_rx_cons_ptr;
+        barrier();
         if (unlikely((cons & MAX_RX_DESC_CNT) == MAX_RX_DESC_CNT))
                 cons++;
         return cons;
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 8c2e5ab51f0..faf094abef7 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1465,6 +1465,12 @@ static struct aggregator *ad_agg_selection_test(struct aggregator *best,
         return best;
 }
 
+static int agg_device_up(const struct aggregator *agg)
+{
+        return (netif_running(agg->slave->dev) &&
+                netif_carrier_ok(agg->slave->dev));
+}
+
 /**
  * ad_agg_selection_logic - select an aggregation group for a team
  * @aggregator: the aggregator we're looking at
@@ -1496,14 +1502,13 @@ static void ad_agg_selection_logic(struct aggregator *agg)
         struct port *port;
 
         origin = agg;
-
         active = __get_active_agg(agg);
-        best = active;
+        best = (active && agg_device_up(active)) ? active : NULL;
 
         do {
                 agg->is_active = 0;
 
-                if (agg->num_of_ports)
+                if (agg->num_of_ports && agg_device_up(agg))
                         best = ad_agg_selection_test(best, agg);
 
         } while ((agg = __get_next_agg(agg)));
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2188a96fc09..74824028f85 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -5181,7 +5181,6 @@ static int __init bonding_init(void)
 {
         int i;
         int res;
-        struct bonding *bond;
 
         printk(KERN_INFO "%s", version);
 
@@ -5212,13 +5211,6 @@ static int __init bonding_init(void)
 
         goto out;
 err:
-        list_for_each_entry(bond, &bond_dev_list, bond_list) {
-                bond_work_cancel_all(bond);
-                destroy_workqueue(bond->wq);
-        }
-
-        bond_destroy_sysfs();
-
         rtnl_lock();
         bond_free_all();
         rtnl_unlock();
diff --git a/drivers/net/cxgb3/adapter.h b/drivers/net/cxgb3/adapter.h
index 714df2b675e..c888e97c967 100644
--- a/drivers/net/cxgb3/adapter.h
+++ b/drivers/net/cxgb3/adapter.h
@@ -85,8 +85,8 @@ struct fl_pg_chunk {
         struct page *page;
         void *va;
         unsigned int offset;
-        u64 *p_cnt;
-        DECLARE_PCI_UNMAP_ADDR(mapping);
+        unsigned long *p_cnt;
+        dma_addr_t mapping;
 };
 
 struct rx_desc;
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index 7ea48414c6c..17858b9a583 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -2496,14 +2496,16 @@ static void check_link_status(struct adapter *adapter)
         for_each_port(adapter, i) {
                 struct net_device *dev = adapter->port[i];
                 struct port_info *p = netdev_priv(dev);
+                int link_fault;
 
                 spin_lock_irq(&adapter->work_lock);
-                if (p->link_fault) {
+                link_fault = p->link_fault;
+                spin_unlock_irq(&adapter->work_lock);
+
+                if (link_fault) {
                         t3_link_fault(adapter, i);
-                        spin_unlock_irq(&adapter->work_lock);
                         continue;
                 }
-                spin_unlock_irq(&adapter->work_lock);
 
                 if (!(p->phy.caps & SUPPORTED_IRQ) && netif_running(dev)) {
                         t3_xgm_intr_disable(adapter, i);
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index 26d3587f339..b3ee2bc1a00 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -355,7 +355,7 @@ static void clear_rx_desc(struct pci_dev *pdev, const struct sge_fl *q,
                 (*d->pg_chunk.p_cnt)--;
                 if (!*d->pg_chunk.p_cnt)
                         pci_unmap_page(pdev,
-                                       pci_unmap_addr(&d->pg_chunk, mapping),
+                                       d->pg_chunk.mapping,
                                        q->alloc_size, PCI_DMA_FROMDEVICE);
 
                 put_page(d->pg_chunk.page);
@@ -454,7 +454,7 @@ static int alloc_pg_chunk(struct adapter *adapter, struct sge_fl *q,
                 q->pg_chunk.offset = 0;
                 mapping = pci_map_page(adapter->pdev, q->pg_chunk.page,
                                        0, q->alloc_size, PCI_DMA_FROMDEVICE);
-                pci_unmap_addr_set(&q->pg_chunk, mapping, mapping);
+                q->pg_chunk.mapping = mapping;
         }
         sd->pg_chunk = q->pg_chunk;
 
@@ -511,8 +511,7 @@ static int refill_fl(struct adapter *adap, struct sge_fl *q, int n, gfp_t gfp)
 nomem:                          q->alloc_failed++;
                                 break;
                         }
-                        mapping = pci_unmap_addr(&sd->pg_chunk, mapping) +
-                                                 sd->pg_chunk.offset;
+                        mapping = sd->pg_chunk.mapping + sd->pg_chunk.offset;
                         pci_unmap_addr_set(sd, dma_addr, mapping);
 
                         add_one_rx_chunk(mapping, d, q->gen);
@@ -881,7 +880,7 @@ recycle:
         (*sd->pg_chunk.p_cnt)--;
         if (!*sd->pg_chunk.p_cnt)
                 pci_unmap_page(adap->pdev,
-                               pci_unmap_addr(&sd->pg_chunk, mapping),
+                               sd->pg_chunk.mapping,
                                fl->alloc_size,
                                PCI_DMA_FROMDEVICE);
         if (!skb) {
@@ -2096,7 +2095,7 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
         (*sd->pg_chunk.p_cnt)--;
         if (!*sd->pg_chunk.p_cnt)
                 pci_unmap_page(adap->pdev,
-                               pci_unmap_addr(&sd->pg_chunk, mapping),
+                               sd->pg_chunk.mapping,
                                fl->alloc_size,
                                PCI_DMA_FROMDEVICE);
 
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index 4f68aeb2679..4950d5d789a 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -1274,6 +1274,11 @@ void t3_link_fault(struct adapter *adapter, int port_id)
                                  A_XGM_INT_STATUS + mac->offset);
         link_fault &= F_LINKFAULTCHANGE;
 
+        link_ok = lc->link_ok;
+        speed = lc->speed;
+        duplex = lc->duplex;
+        fc = lc->fc;
+
         phy->ops->get_link_status(phy, &link_ok, &speed, &duplex, &fc);
 
         if (link_fault) {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index b1419e21b46..fffb006b7d9 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -4027,8 +4027,9 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                                  PCI_DMA_FROMDEVICE);
 
                 length = le16_to_cpu(rx_desc->length);
-
-                if (unlikely(!(status & E1000_RXD_STAT_EOP))) {
+                /* !EOP means multiple descriptors were used to store a single
+                 * packet, also make sure the frame isn't just CRC only */
+                if (unlikely(!(status & E1000_RXD_STAT_EOP) || (length <= 4))) {
                         /* All receives must fit into a single buffer */
                         E1000_DBG("%s: Receive packet consumed multiple"
                                   " buffers\n", netdev->name);
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index f9a846b1b92..9f6a68fb7b4 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -897,6 +897,12 @@ enum {
 };
 static int phy_cross = NV_CROSSOVER_DETECTION_DISABLED;
 
+/*
+ * Power down phy when interface is down (persists through reboot;
+ * older Linux and other OSes may not power it up again)
+ */
+static int phy_power_down = 0;
+
 static inline struct fe_priv *get_nvpriv(struct net_device *dev)
 {
         return netdev_priv(dev);
@@ -1485,7 +1491,10 @@ static int phy_init(struct net_device *dev)
 
         /* restart auto negotiation, power down phy */
         mii_control = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
-        mii_control |= (BMCR_ANRESTART | BMCR_ANENABLE | BMCR_PDOWN);
+        mii_control |= (BMCR_ANRESTART | BMCR_ANENABLE);
+        if (phy_power_down) {
+                mii_control |= BMCR_PDOWN;
+        }
         if (mii_rw(dev, np->phyaddr, MII_BMCR, mii_control)) {
                 return PHY_ERROR;
         }
@@ -5513,7 +5522,7 @@ static int nv_close(struct net_device *dev)
 
         nv_drain_rxtx(dev);
 
-        if (np->wolenabled) {
+        if (np->wolenabled || !phy_power_down) {
                 writel(NVREG_PFF_ALWAYS|NVREG_PFF_MYADDR, base + NvRegPacketFilterFlags);
                 nv_start_rx(dev);
         } else {
@@ -6367,6 +6376,8 @@ module_param(dma_64bit, int, 0);
 MODULE_PARM_DESC(dma_64bit, "High DMA is enabled by setting to 1 and disabled by setting to 0.");
 module_param(phy_cross, int, 0);
 MODULE_PARM_DESC(phy_cross, "Phy crossover detection for Realtek 8201 phy is enabled by setting to 1 and disabled by setting to 0.");
+module_param(phy_power_down, int, 0);
+MODULE_PARM_DESC(phy_power_down, "Power down phy and disable link when interface is down (1), or leave phy powered up (0).");
 
 MODULE_AUTHOR("Manfred Spraul <manfred@colorfullife.com>");
 MODULE_DESCRIPTION("Reverse Engineered nForce ethernet driver");
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index b2c49679bba..a0519184e54 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1885,8 +1885,17 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
 
                         if (unlikely(!newskb))
                                 newskb = skb;
-                        else if (skb)
+                        else if (skb) {
+                                /*
+                                 * We need to reset ->data to what it
+                                 * was before gfar_new_skb() re-aligned
+                                 * it to an RXBUF_ALIGNMENT boundary
+                                 * before we put the skb back on the
+                                 * recycle list.
+                                 */
+                                skb->data = skb->head + NET_SKB_PAD;
                                 __skb_queue_head(&priv->rx_recycle, skb);
+                        }
                 } else {
                         /* Increment the number of packets */
                         dev->stats.rx_packets++;
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index 0642d52aef5..cf352961ae9 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -259,7 +259,7 @@ extern const char gfar_driver_version[];
 (IEVENT_RXC | IEVENT_BSY | IEVENT_EBERR | IEVENT_MSRO | \
  IEVENT_BABT | IEVENT_TXC | IEVENT_TXE | IEVENT_LC \
  | IEVENT_CRL | IEVENT_XFUN | IEVENT_DPE | IEVENT_PERR \
- | IEVENT_MAG)
+ | IEVENT_MAG | IEVENT_BABR)
 
 #define IMASK_INIT_CLEAR        0x00000000
 #define IMASK_BABR              0x80000000
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 08c801490c7..e25343588fc 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -2006,7 +2006,7 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         struct e1000_hw *hw = &adapter->hw;
         u32 rctl;
         u32 srrctl = 0;
-        int i, j;
+        int i;
 
         rctl = rd32(E1000_RCTL);
 
@@ -2071,8 +2071,6 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         if (adapter->vfs_allocated_count) {
                 u32 vmolr;
 
-                j = adapter->rx_ring[0].reg_idx;
-
                 /* set all queue drop enable bits */
                 wr32(E1000_QDE, ALL_QUEUES);
                 srrctl |= E1000_SRRCTL_DROP_EN;
@@ -2080,16 +2078,16 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
                 /* disable queue 0 to prevent tail write w/o re-config */
                 wr32(E1000_RXDCTL(0), 0);
 
-                vmolr = rd32(E1000_VMOLR(j));
+                vmolr = rd32(E1000_VMOLR(adapter->vfs_allocated_count));
                 if (rctl & E1000_RCTL_LPE)
                         vmolr |= E1000_VMOLR_LPE;
-                if (adapter->num_rx_queues > 0)
+                if (adapter->num_rx_queues > 1)
                         vmolr |= E1000_VMOLR_RSSE;
-                wr32(E1000_VMOLR(j), vmolr);
+                wr32(E1000_VMOLR(adapter->vfs_allocated_count), vmolr);
         }
 
         for (i = 0; i < adapter->num_rx_queues; i++) {
-                j = adapter->rx_ring[i].reg_idx;
+                int j = adapter->rx_ring[i].reg_idx;
                 wr32(E1000_SRRCTL(j), srrctl);
         }
 
diff --git a/drivers/net/mac8390.c b/drivers/net/mac8390.c
index 8e884869a05..22e74a0e036 100644
--- a/drivers/net/mac8390.c
+++ b/drivers/net/mac8390.c
@@ -304,7 +304,7 @@ struct net_device * __init mac8390_probe(int unit)
         if (!MACH_IS_MAC)
                 return ERR_PTR(-ENODEV);
 
-        dev = alloc_ei_netdev();
+        dev = ____alloc_ei_netdev(0);
         if (!dev)
                 return ERR_PTR(-ENOMEM);
 
@@ -481,15 +481,15 @@ void cleanup_module(void)
 static const struct net_device_ops mac8390_netdev_ops = {
         .ndo_open               = mac8390_open,
         .ndo_stop               = mac8390_close,
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
diff --git a/drivers/net/meth.c b/drivers/net/meth.c
index aa08987f6e8..dbd3436912b 100644
--- a/drivers/net/meth.c
+++ b/drivers/net/meth.c
@@ -127,11 +127,11 @@ static unsigned long mdio_read(struct meth_private *priv, unsigned long phyreg)
 static int mdio_probe(struct meth_private *priv)
 {
         int i;
-        unsigned long p2, p3;
+        unsigned long p2, p3, flags;
         /* check if phy is detected already */
         if(priv->phy_addr>=0&&priv->phy_addr<32)
                 return 0;
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
         for (i=0;i<32;++i){
                 priv->phy_addr=i;
                 p2=mdio_read(priv,2);
@@ -157,7 +157,7 @@ static int mdio_probe(struct meth_private *priv)
                         break;
                 }
         }
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
         if(priv->phy_addr<32) {
                 return 0;
         }
@@ -373,14 +373,14 @@ static int meth_release(struct net_device *dev)
 static void meth_rx(struct net_device* dev, unsigned long int_status)
 {
         struct sk_buff *skb;
-        unsigned long status;
+        unsigned long status, flags;
         struct meth_private *priv = netdev_priv(dev);
         unsigned long fifo_rptr = (int_status & METH_INT_RX_RPTR_MASK) >> 8;
 
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
         priv->dma_ctrl &= ~METH_DMA_RX_INT_EN;
         mace->eth.dma_ctrl = priv->dma_ctrl;
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
 
         if (int_status & METH_INT_RX_UNDERFLOW) {
                 fifo_rptr = (fifo_rptr - 1) & 0x0f;
@@ -452,12 +452,12 @@ static void meth_rx(struct net_device* dev, unsigned long int_status)
                 mace->eth.rx_fifo = priv->rx_ring_dmas[priv->rx_write];
                 ADVANCE_RX_PTR(priv->rx_write);
         }
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
         /* In case there was underflow, and Rx DMA was disabled */
         priv->dma_ctrl |= METH_DMA_RX_INT_EN | METH_DMA_RX_EN;
         mace->eth.dma_ctrl = priv->dma_ctrl;
         mace->eth.int_stat = METH_INT_RX_THRESHOLD;
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
 }
 
 static int meth_tx_full(struct net_device *dev)
@@ -470,11 +470,11 @@ static int meth_tx_full(struct net_device *dev)
 static void meth_tx_cleanup(struct net_device* dev, unsigned long int_status)
 {
         struct meth_private *priv = netdev_priv(dev);
-        unsigned long status;
+        unsigned long status, flags;
         struct sk_buff *skb;
         unsigned long rptr = (int_status&TX_INFO_RPTR) >> 16;
 
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
 
         /* Stop DMA notification */
         priv->dma_ctrl &= ~(METH_DMA_TX_INT_EN);
@@ -527,12 +527,13 @@ static void meth_tx_cleanup(struct net_device* dev, unsigned long int_status)
         }
 
         mace->eth.int_stat = METH_INT_TX_EMPTY | METH_INT_TX_PKT;
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
 }
 
 static void meth_error(struct net_device* dev, unsigned status)
 {
         struct meth_private *priv = netdev_priv(dev);
+        unsigned long flags;
 
         printk(KERN_WARNING "meth: error status: 0x%08x\n",status);
         /* check for errors too... */
@@ -547,7 +548,7 @@ static void meth_error(struct net_device* dev, unsigned status)
                 printk(KERN_WARNING "meth: Rx overflow\n");
         if (status & (METH_INT_RX_UNDERFLOW)) {
                 printk(KERN_WARNING "meth: Rx underflow\n");
-                spin_lock(&priv->meth_lock);
+                spin_lock_irqsave(&priv->meth_lock, flags);
                 mace->eth.int_stat = METH_INT_RX_UNDERFLOW;
                 /* more underflow interrupts will be delivered,
                  * effectively throwing us into an infinite loop.
@@ -555,7 +556,7 @@ static void meth_error(struct net_device* dev, unsigned status)
                 priv->dma_ctrl &= ~METH_DMA_RX_EN;
                 mace->eth.dma_ctrl = priv->dma_ctrl;
                 DPRINTK("Disabled meth Rx DMA temporarily\n");
-                spin_unlock(&priv->meth_lock);
+                spin_unlock_irqrestore(&priv->meth_lock, flags);
         }
         mace->eth.int_stat = METH_INT_ERROR;
 }
diff --git a/drivers/net/mlx4/en_cq.c b/drivers/net/mlx4/en_cq.c
index 91f50de84be..a276125b709 100644
--- a/drivers/net/mlx4/en_cq.c
+++ b/drivers/net/mlx4/en_cq.c
@@ -125,8 +125,10 @@ void mlx4_en_deactivate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq)
 
         if (cq->is_tx)
                 del_timer(&cq->timer);
-        else
+        else {
                 napi_disable(&cq->napi);
+                netif_napi_del(&cq->napi);
+        }
 
         mlx4_cq_free(mdev->dev, &cq->mcq);
 }
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 7942c4d3cd8..9ee873e872b 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -951,7 +951,6 @@ static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv,
         if (err) {
                 mlx4_err(mdev, "Failed to allocate qp #%d\n", qpn);
                 goto out;
-                return err;
         }
         qp->event = mlx4_en_sqp_event;
 
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index ac6fc499b28..e5c98a98ad3 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -426,7 +426,7 @@ void mlx4_en_poll_tx_cq(unsigned long data)
 
         INC_PERF_COUNTER(priv->pstats.tx_poll);
 
-        if (!spin_trylock(&ring->comp_lock)) {
+        if (!spin_trylock_irq(&ring->comp_lock)) {
                 mod_timer(&cq->timer, jiffies + MLX4_EN_TX_POLL_TIMEOUT);
                 return;
         }
@@ -439,7 +439,7 @@ void mlx4_en_poll_tx_cq(unsigned long data)
         if (inflight && priv->port_up)
                 mod_timer(&cq->timer, jiffies + MLX4_EN_TX_POLL_TIMEOUT);
 
-        spin_unlock(&ring->comp_lock);
+        spin_unlock_irq(&ring->comp_lock);
 }
 
 static struct mlx4_en_tx_desc *mlx4_en_bounce_to_desc(struct mlx4_en_priv *priv,
@@ -482,9 +482,9 @@ static inline void mlx4_en_xmit_poll(struct mlx4_en_priv *priv, int tx_ind)
 
         /* Poll the CQ every mlx4_en_TX_MODER_POLL packets */
         if ((++ring->poll_cnt & (MLX4_EN_TX_POLL_MODER - 1)) == 0)
-                if (spin_trylock(&ring->comp_lock)) {
+                if (spin_trylock_irq(&ring->comp_lock)) {
                         mlx4_en_process_tx_cq(priv->dev, cq);
-                        spin_unlock(&ring->comp_lock);
+                        spin_unlock_irq(&ring->comp_lock);
                 }
 }
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index a400d7115f7..6bb5af35eda 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -569,7 +569,7 @@ static int rxq_process(struct rx_queue *rxq, int budget)
                 if (rxq->rx_curr_desc == rxq->rx_ring_size)
                         rxq->rx_curr_desc = 0;
 
-                dma_unmap_single(NULL, rx_desc->buf_ptr,
+                dma_unmap_single(mp->dev->dev.parent, rx_desc->buf_ptr,
                                  rx_desc->buf_size, DMA_FROM_DEVICE);
                 rxq->rx_desc_count--;
                 rx++;
@@ -678,8 +678,9 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
 
                 rx_desc = rxq->rx_desc_area + rx;
 
-                rx_desc->buf_ptr = dma_map_single(NULL, skb->data,
-                                        mp->skb_size, DMA_FROM_DEVICE);
+                rx_desc->buf_ptr = dma_map_single(mp->dev->dev.parent,
+                                                  skb->data, mp->skb_size,
+                                                  DMA_FROM_DEVICE);
                 rx_desc->buf_size = mp->skb_size;
                 rxq->rx_skb[rx] = skb;
                 wmb();
@@ -718,6 +719,7 @@ static inline unsigned int has_tiny_unaligned_frags(struct sk_buff *skb)
 
 static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
 {
+        struct mv643xx_eth_private *mp = txq_to_mp(txq);
         int nr_frags = skb_shinfo(skb)->nr_frags;
         int frag;
 
@@ -746,10 +748,10 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
 
                 desc->l4i_chk = 0;
                 desc->byte_cnt = this_frag->size;
-                desc->buf_ptr = dma_map_page(NULL, this_frag->page,
-                                                this_frag->page_offset,
-                                                this_frag->size,
-                                                DMA_TO_DEVICE);
+                desc->buf_ptr = dma_map_page(mp->dev->dev.parent,
+                                             this_frag->page,
+                                             this_frag->page_offset,
+                                             this_frag->size, DMA_TO_DEVICE);
         }
 }
 
@@ -826,7 +828,8 @@ no_csum:
 
         desc->l4i_chk = l4i_chk;
         desc->byte_cnt = length;
-        desc->buf_ptr = dma_map_single(NULL, skb->data, length, DMA_TO_DEVICE);
+        desc->buf_ptr = dma_map_single(mp->dev->dev.parent, skb->data,
+                                       length, DMA_TO_DEVICE);
 
         __skb_queue_tail(&txq->tx_skb, skb);
 
@@ -956,10 +959,10 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 }
 
                 if (cmd_sts & TX_FIRST_DESC) {
-                        dma_unmap_single(NULL, desc->buf_ptr,
+                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
                                          desc->byte_cnt, DMA_TO_DEVICE);
                 } else {
-                        dma_unmap_page(NULL, desc->buf_ptr,
+                        dma_unmap_page(mp->dev->dev.parent, desc->buf_ptr,
                                        desc->byte_cnt, DMA_TO_DEVICE);
                 }
 
@@ -1894,9 +1897,9 @@ static int rxq_init(struct mv643xx_eth_private *mp, int index)
                                                 mp->rx_desc_sram_size);
                 rxq->rx_desc_dma = mp->rx_desc_sram_addr;
         } else {
-                rxq->rx_desc_area = dma_alloc_coherent(NULL, size,
-                                                        &rxq->rx_desc_dma,
-                                                        GFP_KERNEL);
+                rxq->rx_desc_area = dma_alloc_coherent(mp->dev->dev.parent,
+                                                       size, &rxq->rx_desc_dma,
+                                                       GFP_KERNEL);
         }
 
         if (rxq->rx_desc_area == NULL) {
@@ -1947,7 +1950,7 @@ out_free:
         if (index == 0 && size <= mp->rx_desc_sram_size)
                 iounmap(rxq->rx_desc_area);
         else
-                dma_free_coherent(NULL, size,
+                dma_free_coherent(mp->dev->dev.parent, size,
                                   rxq->rx_desc_area,
                                   rxq->rx_desc_dma);
 
@@ -1979,7 +1982,7 @@ static void rxq_deinit(struct rx_queue *rxq)
             rxq->rx_desc_area_size <= mp->rx_desc_sram_size)
                 iounmap(rxq->rx_desc_area);
         else
-                dma_free_coherent(NULL, rxq->rx_desc_area_size,
+                dma_free_coherent(mp->dev->dev.parent, rxq->rx_desc_area_size,
                                   rxq->rx_desc_area, rxq->rx_desc_dma);
 
         kfree(rxq->rx_skb);
@@ -2007,9 +2010,9 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
                                                 mp->tx_desc_sram_size);
                 txq->tx_desc_dma = mp->tx_desc_sram_addr;
         } else {
-                txq->tx_desc_area = dma_alloc_coherent(NULL, size,
-                                                        &txq->tx_desc_dma,
-                                                        GFP_KERNEL);
+                txq->tx_desc_area = dma_alloc_coherent(mp->dev->dev.parent,
+                                                       size, &txq->tx_desc_dma,
+                                                       GFP_KERNEL);
         }
 
         if (txq->tx_desc_area == NULL) {
@@ -2053,7 +2056,7 @@ static void txq_deinit(struct tx_queue *txq)
             txq->tx_desc_area_size <= mp->tx_desc_sram_size)
                 iounmap(txq->tx_desc_area);
         else
-                dma_free_coherent(NULL, txq->tx_desc_area_size,
+                dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
                                   txq->tx_desc_area, txq->tx_desc_dma);
 }
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 0b6e8c89683..3b19e0ce290 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -66,7 +66,6 @@ static const int multicast_filter_limit = 32;
 #define RX_DMA_BURST    6       /* Maximum PCI burst, '6' is 1024 */
 #define TX_DMA_BURST    6       /* Maximum PCI burst, '6' is 1024 */
 #define EarlyTxThld     0x3F    /* 0x3F means NO early transmit */
-#define RxPacketMaxSize 0x3FE8  /* 16K - 1 - ETH_HLEN - VLAN - CRC... */
 #define SafeMtu         0x1c20  /* ... actually life sucks beyond ~7k */
 #define InterFrameGap   0x03    /* 3 means InterFrameGap = the shortest one */
 
@@ -2357,10 +2356,10 @@ static u16 rtl_rw_cpluscmd(void __iomem *ioaddr)
         return cmd;
 }
 
-static void rtl_set_rx_max_size(void __iomem *ioaddr)
+static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz)
 {
         /* Low hurts. Let's disable the filtering. */
-        RTL_W16(RxMaxSize, 16383);
+        RTL_W16(RxMaxSize, rx_buf_sz);
 }
 
 static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
@@ -2407,7 +2406,7 @@ static void rtl_hw_start_8169(struct net_device *dev)
 
         RTL_W8(EarlyTxThres, EarlyTxThld);
 
-        rtl_set_rx_max_size(ioaddr);
+        rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
 
         if ((tp->mac_version == RTL_GIGA_MAC_VER_01) ||
             (tp->mac_version == RTL_GIGA_MAC_VER_02) ||
@@ -2668,7 +2667,7 @@ static void rtl_hw_start_8168(struct net_device *dev)
 
         RTL_W8(EarlyTxThres, EarlyTxThld);
 
-        rtl_set_rx_max_size(ioaddr);
+        rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
 
         tp->cp_cmd |= RTL_R16(CPlusCmd) | PktCntrDisable | INTT_1;
 
@@ -2846,7 +2845,7 @@ static void rtl_hw_start_8101(struct net_device *dev)
 
         RTL_W8(EarlyTxThres, EarlyTxThld);
 
-        rtl_set_rx_max_size(ioaddr);
+        rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
 
         tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;
 
@@ -3554,54 +3553,64 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
         int handled = 0;
         int status;
 
+        /* loop handling interrupts until we have no new ones or
+         * we hit a invalid/hotplug case.
+         */
         status = RTL_R16(IntrStatus);
+        while (status && status != 0xffff) {
+                handled = 1;
 
-        /* hotplug/major error/no more work/shared irq */
-        if ((status == 0xffff) || !status)
-                goto out;
-
-        handled = 1;
+                /* Handle all of the error cases first. These will reset
+                 * the chip, so just exit the loop.
+                 */
+                if (unlikely(!netif_running(dev))) {
+                        rtl8169_asic_down(ioaddr);
+                        break;
+                }
 
-        if (unlikely(!netif_running(dev))) {
-                rtl8169_asic_down(ioaddr);
-                goto out;
-        }
+                /* Work around for rx fifo overflow */
+                if (unlikely(status & RxFIFOOver) &&
+                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+                        netif_stop_queue(dev);
+                        rtl8169_tx_timeout(dev);
+                        break;
+                }
 
-        status &= tp->intr_mask;
-        RTL_W16(IntrStatus,
-                (status & RxFIFOOver) ? (status | RxOverflow) : status);
+                if (unlikely(status & SYSErr)) {
+                        rtl8169_pcierr_interrupt(dev);
+                        break;
+                }
 
-        if (!(status & tp->intr_event))
-                goto out;
+                if (status & LinkChg)
+                        rtl8169_check_link_status(dev, tp, ioaddr);
 
-        /* Work around for rx fifo overflow */
-        if (unlikely(status & RxFIFOOver) &&
-            (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
-                netif_stop_queue(dev);
-                rtl8169_tx_timeout(dev);
-                goto out;
-        }
+                /* We need to see the lastest version of tp->intr_mask to
+                 * avoid ignoring an MSI interrupt and having to wait for
+                 * another event which may never come.
+                 */
+                smp_rmb();
+                if (status & tp->intr_mask & tp->napi_event) {
+                        RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
+                        tp->intr_mask = ~tp->napi_event;
+
+                        if (likely(napi_schedule_prep(&tp->napi)))
+                                __napi_schedule(&tp->napi);
+                        else if (netif_msg_intr(tp)) {
+                                printk(KERN_INFO "%s: interrupt %04x in poll\n",
+                                dev->name, status);
+                        }
+                }
 
-        if (unlikely(status & SYSErr)) {
-                rtl8169_pcierr_interrupt(dev);
-                goto out;
+                /* We only get a new MSI interrupt when all active irq
+                 * sources on the chip have been acknowledged. So, ack
+                 * everything we've seen and check if new sources have become
+                 * active to avoid blocking all interrupts from the chip.
+                 */
+                RTL_W16(IntrStatus,
+                        (status & RxFIFOOver) ? (status | RxOverflow) : status);
+                status = RTL_R16(IntrStatus);
         }
 
-        if (status & LinkChg)
-                rtl8169_check_link_status(dev, tp, ioaddr);
-
-        if (status & tp->napi_event) {
-                RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
-                tp->intr_mask = ~tp->napi_event;
-
-                if (likely(napi_schedule_prep(&tp->napi)))
-                        __napi_schedule(&tp->napi);
-                else if (netif_msg_intr(tp)) {
-                        printk(KERN_INFO "%s: interrupt %04x in poll\n",
-                               dev->name, status);
-                }
-        }
-out:
         return IRQ_RETVAL(handled);
 }
 
@@ -3617,13 +3626,15 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
 
         if (work_done < budget) {
                 napi_complete(napi);
-                tp->intr_mask = 0xffff;
-                /*
-                 * 20040426: the barrier is not strictly required but the
-                 * behavior of the irq handler could be less predictable
-                 * without it. Btw, the lack of flush for the posted pci
-                 * write is safe - FR
+
+                /* We need for force the visibility of tp->intr_mask
+                 * for other CPUs, as we can loose an MSI interrupt
+                 * and potentially wait for a retransmit timeout if we don't.
+                 * The posted write to IntrMask is safe, as it will
+                 * eventually make it to the chip and we won't loose anything
+                 * until it does.
                  */
+                tp->intr_mask = 0xffff;
                 smp_wmb();
                 RTL_W16(IntrMask, tp->intr_event);
         }
diff --git a/drivers/net/vxge/vxge-traffic.c b/drivers/net/vxge/vxge-traffic.c
index 7be0ae10d69..c2eeac4125f 100644
--- a/drivers/net/vxge/vxge-traffic.c
+++ b/drivers/net/vxge/vxge-traffic.c
@@ -115,7 +115,7 @@ enum vxge_hw_status vxge_hw_vpath_intr_enable(struct __vxge_hw_vpath_handle *vp)
                 VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO1_POISON|
                 VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO2_POISON|
                 VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO1_DMA_ERR|
-                VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO1_DMA_ERR), 0, 32),
+                VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO2_DMA_ERR), 0, 32),
                 &vp_reg->kdfcctl_errors_mask);
 
         __vxge_hw_pio_mem_write32_upper(0, &vp_reg->vpath_ppif_int_mask);
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index 3bf7d3f447d..765a7f5d6aa 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -1249,7 +1249,7 @@ static int __devinit hss_init_one(struct platform_device *pdev)
                 return -ENOMEM;
 
         if ((port->npe = npe_request(0)) == NULL) {
-                err = -ENOSYS;
+                err = -ENODEV;
                 goto err_free;
         }
 
@@ -1311,7 +1311,7 @@ static int __init hss_init_module(void)
         if ((ixp4xx_read_feature_bits() &
              (IXP4XX_FEATURE_HDLC | IXP4XX_FEATURE_HSS)) !=
             (IXP4XX_FEATURE_HDLC | IXP4XX_FEATURE_HSS))
-                return -ENOSYS;
+                return -ENODEV;
 
         spin_lock_init(&npe_lock);
 
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index 02419bfd64b..f9fc3890232 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -819,10 +819,9 @@ void i2400m_roq_queue_update_ws(struct i2400m *i2400m, struct i2400m_roq *roq,
                         roq_data = (struct i2400m_roq_data *) &skb->cb;
                         i2400m_net_erx(i2400m, skb, roq_data->cs);
                 }
-                else {
+                else
                         __i2400m_roq_queue(i2400m, roq, skb, sn, nsn);
-                        __i2400m_roq_update_ws(i2400m, roq, sn + 1);
-                }
+                __i2400m_roq_update_ws(i2400m, roq, sn + 1);
                 i2400m_roq_log_add(i2400m, roq, I2400M_RO_TYPE_PACKET_WS,
                                    old_ws, len, sn, nsn, roq->ws);
         }
diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c
index ca4151a9e22..17851321b7f 100644
--- a/drivers/net/wimax/i2400m/usb.c
+++ b/drivers/net/wimax/i2400m/usb.c
@@ -505,27 +505,52 @@ int i2400mu_suspend(struct usb_interface *iface, pm_message_t pm_msg)
 #ifdef CONFIG_PM
         struct usb_device *usb_dev = i2400mu->usb_dev;
 #endif
+        unsigned is_autosuspend = 0;
         struct i2400m *i2400m = &i2400mu->i2400m;
 
+#ifdef CONFIG_PM
+        if (usb_dev->auto_pm > 0)
+                is_autosuspend = 1;
+#endif
+
         d_fnstart(3, dev, "(iface %p pm_msg %u)\n", iface, pm_msg.event);
         if (i2400m->updown == 0)
                 goto no_firmware;
-        d_printf(1, dev, "fw up, requesting standby\n");
+        if (i2400m->state == I2400M_SS_DATA_PATH_CONNECTED && is_autosuspend) {
+                /* ugh -- the device is connected and this suspend
+                 * request is an autosuspend one (not a system standby
+                 * / hibernate).
+                 *
+                 * The only way the device can go to standby is if the
+                 * link with the base station is in IDLE mode; that
+                 * were the case, we'd be in status
+                 * I2400M_SS_CONNECTED_IDLE. But we are not.
+                 *
+                 * If we *tell* him to go power save now, it'll reset
+                 * as a precautionary measure, so if this is an
+                 * autosuspend thing, say no and it'll come back
+                 * later, when the link is IDLE
+                 */
+                result = -EBADF;
+                d_printf(1, dev, "fw up, link up, not-idle, autosuspend: "
+                         "not entering powersave\n");
+                goto error_not_now;
+        }
+        d_printf(1, dev, "fw up: entering powersave\n");
         atomic_dec(&i2400mu->do_autopm);
         result = i2400m_cmd_enter_powersave(i2400m);
         atomic_inc(&i2400mu->do_autopm);
-#ifdef CONFIG_PM
-        if (result < 0 && usb_dev->auto_pm == 0) {
+        if (result < 0 && !is_autosuspend) {
                 /* System suspend, can't fail */
                 dev_err(dev, "failed to suspend, will reset on resume\n");
                 result = 0;
         }
-#endif
         if (result < 0)
                 goto error_enter_powersave;
         i2400mu_notification_release(i2400mu);
-        d_printf(1, dev, "fw up, got standby\n");
+        d_printf(1, dev, "powersave requested\n");
 error_enter_powersave:
+error_not_now:
 no_firmware:
         d_fnend(3, dev, "(iface %p pm_msg %u) = %d\n",
                 iface, pm_msg.event, result);
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 8a0823588c5..3d94e7dfea6 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -430,6 +430,7 @@ config RTL8187
           ASUS P5B Deluxe
           Toshiba Satellite Pro series of laptops
           Asus Wireless Link
+          Linksys WUSB54GC-EU
 
           Thanks to Realtek for their support!
 
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index c36d3a3d655..9eabf4d1f2e 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -6467,6 +6467,7 @@ static int airo_get_encode(struct net_device *dev,
 {
         struct airo_info *local = dev->ml_priv;
         int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+        int wep_key_len;
         u8 buf[16];
 
         if (!local->wep_capable)
@@ -6500,8 +6501,13 @@ static int airo_get_encode(struct net_device *dev,
         dwrq->flags |= index + 1;
 
         /* Copy the key to the user buffer */
-        dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf));
-        memcpy(extra, buf, dwrq->length);
+        wep_key_len = get_wep_key(local, index, &buf[0], sizeof(buf));
+        if (wep_key_len < 0) {
+                dwrq->length = 0;
+        } else {
+                dwrq->length = wep_key_len;
+                memcpy(extra, buf, dwrq->length);
+        }
 
         return 0;
 }
@@ -6614,7 +6620,7 @@ static int airo_get_encodeext(struct net_device *dev,
         struct airo_info *local = dev->ml_priv;
         struct iw_point *encoding = &wrqu->encoding;
         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-        int idx, max_key_len;
+        int idx, max_key_len, wep_key_len;
         u8 buf[16];
 
         if (!local->wep_capable)
@@ -6658,8 +6664,13 @@ static int airo_get_encodeext(struct net_device *dev,
         memset(extra, 0, 16);
         
         /* Copy the key to the user buffer */
-        ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
-        memcpy(extra, buf, ext->key_len);
+        wep_key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
+        if (wep_key_len < 0) {
+                ext->key_len = 0;
+        } else {
+                ext->key_len = wep_key_len;
+                memcpy(extra, buf, ext->key_len);
+        }
 
         return 0;
 }
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 744f4f4dd3d..8d93ca4651b 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1873,18 +1873,18 @@ static void at76_dwork_hw_scan(struct work_struct *work)
         if (ret != CMD_STATUS_COMPLETE) {
                 queue_delayed_work(priv->hw->workqueue, &priv->dwork_hw_scan,
                                    SCAN_POLL_INTERVAL);
-                goto exit;
+                mutex_unlock(&priv->mtx);
+                return;
         }
 
-        ieee80211_scan_completed(priv->hw, false);
-
         if (is_valid_ether_addr(priv->bssid))
                 at76_join(priv);
 
-        ieee80211_wake_queues(priv->hw);
-
-exit:
         mutex_unlock(&priv->mtx);
+
+        ieee80211_scan_completed(priv->hw, false);
+
+        ieee80211_wake_queues(priv->hw);
 }
 
 static int at76_hw_scan(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index a08bc8a4fb6..32df27a9c7a 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -214,7 +214,7 @@ static struct pci_driver ath5k_pci_driver = {
  * Prototypes - MAC 802.11 stack related functions
  */
 static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
-static int ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel);
+static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
 static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
@@ -1038,16 +1038,13 @@ ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
         if (chan->center_freq != sc->curchan->center_freq ||
                 chan->hw_value != sc->curchan->hw_value) {
 
-                sc->curchan = chan;
-                sc->curband = &sc->sbands[chan->band];
-
                 /*
                  * To switch channels clear any pending DMA operations;
                  * wait long enough for the RX fifo to drain, reset the
                  * hardware at the new frequency, and then re-enable
                  * the relevant bits of the h/w.
                  */
-                return ath5k_reset(sc, true, true);
+                return ath5k_reset(sc, chan);
         }
 
         return 0;
@@ -2314,7 +2311,7 @@ ath5k_init(struct ath5k_softc *sc)
         sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
                 AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
                 AR5K_INT_FATAL | AR5K_INT_GLOBAL;
-        ret = ath5k_reset(sc, false, false);
+        ret = ath5k_reset(sc, NULL);
         if (ret)
                 goto done;
 
@@ -2599,18 +2596,25 @@ drop_packet:
         return NETDEV_TX_OK;
 }
 
+/*
+ * Reset the hardware.  If chan is not NULL, then also pause rx/tx
+ * and change to the given channel.
+ */
 static int
-ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel)
+ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
 {
         struct ath5k_hw *ah = sc->ah;
         int ret;
 
         ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "resetting\n");
 
-        if (stop) {
+        if (chan) {
                 ath5k_hw_set_imr(ah, 0);
                 ath5k_txq_cleanup(sc);
                 ath5k_rx_stop(sc);
+
+                sc->curchan = chan;
+                sc->curband = &sc->sbands[chan->band];
         }
         ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true);
         if (ret) {
@@ -2648,7 +2652,7 @@ ath5k_reset_wake(struct ath5k_softc *sc)
 {
         int ret;
 
-        ret = ath5k_reset(sc, true, true);
+        ret = ath5k_reset(sc, sc->curchan);
         if (!ret)
                 ieee80211_wake_queues(sc->hw);
 
diff --git a/drivers/net/wireless/ath5k/phy.c b/drivers/net/wireless/ath5k/phy.c
index 9e2faae5ae9..b48b29dca3d 100644
--- a/drivers/net/wireless/ath5k/phy.c
+++ b/drivers/net/wireless/ath5k/phy.c
@@ -1487,28 +1487,35 @@ ath5k_get_linear_pcdac_min(const u8 *stepL, const u8 *stepR,
 {
         s8 tmp;
         s16 min_pwrL, min_pwrR;
-        s16 pwr_i = pwrL[0];
-
-        do {
-                pwr_i--;
-                tmp = (s8) ath5k_get_interpolated_value(pwr_i,
-                                                pwrL[0], pwrL[1],
-                                                stepL[0], stepL[1]);
-
-        } while (tmp > 1);
-
-        min_pwrL = pwr_i;
-
-        pwr_i = pwrR[0];
-        do {
-                pwr_i--;
-                tmp = (s8) ath5k_get_interpolated_value(pwr_i,
-                                                pwrR[0], pwrR[1],
-                                                stepR[0], stepR[1]);
-
-        } while (tmp > 1);
+        s16 pwr_i;
+
+        if (pwrL[0] == pwrL[1])
+                min_pwrL = pwrL[0];
+        else {
+                pwr_i = pwrL[0];
+                do {
+                        pwr_i--;
+                        tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+                                                        pwrL[0], pwrL[1],
+                                                        stepL[0], stepL[1]);
+                } while (tmp > 1);
+
+                min_pwrL = pwr_i;
+        }
 
-        min_pwrR = pwr_i;
+        if (pwrR[0] == pwrR[1])
+                min_pwrR = pwrR[0];
+        else {
+                pwr_i = pwrR[0];
+                do {
+                        pwr_i--;
+                        tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+                                                        pwrR[0], pwrR[1],
+                                                        stepR[0], stepR[1]);
+                } while (tmp > 1);
+
+                min_pwrR = pwr_i;
+        }
 
         /* Keep the right boundary so that it works for both curves */
         return max(min_pwrL, min_pwrR);
diff --git a/drivers/net/wireless/ath5k/reset.c b/drivers/net/wireless/ath5k/reset.c
index 7a17d31b2fd..5f72c111c2e 100644
--- a/drivers/net/wireless/ath5k/reset.c
+++ b/drivers/net/wireless/ath5k/reset.c
@@ -26,7 +26,7 @@
 \*****************************/
 
 #include <linux/pci.h>          /* To determine if a card is pci-e */
-#include <linux/bitops.h>       /* For get_bitmask_order */
+#include <linux/log2.h>
 #include "ath5k.h"
 #include "reg.h"
 #include "base.h"
@@ -69,10 +69,10 @@ static inline int ath5k_hw_write_ofdm_timings(struct ath5k_hw *ah,
 
         /* Get exponent
          * ALGO: coef_exp = 14 - highest set bit position */
-        coef_exp = get_bitmask_order(coef_scaled);
+        coef_exp = ilog2(coef_scaled);
 
         /* Doesn't make sense if it's zero*/
-        if (!coef_exp)
+        if (!coef_scaled || !coef_exp)
                 return -EINVAL;
 
         /* Note: we've shifted coef_scaled by 24 */
@@ -359,7 +359,7 @@ int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
                         mode |= AR5K_PHY_MODE_FREQ_5GHZ;
 
                         if (ah->ah_radio == AR5K_RF5413)
-                                clock |= AR5K_PHY_PLL_40MHZ_5413;
+                                clock = AR5K_PHY_PLL_40MHZ_5413;
                         else
                                 clock |= AR5K_PHY_PLL_40MHZ;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index e5ca2511a81..9452461ce86 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -46,7 +46,7 @@
 #include "iwl-6000-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL5000_UCODE_API_MAX 1
+#define IWL5000_UCODE_API_MAX 2
 #define IWL5150_UCODE_API_MAX 2
 
 /* Lowest firmware API version supported */
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index edfa5e149f7..bd438d8acf5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -101,8 +101,8 @@ struct iwl_cfg iwl6000_2agn_cfg = {
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
         .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .need_pll_cfg = false,
 };
 
@@ -117,8 +117,8 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
         .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .need_pll_cfg = false,
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 1ef4192207a..f46ba247577 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -669,13 +669,6 @@ static int iwl_set_mode(struct iwl_priv *priv, int mode)
         if (!iwl_is_ready_rf(priv))
                 return -EAGAIN;
 
-        cancel_delayed_work(&priv->scan_check);
-        if (iwl_scan_cancel_timeout(priv, 100)) {
-                IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
-                IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                return -EAGAIN;
-        }
-
         iwl_commit_rxon(priv);
 
         return 0;
@@ -3636,7 +3629,9 @@ static struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x0085, 0x1112, iwl6000_2ag_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1122, iwl6000_2ag_cfg)},
         {IWL_PCI_DEVICE(0x422B, PCI_ANY_ID, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422C, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x4238, PCI_ANY_ID, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x4239, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0082, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0085, PCI_ANY_ID, iwl6000_3agn_cfg)},
         {IWL_PCI_DEVICE(0x0086, PCI_ANY_ID, iwl6050_3agn_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index e7c65c4f741..6330b91e37c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -227,9 +227,6 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
         /* The HW is no longer scanning */
         clear_bit(STATUS_SCAN_HW, &priv->status);
 
-        /* The scan completion notification came in, so kill that timer... */
-        cancel_delayed_work(&priv->scan_check);
-
         IWL_DEBUG_INFO(priv, "Scan pass on %sGHz took %dms\n",
                        (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
                                                 "2.4" : "5.2",
@@ -712,6 +709,8 @@ static void iwl_bg_request_scan(struct work_struct *data)
 
         mutex_lock(&priv->mutex);
 
+        cancel_delayed_work(&priv->scan_check);
+
         if (!iwl_is_ready(priv)) {
                 IWL_WARN(priv, "request scan called when driver not ready.\n");
                 goto done;
@@ -925,6 +924,8 @@ void iwl_bg_scan_completed(struct work_struct *work)
 
         IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
 
+        cancel_delayed_work(&priv->scan_check);
+
         ieee80211_scan_completed(priv->hw, false);
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 5798fe49c77..44ab03a12e4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -719,6 +719,14 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
 {
         unsigned long flags;
         int ret = 0;
+        __le16 key_flags = 0;
+
+        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
+        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags &= ~STA_KEY_FLG_INVALID;
+
+        if (sta_id == priv->hw_params.bcast_sta_id)
+                key_flags |= STA_KEY_MULTICAST_MSK;
 
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
@@ -738,6 +746,9 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
         WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
                 "no space for a new key");
 
+        priv->stations[sta_id].sta.key.key_flags = key_flags;
+
+
         /* This copy is acutally not needed: we get the key with each TX */
         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
 
@@ -754,9 +765,7 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
 {
         u8 sta_id = IWL_INVALID_STATION;
         unsigned long flags;
-        __le16 key_flags = 0;
         int i;
-        DECLARE_MAC_BUF(mac);
 
         sta_id = iwl_find_station(priv, addr);
         if (sta_id == IWL_INVALID_STATION) {
@@ -771,16 +780,8 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
                 return;
         }
 
-        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
-        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
-        key_flags &= ~STA_KEY_FLG_INVALID;
-
-        if (sta_id == priv->hw_params.bcast_sta_id)
-                key_flags |= STA_KEY_MULTICAST_MSK;
-
         spin_lock_irqsave(&priv->sta_lock, flags);
 
-        priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;
 
         for (i = 0; i < 5; i++)
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 70a00c8ee42..ff4d0e41d7c 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -782,13 +782,6 @@ static int iwl3945_set_mode(struct iwl_priv *priv, int mode)
         if (!iwl_is_ready_rf(priv))
                 return -EAGAIN;
 
-        cancel_delayed_work(&priv->scan_check);
-        if (iwl_scan_cancel_timeout(priv, 100)) {
-                IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
-                IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                return -EAGAIN;
-        }
-
         iwl3945_commit_rxon(priv);
 
         return 0;
@@ -1744,7 +1737,6 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
         rxq->bd = NULL;
         rxq->rb_stts  = NULL;
 }
-EXPORT_SYMBOL(iwl3945_rx_queue_free);
 
 
 /* Convert linear signal-to-noise ratio into dB */
@@ -3299,6 +3291,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
         mutex_lock(&priv->mutex);
 
+        cancel_delayed_work(&priv->scan_check);
+
         if (!iwl_is_ready(priv)) {
                 IWL_WARN(priv, "request scan called when driver not ready.\n");
                 goto done;
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 07d378ef0b4..7b3ee8c2eae 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -138,7 +138,7 @@ void rt2x00debug_update_crypto(struct rt2x00_dev *rt2x00dev,
 
         if (cipher == CIPHER_TKIP_NO_MIC)
                 cipher = CIPHER_TKIP;
-        if (cipher == CIPHER_NONE || cipher > CIPHER_MAX)
+        if (cipher == CIPHER_NONE || cipher >= CIPHER_MAX)
                 return;
 
         /* Remove CIPHER_NONE index */
diff --git a/drivers/net/wireless/rtl818x/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187.h
index 9718f61809c..edeff82a4d0 100644
--- a/drivers/net/wireless/rtl818x/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187.h
@@ -120,6 +120,12 @@ struct rtl8187_priv {
                 __le64 buf;
                 struct sk_buff_head queue;
         } b_tx_status; /* This queue is used by both -b and non-b devices */
+        struct mutex io_mutex;
+        union {
+                u8 bits8;
+                __le16 bits16;
+                __le32 bits32;
+        } *io_dmabuf;
 };
 
 void rtl8187_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data);
@@ -129,10 +135,14 @@ static inline u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv,
 {
         u8 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits8;
+        mutex_unlock(&priv->io_mutex);
 
         return val;
 }
@@ -147,10 +157,14 @@ static inline u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv,
 {
         __le16 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits16;
+        mutex_unlock(&priv->io_mutex);
 
         return le16_to_cpu(val);
 }
@@ -165,10 +179,14 @@ static inline u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv,
 {
         __le32 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits32;
+        mutex_unlock(&priv->io_mutex);
 
         return le32_to_cpu(val);
 }
@@ -181,10 +199,15 @@ static inline u32 rtl818x_ioread32(struct rtl8187_priv *priv, __le32 *addr)
 static inline void rtl818x_iowrite8_idx(struct rtl8187_priv *priv,
                                         u8 *addr, u8 val, u8 idx)
 {
+        mutex_lock(&priv->io_mutex);
+
+        priv->io_dmabuf->bits8 = val;
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
@@ -195,12 +218,15 @@ static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
 static inline void rtl818x_iowrite16_idx(struct rtl8187_priv *priv,
                                          __le16 *addr, u16 val, u8 idx)
 {
-        __le16 buf = cpu_to_le16(val);
+        mutex_lock(&priv->io_mutex);
 
+        priv->io_dmabuf->bits16 = cpu_to_le16(val);
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
-                        HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
@@ -212,12 +238,15 @@ static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
 static inline void rtl818x_iowrite32_idx(struct rtl8187_priv *priv,
                                          __le32 *addr, u32 val, u8 idx)
 {
-        __le32 buf = cpu_to_le32(val);
+        mutex_lock(&priv->io_mutex);
 
+        priv->io_dmabuf->bits32 = cpu_to_le32(val);
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
-                        HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite32(struct rtl8187_priv *priv, __le32 *addr,
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index fd81884b9c7..d51ba0a88c2 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -71,6 +71,8 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         {USB_DEVICE(0x18E8, 0x6232), .driver_info = DEVICE_RTL8187},
         /* AirLive */
         {USB_DEVICE(0x1b75, 0x8187), .driver_info = DEVICE_RTL8187},
+        /* Linksys */
+        {USB_DEVICE(0x1737, 0x0073), .driver_info = DEVICE_RTL8187B},
         {}
 };
 
@@ -1329,6 +1331,14 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         priv = dev->priv;
         priv->is_rtl8187b = (id->driver_info == DEVICE_RTL8187B);
 
+        /* allocate "DMA aware" buffer for register accesses */
+        priv->io_dmabuf = kmalloc(sizeof(*priv->io_dmabuf), GFP_KERNEL);
+        if (!priv->io_dmabuf) {
+                err = -ENOMEM;
+                goto err_free_dev;
+        }
+        mutex_init(&priv->io_mutex);
+
         SET_IEEE80211_DEV(dev, &intf->dev);
         usb_set_intfdata(intf, dev);
         priv->udev = udev;
@@ -1495,7 +1505,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         err = ieee80211_register_hw(dev);
         if (err) {
                 printk(KERN_ERR "rtl8187: Cannot register device\n");
-                goto err_free_dev;
+                goto err_free_dmabuf;
         }
         mutex_init(&priv->conf_mutex);
         skb_queue_head_init(&priv->b_tx_status.queue);
@@ -1506,6 +1516,8 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
 
         return 0;
 
+ err_free_dmabuf:
+        kfree(priv->io_dmabuf);
  err_free_dev:
         ieee80211_free_hw(dev);
         usb_set_intfdata(intf, NULL);
@@ -1526,6 +1538,7 @@ static void __devexit rtl8187_disconnect(struct usb_interface *intf)
         priv = dev->priv;
         usb_reset_device(priv->udev);
         usb_put_dev(interface_to_usbdev(intf));
+        kfree(priv->io_dmabuf);
         ieee80211_free_hw(dev);
 }
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
index 78df281b297..a09819386a1 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
@@ -88,9 +88,15 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data)
         rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80);
         udelay(10);
 
+        mutex_lock(&priv->io_mutex);
+
+        priv->io_dmabuf->bits16 = data;
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        addr, 0x8225, &data, sizeof(data), HZ / 2);
+                        addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data),
+                        HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 
         rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80 | (1 << 2));
         udelay(10);
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index f0e99d4c066..242257b1944 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -78,16 +78,20 @@ void free_cpu_buffers(void)
         op_ring_buffer_write = NULL;
 }
 
+#define RB_EVENT_HDR_SIZE 4
+
 int alloc_cpu_buffers(void)
 {
         int i;
 
         unsigned long buffer_size = oprofile_cpu_buffer_size;
+        unsigned long byte_size = buffer_size * (sizeof(struct op_sample) +
+                                                 RB_EVENT_HDR_SIZE);
 
-        op_ring_buffer_read = ring_buffer_alloc(buffer_size, OP_BUFFER_FLAGS);
+        op_ring_buffer_read = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
         if (!op_ring_buffer_read)
                 goto fail;
-        op_ring_buffer_write = ring_buffer_alloc(buffer_size, OP_BUFFER_FLAGS);
+        op_ring_buffer_write = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
         if (!op_ring_buffer_write)
                 goto fail;
 
diff --git a/drivers/parport/parport_gsc.c b/drivers/parport/parport_gsc.c
index e6a7e847ee8..ea31a452b15 100644
--- a/drivers/parport/parport_gsc.c
+++ b/drivers/parport/parport_gsc.c
@@ -352,8 +352,8 @@ static int __devinit parport_init_chip(struct parisc_device *dev)
         unsigned long port;
 
         if (!dev->irq) {
-                printk(KERN_WARNING "IRQ not found for parallel device at 0x%lx\n",
-                        dev->hpa.start);
+                printk(KERN_WARNING "IRQ not found for parallel device at 0x%llx\n",
+                        (unsigned long long)dev->hpa.start);
                 return -ENODEV;
         }
 
diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index 0ebca450ed2..dffa5d4fb29 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -614,7 +614,10 @@ parport_register_device(struct parport *port, const char *name,
          * pardevice fields. -arca
          */
         port->ops->init_state(tmp, tmp->state);
-        parport_device_proc_register(tmp);
+        if (!test_and_set_bit(PARPORT_DEVPROC_REGISTERED, &port->devflags)) {
+                port->proc_device = tmp;
+                parport_device_proc_register(tmp);
+        }
         return tmp;
 
  out_free_all:
@@ -646,10 +649,14 @@ void parport_unregister_device(struct pardevice *dev)
         }
 #endif
 
-        parport_device_proc_unregister(dev);
-
         port = dev->port->physport;
 
+        if (port->proc_device == dev) {
+                port->proc_device = NULL;
+                clear_bit(PARPORT_DEVPROC_REGISTERED, &port->devflags);
+                parport_device_proc_unregister(dev);
+        }
+
         if (port->cad == dev) {
                 printk(KERN_DEBUG "%s: %s forgot to release port\n",
                        port->name, dev->name);
diff --git a/drivers/pci/hotplug/acpiphp.h b/drivers/pci/hotplug/acpiphp.h
index 4fc168b7009..e68d5f20ffb 100644
--- a/drivers/pci/hotplug/acpiphp.h
+++ b/drivers/pci/hotplug/acpiphp.h
@@ -129,7 +129,6 @@ struct acpiphp_func {
         struct acpiphp_bridge *bridge;  /* Ejectable PCI-to-PCI bridge */
 
         struct list_head sibling;
-        struct pci_dev *pci_dev;
         struct notifier_block nb;
         acpi_handle     handle;
 
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index a33794d9e0d..3a6064bce56 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -32,9 +32,6 @@
 
 /*
  * Lifetime rules for pci_dev:
- *  - The one in acpiphp_func has its refcount elevated by pci_get_slot()
- *    when the driver is loaded or when an insertion event occurs.  It loses
- *    a refcount when its ejected or the driver unloads.
  *  - The one in acpiphp_bridge has its refcount elevated by pci_get_slot()
  *    when the bridge is scanned and it loses a refcount when the bridge
  *    is removed.
@@ -130,6 +127,7 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv)
         unsigned long long adr, sun;
         int device, function, retval;
         struct pci_bus *pbus = bridge->pci_bus;
+        struct pci_dev *pdev;
 
         if (!acpi_pci_check_ejectable(pbus, handle) && !is_dock_device(handle))
                 return AE_OK;
@@ -213,10 +211,10 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv)
         newfunc->slot = slot;
         list_add_tail(&newfunc->sibling, &slot->funcs);
 
-        /* associate corresponding pci_dev */
-        newfunc->pci_dev = pci_get_slot(pbus, PCI_DEVFN(device, function));
-        if (newfunc->pci_dev) {
+        pdev = pci_get_slot(pbus, PCI_DEVFN(device, function));
+        if (pdev) {
                 slot->flags |= (SLOT_ENABLED | SLOT_POWEREDON);
+                pci_dev_put(pdev);
         }
 
         if (is_dock_device(handle)) {
@@ -617,7 +615,6 @@ static void cleanup_bridge(struct acpiphp_bridge *bridge)
                                 if (ACPI_FAILURE(status))
                                         err("failed to remove notify handler\n");
                         }
-                        pci_dev_put(func->pci_dev);
                         list_del(list);
                         kfree(func);
                 }
@@ -1101,22 +1098,24 @@ static int __ref enable_device(struct acpiphp_slot *slot)
         pci_enable_bridges(bus);
         pci_bus_add_devices(bus);
 
-        /* associate pci_dev to our representation */
         list_for_each (l, &slot->funcs) {
                 func = list_entry(l, struct acpiphp_func, sibling);
-                func->pci_dev = pci_get_slot(bus, PCI_DEVFN(slot->device,
-                                                        func->function));
-                if (!func->pci_dev)
+                dev = pci_get_slot(bus, PCI_DEVFN(slot->device,
+                                                  func->function));
+                if (!dev)
                         continue;
 
-                if (func->pci_dev->hdr_type != PCI_HEADER_TYPE_BRIDGE &&
-                    func->pci_dev->hdr_type != PCI_HEADER_TYPE_CARDBUS)
+                if (dev->hdr_type != PCI_HEADER_TYPE_BRIDGE &&
+                    dev->hdr_type != PCI_HEADER_TYPE_CARDBUS) {
+                        pci_dev_put(dev);
                         continue;
+                }
 
                 status = find_p2p_bridge(func->handle, (u32)1, bus, NULL);
                 if (ACPI_FAILURE(status))
                         warn("find_p2p_bridge failed (error code = 0x%x)\n",
                                 status);
+                pci_dev_put(dev);
         }
 
         slot->flags |= SLOT_ENABLED;
@@ -1142,17 +1141,14 @@ static void disable_bridges(struct pci_bus *bus)
  */
 static int disable_device(struct acpiphp_slot *slot)
 {
-        int retval = 0;
         struct acpiphp_func *func;
-        struct list_head *l;
+        struct pci_dev *pdev;
 
         /* is this slot already disabled? */
         if (!(slot->flags & SLOT_ENABLED))
                 goto err_exit;
 
-        list_for_each (l, &slot->funcs) {
-                func = list_entry(l, struct acpiphp_func, sibling);
-
+        list_for_each_entry(func, &slot->funcs, sibling) {
                 if (func->bridge) {
                         /* cleanup p2p bridges under this P2P bridge */
                         cleanup_p2p_bridge(func->bridge->handle,
@@ -1160,35 +1156,28 @@ static int disable_device(struct acpiphp_slot *slot)
                         func->bridge = NULL;
                 }
 
-                if (func->pci_dev) {
-                        pci_stop_bus_device(func->pci_dev);
-                        if (func->pci_dev->subordinate) {
-                                disable_bridges(func->pci_dev->subordinate);
-                                pci_disable_device(func->pci_dev);
+                pdev = pci_get_slot(slot->bridge->pci_bus,
+                                    PCI_DEVFN(slot->device, func->function));
+                if (pdev) {
+                        pci_stop_bus_device(pdev);
+                        if (pdev->subordinate) {
+                                disable_bridges(pdev->subordinate);
+                                pci_disable_device(pdev);
                         }
+                        pci_remove_bus_device(pdev);
+                        pci_dev_put(pdev);
                 }
         }
 
-        list_for_each (l, &slot->funcs) {
-                func = list_entry(l, struct acpiphp_func, sibling);
-
+        list_for_each_entry(func, &slot->funcs, sibling) {
                 acpiphp_unconfigure_ioapics(func->handle);
                 acpiphp_bus_trim(func->handle);
-                /* try to remove anyway.
-                 * acpiphp_bus_add might have been failed */
-
-                if (!func->pci_dev)
-                        continue;
-
-                pci_remove_bus_device(func->pci_dev);
-                pci_dev_put(func->pci_dev);
-                func->pci_dev = NULL;
         }
 
         slot->flags &= (~SLOT_ENABLED);
 
- err_exit:
-        return retval;
+err_exit:
+        return 0;
 }
 
 
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 001b328adf8..a563fbe559d 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -59,6 +59,10 @@
 #define DMA_32BIT_PFN           IOVA_PFN(DMA_BIT_MASK(32))
 #define DMA_64BIT_PFN           IOVA_PFN(DMA_BIT_MASK(64))
 
+#ifndef PHYSICAL_PAGE_MASK
+#define PHYSICAL_PAGE_MASK PAGE_MASK
+#endif
+
 /* global iommu list, set NULL for ignored DMAR units */
 static struct intel_iommu **g_iommus;
 
@@ -1216,7 +1220,7 @@ static void dmar_init_reserved_ranges(void)
                         if (!r->flags || !(r->flags & IORESOURCE_MEM))
                                 continue;
                         addr = r->start;
-                        addr &= PAGE_MASK;
+                        addr &= PHYSICAL_PAGE_MASK;
                         size = r->end - addr;
                         size = PAGE_ALIGN(size);
                         iova = reserve_iova(&reserved_iova_list, IOVA_PFN(addr),
@@ -2173,7 +2177,8 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
          * is not a big problem
          */
         ret = domain_page_mapping(domain, start_paddr,
-                ((u64)paddr) & PAGE_MASK, size, prot);
+                                  ((u64)paddr) & PHYSICAL_PAGE_MASK,
+                                  size, prot);
         if (ret)
                 goto error;
 
@@ -2463,8 +2468,8 @@ static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int ne
                 addr = page_to_phys(sg_page(sg)) + sg->offset;
                 size = aligned_size((u64)addr, sg->length);
                 ret = domain_page_mapping(domain, start_addr + offset,
-                        ((u64)addr) & PAGE_MASK,
-                        size, prot);
+                                          ((u64)addr) & PHYSICAL_PAGE_MASK,
+                                          size, prot);
                 if (ret) {
                         /*  clear the page */
                         dma_pte_clear_range(domain, start_addr,
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 6f2e6295e77..362773247fb 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -455,8 +455,6 @@ static int msix_capability_init(struct pci_dev *dev,
                 entry->msi_attrib.default_irq = dev->irq;
                 entry->msi_attrib.pos = pos;
                 entry->mask_base = base;
-                entry->masked = readl(base + j * PCI_MSIX_ENTRY_SIZE +
-                                        PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
                 msix_mask_irq(entry, 1);
 
                 list_add_tail(&entry->list, &dev->msi_list);
@@ -493,6 +491,12 @@ static int msix_capability_init(struct pci_dev *dev,
         msix_set_enable(dev, 1);
         dev->msix_enabled = 1;
 
+        list_for_each_entry(entry, &dev->msi_list, list) {
+                int vector = entry->msi_attrib.entry_nr;
+                entry->masked = readl(base + vector * PCI_MSIX_ENTRY_SIZE +
+                                        PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
+        }
+
         return 0;
 }
 
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 34bf0fdf504..1a91bf9687a 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -557,7 +557,8 @@ static int pci_platform_power_transition(struct pci_dev *dev, pci_power_t state)
         } else {
                 error = -ENODEV;
                 /* Fall back to PCI_D0 if native PM is not supported */
-                pci_update_current_state(dev, PCI_D0);
+                if (!dev->pm_cap)
+                        dev->current_state = PCI_D0;
         }
 
         return error;
diff --git a/drivers/pci/pcie/aer/aerdrv.h b/drivers/pci/pcie/aer/aerdrv.h
index c7ad68b6c6d..aa14482a477 100644
--- a/drivers/pci/pcie/aer/aerdrv.h
+++ b/drivers/pci/pcie/aer/aerdrv.h
@@ -95,6 +95,9 @@ struct aer_broadcast_data {
 static inline pci_ers_result_t merge_result(enum pci_ers_result orig,
                 enum pci_ers_result new)
 {
+        if (new == PCI_ERS_RESULT_NONE)
+                return orig;
+
         switch (orig) {
         case PCI_ERS_RESULT_CAN_RECOVER:
         case PCI_ERS_RESULT_RECOVERED:
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index b924e2463f8..091ce70051e 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -200,7 +200,7 @@ static int slot_reset_iter(struct device *device, void *data)
 
 static pci_ers_result_t pcie_portdrv_slot_reset(struct pci_dev *dev)
 {
-        pci_ers_result_t status = PCI_ERS_RESULT_NONE;
+        pci_ers_result_t status = PCI_ERS_RESULT_RECOVERED;
         int retval;
 
         /* If fatal, restore cfg space for possible link reset at upstream */
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index e3c3e081b83..f1ae2475fff 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -745,6 +745,8 @@ int pci_setup_device(struct pci_dev *dev)
 
         /* Early fixups, before probing the BARs */
         pci_fixup_device(pci_fixup_early, dev);
+        /* device class may be changed after fixup */
+        class = dev->class >> 8;
 
         switch (dev->hdr_type) {                    /* header type */
         case PCI_HEADER_TYPE_NORMAL:                /* standard header */
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index eeafc6c0160..bfc1a8892a3 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -269,16 +269,16 @@ static struct key_entry asus_keymap[] = {
         {KE_KEY, 0x34, KEY_SWITCHVIDEOMODE},
         {KE_KEY, 0x40, KEY_PREVIOUSSONG},
         {KE_KEY, 0x41, KEY_NEXTSONG},
-        {KE_KEY, 0x43, KEY_STOP},
+        {KE_KEY, 0x43, KEY_STOPCD},
         {KE_KEY, 0x45, KEY_PLAYPAUSE},
         {KE_KEY, 0x50, KEY_EMAIL},
         {KE_KEY, 0x51, KEY_WWW},
-        {KE_KEY, 0x5C, BTN_EXTRA},  /* Performance */
+        {KE_KEY, 0x5C, KEY_SCREENLOCK},  /* Screenlock */
         {KE_KEY, 0x5D, KEY_WLAN},
         {KE_KEY, 0x61, KEY_SWITCHVIDEOMODE},
         {KE_KEY, 0x6B, BTN_TOUCH}, /* Lock Mouse */
         {KE_KEY, 0x82, KEY_CAMERA},
-        {KE_KEY, 0x8A, KEY_TV},
+        {KE_KEY, 0x8A, KEY_PROG1},
         {KE_KEY, 0x95, KEY_MEDIA},
         {KE_KEY, 0x99, KEY_PHONE},
         {KE_END, 0},
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 6f54fd1757c..353a898c369 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -158,6 +158,7 @@ enum { KE_KEY, KE_END };
 static struct key_entry eeepc_keymap[] = {
         /* Sleep already handled via generic ACPI code */
         {KE_KEY, 0x10, KEY_WLAN },
+        {KE_KEY, 0x11, KEY_WLAN },
         {KE_KEY, 0x12, KEY_PROG1 },
         {KE_KEY, 0x13, KEY_MUTE },
         {KE_KEY, 0x14, KEY_VOLUMEDOWN },
@@ -166,6 +167,8 @@ static struct key_entry eeepc_keymap[] = {
         {KE_KEY, 0x1b, KEY_ZOOM },
         {KE_KEY, 0x1c, KEY_PROG2 },
         {KE_KEY, 0x1d, KEY_PROG3 },
+        {KE_KEY, NOTIFY_BRN_MIN,     KEY_BRIGHTNESSDOWN },
+        {KE_KEY, NOTIFY_BRN_MIN + 2, KEY_BRIGHTNESSUP },
         {KE_KEY, 0x30, KEY_SWITCHVIDEOMODE },
         {KE_KEY, 0x31, KEY_SWITCHVIDEOMODE },
         {KE_KEY, 0x32, KEY_SWITCHVIDEOMODE },
@@ -381,11 +384,13 @@ static ssize_t show_sys_acpi(int cm, char *buf)
 EEEPC_CREATE_DEVICE_ATTR(camera, CM_ASL_CAMERA);
 EEEPC_CREATE_DEVICE_ATTR(cardr, CM_ASL_CARDREADER);
 EEEPC_CREATE_DEVICE_ATTR(disp, CM_ASL_DISPLAYSWITCH);
+EEEPC_CREATE_DEVICE_ATTR(cpufv, CM_ASL_CPUFV);
 
 static struct attribute *platform_attributes[] = {
         &dev_attr_camera.attr,
         &dev_attr_cardr.attr,
         &dev_attr_disp.attr,
+        &dev_attr_cpufv.attr,
         NULL
 };
 
@@ -512,15 +517,21 @@ static int eeepc_hotk_check(void)
         return 0;
 }
 
-static void notify_brn(void)
+static int notify_brn(void)
 {
+        /* returns the *previous* brightness, or -1 */
         struct backlight_device *bd = eeepc_backlight_device;
-        if (bd)
+        if (bd) {
+                int old = bd->props.brightness;
                 bd->props.brightness = read_brightness(bd);
+                return old;
+        }
+        return -1;
 }
 
 static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
 {
+        enum rfkill_state state;
         struct pci_dev *dev;
         struct pci_bus *bus = pci_find_bus(0, 1);
 
@@ -532,7 +543,9 @@ static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
                 return;
         }
 
-        if (get_acpi(CM_ASL_WLAN) == 1) {
+        eeepc_wlan_rfkill_state(ehotk->eeepc_wlan_rfkill, &state);
+
+        if (state == RFKILL_STATE_UNBLOCKED) {
                 dev = pci_get_slot(bus, 0);
                 if (dev) {
                         /* Device already present */
@@ -552,23 +565,41 @@ static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
                         pci_dev_put(dev);
                 }
         }
+
+        rfkill_force_state(ehotk->eeepc_wlan_rfkill, state);
 }
 
 static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
 {
         static struct key_entry *key;
         u16 count;
+        int brn = -ENODEV;
 
         if (!ehotk)
                 return;
         if (event >= NOTIFY_BRN_MIN && event <= NOTIFY_BRN_MAX)
-                notify_brn();
+                brn = notify_brn();
         count = ehotk->event_count[event % 128]++;
         acpi_bus_generate_proc_event(ehotk->device, event, count);
         acpi_bus_generate_netlink_event(ehotk->device->pnp.device_class,
                                         dev_name(&ehotk->device->dev), event,
                                         count);
         if (ehotk->inputdev) {
+                if (brn != -ENODEV) {
+                        /* brightness-change events need special
+                         * handling for conversion to key events
+                         */
+                        if (brn < 0)
+                                brn = event;
+                        else
+                                brn += NOTIFY_BRN_MIN;
+                        if (event < brn)
+                                event = NOTIFY_BRN_MIN; /* brightness down */
+                        else if (event > brn)
+                                event = NOTIFY_BRN_MIN + 2; /* ... up */
+                        else
+                                event = NOTIFY_BRN_MIN + 1; /* ... unchanged */
+                }
                 key = eepc_get_entry_by_scancode(event);
                 if (key) {
                         switch (key->type) {
@@ -649,6 +680,9 @@ static int eeepc_hotk_add(struct acpi_device *device)
         if (ACPI_FAILURE(status))
                 printk(EEEPC_ERR "Error installing notify handler\n");
 
+        eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P6");
+        eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P7");
+
         if (get_acpi(CM_ASL_WLAN) != -1) {
                 ehotk->eeepc_wlan_rfkill = rfkill_allocate(&device->dev,
                                                            RFKILL_TYPE_WLAN);
@@ -704,9 +738,6 @@ static int eeepc_hotk_add(struct acpi_device *device)
                         goto bluetooth_fail;
         }
 
-        eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P6");
-        eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P7");
-
         return 0;
 
  bluetooth_fail:
@@ -717,6 +748,8 @@ static int eeepc_hotk_add(struct acpi_device *device)
  wlan_fail:
         if (ehotk->eeepc_wlan_rfkill)
                 rfkill_free(ehotk->eeepc_wlan_rfkill);
+        eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P6");
+        eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P7");
  ehotk_fail:
         kfree(ehotk);
         ehotk = NULL;
diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
index 9a3a682c698..9496494f340 100644
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -110,11 +110,9 @@ static int pnpacpi_disable_resources(struct pnp_dev *dev)
 
         /* acpi_unregister_gsi(pnp_irq(dev, 0)); */
         ret = 0;
-        if (acpi_bus_power_manageable(handle)) {
-                ret = acpi_bus_set_power(handle, ACPI_STATE_D3);
-                if (ret)
-                        return ret;
-        }
+        if (acpi_bus_power_manageable(handle))
+                acpi_bus_set_power(handle, ACPI_STATE_D3);
+                /* continue even if acpi_bus_set_power() fails */
         if (ACPI_FAILURE(acpi_evaluate_object(handle, "_DIS", NULL, NULL)))
                 ret = -ENODEV;
         return ret;
diff --git a/drivers/regulator/da903x.c b/drivers/regulator/da903x.c
index 72b15495183..c6628f5a0af 100644
--- a/drivers/regulator/da903x.c
+++ b/drivers/regulator/da903x.c
@@ -497,7 +497,7 @@ static struct platform_driver da903x_regulator_driver = {
                 .owner  = THIS_MODULE,
         },
         .probe          = da903x_regulator_probe,
-        .remove         = da903x_regulator_remove,
+        .remove         = __devexit_p(da903x_regulator_remove),
 };
 
 static int __init da903x_regulator_init(void)
diff --git a/drivers/rtc/rtc-pl030.c b/drivers/rtc/rtc-pl030.c
index 82615355215..aaf1f75fa29 100644
--- a/drivers/rtc/rtc-pl030.c
+++ b/drivers/rtc/rtc-pl030.c
@@ -102,7 +102,7 @@ static const struct rtc_class_ops pl030_ops = {
         .set_alarm      = pl030_set_alarm,
 };
 
-static int pl030_probe(struct amba_device *dev, void *id)
+static int pl030_probe(struct amba_device *dev, struct amba_id *id)
 {
         struct pl030_rtc *rtc;
         int ret;
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index 333eec689d2..451fc13784d 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -127,7 +127,7 @@ static int pl031_remove(struct amba_device *adev)
         return 0;
 }
 
-static int pl031_probe(struct amba_device *adev, void *id)
+static int pl031_probe(struct amba_device *adev, struct amba_id *id)
 {
         int ret;
         struct pl031_local *ldata;
diff --git a/drivers/rtc/rtc-twl4030.c b/drivers/rtc/rtc-twl4030.c
index a6341e4f9a0..9c8c70c497d 100644
--- a/drivers/rtc/rtc-twl4030.c
+++ b/drivers/rtc/rtc-twl4030.c
@@ -495,9 +495,7 @@ static int twl4030_rtc_suspend(struct platform_device *pdev, pm_message_t state)
 {
         irqstat = rtc_irq_bits;
 
-        /* REVISIT alarm may need to wake us from sleep */
-        mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M |
-                         BIT_RTC_INTERRUPTS_REG_IT_ALARM_M);
+        mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M);
         return 0;
 }
 
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index 8b7983aba8f..36c21b19e5d 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -1978,7 +1978,8 @@ static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
 {
         struct scsi_cmnd *cmd = tw_dev->srb[request_id];
 
-        scsi_dma_unmap(cmd);
+        if (cmd->SCp.phase == TW_PHASE_SGLIST)
+                scsi_dma_unmap(cmd);
 } /* End twa_unmap_scsi_data() */
 
 /* scsi_host_template initializer */
diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index c03f1d2c9e2..faa0fcfed71 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -6,7 +6,7 @@
                      Arnaldo Carvalho de Melo <acme@conectiva.com.br>
                      Brad Strand <linux@3ware.com>
 
-   Copyright (C) 1999-2007 3ware Inc.
+   Copyright (C) 1999-2009 3ware Inc.
 
    Kernel compatiblity By:      Andre Hedrick <andre@suse.com>
    Non-Copyright (C) 2000       Andre Hedrick <andre@suse.com>
@@ -1294,7 +1294,8 @@ static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
 {
         dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n");
 
-        scsi_dma_unmap(cmd);
+        if (cmd->SCp.phase == TW_PHASE_SGLIST)
+                scsi_dma_unmap(cmd);
 } /* End tw_unmap_scsi_data() */
 
 /* This function will reset a device extension */
diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
index 8e71e5e122b..a5a2ba2561d 100644
--- a/drivers/scsi/3w-xxxx.h
+++ b/drivers/scsi/3w-xxxx.h
@@ -6,7 +6,7 @@
                      Arnaldo Carvalho de Melo <acme@conectiva.com.br>
                      Brad Strand <linux@3ware.com>
 
-   Copyright (C) 1999-2007 3ware Inc.
+   Copyright (C) 1999-2009 3ware Inc.
 
    Kernel compatiblity By:      Andre Hedrick <andre@suse.com>
    Non-Copyright (C) 2000       Andre Hedrick <andre@suse.com>
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 8ed2990c826..fb2740789b6 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -628,6 +628,17 @@ config FCOE
         ---help---
           Fibre Channel over Ethernet module
 
+config FCOE_FNIC
+        tristate "Cisco FNIC Driver"
+        depends on PCI && X86
+        select LIBFC
+        help
+          This is support for the Cisco PCI-Express FCoE HBA.
+
+          To compile this driver as a module, choose M here and read
+          <file:Documentation/scsi/scsi.txt>.
+          The module will be called fnic.
+
 config SCSI_DMX3191D
         tristate "DMX3191D SCSI support"
         depends on PCI && SCSI
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index e7c861ac417..a5049cfb40e 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -39,6 +39,7 @@ obj-$(CONFIG_SCSI_DH)		+= device_handler/
 obj-$(CONFIG_LIBFC)             += libfc/
 obj-$(CONFIG_LIBFCOE)           += fcoe/
 obj-$(CONFIG_FCOE)              += fcoe/
+obj-$(CONFIG_FCOE_FNIC)         += fnic/
 obj-$(CONFIG_ISCSI_TCP)         += libiscsi.o   libiscsi_tcp.o iscsi_tcp.o
 obj-$(CONFIG_INFINIBAND_ISER)   += libiscsi.o
 obj-$(CONFIG_SCSI_A4000T)       += 53c700.o     a4000t.o
diff --git a/drivers/scsi/fnic/Makefile b/drivers/scsi/fnic/Makefile
new file mode 100644
index 00000000000..37c3440bc17
--- /dev/null
+++ b/drivers/scsi/fnic/Makefile
@@ -0,0 +1,15 @@
+obj-$(CONFIG_FCOE_FNIC) += fnic.o
+
+fnic-y  := \
+        fnic_attrs.o \
+        fnic_isr.o \
+        fnic_main.o \
+        fnic_res.o \
+        fnic_fcs.o \
+        fnic_scsi.o \
+        vnic_cq.o \
+        vnic_dev.o \
+        vnic_intr.o \
+        vnic_rq.o \
+        vnic_wq_copy.o \
+        vnic_wq.o
diff --git a/drivers/scsi/fnic/cq_desc.h b/drivers/scsi/fnic/cq_desc.h
new file mode 100644
index 00000000000..d1225cf6320
--- /dev/null
+++ b/drivers/scsi/fnic/cq_desc.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _CQ_DESC_H_
+#define _CQ_DESC_H_
+
+/*
+ * Completion queue descriptor types
+ */
+enum cq_desc_types {
+        CQ_DESC_TYPE_WQ_ENET = 0,
+        CQ_DESC_TYPE_DESC_COPY = 1,
+        CQ_DESC_TYPE_WQ_EXCH = 2,
+        CQ_DESC_TYPE_RQ_ENET = 3,
+        CQ_DESC_TYPE_RQ_FCP = 4,
+};
+
+/* Completion queue descriptor: 16B
+ *
+ * All completion queues have this basic layout.  The
+ * type_specfic area is unique for each completion
+ * queue type.
+ */
+struct cq_desc {
+        __le16 completed_index;
+        __le16 q_number;
+        u8 type_specfic[11];
+        u8 type_color;
+};
+
+#define CQ_DESC_TYPE_BITS        4
+#define CQ_DESC_TYPE_MASK        ((1 << CQ_DESC_TYPE_BITS) - 1)
+#define CQ_DESC_COLOR_MASK       1
+#define CQ_DESC_COLOR_SHIFT      7
+#define CQ_DESC_Q_NUM_BITS       10
+#define CQ_DESC_Q_NUM_MASK       ((1 << CQ_DESC_Q_NUM_BITS) - 1)
+#define CQ_DESC_COMP_NDX_BITS    12
+#define CQ_DESC_COMP_NDX_MASK    ((1 << CQ_DESC_COMP_NDX_BITS) - 1)
+
+static inline void cq_desc_dec(const struct cq_desc *desc_arg,
+        u8 *type, u8 *color, u16 *q_number, u16 *completed_index)
+{
+        const struct cq_desc *desc = desc_arg;
+        const u8 type_color = desc->type_color;
+
+        *color = (type_color >> CQ_DESC_COLOR_SHIFT) & CQ_DESC_COLOR_MASK;
+
+        /*
+         * Make sure color bit is read from desc *before* other fields
+         * are read from desc.  Hardware guarantees color bit is last
+         * bit (byte) written.  Adding the rmb() prevents the compiler
+         * and/or CPU from reordering the reads which would potentially
+         * result in reading stale values.
+         */
+
+        rmb();
+
+        *type = type_color & CQ_DESC_TYPE_MASK;
+        *q_number = le16_to_cpu(desc->q_number) & CQ_DESC_Q_NUM_MASK;
+        *completed_index = le16_to_cpu(desc->completed_index) &
+                CQ_DESC_COMP_NDX_MASK;
+}
+
+#endif /* _CQ_DESC_H_ */
diff --git a/drivers/scsi/fnic/cq_enet_desc.h b/drivers/scsi/fnic/cq_enet_desc.h
new file mode 100644
index 00000000000..a9fa26f82dd
--- /dev/null
+++ b/drivers/scsi/fnic/cq_enet_desc.h
@@ -0,0 +1,167 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _CQ_ENET_DESC_H_
+#define _CQ_ENET_DESC_H_
+
+#include "cq_desc.h"
+
+/* Ethernet completion queue descriptor: 16B */
+struct cq_enet_wq_desc {
+        __le16 completed_index;
+        __le16 q_number;
+        u8 reserved[11];
+        u8 type_color;
+};
+
+static inline void cq_enet_wq_desc_dec(struct cq_enet_wq_desc *desc,
+        u8 *type, u8 *color, u16 *q_number, u16 *completed_index)
+{
+        cq_desc_dec((struct cq_desc *)desc, type,
+                color, q_number, completed_index);
+}
+
+/* Completion queue descriptor: Ethernet receive queue, 16B */
+struct cq_enet_rq_desc {
+        __le16 completed_index_flags;
+        __le16 q_number_rss_type_flags;
+        __le32 rss_hash;
+        __le16 bytes_written_flags;
+        __le16 vlan;
+        __le16 checksum_fcoe;
+        u8 flags;
+        u8 type_color;
+};
+
+#define CQ_ENET_RQ_DESC_FLAGS_INGRESS_PORT          (0x1 << 12)
+#define CQ_ENET_RQ_DESC_FLAGS_FCOE                  (0x1 << 13)
+#define CQ_ENET_RQ_DESC_FLAGS_EOP                   (0x1 << 14)
+#define CQ_ENET_RQ_DESC_FLAGS_SOP                   (0x1 << 15)
+
+#define CQ_ENET_RQ_DESC_RSS_TYPE_BITS               4
+#define CQ_ENET_RQ_DESC_RSS_TYPE_MASK \
+        ((1 << CQ_ENET_RQ_DESC_RSS_TYPE_BITS) - 1)
+#define CQ_ENET_RQ_DESC_RSS_TYPE_NONE               0
+#define CQ_ENET_RQ_DESC_RSS_TYPE_IPv4               1
+#define CQ_ENET_RQ_DESC_RSS_TYPE_TCP_IPv4           2
+#define CQ_ENET_RQ_DESC_RSS_TYPE_IPv6               3
+#define CQ_ENET_RQ_DESC_RSS_TYPE_TCP_IPv6           4
+#define CQ_ENET_RQ_DESC_RSS_TYPE_IPv6_EX            5
+#define CQ_ENET_RQ_DESC_RSS_TYPE_TCP_IPv6_EX        6
+
+#define CQ_ENET_RQ_DESC_FLAGS_CSUM_NOT_CALC         (0x1 << 14)
+
+#define CQ_ENET_RQ_DESC_BYTES_WRITTEN_BITS          14
+#define CQ_ENET_RQ_DESC_BYTES_WRITTEN_MASK \
+        ((1 << CQ_ENET_RQ_DESC_BYTES_WRITTEN_BITS) - 1)
+#define CQ_ENET_RQ_DESC_FLAGS_TRUNCATED             (0x1 << 14)
+#define CQ_ENET_RQ_DESC_FLAGS_VLAN_STRIPPED         (0x1 << 15)
+
+#define CQ_ENET_RQ_DESC_FCOE_SOF_BITS               4
+#define CQ_ENET_RQ_DESC_FCOE_SOF_MASK \
+        ((1 << CQ_ENET_RQ_DESC_FCOE_SOF_BITS) - 1)
+#define CQ_ENET_RQ_DESC_FCOE_EOF_BITS               8
+#define CQ_ENET_RQ_DESC_FCOE_EOF_MASK \
+        ((1 << CQ_ENET_RQ_DESC_FCOE_EOF_BITS) - 1)
+#define CQ_ENET_RQ_DESC_FCOE_EOF_SHIFT              8
+
+#define CQ_ENET_RQ_DESC_FLAGS_TCP_UDP_CSUM_OK       (0x1 << 0)
+#define CQ_ENET_RQ_DESC_FCOE_FC_CRC_OK              (0x1 << 0)
+#define CQ_ENET_RQ_DESC_FLAGS_UDP                   (0x1 << 1)
+#define CQ_ENET_RQ_DESC_FCOE_ENC_ERROR              (0x1 << 1)
+#define CQ_ENET_RQ_DESC_FLAGS_TCP                   (0x1 << 2)
+#define CQ_ENET_RQ_DESC_FLAGS_IPV4_CSUM_OK          (0x1 << 3)
+#define CQ_ENET_RQ_DESC_FLAGS_IPV6                  (0x1 << 4)
+#define CQ_ENET_RQ_DESC_FLAGS_IPV4                  (0x1 << 5)
+#define CQ_ENET_RQ_DESC_FLAGS_IPV4_FRAGMENT         (0x1 << 6)
+#define CQ_ENET_RQ_DESC_FLAGS_FCS_OK                (0x1 << 7)
+
+static inline void cq_enet_rq_desc_dec(struct cq_enet_rq_desc *desc,
+        u8 *type, u8 *color, u16 *q_number, u16 *completed_index,
+        u8 *ingress_port, u8 *fcoe, u8 *eop, u8 *sop, u8 *rss_type,
+        u8 *csum_not_calc, u32 *rss_hash, u16 *bytes_written, u8 *packet_error,
+        u8 *vlan_stripped, u16 *vlan, u16 *checksum, u8 *fcoe_sof,
+        u8 *fcoe_fc_crc_ok, u8 *fcoe_enc_error, u8 *fcoe_eof,
+        u8 *tcp_udp_csum_ok, u8 *udp, u8 *tcp, u8 *ipv4_csum_ok,
+        u8 *ipv6, u8 *ipv4, u8 *ipv4_fragment, u8 *fcs_ok)
+{
+        u16 completed_index_flags = le16_to_cpu(desc->completed_index_flags);
+        u16 q_number_rss_type_flags =
+                le16_to_cpu(desc->q_number_rss_type_flags);
+        u16 bytes_written_flags = le16_to_cpu(desc->bytes_written_flags);
+
+        cq_desc_dec((struct cq_desc *)desc, type,
+                color, q_number, completed_index);
+
+        *ingress_port = (completed_index_flags &
+                CQ_ENET_RQ_DESC_FLAGS_INGRESS_PORT) ? 1 : 0;
+        *fcoe = (completed_index_flags & CQ_ENET_RQ_DESC_FLAGS_FCOE) ?
+                1 : 0;
+        *eop = (completed_index_flags & CQ_ENET_RQ_DESC_FLAGS_EOP) ?
+                1 : 0;
+        *sop = (completed_index_flags & CQ_ENET_RQ_DESC_FLAGS_SOP) ?
+                1 : 0;
+
+        *rss_type = (u8)((q_number_rss_type_flags >> CQ_DESC_Q_NUM_BITS) &
+                CQ_ENET_RQ_DESC_RSS_TYPE_MASK);
+        *csum_not_calc = (q_number_rss_type_flags &
+                CQ_ENET_RQ_DESC_FLAGS_CSUM_NOT_CALC) ? 1 : 0;
+
+        *rss_hash = le32_to_cpu(desc->rss_hash);
+
+        *bytes_written = bytes_written_flags &
+                CQ_ENET_RQ_DESC_BYTES_WRITTEN_MASK;
+        *packet_error = (bytes_written_flags &
+                CQ_ENET_RQ_DESC_FLAGS_TRUNCATED) ? 1 : 0;
+        *vlan_stripped = (bytes_written_flags &
+                CQ_ENET_RQ_DESC_FLAGS_VLAN_STRIPPED) ? 1 : 0;
+
+        *vlan = le16_to_cpu(desc->vlan);
+
+        if (*fcoe) {
+                *fcoe_sof = (u8)(le16_to_cpu(desc->checksum_fcoe) &
+                        CQ_ENET_RQ_DESC_FCOE_SOF_MASK);
+                *fcoe_fc_crc_ok = (desc->flags &
+                        CQ_ENET_RQ_DESC_FCOE_FC_CRC_OK) ? 1 : 0;
+                *fcoe_enc_error = (desc->flags &
+                        CQ_ENET_RQ_DESC_FCOE_ENC_ERROR) ? 1 : 0;
+                *fcoe_eof = (u8)((desc->checksum_fcoe >>
+                        CQ_ENET_RQ_DESC_FCOE_EOF_SHIFT) &
+                        CQ_ENET_RQ_DESC_FCOE_EOF_MASK);
+                *checksum = 0;
+        } else {
+                *fcoe_sof = 0;
+                *fcoe_fc_crc_ok = 0;
+                *fcoe_enc_error = 0;
+                *fcoe_eof = 0;
+                *checksum = le16_to_cpu(desc->checksum_fcoe);
+        }
+
+        *tcp_udp_csum_ok =
+                (desc->flags & CQ_ENET_RQ_DESC_FLAGS_TCP_UDP_CSUM_OK) ? 1 : 0;
+        *udp = (desc->flags & CQ_ENET_RQ_DESC_FLAGS_UDP) ? 1 : 0;
+        *tcp = (desc->flags & CQ_ENET_RQ_DESC_FLAGS_TCP) ? 1 : 0;
+        *ipv4_csum_ok =
+                (desc->flags & CQ_ENET_RQ_DESC_FLAGS_IPV4_CSUM_OK) ? 1 : 0;
+        *ipv6 = (desc->flags & CQ_ENET_RQ_DESC_FLAGS_IPV6) ? 1 : 0;
+        *ipv4 = (desc->flags & CQ_ENET_RQ_DESC_FLAGS_IPV4) ? 1 : 0;
+        *ipv4_fragment =
+                (desc->flags & CQ_ENET_RQ_DESC_FLAGS_IPV4_FRAGMENT) ? 1 : 0;
+        *fcs_ok = (desc->flags & CQ_ENET_RQ_DESC_FLAGS_FCS_OK) ? 1 : 0;
+}
+
+#endif /* _CQ_ENET_DESC_H_ */
diff --git a/drivers/scsi/fnic/cq_exch_desc.h b/drivers/scsi/fnic/cq_exch_desc.h
new file mode 100644
index 00000000000..501660cfe22
--- /dev/null
+++ b/drivers/scsi/fnic/cq_exch_desc.h
@@ -0,0 +1,182 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _CQ_EXCH_DESC_H_
+#define _CQ_EXCH_DESC_H_
+
+#include "cq_desc.h"
+
+/* Exchange completion queue descriptor: 16B */
+struct cq_exch_wq_desc {
+        u16 completed_index;
+        u16 q_number;
+        u16 exchange_id;
+        u8  tmpl;
+        u8  reserved0;
+        u32 reserved1;
+        u8  exch_status;
+        u8  reserved2[2];
+        u8  type_color;
+};
+
+#define CQ_EXCH_WQ_STATUS_BITS      2
+#define CQ_EXCH_WQ_STATUS_MASK      ((1 << CQ_EXCH_WQ_STATUS_BITS) - 1)
+
+enum cq_exch_status_types {
+        CQ_EXCH_WQ_STATUS_TYPE_COMPLETE = 0,
+        CQ_EXCH_WQ_STATUS_TYPE_ABORT = 1,
+        CQ_EXCH_WQ_STATUS_TYPE_SGL_EOF = 2,
+        CQ_EXCH_WQ_STATUS_TYPE_TMPL_ERR = 3,
+};
+
+static inline void cq_exch_wq_desc_dec(struct cq_exch_wq_desc *desc_ptr,
+                                       u8  *type,
+                                       u8  *color,
+                                       u16 *q_number,
+                                       u16 *completed_index,
+                                       u8  *exch_status)
+{
+        cq_desc_dec((struct cq_desc *)desc_ptr, type,
+                    color, q_number, completed_index);
+        *exch_status = desc_ptr->exch_status & CQ_EXCH_WQ_STATUS_MASK;
+}
+
+struct cq_fcp_rq_desc {
+        u16 completed_index_eop_sop_prt;
+        u16 q_number;
+        u16 exchange_id;
+        u16 tmpl;
+        u16 bytes_written;
+        u16 vlan;
+        u8  sof;
+        u8  eof;
+        u8  fcs_fer_fck;
+        u8  type_color;
+};
+
+#define CQ_FCP_RQ_DESC_FLAGS_SOP                (1 << 15)
+#define CQ_FCP_RQ_DESC_FLAGS_EOP                (1 << 14)
+#define CQ_FCP_RQ_DESC_FLAGS_PRT                (1 << 12)
+#define CQ_FCP_RQ_DESC_TMPL_MASK                0x1f
+#define CQ_FCP_RQ_DESC_BYTES_WRITTEN_MASK       0x3fff
+#define CQ_FCP_RQ_DESC_PACKET_ERR_SHIFT         14
+#define CQ_FCP_RQ_DESC_PACKET_ERR_MASK (1 << CQ_FCP_RQ_DESC_PACKET_ERR_SHIFT)
+#define CQ_FCP_RQ_DESC_VS_STRIPPED_SHIFT        15
+#define CQ_FCP_RQ_DESC_VS_STRIPPED_MASK (1 << CQ_FCP_RQ_DESC_VS_STRIPPED_SHIFT)
+#define CQ_FCP_RQ_DESC_FC_CRC_OK_MASK           0x1
+#define CQ_FCP_RQ_DESC_FCOE_ERR_SHIFT           1
+#define CQ_FCP_RQ_DESC_FCOE_ERR_MASK (1 << CQ_FCP_RQ_DESC_FCOE_ERR_SHIFT)
+#define CQ_FCP_RQ_DESC_FCS_OK_SHIFT             7
+#define CQ_FCP_RQ_DESC_FCS_OK_MASK (1 << CQ_FCP_RQ_DESC_FCS_OK_SHIFT)
+
+static inline void cq_fcp_rq_desc_dec(struct cq_fcp_rq_desc *desc_ptr,
+                                      u8  *type,
+                                      u8  *color,
+                                      u16 *q_number,
+                                      u16 *completed_index,
+                                      u8  *eop,
+                                      u8  *sop,
+                                      u8  *fck,
+                                      u16 *exchange_id,
+                                      u16 *tmpl,
+                                      u32 *bytes_written,
+                                      u8  *sof,
+                                      u8  *eof,
+                                      u8  *ingress_port,
+                                      u8  *packet_err,
+                                      u8  *fcoe_err,
+                                      u8  *fcs_ok,
+                                      u8  *vlan_stripped,
+                                      u16 *vlan)
+{
+        cq_desc_dec((struct cq_desc *)desc_ptr, type,
+                    color, q_number, completed_index);
+        *eop = (desc_ptr->completed_index_eop_sop_prt &
+                CQ_FCP_RQ_DESC_FLAGS_EOP) ? 1 : 0;
+        *sop = (desc_ptr->completed_index_eop_sop_prt &
+                CQ_FCP_RQ_DESC_FLAGS_SOP) ? 1 : 0;
+        *ingress_port =
+                (desc_ptr->completed_index_eop_sop_prt &
+                 CQ_FCP_RQ_DESC_FLAGS_PRT) ? 1 : 0;
+        *exchange_id = desc_ptr->exchange_id;
+        *tmpl = desc_ptr->tmpl & CQ_FCP_RQ_DESC_TMPL_MASK;
+        *bytes_written =
+                desc_ptr->bytes_written & CQ_FCP_RQ_DESC_BYTES_WRITTEN_MASK;
+        *packet_err =
+                (desc_ptr->bytes_written & CQ_FCP_RQ_DESC_PACKET_ERR_MASK) >>
+                CQ_FCP_RQ_DESC_PACKET_ERR_SHIFT;
+        *vlan_stripped =
+                (desc_ptr->bytes_written & CQ_FCP_RQ_DESC_VS_STRIPPED_MASK) >>
+                CQ_FCP_RQ_DESC_VS_STRIPPED_SHIFT;
+        *vlan = desc_ptr->vlan;
+        *sof = desc_ptr->sof;
+        *fck = desc_ptr->fcs_fer_fck & CQ_FCP_RQ_DESC_FC_CRC_OK_MASK;
+        *fcoe_err = (desc_ptr->fcs_fer_fck & CQ_FCP_RQ_DESC_FCOE_ERR_MASK) >>
+                CQ_FCP_RQ_DESC_FCOE_ERR_SHIFT;
+        *eof = desc_ptr->eof;
+        *fcs_ok =
+                (desc_ptr->fcs_fer_fck & CQ_FCP_RQ_DESC_FCS_OK_MASK) >>
+                CQ_FCP_RQ_DESC_FCS_OK_SHIFT;
+}
+
+struct cq_sgl_desc {
+        u16 exchange_id;
+        u16 q_number;
+        u32 active_burst_offset;
+        u32 tot_data_bytes;
+        u16 tmpl;
+        u8  sgl_err;
+        u8  type_color;
+};
+
+enum cq_sgl_err_types {
+        CQ_SGL_ERR_NO_ERROR = 0,
+        CQ_SGL_ERR_OVERFLOW,         /* data ran beyond end of SGL */
+        CQ_SGL_ERR_SGL_LCL_ADDR_ERR, /* sgl access to local vnic addr illegal*/
+        CQ_SGL_ERR_ADDR_RSP_ERR,     /* sgl address error */
+        CQ_SGL_ERR_DATA_RSP_ERR,     /* sgl data rsp error */
+        CQ_SGL_ERR_CNT_ZERO_ERR,     /* SGL count is 0 */
+        CQ_SGL_ERR_CNT_MAX_ERR,      /* SGL count is larger than supported */
+        CQ_SGL_ERR_ORDER_ERR,        /* frames recv on both ports, order err */
+        CQ_SGL_ERR_DATA_LCL_ADDR_ERR,/* sgl data buf to local vnic addr ill */
+        CQ_SGL_ERR_HOST_CQ_ERR,      /* host cq entry to local vnic addr ill */
+};
+
+#define CQ_SGL_SGL_ERR_MASK             0x1f
+#define CQ_SGL_TMPL_MASK                0x1f
+
+static inline void cq_sgl_desc_dec(struct cq_sgl_desc *desc_ptr,
+                                   u8  *type,
+                                   u8  *color,
+                                   u16 *q_number,
+                                   u16 *exchange_id,
+                                   u32 *active_burst_offset,
+                                   u32 *tot_data_bytes,
+                                   u16 *tmpl,
+                                   u8  *sgl_err)
+{
+        /* Cheat a little by assuming exchange_id is the same as completed
+           index */
+        cq_desc_dec((struct cq_desc *)desc_ptr, type, color, q_number,
+                    exchange_id);
+        *active_burst_offset = desc_ptr->active_burst_offset;
+        *tot_data_bytes = desc_ptr->tot_data_bytes;
+        *tmpl = desc_ptr->tmpl & CQ_SGL_TMPL_MASK;
+        *sgl_err = desc_ptr->sgl_err & CQ_SGL_SGL_ERR_MASK;
+}
+
+#endif /* _CQ_EXCH_DESC_H_ */
diff --git a/drivers/scsi/fnic/fcpio.h b/drivers/scsi/fnic/fcpio.h
new file mode 100644
index 00000000000..12d770d885c
--- /dev/null
+++ b/drivers/scsi/fnic/fcpio.h
@@ -0,0 +1,780 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _FCPIO_H_
+#define _FCPIO_H_
+
+#include <linux/if_ether.h>
+
+/*
+ * This header file includes all of the data structures used for
+ * communication by the host driver to the fcp firmware.
+ */
+
+/*
+ * Exchange and sequence id space allocated to the host driver
+ */
+#define FCPIO_HOST_EXCH_RANGE_START         0x1000
+#define FCPIO_HOST_EXCH_RANGE_END           0x1fff
+#define FCPIO_HOST_SEQ_ID_RANGE_START       0x80
+#define FCPIO_HOST_SEQ_ID_RANGE_END         0xff
+
+/*
+ * Command entry type
+ */
+enum fcpio_type {
+        /*
+         * Initiator request types
+         */
+        FCPIO_ICMND_16 = 0x1,
+        FCPIO_ICMND_32,
+        FCPIO_ICMND_CMPL,
+        FCPIO_ITMF,
+        FCPIO_ITMF_CMPL,
+
+        /*
+         * Target request types
+         */
+        FCPIO_TCMND_16 = 0x11,
+        FCPIO_TCMND_32,
+        FCPIO_TDATA,
+        FCPIO_TXRDY,
+        FCPIO_TRSP,
+        FCPIO_TDRSP_CMPL,
+        FCPIO_TTMF,
+        FCPIO_TTMF_ACK,
+        FCPIO_TABORT,
+        FCPIO_TABORT_CMPL,
+
+        /*
+         * Misc request types
+         */
+        FCPIO_ACK = 0x20,
+        FCPIO_RESET,
+        FCPIO_RESET_CMPL,
+        FCPIO_FLOGI_REG,
+        FCPIO_FLOGI_REG_CMPL,
+        FCPIO_ECHO,
+        FCPIO_ECHO_CMPL,
+        FCPIO_LUNMAP_CHNG,
+        FCPIO_LUNMAP_REQ,
+        FCPIO_LUNMAP_REQ_CMPL,
+        FCPIO_FLOGI_FIP_REG,
+        FCPIO_FLOGI_FIP_REG_CMPL,
+};
+
+/*
+ * Header status codes from the firmware
+ */
+enum fcpio_status {
+        FCPIO_SUCCESS = 0,              /* request was successful */
+
+        /*
+         * If a request to the firmware is rejected, the original request
+         * header will be returned with the status set to one of the following:
+         */
+        FCPIO_INVALID_HEADER,    /* header contains invalid data */
+        FCPIO_OUT_OF_RESOURCE,   /* out of resources to complete request */
+        FCPIO_INVALID_PARAM,     /* some parameter in request is invalid */
+        FCPIO_REQ_NOT_SUPPORTED, /* request type is not supported */
+        FCPIO_IO_NOT_FOUND,      /* requested I/O was not found */
+
+        /*
+         * Once a request is processed, the firmware will usually return
+         * a cmpl message type.  In cases where errors occurred,
+         * the header status field would be filled in with one of the following:
+         */
+        FCPIO_ABORTED = 0x41,     /* request was aborted */
+        FCPIO_TIMEOUT,            /* request was timed out */
+        FCPIO_SGL_INVALID,        /* request was aborted due to sgl error */
+        FCPIO_MSS_INVALID,        /* request was aborted due to mss error */
+        FCPIO_DATA_CNT_MISMATCH,  /* recv/sent more/less data than exp. */
+        FCPIO_FW_ERR,             /* request was terminated due to fw error */
+        FCPIO_ITMF_REJECTED,      /* itmf req was rejected by remote node */
+        FCPIO_ITMF_FAILED,        /* itmf req was failed by remote node */
+        FCPIO_ITMF_INCORRECT_LUN, /* itmf req targeted incorrect LUN */
+        FCPIO_CMND_REJECTED,      /* request was invalid and rejected */
+        FCPIO_NO_PATH_AVAIL,      /* no paths to the lun was available */
+        FCPIO_PATH_FAILED,        /* i/o sent to current path failed */
+        FCPIO_LUNMAP_CHNG_PEND,   /* i/o rejected due to lunmap change */
+};
+
+/*
+ * The header command tag.  All host requests will use the "tag" field
+ * to mark commands with a unique tag.  When the firmware responds to
+ * a host request, it will copy the tag field into the response.
+ *
+ * The only firmware requests that will use the rx_id/ox_id fields instead
+ * of the tag field will be the target command and target task management
+ * requests.  These two requests do not have corresponding host requests
+ * since they come directly from the FC initiator on the network.
+ */
+struct fcpio_tag {
+        union {
+                u32 req_id;
+                struct {
+                        u16 rx_id;
+                        u16 ox_id;
+                } ex_id;
+        } u;
+};
+
+static inline void
+fcpio_tag_id_enc(struct fcpio_tag *tag, u32 id)
+{
+        tag->u.req_id = id;
+}
+
+static inline void
+fcpio_tag_id_dec(struct fcpio_tag *tag, u32 *id)
+{
+        *id = tag->u.req_id;
+}
+
+static inline void
+fcpio_tag_exid_enc(struct fcpio_tag *tag, u16 ox_id, u16 rx_id)
+{
+        tag->u.ex_id.rx_id = rx_id;
+        tag->u.ex_id.ox_id = ox_id;
+}
+
+static inline void
+fcpio_tag_exid_dec(struct fcpio_tag *tag, u16 *ox_id, u16 *rx_id)
+{
+        *rx_id = tag->u.ex_id.rx_id;
+        *ox_id = tag->u.ex_id.ox_id;
+}
+
+/*
+ * The header for an fcpio request, whether from the firmware or from the
+ * host driver
+ */
+struct fcpio_header {
+        u8            type;           /* enum fcpio_type */
+        u8            status;         /* header status entry */
+        u16           _resvd;         /* reserved */
+        struct fcpio_tag    tag;      /* header tag */
+};
+
+static inline void
+fcpio_header_enc(struct fcpio_header *hdr,
+                 u8 type, u8 status,
+                 struct fcpio_tag tag)
+{
+        hdr->type = type;
+        hdr->status = status;
+        hdr->_resvd = 0;
+        hdr->tag = tag;
+}
+
+static inline void
+fcpio_header_dec(struct fcpio_header *hdr,
+                 u8 *type, u8 *status,
+                 struct fcpio_tag *tag)
+{
+        *type = hdr->type;
+        *status = hdr->status;
+        *tag = hdr->tag;
+}
+
+#define CDB_16      16
+#define CDB_32      32
+#define LUN_ADDRESS 8
+
+/*
+ * fcpio_icmnd_16: host -> firmware request
+ *
+ * used for sending out an initiator SCSI 16-byte command
+ */
+struct fcpio_icmnd_16 {
+        u32       lunmap_id;            /* index into lunmap table */
+        u8        special_req_flags;    /* special exchange request flags */
+        u8        _resvd0[3];           /* reserved */
+        u32       sgl_cnt;              /* scatter-gather list count */
+        u32       sense_len;            /* sense buffer length */
+        u64       sgl_addr;             /* scatter-gather list addr */
+        u64       sense_addr;           /* sense buffer address */
+        u8        crn;                  /* SCSI Command Reference No. */
+        u8        pri_ta;               /* SCSI Priority and Task attribute */
+        u8        _resvd1;              /* reserved: should be 0 */
+        u8        flags;                /* command flags */
+        u8        scsi_cdb[CDB_16];     /* SCSI Cmnd Descriptor Block */
+        u32       data_len;             /* length of data expected */
+        u8        lun[LUN_ADDRESS];     /* FC vNIC only: LUN address */
+        u8        _resvd2;              /* reserved */
+        u8        d_id[3];              /* FC vNIC only: Target D_ID */
+        u16       mss;                  /* FC vNIC only: max burst */
+        u16       _resvd3;              /* reserved */
+        u32       r_a_tov;              /* FC vNIC only: Res. Alloc Timeout */
+        u32       e_d_tov;              /* FC vNIC only: Err Detect Timeout */
+};
+
+/*
+ * Special request flags
+ */
+#define FCPIO_ICMND_SRFLAG_RETRY 0x01   /* Enable Retry handling on exchange */
+
+/*
+ * Priority/Task Attribute settings
+ */
+#define FCPIO_ICMND_PTA_SIMPLE      0   /* simple task attribute */
+#define FCPIO_ICMND_PTA_HEADQ       1   /* head of queue task attribute */
+#define FCPIO_ICMND_PTA_ORDERED     2   /* ordered task attribute */
+#define FCPIO_ICMND_PTA_ACA         4   /* auto contingent allegiance */
+#define FCPIO_ICMND_PRI_SHIFT       3   /* priority field starts in bit 3 */
+
+/*
+ * Command flags
+ */
+#define FCPIO_ICMND_RDDATA      0x02    /* read data */
+#define FCPIO_ICMND_WRDATA      0x01    /* write data */
+
+/*
+ * fcpio_icmnd_32: host -> firmware request
+ *
+ * used for sending out an initiator SCSI 32-byte command
+ */
+struct fcpio_icmnd_32 {
+        u32   lunmap_id;              /* index into lunmap table */
+        u8    special_req_flags;      /* special exchange request flags */
+        u8    _resvd0[3];             /* reserved */
+        u32   sgl_cnt;                /* scatter-gather list count */
+        u32   sense_len;              /* sense buffer length */
+        u64   sgl_addr;               /* scatter-gather list addr */
+        u64   sense_addr;             /* sense buffer address */
+        u8    crn;                    /* SCSI Command Reference No. */
+        u8    pri_ta;                 /* SCSI Priority and Task attribute */
+        u8    _resvd1;                /* reserved: should be 0 */
+        u8    flags;                  /* command flags */
+        u8    scsi_cdb[CDB_32];       /* SCSI Cmnd Descriptor Block */
+        u32   data_len;               /* length of data expected */
+        u8    lun[LUN_ADDRESS];       /* FC vNIC only: LUN address */
+        u8    _resvd2;                /* reserved */
+        u8    d_id[3];                /* FC vNIC only: Target D_ID */
+        u16   mss;                    /* FC vNIC only: max burst */
+        u16   _resvd3;                /* reserved */
+        u32   r_a_tov;                /* FC vNIC only: Res. Alloc Timeout */
+        u32   e_d_tov;                /* FC vNIC only: Error Detect Timeout */
+};
+
+/*
+ * fcpio_itmf: host -> firmware request
+ *
+ * used for requesting the firmware to abort a request and/or send out
+ * a task management function
+ *
+ * The t_tag field is only needed when the request type is ABT_TASK.
+ */
+struct fcpio_itmf {
+        u32   lunmap_id;              /* index into lunmap table */
+        u32   tm_req;                 /* SCSI Task Management request */
+        u32   t_tag;                  /* header tag of fcpio to be aborted */
+        u32   _resvd;                 /* _reserved */
+        u8    lun[LUN_ADDRESS];       /* FC vNIC only: LUN address */
+        u8    _resvd1;                /* reserved */
+        u8    d_id[3];                /* FC vNIC only: Target D_ID */
+        u32   r_a_tov;                /* FC vNIC only: R_A_TOV in msec */
+        u32   e_d_tov;                /* FC vNIC only: E_D_TOV in msec */
+};
+
+/*
+ * Task Management request
+ */
+enum fcpio_itmf_tm_req_type {
+        FCPIO_ITMF_ABT_TASK_TERM = 0x01,    /* abort task and terminate */
+        FCPIO_ITMF_ABT_TASK,                /* abort task and issue abts */
+        FCPIO_ITMF_ABT_TASK_SET,            /* abort task set */
+        FCPIO_ITMF_CLR_TASK_SET,            /* clear task set */
+        FCPIO_ITMF_LUN_RESET,               /* logical unit reset task mgmt */
+        FCPIO_ITMF_CLR_ACA,                 /* Clear ACA condition */
+};
+
+/*
+ * fcpio_tdata: host -> firmware request
+ *
+ * used for requesting the firmware to send out a read data transfer for a
+ * target command
+ */
+struct fcpio_tdata {
+        u16   rx_id;                  /* FC rx_id of target command */
+        u16   flags;                  /* command flags */
+        u32   rel_offset;             /* data sequence relative offset */
+        u32   sgl_cnt;                /* scatter-gather list count */
+        u32   data_len;               /* length of data expected to send */
+        u64   sgl_addr;               /* scatter-gather list address */
+};
+
+/*
+ * Command flags
+ */
+#define FCPIO_TDATA_SCSI_RSP    0x01    /* send a scsi resp. after last frame */
+
+/*
+ * fcpio_txrdy: host -> firmware request
+ *
+ * used for requesting the firmware to send out a write data transfer for a
+ * target command
+ */
+struct fcpio_txrdy {
+        u16   rx_id;                  /* FC rx_id of target command */
+        u16   _resvd0;                /* reserved */
+        u32   rel_offset;             /* data sequence relative offset */
+        u32   sgl_cnt;                /* scatter-gather list count */
+        u32   data_len;               /* length of data expected to send */
+        u64   sgl_addr;               /* scatter-gather list address */
+};
+
+/*
+ * fcpio_trsp: host -> firmware request
+ *
+ * used for requesting the firmware to send out a response for a target
+ * command
+ */
+struct fcpio_trsp {
+        u16   rx_id;                  /* FC rx_id of target command */
+        u16   _resvd0;                /* reserved */
+        u32   sense_len;              /* sense data buffer length */
+        u64   sense_addr;             /* sense data buffer address */
+        u16   _resvd1;                /* reserved */
+        u8    flags;                  /* response request flags */
+        u8    scsi_status;            /* SCSI status */
+        u32   residual;               /* SCSI data residual value of I/O */
+};
+
+/*
+ * resposnse request flags
+ */
+#define FCPIO_TRSP_RESID_UNDER  0x08   /* residual is valid and is underflow */
+#define FCPIO_TRSP_RESID_OVER   0x04   /* residual is valid and is overflow */
+
+/*
+ * fcpio_ttmf_ack: host -> firmware response
+ *
+ * used by the host to indicate to the firmware it has received and processed
+ * the target tmf request
+ */
+struct fcpio_ttmf_ack {
+        u16   rx_id;                  /* FC rx_id of target command */
+        u16   _resvd0;                /* reserved */
+        u32   tmf_status;             /* SCSI task management status */
+};
+
+/*
+ * fcpio_tabort: host -> firmware request
+ *
+ * used by the host to request the firmware to abort a target request that was
+ * received by the firmware
+ */
+struct fcpio_tabort {
+        u16   rx_id;                  /* rx_id of the target request */
+};
+
+/*
+ * fcpio_reset: host -> firmware request
+ *
+ * used by the host to signal a reset of the driver to the firmware
+ * and to request firmware to clean up all outstanding I/O
+ */
+struct fcpio_reset {
+        u32   _resvd;
+};
+
+enum fcpio_flogi_reg_format_type {
+        FCPIO_FLOGI_REG_DEF_DEST = 0,    /* Use the oui | s_id mac format */
+        FCPIO_FLOGI_REG_GW_DEST,         /* Use the fixed gateway mac */
+};
+
+/*
+ * fcpio_flogi_reg: host -> firmware request
+ *
+ * fc vnic only
+ * used by the host to notify the firmware of the lif's s_id
+ * and destination mac address format
+ */
+struct fcpio_flogi_reg {
+        u8 format;
+        u8 s_id[3];                     /* FC vNIC only: Source S_ID */
+        u8 gateway_mac[ETH_ALEN];       /* Destination gateway mac */
+        u16 _resvd;
+        u32 r_a_tov;                    /* R_A_TOV in msec */
+        u32 e_d_tov;                    /* E_D_TOV in msec */
+};
+
+/*
+ * fcpio_echo: host -> firmware request
+ *
+ * sends a heartbeat echo request to the firmware
+ */
+struct fcpio_echo {
+        u32 _resvd;
+};
+
+/*
+ * fcpio_lunmap_req: host -> firmware request
+ *
+ * scsi vnic only
+ * sends a request to retrieve the lunmap table for scsi vnics
+ */
+struct fcpio_lunmap_req {
+        u64 addr;                     /* address of the buffer */
+        u32 len;                      /* len of the buffer */
+};
+
+/*
+ * fcpio_flogi_fip_reg: host -> firmware request
+ *
+ * fc vnic only
+ * used by the host to notify the firmware of the lif's s_id
+ * and destination mac address format
+ */
+struct fcpio_flogi_fip_reg {
+        u8    _resvd0;
+        u8     s_id[3];               /* FC vNIC only: Source S_ID */
+        u8     fcf_mac[ETH_ALEN];     /* FCF Target destination mac */
+        u16   _resvd1;
+        u32   r_a_tov;                /* R_A_TOV in msec */
+        u32   e_d_tov;                /* E_D_TOV in msec */
+        u8    ha_mac[ETH_ALEN];       /* Host adapter source mac */
+        u16   _resvd2;
+};
+
+/*
+ * Basic structure for all fcpio structures that are sent from the host to the
+ * firmware.  They are 128 bytes per structure.
+ */
+#define FCPIO_HOST_REQ_LEN      128     /* expected length of host requests */
+
+struct fcpio_host_req {
+        struct fcpio_header hdr;
+
+        union {
+                /*
+                 * Defines space needed for request
+                 */
+                u8 buf[FCPIO_HOST_REQ_LEN - sizeof(struct fcpio_header)];
+
+                /*
+                 * Initiator host requests
+                 */
+                struct fcpio_icmnd_16               icmnd_16;
+                struct fcpio_icmnd_32               icmnd_32;
+                struct fcpio_itmf                   itmf;
+
+                /*
+                 * Target host requests
+                 */
+                struct fcpio_tdata                  tdata;
+                struct fcpio_txrdy                  txrdy;
+                struct fcpio_trsp                   trsp;
+                struct fcpio_ttmf_ack               ttmf_ack;
+                struct fcpio_tabort                 tabort;
+
+                /*
+                 * Misc requests
+                 */
+                struct fcpio_reset                  reset;
+                struct fcpio_flogi_reg              flogi_reg;
+                struct fcpio_echo                   echo;
+                struct fcpio_lunmap_req             lunmap_req;
+                struct fcpio_flogi_fip_reg          flogi_fip_reg;
+        } u;
+};
+
+/*
+ * fcpio_icmnd_cmpl: firmware -> host response
+ *
+ * used for sending the host a response to an initiator command
+ */
+struct fcpio_icmnd_cmpl {
+        u8    _resvd0[6];             /* reserved */
+        u8    flags;                  /* response flags */
+        u8    scsi_status;            /* SCSI status */
+        u32   residual;               /* SCSI data residual length */
+        u32   sense_len;              /* SCSI sense length */
+};
+
+/*
+ * response flags
+ */
+#define FCPIO_ICMND_CMPL_RESID_UNDER    0x08    /* resid under and valid */
+#define FCPIO_ICMND_CMPL_RESID_OVER     0x04    /* resid over and valid */
+
+/*
+ * fcpio_itmf_cmpl: firmware -> host response
+ *
+ * used for sending the host a response for a itmf request
+ */
+struct fcpio_itmf_cmpl {
+        u32    _resvd;                /* reserved */
+};
+
+/*
+ * fcpio_tcmnd_16: firmware -> host request
+ *
+ * used by the firmware to notify the host of an incoming target SCSI 16-Byte
+ * request
+ */
+struct fcpio_tcmnd_16 {
+        u8    lun[LUN_ADDRESS];       /* FC vNIC only: LUN address */
+        u8    crn;                    /* SCSI Command Reference No. */
+        u8    pri_ta;                 /* SCSI Priority and Task attribute */
+        u8    _resvd2;                /* reserved: should be 0 */
+        u8    flags;                  /* command flags */
+        u8    scsi_cdb[CDB_16];       /* SCSI Cmnd Descriptor Block */
+        u32   data_len;               /* length of data expected */
+        u8    _resvd1;                /* reserved */
+        u8    s_id[3];                /* FC vNIC only: Source S_ID */
+};
+
+/*
+ * Priority/Task Attribute settings
+ */
+#define FCPIO_TCMND_PTA_SIMPLE      0   /* simple task attribute */
+#define FCPIO_TCMND_PTA_HEADQ       1   /* head of queue task attribute */
+#define FCPIO_TCMND_PTA_ORDERED     2   /* ordered task attribute */
+#define FCPIO_TCMND_PTA_ACA         4   /* auto contingent allegiance */
+#define FCPIO_TCMND_PRI_SHIFT       3   /* priority field starts in bit 3 */
+
+/*
+ * Command flags
+ */
+#define FCPIO_TCMND_RDDATA      0x02    /* read data */
+#define FCPIO_TCMND_WRDATA      0x01    /* write data */
+
+/*
+ * fcpio_tcmnd_32: firmware -> host request
+ *
+ * used by the firmware to notify the host of an incoming target SCSI 32-Byte
+ * request
+ */
+struct fcpio_tcmnd_32 {
+        u8    lun[LUN_ADDRESS];       /* FC vNIC only: LUN address */
+        u8    crn;                    /* SCSI Command Reference No. */
+        u8    pri_ta;                 /* SCSI Priority and Task attribute */
+        u8    _resvd2;                /* reserved: should be 0 */
+        u8    flags;                  /* command flags */
+        u8    scsi_cdb[CDB_32];       /* SCSI Cmnd Descriptor Block */
+        u32   data_len;               /* length of data expected */
+        u8    _resvd0;                /* reserved */
+        u8    s_id[3];                /* FC vNIC only: Source S_ID */
+};
+
+/*
+ * fcpio_tdrsp_cmpl: firmware -> host response
+ *
+ * used by the firmware to notify the host of a response to a host target
+ * command
+ */
+struct fcpio_tdrsp_cmpl {
+        u16   rx_id;                  /* rx_id of the target request */
+        u16   _resvd0;                /* reserved */
+};
+
+/*
+ * fcpio_ttmf: firmware -> host request
+ *
+ * used by the firmware to notify the host of an incoming task management
+ * function request
+ */
+struct fcpio_ttmf {
+        u8    _resvd0;                /* reserved */
+        u8    s_id[3];                /* FC vNIC only: Source S_ID */
+        u8    lun[LUN_ADDRESS];       /* FC vNIC only: LUN address */
+        u8    crn;                    /* SCSI Command Reference No. */
+        u8    _resvd2[3];             /* reserved */
+        u32   tmf_type;               /* task management request type */
+};
+
+/*
+ * Task Management request
+ */
+#define FCPIO_TTMF_CLR_ACA      0x40    /* Clear ACA condition */
+#define FCPIO_TTMF_LUN_RESET    0x10    /* logical unit reset task mgmt */
+#define FCPIO_TTMF_CLR_TASK_SET 0x04    /* clear task set */
+#define FCPIO_TTMF_ABT_TASK_SET 0x02    /* abort task set */
+#define FCPIO_TTMF_ABT_TASK     0x01    /* abort task */
+
+/*
+ * fcpio_tabort_cmpl: firmware -> host response
+ *
+ * used by the firmware to respond to a host's tabort request
+ */
+struct fcpio_tabort_cmpl {
+        u16   rx_id;                  /* rx_id of the target request */
+        u16   _resvd0;                /* reserved */
+};
+
+/*
+ * fcpio_ack: firmware -> host response
+ *
+ * used by firmware to notify the host of the last work request received
+ */
+struct fcpio_ack {
+        u16  request_out;             /* last host entry received */
+        u16  _resvd;
+};
+
+/*
+ * fcpio_reset_cmpl: firmware -> host response
+ *
+ * use by firmware to respond to the host's reset request
+ */
+struct fcpio_reset_cmpl {
+        u16   vnic_id;
+};
+
+/*
+ * fcpio_flogi_reg_cmpl: firmware -> host response
+ *
+ * fc vnic only
+ * response to the fcpio_flogi_reg request
+ */
+struct fcpio_flogi_reg_cmpl {
+        u32 _resvd;
+};
+
+/*
+ * fcpio_echo_cmpl: firmware -> host response
+ *
+ * response to the fcpio_echo request
+ */
+struct fcpio_echo_cmpl {
+        u32 _resvd;
+};
+
+/*
+ * fcpio_lunmap_chng: firmware -> host notification
+ *
+ * scsi vnic only
+ * notifies the host that the lunmap tables have changed
+ */
+struct fcpio_lunmap_chng {
+        u32 _resvd;
+};
+
+/*
+ * fcpio_lunmap_req_cmpl: firmware -> host response
+ *
+ * scsi vnic only
+ * response for lunmap table request from the host
+ */
+struct fcpio_lunmap_req_cmpl {
+        u32 _resvd;
+};
+
+/*
+ * Basic structure for all fcpio structures that are sent from the firmware to
+ * the host.  They are 64 bytes per structure.
+ */
+#define FCPIO_FW_REQ_LEN        64      /* expected length of fw requests */
+struct fcpio_fw_req {
+        struct fcpio_header hdr;
+
+        union {
+                /*
+                 * Defines space needed for request
+                 */
+                u8 buf[FCPIO_FW_REQ_LEN - sizeof(struct fcpio_header)];
+
+                /*
+                 * Initiator firmware responses
+                 */
+                struct fcpio_icmnd_cmpl         icmnd_cmpl;
+                struct fcpio_itmf_cmpl          itmf_cmpl;
+
+                /*
+                 * Target firmware new requests
+                 */
+                struct fcpio_tcmnd_16           tcmnd_16;
+                struct fcpio_tcmnd_32           tcmnd_32;
+
+                /*
+                 * Target firmware responses
+                 */
+                struct fcpio_tdrsp_cmpl         tdrsp_cmpl;
+                struct fcpio_ttmf               ttmf;
+                struct fcpio_tabort_cmpl        tabort_cmpl;
+
+                /*
+                 * Firmware response to work received
+                 */
+                struct fcpio_ack                ack;
+
+                /*
+                 * Misc requests
+                 */
+                struct fcpio_reset_cmpl         reset_cmpl;
+                struct fcpio_flogi_reg_cmpl     flogi_reg_cmpl;
+                struct fcpio_echo_cmpl          echo_cmpl;
+                struct fcpio_lunmap_chng        lunmap_chng;
+                struct fcpio_lunmap_req_cmpl    lunmap_req_cmpl;
+        } u;
+};
+
+/*
+ * Access routines to encode and decode the color bit, which is the most
+ * significant bit of the MSB of the structure
+ */
+static inline void fcpio_color_enc(struct fcpio_fw_req *fw_req, u8 color)
+{
+        u8 *c = ((u8 *) fw_req) + sizeof(struct fcpio_fw_req) - 1;
+
+        if (color)
+                *c |= 0x80;
+        else
+                *c &= ~0x80;
+}
+
+static inline void fcpio_color_dec(struct fcpio_fw_req *fw_req, u8 *color)
+{
+        u8 *c = ((u8 *) fw_req) + sizeof(struct fcpio_fw_req) - 1;
+
+        *color = *c >> 7;
+
+        /*
+         * Make sure color bit is read from desc *before* other fields
+         * are read from desc.  Hardware guarantees color bit is last
+         * bit (byte) written.  Adding the rmb() prevents the compiler
+         * and/or CPU from reordering the reads which would potentially
+         * result in reading stale values.
+         */
+
+        rmb();
+
+}
+
+/*
+ * Lunmap table entry for scsi vnics
+ */
+#define FCPIO_LUNMAP_TABLE_SIZE     256
+#define FCPIO_FLAGS_LUNMAP_VALID    0x80
+#define FCPIO_FLAGS_BOOT            0x01
+struct fcpio_lunmap_entry {
+        u8    bus;
+        u8    target;
+        u8    lun;
+        u8    path_cnt;
+        u16   flags;
+        u16   update_cnt;
+};
+
+struct fcpio_lunmap_tbl {
+        u32                   update_cnt;
+        struct fcpio_lunmap_entry   lunmaps[FCPIO_LUNMAP_TABLE_SIZE];
+};
+
+#endif /* _FCPIO_H_ */
diff --git a/drivers/scsi/fnic/fnic.h b/drivers/scsi/fnic/fnic.h
new file mode 100644
index 00000000000..e4c0a3d7d87
--- /dev/null
+++ b/drivers/scsi/fnic/fnic.h
@@ -0,0 +1,265 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _FNIC_H_
+#define _FNIC_H_
+
+#include <linux/interrupt.h>
+#include <linux/netdevice.h>
+#include <linux/workqueue.h>
+#include <scsi/libfc.h>
+#include "fnic_io.h"
+#include "fnic_res.h"
+#include "vnic_dev.h"
+#include "vnic_wq.h"
+#include "vnic_rq.h"
+#include "vnic_cq.h"
+#include "vnic_wq_copy.h"
+#include "vnic_intr.h"
+#include "vnic_stats.h"
+#include "vnic_scsi.h"
+
+#define DRV_NAME                "fnic"
+#define DRV_DESCRIPTION         "Cisco FCoE HBA Driver"
+#define DRV_VERSION             "1.0.0.1121"
+#define PFX                     DRV_NAME ": "
+#define DFX                     DRV_NAME "%d: "
+
+#define DESC_CLEAN_LOW_WATERMARK 8
+#define FNIC_MAX_IO_REQ         2048 /* scsi_cmnd tag map entries */
+#define FNIC_IO_LOCKS           64 /* IO locks: power of 2 */
+#define FNIC_DFLT_QUEUE_DEPTH   32
+#define FNIC_STATS_RATE_LIMIT   4 /* limit rate at which stats are pulled up */
+
+/*
+ * Tag bits used for special requests.
+ */
+#define BIT(nr)                 (1UL << (nr))
+#define FNIC_TAG_ABORT          BIT(30)         /* tag bit indicating abort */
+#define FNIC_TAG_DEV_RST        BIT(29)         /* indicates device reset */
+#define FNIC_TAG_MASK           (BIT(24) - 1)   /* mask for lookup */
+#define FNIC_NO_TAG             -1
+
+/*
+ * Usage of the scsi_cmnd scratchpad.
+ * These fields are locked by the hashed io_req_lock.
+ */
+#define CMD_SP(Cmnd)            ((Cmnd)->SCp.ptr)
+#define CMD_STATE(Cmnd)         ((Cmnd)->SCp.phase)
+#define CMD_ABTS_STATUS(Cmnd)   ((Cmnd)->SCp.Message)
+#define CMD_LR_STATUS(Cmnd)     ((Cmnd)->SCp.have_data_in)
+#define CMD_TAG(Cmnd)           ((Cmnd)->SCp.sent_command)
+
+#define FCPIO_INVALID_CODE 0x100 /* hdr_status value unused by firmware */
+
+#define FNIC_LUN_RESET_TIMEOUT       10000      /* mSec */
+#define FNIC_HOST_RESET_TIMEOUT      10000      /* mSec */
+#define FNIC_RMDEVICE_TIMEOUT        1000       /* mSec */
+#define FNIC_HOST_RESET_SETTLE_TIME  30         /* Sec */
+
+#define FNIC_MAX_FCP_TARGET     256
+
+extern unsigned int fnic_log_level;
+
+#define FNIC_MAIN_LOGGING 0x01
+#define FNIC_FCS_LOGGING 0x02
+#define FNIC_SCSI_LOGGING 0x04
+#define FNIC_ISR_LOGGING 0x08
+
+#define FNIC_CHECK_LOGGING(LEVEL, CMD)                          \
+do {                                                            \
+        if (unlikely(fnic_log_level & LEVEL))                   \
+                do {                                            \
+                        CMD;                                    \
+                } while (0);                                    \
+} while (0)
+
+#define FNIC_MAIN_DBG(kern_level, host, fmt, args...)           \
+        FNIC_CHECK_LOGGING(FNIC_MAIN_LOGGING,                   \
+                         shost_printk(kern_level, host, fmt, ##args);)
+
+#define FNIC_FCS_DBG(kern_level, host, fmt, args...)            \
+        FNIC_CHECK_LOGGING(FNIC_FCS_LOGGING,                    \
+                         shost_printk(kern_level, host, fmt, ##args);)
+
+#define FNIC_SCSI_DBG(kern_level, host, fmt, args...)           \
+        FNIC_CHECK_LOGGING(FNIC_SCSI_LOGGING,                   \
+                         shost_printk(kern_level, host, fmt, ##args);)
+
+#define FNIC_ISR_DBG(kern_level, host, fmt, args...)            \
+        FNIC_CHECK_LOGGING(FNIC_ISR_LOGGING,                    \
+                         shost_printk(kern_level, host, fmt, ##args);)
+
+extern const char *fnic_state_str[];
+
+enum fnic_intx_intr_index {
+        FNIC_INTX_WQ_RQ_COPYWQ,
+        FNIC_INTX_ERR,
+        FNIC_INTX_NOTIFY,
+        FNIC_INTX_INTR_MAX,
+};
+
+enum fnic_msix_intr_index {
+        FNIC_MSIX_RQ,
+        FNIC_MSIX_WQ,
+        FNIC_MSIX_WQ_COPY,
+        FNIC_MSIX_ERR_NOTIFY,
+        FNIC_MSIX_INTR_MAX,
+};
+
+struct fnic_msix_entry {
+        int requested;
+        char devname[IFNAMSIZ];
+        irqreturn_t (*isr)(int, void *);
+        void *devid;
+};
+
+enum fnic_state {
+        FNIC_IN_FC_MODE = 0,
+        FNIC_IN_FC_TRANS_ETH_MODE,
+        FNIC_IN_ETH_MODE,
+        FNIC_IN_ETH_TRANS_FC_MODE,
+};
+
+#define FNIC_WQ_COPY_MAX 1
+#define FNIC_WQ_MAX 1
+#define FNIC_RQ_MAX 1
+#define FNIC_CQ_MAX (FNIC_WQ_COPY_MAX + FNIC_WQ_MAX + FNIC_RQ_MAX)
+
+struct mempool;
+
+/* Per-instance private data structure */
+struct fnic {
+        struct fc_lport *lport;
+        struct vnic_dev_bar bar0;
+
+        struct msix_entry msix_entry[FNIC_MSIX_INTR_MAX];
+        struct fnic_msix_entry msix[FNIC_MSIX_INTR_MAX];
+
+        struct vnic_stats *stats;
+        unsigned long stats_time;       /* time of stats update */
+        struct vnic_nic_cfg *nic_cfg;
+        char name[IFNAMSIZ];
+        struct timer_list notify_timer; /* used for MSI interrupts */
+
+        unsigned int err_intr_offset;
+        unsigned int link_intr_offset;
+
+        unsigned int wq_count;
+        unsigned int cq_count;
+
+        u32 fcoui_mode:1;               /* use fcoui address*/
+        u32 vlan_hw_insert:1;           /* let hw insert the tag */
+        u32 in_remove:1;                /* fnic device in removal */
+        u32 stop_rx_link_events:1;      /* stop proc. rx frames, link events */
+
+        struct completion *remove_wait; /* device remove thread blocks */
+
+        struct fc_frame *flogi;
+        struct fc_frame *flogi_resp;
+        u16 flogi_oxid;
+        unsigned long s_id;
+        enum fnic_state state;
+        spinlock_t fnic_lock;
+
+        u16 vlan_id;                    /* VLAN tag including priority */
+        u8 mac_addr[ETH_ALEN];
+        u8 dest_addr[ETH_ALEN];
+        u8 data_src_addr[ETH_ALEN];
+        u64 fcp_input_bytes;            /* internal statistic */
+        u64 fcp_output_bytes;           /* internal statistic */
+        u32 link_down_cnt;
+        int link_status;
+
+        struct list_head list;
+        struct pci_dev *pdev;
+        struct vnic_fc_config config;
+        struct vnic_dev *vdev;
+        unsigned int raw_wq_count;
+        unsigned int wq_copy_count;
+        unsigned int rq_count;
+        int fw_ack_index[FNIC_WQ_COPY_MAX];
+        unsigned short fw_ack_recd[FNIC_WQ_COPY_MAX];
+        unsigned short wq_copy_desc_low[FNIC_WQ_COPY_MAX];
+        unsigned int intr_count;
+        u32 __iomem *legacy_pba;
+        struct fnic_host_tag *tags;
+        mempool_t *io_req_pool;
+        mempool_t *io_sgl_pool[FNIC_SGL_NUM_CACHES];
+        spinlock_t io_req_lock[FNIC_IO_LOCKS];  /* locks for scsi cmnds */
+
+        struct work_struct link_work;
+        struct work_struct frame_work;
+        struct sk_buff_head frame_queue;
+
+        /* copy work queue cache line section */
+        ____cacheline_aligned struct vnic_wq_copy wq_copy[FNIC_WQ_COPY_MAX];
+        /* completion queue cache line section */
+        ____cacheline_aligned struct vnic_cq cq[FNIC_CQ_MAX];
+
+        spinlock_t wq_copy_lock[FNIC_WQ_COPY_MAX];
+
+        /* work queue cache line section */
+        ____cacheline_aligned struct vnic_wq wq[FNIC_WQ_MAX];
+        spinlock_t wq_lock[FNIC_WQ_MAX];
+
+        /* receive queue cache line section */
+        ____cacheline_aligned struct vnic_rq rq[FNIC_RQ_MAX];
+
+        /* interrupt resource cache line section */
+        ____cacheline_aligned struct vnic_intr intr[FNIC_MSIX_INTR_MAX];
+};
+
+extern struct workqueue_struct *fnic_event_queue;
+extern struct device_attribute *fnic_attrs[];
+
+void fnic_clear_intr_mode(struct fnic *fnic);
+int fnic_set_intr_mode(struct fnic *fnic);
+void fnic_free_intr(struct fnic *fnic);
+int fnic_request_intr(struct fnic *fnic);
+
+int fnic_send(struct fc_lport *, struct fc_frame *);
+void fnic_free_wq_buf(struct vnic_wq *wq, struct vnic_wq_buf *buf);
+void fnic_handle_frame(struct work_struct *work);
+void fnic_handle_link(struct work_struct *work);
+int fnic_rq_cmpl_handler(struct fnic *fnic, int);
+int fnic_alloc_rq_frame(struct vnic_rq *rq);
+void fnic_free_rq_buf(struct vnic_rq *rq, struct vnic_rq_buf *buf);
+int fnic_send_frame(struct fnic *fnic, struct fc_frame *fp);
+
+int fnic_queuecommand(struct scsi_cmnd *, void (*done)(struct scsi_cmnd *));
+int fnic_abort_cmd(struct scsi_cmnd *);
+int fnic_device_reset(struct scsi_cmnd *);
+int fnic_host_reset(struct scsi_cmnd *);
+int fnic_reset(struct Scsi_Host *);
+void fnic_scsi_cleanup(struct fc_lport *);
+void fnic_scsi_abort_io(struct fc_lport *);
+void fnic_empty_scsi_cleanup(struct fc_lport *);
+void fnic_exch_mgr_reset(struct fc_lport *, u32, u32);
+int fnic_wq_copy_cmpl_handler(struct fnic *fnic, int);
+int fnic_wq_cmpl_handler(struct fnic *fnic, int);
+int fnic_flogi_reg_handler(struct fnic *fnic);
+void fnic_wq_copy_cleanup_handler(struct vnic_wq_copy *wq,
+                                  struct fcpio_host_req *desc);
+int fnic_fw_reset_handler(struct fnic *fnic);
+void fnic_terminate_rport_io(struct fc_rport *);
+const char *fnic_state_to_str(unsigned int state);
+
+void fnic_log_q_error(struct fnic *fnic);
+void fnic_handle_link_event(struct fnic *fnic);
+
+#endif /* _FNIC_H_ */
diff --git a/drivers/scsi/fnic/fnic_attrs.c b/drivers/scsi/fnic/fnic_attrs.c
new file mode 100644
index 00000000000..aea0c3becfd
--- /dev/null
+++ b/drivers/scsi/fnic/fnic_attrs.c
@@ -0,0 +1,56 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/string.h>
+#include <linux/device.h>
+#include <scsi/scsi_host.h>
+#include "fnic.h"
+
+static ssize_t fnic_show_state(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        struct fc_lport *lp = shost_priv(class_to_shost(dev));
+        struct fnic *fnic = lport_priv(lp);
+
+        return snprintf(buf, PAGE_SIZE, "%s\n", fnic_state_str[fnic->state]);
+}
+
+static ssize_t fnic_show_drv_version(struct device *dev,
+                                     struct device_attribute *attr, char *buf)
+{
+        return snprintf(buf, PAGE_SIZE, "%s\n", DRV_VERSION);
+}
+
+static ssize_t fnic_show_link_state(struct device *dev,
+                                    struct device_attribute *attr, char *buf)
+{
+        struct fc_lport *lp = shost_priv(class_to_shost(dev));
+
+        return snprintf(buf, PAGE_SIZE, "%s\n", (lp->link_up)
+                        ? "Link Up" : "Link Down");
+}
+
+static DEVICE_ATTR(fnic_state, S_IRUGO, fnic_show_state, NULL);
+static DEVICE_ATTR(drv_version, S_IRUGO, fnic_show_drv_version, NULL);
+static DEVICE_ATTR(link_state, S_IRUGO, fnic_show_link_state, NULL);
+
+struct device_attribute *fnic_attrs[] = {
+        &dev_attr_fnic_state,
+        &dev_attr_drv_version,
+        &dev_attr_link_state,
+        NULL,
+};
diff --git a/drivers/scsi/fnic/fnic_fcs.c b/drivers/scsi/fnic/fnic_fcs.c
new file mode 100644
index 00000000000..07e6eedb83c
--- /dev/null
+++ b/drivers/scsi/fnic/fnic_fcs.c
@@ -0,0 +1,742 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/errno.h>
+#include <linux/pci.h>
+#include <linux/skbuff.h>
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+#include <linux/if_ether.h>
+#include <linux/if_vlan.h>
+#include <linux/workqueue.h>
+#include <scsi/fc/fc_els.h>
+#include <scsi/fc/fc_fcoe.h>
+#include <scsi/fc_frame.h>
+#include <scsi/libfc.h>
+#include "fnic_io.h"
+#include "fnic.h"
+#include "cq_enet_desc.h"
+#include "cq_exch_desc.h"
+
+struct workqueue_struct *fnic_event_queue;
+
+void fnic_handle_link(struct work_struct *work)
+{
+        struct fnic *fnic = container_of(work, struct fnic, link_work);
+        unsigned long flags;
+        int old_link_status;
+        u32 old_link_down_cnt;
+
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+
+        if (fnic->stop_rx_link_events) {
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                return;
+        }
+
+        old_link_down_cnt = fnic->link_down_cnt;
+        old_link_status = fnic->link_status;
+        fnic->link_status = vnic_dev_link_status(fnic->vdev);
+        fnic->link_down_cnt = vnic_dev_link_down_cnt(fnic->vdev);
+
+        if (old_link_status == fnic->link_status) {
+                if (!fnic->link_status)
+                        /* DOWN -> DOWN */
+                        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                else {
+                        if (old_link_down_cnt != fnic->link_down_cnt) {
+                                /* UP -> DOWN -> UP */
+                                fnic->lport->host_stats.link_failure_count++;
+                                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                                FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
+                                             "link down\n");
+                                fc_linkdown(fnic->lport);
+                                FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
+                                             "link up\n");
+                                fc_linkup(fnic->lport);
+                        } else
+                                /* UP -> UP */
+                                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                }
+        } else if (fnic->link_status) {
+                /* DOWN -> UP */
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host, "link up\n");
+                fc_linkup(fnic->lport);
+        } else {
+                /* UP -> DOWN */
+                fnic->lport->host_stats.link_failure_count++;
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host, "link down\n");
+                fc_linkdown(fnic->lport);
+        }
+
+}
+
+/*
+ * This function passes incoming fabric frames to libFC
+ */
+void fnic_handle_frame(struct work_struct *work)
+{
+        struct fnic *fnic = container_of(work, struct fnic, frame_work);
+        struct fc_lport *lp = fnic->lport;
+        unsigned long flags;
+        struct sk_buff *skb;
+        struct fc_frame *fp;
+
+        while ((skb = skb_dequeue(&fnic->frame_queue))) {
+
+                spin_lock_irqsave(&fnic->fnic_lock, flags);
+                if (fnic->stop_rx_link_events) {
+                        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                        dev_kfree_skb(skb);
+                        return;
+                }
+                fp = (struct fc_frame *)skb;
+                /* if Flogi resp frame, register the address */
+                if (fr_flags(fp)) {
+                        vnic_dev_add_addr(fnic->vdev,
+                                          fnic->data_src_addr);
+                        fr_flags(fp) = 0;
+                }
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+                fc_exch_recv(lp, lp->emp, fp);
+        }
+
+}
+
+static inline void fnic_import_rq_fc_frame(struct sk_buff *skb,
+                                           u32 len, u8 sof, u8 eof)
+{
+        struct fc_frame *fp = (struct fc_frame *)skb;
+
+        skb_trim(skb, len);
+        fr_eof(fp) = eof;
+        fr_sof(fp) = sof;
+}
+
+
+static inline int fnic_import_rq_eth_pkt(struct sk_buff *skb, u32 len)
+{
+        struct fc_frame *fp;
+        struct ethhdr *eh;
+        struct vlan_ethhdr *vh;
+        struct fcoe_hdr *fcoe_hdr;
+        struct fcoe_crc_eof *ft;
+        u32    transport_len = 0;
+
+        eh = (struct ethhdr *)skb->data;
+        vh = (struct vlan_ethhdr *)skb->data;
+        if (vh->h_vlan_proto == htons(ETH_P_8021Q) &&
+            vh->h_vlan_encapsulated_proto == htons(ETH_P_FCOE)) {
+                skb_pull(skb, sizeof(struct vlan_ethhdr));
+                transport_len += sizeof(struct vlan_ethhdr);
+        } else if (eh->h_proto == htons(ETH_P_FCOE)) {
+                transport_len += sizeof(struct ethhdr);
+                skb_pull(skb, sizeof(struct ethhdr));
+        } else
+                return -1;
+
+        fcoe_hdr = (struct fcoe_hdr *)skb->data;
+        if (FC_FCOE_DECAPS_VER(fcoe_hdr) != FC_FCOE_VER)
+                return -1;
+
+        fp = (struct fc_frame *)skb;
+        fc_frame_init(fp);
+        fr_sof(fp) = fcoe_hdr->fcoe_sof;
+        skb_pull(skb, sizeof(struct fcoe_hdr));
+        transport_len += sizeof(struct fcoe_hdr);
+
+        ft = (struct fcoe_crc_eof *)(skb->data + len -
+                                     transport_len - sizeof(*ft));
+        fr_eof(fp) = ft->fcoe_eof;
+        skb_trim(skb, len - transport_len - sizeof(*ft));
+        return 0;
+}
+
+static inline int fnic_handle_flogi_resp(struct fnic *fnic,
+                                         struct fc_frame *fp)
+{
+        u8 mac[ETH_ALEN] = FC_FCOE_FLOGI_MAC;
+        struct ethhdr *eth_hdr;
+        struct fc_frame_header *fh;
+        int ret = 0;
+        unsigned long flags;
+        struct fc_frame *old_flogi_resp = NULL;
+
+        fh = (struct fc_frame_header *)fr_hdr(fp);
+
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+
+        if (fnic->state == FNIC_IN_ETH_MODE) {
+
+                /*
+                 * Check if oxid matches on taking the lock. A new Flogi
+                 * issued by libFC might have changed the fnic cached oxid
+                 */
+                if (fnic->flogi_oxid != ntohs(fh->fh_ox_id)) {
+                        FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
+                                     "Flogi response oxid not"
+                                     " matching cached oxid, dropping frame"
+                                     "\n");
+                        ret = -1;
+                        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                        dev_kfree_skb_irq(fp_skb(fp));
+                        goto handle_flogi_resp_end;
+                }
+
+                /* Drop older cached flogi response frame, cache this frame */
+                old_flogi_resp = fnic->flogi_resp;
+                fnic->flogi_resp = fp;
+                fnic->flogi_oxid = FC_XID_UNKNOWN;
+
+                /*
+                 * this frame is part of flogi get the src mac addr from this
+                 * frame if the src mac is fcoui based then we mark the
+                 * address mode flag to use fcoui base for dst mac addr
+                 * otherwise we have to store the fcoe gateway addr
+                 */
+                eth_hdr = (struct ethhdr *)skb_mac_header(fp_skb(fp));
+                memcpy(mac, eth_hdr->h_source, ETH_ALEN);
+
+                if (ntoh24(mac) == FC_FCOE_OUI)
+                        fnic->fcoui_mode = 1;
+                else {
+                        fnic->fcoui_mode = 0;
+                        memcpy(fnic->dest_addr, mac, ETH_ALEN);
+                }
+
+                /*
+                 * Except for Flogi frame, all outbound frames from us have the
+                 * Eth Src address as FC_FCOE_OUI"our_sid". Flogi frame uses
+                 * the vnic MAC address as the Eth Src address
+                 */
+                fc_fcoe_set_mac(fnic->data_src_addr, fh->fh_d_id);
+
+                /* We get our s_id from the d_id of the flogi resp frame */
+                fnic->s_id = ntoh24(fh->fh_d_id);
+
+                /* Change state to reflect transition from Eth to FC mode */
+                fnic->state = FNIC_IN_ETH_TRANS_FC_MODE;
+
+        } else {
+                FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
+                             "Unexpected fnic state %s while"
+                             " processing flogi resp\n",
+                             fnic_state_to_str(fnic->state));
+                ret = -1;
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                dev_kfree_skb_irq(fp_skb(fp));
+                goto handle_flogi_resp_end;
+        }
+
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+        /* Drop older cached frame */
+        if (old_flogi_resp)
+                dev_kfree_skb_irq(fp_skb(old_flogi_resp));
+
+        /*
+         * send flogi reg request to firmware, this will put the fnic in
+         * in FC mode
+         */
+        ret = fnic_flogi_reg_handler(fnic);
+
+        if (ret < 0) {
+                int free_fp = 1;
+                spin_lock_irqsave(&fnic->fnic_lock, flags);
+                /*
+                 * free the frame is some other thread is not
+                 * pointing to it
+                 */
+                if (fnic->flogi_resp != fp)
+                        free_fp = 0;
+                else
+                        fnic->flogi_resp = NULL;
+
+                if (fnic->state == FNIC_IN_ETH_TRANS_FC_MODE)
+                        fnic->state = FNIC_IN_ETH_MODE;
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                if (free_fp)
+                        dev_kfree_skb_irq(fp_skb(fp));
+        }
+
+ handle_flogi_resp_end:
+        return ret;
+}
+
+/* Returns 1 for a response that matches cached flogi oxid */
+static inline int is_matching_flogi_resp_frame(struct fnic *fnic,
+                                               struct fc_frame *fp)
+{
+        struct fc_frame_header *fh;
+        int ret = 0;
+        u32 f_ctl;
+
+        fh = fc_frame_header_get(fp);
+        f_ctl = ntoh24(fh->fh_f_ctl);
+
+        if (fnic->flogi_oxid == ntohs(fh->fh_ox_id) &&
+            fh->fh_r_ctl == FC_RCTL_ELS_REP &&
+            (f_ctl & (FC_FC_EX_CTX | FC_FC_SEQ_CTX)) == FC_FC_EX_CTX &&
+            fh->fh_type == FC_TYPE_ELS)
+                ret = 1;
+
+        return ret;
+}
+
+static void fnic_rq_cmpl_frame_recv(struct vnic_rq *rq, struct cq_desc
+                                    *cq_desc, struct vnic_rq_buf *buf,
+                                    int skipped __attribute__((unused)),
+                                    void *opaque)
+{
+        struct fnic *fnic = vnic_dev_priv(rq->vdev);
+        struct sk_buff *skb;
+        struct fc_frame *fp;
+        unsigned int eth_hdrs_stripped;
+        u8 type, color, eop, sop, ingress_port, vlan_stripped;
+        u8 fcoe = 0, fcoe_sof, fcoe_eof;
+        u8 fcoe_fc_crc_ok = 1, fcoe_enc_error = 0;
+        u8 tcp_udp_csum_ok, udp, tcp, ipv4_csum_ok;
+        u8 ipv6, ipv4, ipv4_fragment, rss_type, csum_not_calc;
+        u8 fcs_ok = 1, packet_error = 0;
+        u16 q_number, completed_index, bytes_written = 0, vlan, checksum;
+        u32 rss_hash;
+        u16 exchange_id, tmpl;
+        u8 sof = 0;
+        u8 eof = 0;
+        u32 fcp_bytes_written = 0;
+        unsigned long flags;
+
+        pci_unmap_single(fnic->pdev, buf->dma_addr, buf->len,
+                         PCI_DMA_FROMDEVICE);
+        skb = buf->os_buf;
+        buf->os_buf = NULL;
+
+        cq_desc_dec(cq_desc, &type, &color, &q_number, &completed_index);
+        if (type == CQ_DESC_TYPE_RQ_FCP) {
+                cq_fcp_rq_desc_dec((struct cq_fcp_rq_desc *)cq_desc,
+                                   &type, &color, &q_number, &completed_index,
+                                   &eop, &sop, &fcoe_fc_crc_ok, &exchange_id,
+                                   &tmpl, &fcp_bytes_written, &sof, &eof,
+                                   &ingress_port, &packet_error,
+                                   &fcoe_enc_error, &fcs_ok, &vlan_stripped,
+                                   &vlan);
+                eth_hdrs_stripped = 1;
+
+        } else if (type == CQ_DESC_TYPE_RQ_ENET) {
+                cq_enet_rq_desc_dec((struct cq_enet_rq_desc *)cq_desc,
+                                    &type, &color, &q_number, &completed_index,
+                                    &ingress_port, &fcoe, &eop, &sop,
+                                    &rss_type, &csum_not_calc, &rss_hash,
+                                    &bytes_written, &packet_error,
+                                    &vlan_stripped, &vlan, &checksum,
+                                    &fcoe_sof, &fcoe_fc_crc_ok,
+                                    &fcoe_enc_error, &fcoe_eof,
+                                    &tcp_udp_csum_ok, &udp, &tcp,
+                                    &ipv4_csum_ok, &ipv6, &ipv4,
+                                    &ipv4_fragment, &fcs_ok);
+                eth_hdrs_stripped = 0;
+
+        } else {
+                /* wrong CQ type*/
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "fnic rq_cmpl wrong cq type x%x\n", type);
+                goto drop;
+        }
+
+        if (!fcs_ok || packet_error || !fcoe_fc_crc_ok || fcoe_enc_error) {
+                FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
+                             "fnic rq_cmpl fcoe x%x fcsok x%x"
+                             " pkterr x%x fcoe_fc_crc_ok x%x, fcoe_enc_err"
+                             " x%x\n",
+                             fcoe, fcs_ok, packet_error,
+                             fcoe_fc_crc_ok, fcoe_enc_error);
+                goto drop;
+        }
+
+        if (eth_hdrs_stripped)
+                fnic_import_rq_fc_frame(skb, fcp_bytes_written, sof, eof);
+        else if (fnic_import_rq_eth_pkt(skb, bytes_written))
+                goto drop;
+
+        fp = (struct fc_frame *)skb;
+
+        /*
+         * If frame is an ELS response that matches the cached FLOGI OX_ID,
+         * and is accept, issue flogi_reg_request copy wq request to firmware
+         * to register the S_ID and determine whether FC_OUI mode or GW mode.
+         */
+        if (is_matching_flogi_resp_frame(fnic, fp)) {
+                if (!eth_hdrs_stripped) {
+                        if (fc_frame_payload_op(fp) == ELS_LS_ACC) {
+                                fnic_handle_flogi_resp(fnic, fp);
+                                return;
+                        }
+                        /*
+                         * Recd. Flogi reject. No point registering
+                         * with fw, but forward to libFC
+                         */
+                        goto forward;
+                }
+                goto drop;
+        }
+        if (!eth_hdrs_stripped)
+                goto drop;
+
+forward:
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+        if (fnic->stop_rx_link_events) {
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                goto drop;
+        }
+        /* Use fr_flags to indicate whether succ. flogi resp or not */
+        fr_flags(fp) = 0;
+        fr_dev(fp) = fnic->lport;
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+        skb_queue_tail(&fnic->frame_queue, skb);
+        queue_work(fnic_event_queue, &fnic->frame_work);
+
+        return;
+drop:
+        dev_kfree_skb_irq(skb);
+}
+
+static int fnic_rq_cmpl_handler_cont(struct vnic_dev *vdev,
+                                     struct cq_desc *cq_desc, u8 type,
+                                     u16 q_number, u16 completed_index,
+                                     void *opaque)
+{
+        struct fnic *fnic = vnic_dev_priv(vdev);
+
+        vnic_rq_service(&fnic->rq[q_number], cq_desc, completed_index,
+                        VNIC_RQ_RETURN_DESC, fnic_rq_cmpl_frame_recv,
+                        NULL);
+        return 0;
+}
+
+int fnic_rq_cmpl_handler(struct fnic *fnic, int rq_work_to_do)
+{
+        unsigned int tot_rq_work_done = 0, cur_work_done;
+        unsigned int i;
+        int err;
+
+        for (i = 0; i < fnic->rq_count; i++) {
+                cur_work_done = vnic_cq_service(&fnic->cq[i], rq_work_to_do,
+                                                fnic_rq_cmpl_handler_cont,
+                                                NULL);
+                if (cur_work_done) {
+                        err = vnic_rq_fill(&fnic->rq[i], fnic_alloc_rq_frame);
+                        if (err)
+                                shost_printk(KERN_ERR, fnic->lport->host,
+                                             "fnic_alloc_rq_frame cant alloc"
+                                             " frame\n");
+                }
+                tot_rq_work_done += cur_work_done;
+        }
+
+        return tot_rq_work_done;
+}
+
+/*
+ * This function is called once at init time to allocate and fill RQ
+ * buffers. Subsequently, it is called in the interrupt context after RQ
+ * buffer processing to replenish the buffers in the RQ
+ */
+int fnic_alloc_rq_frame(struct vnic_rq *rq)
+{
+        struct fnic *fnic = vnic_dev_priv(rq->vdev);
+        struct sk_buff *skb;
+        u16 len;
+        dma_addr_t pa;
+
+        len = FC_FRAME_HEADROOM + FC_MAX_FRAME + FC_FRAME_TAILROOM;
+        skb = dev_alloc_skb(len);
+        if (!skb) {
+                FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
+                             "Unable to allocate RQ sk_buff\n");
+                return -ENOMEM;
+        }
+        skb_reset_mac_header(skb);
+        skb_reset_transport_header(skb);
+        skb_reset_network_header(skb);
+        skb_put(skb, len);
+        pa = pci_map_single(fnic->pdev, skb->data, len, PCI_DMA_FROMDEVICE);
+        fnic_queue_rq_desc(rq, skb, pa, len);
+        return 0;
+}
+
+void fnic_free_rq_buf(struct vnic_rq *rq, struct vnic_rq_buf *buf)
+{
+        struct fc_frame *fp = buf->os_buf;
+        struct fnic *fnic = vnic_dev_priv(rq->vdev);
+
+        pci_unmap_single(fnic->pdev, buf->dma_addr, buf->len,
+                         PCI_DMA_FROMDEVICE);
+
+        dev_kfree_skb(fp_skb(fp));
+        buf->os_buf = NULL;
+}
+
+static inline int is_flogi_frame(struct fc_frame_header *fh)
+{
+        return fh->fh_r_ctl == FC_RCTL_ELS_REQ && *(u8 *)(fh + 1) == ELS_FLOGI;
+}
+
+int fnic_send_frame(struct fnic *fnic, struct fc_frame *fp)
+{
+        struct vnic_wq *wq = &fnic->wq[0];
+        struct sk_buff *skb;
+        dma_addr_t pa;
+        struct ethhdr *eth_hdr;
+        struct vlan_ethhdr *vlan_hdr;
+        struct fcoe_hdr *fcoe_hdr;
+        struct fc_frame_header *fh;
+        u32 tot_len, eth_hdr_len;
+        int ret = 0;
+        unsigned long flags;
+
+        fh = fc_frame_header_get(fp);
+        skb = fp_skb(fp);
+
+        if (!fnic->vlan_hw_insert) {
+                eth_hdr_len = sizeof(*vlan_hdr) + sizeof(*fcoe_hdr);
+                vlan_hdr = (struct vlan_ethhdr *)skb_push(skb, eth_hdr_len);
+                eth_hdr = (struct ethhdr *)vlan_hdr;
+                vlan_hdr->h_vlan_proto = htons(ETH_P_8021Q);
+                vlan_hdr->h_vlan_encapsulated_proto = htons(ETH_P_FCOE);
+                vlan_hdr->h_vlan_TCI = htons(fnic->vlan_id);
+                fcoe_hdr = (struct fcoe_hdr *)(vlan_hdr + 1);
+        } else {
+                eth_hdr_len = sizeof(*eth_hdr) + sizeof(*fcoe_hdr);
+                eth_hdr = (struct ethhdr *)skb_push(skb, eth_hdr_len);
+                eth_hdr->h_proto = htons(ETH_P_FCOE);
+                fcoe_hdr = (struct fcoe_hdr *)(eth_hdr + 1);
+        }
+
+        if (is_flogi_frame(fh)) {
+                fc_fcoe_set_mac(eth_hdr->h_dest, fh->fh_d_id);
+                memcpy(eth_hdr->h_source, fnic->mac_addr, ETH_ALEN);
+        } else {
+                if (fnic->fcoui_mode)
+                        fc_fcoe_set_mac(eth_hdr->h_dest, fh->fh_d_id);
+                else
+                        memcpy(eth_hdr->h_dest, fnic->dest_addr, ETH_ALEN);
+                memcpy(eth_hdr->h_source, fnic->data_src_addr, ETH_ALEN);
+        }
+
+        tot_len = skb->len;
+        BUG_ON(tot_len % 4);
+
+        memset(fcoe_hdr, 0, sizeof(*fcoe_hdr));
+        fcoe_hdr->fcoe_sof = fr_sof(fp);
+        if (FC_FCOE_VER)
+                FC_FCOE_ENCAPS_VER(fcoe_hdr, FC_FCOE_VER);
+
+        pa = pci_map_single(fnic->pdev, eth_hdr, tot_len, PCI_DMA_TODEVICE);
+
+        spin_lock_irqsave(&fnic->wq_lock[0], flags);
+
+        if (!vnic_wq_desc_avail(wq)) {
+                pci_unmap_single(fnic->pdev, pa,
+                                 tot_len, PCI_DMA_TODEVICE);
+                ret = -1;
+                goto fnic_send_frame_end;
+        }
+
+        fnic_queue_wq_desc(wq, skb, pa, tot_len, fr_eof(fp),
+                           fnic->vlan_hw_insert, fnic->vlan_id, 1, 1, 1);
+fnic_send_frame_end:
+        spin_unlock_irqrestore(&fnic->wq_lock[0], flags);
+
+        if (ret)
+                dev_kfree_skb_any(fp_skb(fp));
+
+        return ret;
+}
+
+/*
+ * fnic_send
+ * Routine to send a raw frame
+ */
+int fnic_send(struct fc_lport *lp, struct fc_frame *fp)
+{
+        struct fnic *fnic = lport_priv(lp);
+        struct fc_frame_header *fh;
+        int ret = 0;
+        enum fnic_state old_state;
+        unsigned long flags;
+        struct fc_frame *old_flogi = NULL;
+        struct fc_frame *old_flogi_resp = NULL;
+
+        if (fnic->in_remove) {
+                dev_kfree_skb(fp_skb(fp));
+                ret = -1;
+                goto fnic_send_end;
+        }
+
+        fh = fc_frame_header_get(fp);
+        /* if not an Flogi frame, send it out, this is the common case */
+        if (!is_flogi_frame(fh))
+                return fnic_send_frame(fnic, fp);
+
+        /* Flogi frame, now enter the state machine */
+
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+again:
+        /* Get any old cached frames, free them after dropping lock */
+        old_flogi = fnic->flogi;
+        fnic->flogi = NULL;
+        old_flogi_resp = fnic->flogi_resp;
+        fnic->flogi_resp = NULL;
+
+        fnic->flogi_oxid = FC_XID_UNKNOWN;
+
+        old_state = fnic->state;
+        switch (old_state) {
+        case FNIC_IN_FC_MODE:
+        case FNIC_IN_ETH_TRANS_FC_MODE:
+        default:
+                fnic->state = FNIC_IN_FC_TRANS_ETH_MODE;
+                vnic_dev_del_addr(fnic->vdev, fnic->data_src_addr);
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+                if (old_flogi) {
+                        dev_kfree_skb(fp_skb(old_flogi));
+                        old_flogi = NULL;
+                }
+                if (old_flogi_resp) {
+                        dev_kfree_skb(fp_skb(old_flogi_resp));
+                        old_flogi_resp = NULL;
+                }
+
+                ret = fnic_fw_reset_handler(fnic);
+
+                spin_lock_irqsave(&fnic->fnic_lock, flags);
+                if (fnic->state != FNIC_IN_FC_TRANS_ETH_MODE)
+                        goto again;
+                if (ret) {
+                        fnic->state = old_state;
+                        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                        dev_kfree_skb(fp_skb(fp));
+                        goto fnic_send_end;
+                }
+                old_flogi = fnic->flogi;
+                fnic->flogi = fp;
+                fnic->flogi_oxid = ntohs(fh->fh_ox_id);
+                old_flogi_resp = fnic->flogi_resp;
+                fnic->flogi_resp = NULL;
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                break;
+
+        case FNIC_IN_FC_TRANS_ETH_MODE:
+                /*
+                 * A reset is pending with the firmware. Store the flogi
+                 * and its oxid. The transition out of this state happens
+                 * only when Firmware completes the reset, either with
+                 * success or failed. If success, transition to
+                 * FNIC_IN_ETH_MODE, if fail, then transition to
+                 * FNIC_IN_FC_MODE
+                 */
+                fnic->flogi = fp;
+                fnic->flogi_oxid = ntohs(fh->fh_ox_id);
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                break;
+
+        case FNIC_IN_ETH_MODE:
+                /*
+                 * The fw/hw is already in eth mode. Store the oxid,
+                 * and send the flogi frame out. The transition out of this
+                 * state happens only we receive flogi response from the
+                 * network, and the oxid matches the cached oxid when the
+                 * flogi frame was sent out. If they match, then we issue
+                 * a flogi_reg request and transition to state
+                 * FNIC_IN_ETH_TRANS_FC_MODE
+                 */
+                fnic->flogi_oxid = ntohs(fh->fh_ox_id);
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                ret = fnic_send_frame(fnic, fp);
+                break;
+        }
+
+fnic_send_end:
+        if (old_flogi)
+                dev_kfree_skb(fp_skb(old_flogi));
+        if (old_flogi_resp)
+                dev_kfree_skb(fp_skb(old_flogi_resp));
+        return ret;
+}
+
+static void fnic_wq_complete_frame_send(struct vnic_wq *wq,
+                                        struct cq_desc *cq_desc,
+                                        struct vnic_wq_buf *buf, void *opaque)
+{
+        struct sk_buff *skb = buf->os_buf;
+        struct fc_frame *fp = (struct fc_frame *)skb;
+        struct fnic *fnic = vnic_dev_priv(wq->vdev);
+
+        pci_unmap_single(fnic->pdev, buf->dma_addr,
+                         buf->len, PCI_DMA_TODEVICE);
+        dev_kfree_skb_irq(fp_skb(fp));
+        buf->os_buf = NULL;
+}
+
+static int fnic_wq_cmpl_handler_cont(struct vnic_dev *vdev,
+                                     struct cq_desc *cq_desc, u8 type,
+                                     u16 q_number, u16 completed_index,
+                                     void *opaque)
+{
+        struct fnic *fnic = vnic_dev_priv(vdev);
+        unsigned long flags;
+
+        spin_lock_irqsave(&fnic->wq_lock[q_number], flags);
+        vnic_wq_service(&fnic->wq[q_number], cq_desc, completed_index,
+                        fnic_wq_complete_frame_send, NULL);
+        spin_unlock_irqrestore(&fnic->wq_lock[q_number], flags);
+
+        return 0;
+}
+
+int fnic_wq_cmpl_handler(struct fnic *fnic, int work_to_do)
+{
+        unsigned int wq_work_done = 0;
+        unsigned int i;
+
+        for (i = 0; i < fnic->raw_wq_count; i++) {
+                wq_work_done  += vnic_cq_service(&fnic->cq[fnic->rq_count+i],
+                                                 work_to_do,
+                                                 fnic_wq_cmpl_handler_cont,
+                                                 NULL);
+        }
+
+        return wq_work_done;
+}
+
+
+void fnic_free_wq_buf(struct vnic_wq *wq, struct vnic_wq_buf *buf)
+{
+        struct fc_frame *fp = buf->os_buf;
+        struct fnic *fnic = vnic_dev_priv(wq->vdev);
+
+        pci_unmap_single(fnic->pdev, buf->dma_addr,
+                         buf->len, PCI_DMA_TODEVICE);
+
+        dev_kfree_skb(fp_skb(fp));
+        buf->os_buf = NULL;
+}
diff --git a/drivers/scsi/fnic/fnic_io.h b/drivers/scsi/fnic/fnic_io.h
new file mode 100644
index 00000000000..f0b896988cd
--- /dev/null
+++ b/drivers/scsi/fnic/fnic_io.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _FNIC_IO_H_
+#define _FNIC_IO_H_
+
+#include <scsi/fc/fc_fcp.h>
+
+#define FNIC_DFLT_SG_DESC_CNT  32
+#define FNIC_MAX_SG_DESC_CNT        1024    /* Maximum descriptors per sgl */
+#define FNIC_SG_DESC_ALIGN          16      /* Descriptor address alignment */
+
+struct host_sg_desc {
+        __le64 addr;
+        __le32 len;
+        u32 _resvd;
+};
+
+struct fnic_dflt_sgl_list {
+        struct host_sg_desc sg_desc[FNIC_DFLT_SG_DESC_CNT];
+};
+
+struct fnic_sgl_list {
+        struct host_sg_desc sg_desc[FNIC_MAX_SG_DESC_CNT];
+};
+
+enum fnic_sgl_list_type {
+        FNIC_SGL_CACHE_DFLT = 0,  /* cache with default size sgl */
+        FNIC_SGL_CACHE_MAX,       /* cache with max size sgl */
+        FNIC_SGL_NUM_CACHES       /* number of sgl caches */
+};
+
+enum fnic_ioreq_state {
+        FNIC_IOREQ_CMD_PENDING = 0,
+        FNIC_IOREQ_ABTS_PENDING,
+        FNIC_IOREQ_ABTS_COMPLETE,
+        FNIC_IOREQ_CMD_COMPLETE,
+};
+
+struct fnic_io_req {
+        struct host_sg_desc *sgl_list; /* sgl list */
+        void *sgl_list_alloc; /* sgl list address used for free */
+        dma_addr_t sense_buf_pa; /* dma address for sense buffer*/
+        dma_addr_t sgl_list_pa; /* dma address for sgl list */
+        u16 sgl_cnt;
+        u8 sgl_type; /* device DMA descriptor list type */
+        u8 io_completed:1; /* set to 1 when fw completes IO */
+        u32 port_id; /* remote port DID */
+        struct completion *abts_done; /* completion for abts */
+        struct completion *dr_done; /* completion for device reset */
+};
+
+#endif /* _FNIC_IO_H_ */
diff --git a/drivers/scsi/fnic/fnic_isr.c b/drivers/scsi/fnic/fnic_isr.c
new file mode 100644
index 00000000000..2b3064828ae
--- /dev/null
+++ b/drivers/scsi/fnic/fnic_isr.c
@@ -0,0 +1,332 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <scsi/libfc.h>
+#include <scsi/fc_frame.h>
+#include "vnic_dev.h"
+#include "vnic_intr.h"
+#include "vnic_stats.h"
+#include "fnic_io.h"
+#include "fnic.h"
+
+static irqreturn_t fnic_isr_legacy(int irq, void *data)
+{
+        struct fnic *fnic = data;
+        u32 pba;
+        unsigned long work_done = 0;
+
+        pba = vnic_intr_legacy_pba(fnic->legacy_pba);
+        if (!pba)
+                return IRQ_NONE;
+
+        if (pba & (1 << FNIC_INTX_NOTIFY)) {
+                vnic_intr_return_all_credits(&fnic->intr[FNIC_INTX_NOTIFY]);
+                fnic_handle_link_event(fnic);
+        }
+
+        if (pba & (1 << FNIC_INTX_ERR)) {
+                vnic_intr_return_all_credits(&fnic->intr[FNIC_INTX_ERR]);
+                fnic_log_q_error(fnic);
+        }
+
+        if (pba & (1 << FNIC_INTX_WQ_RQ_COPYWQ)) {
+                work_done += fnic_wq_copy_cmpl_handler(fnic, 8);
+                work_done += fnic_wq_cmpl_handler(fnic, 4);
+                work_done += fnic_rq_cmpl_handler(fnic, 4);
+
+                vnic_intr_return_credits(&fnic->intr[FNIC_INTX_WQ_RQ_COPYWQ],
+                                         work_done,
+                                         1 /* unmask intr */,
+                                         1 /* reset intr timer */);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t fnic_isr_msi(int irq, void *data)
+{
+        struct fnic *fnic = data;
+        unsigned long work_done = 0;
+
+        work_done += fnic_wq_copy_cmpl_handler(fnic, 8);
+        work_done += fnic_wq_cmpl_handler(fnic, 4);
+        work_done += fnic_rq_cmpl_handler(fnic, 4);
+
+        vnic_intr_return_credits(&fnic->intr[0],
+                                 work_done,
+                                 1 /* unmask intr */,
+                                 1 /* reset intr timer */);
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t fnic_isr_msix_rq(int irq, void *data)
+{
+        struct fnic *fnic = data;
+        unsigned long rq_work_done = 0;
+
+        rq_work_done = fnic_rq_cmpl_handler(fnic, 4);
+        vnic_intr_return_credits(&fnic->intr[FNIC_MSIX_RQ],
+                                 rq_work_done,
+                                 1 /* unmask intr */,
+                                 1 /* reset intr timer */);
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t fnic_isr_msix_wq(int irq, void *data)
+{
+        struct fnic *fnic = data;
+        unsigned long wq_work_done = 0;
+
+        wq_work_done = fnic_wq_cmpl_handler(fnic, 4);
+        vnic_intr_return_credits(&fnic->intr[FNIC_MSIX_WQ],
+                                 wq_work_done,
+                                 1 /* unmask intr */,
+                                 1 /* reset intr timer */);
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t fnic_isr_msix_wq_copy(int irq, void *data)
+{
+        struct fnic *fnic = data;
+        unsigned long wq_copy_work_done = 0;
+
+        wq_copy_work_done = fnic_wq_copy_cmpl_handler(fnic, 8);
+        vnic_intr_return_credits(&fnic->intr[FNIC_MSIX_WQ_COPY],
+                                 wq_copy_work_done,
+                                 1 /* unmask intr */,
+                                 1 /* reset intr timer */);
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t fnic_isr_msix_err_notify(int irq, void *data)
+{
+        struct fnic *fnic = data;
+
+        vnic_intr_return_all_credits(&fnic->intr[FNIC_MSIX_ERR_NOTIFY]);
+        fnic_log_q_error(fnic);
+        fnic_handle_link_event(fnic);
+
+        return IRQ_HANDLED;
+}
+
+void fnic_free_intr(struct fnic *fnic)
+{
+        int i;
+
+        switch (vnic_dev_get_intr_mode(fnic->vdev)) {
+        case VNIC_DEV_INTR_MODE_INTX:
+        case VNIC_DEV_INTR_MODE_MSI:
+                free_irq(fnic->pdev->irq, fnic);
+                break;
+
+        case VNIC_DEV_INTR_MODE_MSIX:
+                for (i = 0; i < ARRAY_SIZE(fnic->msix); i++)
+                        if (fnic->msix[i].requested)
+                                free_irq(fnic->msix_entry[i].vector,
+                                         fnic->msix[i].devid);
+                break;
+
+        default:
+                break;
+        }
+}
+
+int fnic_request_intr(struct fnic *fnic)
+{
+        int err = 0;
+        int i;
+
+        switch (vnic_dev_get_intr_mode(fnic->vdev)) {
+
+        case VNIC_DEV_INTR_MODE_INTX:
+                err = request_irq(fnic->pdev->irq, &fnic_isr_legacy,
+                                  IRQF_SHARED, DRV_NAME, fnic);
+                break;
+
+        case VNIC_DEV_INTR_MODE_MSI:
+                err = request_irq(fnic->pdev->irq, &fnic_isr_msi,
+                                  0, fnic->name, fnic);
+                break;
+
+        case VNIC_DEV_INTR_MODE_MSIX:
+
+                sprintf(fnic->msix[FNIC_MSIX_RQ].devname,
+                        "%.11s-fcs-rq", fnic->name);
+                fnic->msix[FNIC_MSIX_RQ].isr = fnic_isr_msix_rq;
+                fnic->msix[FNIC_MSIX_RQ].devid = fnic;
+
+                sprintf(fnic->msix[FNIC_MSIX_WQ].devname,
+                        "%.11s-fcs-wq", fnic->name);
+                fnic->msix[FNIC_MSIX_WQ].isr = fnic_isr_msix_wq;
+                fnic->msix[FNIC_MSIX_WQ].devid = fnic;
+
+                sprintf(fnic->msix[FNIC_MSIX_WQ_COPY].devname,
+                        "%.11s-scsi-wq", fnic->name);
+                fnic->msix[FNIC_MSIX_WQ_COPY].isr = fnic_isr_msix_wq_copy;
+                fnic->msix[FNIC_MSIX_WQ_COPY].devid = fnic;
+
+                sprintf(fnic->msix[FNIC_MSIX_ERR_NOTIFY].devname,
+                        "%.11s-err-notify", fnic->name);
+                fnic->msix[FNIC_MSIX_ERR_NOTIFY].isr =
+                        fnic_isr_msix_err_notify;
+                fnic->msix[FNIC_MSIX_ERR_NOTIFY].devid = fnic;
+
+                for (i = 0; i < ARRAY_SIZE(fnic->msix); i++) {
+                        err = request_irq(fnic->msix_entry[i].vector,
+                                          fnic->msix[i].isr, 0,
+                                          fnic->msix[i].devname,
+                                          fnic->msix[i].devid);
+                        if (err) {
+                                shost_printk(KERN_ERR, fnic->lport->host,
+                                             "MSIX: request_irq"
+                                             " failed %d\n", err);
+                                fnic_free_intr(fnic);
+                                break;
+                        }
+                        fnic->msix[i].requested = 1;
+                }
+                break;
+
+        default:
+                break;
+        }
+
+        return err;
+}
+
+int fnic_set_intr_mode(struct fnic *fnic)
+{
+        unsigned int n = ARRAY_SIZE(fnic->rq);
+        unsigned int m = ARRAY_SIZE(fnic->wq);
+        unsigned int o = ARRAY_SIZE(fnic->wq_copy);
+        unsigned int i;
+
+        /*
+         * Set interrupt mode (INTx, MSI, MSI-X) depending
+         * system capabilities.
+         *
+         * Try MSI-X first
+         *
+         * We need n RQs, m WQs, o Copy WQs, n+m+o CQs, and n+m+o+1 INTRs
+         * (last INTR is used for WQ/RQ errors and notification area)
+         */
+
+        BUG_ON(ARRAY_SIZE(fnic->msix_entry) < n + m + o + 1);
+        for (i = 0; i < n + m + o + 1; i++)
+                fnic->msix_entry[i].entry = i;
+
+        if (fnic->rq_count >= n &&
+            fnic->raw_wq_count >= m &&
+            fnic->wq_copy_count >= o &&
+            fnic->cq_count >= n + m + o) {
+                if (!pci_enable_msix(fnic->pdev, fnic->msix_entry,
+                                    n + m + o + 1)) {
+                        fnic->rq_count = n;
+                        fnic->raw_wq_count = m;
+                        fnic->wq_copy_count = o;
+                        fnic->wq_count = m + o;
+                        fnic->cq_count = n + m + o;
+                        fnic->intr_count = n + m + o + 1;
+                        fnic->err_intr_offset = FNIC_MSIX_ERR_NOTIFY;
+
+                        FNIC_ISR_DBG(KERN_DEBUG, fnic->lport->host,
+                                     "Using MSI-X Interrupts\n");
+                        vnic_dev_set_intr_mode(fnic->vdev,
+                                               VNIC_DEV_INTR_MODE_MSIX);
+                        return 0;
+                }
+        }
+
+        /*
+         * Next try MSI
+         * We need 1 RQ, 1 WQ, 1 WQ_COPY, 3 CQs, and 1 INTR
+         */
+        if (fnic->rq_count >= 1 &&
+            fnic->raw_wq_count >= 1 &&
+            fnic->wq_copy_count >= 1 &&
+            fnic->cq_count >= 3 &&
+            fnic->intr_count >= 1 &&
+            !pci_enable_msi(fnic->pdev)) {
+
+                fnic->rq_count = 1;
+                fnic->raw_wq_count = 1;
+                fnic->wq_copy_count = 1;
+                fnic->wq_count = 2;
+                fnic->cq_count = 3;
+                fnic->intr_count = 1;
+                fnic->err_intr_offset = 0;
+
+                FNIC_ISR_DBG(KERN_DEBUG, fnic->lport->host,
+                             "Using MSI Interrupts\n");
+                vnic_dev_set_intr_mode(fnic->vdev, VNIC_DEV_INTR_MODE_MSI);
+
+                return 0;
+        }
+
+        /*
+         * Next try INTx
+         * We need 1 RQ, 1 WQ, 1 WQ_COPY, 3 CQs, and 3 INTRs
+         * 1 INTR is used for all 3 queues, 1 INTR for queue errors
+         * 1 INTR for notification area
+         */
+
+        if (fnic->rq_count >= 1 &&
+            fnic->raw_wq_count >= 1 &&
+            fnic->wq_copy_count >= 1 &&
+            fnic->cq_count >= 3 &&
+            fnic->intr_count >= 3) {
+
+                fnic->rq_count = 1;
+                fnic->raw_wq_count = 1;
+                fnic->wq_copy_count = 1;
+                fnic->cq_count = 3;
+                fnic->intr_count = 3;
+
+                FNIC_ISR_DBG(KERN_DEBUG, fnic->lport->host,
+                             "Using Legacy Interrupts\n");
+                vnic_dev_set_intr_mode(fnic->vdev, VNIC_DEV_INTR_MODE_INTX);
+
+                return 0;
+        }
+
+        vnic_dev_set_intr_mode(fnic->vdev, VNIC_DEV_INTR_MODE_UNKNOWN);
+
+        return -EINVAL;
+}
+
+void fnic_clear_intr_mode(struct fnic *fnic)
+{
+        switch (vnic_dev_get_intr_mode(fnic->vdev)) {
+        case VNIC_DEV_INTR_MODE_MSIX:
+                pci_disable_msix(fnic->pdev);
+                break;
+        case VNIC_DEV_INTR_MODE_MSI:
+                pci_disable_msi(fnic->pdev);
+                break;
+        default:
+                break;
+        }
+
+        vnic_dev_set_intr_mode(fnic->vdev, VNIC_DEV_INTR_MODE_INTX);
+}
+
diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
new file mode 100644
index 00000000000..32ef6b87d89
--- /dev/null
+++ b/drivers/scsi/fnic/fnic_main.c
@@ -0,0 +1,942 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/mempool.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/skbuff.h>
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+#include <scsi/scsi_host.h>
+#include <scsi/scsi_transport.h>
+#include <scsi/scsi_transport_fc.h>
+#include <scsi/scsi_tcq.h>
+#include <scsi/libfc.h>
+#include <scsi/fc_frame.h>
+
+#include "vnic_dev.h"
+#include "vnic_intr.h"
+#include "vnic_stats.h"
+#include "fnic_io.h"
+#include "fnic.h"
+
+#define PCI_DEVICE_ID_CISCO_FNIC        0x0045
+
+/* Timer to poll notification area for events. Used for MSI interrupts */
+#define FNIC_NOTIFY_TIMER_PERIOD        (2 * HZ)
+
+static struct kmem_cache *fnic_sgl_cache[FNIC_SGL_NUM_CACHES];
+static struct kmem_cache *fnic_io_req_cache;
+LIST_HEAD(fnic_list);
+DEFINE_SPINLOCK(fnic_list_lock);
+
+/* Supported devices by fnic module */
+static struct pci_device_id fnic_id_table[] = {
+        { PCI_DEVICE(PCI_VENDOR_ID_CISCO, PCI_DEVICE_ID_CISCO_FNIC) },
+        { 0, }
+};
+
+MODULE_DESCRIPTION(DRV_DESCRIPTION);
+MODULE_AUTHOR("Abhijeet Joglekar <abjoglek@cisco.com>, "
+              "Joseph R. Eykholt <jeykholt@cisco.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_VERSION(DRV_VERSION);
+MODULE_DEVICE_TABLE(pci, fnic_id_table);
+
+unsigned int fnic_log_level;
+module_param(fnic_log_level, int, S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(fnic_log_level, "bit mask of fnic logging levels");
+
+
+static struct libfc_function_template fnic_transport_template = {
+        .frame_send = fnic_send,
+        .fcp_abort_io = fnic_empty_scsi_cleanup,
+        .fcp_cleanup = fnic_empty_scsi_cleanup,
+        .exch_mgr_reset = fnic_exch_mgr_reset
+};
+
+static int fnic_slave_alloc(struct scsi_device *sdev)
+{
+        struct fc_rport *rport = starget_to_rport(scsi_target(sdev));
+        struct fc_lport *lp = shost_priv(sdev->host);
+        struct fnic *fnic = lport_priv(lp);
+
+        sdev->tagged_supported = 1;
+
+        if (!rport || fc_remote_port_chkready(rport))
+                return -ENXIO;
+
+        scsi_activate_tcq(sdev, FNIC_DFLT_QUEUE_DEPTH);
+        rport->dev_loss_tmo = fnic->config.port_down_timeout / 1000;
+
+        return 0;
+}
+
+static struct scsi_host_template fnic_host_template = {
+        .module = THIS_MODULE,
+        .name = DRV_NAME,
+        .queuecommand = fnic_queuecommand,
+        .eh_abort_handler = fnic_abort_cmd,
+        .eh_device_reset_handler = fnic_device_reset,
+        .eh_host_reset_handler = fnic_host_reset,
+        .slave_alloc = fnic_slave_alloc,
+        .change_queue_depth = fc_change_queue_depth,
+        .change_queue_type = fc_change_queue_type,
+        .this_id = -1,
+        .cmd_per_lun = 3,
+        .can_queue = FNIC_MAX_IO_REQ,
+        .use_clustering = ENABLE_CLUSTERING,
+        .sg_tablesize = FNIC_MAX_SG_DESC_CNT,
+        .max_sectors = 0xffff,
+        .shost_attrs = fnic_attrs,
+};
+
+static void fnic_get_host_speed(struct Scsi_Host *shost);
+static struct scsi_transport_template *fnic_fc_transport;
+static struct fc_host_statistics *fnic_get_stats(struct Scsi_Host *);
+
+static struct fc_function_template fnic_fc_functions = {
+
+        .show_host_node_name = 1,
+        .show_host_port_name = 1,
+        .show_host_supported_classes = 1,
+        .show_host_supported_fc4s = 1,
+        .show_host_active_fc4s = 1,
+        .show_host_maxframe_size = 1,
+        .show_host_port_id = 1,
+        .show_host_supported_speeds = 1,
+        .get_host_speed = fnic_get_host_speed,
+        .show_host_speed = 1,
+        .show_host_port_type = 1,
+        .get_host_port_state = fc_get_host_port_state,
+        .show_host_port_state = 1,
+        .show_host_symbolic_name = 1,
+        .show_rport_maxframe_size = 1,
+        .show_rport_supported_classes = 1,
+        .show_host_fabric_name = 1,
+        .show_starget_node_name = 1,
+        .show_starget_port_name = 1,
+        .show_starget_port_id = 1,
+        .show_rport_dev_loss_tmo = 1,
+        .issue_fc_host_lip = fnic_reset,
+        .get_fc_host_stats = fnic_get_stats,
+        .dd_fcrport_size = sizeof(struct fc_rport_libfc_priv),
+        .terminate_rport_io = fnic_terminate_rport_io,
+};
+
+static void fnic_get_host_speed(struct Scsi_Host *shost)
+{
+        struct fc_lport *lp = shost_priv(shost);
+        struct fnic *fnic = lport_priv(lp);
+        u32 port_speed = vnic_dev_port_speed(fnic->vdev);
+
+        /* Add in other values as they get defined in fw */
+        switch (port_speed) {
+        case 10000:
+                fc_host_speed(shost) = FC_PORTSPEED_10GBIT;
+                break;
+        default:
+                fc_host_speed(shost) = FC_PORTSPEED_10GBIT;
+                break;
+        }
+}
+
+static struct fc_host_statistics *fnic_get_stats(struct Scsi_Host *host)
+{
+        int ret;
+        struct fc_lport *lp = shost_priv(host);
+        struct fnic *fnic = lport_priv(lp);
+        struct fc_host_statistics *stats = &lp->host_stats;
+        struct vnic_stats *vs;
+        unsigned long flags;
+
+        if (time_before(jiffies, fnic->stats_time + HZ / FNIC_STATS_RATE_LIMIT))
+                return stats;
+        fnic->stats_time = jiffies;
+
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+        ret = vnic_dev_stats_dump(fnic->vdev, &fnic->stats);
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+        if (ret) {
+                FNIC_MAIN_DBG(KERN_DEBUG, fnic->lport->host,
+                              "fnic: Get vnic stats failed"
+                              " 0x%x", ret);
+                return stats;
+        }
+        vs = fnic->stats;
+        stats->tx_frames = vs->tx.tx_unicast_frames_ok;
+        stats->tx_words  = vs->tx.tx_unicast_bytes_ok / 4;
+        stats->rx_frames = vs->rx.rx_unicast_frames_ok;
+        stats->rx_words  = vs->rx.rx_unicast_bytes_ok / 4;
+        stats->error_frames = vs->tx.tx_errors + vs->rx.rx_errors;
+        stats->dumped_frames = vs->tx.tx_drops + vs->rx.rx_drop;
+        stats->invalid_crc_count = vs->rx.rx_crc_errors;
+        stats->seconds_since_last_reset = (jiffies - lp->boot_time) / HZ;
+        stats->fcp_input_megabytes = div_u64(fnic->fcp_input_bytes, 1000000);
+        stats->fcp_output_megabytes = div_u64(fnic->fcp_output_bytes, 1000000);
+
+        return stats;
+}
+
+void fnic_log_q_error(struct fnic *fnic)
+{
+        unsigned int i;
+        u32 error_status;
+
+        for (i = 0; i < fnic->raw_wq_count; i++) {
+                error_status = ioread32(&fnic->wq[i].ctrl->error_status);
+                if (error_status)
+                        shost_printk(KERN_ERR, fnic->lport->host,
+                                     "WQ[%d] error_status"
+                                     " %d\n", i, error_status);
+        }
+
+        for (i = 0; i < fnic->rq_count; i++) {
+                error_status = ioread32(&fnic->rq[i].ctrl->error_status);
+                if (error_status)
+                        shost_printk(KERN_ERR, fnic->lport->host,
+                                     "RQ[%d] error_status"
+                                     " %d\n", i, error_status);
+        }
+
+        for (i = 0; i < fnic->wq_copy_count; i++) {
+                error_status = ioread32(&fnic->wq_copy[i].ctrl->error_status);
+                if (error_status)
+                        shost_printk(KERN_ERR, fnic->lport->host,
+                                     "CWQ[%d] error_status"
+                                     " %d\n", i, error_status);
+        }
+}
+
+void fnic_handle_link_event(struct fnic *fnic)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+        if (fnic->stop_rx_link_events) {
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                return;
+        }
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+        queue_work(fnic_event_queue, &fnic->link_work);
+
+}
+
+static int fnic_notify_set(struct fnic *fnic)
+{
+        int err;
+
+        switch (vnic_dev_get_intr_mode(fnic->vdev)) {
+        case VNIC_DEV_INTR_MODE_INTX:
+                err = vnic_dev_notify_set(fnic->vdev, FNIC_INTX_NOTIFY);
+                break;
+        case VNIC_DEV_INTR_MODE_MSI:
+                err = vnic_dev_notify_set(fnic->vdev, -1);
+                break;
+        case VNIC_DEV_INTR_MODE_MSIX:
+                err = vnic_dev_notify_set(fnic->vdev, FNIC_MSIX_ERR_NOTIFY);
+                break;
+        default:
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Interrupt mode should be set up"
+                             " before devcmd notify set %d\n",
+                             vnic_dev_get_intr_mode(fnic->vdev));
+                err = -1;
+                break;
+        }
+
+        return err;
+}
+
+static void fnic_notify_timer(unsigned long data)
+{
+        struct fnic *fnic = (struct fnic *)data;
+
+        fnic_handle_link_event(fnic);
+        mod_timer(&fnic->notify_timer,
+                  round_jiffies(jiffies + FNIC_NOTIFY_TIMER_PERIOD));
+}
+
+static void fnic_notify_timer_start(struct fnic *fnic)
+{
+        switch (vnic_dev_get_intr_mode(fnic->vdev)) {
+        case VNIC_DEV_INTR_MODE_MSI:
+                /*
+                 * Schedule first timeout immediately. The driver is
+                 * initiatialized and ready to look for link up notification
+                 */
+                mod_timer(&fnic->notify_timer, jiffies);
+                break;
+        default:
+                /* Using intr for notification for INTx/MSI-X */
+                break;
+        };
+}
+
+static int fnic_dev_wait(struct vnic_dev *vdev,
+                         int (*start)(struct vnic_dev *, int),
+                         int (*finished)(struct vnic_dev *, int *),
+                         int arg)
+{
+        unsigned long time;
+        int done;
+        int err;
+
+        err = start(vdev, arg);
+        if (err)
+                return err;
+
+        /* Wait for func to complete...2 seconds max */
+        time = jiffies + (HZ * 2);
+        do {
+                err = finished(vdev, &done);
+                if (err)
+                        return err;
+                if (done)
+                        return 0;
+                schedule_timeout_uninterruptible(HZ / 10);
+        } while (time_after(time, jiffies));
+
+        return -ETIMEDOUT;
+}
+
+static int fnic_cleanup(struct fnic *fnic)
+{
+        unsigned int i;
+        int err;
+        unsigned long flags;
+        struct fc_frame *flogi = NULL;
+        struct fc_frame *flogi_resp = NULL;
+
+        vnic_dev_disable(fnic->vdev);
+        for (i = 0; i < fnic->intr_count; i++)
+                vnic_intr_mask(&fnic->intr[i]);
+
+        for (i = 0; i < fnic->rq_count; i++) {
+                err = vnic_rq_disable(&fnic->rq[i]);
+                if (err)
+                        return err;
+        }
+        for (i = 0; i < fnic->raw_wq_count; i++) {
+                err = vnic_wq_disable(&fnic->wq[i]);
+                if (err)
+                        return err;
+        }
+        for (i = 0; i < fnic->wq_copy_count; i++) {
+                err = vnic_wq_copy_disable(&fnic->wq_copy[i]);
+                if (err)
+                        return err;
+        }
+
+        /* Clean up completed IOs and FCS frames */
+        fnic_wq_copy_cmpl_handler(fnic, -1);
+        fnic_wq_cmpl_handler(fnic, -1);
+        fnic_rq_cmpl_handler(fnic, -1);
+
+        /* Clean up the IOs and FCS frames that have not completed */
+        for (i = 0; i < fnic->raw_wq_count; i++)
+                vnic_wq_clean(&fnic->wq[i], fnic_free_wq_buf);
+        for (i = 0; i < fnic->rq_count; i++)
+                vnic_rq_clean(&fnic->rq[i], fnic_free_rq_buf);
+        for (i = 0; i < fnic->wq_copy_count; i++)
+                vnic_wq_copy_clean(&fnic->wq_copy[i],
+                                   fnic_wq_copy_cleanup_handler);
+
+        for (i = 0; i < fnic->cq_count; i++)
+                vnic_cq_clean(&fnic->cq[i]);
+        for (i = 0; i < fnic->intr_count; i++)
+                vnic_intr_clean(&fnic->intr[i]);
+
+        /*
+         * Remove cached flogi and flogi resp frames if any
+         * These frames are not in any queue, and therefore queue
+         * cleanup does not clean them. So clean them explicitly
+         */
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+        flogi = fnic->flogi;
+        fnic->flogi = NULL;
+        flogi_resp = fnic->flogi_resp;
+        fnic->flogi_resp = NULL;
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+        if (flogi)
+                dev_kfree_skb(fp_skb(flogi));
+
+        if (flogi_resp)
+                dev_kfree_skb(fp_skb(flogi_resp));
+
+        mempool_destroy(fnic->io_req_pool);
+        for (i = 0; i < FNIC_SGL_NUM_CACHES; i++)
+                mempool_destroy(fnic->io_sgl_pool[i]);
+
+        return 0;
+}
+
+static void fnic_iounmap(struct fnic *fnic)
+{
+        if (fnic->bar0.vaddr)
+                iounmap(fnic->bar0.vaddr);
+}
+
+/*
+ * Allocate element for mempools requiring GFP_DMA flag.
+ * Otherwise, checks in kmem_flagcheck() hit BUG_ON().
+ */
+static void *fnic_alloc_slab_dma(gfp_t gfp_mask, void *pool_data)
+{
+        struct kmem_cache *mem = pool_data;
+
+        return kmem_cache_alloc(mem, gfp_mask | GFP_ATOMIC | GFP_DMA);
+}
+
+static int __devinit fnic_probe(struct pci_dev *pdev,
+                                const struct pci_device_id *ent)
+{
+        struct Scsi_Host *host;
+        struct fc_lport *lp;
+        struct fnic *fnic;
+        mempool_t *pool;
+        int err;
+        int i;
+        unsigned long flags;
+
+        /*
+         * Allocate SCSI Host and set up association between host,
+         * local port, and fnic
+         */
+        host = scsi_host_alloc(&fnic_host_template,
+                               sizeof(struct fc_lport) + sizeof(struct fnic));
+        if (!host) {
+                printk(KERN_ERR PFX "Unable to alloc SCSI host\n");
+                err = -ENOMEM;
+                goto err_out;
+        }
+        lp = shost_priv(host);
+        lp->host = host;
+        fnic = lport_priv(lp);
+        fnic->lport = lp;
+
+        snprintf(fnic->name, sizeof(fnic->name) - 1, "%s%d", DRV_NAME,
+                 host->host_no);
+
+        host->transportt = fnic_fc_transport;
+
+        err = scsi_init_shared_tag_map(host, FNIC_MAX_IO_REQ);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Unable to alloc shared tag map\n");
+                goto err_out_free_hba;
+        }
+
+        /* Setup PCI resources */
+        pci_set_drvdata(pdev, fnic);
+
+        fnic->pdev = pdev;
+
+        err = pci_enable_device(pdev);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Cannot enable PCI device, aborting.\n");
+                goto err_out_free_hba;
+        }
+
+        err = pci_request_regions(pdev, DRV_NAME);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Cannot enable PCI resources, aborting\n");
+                goto err_out_disable_device;
+        }
+
+        pci_set_master(pdev);
+
+        /* Query PCI controller on system for DMA addressing
+         * limitation for the device.  Try 40-bit first, and
+         * fail to 32-bit.
+         */
+        err = pci_set_dma_mask(pdev, DMA_40BIT_MASK);
+        if (err) {
+                err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
+                if (err) {
+                        shost_printk(KERN_ERR, fnic->lport->host,
+                                     "No usable DMA configuration "
+                                     "aborting\n");
+                        goto err_out_release_regions;
+                }
+                err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
+                if (err) {
+                        shost_printk(KERN_ERR, fnic->lport->host,
+                                     "Unable to obtain 32-bit DMA "
+                                     "for consistent allocations, aborting.\n");
+                        goto err_out_release_regions;
+                }
+        } else {
+                err = pci_set_consistent_dma_mask(pdev, DMA_40BIT_MASK);
+                if (err) {
+                        shost_printk(KERN_ERR, fnic->lport->host,
+                                     "Unable to obtain 40-bit DMA "
+                                     "for consistent allocations, aborting.\n");
+                        goto err_out_release_regions;
+                }
+        }
+
+        /* Map vNIC resources from BAR0 */
+        if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "BAR0 not memory-map'able, aborting.\n");
+                err = -ENODEV;
+                goto err_out_release_regions;
+        }
+
+        fnic->bar0.vaddr = pci_iomap(pdev, 0, 0);
+        fnic->bar0.bus_addr = pci_resource_start(pdev, 0);
+        fnic->bar0.len = pci_resource_len(pdev, 0);
+
+        if (!fnic->bar0.vaddr) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Cannot memory-map BAR0 res hdr, "
+                             "aborting.\n");
+                err = -ENODEV;
+                goto err_out_release_regions;
+        }
+
+        fnic->vdev = vnic_dev_register(NULL, fnic, pdev, &fnic->bar0);
+        if (!fnic->vdev) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "vNIC registration failed, "
+                             "aborting.\n");
+                err = -ENODEV;
+                goto err_out_iounmap;
+        }
+
+        err = fnic_dev_wait(fnic->vdev, vnic_dev_open,
+                            vnic_dev_open_done, 0);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "vNIC dev open failed, aborting.\n");
+                goto err_out_vnic_unregister;
+        }
+
+        err = vnic_dev_init(fnic->vdev, 0);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "vNIC dev init failed, aborting.\n");
+                goto err_out_dev_close;
+        }
+
+        err = vnic_dev_mac_addr(fnic->vdev, fnic->mac_addr);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "vNIC get MAC addr failed \n");
+                goto err_out_dev_close;
+        }
+
+        /* Get vNIC configuration */
+        err = fnic_get_vnic_config(fnic);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Get vNIC configuration failed, "
+                             "aborting.\n");
+                goto err_out_dev_close;
+        }
+        host->max_lun = fnic->config.luns_per_tgt;
+        host->max_id = FNIC_MAX_FCP_TARGET;
+
+        fnic_get_res_counts(fnic);
+
+        err = fnic_set_intr_mode(fnic);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Failed to set intr mode, "
+                             "aborting.\n");
+                goto err_out_dev_close;
+        }
+
+        err = fnic_request_intr(fnic);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Unable to request irq.\n");
+                goto err_out_clear_intr;
+        }
+
+        err = fnic_alloc_vnic_resources(fnic);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Failed to alloc vNIC resources, "
+                             "aborting.\n");
+                goto err_out_free_intr;
+        }
+
+
+        /* initialize all fnic locks */
+        spin_lock_init(&fnic->fnic_lock);
+
+        for (i = 0; i < FNIC_WQ_MAX; i++)
+                spin_lock_init(&fnic->wq_lock[i]);
+
+        for (i = 0; i < FNIC_WQ_COPY_MAX; i++) {
+                spin_lock_init(&fnic->wq_copy_lock[i]);
+                fnic->wq_copy_desc_low[i] = DESC_CLEAN_LOW_WATERMARK;
+                fnic->fw_ack_recd[i] = 0;
+                fnic->fw_ack_index[i] = -1;
+        }
+
+        for (i = 0; i < FNIC_IO_LOCKS; i++)
+                spin_lock_init(&fnic->io_req_lock[i]);
+
+        fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache);
+        if (!fnic->io_req_pool)
+                goto err_out_free_resources;
+
+        pool = mempool_create(2, fnic_alloc_slab_dma, mempool_free_slab,
+                              fnic_sgl_cache[FNIC_SGL_CACHE_DFLT]);
+        if (!pool)
+                goto err_out_free_ioreq_pool;
+        fnic->io_sgl_pool[FNIC_SGL_CACHE_DFLT] = pool;
+
+        pool = mempool_create(2, fnic_alloc_slab_dma, mempool_free_slab,
+                              fnic_sgl_cache[FNIC_SGL_CACHE_MAX]);
+        if (!pool)
+                goto err_out_free_dflt_pool;
+        fnic->io_sgl_pool[FNIC_SGL_CACHE_MAX] = pool;
+
+        /* setup vlan config, hw inserts vlan header */
+        fnic->vlan_hw_insert = 1;
+        fnic->vlan_id = 0;
+
+        fnic->flogi_oxid = FC_XID_UNKNOWN;
+        fnic->flogi = NULL;
+        fnic->flogi_resp = NULL;
+        fnic->state = FNIC_IN_FC_MODE;
+
+        /* Enable hardware stripping of vlan header on ingress */
+        fnic_set_nic_config(fnic, 0, 0, 0, 0, 0, 0, 1);
+
+        /* Setup notification buffer area */
+        err = fnic_notify_set(fnic);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Failed to alloc notify buffer, aborting.\n");
+                goto err_out_free_max_pool;
+        }
+
+        /* Setup notify timer when using MSI interrupts */
+        if (vnic_dev_get_intr_mode(fnic->vdev) == VNIC_DEV_INTR_MODE_MSI)
+                setup_timer(&fnic->notify_timer,
+                            fnic_notify_timer, (unsigned long)fnic);
+
+        /* allocate RQ buffers and post them to RQ*/
+        for (i = 0; i < fnic->rq_count; i++) {
+                err = vnic_rq_fill(&fnic->rq[i], fnic_alloc_rq_frame);
+                if (err) {
+                        shost_printk(KERN_ERR, fnic->lport->host,
+                                     "fnic_alloc_rq_frame can't alloc "
+                                     "frame\n");
+                        goto err_out_free_rq_buf;
+                }
+        }
+
+        /*
+         * Initialization done with PCI system, hardware, firmware.
+         * Add host to SCSI
+         */
+        err = scsi_add_host(lp->host, &pdev->dev);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "fnic: scsi_add_host failed...exiting\n");
+                goto err_out_free_rq_buf;
+        }
+
+        /* Start local port initiatialization */
+
+        lp->link_up = 0;
+        lp->tt = fnic_transport_template;
+
+        lp->emp = fc_exch_mgr_alloc(lp, FC_CLASS_3,
+                                    FCPIO_HOST_EXCH_RANGE_START,
+                                    FCPIO_HOST_EXCH_RANGE_END);
+        if (!lp->emp) {
+                err = -ENOMEM;
+                goto err_out_remove_scsi_host;
+        }
+
+        lp->max_retry_count = fnic->config.flogi_retries;
+        lp->service_params = (FCP_SPPF_INIT_FCN | FCP_SPPF_RD_XRDY_DIS |
+                              FCP_SPPF_CONF_COMPL);
+        if (fnic->config.flags & VFCF_FCP_SEQ_LVL_ERR)
+                lp->service_params |= FCP_SPPF_RETRY;
+
+        lp->boot_time = jiffies;
+        lp->e_d_tov = fnic->config.ed_tov;
+        lp->r_a_tov = fnic->config.ra_tov;
+        lp->link_supported_speeds = FC_PORTSPEED_10GBIT;
+        fc_set_wwnn(lp, fnic->config.node_wwn);
+        fc_set_wwpn(lp, fnic->config.port_wwn);
+
+        fc_exch_init(lp);
+        fc_lport_init(lp);
+        fc_elsct_init(lp);
+        fc_rport_init(lp);
+        fc_disc_init(lp);
+
+        fc_lport_config(lp);
+
+        if (fc_set_mfs(lp, fnic->config.maxdatafieldsize +
+                       sizeof(struct fc_frame_header))) {
+                err = -EINVAL;
+                goto err_out_free_exch_mgr;
+        }
+        fc_host_maxframe_size(lp->host) = lp->mfs;
+
+        sprintf(fc_host_symbolic_name(lp->host),
+                DRV_NAME " v" DRV_VERSION " over %s", fnic->name);
+
+        spin_lock_irqsave(&fnic_list_lock, flags);
+        list_add_tail(&fnic->list, &fnic_list);
+        spin_unlock_irqrestore(&fnic_list_lock, flags);
+
+        INIT_WORK(&fnic->link_work, fnic_handle_link);
+        INIT_WORK(&fnic->frame_work, fnic_handle_frame);
+        skb_queue_head_init(&fnic->frame_queue);
+
+        /* Enable all queues */
+        for (i = 0; i < fnic->raw_wq_count; i++)
+                vnic_wq_enable(&fnic->wq[i]);
+        for (i = 0; i < fnic->rq_count; i++)
+                vnic_rq_enable(&fnic->rq[i]);
+        for (i = 0; i < fnic->wq_copy_count; i++)
+                vnic_wq_copy_enable(&fnic->wq_copy[i]);
+
+        fc_fabric_login(lp);
+
+        vnic_dev_enable(fnic->vdev);
+        for (i = 0; i < fnic->intr_count; i++)
+                vnic_intr_unmask(&fnic->intr[i]);
+
+        fnic_notify_timer_start(fnic);
+
+        return 0;
+
+err_out_free_exch_mgr:
+        fc_exch_mgr_free(lp->emp);
+err_out_remove_scsi_host:
+        fc_remove_host(fnic->lport->host);
+        scsi_remove_host(fnic->lport->host);
+err_out_free_rq_buf:
+        for (i = 0; i < fnic->rq_count; i++)
+                vnic_rq_clean(&fnic->rq[i], fnic_free_rq_buf);
+        vnic_dev_notify_unset(fnic->vdev);
+err_out_free_max_pool:
+        mempool_destroy(fnic->io_sgl_pool[FNIC_SGL_CACHE_MAX]);
+err_out_free_dflt_pool:
+        mempool_destroy(fnic->io_sgl_pool[FNIC_SGL_CACHE_DFLT]);
+err_out_free_ioreq_pool:
+        mempool_destroy(fnic->io_req_pool);
+err_out_free_resources:
+        fnic_free_vnic_resources(fnic);
+err_out_free_intr:
+        fnic_free_intr(fnic);
+err_out_clear_intr:
+        fnic_clear_intr_mode(fnic);
+err_out_dev_close:
+        vnic_dev_close(fnic->vdev);
+err_out_vnic_unregister:
+        vnic_dev_unregister(fnic->vdev);
+err_out_iounmap:
+        fnic_iounmap(fnic);
+err_out_release_regions:
+        pci_release_regions(pdev);
+err_out_disable_device:
+        pci_disable_device(pdev);
+err_out_free_hba:
+        scsi_host_put(lp->host);
+err_out:
+        return err;
+}
+
+static void __devexit fnic_remove(struct pci_dev *pdev)
+{
+        struct fnic *fnic = pci_get_drvdata(pdev);
+        unsigned long flags;
+
+        /*
+         * Mark state so that the workqueue thread stops forwarding
+         * received frames and link events to the local port. ISR and
+         * other threads that can queue work items will also stop
+         * creating work items on the fnic workqueue
+         */
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+        fnic->stop_rx_link_events = 1;
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+        if (vnic_dev_get_intr_mode(fnic->vdev) == VNIC_DEV_INTR_MODE_MSI)
+                del_timer_sync(&fnic->notify_timer);
+
+        /*
+         * Flush the fnic event queue. After this call, there should
+         * be no event queued for this fnic device in the workqueue
+         */
+        flush_workqueue(fnic_event_queue);
+        skb_queue_purge(&fnic->frame_queue);
+
+        /*
+         * Log off the fabric. This stops all remote ports, dns port,
+         * logs off the fabric. This flushes all rport, disc, lport work
+         * before returning
+         */
+        fc_fabric_logoff(fnic->lport);
+
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+        fnic->in_remove = 1;
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+        fc_lport_destroy(fnic->lport);
+
+        /*
+         * This stops the fnic device, masks all interrupts. Completed
+         * CQ entries are drained. Posted WQ/RQ/Copy-WQ entries are
+         * cleaned up
+         */
+        fnic_cleanup(fnic);
+
+        BUG_ON(!skb_queue_empty(&fnic->frame_queue));
+
+        spin_lock_irqsave(&fnic_list_lock, flags);
+        list_del(&fnic->list);
+        spin_unlock_irqrestore(&fnic_list_lock, flags);
+
+        fc_remove_host(fnic->lport->host);
+        scsi_remove_host(fnic->lport->host);
+        fc_exch_mgr_free(fnic->lport->emp);
+        vnic_dev_notify_unset(fnic->vdev);
+        fnic_free_vnic_resources(fnic);
+        fnic_free_intr(fnic);
+        fnic_clear_intr_mode(fnic);
+        vnic_dev_close(fnic->vdev);
+        vnic_dev_unregister(fnic->vdev);
+        fnic_iounmap(fnic);
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+        pci_set_drvdata(pdev, NULL);
+        scsi_host_put(fnic->lport->host);
+}
+
+static struct pci_driver fnic_driver = {
+        .name = DRV_NAME,
+        .id_table = fnic_id_table,
+        .probe = fnic_probe,
+        .remove = __devexit_p(fnic_remove),
+};
+
+static int __init fnic_init_module(void)
+{
+        size_t len;
+        int err = 0;
+
+        printk(KERN_INFO PFX "%s, ver %s\n", DRV_DESCRIPTION, DRV_VERSION);
+
+        /* Create a cache for allocation of default size sgls */
+        len = sizeof(struct fnic_dflt_sgl_list);
+        fnic_sgl_cache[FNIC_SGL_CACHE_DFLT] = kmem_cache_create
+                ("fnic_sgl_dflt", len + FNIC_SG_DESC_ALIGN, FNIC_SG_DESC_ALIGN,
+                 SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA,
+                 NULL);
+        if (!fnic_sgl_cache[FNIC_SGL_CACHE_DFLT]) {
+                printk(KERN_ERR PFX "failed to create fnic dflt sgl slab\n");
+                err = -ENOMEM;
+                goto err_create_fnic_sgl_slab_dflt;
+        }
+
+        /* Create a cache for allocation of max size sgls*/
+        len = sizeof(struct fnic_sgl_list);
+        fnic_sgl_cache[FNIC_SGL_CACHE_MAX] = kmem_cache_create
+                ("fnic_sgl_max", len + FNIC_SG_DESC_ALIGN, FNIC_SG_DESC_ALIGN,
+                 SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA,
+                 NULL);
+        if (!fnic_sgl_cache[FNIC_SGL_CACHE_MAX]) {
+                printk(KERN_ERR PFX "failed to create fnic max sgl slab\n");
+                err = -ENOMEM;
+                goto err_create_fnic_sgl_slab_max;
+        }
+
+        /* Create a cache of io_req structs for use via mempool */
+        fnic_io_req_cache = kmem_cache_create("fnic_io_req",
+                                              sizeof(struct fnic_io_req),
+                                              0, SLAB_HWCACHE_ALIGN, NULL);
+        if (!fnic_io_req_cache) {
+                printk(KERN_ERR PFX "failed to create fnic io_req slab\n");
+                err = -ENOMEM;
+                goto err_create_fnic_ioreq_slab;
+        }
+
+        fnic_event_queue = create_singlethread_workqueue("fnic_event_wq");
+        if (!fnic_event_queue) {
+                printk(KERN_ERR PFX "fnic work queue create failed\n");
+                err = -ENOMEM;
+                goto err_create_fnic_workq;
+        }
+
+        spin_lock_init(&fnic_list_lock);
+        INIT_LIST_HEAD(&fnic_list);
+
+        fnic_fc_transport = fc_attach_transport(&fnic_fc_functions);
+        if (!fnic_fc_transport) {
+                printk(KERN_ERR PFX "fc_attach_transport error\n");
+                err = -ENOMEM;
+                goto err_fc_transport;
+        }
+
+        /* register the driver with PCI system */
+        err = pci_register_driver(&fnic_driver);
+        if (err < 0) {
+                printk(KERN_ERR PFX "pci register error\n");
+                goto err_pci_register;
+        }
+        return err;
+
+err_pci_register:
+        fc_release_transport(fnic_fc_transport);
+err_fc_transport:
+        destroy_workqueue(fnic_event_queue);
+err_create_fnic_workq:
+        kmem_cache_destroy(fnic_io_req_cache);
+err_create_fnic_ioreq_slab:
+        kmem_cache_destroy(fnic_sgl_cache[FNIC_SGL_CACHE_MAX]);
+err_create_fnic_sgl_slab_max:
+        kmem_cache_destroy(fnic_sgl_cache[FNIC_SGL_CACHE_DFLT]);
+err_create_fnic_sgl_slab_dflt:
+        return err;
+}
+
+static void __exit fnic_cleanup_module(void)
+{
+        pci_unregister_driver(&fnic_driver);
+        destroy_workqueue(fnic_event_queue);
+        kmem_cache_destroy(fnic_sgl_cache[FNIC_SGL_CACHE_MAX]);
+        kmem_cache_destroy(fnic_sgl_cache[FNIC_SGL_CACHE_DFLT]);
+        kmem_cache_destroy(fnic_io_req_cache);
+        fc_release_transport(fnic_fc_transport);
+}
+
+module_init(fnic_init_module);
+module_exit(fnic_cleanup_module);
+
diff --git a/drivers/scsi/fnic/fnic_res.c b/drivers/scsi/fnic/fnic_res.c
new file mode 100644
index 00000000000..7ba61ec715d
--- /dev/null
+++ b/drivers/scsi/fnic/fnic_res.c
@@ -0,0 +1,444 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include "wq_enet_desc.h"
+#include "rq_enet_desc.h"
+#include "cq_enet_desc.h"
+#include "vnic_resource.h"
+#include "vnic_dev.h"
+#include "vnic_wq.h"
+#include "vnic_rq.h"
+#include "vnic_cq.h"
+#include "vnic_intr.h"
+#include "vnic_stats.h"
+#include "vnic_nic.h"
+#include "fnic.h"
+
+int fnic_get_vnic_config(struct fnic *fnic)
+{
+        struct vnic_fc_config *c = &fnic->config;
+        int err;
+
+#define GET_CONFIG(m) \
+        do { \
+                err = vnic_dev_spec(fnic->vdev, \
+                                    offsetof(struct vnic_fc_config, m), \
+                                    sizeof(c->m), &c->m); \
+                if (err) { \
+                        shost_printk(KERN_ERR, fnic->lport->host, \
+                                     "Error getting %s, %d\n", #m, \
+                                     err); \
+                        return err; \
+                } \
+        } while (0);
+
+        GET_CONFIG(node_wwn);
+        GET_CONFIG(port_wwn);
+        GET_CONFIG(wq_enet_desc_count);
+        GET_CONFIG(wq_copy_desc_count);
+        GET_CONFIG(rq_desc_count);
+        GET_CONFIG(maxdatafieldsize);
+        GET_CONFIG(ed_tov);
+        GET_CONFIG(ra_tov);
+        GET_CONFIG(intr_timer);
+        GET_CONFIG(intr_timer_type);
+        GET_CONFIG(flags);
+        GET_CONFIG(flogi_retries);
+        GET_CONFIG(flogi_timeout);
+        GET_CONFIG(plogi_retries);
+        GET_CONFIG(plogi_timeout);
+        GET_CONFIG(io_throttle_count);
+        GET_CONFIG(link_down_timeout);
+        GET_CONFIG(port_down_timeout);
+        GET_CONFIG(port_down_io_retries);
+        GET_CONFIG(luns_per_tgt);
+
+        c->wq_enet_desc_count =
+                min_t(u32, VNIC_FNIC_WQ_DESCS_MAX,
+                      max_t(u32, VNIC_FNIC_WQ_DESCS_MIN,
+                            c->wq_enet_desc_count));
+        c->wq_enet_desc_count = ALIGN(c->wq_enet_desc_count, 16);
+
+        c->wq_copy_desc_count =
+                min_t(u32, VNIC_FNIC_WQ_COPY_DESCS_MAX,
+                      max_t(u32, VNIC_FNIC_WQ_COPY_DESCS_MIN,
+                            c->wq_copy_desc_count));
+        c->wq_copy_desc_count = ALIGN(c->wq_copy_desc_count, 16);
+
+        c->rq_desc_count =
+                min_t(u32, VNIC_FNIC_RQ_DESCS_MAX,
+                      max_t(u32, VNIC_FNIC_RQ_DESCS_MIN,
+                            c->rq_desc_count));
+        c->rq_desc_count = ALIGN(c->rq_desc_count, 16);
+
+        c->maxdatafieldsize =
+                min_t(u16, VNIC_FNIC_MAXDATAFIELDSIZE_MAX,
+                      max_t(u16, VNIC_FNIC_MAXDATAFIELDSIZE_MIN,
+                            c->maxdatafieldsize));
+        c->ed_tov =
+                min_t(u32, VNIC_FNIC_EDTOV_MAX,
+                      max_t(u32, VNIC_FNIC_EDTOV_MIN,
+                            c->ed_tov));
+
+        c->ra_tov =
+                min_t(u32, VNIC_FNIC_RATOV_MAX,
+                      max_t(u32, VNIC_FNIC_RATOV_MIN,
+                            c->ra_tov));
+
+        c->flogi_retries =
+                min_t(u32, VNIC_FNIC_FLOGI_RETRIES_MAX, c->flogi_retries);
+
+        c->flogi_timeout =
+                min_t(u32, VNIC_FNIC_FLOGI_TIMEOUT_MAX,
+                      max_t(u32, VNIC_FNIC_FLOGI_TIMEOUT_MIN,
+                            c->flogi_timeout));
+
+        c->plogi_retries =
+                min_t(u32, VNIC_FNIC_PLOGI_RETRIES_MAX, c->plogi_retries);
+
+        c->plogi_timeout =
+                min_t(u32, VNIC_FNIC_PLOGI_TIMEOUT_MAX,
+                      max_t(u32, VNIC_FNIC_PLOGI_TIMEOUT_MIN,
+                            c->plogi_timeout));
+
+        c->io_throttle_count =
+                min_t(u32, VNIC_FNIC_IO_THROTTLE_COUNT_MAX,
+                      max_t(u32, VNIC_FNIC_IO_THROTTLE_COUNT_MIN,
+                            c->io_throttle_count));
+
+        c->link_down_timeout =
+                min_t(u32, VNIC_FNIC_LINK_DOWN_TIMEOUT_MAX,
+                      c->link_down_timeout);
+
+        c->port_down_timeout =
+                min_t(u32, VNIC_FNIC_PORT_DOWN_TIMEOUT_MAX,
+                      c->port_down_timeout);
+
+        c->port_down_io_retries =
+                min_t(u32, VNIC_FNIC_PORT_DOWN_IO_RETRIES_MAX,
+                      c->port_down_io_retries);
+
+        c->luns_per_tgt =
+                min_t(u32, VNIC_FNIC_LUNS_PER_TARGET_MAX,
+                      max_t(u32, VNIC_FNIC_LUNS_PER_TARGET_MIN,
+                            c->luns_per_tgt));
+
+        c->intr_timer = min_t(u16, VNIC_INTR_TIMER_MAX, c->intr_timer);
+        c->intr_timer_type = c->intr_timer_type;
+
+        shost_printk(KERN_INFO, fnic->lport->host,
+                     "vNIC MAC addr %02x:%02x:%02x:%02x:%02x:%02x "
+                     "wq/wq_copy/rq %d/%d/%d\n",
+                     fnic->mac_addr[0], fnic->mac_addr[1], fnic->mac_addr[2],
+                     fnic->mac_addr[3], fnic->mac_addr[4], fnic->mac_addr[5],
+                     c->wq_enet_desc_count, c->wq_copy_desc_count,
+                     c->rq_desc_count);
+        shost_printk(KERN_INFO, fnic->lport->host,
+                     "vNIC node wwn %llx port wwn %llx\n",
+                     c->node_wwn, c->port_wwn);
+        shost_printk(KERN_INFO, fnic->lport->host,
+                     "vNIC ed_tov %d ra_tov %d\n",
+                     c->ed_tov, c->ra_tov);
+        shost_printk(KERN_INFO, fnic->lport->host,
+                     "vNIC mtu %d intr timer %d\n",
+                     c->maxdatafieldsize, c->intr_timer);
+        shost_printk(KERN_INFO, fnic->lport->host,
+                     "vNIC flags 0x%x luns per tgt %d\n",
+                     c->flags, c->luns_per_tgt);
+        shost_printk(KERN_INFO, fnic->lport->host,
+                     "vNIC flogi_retries %d flogi timeout %d\n",
+                     c->flogi_retries, c->flogi_timeout);
+        shost_printk(KERN_INFO, fnic->lport->host,
+                     "vNIC plogi retries %d plogi timeout %d\n",
+                     c->plogi_retries, c->plogi_timeout);
+        shost_printk(KERN_INFO, fnic->lport->host,
+                     "vNIC io throttle count %d link dn timeout %d\n",
+                     c->io_throttle_count, c->link_down_timeout);
+        shost_printk(KERN_INFO, fnic->lport->host,
+                     "vNIC port dn io retries %d port dn timeout %d\n",
+                     c->port_down_io_retries, c->port_down_timeout);
+
+        return 0;
+}
+
+int fnic_set_nic_config(struct fnic *fnic, u8 rss_default_cpu,
+                        u8 rss_hash_type,
+                        u8 rss_hash_bits, u8 rss_base_cpu, u8 rss_enable,
+                        u8 tso_ipid_split_en, u8 ig_vlan_strip_en)
+{
+        u64 a0, a1;
+        u32 nic_cfg;
+        int wait = 1000;
+
+        vnic_set_nic_cfg(&nic_cfg, rss_default_cpu,
+                rss_hash_type, rss_hash_bits, rss_base_cpu,
+                rss_enable, tso_ipid_split_en, ig_vlan_strip_en);
+
+        a0 = nic_cfg;
+        a1 = 0;
+
+        return vnic_dev_cmd(fnic->vdev, CMD_NIC_CFG, &a0, &a1, wait);
+}
+
+void fnic_get_res_counts(struct fnic *fnic)
+{
+        fnic->wq_count = vnic_dev_get_res_count(fnic->vdev, RES_TYPE_WQ);
+        fnic->raw_wq_count = fnic->wq_count - 1;
+        fnic->wq_copy_count = fnic->wq_count - fnic->raw_wq_count;
+        fnic->rq_count = vnic_dev_get_res_count(fnic->vdev, RES_TYPE_RQ);
+        fnic->cq_count = vnic_dev_get_res_count(fnic->vdev, RES_TYPE_CQ);
+        fnic->intr_count = vnic_dev_get_res_count(fnic->vdev,
+                RES_TYPE_INTR_CTRL);
+}
+
+void fnic_free_vnic_resources(struct fnic *fnic)
+{
+        unsigned int i;
+
+        for (i = 0; i < fnic->raw_wq_count; i++)
+                vnic_wq_free(&fnic->wq[i]);
+
+        for (i = 0; i < fnic->wq_copy_count; i++)
+                vnic_wq_copy_free(&fnic->wq_copy[i]);
+
+        for (i = 0; i < fnic->rq_count; i++)
+                vnic_rq_free(&fnic->rq[i]);
+
+        for (i = 0; i < fnic->cq_count; i++)
+                vnic_cq_free(&fnic->cq[i]);
+
+        for (i = 0; i < fnic->intr_count; i++)
+                vnic_intr_free(&fnic->intr[i]);
+}
+
+int fnic_alloc_vnic_resources(struct fnic *fnic)
+{
+        enum vnic_dev_intr_mode intr_mode;
+        unsigned int mask_on_assertion;
+        unsigned int interrupt_offset;
+        unsigned int error_interrupt_enable;
+        unsigned int error_interrupt_offset;
+        unsigned int i, cq_index;
+        unsigned int wq_copy_cq_desc_count;
+        int err;
+
+        intr_mode = vnic_dev_get_intr_mode(fnic->vdev);
+
+        shost_printk(KERN_INFO, fnic->lport->host, "vNIC interrupt mode: %s\n",
+                     intr_mode == VNIC_DEV_INTR_MODE_INTX ? "legacy PCI INTx" :
+                     intr_mode == VNIC_DEV_INTR_MODE_MSI ? "MSI" :
+                     intr_mode == VNIC_DEV_INTR_MODE_MSIX ?
+                     "MSI-X" : "unknown");
+
+        shost_printk(KERN_INFO, fnic->lport->host, "vNIC resources avail: "
+                     "wq %d cp_wq %d raw_wq %d rq %d cq %d intr %d\n",
+                     fnic->wq_count, fnic->wq_copy_count, fnic->raw_wq_count,
+                     fnic->rq_count, fnic->cq_count, fnic->intr_count);
+
+        /* Allocate Raw WQ used for FCS frames */
+        for (i = 0; i < fnic->raw_wq_count; i++) {
+                err = vnic_wq_alloc(fnic->vdev, &fnic->wq[i], i,
+                        fnic->config.wq_enet_desc_count,
+                        sizeof(struct wq_enet_desc));
+                if (err)
+                        goto err_out_cleanup;
+        }
+
+        /* Allocate Copy WQs used for SCSI IOs */
+        for (i = 0; i < fnic->wq_copy_count; i++) {
+                err = vnic_wq_copy_alloc(fnic->vdev, &fnic->wq_copy[i],
+                        (fnic->raw_wq_count + i),
+                        fnic->config.wq_copy_desc_count,
+                        sizeof(struct fcpio_host_req));
+                if (err)
+                        goto err_out_cleanup;
+        }
+
+        /* RQ for receiving FCS frames */
+        for (i = 0; i < fnic->rq_count; i++) {
+                err = vnic_rq_alloc(fnic->vdev, &fnic->rq[i], i,
+                        fnic->config.rq_desc_count,
+                        sizeof(struct rq_enet_desc));
+                if (err)
+                        goto err_out_cleanup;
+        }
+
+        /* CQ for each RQ */
+        for (i = 0; i < fnic->rq_count; i++) {
+                cq_index = i;
+                err = vnic_cq_alloc(fnic->vdev,
+                        &fnic->cq[cq_index], cq_index,
+                        fnic->config.rq_desc_count,
+                        sizeof(struct cq_enet_rq_desc));
+                if (err)
+                        goto err_out_cleanup;
+        }
+
+        /* CQ for each WQ */
+        for (i = 0; i < fnic->raw_wq_count; i++) {
+                cq_index = fnic->rq_count + i;
+                err = vnic_cq_alloc(fnic->vdev, &fnic->cq[cq_index], cq_index,
+                        fnic->config.wq_enet_desc_count,
+                        sizeof(struct cq_enet_wq_desc));
+                if (err)
+                        goto err_out_cleanup;
+        }
+
+        /* CQ for each COPY WQ */
+        wq_copy_cq_desc_count = (fnic->config.wq_copy_desc_count * 3);
+        for (i = 0; i < fnic->wq_copy_count; i++) {
+                cq_index = fnic->raw_wq_count + fnic->rq_count + i;
+                err = vnic_cq_alloc(fnic->vdev, &fnic->cq[cq_index],
+                        cq_index,
+                        wq_copy_cq_desc_count,
+                        sizeof(struct fcpio_fw_req));
+                if (err)
+                        goto err_out_cleanup;
+        }
+
+        for (i = 0; i < fnic->intr_count; i++) {
+                err = vnic_intr_alloc(fnic->vdev, &fnic->intr[i], i);
+                if (err)
+                        goto err_out_cleanup;
+        }
+
+        fnic->legacy_pba = vnic_dev_get_res(fnic->vdev,
+                                RES_TYPE_INTR_PBA_LEGACY, 0);
+
+        if (!fnic->legacy_pba && intr_mode == VNIC_DEV_INTR_MODE_INTX) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Failed to hook legacy pba resource\n");
+                err = -ENODEV;
+                goto err_out_cleanup;
+        }
+
+        /*
+         * Init RQ/WQ resources.
+         *
+         * RQ[0 to n-1] point to CQ[0 to n-1]
+         * WQ[0 to m-1] point to CQ[n to n+m-1]
+         * WQ_COPY[0 to k-1] points to CQ[n+m to n+m+k-1]
+         *
+         * Note for copy wq we always initialize with cq_index = 0
+         *
+         * Error interrupt is not enabled for MSI.
+         */
+
+        switch (intr_mode) {
+        case VNIC_DEV_INTR_MODE_INTX:
+        case VNIC_DEV_INTR_MODE_MSIX:
+                error_interrupt_enable = 1;
+                error_interrupt_offset = fnic->err_intr_offset;
+                break;
+        default:
+                error_interrupt_enable = 0;
+                error_interrupt_offset = 0;
+                break;
+        }
+
+        for (i = 0; i < fnic->rq_count; i++) {
+                cq_index = i;
+                vnic_rq_init(&fnic->rq[i],
+                             cq_index,
+                             error_interrupt_enable,
+                             error_interrupt_offset);
+        }
+
+        for (i = 0; i < fnic->raw_wq_count; i++) {
+                cq_index = i + fnic->rq_count;
+                vnic_wq_init(&fnic->wq[i],
+                             cq_index,
+                             error_interrupt_enable,
+                             error_interrupt_offset);
+        }
+
+        for (i = 0; i < fnic->wq_copy_count; i++) {
+                vnic_wq_copy_init(&fnic->wq_copy[i],
+                                  0 /* cq_index 0 - always */,
+                                  error_interrupt_enable,
+                                  error_interrupt_offset);
+        }
+
+        for (i = 0; i < fnic->cq_count; i++) {
+
+                switch (intr_mode) {
+                case VNIC_DEV_INTR_MODE_MSIX:
+                        interrupt_offset = i;
+                        break;
+                default:
+                        interrupt_offset = 0;
+                        break;
+                }
+
+                vnic_cq_init(&fnic->cq[i],
+                        0 /* flow_control_enable */,
+                        1 /* color_enable */,
+                        0 /* cq_head */,
+                        0 /* cq_tail */,
+                        1 /* cq_tail_color */,
+                        1 /* interrupt_enable */,
+                        1 /* cq_entry_enable */,
+                        0 /* cq_message_enable */,
+                        interrupt_offset,
+                        0 /* cq_message_addr */);
+        }
+
+        /*
+         * Init INTR resources
+         *
+         * mask_on_assertion is not used for INTx due to the level-
+         * triggered nature of INTx
+         */
+
+        switch (intr_mode) {
+        case VNIC_DEV_INTR_MODE_MSI:
+        case VNIC_DEV_INTR_MODE_MSIX:
+                mask_on_assertion = 1;
+                break;
+        default:
+                mask_on_assertion = 0;
+                break;
+        }
+
+        for (i = 0; i < fnic->intr_count; i++) {
+                vnic_intr_init(&fnic->intr[i],
+                        fnic->config.intr_timer,
+                        fnic->config.intr_timer_type,
+                        mask_on_assertion);
+        }
+
+        /* init the stats memory by making the first call here */
+        err = vnic_dev_stats_dump(fnic->vdev, &fnic->stats);
+        if (err) {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "vnic_dev_stats_dump failed - x%x\n", err);
+                goto err_out_cleanup;
+        }
+
+        /* Clear LIF stats */
+        vnic_dev_stats_clear(fnic->vdev);
+
+        return 0;
+
+err_out_cleanup:
+        fnic_free_vnic_resources(fnic);
+
+        return err;
+}
diff --git a/drivers/scsi/fnic/fnic_res.h b/drivers/scsi/fnic/fnic_res.h
new file mode 100644
index 00000000000..b6f31026253
--- /dev/null
+++ b/drivers/scsi/fnic/fnic_res.h
@@ -0,0 +1,197 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _FNIC_RES_H_
+#define _FNIC_RES_H_
+
+#include "wq_enet_desc.h"
+#include "rq_enet_desc.h"
+#include "vnic_wq.h"
+#include "vnic_rq.h"
+#include "fnic_io.h"
+#include "fcpio.h"
+#include "vnic_wq_copy.h"
+#include "vnic_cq_copy.h"
+
+static inline void fnic_queue_wq_desc(struct vnic_wq *wq,
+                                      void *os_buf, dma_addr_t dma_addr,
+                                      unsigned int len, unsigned int fc_eof,
+                                      int vlan_tag_insert,
+                                      unsigned int vlan_tag,
+                                      int cq_entry, int sop, int eop)
+{
+        struct wq_enet_desc *desc = vnic_wq_next_desc(wq);
+
+        wq_enet_desc_enc(desc,
+                         (u64)dma_addr | VNIC_PADDR_TARGET,
+                         (u16)len,
+                         0, /* mss_or_csum_offset */
+                         (u16)fc_eof,
+                         0, /* offload_mode */
+                         (u8)eop, (u8)cq_entry,
+                         1, /* fcoe_encap */
+                         (u8)vlan_tag_insert,
+                         (u16)vlan_tag,
+                         0 /* loopback */);
+
+        vnic_wq_post(wq, os_buf, dma_addr, len, sop, eop);
+}
+
+static inline void fnic_queue_wq_copy_desc_icmnd_16(struct vnic_wq_copy *wq,
+                                                    u32 req_id,
+                                                    u32 lunmap_id, u8 spl_flags,
+                                                    u32 sgl_cnt, u32 sense_len,
+                                                    u64 sgl_addr, u64 sns_addr,
+                                                    u8 crn, u8 pri_ta,
+                                                    u8 flags, u8 *scsi_cdb,
+                                                    u32 data_len, u8 *lun,
+                                                    u32 d_id, u16 mss,
+                                                    u32 ratov, u32 edtov)
+{
+        struct fcpio_host_req *desc = vnic_wq_copy_next_desc(wq);
+
+        desc->hdr.type = FCPIO_ICMND_16; /* enum fcpio_type */
+        desc->hdr.status = 0;            /* header status entry */
+        desc->hdr._resvd = 0;            /* reserved */
+        desc->hdr.tag.u.req_id = req_id; /* id for this request */
+
+        desc->u.icmnd_16.lunmap_id = lunmap_id; /* index into lunmap table */
+        desc->u.icmnd_16.special_req_flags = spl_flags; /* exch req flags */
+        desc->u.icmnd_16._resvd0[0] = 0;        /* reserved */
+        desc->u.icmnd_16._resvd0[1] = 0;        /* reserved */
+        desc->u.icmnd_16._resvd0[2] = 0;        /* reserved */
+        desc->u.icmnd_16.sgl_cnt = sgl_cnt;     /* scatter-gather list count */
+        desc->u.icmnd_16.sense_len = sense_len; /* sense buffer length */
+        desc->u.icmnd_16.sgl_addr = sgl_addr;   /* scatter-gather list addr */
+        desc->u.icmnd_16.sense_addr = sns_addr; /* sense buffer address */
+        desc->u.icmnd_16.crn = crn;             /* SCSI Command Reference No.*/
+        desc->u.icmnd_16.pri_ta = pri_ta;       /* SCSI Pri & Task attribute */
+        desc->u.icmnd_16._resvd1 = 0;           /* reserved: should be 0 */
+        desc->u.icmnd_16.flags = flags;         /* command flags */
+        memcpy(desc->u.icmnd_16.scsi_cdb, scsi_cdb, CDB_16);    /* SCSI CDB */
+        desc->u.icmnd_16.data_len = data_len;   /* length of data expected */
+        memcpy(desc->u.icmnd_16.lun, lun, LUN_ADDRESS);  /* LUN address */
+        desc->u.icmnd_16._resvd2 = 0;           /* reserved */
+        hton24(desc->u.icmnd_16.d_id, d_id);    /* FC vNIC only: Target D_ID */
+        desc->u.icmnd_16.mss = mss;             /* FC vNIC only: max burst */
+        desc->u.icmnd_16.r_a_tov = ratov; /*FC vNIC only: Res. Alloc Timeout */
+        desc->u.icmnd_16.e_d_tov = edtov; /*FC vNIC only: Err Detect Timeout */
+
+        vnic_wq_copy_post(wq);
+}
+
+static inline void fnic_queue_wq_copy_desc_itmf(struct vnic_wq_copy *wq,
+                                                u32 req_id, u32 lunmap_id,
+                                                u32 tm_req, u32 tm_id, u8 *lun,
+                                                u32 d_id, u32 r_a_tov,
+                                                u32 e_d_tov)
+{
+        struct fcpio_host_req *desc = vnic_wq_copy_next_desc(wq);
+
+        desc->hdr.type = FCPIO_ITMF;     /* enum fcpio_type */
+        desc->hdr.status = 0;            /* header status entry */
+        desc->hdr._resvd = 0;            /* reserved */
+        desc->hdr.tag.u.req_id = req_id; /* id for this request */
+
+        desc->u.itmf.lunmap_id = lunmap_id; /* index into lunmap table */
+        desc->u.itmf.tm_req = tm_req;       /* SCSI Task Management request */
+        desc->u.itmf.t_tag = tm_id;         /* tag of fcpio to be aborted */
+        desc->u.itmf._resvd = 0;
+        memcpy(desc->u.itmf.lun, lun, LUN_ADDRESS);  /* LUN address */
+        desc->u.itmf._resvd1 = 0;
+        hton24(desc->u.itmf.d_id, d_id);    /* FC vNIC only: Target D_ID */
+        desc->u.itmf.r_a_tov = r_a_tov;     /* FC vNIC only: R_A_TOV in msec */
+        desc->u.itmf.e_d_tov = e_d_tov;     /* FC vNIC only: E_D_TOV in msec */
+
+        vnic_wq_copy_post(wq);
+}
+
+static inline void fnic_queue_wq_copy_desc_flogi_reg(struct vnic_wq_copy *wq,
+                                                     u32 req_id, u8 format,
+                                                     u32 s_id, u8 *gw_mac)
+{
+        struct fcpio_host_req *desc = vnic_wq_copy_next_desc(wq);
+
+        desc->hdr.type = FCPIO_FLOGI_REG;     /* enum fcpio_type */
+        desc->hdr.status = 0;                 /* header status entry */
+        desc->hdr._resvd = 0;                 /* reserved */
+        desc->hdr.tag.u.req_id = req_id;      /* id for this request */
+
+        desc->u.flogi_reg.format = format;
+        hton24(desc->u.flogi_reg.s_id, s_id);
+        memcpy(desc->u.flogi_reg.gateway_mac, gw_mac, ETH_ALEN);
+
+        vnic_wq_copy_post(wq);
+}
+
+static inline void fnic_queue_wq_copy_desc_fw_reset(struct vnic_wq_copy *wq,
+                                                    u32 req_id)
+{
+        struct fcpio_host_req *desc = vnic_wq_copy_next_desc(wq);
+
+        desc->hdr.type = FCPIO_RESET;     /* enum fcpio_type */
+        desc->hdr.status = 0;             /* header status entry */
+        desc->hdr._resvd = 0;             /* reserved */
+        desc->hdr.tag.u.req_id = req_id;  /* id for this request */
+
+        vnic_wq_copy_post(wq);
+}
+
+static inline void fnic_queue_wq_copy_desc_lunmap(struct vnic_wq_copy *wq,
+                                                  u32 req_id, u64 lunmap_addr,
+                                                  u32 lunmap_len)
+{
+        struct fcpio_host_req *desc = vnic_wq_copy_next_desc(wq);
+
+        desc->hdr.type = FCPIO_LUNMAP_REQ;      /* enum fcpio_type */
+        desc->hdr.status = 0;                   /* header status entry */
+        desc->hdr._resvd = 0;                   /* reserved */
+        desc->hdr.tag.u.req_id = req_id;        /* id for this request */
+
+        desc->u.lunmap_req.addr = lunmap_addr;  /* address of the buffer */
+        desc->u.lunmap_req.len = lunmap_len;    /* len of the buffer */
+
+        vnic_wq_copy_post(wq);
+}
+
+static inline void fnic_queue_rq_desc(struct vnic_rq *rq,
+                                      void *os_buf, dma_addr_t dma_addr,
+                                      u16 len)
+{
+        struct rq_enet_desc *desc = vnic_rq_next_desc(rq);
+
+        rq_enet_desc_enc(desc,
+                (u64)dma_addr | VNIC_PADDR_TARGET,
+                RQ_ENET_TYPE_ONLY_SOP,
+                (u16)len);
+
+        vnic_rq_post(rq, os_buf, 0, dma_addr, len);
+}
+
+
+struct fnic;
+
+int fnic_get_vnic_config(struct fnic *);
+int fnic_alloc_vnic_resources(struct fnic *);
+void fnic_free_vnic_resources(struct fnic *);
+void fnic_get_res_counts(struct fnic *);
+int fnic_set_nic_config(struct fnic *fnic, u8 rss_default_cpu,
+                        u8 rss_hash_type, u8 rss_hash_bits, u8 rss_base_cpu,
+                        u8 rss_enable, u8 tso_ipid_split_en,
+                        u8 ig_vlan_strip_en);
+
+#endif /* _FNIC_RES_H_ */
diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
new file mode 100644
index 00000000000..eabf3650285
--- /dev/null
+++ b/drivers/scsi/fnic/fnic_scsi.c
@@ -0,0 +1,1850 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/mempool.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/workqueue.h>
+#include <linux/pci.h>
+#include <linux/scatterlist.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/if_ether.h>
+#include <linux/if_vlan.h>
+#include <linux/delay.h>
+#include <scsi/scsi.h>
+#include <scsi/scsi_host.h>
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_tcq.h>
+#include <scsi/fc/fc_els.h>
+#include <scsi/fc/fc_fcoe.h>
+#include <scsi/libfc.h>
+#include <scsi/fc_frame.h>
+#include "fnic_io.h"
+#include "fnic.h"
+
+const char *fnic_state_str[] = {
+        [FNIC_IN_FC_MODE] =           "FNIC_IN_FC_MODE",
+        [FNIC_IN_FC_TRANS_ETH_MODE] = "FNIC_IN_FC_TRANS_ETH_MODE",
+        [FNIC_IN_ETH_MODE] =          "FNIC_IN_ETH_MODE",
+        [FNIC_IN_ETH_TRANS_FC_MODE] = "FNIC_IN_ETH_TRANS_FC_MODE",
+};
+
+static const char *fnic_ioreq_state_str[] = {
+        [FNIC_IOREQ_CMD_PENDING] = "FNIC_IOREQ_CMD_PENDING",
+        [FNIC_IOREQ_ABTS_PENDING] = "FNIC_IOREQ_ABTS_PENDING",
+        [FNIC_IOREQ_ABTS_COMPLETE] = "FNIC_IOREQ_ABTS_COMPLETE",
+        [FNIC_IOREQ_CMD_COMPLETE] = "FNIC_IOREQ_CMD_COMPLETE",
+};
+
+static const char *fcpio_status_str[] =  {
+        [FCPIO_SUCCESS] = "FCPIO_SUCCESS", /*0x0*/
+        [FCPIO_INVALID_HEADER] = "FCPIO_INVALID_HEADER",
+        [FCPIO_OUT_OF_RESOURCE] = "FCPIO_OUT_OF_RESOURCE",
+        [FCPIO_INVALID_PARAM] = "FCPIO_INVALID_PARAM]",
+        [FCPIO_REQ_NOT_SUPPORTED] = "FCPIO_REQ_NOT_SUPPORTED",
+        [FCPIO_IO_NOT_FOUND] = "FCPIO_IO_NOT_FOUND",
+        [FCPIO_ABORTED] = "FCPIO_ABORTED", /*0x41*/
+        [FCPIO_TIMEOUT] = "FCPIO_TIMEOUT",
+        [FCPIO_SGL_INVALID] = "FCPIO_SGL_INVALID",
+        [FCPIO_MSS_INVALID] = "FCPIO_MSS_INVALID",
+        [FCPIO_DATA_CNT_MISMATCH] = "FCPIO_DATA_CNT_MISMATCH",
+        [FCPIO_FW_ERR] = "FCPIO_FW_ERR",
+        [FCPIO_ITMF_REJECTED] = "FCPIO_ITMF_REJECTED",
+        [FCPIO_ITMF_FAILED] = "FCPIO_ITMF_FAILED",
+        [FCPIO_ITMF_INCORRECT_LUN] = "FCPIO_ITMF_INCORRECT_LUN",
+        [FCPIO_CMND_REJECTED] = "FCPIO_CMND_REJECTED",
+        [FCPIO_NO_PATH_AVAIL] = "FCPIO_NO_PATH_AVAIL",
+        [FCPIO_PATH_FAILED] = "FCPIO_PATH_FAILED",
+        [FCPIO_LUNMAP_CHNG_PEND] = "FCPIO_LUNHMAP_CHNG_PEND",
+};
+
+const char *fnic_state_to_str(unsigned int state)
+{
+        if (state >= ARRAY_SIZE(fnic_state_str) || !fnic_state_str[state])
+                return "unknown";
+
+        return fnic_state_str[state];
+}
+
+static const char *fnic_ioreq_state_to_str(unsigned int state)
+{
+        if (state >= ARRAY_SIZE(fnic_ioreq_state_str) ||
+            !fnic_ioreq_state_str[state])
+                return "unknown";
+
+        return fnic_ioreq_state_str[state];
+}
+
+static const char *fnic_fcpio_status_to_str(unsigned int status)
+{
+        if (status >= ARRAY_SIZE(fcpio_status_str) || !fcpio_status_str[status])
+                return "unknown";
+
+        return fcpio_status_str[status];
+}
+
+static void fnic_cleanup_io(struct fnic *fnic, int exclude_id);
+
+static inline spinlock_t *fnic_io_lock_hash(struct fnic *fnic,
+                                            struct scsi_cmnd *sc)
+{
+        u32 hash = sc->request->tag & (FNIC_IO_LOCKS - 1);
+
+        return &fnic->io_req_lock[hash];
+}
+
+/*
+ * Unmap the data buffer and sense buffer for an io_req,
+ * also unmap and free the device-private scatter/gather list.
+ */
+static void fnic_release_ioreq_buf(struct fnic *fnic,
+                                   struct fnic_io_req *io_req,
+                                   struct scsi_cmnd *sc)
+{
+        if (io_req->sgl_list_pa)
+                pci_unmap_single(fnic->pdev, io_req->sgl_list_pa,
+                                 sizeof(io_req->sgl_list[0]) * io_req->sgl_cnt,
+                                 PCI_DMA_TODEVICE);
+        scsi_dma_unmap(sc);
+
+        if (io_req->sgl_cnt)
+                mempool_free(io_req->sgl_list_alloc,
+                             fnic->io_sgl_pool[io_req->sgl_type]);
+        if (io_req->sense_buf_pa)
+                pci_unmap_single(fnic->pdev, io_req->sense_buf_pa,
+                                 SCSI_SENSE_BUFFERSIZE, PCI_DMA_FROMDEVICE);
+}
+
+/* Free up Copy Wq descriptors. Called with copy_wq lock held */
+static int free_wq_copy_descs(struct fnic *fnic, struct vnic_wq_copy *wq)
+{
+        /* if no Ack received from firmware, then nothing to clean */
+        if (!fnic->fw_ack_recd[0])
+                return 1;
+
+        /*
+         * Update desc_available count based on number of freed descriptors
+         * Account for wraparound
+         */
+        if (wq->to_clean_index <= fnic->fw_ack_index[0])
+                wq->ring.desc_avail += (fnic->fw_ack_index[0]
+                                        - wq->to_clean_index + 1);
+        else
+                wq->ring.desc_avail += (wq->ring.desc_count
+                                        - wq->to_clean_index
+                                        + fnic->fw_ack_index[0] + 1);
+
+        /*
+         * just bump clean index to ack_index+1 accounting for wraparound
+         * this will essentially free up all descriptors between
+         * to_clean_index and fw_ack_index, both inclusive
+         */
+        wq->to_clean_index =
+                (fnic->fw_ack_index[0] + 1) % wq->ring.desc_count;
+
+        /* we have processed the acks received so far */
+        fnic->fw_ack_recd[0] = 0;
+        return 0;
+}
+
+
+/*
+ * fnic_fw_reset_handler
+ * Routine to send reset msg to fw
+ */
+int fnic_fw_reset_handler(struct fnic *fnic)
+{
+        struct vnic_wq_copy *wq = &fnic->wq_copy[0];
+        int ret = 0;
+        unsigned long flags;
+
+        spin_lock_irqsave(&fnic->wq_copy_lock[0], flags);
+
+        if (vnic_wq_copy_desc_avail(wq) <= fnic->wq_copy_desc_low[0])
+                free_wq_copy_descs(fnic, wq);
+
+        if (!vnic_wq_copy_desc_avail(wq))
+                ret = -EAGAIN;
+        else
+                fnic_queue_wq_copy_desc_fw_reset(wq, SCSI_NO_TAG);
+
+        spin_unlock_irqrestore(&fnic->wq_copy_lock[0], flags);
+
+        if (!ret)
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "Issued fw reset\n");
+        else
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "Failed to issue fw reset\n");
+        return ret;
+}
+
+
+/*
+ * fnic_flogi_reg_handler
+ * Routine to send flogi register msg to fw
+ */
+int fnic_flogi_reg_handler(struct fnic *fnic)
+{
+        struct vnic_wq_copy *wq = &fnic->wq_copy[0];
+        u8 gw_mac[ETH_ALEN];
+        int ret = 0;
+        unsigned long flags;
+
+        spin_lock_irqsave(&fnic->wq_copy_lock[0], flags);
+
+        if (vnic_wq_copy_desc_avail(wq) <= fnic->wq_copy_desc_low[0])
+                free_wq_copy_descs(fnic, wq);
+
+        if (!vnic_wq_copy_desc_avail(wq)) {
+                ret = -EAGAIN;
+                goto flogi_reg_ioreq_end;
+        }
+
+        if (fnic->fcoui_mode)
+                memset(gw_mac, 0xff, ETH_ALEN);
+        else
+                memcpy(gw_mac, fnic->dest_addr, ETH_ALEN);
+
+        fnic_queue_wq_copy_desc_flogi_reg(wq, SCSI_NO_TAG,
+                                          FCPIO_FLOGI_REG_GW_DEST,
+                                          fnic->s_id,
+                                          gw_mac);
+
+flogi_reg_ioreq_end:
+        spin_unlock_irqrestore(&fnic->wq_copy_lock[0], flags);
+
+        if (!ret)
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "flog reg issued\n");
+
+        return ret;
+}
+
+/*
+ * fnic_queue_wq_copy_desc
+ * Routine to enqueue a wq copy desc
+ */
+static inline int fnic_queue_wq_copy_desc(struct fnic *fnic,
+                                          struct vnic_wq_copy *wq,
+                                          struct fnic_io_req *io_req,
+                                          struct scsi_cmnd *sc,
+                                          u32 sg_count)
+{
+        struct scatterlist *sg;
+        struct fc_rport *rport = starget_to_rport(scsi_target(sc->device));
+        struct fc_rport_libfc_priv *rp = rport->dd_data;
+        struct host_sg_desc *desc;
+        u8 pri_tag = 0;
+        unsigned int i;
+        unsigned long intr_flags;
+        int flags;
+        u8 exch_flags;
+        struct scsi_lun fc_lun;
+        char msg[2];
+
+        if (sg_count) {
+                BUG_ON(sg_count < 0);
+                BUG_ON(sg_count > FNIC_MAX_SG_DESC_CNT);
+
+                /* For each SGE, create a device desc entry */
+                desc = io_req->sgl_list;
+                for_each_sg(scsi_sglist(sc), sg, sg_count, i) {
+                        desc->addr = cpu_to_le64(sg_dma_address(sg));
+                        desc->len = cpu_to_le32(sg_dma_len(sg));
+                        desc->_resvd = 0;
+                        desc++;
+                }
+
+                io_req->sgl_list_pa = pci_map_single
+                        (fnic->pdev,
+                         io_req->sgl_list,
+                         sizeof(io_req->sgl_list[0]) * sg_count,
+                         PCI_DMA_TODEVICE);
+        }
+
+        io_req->sense_buf_pa = pci_map_single(fnic->pdev,
+                                              sc->sense_buffer,
+                                              SCSI_SENSE_BUFFERSIZE,
+                                              PCI_DMA_FROMDEVICE);
+
+        int_to_scsilun(sc->device->lun, &fc_lun);
+
+        pri_tag = FCPIO_ICMND_PTA_SIMPLE;
+        msg[0] = MSG_SIMPLE_TAG;
+        scsi_populate_tag_msg(sc, msg);
+        if (msg[0] == MSG_ORDERED_TAG)
+                pri_tag = FCPIO_ICMND_PTA_ORDERED;
+
+        /* Enqueue the descriptor in the Copy WQ */
+        spin_lock_irqsave(&fnic->wq_copy_lock[0], intr_flags);
+
+        if (vnic_wq_copy_desc_avail(wq) <= fnic->wq_copy_desc_low[0])
+                free_wq_copy_descs(fnic, wq);
+
+        if (unlikely(!vnic_wq_copy_desc_avail(wq))) {
+                spin_unlock_irqrestore(&fnic->wq_copy_lock[0], intr_flags);
+                return SCSI_MLQUEUE_HOST_BUSY;
+        }
+
+        flags = 0;
+        if (sc->sc_data_direction == DMA_FROM_DEVICE)
+                flags = FCPIO_ICMND_RDDATA;
+        else if (sc->sc_data_direction == DMA_TO_DEVICE)
+                flags = FCPIO_ICMND_WRDATA;
+
+        exch_flags = 0;
+        if ((fnic->config.flags & VFCF_FCP_SEQ_LVL_ERR) &&
+            (rp->flags & FC_RP_FLAGS_RETRY))
+                exch_flags |= FCPIO_ICMND_SRFLAG_RETRY;
+
+        fnic_queue_wq_copy_desc_icmnd_16(wq, sc->request->tag,
+                                         0, exch_flags, io_req->sgl_cnt,
+                                         SCSI_SENSE_BUFFERSIZE,
+                                         io_req->sgl_list_pa,
+                                         io_req->sense_buf_pa,
+                                         0, /* scsi cmd ref, always 0 */
+                                         pri_tag, /* scsi pri and tag */
+                                         flags, /* command flags */
+                                         sc->cmnd, scsi_bufflen(sc),
+                                         fc_lun.scsi_lun, io_req->port_id,
+                                         rport->maxframe_size, rp->r_a_tov,
+                                         rp->e_d_tov);
+
+        spin_unlock_irqrestore(&fnic->wq_copy_lock[0], intr_flags);
+        return 0;
+}
+
+/*
+ * fnic_queuecommand
+ * Routine to send a scsi cdb
+ * Called with host_lock held and interrupts disabled.
+ */
+int fnic_queuecommand(struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
+{
+        struct fc_lport *lp;
+        struct fc_rport *rport;
+        struct fnic_io_req *io_req;
+        struct fnic *fnic;
+        struct vnic_wq_copy *wq;
+        int ret;
+        u32 sg_count;
+        unsigned long flags;
+        unsigned long ptr;
+
+        rport = starget_to_rport(scsi_target(sc->device));
+        ret = fc_remote_port_chkready(rport);
+        if (ret) {
+                sc->result = ret;
+                done(sc);
+                return 0;
+        }
+
+        lp = shost_priv(sc->device->host);
+        if (lp->state != LPORT_ST_READY || !(lp->link_up))
+                return SCSI_MLQUEUE_HOST_BUSY;
+
+        /*
+         * Release host lock, use driver resource specific locks from here.
+         * Don't re-enable interrupts in case they were disabled prior to the
+         * caller disabling them.
+         */
+        spin_unlock(lp->host->host_lock);
+
+        /* Get a new io_req for this SCSI IO */
+        fnic = lport_priv(lp);
+
+        io_req = mempool_alloc(fnic->io_req_pool, GFP_ATOMIC);
+        if (!io_req) {
+                ret = SCSI_MLQUEUE_HOST_BUSY;
+                goto out;
+        }
+        memset(io_req, 0, sizeof(*io_req));
+
+        /* Map the data buffer */
+        sg_count = scsi_dma_map(sc);
+        if (sg_count < 0) {
+                mempool_free(io_req, fnic->io_req_pool);
+                goto out;
+        }
+
+        /* Determine the type of scatter/gather list we need */
+        io_req->sgl_cnt = sg_count;
+        io_req->sgl_type = FNIC_SGL_CACHE_DFLT;
+        if (sg_count > FNIC_DFLT_SG_DESC_CNT)
+                io_req->sgl_type = FNIC_SGL_CACHE_MAX;
+
+        if (sg_count) {
+                io_req->sgl_list =
+                        mempool_alloc(fnic->io_sgl_pool[io_req->sgl_type],
+                                      GFP_ATOMIC | GFP_DMA);
+                if (!io_req->sgl_list) {
+                        ret = SCSI_MLQUEUE_HOST_BUSY;
+                        scsi_dma_unmap(sc);
+                        mempool_free(io_req, fnic->io_req_pool);
+                        goto out;
+                }
+
+                /* Cache sgl list allocated address before alignment */
+                io_req->sgl_list_alloc = io_req->sgl_list;
+                ptr = (unsigned long) io_req->sgl_list;
+                if (ptr % FNIC_SG_DESC_ALIGN) {
+                        io_req->sgl_list = (struct host_sg_desc *)
+                                (((unsigned long) ptr
+                                  + FNIC_SG_DESC_ALIGN - 1)
+                                 & ~(FNIC_SG_DESC_ALIGN - 1));
+                }
+        }
+
+        /* initialize rest of io_req */
+        io_req->port_id = rport->port_id;
+        CMD_STATE(sc) = FNIC_IOREQ_CMD_PENDING;
+        CMD_SP(sc) = (char *)io_req;
+        sc->scsi_done = done;
+
+        /* create copy wq desc and enqueue it */
+        wq = &fnic->wq_copy[0];
+        ret = fnic_queue_wq_copy_desc(fnic, wq, io_req, sc, sg_count);
+        if (ret) {
+                /*
+                 * In case another thread cancelled the request,
+                 * refetch the pointer under the lock.
+                 */
+                spinlock_t *io_lock = fnic_io_lock_hash(fnic, sc);
+
+                spin_lock_irqsave(io_lock, flags);
+                io_req = (struct fnic_io_req *)CMD_SP(sc);
+                CMD_SP(sc) = NULL;
+                CMD_STATE(sc) = FNIC_IOREQ_CMD_COMPLETE;
+                spin_unlock_irqrestore(io_lock, flags);
+                if (io_req) {
+                        fnic_release_ioreq_buf(fnic, io_req, sc);
+                        mempool_free(io_req, fnic->io_req_pool);
+                }
+        }
+out:
+        /* acquire host lock before returning to SCSI */
+        spin_lock(lp->host->host_lock);
+        return ret;
+}
+
+/*
+ * fnic_fcpio_fw_reset_cmpl_handler
+ * Routine to handle fw reset completion
+ */
+static int fnic_fcpio_fw_reset_cmpl_handler(struct fnic *fnic,
+                                            struct fcpio_fw_req *desc)
+{
+        u8 type;
+        u8 hdr_status;
+        struct fcpio_tag tag;
+        int ret = 0;
+        struct fc_frame *flogi;
+        unsigned long flags;
+
+        fcpio_header_dec(&desc->hdr, &type, &hdr_status, &tag);
+
+        /* Clean up all outstanding io requests */
+        fnic_cleanup_io(fnic, SCSI_NO_TAG);
+
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+
+        flogi = fnic->flogi;
+        fnic->flogi = NULL;
+
+        /* fnic should be in FC_TRANS_ETH_MODE */
+        if (fnic->state == FNIC_IN_FC_TRANS_ETH_MODE) {
+                /* Check status of reset completion */
+                if (!hdr_status) {
+                        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                                      "reset cmpl success\n");
+                        /* Ready to send flogi out */
+                        fnic->state = FNIC_IN_ETH_MODE;
+                } else {
+                        FNIC_SCSI_DBG(KERN_DEBUG,
+                                      fnic->lport->host,
+                                      "fnic fw_reset : failed %s\n",
+                                      fnic_fcpio_status_to_str(hdr_status));
+
+                        /*
+                         * Unable to change to eth mode, cannot send out flogi
+                         * Change state to fc mode, so that subsequent Flogi
+                         * requests from libFC will cause more attempts to
+                         * reset the firmware. Free the cached flogi
+                         */
+                        fnic->state = FNIC_IN_FC_MODE;
+                        ret = -1;
+                }
+        } else {
+                FNIC_SCSI_DBG(KERN_DEBUG,
+                              fnic->lport->host,
+                              "Unexpected state %s while processing"
+                              " reset cmpl\n", fnic_state_to_str(fnic->state));
+                ret = -1;
+        }
+
+        /* Thread removing device blocks till firmware reset is complete */
+        if (fnic->remove_wait)
+                complete(fnic->remove_wait);
+
+        /*
+         * If fnic is being removed, or fw reset failed
+         * free the flogi frame. Else, send it out
+         */
+        if (fnic->remove_wait || ret) {
+                fnic->flogi_oxid = FC_XID_UNKNOWN;
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                if (flogi)
+                        dev_kfree_skb_irq(fp_skb(flogi));
+                goto reset_cmpl_handler_end;
+        }
+
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+        if (flogi)
+                ret = fnic_send_frame(fnic, flogi);
+
+ reset_cmpl_handler_end:
+        return ret;
+}
+
+/*
+ * fnic_fcpio_flogi_reg_cmpl_handler
+ * Routine to handle flogi register completion
+ */
+static int fnic_fcpio_flogi_reg_cmpl_handler(struct fnic *fnic,
+                                             struct fcpio_fw_req *desc)
+{
+        u8 type;
+        u8 hdr_status;
+        struct fcpio_tag tag;
+        int ret = 0;
+        struct fc_frame *flogi_resp = NULL;
+        unsigned long flags;
+        struct sk_buff *skb;
+
+        fcpio_header_dec(&desc->hdr, &type, &hdr_status, &tag);
+
+        /* Update fnic state based on status of flogi reg completion */
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+
+        flogi_resp = fnic->flogi_resp;
+        fnic->flogi_resp = NULL;
+
+        if (fnic->state == FNIC_IN_ETH_TRANS_FC_MODE) {
+
+                /* Check flogi registration completion status */
+                if (!hdr_status) {
+                        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                                      "flog reg succeeded\n");
+                        fnic->state = FNIC_IN_FC_MODE;
+                } else {
+                        FNIC_SCSI_DBG(KERN_DEBUG,
+                                      fnic->lport->host,
+                                      "fnic flogi reg :failed %s\n",
+                                      fnic_fcpio_status_to_str(hdr_status));
+                        fnic->state = FNIC_IN_ETH_MODE;
+                        ret = -1;
+                }
+        } else {
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "Unexpected fnic state %s while"
+                              " processing flogi reg completion\n",
+                              fnic_state_to_str(fnic->state));
+                ret = -1;
+        }
+
+        /* Successful flogi reg cmpl, pass frame to LibFC */
+        if (!ret && flogi_resp) {
+                if (fnic->stop_rx_link_events) {
+                        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                        goto reg_cmpl_handler_end;
+                }
+                skb = (struct sk_buff *)flogi_resp;
+                /* Use fr_flags to indicate whether flogi resp or not */
+                fr_flags(flogi_resp) = 1;
+                fr_dev(flogi_resp) = fnic->lport;
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+                skb_queue_tail(&fnic->frame_queue, skb);
+                queue_work(fnic_event_queue, &fnic->frame_work);
+
+        } else {
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                if (flogi_resp)
+                        dev_kfree_skb_irq(fp_skb(flogi_resp));
+        }
+
+reg_cmpl_handler_end:
+        return ret;
+}
+
+static inline int is_ack_index_in_range(struct vnic_wq_copy *wq,
+                                        u16 request_out)
+{
+        if (wq->to_clean_index <= wq->to_use_index) {
+                /* out of range, stale request_out index */
+                if (request_out < wq->to_clean_index ||
+                    request_out >= wq->to_use_index)
+                        return 0;
+        } else {
+                /* out of range, stale request_out index */
+                if (request_out < wq->to_clean_index &&
+                    request_out >= wq->to_use_index)
+                        return 0;
+        }
+        /* request_out index is in range */
+        return 1;
+}
+
+
+/*
+ * Mark that ack received and store the Ack index. If there are multiple
+ * acks received before Tx thread cleans it up, the latest value will be
+ * used which is correct behavior. This state should be in the copy Wq
+ * instead of in the fnic
+ */
+static inline void fnic_fcpio_ack_handler(struct fnic *fnic,
+                                          unsigned int cq_index,
+                                          struct fcpio_fw_req *desc)
+{
+        struct vnic_wq_copy *wq;
+        u16 request_out = desc->u.ack.request_out;
+        unsigned long flags;
+
+        /* mark the ack state */
+        wq = &fnic->wq_copy[cq_index - fnic->raw_wq_count - fnic->rq_count];
+        spin_lock_irqsave(&fnic->wq_copy_lock[0], flags);
+
+        if (is_ack_index_in_range(wq, request_out)) {
+                fnic->fw_ack_index[0] = request_out;
+                fnic->fw_ack_recd[0] = 1;
+        }
+        spin_unlock_irqrestore(&fnic->wq_copy_lock[0], flags);
+}
+
+/*
+ * fnic_fcpio_icmnd_cmpl_handler
+ * Routine to handle icmnd completions
+ */
+static void fnic_fcpio_icmnd_cmpl_handler(struct fnic *fnic,
+                                         struct fcpio_fw_req *desc)
+{
+        u8 type;
+        u8 hdr_status;
+        struct fcpio_tag tag;
+        u32 id;
+        u64 xfer_len = 0;
+        struct fcpio_icmnd_cmpl *icmnd_cmpl;
+        struct fnic_io_req *io_req;
+        struct scsi_cmnd *sc;
+        unsigned long flags;
+        spinlock_t *io_lock;
+
+        /* Decode the cmpl description to get the io_req id */
+        fcpio_header_dec(&desc->hdr, &type, &hdr_status, &tag);
+        fcpio_tag_id_dec(&tag, &id);
+
+        if (id >= FNIC_MAX_IO_REQ)
+                return;
+
+        sc = scsi_host_find_tag(fnic->lport->host, id);
+        WARN_ON_ONCE(!sc);
+        if (!sc)
+                return;
+
+        io_lock = fnic_io_lock_hash(fnic, sc);
+        spin_lock_irqsave(io_lock, flags);
+        io_req = (struct fnic_io_req *)CMD_SP(sc);
+        WARN_ON_ONCE(!io_req);
+        if (!io_req) {
+                spin_unlock_irqrestore(io_lock, flags);
+                return;
+        }
+
+        /* firmware completed the io */
+        io_req->io_completed = 1;
+
+        /*
+         *  if SCSI-ML has already issued abort on this command,
+         * ignore completion of the IO. The abts path will clean it up
+         */
+        if (CMD_STATE(sc) == FNIC_IOREQ_ABTS_PENDING) {
+                spin_unlock_irqrestore(io_lock, flags);
+                return;
+        }
+
+        /* Mark the IO as complete */
+        CMD_STATE(sc) = FNIC_IOREQ_CMD_COMPLETE;
+
+        icmnd_cmpl = &desc->u.icmnd_cmpl;
+
+        switch (hdr_status) {
+        case FCPIO_SUCCESS:
+                sc->result = (DID_OK << 16) | icmnd_cmpl->scsi_status;
+                xfer_len = scsi_bufflen(sc);
+                scsi_set_resid(sc, icmnd_cmpl->residual);
+
+                if (icmnd_cmpl->flags & FCPIO_ICMND_CMPL_RESID_UNDER)
+                        xfer_len -= icmnd_cmpl->residual;
+
+                /*
+                 * If queue_full, then try to reduce queue depth for all
+                 * LUNS on the target. Todo: this should be accompanied
+                 * by a periodic queue_depth rampup based on successful
+                 * IO completion.
+                 */
+                if (icmnd_cmpl->scsi_status == QUEUE_FULL) {
+                        struct scsi_device *t_sdev;
+                        int qd = 0;
+
+                        shost_for_each_device(t_sdev, sc->device->host) {
+                                if (t_sdev->id != sc->device->id)
+                                        continue;
+
+                                if (t_sdev->queue_depth > 1) {
+                                        qd = scsi_track_queue_full
+                                                (t_sdev,
+                                                 t_sdev->queue_depth - 1);
+                                        if (qd == -1)
+                                                qd = t_sdev->host->cmd_per_lun;
+                                        shost_printk(KERN_INFO,
+                                                     fnic->lport->host,
+                                                     "scsi[%d:%d:%d:%d"
+                                                     "] queue full detected,"
+                                                     "new depth = %d\n",
+                                                     t_sdev->host->host_no,
+                                                     t_sdev->channel,
+                                                     t_sdev->id, t_sdev->lun,
+                                                     t_sdev->queue_depth);
+                                }
+                        }
+                }
+                break;
+
+        case FCPIO_TIMEOUT:          /* request was timed out */
+                sc->result = (DID_TIME_OUT << 16) | icmnd_cmpl->scsi_status;
+                break;
+
+        case FCPIO_ABORTED:          /* request was aborted */
+                sc->result = (DID_ERROR << 16) | icmnd_cmpl->scsi_status;
+                break;
+
+        case FCPIO_DATA_CNT_MISMATCH: /* recv/sent more/less data than exp. */
+                scsi_set_resid(sc, icmnd_cmpl->residual);
+                sc->result = (DID_ERROR << 16) | icmnd_cmpl->scsi_status;
+                break;
+
+        case FCPIO_OUT_OF_RESOURCE:  /* out of resources to complete request */
+                sc->result = (DID_REQUEUE << 16) | icmnd_cmpl->scsi_status;
+                break;
+        case FCPIO_INVALID_HEADER:   /* header contains invalid data */
+        case FCPIO_INVALID_PARAM:    /* some parameter in request invalid */
+        case FCPIO_REQ_NOT_SUPPORTED:/* request type is not supported */
+        case FCPIO_IO_NOT_FOUND:     /* requested I/O was not found */
+        case FCPIO_SGL_INVALID:      /* request was aborted due to sgl error */
+        case FCPIO_MSS_INVALID:      /* request was aborted due to mss error */
+        case FCPIO_FW_ERR:           /* request was terminated due fw error */
+        default:
+                shost_printk(KERN_ERR, fnic->lport->host, "hdr status = %s\n",
+                             fnic_fcpio_status_to_str(hdr_status));
+                sc->result = (DID_ERROR << 16) | icmnd_cmpl->scsi_status;
+                break;
+        }
+
+        /* Break link with the SCSI command */
+        CMD_SP(sc) = NULL;
+
+        spin_unlock_irqrestore(io_lock, flags);
+
+        fnic_release_ioreq_buf(fnic, io_req, sc);
+
+        mempool_free(io_req, fnic->io_req_pool);
+
+        if (sc->sc_data_direction == DMA_FROM_DEVICE) {
+                fnic->lport->host_stats.fcp_input_requests++;
+                fnic->fcp_input_bytes += xfer_len;
+        } else if (sc->sc_data_direction == DMA_TO_DEVICE) {
+                fnic->lport->host_stats.fcp_output_requests++;
+                fnic->fcp_output_bytes += xfer_len;
+        } else
+                fnic->lport->host_stats.fcp_control_requests++;
+
+        /* Call SCSI completion function to complete the IO */
+        if (sc->scsi_done)
+                sc->scsi_done(sc);
+
+}
+
+/* fnic_fcpio_itmf_cmpl_handler
+ * Routine to handle itmf completions
+ */
+static void fnic_fcpio_itmf_cmpl_handler(struct fnic *fnic,
+                                        struct fcpio_fw_req *desc)
+{
+        u8 type;
+        u8 hdr_status;
+        struct fcpio_tag tag;
+        u32 id;
+        struct scsi_cmnd *sc;
+        struct fnic_io_req *io_req;
+        unsigned long flags;
+        spinlock_t *io_lock;
+
+        fcpio_header_dec(&desc->hdr, &type, &hdr_status, &tag);
+        fcpio_tag_id_dec(&tag, &id);
+
+        if ((id & FNIC_TAG_MASK) >= FNIC_MAX_IO_REQ)
+                return;
+
+        sc = scsi_host_find_tag(fnic->lport->host, id & FNIC_TAG_MASK);
+        WARN_ON_ONCE(!sc);
+        if (!sc)
+                return;
+
+        io_lock = fnic_io_lock_hash(fnic, sc);
+        spin_lock_irqsave(io_lock, flags);
+        io_req = (struct fnic_io_req *)CMD_SP(sc);
+        WARN_ON_ONCE(!io_req);
+        if (!io_req) {
+                spin_unlock_irqrestore(io_lock, flags);
+                return;
+        }
+
+        if (id & FNIC_TAG_ABORT) {
+                /* Completion of abort cmd */
+                if (CMD_STATE(sc) != FNIC_IOREQ_ABTS_PENDING) {
+                        /* This is a late completion. Ignore it */
+                        spin_unlock_irqrestore(io_lock, flags);
+                        return;
+                }
+                CMD_STATE(sc) = FNIC_IOREQ_ABTS_COMPLETE;
+                CMD_ABTS_STATUS(sc) = hdr_status;
+
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "abts cmpl recd. id %d status %s\n",
+                              (int)(id & FNIC_TAG_MASK),
+                              fnic_fcpio_status_to_str(hdr_status));
+
+                /*
+                 * If scsi_eh thread is blocked waiting for abts to complete,
+                 * signal completion to it. IO will be cleaned in the thread
+                 * else clean it in this context
+                 */
+                if (io_req->abts_done) {
+                        complete(io_req->abts_done);
+                        spin_unlock_irqrestore(io_lock, flags);
+                } else {
+                        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                                      "abts cmpl, completing IO\n");
+                        CMD_SP(sc) = NULL;
+                        sc->result = (DID_ERROR << 16);
+
+                        spin_unlock_irqrestore(io_lock, flags);
+
+                        fnic_release_ioreq_buf(fnic, io_req, sc);
+                        mempool_free(io_req, fnic->io_req_pool);
+                        if (sc->scsi_done)
+                                sc->scsi_done(sc);
+                }
+
+        } else if (id & FNIC_TAG_DEV_RST) {
+                /* Completion of device reset */
+                CMD_LR_STATUS(sc) = hdr_status;
+                CMD_STATE(sc) = FNIC_IOREQ_CMD_COMPLETE;
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "dev reset cmpl recd. id %d status %s\n",
+                              (int)(id & FNIC_TAG_MASK),
+                              fnic_fcpio_status_to_str(hdr_status));
+                if (io_req->dr_done)
+                        complete(io_req->dr_done);
+                spin_unlock_irqrestore(io_lock, flags);
+
+        } else {
+                shost_printk(KERN_ERR, fnic->lport->host,
+                             "Unexpected itmf io state %s tag %x\n",
+                             fnic_ioreq_state_to_str(CMD_STATE(sc)), id);
+                spin_unlock_irqrestore(io_lock, flags);
+        }
+
+}
+
+/*
+ * fnic_fcpio_cmpl_handler
+ * Routine to service the cq for wq_copy
+ */
+static int fnic_fcpio_cmpl_handler(struct vnic_dev *vdev,
+                                   unsigned int cq_index,
+                                   struct fcpio_fw_req *desc)
+{
+        struct fnic *fnic = vnic_dev_priv(vdev);
+        int ret = 0;
+
+        switch (desc->hdr.type) {
+        case FCPIO_ACK: /* fw copied copy wq desc to its queue */
+                fnic_fcpio_ack_handler(fnic, cq_index, desc);
+                break;
+
+        case FCPIO_ICMND_CMPL: /* fw completed a command */
+                fnic_fcpio_icmnd_cmpl_handler(fnic, desc);
+                break;
+
+        case FCPIO_ITMF_CMPL: /* fw completed itmf (abort cmd, lun reset)*/
+                fnic_fcpio_itmf_cmpl_handler(fnic, desc);
+                break;
+
+        case FCPIO_FLOGI_REG_CMPL: /* fw completed flogi_reg */
+                ret = fnic_fcpio_flogi_reg_cmpl_handler(fnic, desc);
+                break;
+
+        case FCPIO_RESET_CMPL: /* fw completed reset */
+                ret = fnic_fcpio_fw_reset_cmpl_handler(fnic, desc);
+                break;
+
+        default:
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "firmware completion type %d\n",
+                              desc->hdr.type);
+                break;
+        }
+
+        return ret;
+}
+
+/*
+ * fnic_wq_copy_cmpl_handler
+ * Routine to process wq copy
+ */
+int fnic_wq_copy_cmpl_handler(struct fnic *fnic, int copy_work_to_do)
+{
+        unsigned int wq_work_done = 0;
+        unsigned int i, cq_index;
+        unsigned int cur_work_done;
+
+        for (i = 0; i < fnic->wq_copy_count; i++) {
+                cq_index = i + fnic->raw_wq_count + fnic->rq_count;
+                cur_work_done = vnic_cq_copy_service(&fnic->cq[cq_index],
+                                                     fnic_fcpio_cmpl_handler,
+                                                     copy_work_to_do);
+                wq_work_done += cur_work_done;
+        }
+        return wq_work_done;
+}
+
+static void fnic_cleanup_io(struct fnic *fnic, int exclude_id)
+{
+        unsigned int i;
+        struct fnic_io_req *io_req;
+        unsigned long flags = 0;
+        struct scsi_cmnd *sc;
+        spinlock_t *io_lock;
+
+        for (i = 0; i < FNIC_MAX_IO_REQ; i++) {
+                if (i == exclude_id)
+                        continue;
+
+                sc = scsi_host_find_tag(fnic->lport->host, i);
+                if (!sc)
+                        continue;
+
+                io_lock = fnic_io_lock_hash(fnic, sc);
+                spin_lock_irqsave(io_lock, flags);
+                io_req = (struct fnic_io_req *)CMD_SP(sc);
+                if (!io_req) {
+                        spin_unlock_irqrestore(io_lock, flags);
+                        goto cleanup_scsi_cmd;
+                }
+
+                CMD_SP(sc) = NULL;
+
+                spin_unlock_irqrestore(io_lock, flags);
+
+                /*
+                 * If there is a scsi_cmnd associated with this io_req, then
+                 * free the corresponding state
+                 */
+                fnic_release_ioreq_buf(fnic, io_req, sc);
+                mempool_free(io_req, fnic->io_req_pool);
+
+cleanup_scsi_cmd:
+                sc->result = DID_TRANSPORT_DISRUPTED << 16;
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host, "fnic_cleanup_io:"
+                              " DID_TRANSPORT_DISRUPTED\n");
+
+                /* Complete the command to SCSI */
+                if (sc->scsi_done)
+                        sc->scsi_done(sc);
+        }
+}
+
+void fnic_wq_copy_cleanup_handler(struct vnic_wq_copy *wq,
+                                  struct fcpio_host_req *desc)
+{
+        u32 id;
+        struct fnic *fnic = vnic_dev_priv(wq->vdev);
+        struct fnic_io_req *io_req;
+        struct scsi_cmnd *sc;
+        unsigned long flags;
+        spinlock_t *io_lock;
+
+        /* get the tag reference */
+        fcpio_tag_id_dec(&desc->hdr.tag, &id);
+        id &= FNIC_TAG_MASK;
+
+        if (id >= FNIC_MAX_IO_REQ)
+                return;
+
+        sc = scsi_host_find_tag(fnic->lport->host, id);
+        if (!sc)
+                return;
+
+        io_lock = fnic_io_lock_hash(fnic, sc);
+        spin_lock_irqsave(io_lock, flags);
+
+        /* Get the IO context which this desc refers to */
+        io_req = (struct fnic_io_req *)CMD_SP(sc);
+
+        /* fnic interrupts are turned off by now */
+
+        if (!io_req) {
+                spin_unlock_irqrestore(io_lock, flags);
+                goto wq_copy_cleanup_scsi_cmd;
+        }
+
+        CMD_SP(sc) = NULL;
+
+        spin_unlock_irqrestore(io_lock, flags);
+
+        fnic_release_ioreq_buf(fnic, io_req, sc);
+        mempool_free(io_req, fnic->io_req_pool);
+
+wq_copy_cleanup_scsi_cmd:
+        sc->result = DID_NO_CONNECT << 16;
+        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host, "wq_copy_cleanup_handler:"
+                      " DID_NO_CONNECT\n");
+
+        if (sc->scsi_done)
+                sc->scsi_done(sc);
+}
+
+static inline int fnic_queue_abort_io_req(struct fnic *fnic, int tag,
+                                          u32 task_req, u8 *fc_lun,
+                                          struct fnic_io_req *io_req)
+{
+        struct vnic_wq_copy *wq = &fnic->wq_copy[0];
+        unsigned long flags;
+
+        spin_lock_irqsave(&fnic->wq_copy_lock[0], flags);
+
+        if (vnic_wq_copy_desc_avail(wq) <= fnic->wq_copy_desc_low[0])
+                free_wq_copy_descs(fnic, wq);
+
+        if (!vnic_wq_copy_desc_avail(wq)) {
+                spin_unlock_irqrestore(&fnic->wq_copy_lock[0], flags);
+                return 1;
+        }
+        fnic_queue_wq_copy_desc_itmf(wq, tag | FNIC_TAG_ABORT,
+                                     0, task_req, tag, fc_lun, io_req->port_id,
+                                     fnic->config.ra_tov, fnic->config.ed_tov);
+
+        spin_unlock_irqrestore(&fnic->wq_copy_lock[0], flags);
+        return 0;
+}
+
+void fnic_rport_exch_reset(struct fnic *fnic, u32 port_id)
+{
+        int tag;
+        struct fnic_io_req *io_req;
+        spinlock_t *io_lock;
+        unsigned long flags;
+        struct scsi_cmnd *sc;
+        struct scsi_lun fc_lun;
+        enum fnic_ioreq_state old_ioreq_state;
+
+        FNIC_SCSI_DBG(KERN_DEBUG,
+                      fnic->lport->host,
+                      "fnic_rport_reset_exch called portid 0x%06x\n",
+                      port_id);
+
+        if (fnic->in_remove)
+                return;
+
+        for (tag = 0; tag < FNIC_MAX_IO_REQ; tag++) {
+                sc = scsi_host_find_tag(fnic->lport->host, tag);
+                if (!sc)
+                        continue;
+
+                io_lock = fnic_io_lock_hash(fnic, sc);
+                spin_lock_irqsave(io_lock, flags);
+
+                io_req = (struct fnic_io_req *)CMD_SP(sc);
+
+                if (!io_req || io_req->port_id != port_id) {
+                        spin_unlock_irqrestore(io_lock, flags);
+                        continue;
+                }
+
+                /*
+                 * Found IO that is still pending with firmware and
+                 * belongs to rport that went away
+                 */
+                if (CMD_STATE(sc) == FNIC_IOREQ_ABTS_PENDING) {
+                        spin_unlock_irqrestore(io_lock, flags);
+                        continue;
+                }
+                old_ioreq_state = CMD_STATE(sc);
+                CMD_STATE(sc) = FNIC_IOREQ_ABTS_PENDING;
+                CMD_ABTS_STATUS(sc) = FCPIO_INVALID_CODE;
+
+                BUG_ON(io_req->abts_done);
+
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "fnic_rport_reset_exch: Issuing abts\n");
+
+                spin_unlock_irqrestore(io_lock, flags);
+
+                /* Now queue the abort command to firmware */
+                int_to_scsilun(sc->device->lun, &fc_lun);
+
+                if (fnic_queue_abort_io_req(fnic, tag,
+                                            FCPIO_ITMF_ABT_TASK_TERM,
+                                            fc_lun.scsi_lun, io_req)) {
+                        /*
+                         * Revert the cmd state back to old state, if
+                         * it hasnt changed in between. This cmd will get
+                         * aborted later by scsi_eh, or cleaned up during
+                         * lun reset
+                         */
+                        io_lock = fnic_io_lock_hash(fnic, sc);
+
+                        spin_lock_irqsave(io_lock, flags);
+                        if (CMD_STATE(sc) == FNIC_IOREQ_ABTS_PENDING)
+                                CMD_STATE(sc) = old_ioreq_state;
+                        spin_unlock_irqrestore(io_lock, flags);
+                }
+        }
+
+}
+
+void fnic_terminate_rport_io(struct fc_rport *rport)
+{
+        int tag;
+        struct fnic_io_req *io_req;
+        spinlock_t *io_lock;
+        unsigned long flags;
+        struct scsi_cmnd *sc;
+        struct scsi_lun fc_lun;
+        struct fc_rport_libfc_priv *rdata = rport->dd_data;
+        struct fc_lport *lport = rdata->local_port;
+        struct fnic *fnic = lport_priv(lport);
+        struct fc_rport *cmd_rport;
+        enum fnic_ioreq_state old_ioreq_state;
+
+        FNIC_SCSI_DBG(KERN_DEBUG,
+                      fnic->lport->host, "fnic_terminate_rport_io called"
+                      " wwpn 0x%llx, wwnn0x%llx, portid 0x%06x\n",
+                      rport->port_name, rport->node_name,
+                      rport->port_id);
+
+        if (fnic->in_remove)
+                return;
+
+        for (tag = 0; tag < FNIC_MAX_IO_REQ; tag++) {
+                sc = scsi_host_find_tag(fnic->lport->host, tag);
+                if (!sc)
+                        continue;
+
+                cmd_rport = starget_to_rport(scsi_target(sc->device));
+                if (rport != cmd_rport)
+                        continue;
+
+                io_lock = fnic_io_lock_hash(fnic, sc);
+                spin_lock_irqsave(io_lock, flags);
+
+                io_req = (struct fnic_io_req *)CMD_SP(sc);
+
+                if (!io_req || rport != cmd_rport) {
+                        spin_unlock_irqrestore(io_lock, flags);
+                        continue;
+                }
+
+                /*
+                 * Found IO that is still pending with firmware and
+                 * belongs to rport that went away
+                 */
+                if (CMD_STATE(sc) == FNIC_IOREQ_ABTS_PENDING) {
+                        spin_unlock_irqrestore(io_lock, flags);
+                        continue;
+                }
+                old_ioreq_state = CMD_STATE(sc);
+                CMD_STATE(sc) = FNIC_IOREQ_ABTS_PENDING;
+                CMD_ABTS_STATUS(sc) = FCPIO_INVALID_CODE;
+
+                BUG_ON(io_req->abts_done);
+
+                FNIC_SCSI_DBG(KERN_DEBUG,
+                              fnic->lport->host,
+                              "fnic_terminate_rport_io: Issuing abts\n");
+
+                spin_unlock_irqrestore(io_lock, flags);
+
+                /* Now queue the abort command to firmware */
+                int_to_scsilun(sc->device->lun, &fc_lun);
+
+                if (fnic_queue_abort_io_req(fnic, tag,
+                                            FCPIO_ITMF_ABT_TASK_TERM,
+                                            fc_lun.scsi_lun, io_req)) {
+                        /*
+                         * Revert the cmd state back to old state, if
+                         * it hasnt changed in between. This cmd will get
+                         * aborted later by scsi_eh, or cleaned up during
+                         * lun reset
+                         */
+                        io_lock = fnic_io_lock_hash(fnic, sc);
+
+                        spin_lock_irqsave(io_lock, flags);
+                        if (CMD_STATE(sc) == FNIC_IOREQ_ABTS_PENDING)
+                                CMD_STATE(sc) = old_ioreq_state;
+                        spin_unlock_irqrestore(io_lock, flags);
+                }
+        }
+
+}
+
+static void fnic_block_error_handler(struct scsi_cmnd *sc)
+{
+        struct Scsi_Host *shost = sc->device->host;
+        struct fc_rport *rport = starget_to_rport(scsi_target(sc->device));
+        unsigned long flags;
+
+        spin_lock_irqsave(shost->host_lock, flags);
+        while (rport->port_state == FC_PORTSTATE_BLOCKED) {
+                spin_unlock_irqrestore(shost->host_lock, flags);
+                msleep(1000);
+                spin_lock_irqsave(shost->host_lock, flags);
+        }
+        spin_unlock_irqrestore(shost->host_lock, flags);
+
+}
+
+/*
+ * This function is exported to SCSI for sending abort cmnds.
+ * A SCSI IO is represented by a io_req in the driver.
+ * The ioreq is linked to the SCSI Cmd, thus a link with the ULP's IO.
+ */
+int fnic_abort_cmd(struct scsi_cmnd *sc)
+{
+        struct fc_lport *lp;
+        struct fnic *fnic;
+        struct fnic_io_req *io_req;
+        struct fc_rport *rport;
+        spinlock_t *io_lock;
+        unsigned long flags;
+        int ret = SUCCESS;
+        u32 task_req;
+        struct scsi_lun fc_lun;
+        DECLARE_COMPLETION_ONSTACK(tm_done);
+
+        /* Wait for rport to unblock */
+        fnic_block_error_handler(sc);
+
+        /* Get local-port, check ready and link up */
+        lp = shost_priv(sc->device->host);
+
+        fnic = lport_priv(lp);
+        FNIC_SCSI_DBG(KERN_DEBUG,
+                      fnic->lport->host,
+                      "Abort Cmd called FCID 0x%x, LUN 0x%x TAG %d\n",
+                      (starget_to_rport(scsi_target(sc->device)))->port_id,
+                      sc->device->lun, sc->request->tag);
+
+        if (lp->state != LPORT_ST_READY || !(lp->link_up)) {
+                ret = FAILED;
+                goto fnic_abort_cmd_end;
+        }
+
+        /*
+         * Avoid a race between SCSI issuing the abort and the device
+         * completing the command.
+         *
+         * If the command is already completed by the fw cmpl code,
+         * we just return SUCCESS from here. This means that the abort
+         * succeeded. In the SCSI ML, since the timeout for command has
+         * happened, the completion wont actually complete the command
+         * and it will be considered as an aborted command
+         *
+         * The CMD_SP will not be cleared except while holding io_req_lock.
+         */
+        io_lock = fnic_io_lock_hash(fnic, sc);
+        spin_lock_irqsave(io_lock, flags);
+        io_req = (struct fnic_io_req *)CMD_SP(sc);
+        if (!io_req) {
+                spin_unlock_irqrestore(io_lock, flags);
+                goto fnic_abort_cmd_end;
+        }
+
+        io_req->abts_done = &tm_done;
+
+        if (CMD_STATE(sc) == FNIC_IOREQ_ABTS_PENDING) {
+                spin_unlock_irqrestore(io_lock, flags);
+                goto wait_pending;
+        }
+        /*
+         * Command is still pending, need to abort it
+         * If the firmware completes the command after this point,
+         * the completion wont be done till mid-layer, since abort
+         * has already started.
+         */
+        CMD_STATE(sc) = FNIC_IOREQ_ABTS_PENDING;
+        CMD_ABTS_STATUS(sc) = FCPIO_INVALID_CODE;
+
+        spin_unlock_irqrestore(io_lock, flags);
+
+        /*
+         * Check readiness of the remote port. If the path to remote
+         * port is up, then send abts to the remote port to terminate
+         * the IO. Else, just locally terminate the IO in the firmware
+         */
+        rport = starget_to_rport(scsi_target(sc->device));
+        if (fc_remote_port_chkready(rport) == 0)
+                task_req = FCPIO_ITMF_ABT_TASK;
+        else
+                task_req = FCPIO_ITMF_ABT_TASK_TERM;
+
+        /* Now queue the abort command to firmware */
+        int_to_scsilun(sc->device->lun, &fc_lun);
+
+        if (fnic_queue_abort_io_req(fnic, sc->request->tag, task_req,
+                                    fc_lun.scsi_lun, io_req)) {
+                spin_lock_irqsave(io_lock, flags);
+                io_req = (struct fnic_io_req *)CMD_SP(sc);
+                if (io_req)
+                        io_req->abts_done = NULL;
+                spin_unlock_irqrestore(io_lock, flags);
+                ret = FAILED;
+                goto fnic_abort_cmd_end;
+        }
+
+        /*
+         * We queued an abort IO, wait for its completion.
+         * Once the firmware completes the abort command, it will
+         * wake up this thread.
+         */
+ wait_pending:
+        wait_for_completion_timeout(&tm_done,
+                                    msecs_to_jiffies
+                                    (2 * fnic->config.ra_tov +
+                                     fnic->config.ed_tov));
+
+        /* Check the abort status */
+        spin_lock_irqsave(io_lock, flags);
+
+        io_req = (struct fnic_io_req *)CMD_SP(sc);
+        if (!io_req) {
+                spin_unlock_irqrestore(io_lock, flags);
+                ret = FAILED;
+                goto fnic_abort_cmd_end;
+        }
+        io_req->abts_done = NULL;
+
+        /* fw did not complete abort, timed out */
+        if (CMD_STATE(sc) == FNIC_IOREQ_ABTS_PENDING) {
+                spin_unlock_irqrestore(io_lock, flags);
+                ret = FAILED;
+                goto fnic_abort_cmd_end;
+        }
+
+        /*
+         * firmware completed the abort, check the status,
+         * free the io_req irrespective of failure or success
+         */
+        if (CMD_ABTS_STATUS(sc) != FCPIO_SUCCESS)
+                ret = FAILED;
+
+        CMD_SP(sc) = NULL;
+
+        spin_unlock_irqrestore(io_lock, flags);
+
+        fnic_release_ioreq_buf(fnic, io_req, sc);
+        mempool_free(io_req, fnic->io_req_pool);
+
+fnic_abort_cmd_end:
+        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                      "Returning from abort cmd %s\n",
+                      (ret == SUCCESS) ?
+                      "SUCCESS" : "FAILED");
+        return ret;
+}
+
+static inline int fnic_queue_dr_io_req(struct fnic *fnic,
+                                       struct scsi_cmnd *sc,
+                                       struct fnic_io_req *io_req)
+{
+        struct vnic_wq_copy *wq = &fnic->wq_copy[0];
+        struct scsi_lun fc_lun;
+        int ret = 0;
+        unsigned long intr_flags;
+
+        spin_lock_irqsave(&fnic->wq_copy_lock[0], intr_flags);
+
+        if (vnic_wq_copy_desc_avail(wq) <= fnic->wq_copy_desc_low[0])
+                free_wq_copy_descs(fnic, wq);
+
+        if (!vnic_wq_copy_desc_avail(wq)) {
+                ret = -EAGAIN;
+                goto lr_io_req_end;
+        }
+
+        /* fill in the lun info */
+        int_to_scsilun(sc->device->lun, &fc_lun);
+
+        fnic_queue_wq_copy_desc_itmf(wq, sc->request->tag | FNIC_TAG_DEV_RST,
+                                     0, FCPIO_ITMF_LUN_RESET, SCSI_NO_TAG,
+                                     fc_lun.scsi_lun, io_req->port_id,
+                                     fnic->config.ra_tov, fnic->config.ed_tov);
+
+lr_io_req_end:
+        spin_unlock_irqrestore(&fnic->wq_copy_lock[0], intr_flags);
+
+        return ret;
+}
+
+/*
+ * Clean up any pending aborts on the lun
+ * For each outstanding IO on this lun, whose abort is not completed by fw,
+ * issue a local abort. Wait for abort to complete. Return 0 if all commands
+ * successfully aborted, 1 otherwise
+ */
+static int fnic_clean_pending_aborts(struct fnic *fnic,
+                                     struct scsi_cmnd *lr_sc)
+{
+        int tag;
+        struct fnic_io_req *io_req;
+        spinlock_t *io_lock;
+        unsigned long flags;
+        int ret = 0;
+        struct scsi_cmnd *sc;
+        struct fc_rport *rport;
+        struct scsi_lun fc_lun;
+        struct scsi_device *lun_dev = lr_sc->device;
+        DECLARE_COMPLETION_ONSTACK(tm_done);
+
+        for (tag = 0; tag < FNIC_MAX_IO_REQ; tag++) {
+                sc = scsi_host_find_tag(fnic->lport->host, tag);
+                /*
+                 * ignore this lun reset cmd or cmds that do not belong to
+                 * this lun
+                 */
+                if (!sc || sc == lr_sc || sc->device != lun_dev)
+                        continue;
+
+                io_lock = fnic_io_lock_hash(fnic, sc);
+                spin_lock_irqsave(io_lock, flags);
+
+                io_req = (struct fnic_io_req *)CMD_SP(sc);
+
+                if (!io_req || sc->device != lun_dev) {
+                        spin_unlock_irqrestore(io_lock, flags);
+                        continue;
+                }
+
+                /*
+                 * Found IO that is still pending with firmware and
+                 * belongs to the LUN that we are resetting
+                 */
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "Found IO in %s on lun\n",
+                              fnic_ioreq_state_to_str(CMD_STATE(sc)));
+
+                BUG_ON(CMD_STATE(sc) != FNIC_IOREQ_ABTS_PENDING);
+
+                CMD_ABTS_STATUS(sc) = FCPIO_INVALID_CODE;
+                io_req->abts_done = &tm_done;
+                spin_unlock_irqrestore(io_lock, flags);
+
+                /* Now queue the abort command to firmware */
+                int_to_scsilun(sc->device->lun, &fc_lun);
+                rport = starget_to_rport(scsi_target(sc->device));
+
+                if (fnic_queue_abort_io_req(fnic, tag,
+                                            FCPIO_ITMF_ABT_TASK_TERM,
+                                            fc_lun.scsi_lun, io_req)) {
+                        spin_lock_irqsave(io_lock, flags);
+                        io_req = (struct fnic_io_req *)CMD_SP(sc);
+                        if (io_req)
+                                io_req->abts_done = NULL;
+                        spin_unlock_irqrestore(io_lock, flags);
+                        ret = 1;
+                        goto clean_pending_aborts_end;
+                }
+
+                wait_for_completion_timeout(&tm_done,
+                                            msecs_to_jiffies
+                                            (fnic->config.ed_tov));
+
+                /* Recheck cmd state to check if it is now aborted */
+                spin_lock_irqsave(io_lock, flags);
+                io_req = (struct fnic_io_req *)CMD_SP(sc);
+                if (!io_req) {
+                        spin_unlock_irqrestore(io_lock, flags);
+                        ret = 1;
+                        goto clean_pending_aborts_end;
+                }
+
+                io_req->abts_done = NULL;
+
+                /* if abort is still pending with fw, fail */
+                if (CMD_STATE(sc) == FNIC_IOREQ_ABTS_PENDING) {
+                        spin_unlock_irqrestore(io_lock, flags);
+                        ret = 1;
+                        goto clean_pending_aborts_end;
+                }
+                CMD_SP(sc) = NULL;
+                spin_unlock_irqrestore(io_lock, flags);
+
+                fnic_release_ioreq_buf(fnic, io_req, sc);
+                mempool_free(io_req, fnic->io_req_pool);
+        }
+
+clean_pending_aborts_end:
+        return ret;
+}
+
+/*
+ * SCSI Eh thread issues a Lun Reset when one or more commands on a LUN
+ * fail to get aborted. It calls driver's eh_device_reset with a SCSI command
+ * on the LUN.
+ */
+int fnic_device_reset(struct scsi_cmnd *sc)
+{
+        struct fc_lport *lp;
+        struct fnic *fnic;
+        struct fnic_io_req *io_req;
+        struct fc_rport *rport;
+        int status;
+        int ret = FAILED;
+        spinlock_t *io_lock;
+        unsigned long flags;
+        DECLARE_COMPLETION_ONSTACK(tm_done);
+
+        /* Wait for rport to unblock */
+        fnic_block_error_handler(sc);
+
+        /* Get local-port, check ready and link up */
+        lp = shost_priv(sc->device->host);
+
+        fnic = lport_priv(lp);
+        FNIC_SCSI_DBG(KERN_DEBUG,
+                      fnic->lport->host,
+                      "Device reset called FCID 0x%x, LUN 0x%x\n",
+                      (starget_to_rport(scsi_target(sc->device)))->port_id,
+                      sc->device->lun);
+
+
+        if (lp->state != LPORT_ST_READY || !(lp->link_up))
+                goto fnic_device_reset_end;
+
+        /* Check if remote port up */
+        rport = starget_to_rport(scsi_target(sc->device));
+        if (fc_remote_port_chkready(rport))
+                goto fnic_device_reset_end;
+
+        io_lock = fnic_io_lock_hash(fnic, sc);
+        spin_lock_irqsave(io_lock, flags);
+        io_req = (struct fnic_io_req *)CMD_SP(sc);
+
+        /*
+         * If there is a io_req attached to this command, then use it,
+         * else allocate a new one.
+         */
+        if (!io_req) {
+                io_req = mempool_alloc(fnic->io_req_pool, GFP_ATOMIC);
+                if (!io_req) {
+                        spin_unlock_irqrestore(io_lock, flags);
+                        goto fnic_device_reset_end;
+                }
+                memset(io_req, 0, sizeof(*io_req));
+                io_req->port_id = rport->port_id;
+                CMD_SP(sc) = (char *)io_req;
+        }
+        io_req->dr_done = &tm_done;
+        CMD_STATE(sc) = FNIC_IOREQ_CMD_PENDING;
+        CMD_LR_STATUS(sc) = FCPIO_INVALID_CODE;
+        spin_unlock_irqrestore(io_lock, flags);
+
+        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host, "TAG %d\n",
+                      sc->request->tag);
+
+        /*
+         * issue the device reset, if enqueue failed, clean up the ioreq
+         * and break assoc with scsi cmd
+         */
+        if (fnic_queue_dr_io_req(fnic, sc, io_req)) {
+                spin_lock_irqsave(io_lock, flags);
+                io_req = (struct fnic_io_req *)CMD_SP(sc);
+                if (io_req)
+                        io_req->dr_done = NULL;
+                goto fnic_device_reset_clean;
+        }
+
+        /*
+         * Wait on the local completion for LUN reset.  The io_req may be
+         * freed while we wait since we hold no lock.
+         */
+        wait_for_completion_timeout(&tm_done,
+                                    msecs_to_jiffies(FNIC_LUN_RESET_TIMEOUT));
+
+        spin_lock_irqsave(io_lock, flags);
+        io_req = (struct fnic_io_req *)CMD_SP(sc);
+        if (!io_req) {
+                spin_unlock_irqrestore(io_lock, flags);
+                goto fnic_device_reset_end;
+        }
+        io_req->dr_done = NULL;
+
+        status = CMD_LR_STATUS(sc);
+        spin_unlock_irqrestore(io_lock, flags);
+
+        /*
+         * If lun reset not completed, bail out with failed. io_req
+         * gets cleaned up during higher levels of EH
+         */
+        if (status == FCPIO_INVALID_CODE) {
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "Device reset timed out\n");
+                goto fnic_device_reset_end;
+        }
+
+        /* Completed, but not successful, clean up the io_req, return fail */
+        if (status != FCPIO_SUCCESS) {
+                spin_lock_irqsave(io_lock, flags);
+                FNIC_SCSI_DBG(KERN_DEBUG,
+                              fnic->lport->host,
+                              "Device reset completed - failed\n");
+                io_req = (struct fnic_io_req *)CMD_SP(sc);
+                goto fnic_device_reset_clean;
+        }
+
+        /*
+         * Clean up any aborts on this lun that have still not
+         * completed. If any of these fail, then LUN reset fails.
+         * clean_pending_aborts cleans all cmds on this lun except
+         * the lun reset cmd. If all cmds get cleaned, the lun reset
+         * succeeds
+         */
+        if (fnic_clean_pending_aborts(fnic, sc)) {
+                spin_lock_irqsave(io_lock, flags);
+                io_req = (struct fnic_io_req *)CMD_SP(sc);
+                FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                              "Device reset failed"
+                              " since could not abort all IOs\n");
+                goto fnic_device_reset_clean;
+        }
+
+        /* Clean lun reset command */
+        spin_lock_irqsave(io_lock, flags);
+        io_req = (struct fnic_io_req *)CMD_SP(sc);
+        if (io_req)
+                /* Completed, and successful */
+                ret = SUCCESS;
+
+fnic_device_reset_clean:
+        if (io_req)
+                CMD_SP(sc) = NULL;
+
+        spin_unlock_irqrestore(io_lock, flags);
+
+        if (io_req) {
+                fnic_release_ioreq_buf(fnic, io_req, sc);
+                mempool_free(io_req, fnic->io_req_pool);
+        }
+
+fnic_device_reset_end:
+        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                      "Returning from device reset %s\n",
+                      (ret == SUCCESS) ?
+                      "SUCCESS" : "FAILED");
+        return ret;
+}
+
+/* Clean up all IOs, clean up libFC local port */
+int fnic_reset(struct Scsi_Host *shost)
+{
+        struct fc_lport *lp;
+        struct fnic *fnic;
+        int ret = SUCCESS;
+
+        lp = shost_priv(shost);
+        fnic = lport_priv(lp);
+
+        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                      "fnic_reset called\n");
+
+        /*
+         * Reset local port, this will clean up libFC exchanges,
+         * reset remote port sessions, and if link is up, begin flogi
+         */
+        if (lp->tt.lport_reset(lp))
+                ret = FAILED;
+
+        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                      "Returning from fnic reset %s\n",
+                      (ret == SUCCESS) ?
+                      "SUCCESS" : "FAILED");
+
+        return ret;
+}
+
+/*
+ * SCSI Error handling calls driver's eh_host_reset if all prior
+ * error handling levels return FAILED. If host reset completes
+ * successfully, and if link is up, then Fabric login begins.
+ *
+ * Host Reset is the highest level of error recovery. If this fails, then
+ * host is offlined by SCSI.
+ *
+ */
+int fnic_host_reset(struct scsi_cmnd *sc)
+{
+        int ret;
+        unsigned long wait_host_tmo;
+        struct Scsi_Host *shost = sc->device->host;
+        struct fc_lport *lp = shost_priv(shost);
+
+        /*
+         * If fnic_reset is successful, wait for fabric login to complete
+         * scsi-ml tries to send a TUR to every device if host reset is
+         * successful, so before returning to scsi, fabric should be up
+         */
+        ret = fnic_reset(shost);
+        if (ret == SUCCESS) {
+                wait_host_tmo = jiffies + FNIC_HOST_RESET_SETTLE_TIME * HZ;
+                ret = FAILED;
+                while (time_before(jiffies, wait_host_tmo)) {
+                        if ((lp->state == LPORT_ST_READY) &&
+                            (lp->link_up)) {
+                                ret = SUCCESS;
+                                break;
+                        }
+                        ssleep(1);
+                }
+        }
+
+        return ret;
+}
+
+/*
+ * This fxn is called from libFC when host is removed
+ */
+void fnic_scsi_abort_io(struct fc_lport *lp)
+{
+        int err = 0;
+        unsigned long flags;
+        enum fnic_state old_state;
+        struct fnic *fnic = lport_priv(lp);
+        DECLARE_COMPLETION_ONSTACK(remove_wait);
+
+        /* Issue firmware reset for fnic, wait for reset to complete */
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+        fnic->remove_wait = &remove_wait;
+        old_state = fnic->state;
+        fnic->state = FNIC_IN_FC_TRANS_ETH_MODE;
+        vnic_dev_del_addr(fnic->vdev, fnic->data_src_addr);
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+        err = fnic_fw_reset_handler(fnic);
+        if (err) {
+                spin_lock_irqsave(&fnic->fnic_lock, flags);
+                if (fnic->state == FNIC_IN_FC_TRANS_ETH_MODE)
+                        fnic->state = old_state;
+                fnic->remove_wait = NULL;
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+                return;
+        }
+
+        /* Wait for firmware reset to complete */
+        wait_for_completion_timeout(&remove_wait,
+                                    msecs_to_jiffies(FNIC_RMDEVICE_TIMEOUT));
+
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+        fnic->remove_wait = NULL;
+        FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+                      "fnic_scsi_abort_io %s\n",
+                      (fnic->state == FNIC_IN_ETH_MODE) ?
+                      "SUCCESS" : "FAILED");
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+}
+
+/*
+ * This fxn called from libFC to clean up driver IO state on link down
+ */
+void fnic_scsi_cleanup(struct fc_lport *lp)
+{
+        unsigned long flags;
+        enum fnic_state old_state;
+        struct fnic *fnic = lport_priv(lp);
+
+        /* issue fw reset */
+        spin_lock_irqsave(&fnic->fnic_lock, flags);
+        old_state = fnic->state;
+        fnic->state = FNIC_IN_FC_TRANS_ETH_MODE;
+        vnic_dev_del_addr(fnic->vdev, fnic->data_src_addr);
+        spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+        if (fnic_fw_reset_handler(fnic)) {
+                spin_lock_irqsave(&fnic->fnic_lock, flags);
+                if (fnic->state == FNIC_IN_FC_TRANS_ETH_MODE)
+                        fnic->state = old_state;
+                spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+        }
+
+}
+
+void fnic_empty_scsi_cleanup(struct fc_lport *lp)
+{
+}
+
+void fnic_exch_mgr_reset(struct fc_lport *lp, u32 sid, u32 did)
+{
+        struct fnic *fnic = lport_priv(lp);
+
+        /* Non-zero sid, nothing to do */
+        if (sid)
+                goto call_fc_exch_mgr_reset;
+
+        if (did) {
+                fnic_rport_exch_reset(fnic, did);
+                goto call_fc_exch_mgr_reset;
+        }
+
+        /*
+         * sid = 0, did = 0
+         * link down or device being removed
+         */
+        if (!fnic->in_remove)
+                fnic_scsi_cleanup(lp);
+        else
+                fnic_scsi_abort_io(lp);
+
+        /* call libFC exch mgr reset to reset its exchanges */
+call_fc_exch_mgr_reset:
+        fc_exch_mgr_reset(lp, sid, did);
+
+}
diff --git a/drivers/scsi/fnic/rq_enet_desc.h b/drivers/scsi/fnic/rq_enet_desc.h
new file mode 100644
index 00000000000..92e80ae6b72
--- /dev/null
+++ b/drivers/scsi/fnic/rq_enet_desc.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _RQ_ENET_DESC_H_
+#define _RQ_ENET_DESC_H_
+
+/* Ethernet receive queue descriptor: 16B */
+struct rq_enet_desc {
+        __le64 address;
+        __le16 length_type;
+        u8 reserved[6];
+};
+
+enum rq_enet_type_types {
+        RQ_ENET_TYPE_ONLY_SOP = 0,
+        RQ_ENET_TYPE_NOT_SOP = 1,
+        RQ_ENET_TYPE_RESV2 = 2,
+        RQ_ENET_TYPE_RESV3 = 3,
+};
+
+#define RQ_ENET_ADDR_BITS               64
+#define RQ_ENET_LEN_BITS                14
+#define RQ_ENET_LEN_MASK                ((1 << RQ_ENET_LEN_BITS) - 1)
+#define RQ_ENET_TYPE_BITS               2
+#define RQ_ENET_TYPE_MASK               ((1 << RQ_ENET_TYPE_BITS) - 1)
+
+static inline void rq_enet_desc_enc(struct rq_enet_desc *desc,
+        u64 address, u8 type, u16 length)
+{
+        desc->address = cpu_to_le64(address);
+        desc->length_type = cpu_to_le16((length & RQ_ENET_LEN_MASK) |
+                ((type & RQ_ENET_TYPE_MASK) << RQ_ENET_LEN_BITS));
+}
+
+static inline void rq_enet_desc_dec(struct rq_enet_desc *desc,
+        u64 *address, u8 *type, u16 *length)
+{
+        *address = le64_to_cpu(desc->address);
+        *length = le16_to_cpu(desc->length_type) & RQ_ENET_LEN_MASK;
+        *type = (u8)((le16_to_cpu(desc->length_type) >> RQ_ENET_LEN_BITS) &
+                RQ_ENET_TYPE_MASK);
+}
+
+#endif /* _RQ_ENET_DESC_H_ */
diff --git a/drivers/scsi/fnic/vnic_cq.c b/drivers/scsi/fnic/vnic_cq.c
new file mode 100644
index 00000000000..c5db32eda5e
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_cq.c
@@ -0,0 +1,85 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include "vnic_dev.h"
+#include "vnic_cq.h"
+
+void vnic_cq_free(struct vnic_cq *cq)
+{
+        vnic_dev_free_desc_ring(cq->vdev, &cq->ring);
+
+        cq->ctrl = NULL;
+}
+
+int vnic_cq_alloc(struct vnic_dev *vdev, struct vnic_cq *cq, unsigned int index,
+        unsigned int desc_count, unsigned int desc_size)
+{
+        int err;
+
+        cq->index = index;
+        cq->vdev = vdev;
+
+        cq->ctrl = vnic_dev_get_res(vdev, RES_TYPE_CQ, index);
+        if (!cq->ctrl) {
+                printk(KERN_ERR "Failed to hook CQ[%d] resource\n", index);
+                return -EINVAL;
+        }
+
+        err = vnic_dev_alloc_desc_ring(vdev, &cq->ring, desc_count, desc_size);
+        if (err)
+                return err;
+
+        return 0;
+}
+
+void vnic_cq_init(struct vnic_cq *cq, unsigned int flow_control_enable,
+        unsigned int color_enable, unsigned int cq_head, unsigned int cq_tail,
+        unsigned int cq_tail_color, unsigned int interrupt_enable,
+        unsigned int cq_entry_enable, unsigned int cq_message_enable,
+        unsigned int interrupt_offset, u64 cq_message_addr)
+{
+        u64 paddr;
+
+        paddr = (u64)cq->ring.base_addr | VNIC_PADDR_TARGET;
+        writeq(paddr, &cq->ctrl->ring_base);
+        iowrite32(cq->ring.desc_count, &cq->ctrl->ring_size);
+        iowrite32(flow_control_enable, &cq->ctrl->flow_control_enable);
+        iowrite32(color_enable, &cq->ctrl->color_enable);
+        iowrite32(cq_head, &cq->ctrl->cq_head);
+        iowrite32(cq_tail, &cq->ctrl->cq_tail);
+        iowrite32(cq_tail_color, &cq->ctrl->cq_tail_color);
+        iowrite32(interrupt_enable, &cq->ctrl->interrupt_enable);
+        iowrite32(cq_entry_enable, &cq->ctrl->cq_entry_enable);
+        iowrite32(cq_message_enable, &cq->ctrl->cq_message_enable);
+        iowrite32(interrupt_offset, &cq->ctrl->interrupt_offset);
+        writeq(cq_message_addr, &cq->ctrl->cq_message_addr);
+}
+
+void vnic_cq_clean(struct vnic_cq *cq)
+{
+        cq->to_clean = 0;
+        cq->last_color = 0;
+
+        iowrite32(0, &cq->ctrl->cq_head);
+        iowrite32(0, &cq->ctrl->cq_tail);
+        iowrite32(1, &cq->ctrl->cq_tail_color);
+
+        vnic_dev_clear_desc_ring(&cq->ring);
+}
diff --git a/drivers/scsi/fnic/vnic_cq.h b/drivers/scsi/fnic/vnic_cq.h
new file mode 100644
index 00000000000..4ede6809fb1
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_cq.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_CQ_H_
+#define _VNIC_CQ_H_
+
+#include "cq_desc.h"
+#include "vnic_dev.h"
+
+/*
+ * These defines avoid symbol clash between fnic and enic (Cisco 10G Eth
+ * Driver) when both are built with CONFIG options =y
+ */
+#define vnic_cq_service fnic_cq_service
+#define vnic_cq_free fnic_cq_free
+#define vnic_cq_alloc fnic_cq_alloc
+#define vnic_cq_init fnic_cq_init
+#define vnic_cq_clean fnic_cq_clean
+
+/* Completion queue control */
+struct vnic_cq_ctrl {
+        u64 ring_base;                  /* 0x00 */
+        u32 ring_size;                  /* 0x08 */
+        u32 pad0;
+        u32 flow_control_enable;        /* 0x10 */
+        u32 pad1;
+        u32 color_enable;               /* 0x18 */
+        u32 pad2;
+        u32 cq_head;                    /* 0x20 */
+        u32 pad3;
+        u32 cq_tail;                    /* 0x28 */
+        u32 pad4;
+        u32 cq_tail_color;              /* 0x30 */
+        u32 pad5;
+        u32 interrupt_enable;           /* 0x38 */
+        u32 pad6;
+        u32 cq_entry_enable;            /* 0x40 */
+        u32 pad7;
+        u32 cq_message_enable;          /* 0x48 */
+        u32 pad8;
+        u32 interrupt_offset;           /* 0x50 */
+        u32 pad9;
+        u64 cq_message_addr;            /* 0x58 */
+        u32 pad10;
+};
+
+struct vnic_cq {
+        unsigned int index;
+        struct vnic_dev *vdev;
+        struct vnic_cq_ctrl __iomem *ctrl;      /* memory-mapped */
+        struct vnic_dev_ring ring;
+        unsigned int to_clean;
+        unsigned int last_color;
+};
+
+static inline unsigned int vnic_cq_service(struct vnic_cq *cq,
+        unsigned int work_to_do,
+        int (*q_service)(struct vnic_dev *vdev, struct cq_desc *cq_desc,
+        u8 type, u16 q_number, u16 completed_index, void *opaque),
+        void *opaque)
+{
+        struct cq_desc *cq_desc;
+        unsigned int work_done = 0;
+        u16 q_number, completed_index;
+        u8 type, color;
+
+        cq_desc = (struct cq_desc *)((u8 *)cq->ring.descs +
+                cq->ring.desc_size * cq->to_clean);
+        cq_desc_dec(cq_desc, &type, &color,
+                &q_number, &completed_index);
+
+        while (color != cq->last_color) {
+
+                if ((*q_service)(cq->vdev, cq_desc, type,
+                        q_number, completed_index, opaque))
+                        break;
+
+                cq->to_clean++;
+                if (cq->to_clean == cq->ring.desc_count) {
+                        cq->to_clean = 0;
+                        cq->last_color = cq->last_color ? 0 : 1;
+                }
+
+                cq_desc = (struct cq_desc *)((u8 *)cq->ring.descs +
+                        cq->ring.desc_size * cq->to_clean);
+                cq_desc_dec(cq_desc, &type, &color,
+                        &q_number, &completed_index);
+
+                work_done++;
+                if (work_done >= work_to_do)
+                        break;
+        }
+
+        return work_done;
+}
+
+void vnic_cq_free(struct vnic_cq *cq);
+int vnic_cq_alloc(struct vnic_dev *vdev, struct vnic_cq *cq, unsigned int index,
+        unsigned int desc_count, unsigned int desc_size);
+void vnic_cq_init(struct vnic_cq *cq, unsigned int flow_control_enable,
+        unsigned int color_enable, unsigned int cq_head, unsigned int cq_tail,
+        unsigned int cq_tail_color, unsigned int interrupt_enable,
+        unsigned int cq_entry_enable, unsigned int message_enable,
+        unsigned int interrupt_offset, u64 message_addr);
+void vnic_cq_clean(struct vnic_cq *cq);
+
+#endif /* _VNIC_CQ_H_ */
diff --git a/drivers/scsi/fnic/vnic_cq_copy.h b/drivers/scsi/fnic/vnic_cq_copy.h
new file mode 100644
index 00000000000..7901ce255a8
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_cq_copy.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_CQ_COPY_H_
+#define _VNIC_CQ_COPY_H_
+
+#include "fcpio.h"
+
+static inline unsigned int vnic_cq_copy_service(
+        struct vnic_cq *cq,
+        int (*q_service)(struct vnic_dev *vdev,
+                         unsigned int index,
+                         struct fcpio_fw_req *desc),
+        unsigned int work_to_do)
+
+{
+        struct fcpio_fw_req *desc;
+        unsigned int work_done = 0;
+        u8 color;
+
+        desc = (struct fcpio_fw_req *)((u8 *)cq->ring.descs +
+                cq->ring.desc_size * cq->to_clean);
+        fcpio_color_dec(desc, &color);
+
+        while (color != cq->last_color) {
+
+                if ((*q_service)(cq->vdev, cq->index, desc))
+                        break;
+
+                cq->to_clean++;
+                if (cq->to_clean == cq->ring.desc_count) {
+                        cq->to_clean = 0;
+                        cq->last_color = cq->last_color ? 0 : 1;
+                }
+
+                desc = (struct fcpio_fw_req *)((u8 *)cq->ring.descs +
+                        cq->ring.desc_size * cq->to_clean);
+                fcpio_color_dec(desc, &color);
+
+                work_done++;
+                if (work_done >= work_to_do)
+                        break;
+        }
+
+        return work_done;
+}
+
+#endif /* _VNIC_CQ_COPY_H_ */
diff --git a/drivers/scsi/fnic/vnic_dev.c b/drivers/scsi/fnic/vnic_dev.c
new file mode 100644
index 00000000000..56677064508
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_dev.c
@@ -0,0 +1,690 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/if_ether.h>
+#include "vnic_resource.h"
+#include "vnic_devcmd.h"
+#include "vnic_dev.h"
+#include "vnic_stats.h"
+
+struct vnic_res {
+        void __iomem *vaddr;
+        unsigned int count;
+};
+
+struct vnic_dev {
+        void *priv;
+        struct pci_dev *pdev;
+        struct vnic_res res[RES_TYPE_MAX];
+        enum vnic_dev_intr_mode intr_mode;
+        struct vnic_devcmd __iomem *devcmd;
+        struct vnic_devcmd_notify *notify;
+        struct vnic_devcmd_notify notify_copy;
+        dma_addr_t notify_pa;
+        u32 *linkstatus;
+        dma_addr_t linkstatus_pa;
+        struct vnic_stats *stats;
+        dma_addr_t stats_pa;
+        struct vnic_devcmd_fw_info *fw_info;
+        dma_addr_t fw_info_pa;
+};
+
+#define VNIC_MAX_RES_HDR_SIZE \
+        (sizeof(struct vnic_resource_header) + \
+        sizeof(struct vnic_resource) * RES_TYPE_MAX)
+#define VNIC_RES_STRIDE 128
+
+void *vnic_dev_priv(struct vnic_dev *vdev)
+{
+        return vdev->priv;
+}
+
+static int vnic_dev_discover_res(struct vnic_dev *vdev,
+        struct vnic_dev_bar *bar)
+{
+        struct vnic_resource_header __iomem *rh;
+        struct vnic_resource __iomem *r;
+        u8 type;
+
+        if (bar->len < VNIC_MAX_RES_HDR_SIZE) {
+                printk(KERN_ERR "vNIC BAR0 res hdr length error\n");
+                return -EINVAL;
+        }
+
+        rh = bar->vaddr;
+        if (!rh) {
+                printk(KERN_ERR "vNIC BAR0 res hdr not mem-mapped\n");
+                return -EINVAL;
+        }
+
+        if (ioread32(&rh->magic) != VNIC_RES_MAGIC ||
+            ioread32(&rh->version) != VNIC_RES_VERSION) {
+                printk(KERN_ERR "vNIC BAR0 res magic/version error "
+                        "exp (%lx/%lx) curr (%x/%x)\n",
+                        VNIC_RES_MAGIC, VNIC_RES_VERSION,
+                        ioread32(&rh->magic), ioread32(&rh->version));
+                return -EINVAL;
+        }
+
+        r = (struct vnic_resource __iomem *)(rh + 1);
+
+        while ((type = ioread8(&r->type)) != RES_TYPE_EOL) {
+
+                u8 bar_num = ioread8(&r->bar);
+                u32 bar_offset = ioread32(&r->bar_offset);
+                u32 count = ioread32(&r->count);
+                u32 len;
+
+                r++;
+
+                if (bar_num != 0)  /* only mapping in BAR0 resources */
+                        continue;
+
+                switch (type) {
+                case RES_TYPE_WQ:
+                case RES_TYPE_RQ:
+                case RES_TYPE_CQ:
+                case RES_TYPE_INTR_CTRL:
+                        /* each count is stride bytes long */
+                        len = count * VNIC_RES_STRIDE;
+                        if (len + bar_offset > bar->len) {
+                                printk(KERN_ERR "vNIC BAR0 resource %d "
+                                        "out-of-bounds, offset 0x%x + "
+                                        "size 0x%x > bar len 0x%lx\n",
+                                        type, bar_offset,
+                                        len,
+                                        bar->len);
+                                return -EINVAL;
+                        }
+                        break;
+                case RES_TYPE_INTR_PBA_LEGACY:
+                case RES_TYPE_DEVCMD:
+                        len = count;
+                        break;
+                default:
+                        continue;
+                }
+
+                vdev->res[type].count = count;
+                vdev->res[type].vaddr = (char __iomem *)bar->vaddr + bar_offset;
+        }
+
+        return 0;
+}
+
+unsigned int vnic_dev_get_res_count(struct vnic_dev *vdev,
+        enum vnic_res_type type)
+{
+        return vdev->res[type].count;
+}
+
+void __iomem *vnic_dev_get_res(struct vnic_dev *vdev, enum vnic_res_type type,
+        unsigned int index)
+{
+        if (!vdev->res[type].vaddr)
+                return NULL;
+
+        switch (type) {
+        case RES_TYPE_WQ:
+        case RES_TYPE_RQ:
+        case RES_TYPE_CQ:
+        case RES_TYPE_INTR_CTRL:
+                return (char __iomem *)vdev->res[type].vaddr +
+                                        index * VNIC_RES_STRIDE;
+        default:
+                return (char __iomem *)vdev->res[type].vaddr;
+        }
+}
+
+unsigned int vnic_dev_desc_ring_size(struct vnic_dev_ring *ring,
+                                     unsigned int desc_count,
+                                     unsigned int desc_size)
+{
+        /* The base address of the desc rings must be 512 byte aligned.
+         * Descriptor count is aligned to groups of 32 descriptors.  A
+         * count of 0 means the maximum 4096 descriptors.  Descriptor
+         * size is aligned to 16 bytes.
+         */
+
+        unsigned int count_align = 32;
+        unsigned int desc_align = 16;
+
+        ring->base_align = 512;
+
+        if (desc_count == 0)
+                desc_count = 4096;
+
+        ring->desc_count = ALIGN(desc_count, count_align);
+
+        ring->desc_size = ALIGN(desc_size, desc_align);
+
+        ring->size = ring->desc_count * ring->desc_size;
+        ring->size_unaligned = ring->size + ring->base_align;
+
+        return ring->size_unaligned;
+}
+
+void vnic_dev_clear_desc_ring(struct vnic_dev_ring *ring)
+{
+        memset(ring->descs, 0, ring->size);
+}
+
+int vnic_dev_alloc_desc_ring(struct vnic_dev *vdev, struct vnic_dev_ring *ring,
+        unsigned int desc_count, unsigned int desc_size)
+{
+        vnic_dev_desc_ring_size(ring, desc_count, desc_size);
+
+        ring->descs_unaligned = pci_alloc_consistent(vdev->pdev,
+                ring->size_unaligned,
+                &ring->base_addr_unaligned);
+
+        if (!ring->descs_unaligned) {
+                printk(KERN_ERR
+                  "Failed to allocate ring (size=%d), aborting\n",
+                        (int)ring->size);
+                return -ENOMEM;
+        }
+
+        ring->base_addr = ALIGN(ring->base_addr_unaligned,
+                ring->base_align);
+        ring->descs = (u8 *)ring->descs_unaligned +
+                (ring->base_addr - ring->base_addr_unaligned);
+
+        vnic_dev_clear_desc_ring(ring);
+
+        ring->desc_avail = ring->desc_count - 1;
+
+        return 0;
+}
+
+void vnic_dev_free_desc_ring(struct vnic_dev *vdev, struct vnic_dev_ring *ring)
+{
+        if (ring->descs) {
+                pci_free_consistent(vdev->pdev,
+                        ring->size_unaligned,
+                        ring->descs_unaligned,
+                        ring->base_addr_unaligned);
+                ring->descs = NULL;
+        }
+}
+
+int vnic_dev_cmd(struct vnic_dev *vdev, enum vnic_devcmd_cmd cmd,
+        u64 *a0, u64 *a1, int wait)
+{
+        struct vnic_devcmd __iomem *devcmd = vdev->devcmd;
+        int delay;
+        u32 status;
+        int dev_cmd_err[] = {
+                /* convert from fw's version of error.h to host's version */
+                0,      /* ERR_SUCCESS */
+                EINVAL, /* ERR_EINVAL */
+                EFAULT, /* ERR_EFAULT */
+                EPERM,  /* ERR_EPERM */
+                EBUSY,  /* ERR_EBUSY */
+        };
+        int err;
+
+        status = ioread32(&devcmd->status);
+        if (status & STAT_BUSY) {
+                printk(KERN_ERR "Busy devcmd %d\n", _CMD_N(cmd));
+                return -EBUSY;
+        }
+
+        if (_CMD_DIR(cmd) & _CMD_DIR_WRITE) {
+                writeq(*a0, &devcmd->args[0]);
+                writeq(*a1, &devcmd->args[1]);
+                wmb();
+        }
+
+        iowrite32(cmd, &devcmd->cmd);
+
+        if ((_CMD_FLAGS(cmd) & _CMD_FLAGS_NOWAIT))
+                        return 0;
+
+        for (delay = 0; delay < wait; delay++) {
+
+                udelay(100);
+
+                status = ioread32(&devcmd->status);
+                if (!(status & STAT_BUSY)) {
+
+                        if (status & STAT_ERROR) {
+                                err = dev_cmd_err[(int)readq(&devcmd->args[0])];
+                                printk(KERN_ERR "Error %d devcmd %d\n",
+                                        err, _CMD_N(cmd));
+                                return -err;
+                        }
+
+                        if (_CMD_DIR(cmd) & _CMD_DIR_READ) {
+                                rmb();
+                                *a0 = readq(&devcmd->args[0]);
+                                *a1 = readq(&devcmd->args[1]);
+                        }
+
+                        return 0;
+                }
+        }
+
+        printk(KERN_ERR "Timedout devcmd %d\n", _CMD_N(cmd));
+        return -ETIMEDOUT;
+}
+
+int vnic_dev_fw_info(struct vnic_dev *vdev,
+        struct vnic_devcmd_fw_info **fw_info)
+{
+        u64 a0, a1 = 0;
+        int wait = 1000;
+        int err = 0;
+
+        if (!vdev->fw_info) {
+                vdev->fw_info = pci_alloc_consistent(vdev->pdev,
+                        sizeof(struct vnic_devcmd_fw_info),
+                        &vdev->fw_info_pa);
+                if (!vdev->fw_info)
+                        return -ENOMEM;
+
+                a0 = vdev->fw_info_pa;
+
+                /* only get fw_info once and cache it */
+                err = vnic_dev_cmd(vdev, CMD_MCPU_FW_INFO, &a0, &a1, wait);
+        }
+
+        *fw_info = vdev->fw_info;
+
+        return err;
+}
+
+int vnic_dev_spec(struct vnic_dev *vdev, unsigned int offset, unsigned int size,
+        void *value)
+{
+        u64 a0, a1;
+        int wait = 1000;
+        int err;
+
+        a0 = offset;
+        a1 = size;
+
+        err = vnic_dev_cmd(vdev, CMD_DEV_SPEC, &a0, &a1, wait);
+
+        switch (size) {
+        case 1:
+                *(u8 *)value = (u8)a0;
+                break;
+        case 2:
+                *(u16 *)value = (u16)a0;
+                break;
+        case 4:
+                *(u32 *)value = (u32)a0;
+                break;
+        case 8:
+                *(u64 *)value = a0;
+                break;
+        default:
+                BUG();
+                break;
+        }
+
+        return err;
+}
+
+int vnic_dev_stats_clear(struct vnic_dev *vdev)
+{
+        u64 a0 = 0, a1 = 0;
+        int wait = 1000;
+        return vnic_dev_cmd(vdev, CMD_STATS_CLEAR, &a0, &a1, wait);
+}
+
+int vnic_dev_stats_dump(struct vnic_dev *vdev, struct vnic_stats **stats)
+{
+        u64 a0, a1;
+        int wait = 1000;
+
+        if (!vdev->stats) {
+                vdev->stats = pci_alloc_consistent(vdev->pdev,
+                        sizeof(struct vnic_stats), &vdev->stats_pa);
+                if (!vdev->stats)
+                        return -ENOMEM;
+        }
+
+        *stats = vdev->stats;
+        a0 = vdev->stats_pa;
+        a1 = sizeof(struct vnic_stats);
+
+        return vnic_dev_cmd(vdev, CMD_STATS_DUMP, &a0, &a1, wait);
+}
+
+int vnic_dev_close(struct vnic_dev *vdev)
+{
+        u64 a0 = 0, a1 = 0;
+        int wait = 1000;
+        return vnic_dev_cmd(vdev, CMD_CLOSE, &a0, &a1, wait);
+}
+
+int vnic_dev_enable(struct vnic_dev *vdev)
+{
+        u64 a0 = 0, a1 = 0;
+        int wait = 1000;
+        return vnic_dev_cmd(vdev, CMD_ENABLE, &a0, &a1, wait);
+}
+
+int vnic_dev_disable(struct vnic_dev *vdev)
+{
+        u64 a0 = 0, a1 = 0;
+        int wait = 1000;
+        return vnic_dev_cmd(vdev, CMD_DISABLE, &a0, &a1, wait);
+}
+
+int vnic_dev_open(struct vnic_dev *vdev, int arg)
+{
+        u64 a0 = (u32)arg, a1 = 0;
+        int wait = 1000;
+        return vnic_dev_cmd(vdev, CMD_OPEN, &a0, &a1, wait);
+}
+
+int vnic_dev_open_done(struct vnic_dev *vdev, int *done)
+{
+        u64 a0 = 0, a1 = 0;
+        int wait = 1000;
+        int err;
+
+        *done = 0;
+
+        err = vnic_dev_cmd(vdev, CMD_OPEN_STATUS, &a0, &a1, wait);
+        if (err)
+                return err;
+
+        *done = (a0 == 0);
+
+        return 0;
+}
+
+int vnic_dev_soft_reset(struct vnic_dev *vdev, int arg)
+{
+        u64 a0 = (u32)arg, a1 = 0;
+        int wait = 1000;
+        return vnic_dev_cmd(vdev, CMD_SOFT_RESET, &a0, &a1, wait);
+}
+
+int vnic_dev_soft_reset_done(struct vnic_dev *vdev, int *done)
+{
+        u64 a0 = 0, a1 = 0;
+        int wait = 1000;
+        int err;
+
+        *done = 0;
+
+        err = vnic_dev_cmd(vdev, CMD_SOFT_RESET_STATUS, &a0, &a1, wait);
+        if (err)
+                return err;
+
+        *done = (a0 == 0);
+
+        return 0;
+}
+
+int vnic_dev_hang_notify(struct vnic_dev *vdev)
+{
+        u64 a0, a1;
+        int wait = 1000;
+        return vnic_dev_cmd(vdev, CMD_HANG_NOTIFY, &a0, &a1, wait);
+}
+
+int vnic_dev_mac_addr(struct vnic_dev *vdev, u8 *mac_addr)
+{
+        u64 a0, a1;
+        int wait = 1000;
+        int err, i;
+
+        for (i = 0; i < ETH_ALEN; i++)
+                mac_addr[i] = 0;
+
+        err = vnic_dev_cmd(vdev, CMD_MAC_ADDR, &a0, &a1, wait);
+        if (err)
+                return err;
+
+        for (i = 0; i < ETH_ALEN; i++)
+                mac_addr[i] = ((u8 *)&a0)[i];
+
+        return 0;
+}
+
+void vnic_dev_packet_filter(struct vnic_dev *vdev, int directed, int multicast,
+        int broadcast, int promisc, int allmulti)
+{
+        u64 a0, a1 = 0;
+        int wait = 1000;
+        int err;
+
+        a0 = (directed ? CMD_PFILTER_DIRECTED : 0) |
+             (multicast ? CMD_PFILTER_MULTICAST : 0) |
+             (broadcast ? CMD_PFILTER_BROADCAST : 0) |
+             (promisc ? CMD_PFILTER_PROMISCUOUS : 0) |
+             (allmulti ? CMD_PFILTER_ALL_MULTICAST : 0);
+
+        err = vnic_dev_cmd(vdev, CMD_PACKET_FILTER, &a0, &a1, wait);
+        if (err)
+                printk(KERN_ERR "Can't set packet filter\n");
+}
+
+void vnic_dev_add_addr(struct vnic_dev *vdev, u8 *addr)
+{
+        u64 a0 = 0, a1 = 0;
+        int wait = 1000;
+        int err;
+        int i;
+
+        for (i = 0; i < ETH_ALEN; i++)
+                ((u8 *)&a0)[i] = addr[i];
+
+        err = vnic_dev_cmd(vdev, CMD_ADDR_ADD, &a0, &a1, wait);
+        if (err)
+                printk(KERN_ERR
+                        "Can't add addr [%02x:%02x:%02x:%02x:%02x:%02x], %d\n",
+                        addr[0], addr[1], addr[2], addr[3], addr[4], addr[5],
+                        err);
+}
+
+void vnic_dev_del_addr(struct vnic_dev *vdev, u8 *addr)
+{
+        u64 a0 = 0, a1 = 0;
+        int wait = 1000;
+        int err;
+        int i;
+
+        for (i = 0; i < ETH_ALEN; i++)
+                ((u8 *)&a0)[i] = addr[i];
+
+        err = vnic_dev_cmd(vdev, CMD_ADDR_DEL, &a0, &a1, wait);
+        if (err)
+                printk(KERN_ERR
+                        "Can't del addr [%02x:%02x:%02x:%02x:%02x:%02x], %d\n",
+                        addr[0], addr[1], addr[2], addr[3], addr[4], addr[5],
+                        err);
+}
+
+int vnic_dev_notify_set(struct vnic_dev *vdev, u16 intr)
+{
+        u64 a0, a1;
+        int wait = 1000;
+
+        if (!vdev->notify) {
+                vdev->notify = pci_alloc_consistent(vdev->pdev,
+                        sizeof(struct vnic_devcmd_notify),
+                        &vdev->notify_pa);
+                if (!vdev->notify)
+                        return -ENOMEM;
+        }
+
+        a0 = vdev->notify_pa;
+        a1 = ((u64)intr << 32) & 0x0000ffff00000000ULL;
+        a1 += sizeof(struct vnic_devcmd_notify);
+
+        return vnic_dev_cmd(vdev, CMD_NOTIFY, &a0, &a1, wait);
+}
+
+void vnic_dev_notify_unset(struct vnic_dev *vdev)
+{
+        u64 a0, a1;
+        int wait = 1000;
+
+        a0 = 0;  /* paddr = 0 to unset notify buffer */
+        a1 = 0x0000ffff00000000ULL; /* intr num = -1 to unreg for intr */
+        a1 += sizeof(struct vnic_devcmd_notify);
+
+        vnic_dev_cmd(vdev, CMD_NOTIFY, &a0, &a1, wait);
+}
+
+static int vnic_dev_notify_ready(struct vnic_dev *vdev)
+{
+        u32 *words;
+        unsigned int nwords = sizeof(struct vnic_devcmd_notify) / 4;
+        unsigned int i;
+        u32 csum;
+
+        if (!vdev->notify)
+                return 0;
+
+        do {
+                csum = 0;
+                memcpy(&vdev->notify_copy, vdev->notify,
+                        sizeof(struct vnic_devcmd_notify));
+                words = (u32 *)&vdev->notify_copy;
+                for (i = 1; i < nwords; i++)
+                        csum += words[i];
+        } while (csum != words[0]);
+
+        return 1;
+}
+
+int vnic_dev_init(struct vnic_dev *vdev, int arg)
+{
+        u64 a0 = (u32)arg, a1 = 0;
+        int wait = 1000;
+        return vnic_dev_cmd(vdev, CMD_INIT, &a0, &a1, wait);
+}
+
+int vnic_dev_link_status(struct vnic_dev *vdev)
+{
+        if (vdev->linkstatus)
+                return *vdev->linkstatus;
+
+        if (!vnic_dev_notify_ready(vdev))
+                return 0;
+
+        return vdev->notify_copy.link_state;
+}
+
+u32 vnic_dev_port_speed(struct vnic_dev *vdev)
+{
+        if (!vnic_dev_notify_ready(vdev))
+                return 0;
+
+        return vdev->notify_copy.port_speed;
+}
+
+u32 vnic_dev_msg_lvl(struct vnic_dev *vdev)
+{
+        if (!vnic_dev_notify_ready(vdev))
+                return 0;
+
+        return vdev->notify_copy.msglvl;
+}
+
+u32 vnic_dev_mtu(struct vnic_dev *vdev)
+{
+        if (!vnic_dev_notify_ready(vdev))
+                return 0;
+
+        return vdev->notify_copy.mtu;
+}
+
+u32 vnic_dev_link_down_cnt(struct vnic_dev *vdev)
+{
+        if (!vnic_dev_notify_ready(vdev))
+                return 0;
+
+        return vdev->notify_copy.link_down_cnt;
+}
+
+void vnic_dev_set_intr_mode(struct vnic_dev *vdev,
+        enum vnic_dev_intr_mode intr_mode)
+{
+        vdev->intr_mode = intr_mode;
+}
+
+enum vnic_dev_intr_mode vnic_dev_get_intr_mode(
+        struct vnic_dev *vdev)
+{
+        return vdev->intr_mode;
+}
+
+void vnic_dev_unregister(struct vnic_dev *vdev)
+{
+        if (vdev) {
+                if (vdev->notify)
+                        pci_free_consistent(vdev->pdev,
+                                sizeof(struct vnic_devcmd_notify),
+                                vdev->notify,
+                                vdev->notify_pa);
+                if (vdev->linkstatus)
+                        pci_free_consistent(vdev->pdev,
+                                sizeof(u32),
+                                vdev->linkstatus,
+                                vdev->linkstatus_pa);
+                if (vdev->stats)
+                        pci_free_consistent(vdev->pdev,
+                                sizeof(struct vnic_dev),
+                                vdev->stats, vdev->stats_pa);
+                if (vdev->fw_info)
+                        pci_free_consistent(vdev->pdev,
+                                sizeof(struct vnic_devcmd_fw_info),
+                                vdev->fw_info, vdev->fw_info_pa);
+                kfree(vdev);
+        }
+}
+
+struct vnic_dev *vnic_dev_register(struct vnic_dev *vdev,
+        void *priv, struct pci_dev *pdev, struct vnic_dev_bar *bar)
+{
+        if (!vdev) {
+                vdev = kzalloc(sizeof(struct vnic_dev), GFP_KERNEL);
+                if (!vdev)
+                        return NULL;
+        }
+
+        vdev->priv = priv;
+        vdev->pdev = pdev;
+
+        if (vnic_dev_discover_res(vdev, bar))
+                goto err_out;
+
+        vdev->devcmd = vnic_dev_get_res(vdev, RES_TYPE_DEVCMD, 0);
+        if (!vdev->devcmd)
+                goto err_out;
+
+        return vdev;
+
+err_out:
+        vnic_dev_unregister(vdev);
+        return NULL;
+}
diff --git a/drivers/scsi/fnic/vnic_dev.h b/drivers/scsi/fnic/vnic_dev.h
new file mode 100644
index 00000000000..f9935a8a5a0
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_dev.h
@@ -0,0 +1,161 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_DEV_H_
+#define _VNIC_DEV_H_
+
+#include "vnic_resource.h"
+#include "vnic_devcmd.h"
+
+/*
+ * These defines avoid symbol clash between fnic and enic (Cisco 10G Eth
+ * Driver) when both are built with CONFIG options =y
+ */
+#define vnic_dev_priv fnic_dev_priv
+#define vnic_dev_get_res_count fnic_dev_get_res_count
+#define vnic_dev_get_res fnic_dev_get_res
+#define vnic_dev_desc_ring_size fnic_dev_desc_ring_siz
+#define vnic_dev_clear_desc_ring fnic_dev_clear_desc_ring
+#define vnic_dev_alloc_desc_ring fnic_dev_alloc_desc_ring
+#define vnic_dev_free_desc_ring fnic_dev_free_desc_ring
+#define vnic_dev_cmd fnic_dev_cmd
+#define vnic_dev_fw_info fnic_dev_fw_info
+#define vnic_dev_spec fnic_dev_spec
+#define vnic_dev_stats_clear fnic_dev_stats_clear
+#define vnic_dev_stats_dump fnic_dev_stats_dump
+#define vnic_dev_hang_notify fnic_dev_hang_notify
+#define vnic_dev_packet_filter fnic_dev_packet_filter
+#define vnic_dev_add_addr fnic_dev_add_addr
+#define vnic_dev_del_addr fnic_dev_del_addr
+#define vnic_dev_mac_addr fnic_dev_mac_addr
+#define vnic_dev_notify_set fnic_dev_notify_set
+#define vnic_dev_notify_unset fnic_dev_notify_unset
+#define vnic_dev_link_status fnic_dev_link_status
+#define vnic_dev_port_speed fnic_dev_port_speed
+#define vnic_dev_msg_lvl fnic_dev_msg_lvl
+#define vnic_dev_mtu fnic_dev_mtu
+#define vnic_dev_link_down_cnt fnic_dev_link_down_cnt
+#define vnic_dev_close fnic_dev_close
+#define vnic_dev_enable fnic_dev_enable
+#define vnic_dev_disable fnic_dev_disable
+#define vnic_dev_open fnic_dev_open
+#define vnic_dev_open_done fnic_dev_open_done
+#define vnic_dev_init fnic_dev_init
+#define vnic_dev_soft_reset fnic_dev_soft_reset
+#define vnic_dev_soft_reset_done fnic_dev_soft_reset_done
+#define vnic_dev_set_intr_mode fnic_dev_set_intr_mode
+#define vnic_dev_get_intr_mode fnic_dev_get_intr_mode
+#define vnic_dev_unregister fnic_dev_unregister
+#define vnic_dev_register fnic_dev_register
+
+#ifndef VNIC_PADDR_TARGET
+#define VNIC_PADDR_TARGET       0x0000000000000000ULL
+#endif
+
+#ifndef readq
+static inline u64 readq(void __iomem *reg)
+{
+        return ((u64)readl(reg + 0x4UL) << 32) | (u64)readl(reg);
+}
+
+static inline void writeq(u64 val, void __iomem *reg)
+{
+        writel(val & 0xffffffff, reg);
+        writel(val >> 32, reg + 0x4UL);
+}
+#endif
+
+enum vnic_dev_intr_mode {
+        VNIC_DEV_INTR_MODE_UNKNOWN,
+        VNIC_DEV_INTR_MODE_INTX,
+        VNIC_DEV_INTR_MODE_MSI,
+        VNIC_DEV_INTR_MODE_MSIX,
+};
+
+struct vnic_dev_bar {
+        void __iomem *vaddr;
+        dma_addr_t bus_addr;
+        unsigned long len;
+};
+
+struct vnic_dev_ring {
+        void *descs;
+        size_t size;
+        dma_addr_t base_addr;
+        size_t base_align;
+        void *descs_unaligned;
+        size_t size_unaligned;
+        dma_addr_t base_addr_unaligned;
+        unsigned int desc_size;
+        unsigned int desc_count;
+        unsigned int desc_avail;
+};
+
+struct vnic_dev;
+struct vnic_stats;
+
+void *vnic_dev_priv(struct vnic_dev *vdev);
+unsigned int vnic_dev_get_res_count(struct vnic_dev *vdev,
+                                    enum vnic_res_type type);
+void __iomem *vnic_dev_get_res(struct vnic_dev *vdev, enum vnic_res_type type,
+                               unsigned int index);
+unsigned int vnic_dev_desc_ring_size(struct vnic_dev_ring *ring,
+                                     unsigned int desc_count,
+                                     unsigned int desc_size);
+void vnic_dev_clear_desc_ring(struct vnic_dev_ring *ring);
+int vnic_dev_alloc_desc_ring(struct vnic_dev *vdev, struct vnic_dev_ring *ring,
+                             unsigned int desc_count, unsigned int desc_size);
+void vnic_dev_free_desc_ring(struct vnic_dev *vdev,
+                             struct vnic_dev_ring *ring);
+int vnic_dev_cmd(struct vnic_dev *vdev, enum vnic_devcmd_cmd cmd,
+                 u64 *a0, u64 *a1, int wait);
+int vnic_dev_fw_info(struct vnic_dev *vdev,
+                     struct vnic_devcmd_fw_info **fw_info);
+int vnic_dev_spec(struct vnic_dev *vdev, unsigned int offset,
+                  unsigned int size, void *value);
+int vnic_dev_stats_clear(struct vnic_dev *vdev);
+int vnic_dev_stats_dump(struct vnic_dev *vdev, struct vnic_stats **stats);
+int vnic_dev_hang_notify(struct vnic_dev *vdev);
+void vnic_dev_packet_filter(struct vnic_dev *vdev, int directed, int multicast,
+                            int broadcast, int promisc, int allmulti);
+void vnic_dev_add_addr(struct vnic_dev *vdev, u8 *addr);
+void vnic_dev_del_addr(struct vnic_dev *vdev, u8 *addr);
+int vnic_dev_mac_addr(struct vnic_dev *vdev, u8 *mac_addr);
+int vnic_dev_notify_set(struct vnic_dev *vdev, u16 intr);
+void vnic_dev_notify_unset(struct vnic_dev *vdev);
+int vnic_dev_link_status(struct vnic_dev *vdev);
+u32 vnic_dev_port_speed(struct vnic_dev *vdev);
+u32 vnic_dev_msg_lvl(struct vnic_dev *vdev);
+u32 vnic_dev_mtu(struct vnic_dev *vdev);
+u32 vnic_dev_link_down_cnt(struct vnic_dev *vdev);
+int vnic_dev_close(struct vnic_dev *vdev);
+int vnic_dev_enable(struct vnic_dev *vdev);
+int vnic_dev_disable(struct vnic_dev *vdev);
+int vnic_dev_open(struct vnic_dev *vdev, int arg);
+int vnic_dev_open_done(struct vnic_dev *vdev, int *done);
+int vnic_dev_init(struct vnic_dev *vdev, int arg);
+int vnic_dev_soft_reset(struct vnic_dev *vdev, int arg);
+int vnic_dev_soft_reset_done(struct vnic_dev *vdev, int *done);
+void vnic_dev_set_intr_mode(struct vnic_dev *vdev,
+                            enum vnic_dev_intr_mode intr_mode);
+enum vnic_dev_intr_mode vnic_dev_get_intr_mode(struct vnic_dev *vdev);
+void vnic_dev_unregister(struct vnic_dev *vdev);
+struct vnic_dev *vnic_dev_register(struct vnic_dev *vdev,
+                                   void *priv, struct pci_dev *pdev,
+                                   struct vnic_dev_bar *bar);
+
+#endif /* _VNIC_DEV_H_ */
diff --git a/drivers/scsi/fnic/vnic_devcmd.h b/drivers/scsi/fnic/vnic_devcmd.h
new file mode 100644
index 00000000000..d62b9061bf1
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_devcmd.h
@@ -0,0 +1,281 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_DEVCMD_H_
+#define _VNIC_DEVCMD_H_
+
+#define _CMD_NBITS      14
+#define _CMD_VTYPEBITS  10
+#define _CMD_FLAGSBITS  6
+#define _CMD_DIRBITS    2
+
+#define _CMD_NMASK      ((1 << _CMD_NBITS)-1)
+#define _CMD_VTYPEMASK  ((1 << _CMD_VTYPEBITS)-1)
+#define _CMD_FLAGSMASK  ((1 << _CMD_FLAGSBITS)-1)
+#define _CMD_DIRMASK    ((1 << _CMD_DIRBITS)-1)
+
+#define _CMD_NSHIFT     0
+#define _CMD_VTYPESHIFT (_CMD_NSHIFT+_CMD_NBITS)
+#define _CMD_FLAGSSHIFT (_CMD_VTYPESHIFT+_CMD_VTYPEBITS)
+#define _CMD_DIRSHIFT   (_CMD_FLAGSSHIFT+_CMD_FLAGSBITS)
+
+/*
+ * Direction bits (from host perspective).
+ */
+#define _CMD_DIR_NONE   0U
+#define _CMD_DIR_WRITE  1U
+#define _CMD_DIR_READ   2U
+#define _CMD_DIR_RW     (_CMD_DIR_WRITE | _CMD_DIR_READ)
+
+/*
+ * Flag bits.
+ */
+#define _CMD_FLAGS_NONE 0U
+#define _CMD_FLAGS_NOWAIT 1U
+
+/*
+ * vNIC type bits.
+ */
+#define _CMD_VTYPE_NONE  0U
+#define _CMD_VTYPE_ENET  1U
+#define _CMD_VTYPE_FC    2U
+#define _CMD_VTYPE_SCSI  4U
+#define _CMD_VTYPE_ALL   (_CMD_VTYPE_ENET | _CMD_VTYPE_FC | _CMD_VTYPE_SCSI)
+
+/*
+ * Used to create cmds..
+*/
+#define _CMDCF(dir, flags, vtype, nr)  \
+        (((dir)   << _CMD_DIRSHIFT) | \
+        ((flags) << _CMD_FLAGSSHIFT) | \
+        ((vtype) << _CMD_VTYPESHIFT) | \
+        ((nr)    << _CMD_NSHIFT))
+#define _CMDC(dir, vtype, nr)    _CMDCF(dir, 0, vtype, nr)
+#define _CMDCNW(dir, vtype, nr)  _CMDCF(dir, _CMD_FLAGS_NOWAIT, vtype, nr)
+
+/*
+ * Used to decode cmds..
+*/
+#define _CMD_DIR(cmd)            (((cmd) >> _CMD_DIRSHIFT) & _CMD_DIRMASK)
+#define _CMD_FLAGS(cmd)          (((cmd) >> _CMD_FLAGSSHIFT) & _CMD_FLAGSMASK)
+#define _CMD_VTYPE(cmd)          (((cmd) >> _CMD_VTYPESHIFT) & _CMD_VTYPEMASK)
+#define _CMD_N(cmd)              (((cmd) >> _CMD_NSHIFT) & _CMD_NMASK)
+
+enum vnic_devcmd_cmd {
+        CMD_NONE                = _CMDC(_CMD_DIR_NONE, _CMD_VTYPE_NONE, 0),
+
+        /* mcpu fw info in mem: (u64)a0=paddr to struct vnic_devcmd_fw_info */
+        CMD_MCPU_FW_INFO        = _CMDC(_CMD_DIR_WRITE, _CMD_VTYPE_ALL, 1),
+
+        /* dev-specific block member:
+         *    in: (u16)a0=offset,(u8)a1=size
+         *    out: a0=value */
+        CMD_DEV_SPEC            = _CMDC(_CMD_DIR_RW, _CMD_VTYPE_ALL, 2),
+
+        /* stats clear */
+        CMD_STATS_CLEAR         = _CMDCNW(_CMD_DIR_NONE, _CMD_VTYPE_ALL, 3),
+
+        /* stats dump in mem: (u64)a0=paddr to stats area,
+         *                    (u16)a1=sizeof stats area */
+        CMD_STATS_DUMP          = _CMDC(_CMD_DIR_WRITE, _CMD_VTYPE_ALL, 4),
+
+        /* set Rx packet filter: (u32)a0=filters (see CMD_PFILTER_*) */
+        CMD_PACKET_FILTER       = _CMDCNW(_CMD_DIR_WRITE, _CMD_VTYPE_ENET, 7),
+
+        /* hang detection notification */
+        CMD_HANG_NOTIFY         = _CMDC(_CMD_DIR_NONE, _CMD_VTYPE_ALL, 8),
+
+        /* MAC address in (u48)a0 */
+        CMD_MAC_ADDR            = _CMDC(_CMD_DIR_READ,
+                                        _CMD_VTYPE_ENET | _CMD_VTYPE_FC, 9),
+
+        /* disable/enable promisc mode: (u8)a0=0/1 */
+/***** XXX DEPRECATED *****/
+        CMD_PROMISC_MODE        = _CMDCNW(_CMD_DIR_WRITE, _CMD_VTYPE_ENET, 10),
+
+        /* disable/enable all-multi mode: (u8)a0=0/1 */
+/***** XXX DEPRECATED *****/
+        CMD_ALLMULTI_MODE       = _CMDCNW(_CMD_DIR_WRITE, _CMD_VTYPE_ENET, 11),
+
+        /* add addr from (u48)a0 */
+        CMD_ADDR_ADD            = _CMDCNW(_CMD_DIR_WRITE,
+                                        _CMD_VTYPE_ENET | _CMD_VTYPE_FC, 12),
+
+        /* del addr from (u48)a0 */
+        CMD_ADDR_DEL            = _CMDCNW(_CMD_DIR_WRITE,
+                                        _CMD_VTYPE_ENET | _CMD_VTYPE_FC, 13),
+
+        /* add VLAN id in (u16)a0 */
+        CMD_VLAN_ADD            = _CMDCNW(_CMD_DIR_WRITE, _CMD_VTYPE_ENET, 14),
+
+        /* del VLAN id in (u16)a0 */
+        CMD_VLAN_DEL            = _CMDCNW(_CMD_DIR_WRITE, _CMD_VTYPE_ENET, 15),
+
+        /* nic_cfg in (u32)a0 */
+        CMD_NIC_CFG             = _CMDCNW(_CMD_DIR_WRITE, _CMD_VTYPE_ALL, 16),
+
+        /* union vnic_rss_key in mem: (u64)a0=paddr, (u16)a1=len */
+        CMD_RSS_KEY             = _CMDC(_CMD_DIR_WRITE, _CMD_VTYPE_ENET, 17),
+
+        /* union vnic_rss_cpu in mem: (u64)a0=paddr, (u16)a1=len */
+        CMD_RSS_CPU             = _CMDC(_CMD_DIR_WRITE, _CMD_VTYPE_ENET, 18),
+
+        /* initiate softreset */
+        CMD_SOFT_RESET          = _CMDCNW(_CMD_DIR_NONE, _CMD_VTYPE_ALL, 19),
+
+        /* softreset status:
+         *    out: a0=0 reset complete, a0=1 reset in progress */
+        CMD_SOFT_RESET_STATUS   = _CMDC(_CMD_DIR_READ, _CMD_VTYPE_ALL, 20),
+
+        /* set struct vnic_devcmd_notify buffer in mem:
+         * in:
+         *   (u64)a0=paddr to notify (set paddr=0 to unset)
+         *   (u32)a1 & 0x00000000ffffffff=sizeof(struct vnic_devcmd_notify)
+         *   (u16)a1 & 0x0000ffff00000000=intr num (-1 for no intr)
+         * out:
+         *   (u32)a1 = effective size
+         */
+        CMD_NOTIFY              = _CMDC(_CMD_DIR_RW, _CMD_VTYPE_ALL, 21),
+
+        /* UNDI API: (u64)a0=paddr to s_PXENV_UNDI_ struct,
+         *           (u8)a1=PXENV_UNDI_xxx */
+        CMD_UNDI                = _CMDC(_CMD_DIR_WRITE, _CMD_VTYPE_ENET, 22),
+
+        /* initiate open sequence (u32)a0=flags (see CMD_OPENF_*) */
+        CMD_OPEN                = _CMDCNW(_CMD_DIR_WRITE, _CMD_VTYPE_ALL, 23),
+
+        /* open status:
+         *    out: a0=0 open complete, a0=1 open in progress */
+        CMD_OPEN_STATUS         = _CMDC(_CMD_DIR_READ, _CMD_VTYPE_ALL, 24),
+
+        /* close vnic */
+        CMD_CLOSE               = _CMDC(_CMD_DIR_NONE, _CMD_VTYPE_ALL, 25),
+
+        /* initialize virtual link: (u32)a0=flags (see CMD_INITF_*) */
+        CMD_INIT                = _CMDCNW(_CMD_DIR_READ, _CMD_VTYPE_ALL, 26),
+
+        /* variant of CMD_INIT, with provisioning info
+         *     (u64)a0=paddr of vnic_devcmd_provinfo
+         *     (u32)a1=sizeof provision info */
+        CMD_INIT_PROV_INFO      = _CMDC(_CMD_DIR_WRITE, _CMD_VTYPE_ENET, 27),
+
+        /* enable virtual link */
+        CMD_ENABLE              = _CMDCNW(_CMD_DIR_WRITE, _CMD_VTYPE_ALL, 28),
+
+        /* disable virtual link */
+        CMD_DISABLE             = _CMDC(_CMD_DIR_NONE, _CMD_VTYPE_ALL, 29),
+
+        /* stats dump all vnics on uplink in mem: (u64)a0=paddr (u32)a1=uif */
+        CMD_STATS_DUMP_ALL      = _CMDC(_CMD_DIR_WRITE, _CMD_VTYPE_ALL, 30),
+
+        /* init status:
+         *    out: a0=0 init complete, a0=1 init in progress
+         *         if a0=0, a1=errno */
+        CMD_INIT_STATUS         = _CMDC(_CMD_DIR_READ, _CMD_VTYPE_ALL, 31),
+
+        /* INT13 API: (u64)a0=paddr to vnic_int13_params struct
+         *            (u8)a1=INT13_CMD_xxx */
+        CMD_INT13               = _CMDC(_CMD_DIR_WRITE, _CMD_VTYPE_FC, 32),
+
+        /* logical uplink enable/disable: (u64)a0: 0/1=disable/enable */
+        CMD_LOGICAL_UPLINK      = _CMDCNW(_CMD_DIR_WRITE, _CMD_VTYPE_ENET, 33),
+
+        /* undo initialize of virtual link */
+        CMD_DEINIT              = _CMDCNW(_CMD_DIR_NONE, _CMD_VTYPE_ALL, 34),
+};
+
+/* flags for CMD_OPEN */
+#define CMD_OPENF_OPROM         0x1     /* open coming from option rom */
+
+/* flags for CMD_INIT */
+#define CMD_INITF_DEFAULT_MAC   0x1     /* init with default mac addr */
+
+/* flags for CMD_PACKET_FILTER */
+#define CMD_PFILTER_DIRECTED            0x01
+#define CMD_PFILTER_MULTICAST           0x02
+#define CMD_PFILTER_BROADCAST           0x04
+#define CMD_PFILTER_PROMISCUOUS         0x08
+#define CMD_PFILTER_ALL_MULTICAST       0x10
+
+enum vnic_devcmd_status {
+        STAT_NONE = 0,
+        STAT_BUSY = 1 << 0,     /* cmd in progress */
+        STAT_ERROR = 1 << 1,    /* last cmd caused error (code in a0) */
+};
+
+enum vnic_devcmd_error {
+        ERR_SUCCESS = 0,
+        ERR_EINVAL = 1,
+        ERR_EFAULT = 2,
+        ERR_EPERM = 3,
+        ERR_EBUSY = 4,
+        ERR_ECMDUNKNOWN = 5,
+        ERR_EBADSTATE = 6,
+        ERR_ENOMEM = 7,
+        ERR_ETIMEDOUT = 8,
+        ERR_ELINKDOWN = 9,
+};
+
+struct vnic_devcmd_fw_info {
+        char fw_version[32];
+        char fw_build[32];
+        char hw_version[32];
+        char hw_serial_number[32];
+};
+
+struct vnic_devcmd_notify {
+        u32 csum;               /* checksum over following words */
+
+        u32 link_state;         /* link up == 1 */
+        u32 port_speed;         /* effective port speed (rate limit) */
+        u32 mtu;                /* MTU */
+        u32 msglvl;             /* requested driver msg lvl */
+        u32 uif;                /* uplink interface */
+        u32 status;             /* status bits (see VNIC_STF_*) */
+        u32 error;              /* error code (see ERR_*) for first ERR */
+        u32 link_down_cnt;      /* running count of link down transitions */
+};
+#define VNIC_STF_FATAL_ERR      0x0001  /* fatal fw error */
+
+struct vnic_devcmd_provinfo {
+        u8 oui[3];
+        u8 type;
+        u8 data[0];
+};
+
+/*
+ * Writing cmd register causes STAT_BUSY to get set in status register.
+ * When cmd completes, STAT_BUSY will be cleared.
+ *
+ * If cmd completed successfully STAT_ERROR will be clear
+ * and args registers contain cmd-specific results.
+ *
+ * If cmd error, STAT_ERROR will be set and args[0] contains error code.
+ *
+ * status register is read-only.  While STAT_BUSY is set,
+ * all other register contents are read-only.
+ */
+
+/* Make sizeof(vnic_devcmd) a power-of-2 for I/O BAR. */
+#define VNIC_DEVCMD_NARGS 15
+struct vnic_devcmd {
+        u32 status;                     /* RO */
+        u32 cmd;                        /* RW */
+        u64 args[VNIC_DEVCMD_NARGS];    /* RW cmd args (little-endian) */
+};
+
+#endif /* _VNIC_DEVCMD_H_ */
diff --git a/drivers/scsi/fnic/vnic_intr.c b/drivers/scsi/fnic/vnic_intr.c
new file mode 100644
index 00000000000..4f4dc8793d2
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_intr.c
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include "vnic_dev.h"
+#include "vnic_intr.h"
+
+void vnic_intr_free(struct vnic_intr *intr)
+{
+        intr->ctrl = NULL;
+}
+
+int vnic_intr_alloc(struct vnic_dev *vdev, struct vnic_intr *intr,
+        unsigned int index)
+{
+        intr->index = index;
+        intr->vdev = vdev;
+
+        intr->ctrl = vnic_dev_get_res(vdev, RES_TYPE_INTR_CTRL, index);
+        if (!intr->ctrl) {
+                printk(KERN_ERR "Failed to hook INTR[%d].ctrl resource\n",
+                        index);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+void vnic_intr_init(struct vnic_intr *intr, unsigned int coalescing_timer,
+        unsigned int coalescing_type, unsigned int mask_on_assertion)
+{
+        iowrite32(coalescing_timer, &intr->ctrl->coalescing_timer);
+        iowrite32(coalescing_type, &intr->ctrl->coalescing_type);
+        iowrite32(mask_on_assertion, &intr->ctrl->mask_on_assertion);
+        iowrite32(0, &intr->ctrl->int_credits);
+}
+
+void vnic_intr_clean(struct vnic_intr *intr)
+{
+        iowrite32(0, &intr->ctrl->int_credits);
+}
diff --git a/drivers/scsi/fnic/vnic_intr.h b/drivers/scsi/fnic/vnic_intr.h
new file mode 100644
index 00000000000..d5fb40e7c98
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_intr.h
@@ -0,0 +1,118 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_INTR_H_
+#define _VNIC_INTR_H_
+
+#include <linux/pci.h>
+#include "vnic_dev.h"
+
+/*
+ * These defines avoid symbol clash between fnic and enic (Cisco 10G Eth
+ * Driver) when both are built with CONFIG options =y
+ */
+#define vnic_intr_unmask fnic_intr_unmask
+#define vnic_intr_mask fnic_intr_mask
+#define vnic_intr_return_credits fnic_intr_return_credits
+#define vnic_intr_credits fnic_intr_credits
+#define vnic_intr_return_all_credits fnic_intr_return_all_credits
+#define vnic_intr_legacy_pba fnic_intr_legacy_pba
+#define vnic_intr_free fnic_intr_free
+#define vnic_intr_alloc fnic_intr_alloc
+#define vnic_intr_init fnic_intr_init
+#define vnic_intr_clean fnic_intr_clean
+
+#define VNIC_INTR_TIMER_MAX             0xffff
+
+#define VNIC_INTR_TIMER_TYPE_ABS        0
+#define VNIC_INTR_TIMER_TYPE_QUIET      1
+
+/* Interrupt control */
+struct vnic_intr_ctrl {
+        u32 coalescing_timer;           /* 0x00 */
+        u32 pad0;
+        u32 coalescing_value;           /* 0x08 */
+        u32 pad1;
+        u32 coalescing_type;            /* 0x10 */
+        u32 pad2;
+        u32 mask_on_assertion;          /* 0x18 */
+        u32 pad3;
+        u32 mask;                       /* 0x20 */
+        u32 pad4;
+        u32 int_credits;                /* 0x28 */
+        u32 pad5;
+        u32 int_credit_return;          /* 0x30 */
+        u32 pad6;
+};
+
+struct vnic_intr {
+        unsigned int index;
+        struct vnic_dev *vdev;
+        struct vnic_intr_ctrl __iomem *ctrl;    /* memory-mapped */
+};
+
+static inline void vnic_intr_unmask(struct vnic_intr *intr)
+{
+        iowrite32(0, &intr->ctrl->mask);
+}
+
+static inline void vnic_intr_mask(struct vnic_intr *intr)
+{
+        iowrite32(1, &intr->ctrl->mask);
+}
+
+static inline void vnic_intr_return_credits(struct vnic_intr *intr,
+        unsigned int credits, int unmask, int reset_timer)
+{
+#define VNIC_INTR_UNMASK_SHIFT          16
+#define VNIC_INTR_RESET_TIMER_SHIFT     17
+
+        u32 int_credit_return = (credits & 0xffff) |
+                (unmask ? (1 << VNIC_INTR_UNMASK_SHIFT) : 0) |
+                (reset_timer ? (1 << VNIC_INTR_RESET_TIMER_SHIFT) : 0);
+
+        iowrite32(int_credit_return, &intr->ctrl->int_credit_return);
+}
+
+static inline unsigned int vnic_intr_credits(struct vnic_intr *intr)
+{
+        return ioread32(&intr->ctrl->int_credits);
+}
+
+static inline void vnic_intr_return_all_credits(struct vnic_intr *intr)
+{
+        unsigned int credits = vnic_intr_credits(intr);
+        int unmask = 1;
+        int reset_timer = 1;
+
+        vnic_intr_return_credits(intr, credits, unmask, reset_timer);
+}
+
+static inline u32 vnic_intr_legacy_pba(u32 __iomem *legacy_pba)
+{
+        /* read PBA without clearing */
+        return ioread32(legacy_pba);
+}
+
+void vnic_intr_free(struct vnic_intr *intr);
+int vnic_intr_alloc(struct vnic_dev *vdev, struct vnic_intr *intr,
+        unsigned int index);
+void vnic_intr_init(struct vnic_intr *intr, unsigned int coalescing_timer,
+        unsigned int coalescing_type, unsigned int mask_on_assertion);
+void vnic_intr_clean(struct vnic_intr *intr);
+
+#endif /* _VNIC_INTR_H_ */
diff --git a/drivers/scsi/fnic/vnic_nic.h b/drivers/scsi/fnic/vnic_nic.h
new file mode 100644
index 00000000000..f15b83eeace
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_nic.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_NIC_H_
+#define _VNIC_NIC_H_
+
+/*
+ * These defines avoid symbol clash between fnic and enic (Cisco 10G Eth
+ * Driver) when both are built with CONFIG options =y
+ */
+#define vnic_set_nic_cfg fnic_set_nic_cfg
+
+#define NIC_CFG_RSS_DEFAULT_CPU_MASK_FIELD      0xffUL
+#define NIC_CFG_RSS_DEFAULT_CPU_SHIFT           0
+#define NIC_CFG_RSS_HASH_TYPE                   (0xffUL << 8)
+#define NIC_CFG_RSS_HASH_TYPE_MASK_FIELD        0xffUL
+#define NIC_CFG_RSS_HASH_TYPE_SHIFT             8
+#define NIC_CFG_RSS_HASH_BITS                   (7UL << 16)
+#define NIC_CFG_RSS_HASH_BITS_MASK_FIELD        7UL
+#define NIC_CFG_RSS_HASH_BITS_SHIFT             16
+#define NIC_CFG_RSS_BASE_CPU                    (7UL << 19)
+#define NIC_CFG_RSS_BASE_CPU_MASK_FIELD         7UL
+#define NIC_CFG_RSS_BASE_CPU_SHIFT              19
+#define NIC_CFG_RSS_ENABLE                      (1UL << 22)
+#define NIC_CFG_RSS_ENABLE_MASK_FIELD           1UL
+#define NIC_CFG_RSS_ENABLE_SHIFT                22
+#define NIC_CFG_TSO_IPID_SPLIT_EN               (1UL << 23)
+#define NIC_CFG_TSO_IPID_SPLIT_EN_MASK_FIELD    1UL
+#define NIC_CFG_TSO_IPID_SPLIT_EN_SHIFT         23
+#define NIC_CFG_IG_VLAN_STRIP_EN                (1UL << 24)
+#define NIC_CFG_IG_VLAN_STRIP_EN_MASK_FIELD     1UL
+#define NIC_CFG_IG_VLAN_STRIP_EN_SHIFT          24
+
+static inline void vnic_set_nic_cfg(u32 *nic_cfg,
+        u8 rss_default_cpu, u8 rss_hash_type,
+        u8 rss_hash_bits, u8 rss_base_cpu,
+        u8 rss_enable, u8 tso_ipid_split_en,
+        u8 ig_vlan_strip_en)
+{
+        *nic_cfg = (rss_default_cpu & NIC_CFG_RSS_DEFAULT_CPU_MASK_FIELD) |
+                ((rss_hash_type & NIC_CFG_RSS_HASH_TYPE_MASK_FIELD)
+                        << NIC_CFG_RSS_HASH_TYPE_SHIFT) |
+                ((rss_hash_bits & NIC_CFG_RSS_HASH_BITS_MASK_FIELD)
+                        << NIC_CFG_RSS_HASH_BITS_SHIFT) |
+                ((rss_base_cpu & NIC_CFG_RSS_BASE_CPU_MASK_FIELD)
+                        << NIC_CFG_RSS_BASE_CPU_SHIFT) |
+                ((rss_enable & NIC_CFG_RSS_ENABLE_MASK_FIELD)
+                        << NIC_CFG_RSS_ENABLE_SHIFT) |
+                ((tso_ipid_split_en & NIC_CFG_TSO_IPID_SPLIT_EN_MASK_FIELD)
+                        << NIC_CFG_TSO_IPID_SPLIT_EN_SHIFT) |
+                ((ig_vlan_strip_en & NIC_CFG_IG_VLAN_STRIP_EN_MASK_FIELD)
+                        << NIC_CFG_IG_VLAN_STRIP_EN_SHIFT);
+}
+
+#endif /* _VNIC_NIC_H_ */
diff --git a/drivers/scsi/fnic/vnic_resource.h b/drivers/scsi/fnic/vnic_resource.h
new file mode 100644
index 00000000000..2d842f79d41
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_resource.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_RESOURCE_H_
+#define _VNIC_RESOURCE_H_
+
+#define VNIC_RES_MAGIC          0x766E6963L     /* 'vnic' */
+#define VNIC_RES_VERSION        0x00000000L
+
+/* vNIC resource types */
+enum vnic_res_type {
+        RES_TYPE_EOL,                   /* End-of-list */
+        RES_TYPE_WQ,                    /* Work queues */
+        RES_TYPE_RQ,                    /* Receive queues */
+        RES_TYPE_CQ,                    /* Completion queues */
+        RES_TYPE_RSVD1,
+        RES_TYPE_NIC_CFG,               /* Enet NIC config registers */
+        RES_TYPE_RSVD2,
+        RES_TYPE_RSVD3,
+        RES_TYPE_RSVD4,
+        RES_TYPE_RSVD5,
+        RES_TYPE_INTR_CTRL,             /* Interrupt ctrl table */
+        RES_TYPE_INTR_TABLE,            /* MSI/MSI-X Interrupt table */
+        RES_TYPE_INTR_PBA,              /* MSI/MSI-X PBA table */
+        RES_TYPE_INTR_PBA_LEGACY,       /* Legacy intr status */
+        RES_TYPE_RSVD6,
+        RES_TYPE_RSVD7,
+        RES_TYPE_DEVCMD,                /* Device command region */
+        RES_TYPE_PASS_THRU_PAGE,        /* Pass-thru page */
+
+        RES_TYPE_MAX,                   /* Count of resource types */
+};
+
+struct vnic_resource_header {
+        u32 magic;
+        u32 version;
+};
+
+struct vnic_resource {
+        u8 type;
+        u8 bar;
+        u8 pad[2];
+        u32 bar_offset;
+        u32 count;
+};
+
+#endif /* _VNIC_RESOURCE_H_ */
diff --git a/drivers/scsi/fnic/vnic_rq.c b/drivers/scsi/fnic/vnic_rq.c
new file mode 100644
index 00000000000..bedd0d28563
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_rq.c
@@ -0,0 +1,196 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include "vnic_dev.h"
+#include "vnic_rq.h"
+
+static int vnic_rq_alloc_bufs(struct vnic_rq *rq)
+{
+        struct vnic_rq_buf *buf;
+        struct vnic_dev *vdev;
+        unsigned int i, j, count = rq->ring.desc_count;
+        unsigned int blks = VNIC_RQ_BUF_BLKS_NEEDED(count);
+
+        vdev = rq->vdev;
+
+        for (i = 0; i < blks; i++) {
+                rq->bufs[i] = kzalloc(VNIC_RQ_BUF_BLK_SZ, GFP_ATOMIC);
+                if (!rq->bufs[i]) {
+                        printk(KERN_ERR "Failed to alloc rq_bufs\n");
+                        return -ENOMEM;
+                }
+        }
+
+        for (i = 0; i < blks; i++) {
+                buf = rq->bufs[i];
+                for (j = 0; j < VNIC_RQ_BUF_BLK_ENTRIES; j++) {
+                        buf->index = i * VNIC_RQ_BUF_BLK_ENTRIES + j;
+                        buf->desc = (u8 *)rq->ring.descs +
+                                rq->ring.desc_size * buf->index;
+                        if (buf->index + 1 == count) {
+                                buf->next = rq->bufs[0];
+                                break;
+                        } else if (j + 1 == VNIC_RQ_BUF_BLK_ENTRIES) {
+                                buf->next = rq->bufs[i + 1];
+                        } else {
+                                buf->next = buf + 1;
+                                buf++;
+                        }
+                }
+        }
+
+        rq->to_use = rq->to_clean = rq->bufs[0];
+        rq->buf_index = 0;
+
+        return 0;
+}
+
+void vnic_rq_free(struct vnic_rq *rq)
+{
+        struct vnic_dev *vdev;
+        unsigned int i;
+
+        vdev = rq->vdev;
+
+        vnic_dev_free_desc_ring(vdev, &rq->ring);
+
+        for (i = 0; i < VNIC_RQ_BUF_BLKS_MAX; i++) {
+                kfree(rq->bufs[i]);
+                rq->bufs[i] = NULL;
+        }
+
+        rq->ctrl = NULL;
+}
+
+int vnic_rq_alloc(struct vnic_dev *vdev, struct vnic_rq *rq, unsigned int index,
+        unsigned int desc_count, unsigned int desc_size)
+{
+        int err;
+
+        rq->index = index;
+        rq->vdev = vdev;
+
+        rq->ctrl = vnic_dev_get_res(vdev, RES_TYPE_RQ, index);
+        if (!rq->ctrl) {
+                printk(KERN_ERR "Failed to hook RQ[%d] resource\n", index);
+                return -EINVAL;
+        }
+
+        vnic_rq_disable(rq);
+
+        err = vnic_dev_alloc_desc_ring(vdev, &rq->ring, desc_count, desc_size);
+        if (err)
+                return err;
+
+        err = vnic_rq_alloc_bufs(rq);
+        if (err) {
+                vnic_rq_free(rq);
+                return err;
+        }
+
+        return 0;
+}
+
+void vnic_rq_init(struct vnic_rq *rq, unsigned int cq_index,
+        unsigned int error_interrupt_enable,
+        unsigned int error_interrupt_offset)
+{
+        u64 paddr;
+        u32 fetch_index;
+
+        paddr = (u64)rq->ring.base_addr | VNIC_PADDR_TARGET;
+        writeq(paddr, &rq->ctrl->ring_base);
+        iowrite32(rq->ring.desc_count, &rq->ctrl->ring_size);
+        iowrite32(cq_index, &rq->ctrl->cq_index);
+        iowrite32(error_interrupt_enable, &rq->ctrl->error_interrupt_enable);
+        iowrite32(error_interrupt_offset, &rq->ctrl->error_interrupt_offset);
+        iowrite32(0, &rq->ctrl->dropped_packet_count);
+        iowrite32(0, &rq->ctrl->error_status);
+
+        /* Use current fetch_index as the ring starting point */
+        fetch_index = ioread32(&rq->ctrl->fetch_index);
+        rq->to_use = rq->to_clean =
+                &rq->bufs[fetch_index / VNIC_RQ_BUF_BLK_ENTRIES]
+                        [fetch_index % VNIC_RQ_BUF_BLK_ENTRIES];
+        iowrite32(fetch_index, &rq->ctrl->posted_index);
+
+        rq->buf_index = 0;
+}
+
+unsigned int vnic_rq_error_status(struct vnic_rq *rq)
+{
+        return ioread32(&rq->ctrl->error_status);
+}
+
+void vnic_rq_enable(struct vnic_rq *rq)
+{
+        iowrite32(1, &rq->ctrl->enable);
+}
+
+int vnic_rq_disable(struct vnic_rq *rq)
+{
+        unsigned int wait;
+
+        iowrite32(0, &rq->ctrl->enable);
+
+        /* Wait for HW to ACK disable request */
+        for (wait = 0; wait < 100; wait++) {
+                if (!(ioread32(&rq->ctrl->running)))
+                        return 0;
+                udelay(1);
+        }
+
+        printk(KERN_ERR "Failed to disable RQ[%d]\n", rq->index);
+
+        return -ETIMEDOUT;
+}
+
+void vnic_rq_clean(struct vnic_rq *rq,
+        void (*buf_clean)(struct vnic_rq *rq, struct vnic_rq_buf *buf))
+{
+        struct vnic_rq_buf *buf;
+        u32 fetch_index;
+
+        BUG_ON(ioread32(&rq->ctrl->enable));
+
+        buf = rq->to_clean;
+
+        while (vnic_rq_desc_used(rq) > 0) {
+
+                (*buf_clean)(rq, buf);
+
+                buf = rq->to_clean = buf->next;
+                rq->ring.desc_avail++;
+        }
+
+        /* Use current fetch_index as the ring starting point */
+        fetch_index = ioread32(&rq->ctrl->fetch_index);
+        rq->to_use = rq->to_clean =
+                &rq->bufs[fetch_index / VNIC_RQ_BUF_BLK_ENTRIES]
+                        [fetch_index % VNIC_RQ_BUF_BLK_ENTRIES];
+        iowrite32(fetch_index, &rq->ctrl->posted_index);
+
+        rq->buf_index = 0;
+
+        vnic_dev_clear_desc_ring(&rq->ring);
+}
+
diff --git a/drivers/scsi/fnic/vnic_rq.h b/drivers/scsi/fnic/vnic_rq.h
new file mode 100644
index 00000000000..aebdfbd6ad3
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_rq.h
@@ -0,0 +1,235 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_RQ_H_
+#define _VNIC_RQ_H_
+
+#include <linux/pci.h>
+#include "vnic_dev.h"
+#include "vnic_cq.h"
+
+/*
+ * These defines avoid symbol clash between fnic and enic (Cisco 10G Eth
+ * Driver) when both are built with CONFIG options =y
+ */
+#define vnic_rq_desc_avail fnic_rq_desc_avail
+#define vnic_rq_desc_used fnic_rq_desc_used
+#define vnic_rq_next_desc fnic_rq_next_desc
+#define vnic_rq_next_index fnic_rq_next_index
+#define vnic_rq_next_buf_index fnic_rq_next_buf_index
+#define vnic_rq_post fnic_rq_post
+#define vnic_rq_posting_soon fnic_rq_posting_soon
+#define vnic_rq_return_descs fnic_rq_return_descs
+#define vnic_rq_service fnic_rq_service
+#define vnic_rq_fill fnic_rq_fill
+#define vnic_rq_free fnic_rq_free
+#define vnic_rq_alloc fnic_rq_alloc
+#define vnic_rq_init fnic_rq_init
+#define vnic_rq_error_status fnic_rq_error_status
+#define vnic_rq_enable fnic_rq_enable
+#define vnic_rq_disable fnic_rq_disable
+#define vnic_rq_clean fnic_rq_clean
+
+/* Receive queue control */
+struct vnic_rq_ctrl {
+        u64 ring_base;                  /* 0x00 */
+        u32 ring_size;                  /* 0x08 */
+        u32 pad0;
+        u32 posted_index;               /* 0x10 */
+        u32 pad1;
+        u32 cq_index;                   /* 0x18 */
+        u32 pad2;
+        u32 enable;                     /* 0x20 */
+        u32 pad3;
+        u32 running;                    /* 0x28 */
+        u32 pad4;
+        u32 fetch_index;                /* 0x30 */
+        u32 pad5;
+        u32 error_interrupt_enable;     /* 0x38 */
+        u32 pad6;
+        u32 error_interrupt_offset;     /* 0x40 */
+        u32 pad7;
+        u32 error_status;               /* 0x48 */
+        u32 pad8;
+        u32 dropped_packet_count;       /* 0x50 */
+        u32 pad9;
+        u32 dropped_packet_count_rc;    /* 0x58 */
+        u32 pad10;
+};
+
+/* Break the vnic_rq_buf allocations into blocks of 64 entries */
+#define VNIC_RQ_BUF_BLK_ENTRIES 64
+#define VNIC_RQ_BUF_BLK_SZ \
+        (VNIC_RQ_BUF_BLK_ENTRIES * sizeof(struct vnic_rq_buf))
+#define VNIC_RQ_BUF_BLKS_NEEDED(entries) \
+        DIV_ROUND_UP(entries, VNIC_RQ_BUF_BLK_ENTRIES)
+#define VNIC_RQ_BUF_BLKS_MAX VNIC_RQ_BUF_BLKS_NEEDED(4096)
+
+struct vnic_rq_buf {
+        struct vnic_rq_buf *next;
+        dma_addr_t dma_addr;
+        void *os_buf;
+        unsigned int os_buf_index;
+        unsigned int len;
+        unsigned int index;
+        void *desc;
+};
+
+struct vnic_rq {
+        unsigned int index;
+        struct vnic_dev *vdev;
+        struct vnic_rq_ctrl __iomem *ctrl;      /* memory-mapped */
+        struct vnic_dev_ring ring;
+        struct vnic_rq_buf *bufs[VNIC_RQ_BUF_BLKS_MAX];
+        struct vnic_rq_buf *to_use;
+        struct vnic_rq_buf *to_clean;
+        void *os_buf_head;
+        unsigned int buf_index;
+        unsigned int pkts_outstanding;
+};
+
+static inline unsigned int vnic_rq_desc_avail(struct vnic_rq *rq)
+{
+        /* how many does SW own? */
+        return rq->ring.desc_avail;
+}
+
+static inline unsigned int vnic_rq_desc_used(struct vnic_rq *rq)
+{
+        /* how many does HW own? */
+        return rq->ring.desc_count - rq->ring.desc_avail - 1;
+}
+
+static inline void *vnic_rq_next_desc(struct vnic_rq *rq)
+{
+        return rq->to_use->desc;
+}
+
+static inline unsigned int vnic_rq_next_index(struct vnic_rq *rq)
+{
+        return rq->to_use->index;
+}
+
+static inline unsigned int vnic_rq_next_buf_index(struct vnic_rq *rq)
+{
+        return rq->buf_index++;
+}
+
+static inline void vnic_rq_post(struct vnic_rq *rq,
+        void *os_buf, unsigned int os_buf_index,
+        dma_addr_t dma_addr, unsigned int len)
+{
+        struct vnic_rq_buf *buf = rq->to_use;
+
+        buf->os_buf = os_buf;
+        buf->os_buf_index = os_buf_index;
+        buf->dma_addr = dma_addr;
+        buf->len = len;
+
+        buf = buf->next;
+        rq->to_use = buf;
+        rq->ring.desc_avail--;
+
+        /* Move the posted_index every nth descriptor
+         */
+
+#ifndef VNIC_RQ_RETURN_RATE
+#define VNIC_RQ_RETURN_RATE             0xf     /* keep 2^n - 1 */
+#endif
+
+        if ((buf->index & VNIC_RQ_RETURN_RATE) == 0) {
+                /* Adding write memory barrier prevents compiler and/or CPU
+                 * reordering, thus avoiding descriptor posting before
+                 * descriptor is initialized. Otherwise, hardware can read
+                 * stale descriptor fields.
+                 */
+                wmb();
+                iowrite32(buf->index, &rq->ctrl->posted_index);
+        }
+}
+
+static inline int vnic_rq_posting_soon(struct vnic_rq *rq)
+{
+        return (rq->to_use->index & VNIC_RQ_RETURN_RATE) == 0;
+}
+
+static inline void vnic_rq_return_descs(struct vnic_rq *rq, unsigned int count)
+{
+        rq->ring.desc_avail += count;
+}
+
+enum desc_return_options {
+        VNIC_RQ_RETURN_DESC,
+        VNIC_RQ_DEFER_RETURN_DESC,
+};
+
+static inline void vnic_rq_service(struct vnic_rq *rq,
+        struct cq_desc *cq_desc, u16 completed_index,
+        int desc_return, void (*buf_service)(struct vnic_rq *rq,
+        struct cq_desc *cq_desc, struct vnic_rq_buf *buf,
+        int skipped, void *opaque), void *opaque)
+{
+        struct vnic_rq_buf *buf;
+        int skipped;
+
+        buf = rq->to_clean;
+        while (1) {
+
+                skipped = (buf->index != completed_index);
+
+                (*buf_service)(rq, cq_desc, buf, skipped, opaque);
+
+                if (desc_return == VNIC_RQ_RETURN_DESC)
+                        rq->ring.desc_avail++;
+
+                rq->to_clean = buf->next;
+
+                if (!skipped)
+                        break;
+
+                buf = rq->to_clean;
+        }
+}
+
+static inline int vnic_rq_fill(struct vnic_rq *rq,
+        int (*buf_fill)(struct vnic_rq *rq))
+{
+        int err;
+
+        while (vnic_rq_desc_avail(rq) > 1) {
+
+                err = (*buf_fill)(rq);
+                if (err)
+                        return err;
+        }
+
+        return 0;
+}
+
+void vnic_rq_free(struct vnic_rq *rq);
+int vnic_rq_alloc(struct vnic_dev *vdev, struct vnic_rq *rq, unsigned int index,
+        unsigned int desc_count, unsigned int desc_size);
+void vnic_rq_init(struct vnic_rq *rq, unsigned int cq_index,
+        unsigned int error_interrupt_enable,
+        unsigned int error_interrupt_offset);
+unsigned int vnic_rq_error_status(struct vnic_rq *rq);
+void vnic_rq_enable(struct vnic_rq *rq);
+int vnic_rq_disable(struct vnic_rq *rq);
+void vnic_rq_clean(struct vnic_rq *rq,
+        void (*buf_clean)(struct vnic_rq *rq, struct vnic_rq_buf *buf));
+
+#endif /* _VNIC_RQ_H_ */
diff --git a/drivers/scsi/fnic/vnic_scsi.h b/drivers/scsi/fnic/vnic_scsi.h
new file mode 100644
index 00000000000..46baa525400
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_scsi.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_SCSI_H_
+#define _VNIC_SCSI_H_
+
+#define VNIC_FNIC_WQ_COPY_COUNT_MIN         1
+#define VNIC_FNIC_WQ_COPY_COUNT_MAX         1
+
+#define VNIC_FNIC_WQ_DESCS_MIN              64
+#define VNIC_FNIC_WQ_DESCS_MAX              128
+
+#define VNIC_FNIC_WQ_COPY_DESCS_MIN         64
+#define VNIC_FNIC_WQ_COPY_DESCS_MAX         512
+
+#define VNIC_FNIC_RQ_DESCS_MIN              64
+#define VNIC_FNIC_RQ_DESCS_MAX              128
+
+#define VNIC_FNIC_EDTOV_MIN                 1000
+#define VNIC_FNIC_EDTOV_MAX                 255000
+#define VNIC_FNIC_EDTOV_DEF                 2000
+
+#define VNIC_FNIC_RATOV_MIN                 1000
+#define VNIC_FNIC_RATOV_MAX                 255000
+
+#define VNIC_FNIC_MAXDATAFIELDSIZE_MIN      256
+#define VNIC_FNIC_MAXDATAFIELDSIZE_MAX      2112
+
+#define VNIC_FNIC_FLOGI_RETRIES_MIN         0
+#define VNIC_FNIC_FLOGI_RETRIES_MAX         0xffffffff
+#define VNIC_FNIC_FLOGI_RETRIES_DEF         0xffffffff
+
+#define VNIC_FNIC_FLOGI_TIMEOUT_MIN         1000
+#define VNIC_FNIC_FLOGI_TIMEOUT_MAX         255000
+
+#define VNIC_FNIC_PLOGI_RETRIES_MIN         0
+#define VNIC_FNIC_PLOGI_RETRIES_MAX         255
+#define VNIC_FNIC_PLOGI_RETRIES_DEF         8
+
+#define VNIC_FNIC_PLOGI_TIMEOUT_MIN         1000
+#define VNIC_FNIC_PLOGI_TIMEOUT_MAX         255000
+
+#define VNIC_FNIC_IO_THROTTLE_COUNT_MIN     256
+#define VNIC_FNIC_IO_THROTTLE_COUNT_MAX     4096
+
+#define VNIC_FNIC_LINK_DOWN_TIMEOUT_MIN     0
+#define VNIC_FNIC_LINK_DOWN_TIMEOUT_MAX     240000
+
+#define VNIC_FNIC_PORT_DOWN_TIMEOUT_MIN     0
+#define VNIC_FNIC_PORT_DOWN_TIMEOUT_MAX     240000
+
+#define VNIC_FNIC_PORT_DOWN_IO_RETRIES_MIN  0
+#define VNIC_FNIC_PORT_DOWN_IO_RETRIES_MAX  255
+
+#define VNIC_FNIC_LUNS_PER_TARGET_MIN       1
+#define VNIC_FNIC_LUNS_PER_TARGET_MAX       1024
+
+/* Device-specific region: scsi configuration */
+struct vnic_fc_config {
+        u64 node_wwn;
+        u64 port_wwn;
+        u32 flags;
+        u32 wq_enet_desc_count;
+        u32 wq_copy_desc_count;
+        u32 rq_desc_count;
+        u32 flogi_retries;
+        u32 flogi_timeout;
+        u32 plogi_retries;
+        u32 plogi_timeout;
+        u32 io_throttle_count;
+        u32 link_down_timeout;
+        u32 port_down_timeout;
+        u32 port_down_io_retries;
+        u32 luns_per_tgt;
+        u16 maxdatafieldsize;
+        u16 ed_tov;
+        u16 ra_tov;
+        u16 intr_timer;
+        u8 intr_timer_type;
+};
+
+#define VFCF_FCP_SEQ_LVL_ERR    0x1     /* Enable FCP-2 Error Recovery */
+#define VFCF_PERBI              0x2     /* persistent binding info available */
+
+#endif /* _VNIC_SCSI_H_ */
diff --git a/drivers/scsi/fnic/vnic_stats.h b/drivers/scsi/fnic/vnic_stats.h
new file mode 100644
index 00000000000..5372e23c1cb
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_stats.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_STATS_H_
+#define _VNIC_STATS_H_
+
+/* Tx statistics */
+struct vnic_tx_stats {
+        u64 tx_frames_ok;
+        u64 tx_unicast_frames_ok;
+        u64 tx_multicast_frames_ok;
+        u64 tx_broadcast_frames_ok;
+        u64 tx_bytes_ok;
+        u64 tx_unicast_bytes_ok;
+        u64 tx_multicast_bytes_ok;
+        u64 tx_broadcast_bytes_ok;
+        u64 tx_drops;
+        u64 tx_errors;
+        u64 tx_tso;
+        u64 rsvd[16];
+};
+
+/* Rx statistics */
+struct vnic_rx_stats {
+        u64 rx_frames_ok;
+        u64 rx_frames_total;
+        u64 rx_unicast_frames_ok;
+        u64 rx_multicast_frames_ok;
+        u64 rx_broadcast_frames_ok;
+        u64 rx_bytes_ok;
+        u64 rx_unicast_bytes_ok;
+        u64 rx_multicast_bytes_ok;
+        u64 rx_broadcast_bytes_ok;
+        u64 rx_drop;
+        u64 rx_no_bufs;
+        u64 rx_errors;
+        u64 rx_rss;
+        u64 rx_crc_errors;
+        u64 rx_frames_64;
+        u64 rx_frames_127;
+        u64 rx_frames_255;
+        u64 rx_frames_511;
+        u64 rx_frames_1023;
+        u64 rx_frames_1518;
+        u64 rx_frames_to_max;
+        u64 rsvd[16];
+};
+
+struct vnic_stats {
+        struct vnic_tx_stats tx;
+        struct vnic_rx_stats rx;
+};
+
+#endif /* _VNIC_STATS_H_ */
diff --git a/drivers/scsi/fnic/vnic_wq.c b/drivers/scsi/fnic/vnic_wq.c
new file mode 100644
index 00000000000..1f9ea790d13
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_wq.c
@@ -0,0 +1,182 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include "vnic_dev.h"
+#include "vnic_wq.h"
+
+static int vnic_wq_alloc_bufs(struct vnic_wq *wq)
+{
+        struct vnic_wq_buf *buf;
+        struct vnic_dev *vdev;
+        unsigned int i, j, count = wq->ring.desc_count;
+        unsigned int blks = VNIC_WQ_BUF_BLKS_NEEDED(count);
+
+        vdev = wq->vdev;
+
+        for (i = 0; i < blks; i++) {
+                wq->bufs[i] = kzalloc(VNIC_WQ_BUF_BLK_SZ, GFP_ATOMIC);
+                if (!wq->bufs[i]) {
+                        printk(KERN_ERR "Failed to alloc wq_bufs\n");
+                        return -ENOMEM;
+                }
+        }
+
+        for (i = 0; i < blks; i++) {
+                buf = wq->bufs[i];
+                for (j = 0; j < VNIC_WQ_BUF_BLK_ENTRIES; j++) {
+                        buf->index = i * VNIC_WQ_BUF_BLK_ENTRIES + j;
+                        buf->desc = (u8 *)wq->ring.descs +
+                                wq->ring.desc_size * buf->index;
+                        if (buf->index + 1 == count) {
+                                buf->next = wq->bufs[0];
+                                break;
+                        } else if (j + 1 == VNIC_WQ_BUF_BLK_ENTRIES) {
+                                buf->next = wq->bufs[i + 1];
+                        } else {
+                                buf->next = buf + 1;
+                                buf++;
+                        }
+                }
+        }
+
+        wq->to_use = wq->to_clean = wq->bufs[0];
+
+        return 0;
+}
+
+void vnic_wq_free(struct vnic_wq *wq)
+{
+        struct vnic_dev *vdev;
+        unsigned int i;
+
+        vdev = wq->vdev;
+
+        vnic_dev_free_desc_ring(vdev, &wq->ring);
+
+        for (i = 0; i < VNIC_WQ_BUF_BLKS_MAX; i++) {
+                kfree(wq->bufs[i]);
+                wq->bufs[i] = NULL;
+        }
+
+        wq->ctrl = NULL;
+
+}
+
+int vnic_wq_alloc(struct vnic_dev *vdev, struct vnic_wq *wq, unsigned int index,
+        unsigned int desc_count, unsigned int desc_size)
+{
+        int err;
+
+        wq->index = index;
+        wq->vdev = vdev;
+
+        wq->ctrl = vnic_dev_get_res(vdev, RES_TYPE_WQ, index);
+        if (!wq->ctrl) {
+                printk(KERN_ERR "Failed to hook WQ[%d] resource\n", index);
+                return -EINVAL;
+        }
+
+        vnic_wq_disable(wq);
+
+        err = vnic_dev_alloc_desc_ring(vdev, &wq->ring, desc_count, desc_size);
+        if (err)
+                return err;
+
+        err = vnic_wq_alloc_bufs(wq);
+        if (err) {
+                vnic_wq_free(wq);
+                return err;
+        }
+
+        return 0;
+}
+
+void vnic_wq_init(struct vnic_wq *wq, unsigned int cq_index,
+        unsigned int error_interrupt_enable,
+        unsigned int error_interrupt_offset)
+{
+        u64 paddr;
+
+        paddr = (u64)wq->ring.base_addr | VNIC_PADDR_TARGET;
+        writeq(paddr, &wq->ctrl->ring_base);
+        iowrite32(wq->ring.desc_count, &wq->ctrl->ring_size);
+        iowrite32(0, &wq->ctrl->fetch_index);
+        iowrite32(0, &wq->ctrl->posted_index);
+        iowrite32(cq_index, &wq->ctrl->cq_index);
+        iowrite32(error_interrupt_enable, &wq->ctrl->error_interrupt_enable);
+        iowrite32(error_interrupt_offset, &wq->ctrl->error_interrupt_offset);
+        iowrite32(0, &wq->ctrl->error_status);
+}
+
+unsigned int vnic_wq_error_status(struct vnic_wq *wq)
+{
+        return ioread32(&wq->ctrl->error_status);
+}
+
+void vnic_wq_enable(struct vnic_wq *wq)
+{
+        iowrite32(1, &wq->ctrl->enable);
+}
+
+int vnic_wq_disable(struct vnic_wq *wq)
+{
+        unsigned int wait;
+
+        iowrite32(0, &wq->ctrl->enable);
+
+        /* Wait for HW to ACK disable request */
+        for (wait = 0; wait < 100; wait++) {
+                if (!(ioread32(&wq->ctrl->running)))
+                        return 0;
+                udelay(1);
+        }
+
+        printk(KERN_ERR "Failed to disable WQ[%d]\n", wq->index);
+
+        return -ETIMEDOUT;
+}
+
+void vnic_wq_clean(struct vnic_wq *wq,
+        void (*buf_clean)(struct vnic_wq *wq, struct vnic_wq_buf *buf))
+{
+        struct vnic_wq_buf *buf;
+
+        BUG_ON(ioread32(&wq->ctrl->enable));
+
+        buf = wq->to_clean;
+
+        while (vnic_wq_desc_used(wq) > 0) {
+
+                (*buf_clean)(wq, buf);
+
+                buf = wq->to_clean = buf->next;
+                wq->ring.desc_avail++;
+        }
+
+        wq->to_use = wq->to_clean = wq->bufs[0];
+
+        iowrite32(0, &wq->ctrl->fetch_index);
+        iowrite32(0, &wq->ctrl->posted_index);
+        iowrite32(0, &wq->ctrl->error_status);
+
+        vnic_dev_clear_desc_ring(&wq->ring);
+}
diff --git a/drivers/scsi/fnic/vnic_wq.h b/drivers/scsi/fnic/vnic_wq.h
new file mode 100644
index 00000000000..5cd094f7928
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_wq.h
@@ -0,0 +1,175 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_WQ_H_
+#define _VNIC_WQ_H_
+
+#include <linux/pci.h>
+#include "vnic_dev.h"
+#include "vnic_cq.h"
+
+/*
+ * These defines avoid symbol clash between fnic and enic (Cisco 10G Eth
+ * Driver) when both are built with CONFIG options =y
+ */
+#define vnic_wq_desc_avail fnic_wq_desc_avail
+#define vnic_wq_desc_used fnic_wq_desc_used
+#define vnic_wq_next_desc fni_cwq_next_desc
+#define vnic_wq_post fnic_wq_post
+#define vnic_wq_service fnic_wq_service
+#define vnic_wq_free fnic_wq_free
+#define vnic_wq_alloc fnic_wq_alloc
+#define vnic_wq_init fnic_wq_init
+#define vnic_wq_error_status fnic_wq_error_status
+#define vnic_wq_enable fnic_wq_enable
+#define vnic_wq_disable fnic_wq_disable
+#define vnic_wq_clean fnic_wq_clean
+
+/* Work queue control */
+struct vnic_wq_ctrl {
+        u64 ring_base;                  /* 0x00 */
+        u32 ring_size;                  /* 0x08 */
+        u32 pad0;
+        u32 posted_index;               /* 0x10 */
+        u32 pad1;
+        u32 cq_index;                   /* 0x18 */
+        u32 pad2;
+        u32 enable;                     /* 0x20 */
+        u32 pad3;
+        u32 running;                    /* 0x28 */
+        u32 pad4;
+        u32 fetch_index;                /* 0x30 */
+        u32 pad5;
+        u32 dca_value;                  /* 0x38 */
+        u32 pad6;
+        u32 error_interrupt_enable;     /* 0x40 */
+        u32 pad7;
+        u32 error_interrupt_offset;     /* 0x48 */
+        u32 pad8;
+        u32 error_status;               /* 0x50 */
+        u32 pad9;
+};
+
+struct vnic_wq_buf {
+        struct vnic_wq_buf *next;
+        dma_addr_t dma_addr;
+        void *os_buf;
+        unsigned int len;
+        unsigned int index;
+        int sop;
+        void *desc;
+};
+
+/* Break the vnic_wq_buf allocations into blocks of 64 entries */
+#define VNIC_WQ_BUF_BLK_ENTRIES 64
+#define VNIC_WQ_BUF_BLK_SZ \
+        (VNIC_WQ_BUF_BLK_ENTRIES * sizeof(struct vnic_wq_buf))
+#define VNIC_WQ_BUF_BLKS_NEEDED(entries) \
+        DIV_ROUND_UP(entries, VNIC_WQ_BUF_BLK_ENTRIES)
+#define VNIC_WQ_BUF_BLKS_MAX VNIC_WQ_BUF_BLKS_NEEDED(4096)
+
+struct vnic_wq {
+        unsigned int index;
+        struct vnic_dev *vdev;
+        struct vnic_wq_ctrl __iomem *ctrl;      /* memory-mapped */
+        struct vnic_dev_ring ring;
+        struct vnic_wq_buf *bufs[VNIC_WQ_BUF_BLKS_MAX];
+        struct vnic_wq_buf *to_use;
+        struct vnic_wq_buf *to_clean;
+        unsigned int pkts_outstanding;
+};
+
+static inline unsigned int vnic_wq_desc_avail(struct vnic_wq *wq)
+{
+        /* how many does SW own? */
+        return wq->ring.desc_avail;
+}
+
+static inline unsigned int vnic_wq_desc_used(struct vnic_wq *wq)
+{
+        /* how many does HW own? */
+        return wq->ring.desc_count - wq->ring.desc_avail - 1;
+}
+
+static inline void *vnic_wq_next_desc(struct vnic_wq *wq)
+{
+        return wq->to_use->desc;
+}
+
+static inline void vnic_wq_post(struct vnic_wq *wq,
+        void *os_buf, dma_addr_t dma_addr,
+        unsigned int len, int sop, int eop)
+{
+        struct vnic_wq_buf *buf = wq->to_use;
+
+        buf->sop = sop;
+        buf->os_buf = eop ? os_buf : NULL;
+        buf->dma_addr = dma_addr;
+        buf->len = len;
+
+        buf = buf->next;
+        if (eop) {
+                /* Adding write memory barrier prevents compiler and/or CPU
+                 * reordering, thus avoiding descriptor posting before
+                 * descriptor is initialized. Otherwise, hardware can read
+                 * stale descriptor fields.
+                 */
+                wmb();
+                iowrite32(buf->index, &wq->ctrl->posted_index);
+        }
+        wq->to_use = buf;
+
+        wq->ring.desc_avail--;
+}
+
+static inline void vnic_wq_service(struct vnic_wq *wq,
+        struct cq_desc *cq_desc, u16 completed_index,
+        void (*buf_service)(struct vnic_wq *wq,
+        struct cq_desc *cq_desc, struct vnic_wq_buf *buf, void *opaque),
+        void *opaque)
+{
+        struct vnic_wq_buf *buf;
+
+        buf = wq->to_clean;
+        while (1) {
+
+                (*buf_service)(wq, cq_desc, buf, opaque);
+
+                wq->ring.desc_avail++;
+
+                wq->to_clean = buf->next;
+
+                if (buf->index == completed_index)
+                        break;
+
+                buf = wq->to_clean;
+        }
+}
+
+void vnic_wq_free(struct vnic_wq *wq);
+int vnic_wq_alloc(struct vnic_dev *vdev, struct vnic_wq *wq, unsigned int index,
+        unsigned int desc_count, unsigned int desc_size);
+void vnic_wq_init(struct vnic_wq *wq, unsigned int cq_index,
+        unsigned int error_interrupt_enable,
+        unsigned int error_interrupt_offset);
+unsigned int vnic_wq_error_status(struct vnic_wq *wq);
+void vnic_wq_enable(struct vnic_wq *wq);
+int vnic_wq_disable(struct vnic_wq *wq);
+void vnic_wq_clean(struct vnic_wq *wq,
+        void (*buf_clean)(struct vnic_wq *wq, struct vnic_wq_buf *buf));
+
+#endif /* _VNIC_WQ_H_ */
diff --git a/drivers/scsi/fnic/vnic_wq_copy.c b/drivers/scsi/fnic/vnic_wq_copy.c
new file mode 100644
index 00000000000..9eab7e7caf3
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_wq_copy.c
@@ -0,0 +1,117 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include "vnic_wq_copy.h"
+
+void vnic_wq_copy_enable(struct vnic_wq_copy *wq)
+{
+        iowrite32(1, &wq->ctrl->enable);
+}
+
+int vnic_wq_copy_disable(struct vnic_wq_copy *wq)
+{
+        unsigned int wait;
+
+        iowrite32(0, &wq->ctrl->enable);
+
+        /* Wait for HW to ACK disable request */
+        for (wait = 0; wait < 100; wait++) {
+                if (!(ioread32(&wq->ctrl->running)))
+                        return 0;
+                udelay(1);
+        }
+
+        printk(KERN_ERR "Failed to disable Copy WQ[%d],"
+               " fetch index=%d, posted_index=%d\n",
+               wq->index, ioread32(&wq->ctrl->fetch_index),
+               ioread32(&wq->ctrl->posted_index));
+
+        return -ENODEV;
+}
+
+void vnic_wq_copy_clean(struct vnic_wq_copy *wq,
+        void (*q_clean)(struct vnic_wq_copy *wq,
+        struct fcpio_host_req *wq_desc))
+{
+        BUG_ON(ioread32(&wq->ctrl->enable));
+
+        if (vnic_wq_copy_desc_in_use(wq))
+                vnic_wq_copy_service(wq, -1, q_clean);
+
+        wq->to_use_index = wq->to_clean_index = 0;
+
+        iowrite32(0, &wq->ctrl->fetch_index);
+        iowrite32(0, &wq->ctrl->posted_index);
+        iowrite32(0, &wq->ctrl->error_status);
+
+        vnic_dev_clear_desc_ring(&wq->ring);
+}
+
+void vnic_wq_copy_free(struct vnic_wq_copy *wq)
+{
+        struct vnic_dev *vdev;
+
+        vdev = wq->vdev;
+        vnic_dev_free_desc_ring(vdev, &wq->ring);
+        wq->ctrl = NULL;
+}
+
+int vnic_wq_copy_alloc(struct vnic_dev *vdev, struct vnic_wq_copy *wq,
+                       unsigned int index, unsigned int desc_count,
+                       unsigned int desc_size)
+{
+        int err;
+
+        wq->index = index;
+        wq->vdev = vdev;
+        wq->to_use_index = wq->to_clean_index = 0;
+        wq->ctrl = vnic_dev_get_res(vdev, RES_TYPE_WQ, index);
+        if (!wq->ctrl) {
+                printk(KERN_ERR "Failed to hook COPY WQ[%d] resource\n", index);
+                return -EINVAL;
+        }
+
+        vnic_wq_copy_disable(wq);
+
+        err = vnic_dev_alloc_desc_ring(vdev, &wq->ring, desc_count, desc_size);
+        if (err)
+                return err;
+
+        return 0;
+}
+
+void vnic_wq_copy_init(struct vnic_wq_copy *wq, unsigned int cq_index,
+        unsigned int error_interrupt_enable,
+        unsigned int error_interrupt_offset)
+{
+        u64 paddr;
+
+        paddr = (u64)wq->ring.base_addr | VNIC_PADDR_TARGET;
+        writeq(paddr, &wq->ctrl->ring_base);
+        iowrite32(wq->ring.desc_count, &wq->ctrl->ring_size);
+        iowrite32(0, &wq->ctrl->fetch_index);
+        iowrite32(0, &wq->ctrl->posted_index);
+        iowrite32(cq_index, &wq->ctrl->cq_index);
+        iowrite32(error_interrupt_enable, &wq->ctrl->error_interrupt_enable);
+        iowrite32(error_interrupt_offset, &wq->ctrl->error_interrupt_offset);
+}
+
diff --git a/drivers/scsi/fnic/vnic_wq_copy.h b/drivers/scsi/fnic/vnic_wq_copy.h
new file mode 100644
index 00000000000..6aff9740c3d
--- /dev/null
+++ b/drivers/scsi/fnic/vnic_wq_copy.h
@@ -0,0 +1,128 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _VNIC_WQ_COPY_H_
+#define _VNIC_WQ_COPY_H_
+
+#include <linux/pci.h>
+#include "vnic_wq.h"
+#include "fcpio.h"
+
+#define VNIC_WQ_COPY_MAX 1
+
+struct vnic_wq_copy {
+        unsigned int index;
+        struct vnic_dev *vdev;
+        struct vnic_wq_ctrl __iomem *ctrl;      /* memory-mapped */
+        struct vnic_dev_ring ring;
+        unsigned to_use_index;
+        unsigned to_clean_index;
+};
+
+static inline unsigned int vnic_wq_copy_desc_avail(struct vnic_wq_copy *wq)
+{
+        return wq->ring.desc_avail;
+}
+
+static inline unsigned int vnic_wq_copy_desc_in_use(struct vnic_wq_copy *wq)
+{
+        return wq->ring.desc_count - 1 - wq->ring.desc_avail;
+}
+
+static inline void *vnic_wq_copy_next_desc(struct vnic_wq_copy *wq)
+{
+        struct fcpio_host_req *desc = wq->ring.descs;
+        return &desc[wq->to_use_index];
+}
+
+static inline void vnic_wq_copy_post(struct vnic_wq_copy *wq)
+{
+
+        ((wq->to_use_index + 1) == wq->ring.desc_count) ?
+                (wq->to_use_index = 0) : (wq->to_use_index++);
+        wq->ring.desc_avail--;
+
+        /* Adding write memory barrier prevents compiler and/or CPU
+         * reordering, thus avoiding descriptor posting before
+         * descriptor is initialized. Otherwise, hardware can read
+         * stale descriptor fields.
+         */
+        wmb();
+
+        iowrite32(wq->to_use_index, &wq->ctrl->posted_index);
+}
+
+static inline void vnic_wq_copy_desc_process(struct vnic_wq_copy *wq, u16 index)
+{
+        unsigned int cnt;
+
+        if (wq->to_clean_index <= index)
+                cnt = (index - wq->to_clean_index) + 1;
+        else
+                cnt = wq->ring.desc_count - wq->to_clean_index + index + 1;
+
+        wq->to_clean_index = ((index + 1) % wq->ring.desc_count);
+        wq->ring.desc_avail += cnt;
+
+}
+
+static inline void vnic_wq_copy_service(struct vnic_wq_copy *wq,
+        u16 completed_index,
+        void (*q_service)(struct vnic_wq_copy *wq,
+        struct fcpio_host_req *wq_desc))
+{
+        struct fcpio_host_req *wq_desc = wq->ring.descs;
+        unsigned int curr_index;
+
+        while (1) {
+
+                if (q_service)
+                        (*q_service)(wq, &wq_desc[wq->to_clean_index]);
+
+                wq->ring.desc_avail++;
+
+                curr_index = wq->to_clean_index;
+
+                /* increment the to-clean index so that we start
+                 * with an unprocessed index next time we enter the loop
+                 */
+                ((wq->to_clean_index + 1) == wq->ring.desc_count) ?
+                        (wq->to_clean_index = 0) : (wq->to_clean_index++);
+
+                if (curr_index == completed_index)
+                        break;
+
+                /* we have cleaned all the entries */
+                if ((completed_index == (u16)-1) &&
+                    (wq->to_clean_index == wq->to_use_index))
+                        break;
+        }
+}
+
+void vnic_wq_copy_enable(struct vnic_wq_copy *wq);
+int vnic_wq_copy_disable(struct vnic_wq_copy *wq);
+void vnic_wq_copy_free(struct vnic_wq_copy *wq);
+int vnic_wq_copy_alloc(struct vnic_dev *vdev, struct vnic_wq_copy *wq,
+        unsigned int index, unsigned int desc_count, unsigned int desc_size);
+void vnic_wq_copy_init(struct vnic_wq_copy *wq, unsigned int cq_index,
+        unsigned int error_interrupt_enable,
+        unsigned int error_interrupt_offset);
+void vnic_wq_copy_clean(struct vnic_wq_copy *wq,
+        void (*q_clean)(struct vnic_wq_copy *wq,
+        struct fcpio_host_req *wq_desc));
+
+#endif /* _VNIC_WQ_COPY_H_ */
diff --git a/drivers/scsi/fnic/wq_enet_desc.h b/drivers/scsi/fnic/wq_enet_desc.h
new file mode 100644
index 00000000000..b121cbad18b
--- /dev/null
+++ b/drivers/scsi/fnic/wq_enet_desc.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2008 Cisco Systems, Inc.  All rights reserved.
+ * Copyright 2007 Nuova Systems, Inc.  All rights reserved.
+ *
+ * This program is free software; you may redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _WQ_ENET_DESC_H_
+#define _WQ_ENET_DESC_H_
+
+/* Ethernet work queue descriptor: 16B */
+struct wq_enet_desc {
+        __le64 address;
+        __le16 length;
+        __le16 mss_loopback;
+        __le16 header_length_flags;
+        __le16 vlan_tag;
+};
+
+#define WQ_ENET_ADDR_BITS               64
+#define WQ_ENET_LEN_BITS                14
+#define WQ_ENET_LEN_MASK                ((1 << WQ_ENET_LEN_BITS) - 1)
+#define WQ_ENET_MSS_BITS                14
+#define WQ_ENET_MSS_MASK                ((1 << WQ_ENET_MSS_BITS) - 1)
+#define WQ_ENET_MSS_SHIFT               2
+#define WQ_ENET_LOOPBACK_SHIFT          1
+#define WQ_ENET_HDRLEN_BITS             10
+#define WQ_ENET_HDRLEN_MASK             ((1 << WQ_ENET_HDRLEN_BITS) - 1)
+#define WQ_ENET_FLAGS_OM_BITS           2
+#define WQ_ENET_FLAGS_OM_MASK           ((1 << WQ_ENET_FLAGS_OM_BITS) - 1)
+#define WQ_ENET_FLAGS_EOP_SHIFT         12
+#define WQ_ENET_FLAGS_CQ_ENTRY_SHIFT    13
+#define WQ_ENET_FLAGS_FCOE_ENCAP_SHIFT  14
+#define WQ_ENET_FLAGS_VLAN_TAG_INSERT_SHIFT     15
+
+#define WQ_ENET_OFFLOAD_MODE_CSUM       0
+#define WQ_ENET_OFFLOAD_MODE_RESERVED   1
+#define WQ_ENET_OFFLOAD_MODE_CSUM_L4    2
+#define WQ_ENET_OFFLOAD_MODE_TSO        3
+
+static inline void wq_enet_desc_enc(struct wq_enet_desc *desc,
+        u64 address, u16 length, u16 mss, u16 header_length,
+        u8 offload_mode, u8 eop, u8 cq_entry, u8 fcoe_encap,
+        u8 vlan_tag_insert, u16 vlan_tag, u8 loopback)
+{
+        desc->address = cpu_to_le64(address);
+        desc->length = cpu_to_le16(length & WQ_ENET_LEN_MASK);
+        desc->mss_loopback = cpu_to_le16((mss & WQ_ENET_MSS_MASK) <<
+                WQ_ENET_MSS_SHIFT | (loopback & 1) << WQ_ENET_LOOPBACK_SHIFT);
+        desc->header_length_flags = cpu_to_le16(
+                (header_length & WQ_ENET_HDRLEN_MASK) |
+                (offload_mode & WQ_ENET_FLAGS_OM_MASK) << WQ_ENET_HDRLEN_BITS |
+                (eop & 1) << WQ_ENET_FLAGS_EOP_SHIFT |
+                (cq_entry & 1) << WQ_ENET_FLAGS_CQ_ENTRY_SHIFT |
+                (fcoe_encap & 1) << WQ_ENET_FLAGS_FCOE_ENCAP_SHIFT |
+                (vlan_tag_insert & 1) << WQ_ENET_FLAGS_VLAN_TAG_INSERT_SHIFT);
+        desc->vlan_tag = cpu_to_le16(vlan_tag);
+}
+
+static inline void wq_enet_desc_dec(struct wq_enet_desc *desc,
+        u64 *address, u16 *length, u16 *mss, u16 *header_length,
+        u8 *offload_mode, u8 *eop, u8 *cq_entry, u8 *fcoe_encap,
+        u8 *vlan_tag_insert, u16 *vlan_tag, u8 *loopback)
+{
+        *address = le64_to_cpu(desc->address);
+        *length = le16_to_cpu(desc->length) & WQ_ENET_LEN_MASK;
+        *mss = (le16_to_cpu(desc->mss_loopback) >> WQ_ENET_MSS_SHIFT) &
+                WQ_ENET_MSS_MASK;
+        *loopback = (u8)((le16_to_cpu(desc->mss_loopback) >>
+                WQ_ENET_LOOPBACK_SHIFT) & 1);
+        *header_length = le16_to_cpu(desc->header_length_flags) &
+                WQ_ENET_HDRLEN_MASK;
+        *offload_mode = (u8)((le16_to_cpu(desc->header_length_flags) >>
+                WQ_ENET_HDRLEN_BITS) & WQ_ENET_FLAGS_OM_MASK);
+        *eop = (u8)((le16_to_cpu(desc->header_length_flags) >>
+                WQ_ENET_FLAGS_EOP_SHIFT) & 1);
+        *cq_entry = (u8)((le16_to_cpu(desc->header_length_flags) >>
+                WQ_ENET_FLAGS_CQ_ENTRY_SHIFT) & 1);
+        *fcoe_encap = (u8)((le16_to_cpu(desc->header_length_flags) >>
+                WQ_ENET_FLAGS_FCOE_ENCAP_SHIFT) & 1);
+        *vlan_tag_insert = (u8)((le16_to_cpu(desc->header_length_flags) >>
+                WQ_ENET_FLAGS_VLAN_TAG_INSERT_SHIFT) & 1);
+        *vlan_tag = le16_to_cpu(desc->vlan_tag);
+}
+
+#endif /* _WQ_ENET_DESC_H_ */
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.h b/drivers/scsi/mpt2sas/mpt2sas_base.h
index babd4cc0cb2..36b1d1052ba 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
@@ -69,7 +69,7 @@
 #define MPT2SAS_AUTHOR  "LSI Corporation <DL-MPTFusionLinux@lsi.com>"
 #define MPT2SAS_DESCRIPTION     "LSI MPT Fusion SAS 2.0 Device Driver"
 #define MPT2SAS_DRIVER_VERSION          "01.100.02.00"
-#define MPT2SAS_MAJOR_VERSION           00
+#define MPT2SAS_MAJOR_VERSION           01
 #define MPT2SAS_MINOR_VERSION           100
 #define MPT2SAS_BUILD_VERSION           02
 #define MPT2SAS_RELEASE_VERSION         00
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index f644c9571ea..22b59e13ba8 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -173,26 +173,26 @@ static const struct file_operations osd_fops = {
         .unlocked_ioctl = osd_uld_ioctl,
 };
 
-struct osd_dev *osduld_path_lookup(const char *path)
+struct osd_dev *osduld_path_lookup(const char *name)
 {
-        struct nameidata nd;
+        struct path path;
         struct inode *inode;
         struct cdev *cdev;
         struct osd_uld_device *uninitialized_var(oud);
         int error;
 
-        if (!path || !*path) {
+        if (!name || !*name) {
                 OSD_ERR("Mount with !path || !*path\n");
                 return ERR_PTR(-EINVAL);
         }
 
-        error = path_lookup(path, LOOKUP_FOLLOW, &nd);
+        error = kern_path(name, LOOKUP_FOLLOW, &path);
         if (error) {
-                OSD_ERR("path_lookup of %s faild=>%d\n", path, error);
+                OSD_ERR("path_lookup of %s failed=>%d\n", name, error);
                 return ERR_PTR(error);
         }
 
-        inode = nd.path.dentry->d_inode;
+        inode = path.dentry->d_inode;
         error = -EINVAL; /* Not the right device e.g osd_uld_device */
         if (!S_ISCHR(inode->i_mode)) {
                 OSD_DEBUG("!S_ISCHR()\n");
@@ -202,15 +202,15 @@ struct osd_dev *osduld_path_lookup(const char *path)
         cdev = inode->i_cdev;
         if (!cdev) {
                 OSD_ERR("Before mounting an OSD Based filesystem\n");
-                OSD_ERR("  user-mode must open+close the %s device\n", path);
-                OSD_ERR("  Example: bash: echo < %s\n", path);
+                OSD_ERR("  user-mode must open+close the %s device\n", name);
+                OSD_ERR("  Example: bash: echo < %s\n", name);
                 goto out;
         }
 
         /* The Magic wand. Is it our char-dev */
         /* TODO: Support sg devices */
         if (cdev->owner != THIS_MODULE) {
-                OSD_ERR("Error mounting %s - is not an OSD device\n", path);
+                OSD_ERR("Error mounting %s - is not an OSD device\n", name);
                 goto out;
         }
 
@@ -220,7 +220,7 @@ struct osd_dev *osduld_path_lookup(const char *path)
         error = 0;
 
 out:
-        path_put(&nd.path);
+        path_put(&path);
         return error ? ERR_PTR(error) : &oud->od;
 }
 EXPORT_SYMBOL(osduld_path_lookup);
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 6f51ca485f3..e2b50d8f57a 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -425,6 +425,7 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
         INIT_LIST_HEAD(&starget->devices);
         starget->state = STARGET_CREATED;
         starget->scsi_level = SCSI_2;
+        starget->max_target_blocked = SCSI_DEFAULT_TARGET_BLOCKED;
  retry:
         spin_lock_irqsave(shost->host_lock, flags);
 
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 09479545529..0a2ce7b6325 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -357,7 +357,7 @@ int iscsi_session_chkready(struct iscsi_cls_session *session)
                 err = 0;
                 break;
         case ISCSI_SESSION_FAILED:
-                err = DID_TRANSPORT_DISRUPTED << 16;
+                err = DID_IMM_RETRY << 16;
                 break;
         case ISCSI_SESSION_FREE:
                 err = DID_TRANSPORT_FAILFAST << 16;
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index b4b39811b44..a0127e93ade 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -137,6 +137,7 @@ struct uart_8250_port {
         unsigned char           mcr;
         unsigned char           mcr_mask;       /* mask of user bits */
         unsigned char           mcr_force;      /* mask of forced bits */
+        unsigned char           cur_iotype;     /* Running I/O type */
 
         /*
          * Some bits in registers are cleared on a read, so they must
@@ -471,6 +472,7 @@ static void io_serial_out(struct uart_port *p, int offset, int value)
 
 static void set_io_from_upio(struct uart_port *p)
 {
+        struct uart_8250_port *up = (struct uart_8250_port *)p;
         switch (p->iotype) {
         case UPIO_HUB6:
                 p->serial_in = hub6_serial_in;
@@ -509,6 +511,8 @@ static void set_io_from_upio(struct uart_port *p)
                 p->serial_out = io_serial_out;
                 break;
         }
+        /* Remember loaded iotype */
+        up->cur_iotype = p->iotype;
 }
 
 static void
@@ -1937,6 +1941,9 @@ static int serial8250_startup(struct uart_port *port)
         up->capabilities = uart_config[up->port.type].flags;
         up->mcr = 0;
 
+        if (up->port.iotype != up->cur_iotype)
+                set_io_from_upio(port);
+
         if (up->port.type == PORT_16C950) {
                 /* Wake up and initialize UART */
                 up->acr = 0;
@@ -2563,6 +2570,9 @@ static void serial8250_config_port(struct uart_port *port, int flags)
         if (ret < 0)
                 probeflags &= ~PROBE_RSA;
 
+        if (up->port.iotype != up->cur_iotype)
+                set_io_from_upio(port);
+
         if (flags & UART_CONFIG_TYPE)
                 autoconfig(up, probeflags);
         if (up->port.type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ)
@@ -2671,6 +2681,11 @@ serial8250_register_ports(struct uart_driver *drv, struct device *dev)
 {
         int i;
 
+        for (i = 0; i < nr_uarts; i++) {
+                struct uart_8250_port *up = &serial8250_ports[i];
+                up->cur_iotype = 0xFF;
+        }
+
         serial8250_isa_init_ports();
 
         for (i = 0; i < nr_uarts; i++) {
diff --git a/drivers/serial/8250_gsc.c b/drivers/serial/8250_gsc.c
index 418b4fe9a0a..33149d982e8 100644
--- a/drivers/serial/8250_gsc.c
+++ b/drivers/serial/8250_gsc.c
@@ -39,9 +39,9 @@ static int __init serial_init_chip(struct parisc_device *dev)
                  */
                 if (parisc_parent(dev)->id.hw_type != HPHW_IOA)
                         printk(KERN_INFO
-                                "Serial: device 0x%lx not configured.\n"
+                                "Serial: device 0x%llx not configured.\n"
                                 "Enable support for Wax, Lasi, Asp or Dino.\n",
-                                dev->hpa.start);
+                                (unsigned long long)dev->hpa.start);
                 return -ENODEV;
         }
 
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index e3a5ad5ef1d..cdc049d4350 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -665,7 +665,7 @@ static struct uart_driver amba_reg = {
         .cons                   = AMBA_CONSOLE,
 };
 
-static int pl010_probe(struct amba_device *dev, void *id)
+static int pl010_probe(struct amba_device *dev, struct amba_id *id)
 {
         struct uart_amba_port *uap;
         void __iomem *base;
diff --git a/drivers/serial/amba-pl011.c b/drivers/serial/amba-pl011.c
index 8b2b9700f3e..88fdac51b6c 100644
--- a/drivers/serial/amba-pl011.c
+++ b/drivers/serial/amba-pl011.c
@@ -729,7 +729,7 @@ static struct uart_driver amba_reg = {
         .cons                   = AMBA_CONSOLE,
 };
 
-static int pl011_probe(struct amba_device *dev, void *id)
+static int pl011_probe(struct amba_device *dev, struct amba_id *id)
 {
         struct uart_amba_port *uap;
         void __iomem *base;
diff --git a/drivers/serial/icom.c b/drivers/serial/icom.c
index 6579e2be1dd..a461b3b2c72 100644
--- a/drivers/serial/icom.c
+++ b/drivers/serial/icom.c
@@ -1472,8 +1472,8 @@ static void icom_remove_adapter(struct icom_adapter *icom_adapter)
 
         free_irq(icom_adapter->pci_dev->irq, (void *) icom_adapter);
         iounmap(icom_adapter->base_addr);
-        icom_free_adapter(icom_adapter);
         pci_release_regions(icom_adapter->pci_dev);
+        icom_free_adapter(icom_adapter);
 }
 
 static void icom_kref_release(struct kref *kref)
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 9f460b175c5..5f0be40dfda 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -1031,6 +1031,8 @@ imx_console_setup(struct console *co, char *options)
         if (co->index == -1 || co->index >= ARRAY_SIZE(imx_ports))
                 co->index = 0;
         sport = imx_ports[co->index];
+        if(sport == NULL)
+                return -ENODEV;
 
         if (options)
                 uart_parse_options(options, &baud, &parity, &bits, &flow);
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 7f72f8ceaa6..b3feb6198d5 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -988,7 +988,7 @@ mpc52xx_console_setup(struct console *co, char *options)
         pr_debug("mpc52xx_console_setup co=%p, co->index=%i, options=%s\n",
                  co, co->index, options);
 
-        if ((co->index < 0) || (co->index > MPC52xx_PSC_MAXNUM)) {
+        if ((co->index < 0) || (co->index >= MPC52xx_PSC_MAXNUM)) {
                 pr_debug("PSC%x out of range\n", co->index);
                 return -EINVAL;
         }
diff --git a/drivers/serial/nwpserial.c b/drivers/serial/nwpserial.c
index 32f3eaf0d26..9e150b19d72 100644
--- a/drivers/serial/nwpserial.c
+++ b/drivers/serial/nwpserial.c
@@ -145,11 +145,13 @@ static irqreturn_t nwpserial_interrupt(int irq, void *dev_id)
                 ch = dcr_read(up->dcr_host, UART_RX);
                 if (up->port.ignore_status_mask != NWPSERIAL_STATUS_RXVALID)
                         tty_insert_flip_char(tty, ch, TTY_NORMAL);
-        } while (dcr_read(up->dcr_host, UART_RX) & UART_LSR_DR);
+        } while (dcr_read(up->dcr_host, UART_LSR) & UART_LSR_DR);
 
         tty_flip_buffer_push(tty);
         ret = IRQ_HANDLED;
 
+        /* clear interrupt */
+        dcr_write(up->dcr_host, UART_IIR, 1);
 out:
         spin_unlock(&up->port.lock);
         return ret;
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 885194a0741..3f3c08c6ba4 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1373,6 +1373,9 @@ static void cleanup(struct spi_device *spi)
 {
         struct chip_data *chip = spi_get_ctldata(spi);
 
+        if (!chip)
+                return;
+
         if (gpio_is_valid(chip->gpio_cs))
                 gpio_free(chip->gpio_cs);
 
diff --git a/drivers/ssb/embedded.c b/drivers/ssb/embedded.c
index 7dc3a6b4139..a0e0d246b59 100644
--- a/drivers/ssb/embedded.c
+++ b/drivers/ssb/embedded.c
@@ -29,6 +29,7 @@ int ssb_watchdog_timer_set(struct ssb_bus *bus, u32 ticks)
         }
         return -ENODEV;
 }
+EXPORT_SYMBOL(ssb_watchdog_timer_set);
 
 u32 ssb_gpio_in(struct ssb_bus *bus, u32 mask)
 {
diff --git a/drivers/staging/comedi/TODO b/drivers/staging/comedi/TODO
index 55781295846..15c9348fb93 100644
--- a/drivers/staging/comedi/TODO
+++ b/drivers/staging/comedi/TODO
@@ -11,4 +11,3 @@ Please send patches to Greg Kroah-Hartman <greg@kroah.com> and
 copy:
         Ian Abbott <abbotti@mev.co.uk>
         Frank Mori Hess <fmhess@users.sourceforge.net>
-        David Schleef <ds@schleef.org>
diff --git a/drivers/staging/rt2870/rt2870.h b/drivers/staging/rt2870/rt2870.h
index a42caa37080..a69cf338e49 100644
--- a/drivers/staging/rt2870/rt2870.h
+++ b/drivers/staging/rt2870/rt2870.h
@@ -145,6 +145,7 @@
         {USB_DEVICE(0x0789,0x0162)}, /* Logitec */              \
         {USB_DEVICE(0x0789,0x0163)}, /* Logitec */              \
         {USB_DEVICE(0x0789,0x0164)}, /* Logitec */              \
+        {USB_DEVICE(0x7392,0x7717)}, /* Edimax */               \
         { }/* Terminating entry */                      \
 }
 
diff --git a/drivers/staging/rtl8187se/r8180.h b/drivers/staging/rtl8187se/r8180.h
index 12215fc61dd..db446b7e2e0 100644
--- a/drivers/staging/rtl8187se/r8180.h
+++ b/drivers/staging/rtl8187se/r8180.h
@@ -19,7 +19,7 @@
 #define R8180H
 
 
-#define RTL8180_MODULE_NAME "rtl8180"
+#define RTL8180_MODULE_NAME "r8180"
 #define DMESG(x,a...) printk(KERN_INFO RTL8180_MODULE_NAME ": " x "\n", ## a)
 #define DMESGW(x,a...) printk(KERN_WARNING RTL8180_MODULE_NAME ": WW:" x "\n", ## a)
 #define DMESGE(x,a...) printk(KERN_WARNING RTL8180_MODULE_NAME ": EE:" x "\n", ## a)
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index 6ecd12de429..e10413cee0d 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -640,11 +640,9 @@ void rtl8180_proc_init_one(struct net_device *dev)
 {
         struct proc_dir_entry *e;
         struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        priv->dir_dev = create_proc_entry(dev->name,
-                                          S_IFDIR | S_IRUGO | S_IXUGO,
-                                          rtl8180_proc);
+        priv->dir_dev = rtl8180_proc;
         if (!priv->dir_dev) {
-                DMESGE("Unable to initialize /proc/net/rtl8180/%s\n",
+                DMESGE("Unable to initialize /proc/net/r8180/%s\n",
                       dev->name);
                 return;
         }
@@ -654,7 +652,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/stats-hw\n",
+                      "/proc/net/r8180/%s/stats-hw\n",
                       dev->name);
         }
 
@@ -663,7 +661,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/stats-rx\n",
+                      "/proc/net/r8180/%s/stats-rx\n",
                       dev->name);
         }
 
@@ -673,7 +671,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/stats-tx\n",
+                      "/proc/net/r8180/%s/stats-tx\n",
                       dev->name);
         }
         #if 0
@@ -702,7 +700,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/registers\n",
+                      "/proc/net/r8180/%s/registers\n",
                       dev->name);
         }
 }
@@ -977,13 +975,6 @@ void check_tx_ring(struct net_device *dev, int pri)
                               *tmp & (1<<15)? "ok": "err", *(tmp+4));
         }
 
-        DMESG("nic at %d",
-                (nic-nicbegin) / 8 /4);
-        DMESG("tail at %d", ((int)tail - (int)begin) /8 /4);
-        DMESG("head at %d", ((int)head - (int)begin) /8 /4);
-        DMESG("check free desc returns %d", check_nic_enought_desc(dev,pri));
-        DMESG("free desc is %d\n", get_curr_tx_free_desc(dev,pri));
-        //rtl8180_reset(dev);
         return;
 }
 
@@ -1736,17 +1727,7 @@ short alloc_tx_desc_ring(struct net_device *dev, int bufsize, int count,
                  * descriptor's buffer must be 256 byte aligned
                  * we shouldn't be here, since we set DMA mask !
                  */
-                DMESGW("Fixing TX alignment");
-                desc = (u32*)((u8*)desc + 256);
-#if (defined(CONFIG_HIGHMEM64G) || defined(CONFIG_64BIT_PHYS_ADDR))
-                desc = (u32*)((u64)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u64)dma_desc &~ 0xff);
-#else
-                desc = (u32*)((u32)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u32)dma_desc &~ 0xff);
-#endif
+                WARN(1, "DMA buffer is not aligned\n");
         }
         tmp=desc;
         for (i=0;i<count;i++)
@@ -1984,18 +1965,7 @@ short alloc_rx_desc_ring(struct net_device *dev, u16 bufsize, int count)
                  * descriptor's buffer must be 256 byte aligned
                  * should never happen since we specify the DMA mask
                  */
-
-                DMESGW("Fixing RX alignment");
-                desc = (u32*)((u8*)desc + 256);
-#if (defined(CONFIG_HIGHMEM64G) || defined(CONFIG_64BIT_PHYS_ADDR))
-                desc = (u32*)((u64)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u64)dma_desc &~ 0xff);
-#else
-                desc = (u32*)((u32)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u32)dma_desc &~ 0xff);
-#endif
+                WARN(1, "DMA buffer is not aligned\n");
         }
 
         priv->rxring=desc;
diff --git a/drivers/staging/winbond/wbusb.c b/drivers/staging/winbond/wbusb.c
index 9c3f9439f35..3b2d52819b4 100644
--- a/drivers/staging/winbond/wbusb.c
+++ b/drivers/staging/winbond/wbusb.c
@@ -386,7 +386,7 @@ static int wb35_probe(struct usb_interface *intf, const struct usb_device_id *id
         if (err)
                 goto error_free_hw;
 
-        usb_set_intfdata(intf, priv);
+        usb_set_intfdata(intf, dev);
 
         return 0;
 
@@ -415,10 +415,15 @@ static void wb35_hw_halt(struct wbsoft_priv *adapter)
 
 static void wb35_disconnect(struct usb_interface *intf)
 {
-        struct wbsoft_priv *priv = usb_get_intfdata(intf);
+        struct ieee80211_hw *hw = usb_get_intfdata(intf);
+        struct wbsoft_priv *priv = hw->priv;
 
         wb35_hw_halt(priv);
 
+        ieee80211_stop_queues(hw);
+        ieee80211_unregister_hw(hw);
+        ieee80211_free_hw(hw);
+
         usb_set_intfdata(intf, NULL);
         usb_put_dev(interface_to_usbdev(intf));
 }
diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
index d0b093b66ad..5e38ba10a3a 100644
--- a/drivers/thermal/thermal_sys.c
+++ b/drivers/thermal/thermal_sys.c
@@ -961,7 +961,7 @@ void thermal_zone_device_update(struct thermal_zone_device *tz)
 
                 switch (trip_type) {
                 case THERMAL_TRIP_CRITICAL:
-                        if (temp > trip_temp) {
+                        if (temp >= trip_temp) {
                                 if (tz->ops->notify)
                                         ret = tz->ops->notify(tz, count,
                                                               trip_type);
@@ -974,7 +974,7 @@ void thermal_zone_device_update(struct thermal_zone_device *tz)
                         }
                         break;
                 case THERMAL_TRIP_HOT:
-                        if (temp > trip_temp)
+                        if (temp >= trip_temp)
                                 if (tz->ops->notify)
                                         tz->ops->notify(tz, count, trip_type);
                         break;
@@ -986,14 +986,14 @@ void thermal_zone_device_update(struct thermal_zone_device *tz)
 
                                 cdev = instance->cdev;
 
-                                if (temp > trip_temp)
+                                if (temp >= trip_temp)
                                         cdev->ops->set_cur_state(cdev, 1);
                                 else
                                         cdev->ops->set_cur_state(cdev, 0);
                         }
                         break;
                 case THERMAL_TRIP_PASSIVE:
-                        if (temp > trip_temp || tz->passive)
+                        if (temp >= trip_temp || tz->passive)
                                 thermal_zone_device_passive(tz, temp,
                                                             trip_temp, count);
                         break;
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 89299a5ce16..0a3dc5ece63 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -11,7 +11,6 @@ obj-$(CONFIG_USB_MON)		+= mon/
 obj-$(CONFIG_PCI)               += host/
 obj-$(CONFIG_USB_EHCI_HCD)      += host/
 obj-$(CONFIG_USB_ISP116X_HCD)   += host/
-obj-$(CONFIG_USB_ISP1760_HCD)   += host/
 obj-$(CONFIG_USB_OHCI_HCD)      += host/
 obj-$(CONFIG_USB_UHCI_HCD)      += host/
 obj-$(CONFIG_USB_FHCI_HCD)      += host/
@@ -27,6 +26,8 @@ obj-$(CONFIG_USB_WUSB)		+= wusbcore/
 
 obj-$(CONFIG_USB_ACM)           += class/
 obj-$(CONFIG_USB_PRINTER)       += class/
+obj-$(CONFIG_USB_WDM)           += class/
+obj-$(CONFIG_USB_TMC)           += class/
 
 obj-$(CONFIG_USB_STORAGE)       += storage/
 obj-$(CONFIG_USB)               += storage/
diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 6789089e246..56802d2e994 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -227,8 +227,14 @@ static ssize_t cxacru_sysfs_showattr_s8(s8 value, char *buf)
 
 static ssize_t cxacru_sysfs_showattr_dB(s16 value, char *buf)
 {
-        return snprintf(buf, PAGE_SIZE, "%d.%02u\n",
-                                        value / 100, abs(value) % 100);
+        if (likely(value >= 0)) {
+                return snprintf(buf, PAGE_SIZE, "%u.%02u\n",
+                                        value / 100, value % 100);
+        } else {
+                value = -value;
+                return snprintf(buf, PAGE_SIZE, "-%u.%02u\n",
+                                        value / 100, value % 100);
+        }
 }
 
 static ssize_t cxacru_sysfs_showattr_bool(u32 value, char *buf)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 0a69c0977e3..7a1164dd1d3 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1375,6 +1375,9 @@ static struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1324), /* Conexant USB MODEM RD02-D400 */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
         { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
         },
         { USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index 563d5727544..05c913cc365 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -794,7 +794,8 @@ usba_ep_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
         if (ep->desc) {
                 list_add_tail(&req->queue, &ep->queue);
 
-                if (ep->is_in || (ep_is_control(ep)
+                if ((!ep_is_control(ep) && ep->is_in) ||
+                        (ep_is_control(ep)
                                 && (ep->state == DATA_STAGE_IN
                                         || ep->state == STATUS_STAGE_IN)))
                         usba_ep_writel(ep, CTL_ENB, USBA_TX_PK_RDY);
@@ -1940,7 +1941,7 @@ static int __init usba_udc_probe(struct platform_device *pdev)
         usba_writel(udc, CTRL, USBA_DISABLE_MASK);
         clk_disable(pclk);
 
-        usba_ep = kmalloc(sizeof(struct usba_ep) * pdata->num_ep,
+        usba_ep = kzalloc(sizeof(struct usba_ep) * pdata->num_ep,
                           GFP_KERNEL);
         if (!usba_ep)
                 goto err_alloc_ep;
diff --git a/drivers/usb/gadget/usbstring.c b/drivers/usb/gadget/usbstring.c
index 4154be375c7..58c4d37d312 100644
--- a/drivers/usb/gadget/usbstring.c
+++ b/drivers/usb/gadget/usbstring.c
@@ -38,7 +38,7 @@ static int utf8_to_utf16le(const char *s, __le16 *cp, unsigned len)
                                 uchar = (c & 0x1f) << 6;
 
                                 c = (u8) *s++;
-                                if ((c & 0xc0) != 0xc0)
+                                if ((c & 0xc0) != 0x80)
                                         goto fail;
                                 c &= 0x3f;
                                 uchar |= c;
@@ -49,13 +49,13 @@ static int utf8_to_utf16le(const char *s, __le16 *cp, unsigned len)
                                 uchar = (c & 0x0f) << 12;
 
                                 c = (u8) *s++;
-                                if ((c & 0xc0) != 0xc0)
+                                if ((c & 0xc0) != 0x80)
                                         goto fail;
                                 c &= 0x3f;
                                 uchar |= c << 6;
 
                                 c = (u8) *s++;
-                                if ((c & 0xc0) != 0xc0)
+                                if ((c & 0xc0) != 0x80)
                                         goto fail;
                                 c &= 0x3f;
                                 uchar |= c;
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index cd07ea3f0c6..15438469f21 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -1658,6 +1658,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
         u32 reg_base, or_reg, skip_reg;
         unsigned long flags;
         struct ptd ptd;
+        packet_enqueue *pe;
 
         switch (usb_pipetype(urb->pipe)) {
         case PIPE_ISOCHRONOUS:
@@ -1669,6 +1670,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                 reg_base = INT_REGS_OFFSET;
                 or_reg = HC_INT_IRQ_MASK_OR_REG;
                 skip_reg = HC_INT_PTD_SKIPMAP_REG;
+                pe = enqueue_an_INT_packet;
                 break;
 
         default:
@@ -1676,6 +1678,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                 reg_base = ATL_REGS_OFFSET;
                 or_reg = HC_ATL_IRQ_MASK_OR_REG;
                 skip_reg = HC_ATL_PTD_SKIPMAP_REG;
+                pe =  enqueue_an_ATL_packet;
                 break;
         }
 
@@ -1687,6 +1690,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                         u32 skip_map;
                         u32 or_map;
                         struct isp1760_qtd *qtd;
+                        struct isp1760_qh *qh = ints->qh;
 
                         skip_map = isp1760_readl(hcd->regs + skip_reg);
                         skip_map |= 1 << i;
@@ -1699,8 +1703,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                         priv_write_copy(priv, (u32 *)&ptd, hcd->regs + reg_base
                                         + i * sizeof(ptd), sizeof(ptd));
                         qtd = ints->qtd;
-
-                        clean_up_qtdlist(qtd);
+                        qtd = clean_up_qtdlist(qtd);
 
                         free_mem(priv, ints->payload);
 
@@ -1711,7 +1714,24 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                         ints->payload = 0;
 
                         isp1760_urb_done(priv, urb, status);
+                        if (qtd)
+                                pe(hcd, qh, qtd);
                         break;
+
+                } else if (ints->qtd) {
+                        struct isp1760_qtd *qtd, *prev_qtd = ints->qtd;
+
+                        for (qtd = ints->qtd->hw_next; qtd; qtd = qtd->hw_next) {
+                                if (qtd->urb == urb) {
+                                        prev_qtd->hw_next = clean_up_qtdlist(qtd);
+                                        isp1760_urb_done(priv, urb, status);
+                                        break;
+                                }
+                                prev_qtd = qtd;
+                        }
+                        /* we found the urb before the end of the list */
+                        if (qtd)
+                                break;
                 }
                 ints++;
         }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8100f1d2590..d9fcdaedf38 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -56,6 +56,7 @@ static __u16 vendor = FTDI_VID;
 static __u16 product;
 
 struct ftdi_private {
+        struct kref kref;
         ftdi_chip_type_t chip_type;
                                 /* type of device, either SIO or FT8U232AM */
         int baud_base;          /* baud base clock for divisor setting */
@@ -669,6 +670,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(ADI_VID, ADI_GNICE_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
+        { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
@@ -1352,6 +1355,7 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)
                 return -ENOMEM;
         }
 
+        kref_init(&priv->kref);
         spin_lock_init(&priv->rx_lock);
         spin_lock_init(&priv->tx_lock);
         init_waitqueue_head(&priv->delta_msr_wait);
@@ -1468,6 +1472,13 @@ static void ftdi_shutdown(struct usb_serial *serial)
         dbg("%s", __func__);
 }
 
+static void ftdi_sio_priv_release(struct kref *k)
+{
+        struct ftdi_private *priv = container_of(k, struct ftdi_private, kref);
+
+        kfree(priv);
+}
+
 static int ftdi_sio_port_remove(struct usb_serial_port *port)
 {
         struct ftdi_private *priv = usb_get_serial_port_data(port);
@@ -1476,14 +1487,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
 
         remove_sysfs_attrs(port);
 
-        /* all open ports are closed at this point
-         *    (by usbserial.c:__serial_close, which calls ftdi_close)
-         */
-
-        if (priv) {
-                usb_set_serial_port_data(port, NULL);
-                kfree(priv);
-        }
+        kref_put(&priv->kref, ftdi_sio_priv_release);
 
         return 0;
 }
@@ -1547,7 +1551,8 @@ static int ftdi_open(struct tty_struct *tty,
                 dev_err(&port->dev,
                         "%s - failed submitting read urb, error %d\n",
                         __func__, result);
-
+        else
+                kref_get(&priv->kref);
 
         return result;
 } /* ftdi_open */
@@ -1589,11 +1594,11 @@ static void ftdi_close(struct tty_struct *tty,
         mutex_unlock(&port->serial->disc_mutex);
 
         /* cancel any scheduled reading */
-        cancel_delayed_work(&priv->rx_work);
-        flush_scheduled_work();
+        cancel_delayed_work_sync(&priv->rx_work);
 
         /* shutdown our bulk read */
         usb_kill_urb(port->read_urb);
+        kref_put(&priv->kref, ftdi_sio_priv_release);
 } /* ftdi_close */
 
 
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index c09f658a448..12330fa1c09 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -920,6 +920,12 @@
 #define JETI_SPC1201_PID        0x04b2
 
 /*
+ * Marvell SheevaPlug
+ */
+#define MARVELL_VID             0x9e88
+#define MARVELL_SHEEVAPLUG_PID  0x9e8f
+
+/*
  *   BmRequestType:  1100 0000b
  *   bRequest:       FTDI_E2_READ
  *   wValue:         0
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 0a566eea49c..f331e2bde88 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -974,6 +974,7 @@ int usb_serial_probe(struct usb_interface *interface,
                 if (retval > 0) {
                         /* quietly accept this device, but don't bind to a
                            serial port as it's about to disappear */
+                        serial->num_ports = 0;
                         goto exit;
                 }
         }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index fa65a3b0860..4b8b69045fe 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -160,8 +160,9 @@ UNUSUAL_DEV(  0x0420, 0x0001, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
-/* Reported by Andrew Nayenko <relan@bk.ru> */
-UNUSUAL_DEV(  0x0421, 0x0019, 0x0592, 0x0592,
+/* Reported by Andrew Nayenko <relan@bk.ru>
+ * Updated for new firmware by Phillip Potter <phillipinda@hotmail.com> */
+UNUSUAL_DEV(  0x0421, 0x0019, 0x0592, 0x0610,
                 "Nokia",
                 "Nokia 6288",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 7826bdce4bb..0048f1185a6 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1128,13 +1128,6 @@ config FB_INTEL
           830M/845G/852GM/855GM/865G/915G/915GM/945G/945GM/965G/965GM chipsets.
           Say Y if you have and plan to use such a board.
 
-          If you say Y here and want DDC/I2C support you must first say Y to
-          "I2C support" and "I2C bit-banging support" in the character devices
-          section.
-
-          If you say M here then "I2C support" and "I2C bit-banging support"
-          can be build either as modules or built-in.
-
           To compile this driver as a module, choose M here: the
           module will be called intelfb.
 
@@ -1207,11 +1200,10 @@ config FB_MATROX_G
           pixel and 32 bpp packed pixel. You can also use font widths
           different from 8.
 
-          If you need support for G400 secondary head, you must first say Y to
-          "I2C support" in the character devices section, and then to
-          "Matrox I2C support" and "G400 second head support" here in the
-          framebuffer section. G450/G550 secondary head and digital output
-          are supported without additional modules.
+          If you need support for G400 secondary head, you must say Y to
+          "Matrox I2C support" and "G400 second head support" right below.
+          G450/G550 secondary head and digital output are supported without
+          additional modules.
 
           The driver starts in monitor mode. You must use the matroxset tool 
           (available at <ftp://platan.vc.cvut.cz/pub/linux/matrox-latest/>) to 
@@ -1310,13 +1302,6 @@ config FB_RADEON
           a framebuffer device.  There are both PCI and AGP versions.  You
           don't need to choose this to run the Radeon in plain VGA mode.
 
-          If you say Y here and want DDC/I2C support you must first say Y to
-          "I2C support" and "I2C bit-banging support" in the character devices
-          section.
-
-          If you say M here then "I2C support" and "I2C bit-banging support" 
-          can be build either as modules or built-in.
-
           There is a product page at
           http://apps.ati.com/ATIcompare/
 
diff --git a/drivers/video/amba-clcd.c b/drivers/video/amba-clcd.c
index 61050ab1412..d1f80bac54f 100644
--- a/drivers/video/amba-clcd.c
+++ b/drivers/video/amba-clcd.c
@@ -437,7 +437,7 @@ static int clcdfb_register(struct clcd_fb *fb)
         return ret;
 }
 
-static int clcdfb_probe(struct amba_device *dev, void *id)
+static int clcdfb_probe(struct amba_device *dev, struct amba_id *id)
 {
         struct clcd_board *board = dev->dev.platform_data;
         struct clcd_fb *fb;
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 9a577a800db..2fb63f6ea2f 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -29,14 +29,8 @@
 
 /* configurable parameters */
 #define ATMEL_LCDC_CVAL_DEFAULT         0xc8
-#define ATMEL_LCDC_DMA_BURST_LEN        8
-
-#if defined(CONFIG_ARCH_AT91SAM9263) || defined(CONFIG_ARCH_AT91CAP9) || \
-        defined(CONFIG_ARCH_AT91SAM9RL)
-#define ATMEL_LCDC_FIFO_SIZE            2048
-#else
-#define ATMEL_LCDC_FIFO_SIZE            512
-#endif
+#define ATMEL_LCDC_DMA_BURST_LEN        8       /* words */
+#define ATMEL_LCDC_FIFO_SIZE            512     /* words */
 
 #if defined(CONFIG_ARCH_AT91)
 #define ATMEL_LCDFB_FBINFO_DEFAULT      (FBINFO_DEFAULT \
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c
index fe5b519860b..1a83709f961 100644
--- a/drivers/video/gbefb.c
+++ b/drivers/video/gbefb.c
@@ -75,7 +75,7 @@ struct gbefb_par {
 static unsigned int gbe_mem_size = CONFIG_FB_GBE_MEM * 1024*1024;
 static void *gbe_mem;
 static dma_addr_t gbe_dma_addr;
-unsigned long gbe_mem_phys;
+static unsigned long gbe_mem_phys;
 
 static struct {
         uint16_t *cpu;
@@ -185,8 +185,8 @@ static struct fb_videomode default_mode_LCD __initdata = {
         .vmode          = FB_VMODE_NONINTERLACED,
 };
 
-struct fb_videomode *default_mode __initdata = &default_mode_CRT;
-struct fb_var_screeninfo *default_var __initdata = &default_var_CRT;
+static struct fb_videomode *default_mode __initdata = &default_mode_CRT;
+static struct fb_var_screeninfo *default_var __initdata = &default_var_CRT;
 
 static int flat_panel_enabled = 0;
 
@@ -205,7 +205,7 @@ static void gbe_reset(void)
  *              console.
  */
 
-void gbe_turn_off(void)
+static void gbe_turn_off(void)
 {
         int i;
         unsigned int val, x, y, vpixen_off;
@@ -1097,7 +1097,7 @@ static void gbefb_create_sysfs(struct device *dev)
  * Initialization
  */
 
-int __init gbefb_setup(char *options)
+static int __init gbefb_setup(char *options)
 {
         char *this_opt;
 
@@ -1283,7 +1283,7 @@ static struct platform_driver gbefb_driver = {
 
 static struct platform_device *gbefb_device;
 
-int __init gbefb_init(void)
+static int __init gbefb_init(void)
 {
         int ret = platform_driver_register(&gbefb_driver);
         if (!ret) {
@@ -1301,7 +1301,7 @@ int __init gbefb_init(void)
         return ret;
 }
 
-void __exit gbefb_exit(void)
+static void __exit gbefb_exit(void)
 {
         platform_device_unregister(gbefb_device);
         platform_driver_unregister(&gbefb_driver);
diff --git a/drivers/video/omap/dispc.c b/drivers/video/omap/dispc.c
index dfb72f5e4c9..148cbcc3960 100644
--- a/drivers/video/omap/dispc.c
+++ b/drivers/video/omap/dispc.c
@@ -880,20 +880,22 @@ static irqreturn_t omap_dispc_irq_handler(int irq, void *dev)
 
 static int get_dss_clocks(void)
 {
-        if (IS_ERR((dispc.dss_ick = clk_get(dispc.fbdev->dev, "dss_ick")))) {
-                dev_err(dispc.fbdev->dev, "can't get dss_ick\n");
+        dispc.dss_ick = clk_get(dispc.fbdev->dev, "ick");
+        if (IS_ERR(dispc.dss_ick)) {
+                dev_err(dispc.fbdev->dev, "can't get ick\n");
                 return PTR_ERR(dispc.dss_ick);
         }
 
-        if (IS_ERR((dispc.dss1_fck = clk_get(dispc.fbdev->dev, "dss1_fck")))) {
+        dispc.dss1_fck = clk_get(dispc.fbdev->dev, "dss1_fck");
+        if (IS_ERR(dispc.dss1_fck)) {
                 dev_err(dispc.fbdev->dev, "can't get dss1_fck\n");
                 clk_put(dispc.dss_ick);
                 return PTR_ERR(dispc.dss1_fck);
         }
 
-        if (IS_ERR((dispc.dss_54m_fck =
-                                clk_get(dispc.fbdev->dev, "dss_54m_fck")))) {
-                dev_err(dispc.fbdev->dev, "can't get dss_54m_fck\n");
+        dispc.dss_54m_fck = clk_get(dispc.fbdev->dev, "tv_fck");
+        if (IS_ERR(dispc.dss_54m_fck)) {
+                dev_err(dispc.fbdev->dev, "can't get tv_fck\n");
                 clk_put(dispc.dss_ick);
                 clk_put(dispc.dss1_fck);
                 return PTR_ERR(dispc.dss_54m_fck);
diff --git a/drivers/video/omap/rfbi.c b/drivers/video/omap/rfbi.c
index a13c8dcad2a..9332d6ca645 100644
--- a/drivers/video/omap/rfbi.c
+++ b/drivers/video/omap/rfbi.c
@@ -83,12 +83,14 @@ static inline u32 rfbi_read_reg(int idx)
 
 static int rfbi_get_clocks(void)
 {
-        if (IS_ERR((rfbi.dss_ick = clk_get(rfbi.fbdev->dev, "dss_ick")))) {
-                dev_err(rfbi.fbdev->dev, "can't get dss_ick\n");
+        rfbi.dss_ick = clk_get(rfbi.fbdev->dev, "ick");
+        if (IS_ERR(rfbi.dss_ick)) {
+                dev_err(rfbi.fbdev->dev, "can't get ick\n");
                 return PTR_ERR(rfbi.dss_ick);
         }
 
-        if (IS_ERR((rfbi.dss1_fck = clk_get(rfbi.fbdev->dev, "dss1_fck")))) {
+        rfbi.dss1_fck = clk_get(rfbi.fbdev->dev, "dss1_fck");
+        if (IS_ERR(rfbi.dss1_fck)) {
                 dev_err(rfbi.fbdev->dev, "can't get dss1_fck\n");
                 clk_put(rfbi.dss_ick);
                 return PTR_ERR(rfbi.dss1_fck);
diff --git a/drivers/video/s3c-fb.c b/drivers/video/s3c-fb.c
index 5e9c6302433..d3a568e6b16 100644
--- a/drivers/video/s3c-fb.c
+++ b/drivers/video/s3c-fb.c
@@ -947,7 +947,8 @@ static int __devexit s3c_fb_remove(struct platform_device *pdev)
         int win;
 
         for (win = 0; win <= S3C_FB_MAX_WIN; win++)
-                s3c_fb_release_win(sfb, sfb->windows[win]);
+                if (sfb->windows[win])
+                        s3c_fb_release_win(sfb, sfb->windows[win]);
 
         iounmap(sfb->regs);
 
@@ -985,11 +986,20 @@ static int s3c_fb_suspend(struct platform_device *pdev, pm_message_t state)
 static int s3c_fb_resume(struct platform_device *pdev)
 {
         struct s3c_fb *sfb = platform_get_drvdata(pdev);
+        struct s3c_fb_platdata *pd = sfb->pdata;
         struct s3c_fb_win *win;
         int win_no;
 
         clk_enable(sfb->bus_clk);
 
+        /* setup registers */
+        writel(pd->vidcon1, sfb->regs + VIDCON1);
+
+        /* zero all windows before we do anything */
+        for (win_no = 0; win_no < S3C_FB_MAX_WIN; win_no++)
+                s3c_fb_clear_win(sfb, win_no);
+
+        /* restore framebuffers */
         for (win_no = 0; win_no < S3C_FB_MAX_WIN; win_no++) {
                 win = sfb->windows[win_no];
                 if (!win)
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 92ea0ab44ce..f10d2fbeda0 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -47,6 +47,7 @@ struct sh_mobile_lcdc_priv {
 #endif
         unsigned long lddckr;
         struct sh_mobile_lcdc_chan ch[2];
+        int started;
 };
 
 /* shared registers */
@@ -451,6 +452,7 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
 
         /* start the lcdc */
         sh_mobile_lcdc_start_stop(priv, 1);
+        priv->started = 1;
 
         /* tell the board code to enable the panel */
         for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
@@ -493,7 +495,10 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
         }
 
         /* stop the lcdc */
-        sh_mobile_lcdc_start_stop(priv, 0);
+        if (priv->started) {
+                sh_mobile_lcdc_start_stop(priv, 0);
+                priv->started = 0;
+        }
 
         /* stop clocks */
         for (k = 0; k < ARRAY_SIZE(priv->ch); k++)
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index e327b84820d..a0fec298216 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -2103,7 +2103,7 @@ static void viafb_remove_proc(struct proc_dir_entry *viafb_entry)
 
 static int __devinit via_pci_probe(void)
 {
-        unsigned int default_xres, default_yres;
+        unsigned long default_xres, default_yres;
         char *tmpc, *tmpm;
         char *tmpc_sec, *tmpm_sec;
         int vmode_index;
@@ -2196,8 +2196,8 @@ static int __devinit via_pci_probe(void)
         viafb_FB_MM = viaparinfo->fbmem_virt;
         tmpm = viafb_mode;
         tmpc = strsep(&tmpm, "x");
-        strict_strtoul(tmpc, 0, (unsigned long *)&default_xres);
-        strict_strtoul(tmpm, 0, (unsigned long *)&default_yres);
+        strict_strtoul(tmpc, 0, &default_xres);
+        strict_strtoul(tmpm, 0, &default_yres);
 
         vmode_index = viafb_get_mode_index(default_xres, default_yres, 0);
         DEBUG_MSG(KERN_INFO "0->index=%d\n", vmode_index);