292 files changed, 13747 insertions, 3389 deletions

diff --git a/drivers/accessibility/Kconfig b/drivers/accessibility/Kconfig
index 1264c4b9809..ef3b65bfdd0 100644
--- a/drivers/accessibility/Kconfig
+++ b/drivers/accessibility/Kconfig
@@ -1,7 +1,17 @@
 menuconfig ACCESSIBILITY
         bool "Accessibility support"
         ---help---
-          Enable a submenu where accessibility items may be enabled.
+          Accessibility handles all special kinds of hardware devices or
+          software adapters which help people with disabilities (e.g.
+          blindness) to use computers.
+
+          That includes braille devices, speech synthesis, keyboard
+          remapping, etc.
+
+          Say Y here to get to see options for accessibility.
+          This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
           If unsure, say N.
 
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 1c11df9a5f3..9bf2986a278 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -205,8 +205,8 @@ config SATA_VITESSE
           If unsure, say N.
 
 config SATA_INIC162X
-        tristate "Initio 162x SATA support (HIGHLY EXPERIMENTAL)"
-        depends on PCI && EXPERIMENTAL
+        tristate "Initio 162x SATA support"
+        depends on PCI
         help
           This option enables support for Initio 162x Serial ATA.
 
@@ -697,6 +697,15 @@ config PATA_SCC
 
           If unsure, say N.
 
+config PATA_SCH
+        tristate "Intel SCH PATA support"
+        depends on PCI
+        help
+          This option enables support for Intel SCH PATA on the Intel
+          SCH (US15W, US15L, UL11L) series host controllers.
+
+          If unsure, say N.
+
 config PATA_BF54X
         tristate "Blackfin 54x ATAPI support"
         depends on BF542 || BF548 || BF549
diff --git a/drivers/ata/Makefile b/drivers/ata/Makefile
index b693d829383..674965fa326 100644
--- a/drivers/ata/Makefile
+++ b/drivers/ata/Makefile
@@ -67,6 +67,7 @@ obj-$(CONFIG_PATA_SIS)		+= pata_sis.o
 obj-$(CONFIG_PATA_TRIFLEX)      += pata_triflex.o
 obj-$(CONFIG_PATA_IXP4XX_CF)    += pata_ixp4xx_cf.o
 obj-$(CONFIG_PATA_SCC)          += pata_scc.o
+obj-$(CONFIG_PATA_SCH)          += pata_sch.o
 obj-$(CONFIG_PATA_BF54X)        += pata_bf54x.o
 obj-$(CONFIG_PATA_PLATFORM)     += pata_platform.o
 obj-$(CONFIG_PATA_OF_PLATFORM)  += pata_of_platform.o
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 8cace9aa9c0..97f83fb2ee2 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1267,9 +1267,7 @@ static int ahci_check_ready(struct ata_link *link)
         void __iomem *port_mmio = ahci_port_base(link->ap);
         u8 status = readl(port_mmio + PORT_TFDATA) & 0xFF;
 
-        if (!(status & ATA_BUSY))
-                return 1;
-        return 0;
+        return ata_check_ready(status);
 }
 
 static int ahci_softreset(struct ata_link *link, unsigned int *class,
diff --git a/drivers/ata/ata_generic.c b/drivers/ata/ata_generic.c
index 47aeccd52fa..75a406f5e69 100644
--- a/drivers/ata/ata_generic.c
+++ b/drivers/ata/ata_generic.c
@@ -152,6 +152,12 @@ static int ata_generic_init_one(struct pci_dev *dev, const struct pci_device_id
         if (dev->vendor == PCI_VENDOR_ID_AL)
                 ata_pci_bmdma_clear_simplex(dev);
 
+        if (dev->vendor == PCI_VENDOR_ID_ATI) {
+                int rc = pcim_enable_device(dev);
+                if (rc < 0)
+                        return rc;
+                pcim_pin_device(dev);
+        }
         return ata_pci_sff_init_one(dev, ppi, &generic_sht, NULL);
 }
 
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index ea2c7649d39..a9027b8fbdd 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -1348,6 +1348,8 @@ static void __devinit piix_init_sidpr(struct ata_host *host)
 {
         struct pci_dev *pdev = to_pci_dev(host->dev);
         struct piix_host_priv *hpriv = host->private_data;
+        struct ata_device *dev0 = &host->ports[0]->link.device[0];
+        u32 scontrol;
         int i;
 
         /* check for availability */
@@ -1366,6 +1368,29 @@ static void __devinit piix_init_sidpr(struct ata_host *host)
                 return;
 
         hpriv->sidpr = pcim_iomap_table(pdev)[PIIX_SIDPR_BAR];
+
+        /* SCR access via SIDPR doesn't work on some configurations.
+         * Give it a test drive by inhibiting power save modes which
+         * we'll do anyway.
+         */
+        scontrol = piix_sidpr_read(dev0, SCR_CONTROL);
+
+        /* if IPM is already 3, SCR access is probably working.  Don't
+         * un-inhibit power save modes as BIOS might have inhibited
+         * them for a reason.
+         */
+        if ((scontrol & 0xf00) != 0x300) {
+                scontrol |= 0x300;
+                piix_sidpr_write(dev0, SCR_CONTROL, scontrol);
+                scontrol = piix_sidpr_read(dev0, SCR_CONTROL);
+
+                if ((scontrol & 0xf00) != 0x300) {
+                        dev_printk(KERN_INFO, host->dev, "SCR access via "
+                                   "SIDPR is available but doesn't work\n");
+                        return;
+                }
+        }
+
         host->ports[0]->ops = &piix_sidpr_sata_ops;
         host->ports[1]->ops = &piix_sidpr_sata_ops;
 }
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3bc48853820..927b692d723 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6292,6 +6292,7 @@ EXPORT_SYMBOL_GPL(ata_eh_freeze_port);
 EXPORT_SYMBOL_GPL(ata_eh_thaw_port);
 EXPORT_SYMBOL_GPL(ata_eh_qc_complete);
 EXPORT_SYMBOL_GPL(ata_eh_qc_retry);
+EXPORT_SYMBOL_GPL(ata_eh_analyze_ncq_error);
 EXPORT_SYMBOL_GPL(ata_do_eh);
 EXPORT_SYMBOL_GPL(ata_std_error_handler);
 
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 61dcd0026c6..62e033146be 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1357,7 +1357,7 @@ static void ata_eh_analyze_serror(struct ata_link *link)
  *      LOCKING:
  *      Kernel thread context (may sleep).
  */
-static void ata_eh_analyze_ncq_error(struct ata_link *link)
+void ata_eh_analyze_ncq_error(struct ata_link *link)
 {
         struct ata_port *ap = link->ap;
         struct ata_eh_context *ehc = &link->eh_context;
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 2ec65a8fda7..3c2d2289f85 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -314,11 +314,7 @@ static int ata_sff_check_ready(struct ata_link *link)
 {
         u8 status = link->ap->ops->sff_check_status(link->ap);
 
-        if (!(status & ATA_BUSY))
-                return 1;
-        if (status == 0xff)
-                return -ENODEV;
-        return 0;
+        return ata_check_ready(status);
 }
 
 /**
diff --git a/drivers/ata/pata_acpi.c b/drivers/ata/pata_acpi.c
index c5f91e62994..fbe60571155 100644
--- a/drivers/ata/pata_acpi.c
+++ b/drivers/ata/pata_acpi.c
@@ -259,6 +259,12 @@ static int pacpi_init_one (struct pci_dev *pdev, const struct pci_device_id *id)
                 .port_ops       = &pacpi_ops,
         };
         const struct ata_port_info *ppi[] = { &info, NULL };
+        if (pdev->vendor == PCI_VENDOR_ID_ATI) {
+                int rc = pcim_enable_device(pdev);
+                if (rc < 0)
+                        return rc;
+                pcim_pin_device(pdev);
+        }
         return ata_pci_sff_init_one(pdev, ppi, &pacpi_sht, NULL);
 }
 
diff --git a/drivers/ata/pata_sch.c b/drivers/ata/pata_sch.c
new file mode 100644
index 00000000000..c8cc027789f
--- /dev/null
+++ b/drivers/ata/pata_sch.c
@@ -0,0 +1,206 @@
+/*
+ *  pata_sch.c - Intel SCH PATA controllers
+ *
+ *  Copyright (c) 2008 Alek Du <alek.du@intel.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License 2 as published
+ *  by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; see the file COPYING.  If not, write to
+ *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+/*
+ *  Supports:
+ *    Intel SCH (AF82US15W, AF82US15L, AF82UL11L) chipsets -- see spec at:
+ *    http://download.intel.com/design/chipsets/embedded/datashts/319537.pdf
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/blkdev.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <scsi/scsi_host.h>
+#include <linux/libata.h>
+#include <linux/dmi.h>
+
+#define DRV_NAME        "pata_sch"
+#define DRV_VERSION     "0.2"
+
+/* see SCH datasheet page 351 */
+enum {
+        D0TIM   = 0x80,         /* Device 0 Timing Register */
+        D1TIM   = 0x84,         /* Device 1 Timing Register */
+        PM      = 0x07,         /* PIO Mode Bit Mask */
+        MDM     = (0x03 << 8),  /* Multi-word DMA Mode Bit Mask */
+        UDM     = (0x07 << 16), /* Ultra DMA Mode Bit Mask */
+        PPE     = (1 << 30),    /* Prefetch/Post Enable */
+        USD     = (1 << 31),    /* Use Synchronous DMA */
+};
+
+static int sch_init_one(struct pci_dev *pdev,
+                         const struct pci_device_id *ent);
+static void sch_set_piomode(struct ata_port *ap, struct ata_device *adev);
+static void sch_set_dmamode(struct ata_port *ap, struct ata_device *adev);
+
+static const struct pci_device_id sch_pci_tbl[] = {
+        /* Intel SCH PATA Controller */
+        { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_SCH_IDE), 0 },
+        { }     /* terminate list */
+};
+
+static struct pci_driver sch_pci_driver = {
+        .name                   = DRV_NAME,
+        .id_table               = sch_pci_tbl,
+        .probe                  = sch_init_one,
+        .remove                 = ata_pci_remove_one,
+#ifdef CONFIG_PM
+        .suspend                = ata_pci_device_suspend,
+        .resume                 = ata_pci_device_resume,
+#endif
+};
+
+static struct scsi_host_template sch_sht = {
+        ATA_BMDMA_SHT(DRV_NAME),
+};
+
+static struct ata_port_operations sch_pata_ops = {
+        .inherits               = &ata_bmdma_port_ops,
+        .cable_detect           = ata_cable_unknown,
+        .set_piomode            = sch_set_piomode,
+        .set_dmamode            = sch_set_dmamode,
+};
+
+static struct ata_port_info sch_port_info = {
+        .flags          = 0,
+        .pio_mask       = ATA_PIO4,   /* pio0-4 */
+        .mwdma_mask     = ATA_MWDMA2, /* mwdma0-2 */
+        .udma_mask      = ATA_UDMA5,  /* udma0-5 */
+        .port_ops       = &sch_pata_ops,
+};
+
+MODULE_AUTHOR("Alek Du <alek.du@intel.com>");
+MODULE_DESCRIPTION("SCSI low-level driver for Intel SCH PATA controllers");
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(pci, sch_pci_tbl);
+MODULE_VERSION(DRV_VERSION);
+
+/**
+ *      sch_set_piomode - Initialize host controller PATA PIO timings
+ *      @ap: Port whose timings we are configuring
+ *      @adev: ATA device
+ *
+ *      Set PIO mode for device, in host controller PCI config space.
+ *
+ *      LOCKING:
+ *      None (inherited from caller).
+ */
+
+static void sch_set_piomode(struct ata_port *ap, struct ata_device *adev)
+{
+        unsigned int pio        = adev->pio_mode - XFER_PIO_0;
+        struct pci_dev *dev     = to_pci_dev(ap->host->dev);
+        unsigned int port       = adev->devno ? D1TIM : D0TIM;
+        unsigned int data;
+
+        pci_read_config_dword(dev, port, &data);
+        /* see SCH datasheet page 351 */
+        /* set PIO mode */
+        data &= ~(PM | PPE);
+        data |= pio;
+        /* enable PPE for block device */
+        if (adev->class == ATA_DEV_ATA)
+                data |= PPE;
+        pci_write_config_dword(dev, port, data);
+}
+
+/**
+ *      sch_set_dmamode - Initialize host controller PATA DMA timings
+ *      @ap: Port whose timings we are configuring
+ *      @adev: ATA device
+ *
+ *      Set MW/UDMA mode for device, in host controller PCI config space.
+ *
+ *      LOCKING:
+ *      None (inherited from caller).
+ */
+
+static void sch_set_dmamode(struct ata_port *ap, struct ata_device *adev)
+{
+        unsigned int dma_mode   = adev->dma_mode;
+        struct pci_dev *dev     = to_pci_dev(ap->host->dev);
+        unsigned int port       = adev->devno ? D1TIM : D0TIM;
+        unsigned int data;
+
+        pci_read_config_dword(dev, port, &data);
+        /* see SCH datasheet page 351 */
+        if (dma_mode >= XFER_UDMA_0) {
+                /* enable Synchronous DMA mode */
+                data |= USD;
+                data &= ~UDM;
+                data |= (dma_mode - XFER_UDMA_0) << 16;
+        } else { /* must be MWDMA mode, since we masked SWDMA already */
+                data &= ~(USD | MDM);
+                data |= (dma_mode - XFER_MW_DMA_0) << 8;
+        }
+        pci_write_config_dword(dev, port, data);
+}
+
+/**
+ *      sch_init_one - Register SCH ATA PCI device with kernel services
+ *      @pdev: PCI device to register
+ *      @ent: Entry in sch_pci_tbl matching with @pdev
+ *
+ *      LOCKING:
+ *      Inherited from PCI layer (may sleep).
+ *
+ *      RETURNS:
+ *      Zero on success, or -ERRNO value.
+ */
+
+static int __devinit sch_init_one(struct pci_dev *pdev,
+                                   const struct pci_device_id *ent)
+{
+        static int printed_version;
+        const struct ata_port_info *ppi[] = { &sch_port_info, NULL };
+        struct ata_host *host;
+        int rc;
+
+        if (!printed_version++)
+                dev_printk(KERN_DEBUG, &pdev->dev,
+                           "version " DRV_VERSION "\n");
+
+        /* enable device and prepare host */
+        rc = pcim_enable_device(pdev);
+        if (rc)
+                return rc;
+        rc = ata_pci_sff_prepare_host(pdev, ppi, &host);
+        if (rc)
+                return rc;
+        pci_set_master(pdev);
+        return ata_pci_sff_activate_host(host, ata_sff_interrupt, &sch_sht);
+}
+
+static int __init sch_init(void)
+{
+        return pci_register_driver(&sch_pci_driver);
+}
+
+static void __exit sch_exit(void)
+{
+        pci_unregister_driver(&sch_pci_driver);
+}
+
+module_init(sch_init);
+module_exit(sch_exit);
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index d27bb9a2568..3ead02fe379 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -10,13 +10,33 @@
  * right.  Documentation is available at initio's website but it only
  * documents registers (not programming model).
  *
- * - ATA disks work.
- * - Hotplug works.
- * - ATAPI read works but burning doesn't.  This thing is really
- *   peculiar about ATAPI and I couldn't figure out how ATAPI PIO and
- *   ATAPI DMA WRITE should be programmed.  If you've got a clue, be
- *   my guest.
- * - Both STR and STD work.
+ * This driver has interesting history.  The first version was written
+ * from the documentation and a 2.4 IDE driver posted on a Taiwan
+ * company, which didn't use any IDMA features and couldn't handle
+ * LBA48.  The resulting driver couldn't handle LBA48 devices either
+ * making it pretty useless.
+ *
+ * After a while, initio picked the driver up, renamed it to
+ * sata_initio162x, updated it to use IDMA for ATA DMA commands and
+ * posted it on their website.  It only used ATA_PROT_DMA for IDMA and
+ * attaching both devices and issuing IDMA and !IDMA commands
+ * simultaneously broke it due to PIRQ masking interaction but it did
+ * show how to use the IDMA (ADMA + some initio specific twists)
+ * engine.
+ *
+ * Then, I picked up their changes again and here's the usable driver
+ * which uses IDMA for everything.  Everything works now including
+ * LBA48, CD/DVD burning, suspend/resume and hotplug.  There are some
+ * issues tho.  Result Tf is not resported properly, NCQ isn't
+ * supported yet and CD/DVD writing works with DMA assisted PIO
+ * protocol (which, for native SATA devices, shouldn't cause any
+ * noticeable difference).
+ *
+ * Anyways, so, here's finally a working driver for inic162x.  Enjoy!
+ *
+ * initio: If you guys wanna improve the driver regarding result TF
+ * access and other stuff, please feel free to contact me.  I'll be
+ * happy to assist.
  */
 
 #include <linux/kernel.h>
@@ -28,13 +48,19 @@
 #include <scsi/scsi_device.h>
 
 #define DRV_NAME        "sata_inic162x"
-#define DRV_VERSION     "0.3"
+#define DRV_VERSION     "0.4"
 
 enum {
-        MMIO_BAR                = 5,
+        MMIO_BAR_PCI            = 5,
+        MMIO_BAR_CARDBUS        = 1,
 
         NR_PORTS                = 2,
 
+        IDMA_CPB_TBL_SIZE       = 4 * 32,
+
+        INIC_DMA_BOUNDARY       = 0xffffff,
+
+        HOST_ACTRL              = 0x08,
         HOST_CTL                = 0x7c,
         HOST_STAT               = 0x7e,
         HOST_IRQ_STAT           = 0xbc,
@@ -43,22 +69,37 @@ enum {
         PORT_SIZE               = 0x40,
 
         /* registers for ATA TF operation */
-        PORT_TF                 = 0x00,
-        PORT_ALT_STAT           = 0x08,
+        PORT_TF_DATA            = 0x00,
+        PORT_TF_FEATURE         = 0x01,
+        PORT_TF_NSECT           = 0x02,
+        PORT_TF_LBAL            = 0x03,
+        PORT_TF_LBAM            = 0x04,
+        PORT_TF_LBAH            = 0x05,
+        PORT_TF_DEVICE          = 0x06,
+        PORT_TF_COMMAND         = 0x07,
+        PORT_TF_ALT_STAT        = 0x08,
         PORT_IRQ_STAT           = 0x09,
         PORT_IRQ_MASK           = 0x0a,
         PORT_PRD_CTL            = 0x0b,
         PORT_PRD_ADDR           = 0x0c,
         PORT_PRD_XFERLEN        = 0x10,
+        PORT_CPB_CPBLAR         = 0x18,
+        PORT_CPB_PTQFIFO        = 0x1c,
 
         /* IDMA register */
         PORT_IDMA_CTL           = 0x14,
+        PORT_IDMA_STAT          = 0x16,
+
+        PORT_RPQ_FIFO           = 0x1e,
+        PORT_RPQ_CNT            = 0x1f,
 
         PORT_SCR                = 0x20,
 
         /* HOST_CTL bits */
         HCTL_IRQOFF             = (1 << 8),  /* global IRQ off */
-        HCTL_PWRDWN             = (1 << 13), /* power down PHYs */
+        HCTL_FTHD0              = (1 << 10), /* fifo threshold 0 */
+        HCTL_FTHD1              = (1 << 11), /* fifo threshold 1*/
+        HCTL_PWRDWN             = (1 << 12), /* power down PHYs */
         HCTL_SOFTRST            = (1 << 13), /* global reset (no phy reset) */
         HCTL_RPGSEL             = (1 << 15), /* register page select */
 
@@ -81,9 +122,7 @@ enum {
         PIRQ_PENDING            = (1 << 7),  /* port IRQ pending (STAT only) */
 
         PIRQ_ERR                = PIRQ_OFFLINE | PIRQ_ONLINE | PIRQ_FATAL,
-
-        PIRQ_MASK_DMA_READ      = PIRQ_REPLY | PIRQ_ATA,
-        PIRQ_MASK_OTHER         = PIRQ_REPLY | PIRQ_COMPLETE,
+        PIRQ_MASK_DEFAULT       = PIRQ_REPLY | PIRQ_ATA,
         PIRQ_MASK_FREEZE        = 0xff,
 
         /* PORT_PRD_CTL bits */
@@ -96,20 +135,104 @@ enum {
         IDMA_CTL_RST_IDMA       = (1 << 5),  /* reset IDMA machinary */
         IDMA_CTL_GO             = (1 << 7),  /* IDMA mode go */
         IDMA_CTL_ATA_NIEN       = (1 << 8),  /* ATA IRQ disable */
+
+        /* PORT_IDMA_STAT bits */
+        IDMA_STAT_PERR          = (1 << 0),  /* PCI ERROR MODE */
+        IDMA_STAT_CPBERR        = (1 << 1),  /* ADMA CPB error */
+        IDMA_STAT_LGCY          = (1 << 3),  /* ADMA legacy */
+        IDMA_STAT_UIRQ          = (1 << 4),  /* ADMA unsolicited irq */
+        IDMA_STAT_STPD          = (1 << 5),  /* ADMA stopped */
+        IDMA_STAT_PSD           = (1 << 6),  /* ADMA pause */
+        IDMA_STAT_DONE          = (1 << 7),  /* ADMA done */
+
+        IDMA_STAT_ERR           = IDMA_STAT_PERR | IDMA_STAT_CPBERR,
+
+        /* CPB Control Flags*/
+        CPB_CTL_VALID           = (1 << 0),  /* CPB valid */
+        CPB_CTL_QUEUED          = (1 << 1),  /* queued command */
+        CPB_CTL_DATA            = (1 << 2),  /* data, rsvd in datasheet */
+        CPB_CTL_IEN             = (1 << 3),  /* PCI interrupt enable */
+        CPB_CTL_DEVDIR          = (1 << 4),  /* device direction control */
+
+        /* CPB Response Flags */
+        CPB_RESP_DONE           = (1 << 0),  /* ATA command complete */
+        CPB_RESP_REL            = (1 << 1),  /* ATA release */
+        CPB_RESP_IGNORED        = (1 << 2),  /* CPB ignored */
+        CPB_RESP_ATA_ERR        = (1 << 3),  /* ATA command error */
+        CPB_RESP_SPURIOUS       = (1 << 4),  /* ATA spurious interrupt error */
+        CPB_RESP_UNDERFLOW      = (1 << 5),  /* APRD deficiency length error */
+        CPB_RESP_OVERFLOW       = (1 << 6),  /* APRD exccess length error */
+        CPB_RESP_CPB_ERR        = (1 << 7),  /* CPB error flag */
+
+        /* PRD Control Flags */
+        PRD_DRAIN               = (1 << 1),  /* ignore data excess */
+        PRD_CDB                 = (1 << 2),  /* atapi packet command pointer */
+        PRD_DIRECT_INTR         = (1 << 3),  /* direct interrupt */
+        PRD_DMA                 = (1 << 4),  /* data transfer method */
+        PRD_WRITE               = (1 << 5),  /* data dir, rsvd in datasheet */
+        PRD_IOM                 = (1 << 6),  /* io/memory transfer */
+        PRD_END                 = (1 << 7),  /* APRD chain end */
 };
 
+/* Comman Parameter Block */
+struct inic_cpb {
+        u8              resp_flags;     /* Response Flags */
+        u8              error;          /* ATA Error */
+        u8              status;         /* ATA Status */
+        u8              ctl_flags;      /* Control Flags */
+        __le32          len;            /* Total Transfer Length */
+        __le32          prd;            /* First PRD pointer */
+        u8              rsvd[4];
+        /* 16 bytes */
+        u8              feature;        /* ATA Feature */
+        u8              hob_feature;    /* ATA Ex. Feature */
+        u8              device;         /* ATA Device/Head */
+        u8              mirctl;         /* Mirror Control */
+        u8              nsect;          /* ATA Sector Count */
+        u8              hob_nsect;      /* ATA Ex. Sector Count */
+        u8              lbal;           /* ATA Sector Number */
+        u8              hob_lbal;       /* ATA Ex. Sector Number */
+        u8              lbam;           /* ATA Cylinder Low */
+        u8              hob_lbam;       /* ATA Ex. Cylinder Low */
+        u8              lbah;           /* ATA Cylinder High */
+        u8              hob_lbah;       /* ATA Ex. Cylinder High */
+        u8              command;        /* ATA Command */
+        u8              ctl;            /* ATA Control */
+        u8              slave_error;    /* Slave ATA Error */
+        u8              slave_status;   /* Slave ATA Status */
+        /* 32 bytes */
+} __packed;
+
+/* Physical Region Descriptor */
+struct inic_prd {
+        __le32          mad;            /* Physical Memory Address */
+        __le16          len;            /* Transfer Length */
+        u8              rsvd;
+        u8              flags;          /* Control Flags */
+} __packed;
+
+struct inic_pkt {
+        struct inic_cpb cpb;
+        struct inic_prd prd[LIBATA_MAX_PRD + 1];        /* + 1 for cdb */
+        u8              cdb[ATAPI_CDB_LEN];
+} __packed;
+
 struct inic_host_priv {
-        u16     cached_hctl;
+        void __iomem    *mmio_base;
+        u16             cached_hctl;
 };
 
 struct inic_port_priv {
-        u8      dfl_prdctl;
-        u8      cached_prdctl;
-        u8      cached_pirq_mask;
+        struct inic_pkt *pkt;
+        dma_addr_t      pkt_dma;
+        u32             *cpb_tbl;
+        dma_addr_t      cpb_tbl_dma;
 };
 
 static struct scsi_host_template inic_sht = {
-        ATA_BMDMA_SHT(DRV_NAME),
+        ATA_BASE_SHT(DRV_NAME),
+        .sg_tablesize   = LIBATA_MAX_PRD,       /* maybe it can be larger? */
+        .dma_boundary   = INIC_DMA_BOUNDARY,
 };
 
 static const int scr_map[] = {
@@ -120,54 +243,34 @@ static const int scr_map[] = {
 
 static void __iomem *inic_port_base(struct ata_port *ap)
 {
-        return ap->host->iomap[MMIO_BAR] + ap->port_no * PORT_SIZE;
-}
-
-static void __inic_set_pirq_mask(struct ata_port *ap, u8 mask)
-{
-        void __iomem *port_base = inic_port_base(ap);
-        struct inic_port_priv *pp = ap->private_data;
+        struct inic_host_priv *hpriv = ap->host->private_data;
 
-        writeb(mask, port_base + PORT_IRQ_MASK);
-        pp->cached_pirq_mask = mask;
-}
-
-static void inic_set_pirq_mask(struct ata_port *ap, u8 mask)
-{
-        struct inic_port_priv *pp = ap->private_data;
-
-        if (pp->cached_pirq_mask != mask)
-                __inic_set_pirq_mask(ap, mask);
+        return hpriv->mmio_base + ap->port_no * PORT_SIZE;
 }
 
 static void inic_reset_port(void __iomem *port_base)
 {
         void __iomem *idma_ctl = port_base + PORT_IDMA_CTL;
-        u16 ctl;
 
-        ctl = readw(idma_ctl);
-        ctl &= ~(IDMA_CTL_RST_IDMA | IDMA_CTL_ATA_NIEN | IDMA_CTL_GO);
+        /* stop IDMA engine */
+        readw(idma_ctl); /* flush */
+        msleep(1);
 
         /* mask IRQ and assert reset */
-        writew(ctl | IDMA_CTL_RST_IDMA | IDMA_CTL_ATA_NIEN, idma_ctl);
+        writew(IDMA_CTL_RST_IDMA, idma_ctl);
         readw(idma_ctl); /* flush */
-
-        /* give it some time */
         msleep(1);
 
         /* release reset */
-        writew(ctl | IDMA_CTL_ATA_NIEN, idma_ctl);
+        writew(0, idma_ctl);
 
         /* clear irq */
         writeb(0xff, port_base + PORT_IRQ_STAT);
-
-        /* reenable ATA IRQ, turn off IDMA mode */
-        writew(ctl, idma_ctl);
 }
 
 static int inic_scr_read(struct ata_port *ap, unsigned sc_reg, u32 *val)
 {
-        void __iomem *scr_addr = ap->ioaddr.scr_addr;
+        void __iomem *scr_addr = inic_port_base(ap) + PORT_SCR;
         void __iomem *addr;
 
         if (unlikely(sc_reg >= ARRAY_SIZE(scr_map)))
@@ -184,120 +287,126 @@ static int inic_scr_read(struct ata_port *ap, unsigned sc_reg, u32 *val)
 
 static int inic_scr_write(struct ata_port *ap, unsigned sc_reg, u32 val)
 {
-        void __iomem *scr_addr = ap->ioaddr.scr_addr;
-        void __iomem *addr;
+        void __iomem *scr_addr = inic_port_base(ap) + PORT_SCR;
 
         if (unlikely(sc_reg >= ARRAY_SIZE(scr_map)))
                 return -EINVAL;
 
-        addr = scr_addr + scr_map[sc_reg] * 4;
         writel(val, scr_addr + scr_map[sc_reg] * 4);
         return 0;
 }
 
-/*
- * In TF mode, inic162x is very similar to SFF device.  TF registers
- * function the same.  DMA engine behaves similary using the same PRD
- * format as BMDMA but different command register, interrupt and event
- * notification methods are used.  The following inic_bmdma_*()
- * functions do the impedance matching.
- */
-static void inic_bmdma_setup(struct ata_queued_cmd *qc)
+static void inic_stop_idma(struct ata_port *ap)
 {
-        struct ata_port *ap = qc->ap;
-        struct inic_port_priv *pp = ap->private_data;
         void __iomem *port_base = inic_port_base(ap);
-        int rw = qc->tf.flags & ATA_TFLAG_WRITE;
-
-        /* make sure device sees PRD table writes */
-        wmb();
-
-        /* load transfer length */
-        writel(qc->nbytes, port_base + PORT_PRD_XFERLEN);
-
-        /* turn on DMA and specify data direction */
-        pp->cached_prdctl = pp->dfl_prdctl | PRD_CTL_DMAEN;
-        if (!rw)
-                pp->cached_prdctl |= PRD_CTL_WR;
-        writeb(pp->cached_prdctl, port_base + PORT_PRD_CTL);
 
-        /* issue r/w command */
-        ap->ops->sff_exec_command(ap, &qc->tf);
+        readb(port_base + PORT_RPQ_FIFO);
+        readb(port_base + PORT_RPQ_CNT);
+        writew(0, port_base + PORT_IDMA_CTL);
 }
 
-static void inic_bmdma_start(struct ata_queued_cmd *qc)
+static void inic_host_err_intr(struct ata_port *ap, u8 irq_stat, u16 idma_stat)
 {
-        struct ata_port *ap = qc->ap;
+        struct ata_eh_info *ehi = &ap->link.eh_info;
         struct inic_port_priv *pp = ap->private_data;
-        void __iomem *port_base = inic_port_base(ap);
+        struct inic_cpb *cpb = &pp->pkt->cpb;
+        bool freeze = false;
 
-        /* start host DMA transaction */
-        pp->cached_prdctl |= PRD_CTL_START;
-        writeb(pp->cached_prdctl, port_base + PORT_PRD_CTL);
-}
+        ata_ehi_clear_desc(ehi);
+        ata_ehi_push_desc(ehi, "irq_stat=0x%x idma_stat=0x%x",
+                          irq_stat, idma_stat);
 
-static void inic_bmdma_stop(struct ata_queued_cmd *qc)
-{
-        struct ata_port *ap = qc->ap;
-        struct inic_port_priv *pp = ap->private_data;
-        void __iomem *port_base = inic_port_base(ap);
+        inic_stop_idma(ap);
 
-        /* stop DMA engine */
-        writeb(pp->dfl_prdctl, port_base + PORT_PRD_CTL);
-}
+        if (irq_stat & (PIRQ_OFFLINE | PIRQ_ONLINE)) {
+                ata_ehi_push_desc(ehi, "hotplug");
+                ata_ehi_hotplugged(ehi);
+                freeze = true;
+        }
 
-static u8 inic_bmdma_status(struct ata_port *ap)
-{
-        /* event is already verified by the interrupt handler */
-        return ATA_DMA_INTR;
+        if (idma_stat & IDMA_STAT_PERR) {
+                ata_ehi_push_desc(ehi, "PCI error");
+                freeze = true;
+        }
+
+        if (idma_stat & IDMA_STAT_CPBERR) {
+                ata_ehi_push_desc(ehi, "CPB error");
+
+                if (cpb->resp_flags & CPB_RESP_IGNORED) {
+                        __ata_ehi_push_desc(ehi, " ignored");
+                        ehi->err_mask |= AC_ERR_INVALID;
+                        freeze = true;
+                }
+
+                if (cpb->resp_flags & CPB_RESP_ATA_ERR)
+                        ehi->err_mask |= AC_ERR_DEV;
+
+                if (cpb->resp_flags & CPB_RESP_SPURIOUS) {
+                        __ata_ehi_push_desc(ehi, " spurious-intr");
+                        ehi->err_mask |= AC_ERR_HSM;
+                        freeze = true;
+                }
+
+                if (cpb->resp_flags &
+                    (CPB_RESP_UNDERFLOW | CPB_RESP_OVERFLOW)) {
+                        __ata_ehi_push_desc(ehi, " data-over/underflow");
+                        ehi->err_mask |= AC_ERR_HSM;
+                        freeze = true;
+                }
+        }
+
+        if (freeze)
+                ata_port_freeze(ap);
+        else
+                ata_port_abort(ap);
 }
 
 static void inic_host_intr(struct ata_port *ap)
 {
         void __iomem *port_base = inic_port_base(ap);
-        struct ata_eh_info *ehi = &ap->link.eh_info;
+        struct ata_queued_cmd *qc = ata_qc_from_tag(ap, ap->link.active_tag);
         u8 irq_stat;
+        u16 idma_stat;
 
-        /* fetch and clear irq */
+        /* read and clear IRQ status */
         irq_stat = readb(port_base + PORT_IRQ_STAT);
         writeb(irq_stat, port_base + PORT_IRQ_STAT);
+        idma_stat = readw(port_base + PORT_IDMA_STAT);
 
-        if (likely(!(irq_stat & PIRQ_ERR))) {
-                struct ata_queued_cmd *qc =
-                        ata_qc_from_tag(ap, ap->link.active_tag);
+        if (unlikely((irq_stat & PIRQ_ERR) || (idma_stat & IDMA_STAT_ERR)))
+                inic_host_err_intr(ap, irq_stat, idma_stat);
 
-                if (unlikely(!qc || (qc->tf.flags & ATA_TFLAG_POLLING))) {
-                        ap->ops->sff_check_status(ap); /* clear ATA interrupt */
-                        return;
-                }
+        if (unlikely(!qc))
+                goto spurious;
 
-                if (likely(ata_sff_host_intr(ap, qc)))
-                        return;
+        if (likely(idma_stat & IDMA_STAT_DONE)) {
+                inic_stop_idma(ap);
 
-                ap->ops->sff_check_status(ap); /* clear ATA interrupt */
-                ata_port_printk(ap, KERN_WARNING, "unhandled "
-                                "interrupt, irq_stat=%x\n", irq_stat);
+                /* Depending on circumstances, device error
+                 * isn't reported by IDMA, check it explicitly.
+                 */
+                if (unlikely(readb(port_base + PORT_TF_COMMAND) &
+                             (ATA_DF | ATA_ERR)))
+                        qc->err_mask |= AC_ERR_DEV;
+
+                ata_qc_complete(qc);
                 return;
         }
 
-        /* error */
-        ata_ehi_push_desc(ehi, "irq_stat=0x%x", irq_stat);
-
-        if (irq_stat & (PIRQ_OFFLINE | PIRQ_ONLINE)) {
-                ata_ehi_hotplugged(ehi);
-                ata_port_freeze(ap);
-        } else
-                ata_port_abort(ap);
+ spurious:
+        ata_port_printk(ap, KERN_WARNING, "unhandled interrupt: "
+                        "cmd=0x%x irq_stat=0x%x idma_stat=0x%x\n",
+                        qc ? qc->tf.command : 0xff, irq_stat, idma_stat);
 }
 
 static irqreturn_t inic_interrupt(int irq, void *dev_instance)
 {
         struct ata_host *host = dev_instance;
-        void __iomem *mmio_base = host->iomap[MMIO_BAR];
+        struct inic_host_priv *hpriv = host->private_data;
         u16 host_irq_stat;
         int i, handled = 0;;
 
-        host_irq_stat = readw(mmio_base + HOST_IRQ_STAT);
+        host_irq_stat = readw(hpriv->mmio_base + HOST_IRQ_STAT);
 
         if (unlikely(!(host_irq_stat & HIRQ_GLOBAL)))
                 goto out;
@@ -327,60 +436,173 @@ static irqreturn_t inic_interrupt(int irq, void *dev_instance)
         return IRQ_RETVAL(handled);
 }
 
+static int inic_check_atapi_dma(struct ata_queued_cmd *qc)
+{
+        /* For some reason ATAPI_PROT_DMA doesn't work for some
+         * commands including writes and other misc ops.  Use PIO
+         * protocol instead, which BTW is driven by the DMA engine
+         * anyway, so it shouldn't make much difference for native
+         * SATA devices.
+         */
+        if (atapi_cmd_type(qc->cdb[0]) == READ)
+                return 0;
+        return 1;
+}
+
+static void inic_fill_sg(struct inic_prd *prd, struct ata_queued_cmd *qc)
+{
+        struct scatterlist *sg;
+        unsigned int si;
+        u8 flags = 0;
+
+        if (qc->tf.flags & ATA_TFLAG_WRITE)
+                flags |= PRD_WRITE;
+
+        if (ata_is_dma(qc->tf.protocol))
+                flags |= PRD_DMA;
+
+        for_each_sg(qc->sg, sg, qc->n_elem, si) {
+                prd->mad = cpu_to_le32(sg_dma_address(sg));
+                prd->len = cpu_to_le16(sg_dma_len(sg));
+                prd->flags = flags;
+                prd++;
+        }
+
+        WARN_ON(!si);
+        prd[-1].flags |= PRD_END;
+}
+
+static void inic_qc_prep(struct ata_queued_cmd *qc)
+{
+        struct inic_port_priv *pp = qc->ap->private_data;
+        struct inic_pkt *pkt = pp->pkt;
+        struct inic_cpb *cpb = &pkt->cpb;
+        struct inic_prd *prd = pkt->prd;
+        bool is_atapi = ata_is_atapi(qc->tf.protocol);
+        bool is_data = ata_is_data(qc->tf.protocol);
+        unsigned int cdb_len = 0;
+
+        VPRINTK("ENTER\n");
+
+        if (is_atapi)
+                cdb_len = qc->dev->cdb_len;
+
+        /* prepare packet, based on initio driver */
+        memset(pkt, 0, sizeof(struct inic_pkt));
+
+        cpb->ctl_flags = CPB_CTL_VALID | CPB_CTL_IEN;
+        if (is_atapi || is_data)
+                cpb->ctl_flags |= CPB_CTL_DATA;
+
+        cpb->len = cpu_to_le32(qc->nbytes + cdb_len);
+        cpb->prd = cpu_to_le32(pp->pkt_dma + offsetof(struct inic_pkt, prd));
+
+        cpb->device = qc->tf.device;
+        cpb->feature = qc->tf.feature;
+        cpb->nsect = qc->tf.nsect;
+        cpb->lbal = qc->tf.lbal;
+        cpb->lbam = qc->tf.lbam;
+        cpb->lbah = qc->tf.lbah;
+
+        if (qc->tf.flags & ATA_TFLAG_LBA48) {
+                cpb->hob_feature = qc->tf.hob_feature;
+                cpb->hob_nsect = qc->tf.hob_nsect;
+                cpb->hob_lbal = qc->tf.hob_lbal;
+                cpb->hob_lbam = qc->tf.hob_lbam;
+                cpb->hob_lbah = qc->tf.hob_lbah;
+        }
+
+        cpb->command = qc->tf.command;
+        /* don't load ctl - dunno why.  it's like that in the initio driver */
+
+        /* setup PRD for CDB */
+        if (is_atapi) {
+                memcpy(pkt->cdb, qc->cdb, ATAPI_CDB_LEN);
+                prd->mad = cpu_to_le32(pp->pkt_dma +
+                                       offsetof(struct inic_pkt, cdb));
+                prd->len = cpu_to_le16(cdb_len);
+                prd->flags = PRD_CDB | PRD_WRITE;
+                if (!is_data)
+                        prd->flags |= PRD_END;
+                prd++;
+        }
+
+        /* setup sg table */
+        if (is_data)
+                inic_fill_sg(prd, qc);
+
+        pp->cpb_tbl[0] = pp->pkt_dma;
+}
+
 static unsigned int inic_qc_issue(struct ata_queued_cmd *qc)
 {
         struct ata_port *ap = qc->ap;
+        void __iomem *port_base = inic_port_base(ap);
 
-        /* ATA IRQ doesn't wait for DMA transfer completion and vice
-         * versa.  Mask IRQ selectively to detect command completion.
-         * Without it, ATA DMA read command can cause data corruption.
-         *
-         * Something similar might be needed for ATAPI writes.  I
-         * tried a lot of combinations but couldn't find the solution.
-         */
-        if (qc->tf.protocol == ATA_PROT_DMA &&
-            !(qc->tf.flags & ATA_TFLAG_WRITE))
-                inic_set_pirq_mask(ap, PIRQ_MASK_DMA_READ);
-        else
-                inic_set_pirq_mask(ap, PIRQ_MASK_OTHER);
+        /* fire up the ADMA engine */
+        writew(HCTL_FTHD0, port_base + HOST_CTL);
+        writew(IDMA_CTL_GO, port_base + PORT_IDMA_CTL);
+        writeb(0, port_base + PORT_CPB_PTQFIFO);
+
+        return 0;
+}
+
+static void inic_tf_read(struct ata_port *ap, struct ata_taskfile *tf)
+{
+        void __iomem *port_base = inic_port_base(ap);
+
+        tf->feature     = readb(port_base + PORT_TF_FEATURE);
+        tf->nsect       = readb(port_base + PORT_TF_NSECT);
+        tf->lbal        = readb(port_base + PORT_TF_LBAL);
+        tf->lbam        = readb(port_base + PORT_TF_LBAM);
+        tf->lbah        = readb(port_base + PORT_TF_LBAH);
+        tf->device      = readb(port_base + PORT_TF_DEVICE);
+        tf->command     = readb(port_base + PORT_TF_COMMAND);
+}
 
-        /* Issuing a command to yet uninitialized port locks up the
-         * controller.  Most of the time, this happens for the first
-         * command after reset which are ATA and ATAPI IDENTIFYs.
-         * Fast fail if stat is 0x7f or 0xff for those commands.
+static bool inic_qc_fill_rtf(struct ata_queued_cmd *qc)
+{
+        struct ata_taskfile *rtf = &qc->result_tf;
+        struct ata_taskfile tf;
+
+        /* FIXME: Except for status and error, result TF access
+         * doesn't work.  I tried reading from BAR0/2, CPB and BAR5.
+         * None works regardless of which command interface is used.
+         * For now return true iff status indicates device error.
+         * This means that we're reporting bogus sector for RW
+         * failures.  Eeekk....
          */
-        if (unlikely(qc->tf.command == ATA_CMD_ID_ATA ||
-                     qc->tf.command == ATA_CMD_ID_ATAPI)) {
-                u8 stat = ap->ops->sff_check_status(ap);
-                if (stat == 0x7f || stat == 0xff)
-                        return AC_ERR_HSM;
-        }
+        inic_tf_read(qc->ap, &tf);
 
-        return ata_sff_qc_issue(qc);
+        if (!(tf.command & ATA_ERR))
+                return false;
+
+        rtf->command = tf.command;
+        rtf->feature = tf.feature;
+        return true;
 }
 
 static void inic_freeze(struct ata_port *ap)
 {
         void __iomem *port_base = inic_port_base(ap);
 
-        __inic_set_pirq_mask(ap, PIRQ_MASK_FREEZE);
-
-        ap->ops->sff_check_status(ap);
+        writeb(PIRQ_MASK_FREEZE, port_base + PORT_IRQ_MASK);
         writeb(0xff, port_base + PORT_IRQ_STAT);
-
-        readb(port_base + PORT_IRQ_STAT); /* flush */
 }
 
 static void inic_thaw(struct ata_port *ap)
 {
         void __iomem *port_base = inic_port_base(ap);
 
-        ap->ops->sff_check_status(ap);
         writeb(0xff, port_base + PORT_IRQ_STAT);
+        writeb(PIRQ_MASK_DEFAULT, port_base + PORT_IRQ_MASK);
+}
 
-        __inic_set_pirq_mask(ap, PIRQ_MASK_OTHER);
+static int inic_check_ready(struct ata_link *link)
+{
+        void __iomem *port_base = inic_port_base(link->ap);
 
-        readb(port_base + PORT_IRQ_STAT); /* flush */
+        return ata_check_ready(readb(port_base + PORT_TF_COMMAND));
 }
 
 /*
@@ -394,17 +616,15 @@ static int inic_hardreset(struct ata_link *link, unsigned int *class,
         void __iomem *port_base = inic_port_base(ap);
         void __iomem *idma_ctl = port_base + PORT_IDMA_CTL;
         const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context);
-        u16 val;
         int rc;
 
         /* hammer it into sane state */
         inic_reset_port(port_base);
 
-        val = readw(idma_ctl);
-        writew(val | IDMA_CTL_RST_ATA, idma_ctl);
+        writew(IDMA_CTL_RST_ATA, idma_ctl);
         readw(idma_ctl);        /* flush */
         msleep(1);
-        writew(val & ~IDMA_CTL_RST_ATA, idma_ctl);
+        writew(0, idma_ctl);
 
         rc = sata_link_resume(link, timing, deadline);
         if (rc) {
@@ -418,7 +638,7 @@ static int inic_hardreset(struct ata_link *link, unsigned int *class,
                 struct ata_taskfile tf;
 
                 /* wait for link to become ready */
-                rc = ata_sff_wait_after_reset(link, 1, deadline);
+                rc = ata_wait_after_reset(link, deadline, inic_check_ready);
                 /* link occupied, -ENODEV too is an error */
                 if (rc) {
                         ata_link_printk(link, KERN_WARNING, "device not ready "
@@ -426,7 +646,7 @@ static int inic_hardreset(struct ata_link *link, unsigned int *class,
                         return rc;
                 }
 
-                ata_sff_tf_read(ap, &tf);
+                inic_tf_read(ap, &tf);
                 *class = ata_dev_classify(&tf);
         }
 
@@ -436,18 +656,8 @@ static int inic_hardreset(struct ata_link *link, unsigned int *class,
 static void inic_error_handler(struct ata_port *ap)
 {
         void __iomem *port_base = inic_port_base(ap);
-        struct inic_port_priv *pp = ap->private_data;
-        unsigned long flags;
 
-        /* reset PIO HSM and stop DMA engine */
         inic_reset_port(port_base);
-
-        spin_lock_irqsave(ap->lock, flags);
-        ap->hsm_task_state = HSM_ST_IDLE;
-        writeb(pp->dfl_prdctl, port_base + PORT_PRD_CTL);
-        spin_unlock_irqrestore(ap->lock, flags);
-
-        /* PIO and DMA engines have been stopped, perform recovery */
         ata_std_error_handler(ap);
 }
 
@@ -458,26 +668,18 @@ static void inic_post_internal_cmd(struct ata_queued_cmd *qc)
                 inic_reset_port(inic_port_base(qc->ap));
 }
 
-static void inic_dev_config(struct ata_device *dev)
-{
-        /* inic can only handle upto LBA28 max sectors */
-        if (dev->max_sectors > ATA_MAX_SECTORS)
-                dev->max_sectors = ATA_MAX_SECTORS;
-
-        if (dev->n_sectors >= 1 << 28) {
-                ata_dev_printk(dev, KERN_ERR,
-        "ERROR: This driver doesn't support LBA48 yet and may cause\n"
-        "                data corruption on such devices.  Disabling.\n");
-                ata_dev_disable(dev);
-        }
-}
-
 static void init_port(struct ata_port *ap)
 {
         void __iomem *port_base = inic_port_base(ap);
+        struct inic_port_priv *pp = ap->private_data;
 
-        /* Setup PRD address */
+        /* clear packet and CPB table */
+        memset(pp->pkt, 0, sizeof(struct inic_pkt));
+        memset(pp->cpb_tbl, 0, IDMA_CPB_TBL_SIZE);
+
+        /* setup PRD and CPB lookup table addresses */
         writel(ap->prd_dma, port_base + PORT_PRD_ADDR);
+        writel(pp->cpb_tbl_dma, port_base + PORT_CPB_CPBLAR);
 }
 
 static int inic_port_resume(struct ata_port *ap)
@@ -488,28 +690,30 @@ static int inic_port_resume(struct ata_port *ap)
 
 static int inic_port_start(struct ata_port *ap)
 {
-        void __iomem *port_base = inic_port_base(ap);
+        struct device *dev = ap->host->dev;
         struct inic_port_priv *pp;
-        u8 tmp;
         int rc;
 
         /* alloc and initialize private data */
-        pp = devm_kzalloc(ap->host->dev, sizeof(*pp), GFP_KERNEL);
+        pp = devm_kzalloc(dev, sizeof(*pp), GFP_KERNEL);
         if (!pp)
                 return -ENOMEM;
         ap->private_data = pp;
 
-        /* default PRD_CTL value, DMAEN, WR and START off */
-        tmp = readb(port_base + PORT_PRD_CTL);
-        tmp &= ~(PRD_CTL_DMAEN | PRD_CTL_WR | PRD_CTL_START);
-        pp->dfl_prdctl = tmp;
-
         /* Alloc resources */
         rc = ata_port_start(ap);
-        if (rc) {
-                kfree(pp);
+        if (rc)
                 return rc;
-        }
+
+        pp->pkt = dmam_alloc_coherent(dev, sizeof(struct inic_pkt),
+                                      &pp->pkt_dma, GFP_KERNEL);
+        if (!pp->pkt)
+                return -ENOMEM;
+
+        pp->cpb_tbl = dmam_alloc_coherent(dev, IDMA_CPB_TBL_SIZE,
+                                          &pp->cpb_tbl_dma, GFP_KERNEL);
+        if (!pp->cpb_tbl)
+                return -ENOMEM;
 
         init_port(ap);
 
@@ -517,21 +721,18 @@ static int inic_port_start(struct ata_port *ap)
 }
 
 static struct ata_port_operations inic_port_ops = {
-        .inherits               = &ata_sff_port_ops,
+        .inherits               = &sata_port_ops,
 
-        .bmdma_setup            = inic_bmdma_setup,
-        .bmdma_start            = inic_bmdma_start,
-        .bmdma_stop             = inic_bmdma_stop,
-        .bmdma_status           = inic_bmdma_status,
+        .check_atapi_dma        = inic_check_atapi_dma,
+        .qc_prep                = inic_qc_prep,
         .qc_issue               = inic_qc_issue,
+        .qc_fill_rtf            = inic_qc_fill_rtf,
 
         .freeze                 = inic_freeze,
         .thaw                   = inic_thaw,
-        .softreset              = ATA_OP_NULL,  /* softreset is broken */
         .hardreset              = inic_hardreset,
         .error_handler          = inic_error_handler,
         .post_internal_cmd      = inic_post_internal_cmd,
-        .dev_config             = inic_dev_config,
 
         .scr_read               = inic_scr_read,
         .scr_write              = inic_scr_write,
@@ -541,12 +742,6 @@ static struct ata_port_operations inic_port_ops = {
 };
 
 static struct ata_port_info inic_port_info = {
-        /* For some reason, ATAPI_PROT_PIO is broken on this
-         * controller, and no, PIO_POLLING does't fix it.  It somehow
-         * manages to report the wrong ireason and ignoring ireason
-         * results in machine lock up.  Tell libata to always prefer
-         * DMA.
-         */
         .flags                  = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA,
         .pio_mask               = 0x1f, /* pio0-4 */
         .mwdma_mask             = 0x07, /* mwdma0-2 */
@@ -599,7 +794,6 @@ static int inic_pci_device_resume(struct pci_dev *pdev)
 {
         struct ata_host *host = dev_get_drvdata(&pdev->dev);
         struct inic_host_priv *hpriv = host->private_data;
-        void __iomem *mmio_base = host->iomap[MMIO_BAR];
         int rc;
 
         rc = ata_pci_device_do_resume(pdev);
@@ -607,7 +801,7 @@ static int inic_pci_device_resume(struct pci_dev *pdev)
                 return rc;
 
         if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND) {
-                rc = init_controller(mmio_base, hpriv->cached_hctl);
+                rc = init_controller(hpriv->mmio_base, hpriv->cached_hctl);
                 if (rc)
                         return rc;
         }
@@ -625,6 +819,7 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct ata_host *host;
         struct inic_host_priv *hpriv;
         void __iomem * const *iomap;
+        int mmio_bar;
         int i, rc;
 
         if (!printed_version++)
@@ -638,38 +833,31 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         host->private_data = hpriv;
 
-        /* acquire resources and fill host */
+        /* Acquire resources and fill host.  Note that PCI and cardbus
+         * use different BARs.
+         */
         rc = pcim_enable_device(pdev);
         if (rc)
                 return rc;
 
-        rc = pcim_iomap_regions(pdev, 0x3f, DRV_NAME);
+        if (pci_resource_flags(pdev, MMIO_BAR_PCI) & IORESOURCE_MEM)
+                mmio_bar = MMIO_BAR_PCI;
+        else
+                mmio_bar = MMIO_BAR_CARDBUS;
+
+        rc = pcim_iomap_regions(pdev, 1 << mmio_bar, DRV_NAME);
         if (rc)
                 return rc;
         host->iomap = iomap = pcim_iomap_table(pdev);
+        hpriv->mmio_base = iomap[mmio_bar];
+        hpriv->cached_hctl = readw(hpriv->mmio_base + HOST_CTL);
 
         for (i = 0; i < NR_PORTS; i++) {
                 struct ata_port *ap = host->ports[i];
-                struct ata_ioports *port = &ap->ioaddr;
-                unsigned int offset = i * PORT_SIZE;
-
-                port->cmd_addr = iomap[2 * i];
-                port->altstatus_addr =
-                port->ctl_addr = (void __iomem *)
-                        ((unsigned long)iomap[2 * i + 1] | ATA_PCI_CTL_OFS);
-                port->scr_addr = iomap[MMIO_BAR] + offset + PORT_SCR;
-
-                ata_sff_std_ports(port);
-
-                ata_port_pbar_desc(ap, MMIO_BAR, -1, "mmio");
-                ata_port_pbar_desc(ap, MMIO_BAR, offset, "port");
-                ata_port_desc(ap, "cmd 0x%llx ctl 0x%llx",
-                  (unsigned long long)pci_resource_start(pdev, 2 * i),
-                  (unsigned long long)pci_resource_start(pdev, (2 * i + 1)) |
-                                      ATA_PCI_CTL_OFS);
-        }
 
-        hpriv->cached_hctl = readw(iomap[MMIO_BAR] + HOST_CTL);
+                ata_port_pbar_desc(ap, mmio_bar, -1, "mmio");
+                ata_port_pbar_desc(ap, mmio_bar, i * PORT_SIZE, "port");
+        }
 
         /* Set dma_mask.  This devices doesn't support 64bit addressing. */
         rc = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
@@ -698,7 +886,7 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return rc;
         }
 
-        rc = init_controller(iomap[MMIO_BAR], hpriv->cached_hctl);
+        rc = init_controller(hpriv->mmio_base, hpriv->cached_hctl);
         if (rc) {
                 dev_printk(KERN_ERR, &pdev->dev,
                            "failed to initialize controller\n");
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 842b1a15b78..bb73b222262 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -65,6 +65,7 @@
 #include <linux/platform_device.h>
 #include <linux/ata_platform.h>
 #include <linux/mbus.h>
+#include <linux/bitops.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_device.h>
@@ -91,9 +92,9 @@ enum {
         MV_IRQ_COAL_TIME_THRESHOLD      = (MV_IRQ_COAL_REG_BASE + 0xd0),
 
         MV_SATAHC0_REG_BASE     = 0x20000,
-        MV_FLASH_CTL            = 0x1046c,
-        MV_GPIO_PORT_CTL        = 0x104f0,
-        MV_RESET_CFG            = 0x180d8,
+        MV_FLASH_CTL_OFS        = 0x1046c,
+        MV_GPIO_PORT_CTL_OFS    = 0x104f0,
+        MV_RESET_CFG_OFS        = 0x180d8,
 
         MV_PCI_REG_SZ           = MV_MAJOR_REG_AREA_SZ,
         MV_SATAHC_REG_SZ        = MV_MAJOR_REG_AREA_SZ,
@@ -147,18 +148,21 @@ enum {
         /* PCI interface registers */
 
         PCI_COMMAND_OFS         = 0xc00,
+        PCI_COMMAND_MRDTRIG     = (1 << 7),     /* PCI Master Read Trigger */
 
         PCI_MAIN_CMD_STS_OFS    = 0xd30,
         STOP_PCI_MASTER         = (1 << 2),
         PCI_MASTER_EMPTY        = (1 << 3),
         GLOB_SFT_RST            = (1 << 4),
 
-        MV_PCI_MODE             = 0xd00,
+        MV_PCI_MODE_OFS         = 0xd00,
+        MV_PCI_MODE_MASK        = 0x30,
+
         MV_PCI_EXP_ROM_BAR_CTL  = 0xd2c,
         MV_PCI_DISC_TIMER       = 0xd04,
         MV_PCI_MSI_TRIGGER      = 0xc38,
         MV_PCI_SERR_MASK        = 0xc28,
-        MV_PCI_XBAR_TMOUT       = 0x1d04,
+        MV_PCI_XBAR_TMOUT_OFS   = 0x1d04,
         MV_PCI_ERR_LOW_ADDRESS  = 0x1d40,
         MV_PCI_ERR_HIGH_ADDRESS = 0x1d44,
         MV_PCI_ERR_ATTRIBUTE    = 0x1d48,
@@ -225,16 +229,18 @@ enum {
         PHY_MODE4               = 0x314,
         PHY_MODE2               = 0x330,
         SATA_IFCTL_OFS          = 0x344,
+        SATA_TESTCTL_OFS        = 0x348,
         SATA_IFSTAT_OFS         = 0x34c,
         VENDOR_UNIQUE_FIS_OFS   = 0x35c,
 
-        FIS_CFG_OFS             = 0x360,
-        FIS_CFG_SINGLE_SYNC     = (1 << 16),    /* SYNC on DMA activation */
+        FISCFG_OFS              = 0x360,
+        FISCFG_WAIT_DEV_ERR     = (1 << 8),     /* wait for host on DevErr */
+        FISCFG_SINGLE_SYNC      = (1 << 16),    /* SYNC on DMA activation */
 
         MV5_PHY_MODE            = 0x74,
-        MV5_LT_MODE             = 0x30,
-        MV5_PHY_CTL             = 0x0C,
-        SATA_INTERFACE_CFG      = 0x050,
+        MV5_LTMODE_OFS          = 0x30,
+        MV5_PHY_CTL_OFS         = 0x0C,
+        SATA_INTERFACE_CFG_OFS  = 0x050,
 
         MV_M2_PREAMP_MASK       = 0x7e0,
 
@@ -332,10 +338,16 @@ enum {
         EDMA_CMD_OFS            = 0x28,         /* EDMA command register */
         EDMA_EN                 = (1 << 0),     /* enable EDMA */
         EDMA_DS                 = (1 << 1),     /* disable EDMA; self-negated */
-        ATA_RST                 = (1 << 2),     /* reset trans/link/phy */
+        EDMA_RESET              = (1 << 2),     /* reset eng/trans/link/phy */
+
+        EDMA_STATUS_OFS         = 0x30,         /* EDMA engine status */
+        EDMA_STATUS_CACHE_EMPTY = (1 << 6),     /* GenIIe command cache empty */
+        EDMA_STATUS_IDLE        = (1 << 7),     /* GenIIe EDMA enabled/idle */
 
-        EDMA_IORDY_TMOUT        = 0x34,
-        EDMA_ARB_CFG            = 0x38,
+        EDMA_IORDY_TMOUT_OFS    = 0x34,
+        EDMA_ARB_CFG_OFS        = 0x38,
+
+        EDMA_HALTCOND_OFS       = 0x60,         /* GenIIe halt conditions */
 
         GEN_II_NCQ_MAX_SECTORS  = 256,          /* max sects/io on Gen2 w/NCQ */
 
@@ -350,15 +362,19 @@ enum {
         MV_HP_GEN_II            = (1 << 7),     /* Generation II: 60xx */
         MV_HP_GEN_IIE           = (1 << 8),     /* Generation IIE: 6042/7042 */
         MV_HP_PCIE              = (1 << 9),     /* PCIe bus/regs: 7042 */
+        MV_HP_CUT_THROUGH       = (1 << 10),    /* can use EDMA cut-through */
 
         /* Port private flags (pp_flags) */
         MV_PP_FLAG_EDMA_EN      = (1 << 0),     /* is EDMA engine enabled? */
         MV_PP_FLAG_NCQ_EN       = (1 << 1),     /* is EDMA set up for NCQ? */
+        MV_PP_FLAG_FBS_EN       = (1 << 2),     /* is EDMA set up for FBS? */
+        MV_PP_FLAG_DELAYED_EH   = (1 << 3),     /* delayed dev err handling */
 };
 
 #define IS_GEN_I(hpriv) ((hpriv)->hp_flags & MV_HP_GEN_I)
 #define IS_GEN_II(hpriv) ((hpriv)->hp_flags & MV_HP_GEN_II)
 #define IS_GEN_IIE(hpriv) ((hpriv)->hp_flags & MV_HP_GEN_IIE)
+#define IS_PCIE(hpriv) ((hpriv)->hp_flags & MV_HP_PCIE)
 #define HAS_PCI(host) (!((host)->ports[0]->flags & MV_FLAG_SOC))
 
 #define WINDOW_CTRL(i)          (0x20030 + ((i) << 4))
@@ -433,6 +449,7 @@ struct mv_port_priv {
         unsigned int            resp_idx;
 
         u32                     pp_flags;
+        unsigned int            delayed_eh_pmp_map;
 };
 
 struct mv_port_signal {
@@ -479,6 +496,7 @@ static int mv5_scr_read(struct ata_port *ap, unsigned int sc_reg_in, u32 *val);
 static int mv5_scr_write(struct ata_port *ap, unsigned int sc_reg_in, u32 val);
 static int mv_port_start(struct ata_port *ap);
 static void mv_port_stop(struct ata_port *ap);
+static int mv_qc_defer(struct ata_queued_cmd *qc);
 static void mv_qc_prep(struct ata_queued_cmd *qc);
 static void mv_qc_prep_iie(struct ata_queued_cmd *qc);
 static unsigned int mv_qc_issue(struct ata_queued_cmd *qc);
@@ -527,6 +545,9 @@ static int mv_pmp_hardreset(struct ata_link *link, unsigned int *class,
                                 unsigned long deadline);
 static int  mv_softreset(struct ata_link *link, unsigned int *class,
                                 unsigned long deadline);
+static void mv_pmp_error_handler(struct ata_port *ap);
+static void mv_process_crpb_entries(struct ata_port *ap,
+                                        struct mv_port_priv *pp);
 
 /* .sg_tablesize is (MV_MAX_SG_CT / 2) in the structures below
  * because we have to allow room for worst case splitting of
@@ -548,6 +569,7 @@ static struct scsi_host_template mv6_sht = {
 static struct ata_port_operations mv5_ops = {
         .inherits               = &ata_sff_port_ops,
 
+        .qc_defer               = mv_qc_defer,
         .qc_prep                = mv_qc_prep,
         .qc_issue               = mv_qc_issue,
 
@@ -566,7 +588,6 @@ static struct ata_port_operations mv5_ops = {
 
 static struct ata_port_operations mv6_ops = {
         .inherits               = &mv5_ops,
-        .qc_defer               = sata_pmp_qc_defer_cmd_switch,
         .dev_config             = mv6_dev_config,
         .scr_read               = mv_scr_read,
         .scr_write              = mv_scr_write,
@@ -574,12 +595,11 @@ static struct ata_port_operations mv6_ops = {
         .pmp_hardreset          = mv_pmp_hardreset,
         .pmp_softreset          = mv_softreset,
         .softreset              = mv_softreset,
-        .error_handler          = sata_pmp_error_handler,
+        .error_handler          = mv_pmp_error_handler,
 };
 
 static struct ata_port_operations mv_iie_ops = {
         .inherits               = &mv6_ops,
-        .qc_defer               = ata_std_qc_defer, /* FIS-based switching */
         .dev_config             = ATA_OP_NULL,
         .qc_prep                = mv_qc_prep_iie,
 };
@@ -875,6 +895,29 @@ static void mv_start_dma(struct ata_port *ap, void __iomem *port_mmio,
         }
 }
 
+static void mv_wait_for_edma_empty_idle(struct ata_port *ap)
+{
+        void __iomem *port_mmio = mv_ap_base(ap);
+        const u32 empty_idle = (EDMA_STATUS_CACHE_EMPTY | EDMA_STATUS_IDLE);
+        const int per_loop = 5, timeout = (15 * 1000 / per_loop);
+        int i;
+
+        /*
+         * Wait for the EDMA engine to finish transactions in progress.
+         * No idea what a good "timeout" value might be, but measurements
+         * indicate that it often requires hundreds of microseconds
+         * with two drives in-use.  So we use the 15msec value above
+         * as a rough guess at what even more drives might require.
+         */
+        for (i = 0; i < timeout; ++i) {
+                u32 edma_stat = readl(port_mmio + EDMA_STATUS_OFS);
+                if ((edma_stat & empty_idle) == empty_idle)
+                        break;
+                udelay(per_loop);
+        }
+        /* ata_port_printk(ap, KERN_INFO, "%s: %u+ usecs\n", __func__, i); */
+}
+
 /**
  *      mv_stop_edma_engine - Disable eDMA engine
  *      @port_mmio: io base address
@@ -907,6 +950,7 @@ static int mv_stop_edma(struct ata_port *ap)
         if (!(pp->pp_flags & MV_PP_FLAG_EDMA_EN))
                 return 0;
         pp->pp_flags &= ~MV_PP_FLAG_EDMA_EN;
+        mv_wait_for_edma_empty_idle(ap);
         if (mv_stop_edma_engine(port_mmio)) {
                 ata_port_printk(ap, KERN_ERR, "Unable to stop eDMA\n");
                 return -EIO;
@@ -1057,26 +1101,95 @@ static void mv6_dev_config(struct ata_device *adev)
         }
 }
 
-static void mv_config_fbs(void __iomem *port_mmio, int enable_fbs)
+static int mv_qc_defer(struct ata_queued_cmd *qc)
 {
-        u32 old_fcfg, new_fcfg, old_ltmode, new_ltmode;
+        struct ata_link *link = qc->dev->link;
+        struct ata_port *ap = link->ap;
+        struct mv_port_priv *pp = ap->private_data;
+
+        /*
+         * Don't allow new commands if we're in a delayed EH state
+         * for NCQ and/or FIS-based switching.
+         */
+        if (pp->pp_flags & MV_PP_FLAG_DELAYED_EH)
+                return ATA_DEFER_PORT;
         /*
-         * Various bit settings required for operation
-         * in FIS-based switching (fbs) mode on GenIIe:
+         * If the port is completely idle, then allow the new qc.
          */
-        old_fcfg   = readl(port_mmio + FIS_CFG_OFS);
-        old_ltmode = readl(port_mmio + LTMODE_OFS);
-        if (enable_fbs) {
-                new_fcfg   = old_fcfg   |  FIS_CFG_SINGLE_SYNC;
-                new_ltmode = old_ltmode |  LTMODE_BIT8;
-        } else { /* disable fbs */
-                new_fcfg   = old_fcfg   & ~FIS_CFG_SINGLE_SYNC;
-                new_ltmode = old_ltmode & ~LTMODE_BIT8;
-        }
-        if (new_fcfg != old_fcfg)
-                writelfl(new_fcfg, port_mmio + FIS_CFG_OFS);
+        if (ap->nr_active_links == 0)
+                return 0;
+
+        if (pp->pp_flags & MV_PP_FLAG_EDMA_EN) {
+                /*
+                 * The port is operating in host queuing mode (EDMA).
+                 * It can accomodate a new qc if the qc protocol
+                 * is compatible with the current host queue mode.
+                 */
+                if (pp->pp_flags & MV_PP_FLAG_NCQ_EN) {
+                        /*
+                         * The host queue (EDMA) is in NCQ mode.
+                         * If the new qc is also an NCQ command,
+                         * then allow the new qc.
+                         */
+                        if (qc->tf.protocol == ATA_PROT_NCQ)
+                                return 0;
+                } else {
+                        /*
+                         * The host queue (EDMA) is in non-NCQ, DMA mode.
+                         * If the new qc is also a non-NCQ, DMA command,
+                         * then allow the new qc.
+                         */
+                        if (qc->tf.protocol == ATA_PROT_DMA)
+                                return 0;
+                }
+        }
+        return ATA_DEFER_PORT;
+}
+
+static void mv_config_fbs(void __iomem *port_mmio, int want_ncq, int want_fbs)
+{
+        u32 new_fiscfg, old_fiscfg;
+        u32 new_ltmode, old_ltmode;
+        u32 new_haltcond, old_haltcond;
+
+        old_fiscfg   = readl(port_mmio + FISCFG_OFS);
+        old_ltmode   = readl(port_mmio + LTMODE_OFS);
+        old_haltcond = readl(port_mmio + EDMA_HALTCOND_OFS);
+
+        new_fiscfg   = old_fiscfg & ~(FISCFG_SINGLE_SYNC | FISCFG_WAIT_DEV_ERR);
+        new_ltmode   = old_ltmode & ~LTMODE_BIT8;
+        new_haltcond = old_haltcond | EDMA_ERR_DEV;
+
+        if (want_fbs) {
+                new_fiscfg = old_fiscfg | FISCFG_SINGLE_SYNC;
+                new_ltmode = old_ltmode | LTMODE_BIT8;
+                if (want_ncq)
+                        new_haltcond &= ~EDMA_ERR_DEV;
+                else
+                        new_fiscfg |=  FISCFG_WAIT_DEV_ERR;
+        }
+
+        if (new_fiscfg != old_fiscfg)
+                writelfl(new_fiscfg, port_mmio + FISCFG_OFS);
         if (new_ltmode != old_ltmode)
                 writelfl(new_ltmode, port_mmio + LTMODE_OFS);
+        if (new_haltcond != old_haltcond)
+                writelfl(new_haltcond, port_mmio + EDMA_HALTCOND_OFS);
+}
+
+static void mv_60x1_errata_sata25(struct ata_port *ap, int want_ncq)
+{
+        struct mv_host_priv *hpriv = ap->host->private_data;
+        u32 old, new;
+
+        /* workaround for 88SX60x1 FEr SATA#25 (part 1) */
+        old = readl(hpriv->base + MV_GPIO_PORT_CTL_OFS);
+        if (want_ncq)
+                new = old | (1 << 22);
+        else
+                new = old & ~(1 << 22);
+        if (new != old)
+                writel(new, hpriv->base + MV_GPIO_PORT_CTL_OFS);
 }
 
 static void mv_edma_cfg(struct ata_port *ap, int want_ncq)
@@ -1088,25 +1201,40 @@ static void mv_edma_cfg(struct ata_port *ap, int want_ncq)
 
         /* set up non-NCQ EDMA configuration */
         cfg = EDMA_CFG_Q_DEPTH;         /* always 0x1f for *all* chips */
+        pp->pp_flags &= ~MV_PP_FLAG_FBS_EN;
 
         if (IS_GEN_I(hpriv))
                 cfg |= (1 << 8);        /* enab config burst size mask */
 
-        else if (IS_GEN_II(hpriv))
+        else if (IS_GEN_II(hpriv)) {
                 cfg |= EDMA_CFG_RD_BRST_EXT | EDMA_CFG_WR_BUFF_LEN;
+                mv_60x1_errata_sata25(ap, want_ncq);
 
-        else if (IS_GEN_IIE(hpriv)) {
-                cfg |= (1 << 23);       /* do not mask PM field in rx'd FIS */
-                cfg |= (1 << 22);       /* enab 4-entry host queue cache */
-                cfg |= (1 << 18);       /* enab early completion */
-                cfg |= (1 << 17);       /* enab cut-through (dis stor&forwrd) */
+        } else if (IS_GEN_IIE(hpriv)) {
+                int want_fbs = sata_pmp_attached(ap);
+                /*
+                 * Possible future enhancement:
+                 *
+                 * The chip can use FBS with non-NCQ, if we allow it,
+                 * But first we need to have the error handling in place
+                 * for this mode (datasheet section 7.3.15.4.2.3).
+                 * So disallow non-NCQ FBS for now.
+                 */
+                want_fbs &= want_ncq;
+
+                mv_config_fbs(port_mmio, want_ncq, want_fbs);
 
-                if (want_ncq && sata_pmp_attached(ap)) {
+                if (want_fbs) {
+                        pp->pp_flags |= MV_PP_FLAG_FBS_EN;
                         cfg |= EDMA_CFG_EDMA_FBS; /* FIS-based switching */
-                        mv_config_fbs(port_mmio, 1);
-                } else {
-                        mv_config_fbs(port_mmio, 0);
                 }
+
+                cfg |= (1 << 23);       /* do not mask PM field in rx'd FIS */
+                cfg |= (1 << 22);       /* enab 4-entry host queue cache */
+                if (HAS_PCI(ap->host))
+                        cfg |= (1 << 18);       /* enab early completion */
+                if (hpriv->hp_flags & MV_HP_CUT_THROUGH)
+                        cfg |= (1 << 17); /* enab cut-thru (dis stor&forwrd) */
         }
 
         if (want_ncq) {
@@ -1483,25 +1611,186 @@ static struct ata_queued_cmd *mv_get_active_qc(struct ata_port *ap)
         return qc;
 }
 
-static void mv_unexpected_intr(struct ata_port *ap)
+static void mv_pmp_error_handler(struct ata_port *ap)
 {
+        unsigned int pmp, pmp_map;
         struct mv_port_priv *pp = ap->private_data;
-        struct ata_eh_info *ehi = &ap->link.eh_info;
-        char *when = "";
 
+        if (pp->pp_flags & MV_PP_FLAG_DELAYED_EH) {
+                /*
+                 * Perform NCQ error analysis on failed PMPs
+                 * before we freeze the port entirely.
+                 *
+                 * The failed PMPs are marked earlier by mv_pmp_eh_prep().
+                 */
+                pmp_map = pp->delayed_eh_pmp_map;
+                pp->pp_flags &= ~MV_PP_FLAG_DELAYED_EH;
+                for (pmp = 0; pmp_map != 0; pmp++) {
+                        unsigned int this_pmp = (1 << pmp);
+                        if (pmp_map & this_pmp) {
+                                struct ata_link *link = &ap->pmp_link[pmp];
+                                pmp_map &= ~this_pmp;
+                                ata_eh_analyze_ncq_error(link);
+                        }
+                }
+                ata_port_freeze(ap);
+        }
+        sata_pmp_error_handler(ap);
+}
+
+static unsigned int mv_get_err_pmp_map(struct ata_port *ap)
+{
+        void __iomem *port_mmio = mv_ap_base(ap);
+
+        return readl(port_mmio + SATA_TESTCTL_OFS) >> 16;
+}
+
+static void mv_pmp_eh_prep(struct ata_port *ap, unsigned int pmp_map)
+{
+        struct ata_eh_info *ehi;
+        unsigned int pmp;
+
+        /*
+         * Initialize EH info for PMPs which saw device errors
+         */
+        ehi = &ap->link.eh_info;
+        for (pmp = 0; pmp_map != 0; pmp++) {
+                unsigned int this_pmp = (1 << pmp);
+                if (pmp_map & this_pmp) {
+                        struct ata_link *link = &ap->pmp_link[pmp];
+
+                        pmp_map &= ~this_pmp;
+                        ehi = &link->eh_info;
+                        ata_ehi_clear_desc(ehi);
+                        ata_ehi_push_desc(ehi, "dev err");
+                        ehi->err_mask |= AC_ERR_DEV;
+                        ehi->action |= ATA_EH_RESET;
+                        ata_link_abort(link);
+                }
+        }
+}
+
+static int mv_handle_fbs_ncq_dev_err(struct ata_port *ap)
+{
+        struct mv_port_priv *pp = ap->private_data;
+        int failed_links;
+        unsigned int old_map, new_map;
+
+        /*
+         * Device error during FBS+NCQ operation:
+         *
+         * Set a port flag to prevent further I/O being enqueued.
+         * Leave the EDMA running to drain outstanding commands from this port.
+         * Perform the post-mortem/EH only when all responses are complete.
+         * Follow recovery sequence from 6042/7042 datasheet (7.3.15.4.2.2).
+         */
+        if (!(pp->pp_flags & MV_PP_FLAG_DELAYED_EH)) {
+                pp->pp_flags |= MV_PP_FLAG_DELAYED_EH;
+                pp->delayed_eh_pmp_map = 0;
+        }
+        old_map = pp->delayed_eh_pmp_map;
+        new_map = old_map | mv_get_err_pmp_map(ap);
+
+        if (old_map != new_map) {
+                pp->delayed_eh_pmp_map = new_map;
+                mv_pmp_eh_prep(ap, new_map & ~old_map);
+        }
+        failed_links = hweight16(new_map);
+
+        ata_port_printk(ap, KERN_INFO, "%s: pmp_map=%04x qc_map=%04x "
+                        "failed_links=%d nr_active_links=%d\n",
+                        __func__, pp->delayed_eh_pmp_map,
+                        ap->qc_active, failed_links,
+                        ap->nr_active_links);
+
+        if (ap->nr_active_links <= failed_links) {
+                mv_process_crpb_entries(ap, pp);
+                mv_stop_edma(ap);
+                mv_eh_freeze(ap);
+                ata_port_printk(ap, KERN_INFO, "%s: done\n", __func__);
+                return 1;       /* handled */
+        }
+        ata_port_printk(ap, KERN_INFO, "%s: waiting\n", __func__);
+        return 1;       /* handled */
+}
+
+static int mv_handle_fbs_non_ncq_dev_err(struct ata_port *ap)
+{
         /*
-         * We got a device interrupt from something that
-         * was supposed to be using EDMA or polling.
+         * Possible future enhancement:
+         *
+         * FBS+non-NCQ operation is not yet implemented.
+         * See related notes in mv_edma_cfg().
+         *
+         * Device error during FBS+non-NCQ operation:
+         *
+         * We need to snapshot the shadow registers for each failed command.
+         * Follow recovery sequence from 6042/7042 datasheet (7.3.15.4.2.3).
          */
+        return 0;       /* not handled */
+}
+
+static int mv_handle_dev_err(struct ata_port *ap, u32 edma_err_cause)
+{
+        struct mv_port_priv *pp = ap->private_data;
+
+        if (!(pp->pp_flags & MV_PP_FLAG_EDMA_EN))
+                return 0;       /* EDMA was not active: not handled */
+        if (!(pp->pp_flags & MV_PP_FLAG_FBS_EN))
+                return 0;       /* FBS was not active: not handled */
+
+        if (!(edma_err_cause & EDMA_ERR_DEV))
+                return 0;       /* non DEV error: not handled */
+        edma_err_cause &= ~EDMA_ERR_IRQ_TRANSIENT;
+        if (edma_err_cause & ~(EDMA_ERR_DEV | EDMA_ERR_SELF_DIS))
+                return 0;       /* other problems: not handled */
+
+        if (pp->pp_flags & MV_PP_FLAG_NCQ_EN) {
+                /*
+                 * EDMA should NOT have self-disabled for this case.
+                 * If it did, then something is wrong elsewhere,
+                 * and we cannot handle it here.
+                 */
+                if (edma_err_cause & EDMA_ERR_SELF_DIS) {
+                        ata_port_printk(ap, KERN_WARNING,
+                                "%s: err_cause=0x%x pp_flags=0x%x\n",
+                                __func__, edma_err_cause, pp->pp_flags);
+                        return 0; /* not handled */
+                }
+                return mv_handle_fbs_ncq_dev_err(ap);
+        } else {
+                /*
+                 * EDMA should have self-disabled for this case.
+                 * If it did not, then something is wrong elsewhere,
+                 * and we cannot handle it here.
+                 */
+                if (!(edma_err_cause & EDMA_ERR_SELF_DIS)) {
+                        ata_port_printk(ap, KERN_WARNING,
+                                "%s: err_cause=0x%x pp_flags=0x%x\n",
+                                __func__, edma_err_cause, pp->pp_flags);
+                        return 0; /* not handled */
+                }
+                return mv_handle_fbs_non_ncq_dev_err(ap);
+        }
+        return 0;       /* not handled */
+}
+
+static void mv_unexpected_intr(struct ata_port *ap, int edma_was_enabled)
+{
+        struct ata_eh_info *ehi = &ap->link.eh_info;
+        char *when = "idle";
+
         ata_ehi_clear_desc(ehi);
-        if (pp->pp_flags & MV_PP_FLAG_EDMA_EN) {
-                when = " while EDMA enabled";
+        if (!ap || (ap->flags & ATA_FLAG_DISABLED)) {
+                when = "disabled";
+        } else if (edma_was_enabled) {
+                when = "EDMA enabled";
         } else {
                 struct ata_queued_cmd *qc = ata_qc_from_tag(ap, ap->link.active_tag);
                 if (qc && (qc->tf.flags & ATA_TFLAG_POLLING))
-                        when = " while polling";
+                        when = "polling";
         }
-        ata_ehi_push_desc(ehi, "unexpected device interrupt%s", when);
+        ata_ehi_push_desc(ehi, "unexpected device interrupt while %s", when);
         ehi->err_mask |= AC_ERR_OTHER;
         ehi->action   |= ATA_EH_RESET;
         ata_port_freeze(ap);
@@ -1519,7 +1808,7 @@ static void mv_unexpected_intr(struct ata_port *ap)
  *      LOCKING:
  *      Inherited from caller.
  */
-static void mv_err_intr(struct ata_port *ap, struct ata_queued_cmd *qc)
+static void mv_err_intr(struct ata_port *ap)
 {
         void __iomem *port_mmio = mv_ap_base(ap);
         u32 edma_err_cause, eh_freeze_mask, serr = 0;
@@ -1527,24 +1816,42 @@ static void mv_err_intr(struct ata_port *ap, struct ata_queued_cmd *qc)
         struct mv_host_priv *hpriv = ap->host->private_data;
         unsigned int action = 0, err_mask = 0;
         struct ata_eh_info *ehi = &ap->link.eh_info;
-
-        ata_ehi_clear_desc(ehi);
+        struct ata_queued_cmd *qc;
+        int abort = 0;
 
         /*
-         * Read and clear the err_cause bits.  This won't actually
-         * clear for some errors (eg. SError), but we will be doing
-         * a hard reset in those cases regardless, which *will* clear it.
+         * Read and clear the SError and err_cause bits.
          */
+        sata_scr_read(&ap->link, SCR_ERROR, &serr);
+        sata_scr_write_flush(&ap->link, SCR_ERROR, serr);
+
         edma_err_cause = readl(port_mmio + EDMA_ERR_IRQ_CAUSE_OFS);
         writelfl(~edma_err_cause, port_mmio + EDMA_ERR_IRQ_CAUSE_OFS);
 
-        ata_ehi_push_desc(ehi, "edma_err_cause=%08x", edma_err_cause);
+        ata_port_printk(ap, KERN_INFO, "%s: err_cause=%08x pp_flags=0x%x\n",
+                        __func__, edma_err_cause, pp->pp_flags);
+
+        if (edma_err_cause & EDMA_ERR_DEV) {
+                /*
+                 * Device errors during FIS-based switching operation
+                 * require special handling.
+                 */
+                if (mv_handle_dev_err(ap, edma_err_cause))
+                        return;
+        }
 
+        qc = mv_get_active_qc(ap);
+        ata_ehi_clear_desc(ehi);
+        ata_ehi_push_desc(ehi, "edma_err_cause=%08x pp_flags=%08x",
+                          edma_err_cause, pp->pp_flags);
         /*
          * All generations share these EDMA error cause bits:
          */
-        if (edma_err_cause & EDMA_ERR_DEV)
+        if (edma_err_cause & EDMA_ERR_DEV) {
                 err_mask |= AC_ERR_DEV;
+                action |= ATA_EH_RESET;
+                ata_ehi_push_desc(ehi, "dev error");
+        }
         if (edma_err_cause & (EDMA_ERR_D_PAR | EDMA_ERR_PRD_PAR |
                         EDMA_ERR_CRQB_PAR | EDMA_ERR_CRPB_PAR |
                         EDMA_ERR_INTRL_PAR)) {
@@ -1576,13 +1883,6 @@ static void mv_err_intr(struct ata_port *ap, struct ata_queued_cmd *qc)
                         ata_ehi_push_desc(ehi, "EDMA self-disable");
                 }
                 if (edma_err_cause & EDMA_ERR_SERR) {
-                        /*
-                         * Ensure that we read our own SCR, not a pmp link SCR:
-                         */
-                        ap->ops->scr_read(ap, SCR_ERROR, &serr);
-                        /*
-                         * Don't clear SError here; leave it for libata-eh:
-                         */
                         ata_ehi_push_desc(ehi, "SError=%08x", serr);
                         err_mask |= AC_ERR_ATA_BUS;
                         action |= ATA_EH_RESET;
@@ -1602,10 +1902,29 @@ static void mv_err_intr(struct ata_port *ap, struct ata_queued_cmd *qc)
         else
                 ehi->err_mask |= err_mask;
 
-        if (edma_err_cause & eh_freeze_mask)
+        if (err_mask == AC_ERR_DEV) {
+                /*
+                 * Cannot do ata_port_freeze() here,
+                 * because it would kill PIO access,
+                 * which is needed for further diagnosis.
+                 */
+                mv_eh_freeze(ap);
+                abort = 1;
+        } else if (edma_err_cause & eh_freeze_mask) {
+                /*
+                 * Note to self: ata_port_freeze() calls ata_port_abort()
+                 */
                 ata_port_freeze(ap);
-        else
-                ata_port_abort(ap);
+        } else {
+                abort = 1;
+        }
+
+        if (abort) {
+                if (qc)
+                        ata_link_abort(qc->dev->link);
+                else
+                        ata_port_abort(ap);
+        }
 }
 
 static void mv_process_crpb_response(struct ata_port *ap,
@@ -1632,8 +1951,9 @@ static void mv_process_crpb_response(struct ata_port *ap,
                         }
                 }
                 ata_status = edma_status >> CRPB_FLAG_STATUS_SHIFT;
-                qc->err_mask |= ac_err_mask(ata_status);
-                ata_qc_complete(qc);
+                if (!ac_err_mask(ata_status))
+                        ata_qc_complete(qc);
+                /* else: leave it for mv_err_intr() */
         } else {
                 ata_port_printk(ap, KERN_ERR, "%s: no qc for tag=%d\n",
                                 __func__, tag);
@@ -1677,6 +1997,44 @@ static void mv_process_crpb_entries(struct ata_port *ap, struct mv_port_priv *pp
                          port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
 }
 
+static void mv_port_intr(struct ata_port *ap, u32 port_cause)
+{
+        struct mv_port_priv *pp;
+        int edma_was_enabled;
+
+        if (!ap || (ap->flags & ATA_FLAG_DISABLED)) {
+                mv_unexpected_intr(ap, 0);
+                return;
+        }
+        /*
+         * Grab a snapshot of the EDMA_EN flag setting,
+         * so that we have a consistent view for this port,
+         * even if something we call of our routines changes it.
+         */
+        pp = ap->private_data;
+        edma_was_enabled = (pp->pp_flags & MV_PP_FLAG_EDMA_EN);
+        /*
+         * Process completed CRPB response(s) before other events.
+         */
+        if (edma_was_enabled && (port_cause & DONE_IRQ)) {
+                mv_process_crpb_entries(ap, pp);
+                if (pp->pp_flags & MV_PP_FLAG_DELAYED_EH)
+                        mv_handle_fbs_ncq_dev_err(ap);
+        }
+        /*
+         * Handle chip-reported errors, or continue on to handle PIO.
+         */
+        if (unlikely(port_cause & ERR_IRQ)) {
+                mv_err_intr(ap);
+        } else if (!edma_was_enabled) {
+                struct ata_queued_cmd *qc = mv_get_active_qc(ap);
+                if (qc)
+                        ata_sff_host_intr(ap, qc);
+                else
+                        mv_unexpected_intr(ap, edma_was_enabled);
+        }
+}
+
 /**
  *      mv_host_intr - Handle all interrupts on the given host controller
  *      @host: host specific structure
@@ -1688,66 +2046,58 @@ static void mv_process_crpb_entries(struct ata_port *ap, struct mv_port_priv *pp
 static int mv_host_intr(struct ata_host *host, u32 main_irq_cause)
 {
         struct mv_host_priv *hpriv = host->private_data;
-        void __iomem *mmio = hpriv->base, *hc_mmio = NULL;
-        u32 hc_irq_cause = 0;
+        void __iomem *mmio = hpriv->base, *hc_mmio;
         unsigned int handled = 0, port;
 
         for (port = 0; port < hpriv->n_ports; port++) {
                 struct ata_port *ap = host->ports[port];
-                struct mv_port_priv *pp;
-                unsigned int shift, hardport, port_cause;
-                /*
-                 * When we move to the second hc, flag our cached
-                 * copies of hc_mmio (and hc_irq_cause) as invalid again.
-                 */
-                if (port == MV_PORTS_PER_HC)
-                        hc_mmio = NULL;
-                /*
-                 * Do nothing if port is not interrupting or is disabled:
-                 */
+                unsigned int p, shift, hardport, port_cause;
+
                 MV_PORT_TO_SHIFT_AND_HARDPORT(port, shift, hardport);
-                port_cause = (main_irq_cause >> shift) & (DONE_IRQ | ERR_IRQ);
-                if (!port_cause || !ap || (ap->flags & ATA_FLAG_DISABLED))
-                        continue;
                 /*
-                 * Each hc within the host has its own hc_irq_cause register.
-                 * We defer reading it until we know we need it, right now:
-                 *
-                 * FIXME later: we don't really need to read this register
-                 * (some logic changes required below if we go that way),
-                 * because it doesn't tell us anything new.  But we do need
-                 * to write to it, outside the top of this loop,
-                 * to reset the interrupt triggers for next time.
+                 * Each hc within the host has its own hc_irq_cause register,
+                 * where the interrupting ports bits get ack'd.
                  */
-                if (!hc_mmio) {
+                if (hardport == 0) {    /* first port on this hc ? */
+                        u32 hc_cause = (main_irq_cause >> shift) & HC0_IRQ_PEND;
+                        u32 port_mask, ack_irqs;
+                        /*
+                         * Skip this entire hc if nothing pending for any ports
+                         */
+                        if (!hc_cause) {
+                                port += MV_PORTS_PER_HC - 1;
+                                continue;
+                        }
+                        /*
+                         * We don't need/want to read the hc_irq_cause register,
+                         * because doing so hurts performance, and
+                         * main_irq_cause already gives us everything we need.
+                         *
+                         * But we do have to *write* to the hc_irq_cause to ack
+                         * the ports that we are handling this time through.
+                         *
+                         * This requires that we create a bitmap for those
+                         * ports which interrupted us, and use that bitmap
+                         * to ack (only) those ports via hc_irq_cause.
+                         */
+                        ack_irqs = 0;
+                        for (p = 0; p < MV_PORTS_PER_HC; ++p) {
+                                if ((port + p) >= hpriv->n_ports)
+                                        break;
+                                port_mask = (DONE_IRQ | ERR_IRQ) << (p * 2);
+                                if (hc_cause & port_mask)
+                                        ack_irqs |= (DMA_IRQ | DEV_IRQ) << p;
+                        }
                         hc_mmio = mv_hc_base_from_port(mmio, port);
-                        hc_irq_cause = readl(hc_mmio + HC_IRQ_CAUSE_OFS);
-                        writelfl(~hc_irq_cause, hc_mmio + HC_IRQ_CAUSE_OFS);
+                        writelfl(~ack_irqs, hc_mmio + HC_IRQ_CAUSE_OFS);
                         handled = 1;
                 }
                 /*
-                 * Process completed CRPB response(s) before other events.
-                 */
-                pp = ap->private_data;
-                if (hc_irq_cause & (DMA_IRQ << hardport)) {
-                        if (pp->pp_flags & MV_PP_FLAG_EDMA_EN)
-                                mv_process_crpb_entries(ap, pp);
-                }
-                /*
-                 * Handle chip-reported errors, or continue on to handle PIO.
+                 * Handle interrupts signalled for this port:
                  */
-                if (unlikely(port_cause & ERR_IRQ)) {
-                        mv_err_intr(ap, mv_get_active_qc(ap));
-                } else if (hc_irq_cause & (DEV_IRQ << hardport)) {
-                        if (!(pp->pp_flags & MV_PP_FLAG_EDMA_EN)) {
-                                struct ata_queued_cmd *qc = mv_get_active_qc(ap);
-                                if (qc) {
-                                        ata_sff_host_intr(ap, qc);
-                                        continue;
-                                }
-                        }
-                        mv_unexpected_intr(ap);
-                }
+                port_cause = (main_irq_cause >> shift) & (DONE_IRQ | ERR_IRQ);
+                if (port_cause)
+                        mv_port_intr(ap, port_cause);
         }
         return handled;
 }
@@ -1894,7 +2244,7 @@ static void mv5_reset_bus(struct ata_host *host, void __iomem *mmio)
 
 static void mv5_reset_flash(struct mv_host_priv *hpriv, void __iomem *mmio)
 {
-        writel(0x0fcfffff, mmio + MV_FLASH_CTL);
+        writel(0x0fcfffff, mmio + MV_FLASH_CTL_OFS);
 }
 
 static void mv5_read_preamp(struct mv_host_priv *hpriv, int idx,
@@ -1913,7 +2263,7 @@ static void mv5_enable_leds(struct mv_host_priv *hpriv, void __iomem *mmio)
 {
         u32 tmp;
 
-        writel(0, mmio + MV_GPIO_PORT_CTL);
+        writel(0, mmio + MV_GPIO_PORT_CTL_OFS);
 
         /* FIXME: handle MV_HP_ERRATA_50XXB2 errata */
 
@@ -1931,14 +2281,14 @@ static void mv5_phy_errata(struct mv_host_priv *hpriv, void __iomem *mmio,
         int fix_apm_sq = (hpriv->hp_flags & MV_HP_ERRATA_50XXB0);
 
         if (fix_apm_sq) {
-                tmp = readl(phy_mmio + MV5_LT_MODE);
+                tmp = readl(phy_mmio + MV5_LTMODE_OFS);
                 tmp |= (1 << 19);
-                writel(tmp, phy_mmio + MV5_LT_MODE);
+                writel(tmp, phy_mmio + MV5_LTMODE_OFS);
 
-                tmp = readl(phy_mmio + MV5_PHY_CTL);
+                tmp = readl(phy_mmio + MV5_PHY_CTL_OFS);
                 tmp &= ~0x3;
                 tmp |= 0x1;
-                writel(tmp, phy_mmio + MV5_PHY_CTL);
+                writel(tmp, phy_mmio + MV5_PHY_CTL_OFS);
         }
 
         tmp = readl(phy_mmio + MV5_PHY_MODE);
@@ -1956,11 +2306,6 @@ static void mv5_reset_hc_port(struct mv_host_priv *hpriv, void __iomem *mmio,
 {
         void __iomem *port_mmio = mv_port_base(mmio, port);
 
-        /*
-         * The datasheet warns against setting ATA_RST when EDMA is active
-         * (but doesn't say what the problem might be).  So we first try
-         * to disable the EDMA engine before doing the ATA_RST operation.
-         */
         mv_reset_channel(hpriv, mmio, port);
 
         ZERO(0x028);    /* command */
@@ -1975,7 +2320,7 @@ static void mv5_reset_hc_port(struct mv_host_priv *hpriv, void __iomem *mmio,
         ZERO(0x024);    /* respq outp */
         ZERO(0x020);    /* respq inp */
         ZERO(0x02c);    /* test control */
-        writel(0xbc, port_mmio + EDMA_IORDY_TMOUT);
+        writel(0xbc, port_mmio + EDMA_IORDY_TMOUT_OFS);
 }
 #undef ZERO
 
@@ -2021,13 +2366,13 @@ static void mv_reset_pci_bus(struct ata_host *host, void __iomem *mmio)
         struct mv_host_priv *hpriv = host->private_data;
         u32 tmp;
 
-        tmp = readl(mmio + MV_PCI_MODE);
+        tmp = readl(mmio + MV_PCI_MODE_OFS);
         tmp &= 0xff00ffff;
-        writel(tmp, mmio + MV_PCI_MODE);
+        writel(tmp, mmio + MV_PCI_MODE_OFS);
 
         ZERO(MV_PCI_DISC_TIMER);
         ZERO(MV_PCI_MSI_TRIGGER);
-        writel(0x000100ff, mmio + MV_PCI_XBAR_TMOUT);
+        writel(0x000100ff, mmio + MV_PCI_XBAR_TMOUT_OFS);
         ZERO(PCI_HC_MAIN_IRQ_MASK_OFS);
         ZERO(MV_PCI_SERR_MASK);
         ZERO(hpriv->irq_cause_ofs);
@@ -2045,10 +2390,10 @@ static void mv6_reset_flash(struct mv_host_priv *hpriv, void __iomem *mmio)
 
         mv5_reset_flash(hpriv, mmio);
 
-        tmp = readl(mmio + MV_GPIO_PORT_CTL);
+        tmp = readl(mmio + MV_GPIO_PORT_CTL_OFS);
         tmp &= 0x3;
         tmp |= (1 << 5) | (1 << 6);
-        writel(tmp, mmio + MV_GPIO_PORT_CTL);
+        writel(tmp, mmio + MV_GPIO_PORT_CTL_OFS);
 }
 
 /**
@@ -2121,7 +2466,7 @@ static void mv6_read_preamp(struct mv_host_priv *hpriv, int idx,
         void __iomem *port_mmio;
         u32 tmp;
 
-        tmp = readl(mmio + MV_RESET_CFG);
+        tmp = readl(mmio + MV_RESET_CFG_OFS);
         if ((tmp & (1 << 0)) == 0) {
                 hpriv->signal[idx].amps = 0x7 << 8;
                 hpriv->signal[idx].pre = 0x1 << 5;
@@ -2137,7 +2482,7 @@ static void mv6_read_preamp(struct mv_host_priv *hpriv, int idx,
 
 static void mv6_enable_leds(struct mv_host_priv *hpriv, void __iomem *mmio)
 {
-        writel(0x00000060, mmio + MV_GPIO_PORT_CTL);
+        writel(0x00000060, mmio + MV_GPIO_PORT_CTL_OFS);
 }
 
 static void mv6_phy_errata(struct mv_host_priv *hpriv, void __iomem *mmio,
@@ -2235,11 +2580,6 @@ static void mv_soc_reset_hc_port(struct mv_host_priv *hpriv,
 {
         void __iomem *port_mmio = mv_port_base(mmio, port);
 
-        /*
-         * The datasheet warns against setting ATA_RST when EDMA is active
-         * (but doesn't say what the problem might be).  So we first try
-         * to disable the EDMA engine before doing the ATA_RST operation.
-         */
         mv_reset_channel(hpriv, mmio, port);
 
         ZERO(0x028);            /* command */
@@ -2254,7 +2594,7 @@ static void mv_soc_reset_hc_port(struct mv_host_priv *hpriv,
         ZERO(0x024);            /* respq outp */
         ZERO(0x020);            /* respq inp */
         ZERO(0x02c);            /* test control */
-        writel(0xbc, port_mmio + EDMA_IORDY_TMOUT);
+        writel(0xbc, port_mmio + EDMA_IORDY_TMOUT_OFS);
 }
 
 #undef ZERO
@@ -2297,38 +2637,39 @@ static void mv_soc_reset_bus(struct ata_host *host, void __iomem *mmio)
         return;
 }
 
-static void mv_setup_ifctl(void __iomem *port_mmio, int want_gen2i)
+static void mv_setup_ifcfg(void __iomem *port_mmio, int want_gen2i)
 {
-        u32 ifctl = readl(port_mmio + SATA_INTERFACE_CFG);
+        u32 ifcfg = readl(port_mmio + SATA_INTERFACE_CFG_OFS);
 
-        ifctl = (ifctl & 0xf7f) | 0x9b1000;     /* from chip spec */
+        ifcfg = (ifcfg & 0xf7f) | 0x9b1000;     /* from chip spec */
         if (want_gen2i)
-                ifctl |= (1 << 7);              /* enable gen2i speed */
-        writelfl(ifctl, port_mmio + SATA_INTERFACE_CFG);
+                ifcfg |= (1 << 7);              /* enable gen2i speed */
+        writelfl(ifcfg, port_mmio + SATA_INTERFACE_CFG_OFS);
 }
 
-/*
- * Caller must ensure that EDMA is not active,
- * by first doing mv_stop_edma() where needed.
- */
 static void mv_reset_channel(struct mv_host_priv *hpriv, void __iomem *mmio,
                              unsigned int port_no)
 {
         void __iomem *port_mmio = mv_port_base(mmio, port_no);
 
+        /*
+         * The datasheet warns against setting EDMA_RESET when EDMA is active
+         * (but doesn't say what the problem might be).  So we first try
+         * to disable the EDMA engine before doing the EDMA_RESET operation.
+         */
         mv_stop_edma_engine(port_mmio);
-        writelfl(ATA_RST, port_mmio + EDMA_CMD_OFS);
+        writelfl(EDMA_RESET, port_mmio + EDMA_CMD_OFS);
 
         if (!IS_GEN_I(hpriv)) {
-                /* Enable 3.0gb/s link speed */
-                mv_setup_ifctl(port_mmio, 1);
+                /* Enable 3.0gb/s link speed: this survives EDMA_RESET */
+                mv_setup_ifcfg(port_mmio, 1);
         }
         /*
-         * Strobing ATA_RST here causes a hard reset of the SATA transport,
+         * Strobing EDMA_RESET here causes a hard reset of the SATA transport,
          * link, and physical layers.  It resets all SATA interface registers
          * (except for SATA_INTERFACE_CFG), and issues a COMRESET to the dev.
          */
-        writelfl(ATA_RST, port_mmio + EDMA_CMD_OFS);
+        writelfl(EDMA_RESET, port_mmio + EDMA_CMD_OFS);
         udelay(25);     /* allow reset propagation */
         writelfl(0, port_mmio + EDMA_CMD_OFS);
 
@@ -2392,7 +2733,7 @@ static int mv_hardreset(struct ata_link *link, unsigned int *class,
                 sata_scr_read(link, SCR_STATUS, &sstatus);
                 if (!IS_GEN_I(hpriv) && ++attempts >= 5 && sstatus == 0x121) {
                         /* Force 1.5gb/s link speed and try again */
-                        mv_setup_ifctl(mv_ap_base(ap), 0);
+                        mv_setup_ifcfg(mv_ap_base(ap), 0);
                         if (time_after(jiffies + HZ, deadline))
                                 extra = HZ; /* only extend it once, max */
                 }
@@ -2493,6 +2834,34 @@ static void mv_port_init(struct ata_ioports *port,  void __iomem *port_mmio)
                 readl(port_mmio + EDMA_ERR_IRQ_MASK_OFS));
 }
 
+static unsigned int mv_in_pcix_mode(struct ata_host *host)
+{
+        struct mv_host_priv *hpriv = host->private_data;
+        void __iomem *mmio = hpriv->base;
+        u32 reg;
+
+        if (!HAS_PCI(host) || !IS_PCIE(hpriv))
+                return 0;       /* not PCI-X capable */
+        reg = readl(mmio + MV_PCI_MODE_OFS);
+        if ((reg & MV_PCI_MODE_MASK) == 0)
+                return 0;       /* conventional PCI mode */
+        return 1;       /* chip is in PCI-X mode */
+}
+
+static int mv_pci_cut_through_okay(struct ata_host *host)
+{
+        struct mv_host_priv *hpriv = host->private_data;
+        void __iomem *mmio = hpriv->base;
+        u32 reg;
+
+        if (!mv_in_pcix_mode(host)) {
+                reg = readl(mmio + PCI_COMMAND_OFS);
+                if (reg & PCI_COMMAND_MRDTRIG)
+                        return 0; /* not okay */
+        }
+        return 1; /* okay */
+}
+
 static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
 {
         struct pci_dev *pdev = to_pci_dev(host->dev);
@@ -2560,7 +2929,7 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
                 break;
 
         case chip_7042:
-                hp_flags |= MV_HP_PCIE;
+                hp_flags |= MV_HP_PCIE | MV_HP_CUT_THROUGH;
                 if (pdev->vendor == PCI_VENDOR_ID_TTI &&
                     (pdev->device == 0x2300 || pdev->device == 0x2310))
                 {
@@ -2590,9 +2959,12 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
                                 " and avoid the final two gigabytes on"
                                 " all RocketRAID BIOS initialized drives.\n");
                 }
+                /* drop through */
         case chip_6042:
                 hpriv->ops = &mv6xxx_ops;
                 hp_flags |= MV_HP_GEN_IIE;
+                if (board_idx == chip_6042 && mv_pci_cut_through_okay(host))
+                        hp_flags |= MV_HP_CUT_THROUGH;
 
                 switch (pdev->revision) {
                 case 0x0:
diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
index 6fe41742997..e38dfed41d8 100644
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -18,7 +18,7 @@ struct sysdev_class cpu_sysdev_class = {
 };
 EXPORT_SYMBOL(cpu_sysdev_class);
 
-static struct sys_device *cpu_sys_devices[NR_CPUS];
+static DEFINE_PER_CPU(struct sys_device *, cpu_sys_devices);
 
 #ifdef CONFIG_HOTPLUG_CPU
 static ssize_t show_online(struct sys_device *dev, char *buf)
@@ -68,7 +68,7 @@ void unregister_cpu(struct cpu *cpu)
         sysdev_remove_file(&cpu->sysdev, &attr_online);
 
         sysdev_unregister(&cpu->sysdev);
-        cpu_sys_devices[logical_cpu] = NULL;
+        per_cpu(cpu_sys_devices, logical_cpu) = NULL;
         return;
 }
 #else /* ... !CONFIG_HOTPLUG_CPU */
@@ -167,7 +167,7 @@ int __cpuinit register_cpu(struct cpu *cpu, int num)
         if (!error && cpu->hotpluggable)
                 register_cpu_control(cpu);
         if (!error)
-                cpu_sys_devices[num] = &cpu->sysdev;
+                per_cpu(cpu_sys_devices, num) = &cpu->sysdev;
         if (!error)
                 register_cpu_under_node(num, cpu_to_node(num));
 
@@ -180,8 +180,8 @@ int __cpuinit register_cpu(struct cpu *cpu, int num)
 
 struct sys_device *get_cpu_sysdev(unsigned cpu)
 {
-        if (cpu < NR_CPUS)
-                return cpu_sys_devices[cpu];
+        if (cpu < nr_cpu_ids && cpu_possible(cpu))
+                return per_cpu(cpu_sys_devices, cpu);
         else
                 return NULL;
 }
diff --git a/drivers/base/sys.c b/drivers/base/sys.c
index 4fbb56bcb1e..358bb0be3c0 100644
--- a/drivers/base/sys.c
+++ b/drivers/base/sys.c
@@ -175,8 +175,7 @@ int sysdev_driver_register(struct sysdev_class *cls, struct sysdev_driver *drv)
         }
 
         /* Check whether this driver has already been added to a class. */
-        if ((drv->entry.next != drv->entry.prev) ||
-            (drv->entry.next != NULL)) {
+        if (drv->entry.next && !list_empty(&drv->entry)) {
                 printk(KERN_WARNING "sysdev: class %s: driver (%p) has already"
                         " been registered to a class, something is wrong, but "
                         "will forge on!\n", cls->name, drv);
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 8fc429cf82b..41f818be2f7 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -755,11 +755,13 @@ diskstats(struct gendisk *disk, struct bio *bio, ulong duration, sector_t sector
 {
         unsigned long n_sect = bio->bi_size >> 9;
         const int rw = bio_data_dir(bio);
+        struct hd_struct *part;
 
-        all_stat_inc(disk, ios[rw], sector);
-        all_stat_add(disk, ticks[rw], duration, sector);
-        all_stat_add(disk, sectors[rw], n_sect, sector);
-        all_stat_add(disk, io_ticks, duration, sector);
+        part = get_part(disk, sector);
+        all_stat_inc(disk, part, ios[rw], sector);
+        all_stat_add(disk, part, ticks[rw], duration, sector);
+        all_stat_add(disk, part, sectors[rw], n_sect, sector);
+        all_stat_add(disk, part, io_ticks, duration, sector);
 }
 
 void
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index e539be5750d..e336b05fe4a 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -428,13 +428,9 @@ static void __devinit cciss_procinit(int i)
                 proc_cciss = proc_mkdir("driver/cciss", NULL);
         if (!proc_cciss)
                 return;
-        pde = proc_create(hba[i]->devname, S_IWUSR | S_IRUSR | S_IRGRP |
+        pde = proc_create_data(hba[i]->devname, S_IWUSR | S_IRUSR | S_IRGRP |
                                         S_IROTH, proc_cciss,
-                                        &cciss_proc_fops);
-        if (!pde)
-                return;
-
-        pde->data = hba[i];
+                                        &cciss_proc_fops, hba[i]);
 }
 #endif                          /* CONFIG_PROC_FS */
 
diff --git a/drivers/block/ub.c b/drivers/block/ub.c
index e322cce8c12..3a281ef11ff 100644
--- a/drivers/block/ub.c
+++ b/drivers/block/ub.c
@@ -205,6 +205,7 @@ struct ub_scsi_cmd {
         unsigned char key, asc, ascq;   /* May be valid if error==-EIO */
 
         int stat_count;                 /* Retries getting status. */
+        unsigned int timeo;             /* jiffies until rq->timeout changes */
 
         unsigned int len;               /* Requested length */
         unsigned int current_sg;
@@ -318,6 +319,7 @@ struct ub_dev {
         int openc;                      /* protected by ub_lock! */
                                         /* kref is too implicit for our taste */
         int reset;                      /* Reset is running */
+        int bad_resid;
         unsigned int tagcnt;
         char name[12];
         struct usb_device *dev;
@@ -764,6 +766,12 @@ static void ub_cmd_build_packet(struct ub_dev *sc, struct ub_lun *lun,
         cmd->cdb_len = rq->cmd_len;
 
         cmd->len = rq->data_len;
+
+        /*
+         * To reapply this to every URB is not as incorrect as it looks.
+         * In return, we avoid any complicated tracking calculations.
+         */
+        cmd->timeo = rq->timeout;
 }
 
 static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
@@ -785,10 +793,6 @@ static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                         scsi_status = 0;
                 } else {
                         if (cmd->act_len != cmd->len) {
-                                if ((cmd->key == MEDIUM_ERROR ||
-                                     cmd->key == UNIT_ATTENTION) &&
-                                    ub_rw_cmd_retry(sc, lun, urq, cmd) == 0)
-                                        return;
                                 scsi_status = SAM_STAT_CHECK_CONDITION;
                         } else {
                                 scsi_status = 0;
@@ -804,7 +808,10 @@ static void ub_rw_cmd_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                         else
                                 scsi_status = DID_ERROR << 16;
                 } else {
-                        if (cmd->error == -EIO) {
+                        if (cmd->error == -EIO &&
+                            (cmd->key == 0 ||
+                             cmd->key == MEDIUM_ERROR ||
+                             cmd->key == UNIT_ATTENTION)) {
                                 if (ub_rw_cmd_retry(sc, lun, urq, cmd) == 0)
                                         return;
                         }
@@ -1259,14 +1266,19 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                         return;
                 }
 
-                len = le32_to_cpu(bcs->Residue);
-                if (len != cmd->len - cmd->act_len) {
-                        /*
-                         * It is all right to transfer less, the caller has
-                         * to check. But it's not all right if the device
-                         * counts disagree with our counts.
-                         */
-                        goto Bad_End;
+                if (!sc->bad_resid) {
+                        len = le32_to_cpu(bcs->Residue);
+                        if (len != cmd->len - cmd->act_len) {
+                                /*
+                                 * Only start ignoring if this cmd ended well.
+                                 */
+                                if (cmd->len == cmd->act_len) {
+                                        printk(KERN_NOTICE "%s: "
+                                            "bad residual %d of %d, ignoring\n",
+                                            sc->name, len, cmd->len);
+                                        sc->bad_resid = 1;
+                                }
+                        }
                 }
 
                 switch (bcs->Status) {
@@ -1297,8 +1309,7 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                 ub_state_done(sc, cmd, -EIO);
 
         } else {
-                printk(KERN_WARNING "%s: "
-                    "wrong command state %d\n",
+                printk(KERN_WARNING "%s: wrong command state %d\n",
                     sc->name, cmd->state);
                 ub_state_done(sc, cmd, -EINVAL);
                 return;
@@ -1336,7 +1347,10 @@ static void ub_data_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                 return;
         }
 
-        sc->work_timer.expires = jiffies + UB_DATA_TIMEOUT;
+        if (cmd->timeo)
+                sc->work_timer.expires = jiffies + cmd->timeo;
+        else
+                sc->work_timer.expires = jiffies + UB_DATA_TIMEOUT;
         add_timer(&sc->work_timer);
 
         cmd->state = UB_CMDST_DATA;
@@ -1376,7 +1390,10 @@ static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                 return -1;
         }
 
-        sc->work_timer.expires = jiffies + UB_STAT_TIMEOUT;
+        if (cmd->timeo)
+                sc->work_timer.expires = jiffies + cmd->timeo;
+        else
+                sc->work_timer.expires = jiffies + UB_STAT_TIMEOUT;
         add_timer(&sc->work_timer);
         return 0;
 }
@@ -1515,8 +1532,7 @@ static void ub_top_sense_done(struct ub_dev *sc, struct ub_scsi_cmd *scmd)
                 return;
         }
         if (cmd->state != UB_CMDST_SENSE) {
-                printk(KERN_WARNING "%s: "
-                    "sense done with bad cmd state %d\n",
+                printk(KERN_WARNING "%s: sense done with bad cmd state %d\n",
                     sc->name, cmd->state);
                 return;
         }
@@ -1720,7 +1736,7 @@ static int ub_bd_ioctl(struct inode *inode, struct file *filp,
 }
 
 /*
- * This is called once a new disk was seen by the block layer or by ub_probe().
+ * This is called by check_disk_change if we reported a media change.
  * The main onjective here is to discover the features of the media such as
  * the capacity, read-only status, etc. USB storage generally does not
  * need to be spun up, but if we needed it, this would be the place.
@@ -2136,8 +2152,7 @@ static int ub_get_pipes(struct ub_dev *sc, struct usb_device *dev,
         }
 
         if (ep_in == NULL || ep_out == NULL) {
-                printk(KERN_NOTICE "%s: failed endpoint check\n",
-                    sc->name);
+                printk(KERN_NOTICE "%s: failed endpoint check\n", sc->name);
                 return -ENODEV;
         }
 
@@ -2354,7 +2369,7 @@ static void ub_disconnect(struct usb_interface *intf)
         spin_unlock_irqrestore(&ub_lock, flags);
 
         /*
-         * Fence stall clearnings, operations triggered by unlinkings and so on.
+         * Fence stall clearings, operations triggered by unlinkings and so on.
          * We do not attempt to unlink any URBs, because we do not trust the
          * unlink paths in HC drivers. Also, we get -84 upon disconnect anyway.
          */
@@ -2417,7 +2432,7 @@ static void ub_disconnect(struct usb_interface *intf)
         spin_unlock_irqrestore(sc->lock, flags);
 
         /*
-         * There is virtually no chance that other CPU runs times so long
+         * There is virtually no chance that other CPU runs a timeout so long
          * after ub_urb_complete should have called del_timer, but only if HCD
          * didn't forget to deliver a callback on unlink.
          */
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 0cfbe8c594a..84e064ffee5 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -35,7 +35,7 @@ struct virtblk_req
         struct list_head list;
         struct request *req;
         struct virtio_blk_outhdr out_hdr;
-        struct virtio_blk_inhdr in_hdr;
+        u8 status;
 };
 
 static void blk_done(struct virtqueue *vq)
@@ -48,7 +48,7 @@ static void blk_done(struct virtqueue *vq)
         spin_lock_irqsave(&vblk->lock, flags);
         while ((vbr = vblk->vq->vq_ops->get_buf(vblk->vq, &len)) != NULL) {
                 int uptodate;
-                switch (vbr->in_hdr.status) {
+                switch (vbr->status) {
                 case VIRTIO_BLK_S_OK:
                         uptodate = 1;
                         break;
@@ -101,7 +101,7 @@ static bool do_req(struct request_queue *q, struct virtio_blk *vblk,
         sg_init_table(vblk->sg, VIRTIO_MAX_SG);
         sg_set_buf(&vblk->sg[0], &vbr->out_hdr, sizeof(vbr->out_hdr));
         num = blk_rq_map_sg(q, vbr->req, vblk->sg+1);
-        sg_set_buf(&vblk->sg[num+1], &vbr->in_hdr, sizeof(vbr->in_hdr));
+        sg_set_buf(&vblk->sg[num+1], &vbr->status, sizeof(vbr->status));
 
         if (rq_data_dir(vbr->req) == WRITE) {
                 vbr->out_hdr.type |= VIRTIO_BLK_T_OUT;
@@ -157,10 +157,25 @@ static int virtblk_ioctl(struct inode *inode, struct file *filp,
 /* We provide getgeo only to please some old bootloader/partitioning tools */
 static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo)
 {
-        /* some standard values, similar to sd */
-        geo->heads = 1 << 6;
-        geo->sectors = 1 << 5;
-        geo->cylinders = get_capacity(bd->bd_disk) >> 11;
+        struct virtio_blk *vblk = bd->bd_disk->private_data;
+        struct virtio_blk_geometry vgeo;
+        int err;
+
+        /* see if the host passed in geometry config */
+        err = virtio_config_val(vblk->vdev, VIRTIO_BLK_F_GEOMETRY,
+                                offsetof(struct virtio_blk_config, geometry),
+                                &vgeo);
+
+        if (!err) {
+                geo->heads = vgeo.heads;
+                geo->sectors = vgeo.sectors;
+                geo->cylinders = vgeo.cylinders;
+        } else {
+                /* some standard values, similar to sd */
+                geo->heads = 1 << 6;
+                geo->sectors = 1 << 5;
+                geo->cylinders = get_capacity(bd->bd_disk) >> 11;
+        }
         return 0;
 }
 
@@ -242,12 +257,12 @@ static int virtblk_probe(struct virtio_device *vdev)
         index++;
 
         /* If barriers are supported, tell block layer that queue is ordered */
-        if (vdev->config->feature(vdev, VIRTIO_BLK_F_BARRIER))
+        if (virtio_has_feature(vdev, VIRTIO_BLK_F_BARRIER))
                 blk_queue_ordered(vblk->disk->queue, QUEUE_ORDERED_TAG, NULL);
 
         /* Host must always specify the capacity. */
-        __virtio_config_val(vdev, offsetof(struct virtio_blk_config, capacity),
-                            &cap);
+        vdev->config->get(vdev, offsetof(struct virtio_blk_config, capacity),
+                          &cap, sizeof(cap));
 
         /* If capacity is too big, truncate with warning. */
         if ((sector_t)cap != cap) {
@@ -289,7 +304,6 @@ out:
 static void virtblk_remove(struct virtio_device *vdev)
 {
         struct virtio_blk *vblk = vdev->priv;
-        int major = vblk->disk->major;
 
         /* Nothing should be pending. */
         BUG_ON(!list_empty(&vblk->reqs));
@@ -299,7 +313,6 @@ static void virtblk_remove(struct virtio_device *vdev)
 
         blk_cleanup_queue(vblk->disk->queue);
         put_disk(vblk->disk);
-        unregister_blkdev(major, "virtblk");
         mempool_destroy(vblk->pool);
         vdev->config->del_vq(vblk->vq);
         kfree(vblk);
@@ -310,7 +323,14 @@ static struct virtio_device_id id_table[] = {
         { 0 },
 };
 
+static unsigned int features[] = {
+        VIRTIO_BLK_F_BARRIER, VIRTIO_BLK_F_SEG_MAX, VIRTIO_BLK_F_SIZE_MAX,
+        VIRTIO_BLK_F_GEOMETRY,
+};
+
 static struct virtio_driver virtio_blk = {
+        .feature_table = features,
+        .feature_table_size = ARRAY_SIZE(features),
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index f49037b744f..b60d425ce8d 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -77,6 +77,10 @@ static int power_status;
 module_param(power_status, bool, 0600);
 MODULE_PARM_DESC(power_status, "Report power status in /proc/i8k");
 
+static int fan_mult = I8K_FAN_MULT;
+module_param(fan_mult, int, 0);
+MODULE_PARM_DESC(fan_mult, "Factor to multiply fan speed with");
+
 static int i8k_open_fs(struct inode *inode, struct file *file);
 static int i8k_ioctl(struct inode *, struct file *, unsigned int,
                      unsigned long);
@@ -239,7 +243,7 @@ static int i8k_get_fan_speed(int fan)
         struct smm_regs regs = { .eax = I8K_SMM_GET_SPEED, };
 
         regs.ebx = fan & 0xff;
-        return i8k_smm(&regs) ? : (regs.eax & 0xffff) * I8K_FAN_MULT;
+        return i8k_smm(&regs) ? : (regs.eax & 0xffff) * fan_mult;
 }
 
 /*
diff --git a/drivers/char/mmtimer.c b/drivers/char/mmtimer.c
index d83db5d880e..192961fd717 100644
--- a/drivers/char/mmtimer.c
+++ b/drivers/char/mmtimer.c
@@ -30,6 +30,8 @@
 #include <linux/miscdevice.h>
 #include <linux/posix-timers.h>
 #include <linux/interrupt.h>
+#include <linux/time.h>
+#include <linux/math64.h>
 
 #include <asm/uaccess.h>
 #include <asm/sn/addrs.h>
@@ -472,8 +474,8 @@ static int sgi_clock_get(clockid_t clockid, struct timespec *tp)
 
         nsec = rtc_time() * sgi_clock_period
                         + sgi_clock_offset.tv_nsec;
-        tp->tv_sec = div_long_long_rem(nsec, NSEC_PER_SEC, &tp->tv_nsec)
-                        + sgi_clock_offset.tv_sec;
+        *tp = ns_to_timespec(nsec);
+        tp->tv_sec += sgi_clock_offset.tv_sec;
         return 0;
 };
 
@@ -481,11 +483,11 @@ static int sgi_clock_set(clockid_t clockid, struct timespec *tp)
 {
 
         u64 nsec;
-        u64 rem;
+        u32 rem;
 
         nsec = rtc_time() * sgi_clock_period;
 
-        sgi_clock_offset.tv_sec = tp->tv_sec - div_long_long_rem(nsec, NSEC_PER_SEC, &rem);
+        sgi_clock_offset.tv_sec = tp->tv_sec - div_u64_rem(nsec, NSEC_PER_SEC, &rem);
 
         if (rem <= tp->tv_nsec)
                 sgi_clock_offset.tv_nsec = tp->tv_sec - rem;
@@ -644,9 +646,6 @@ static int sgi_timer_del(struct k_itimer *timr)
         return 0;
 }
 
-#define timespec_to_ns(x) ((x).tv_nsec + (x).tv_sec * NSEC_PER_SEC)
-#define ns_to_timespec(ts, nsec) (ts).tv_sec = div_long_long_rem(nsec, NSEC_PER_SEC, &(ts).tv_nsec)
-
 /* Assumption: it_lock is already held with irq's disabled */
 static void sgi_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting)
 {
@@ -659,9 +658,8 @@ static void sgi_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting)
                 return;
         }
 
-        ns_to_timespec(cur_setting->it_interval, timr->it.mmtimer.incr * sgi_clock_period);
-        ns_to_timespec(cur_setting->it_value, (timr->it.mmtimer.expires - rtc_time())* sgi_clock_period);
-        return;
+        cur_setting->it_interval = ns_to_timespec(timr->it.mmtimer.incr * sgi_clock_period);
+        cur_setting->it_value = ns_to_timespec((timr->it.mmtimer.expires - rtc_time()) * sgi_clock_period);
 }
 
 
@@ -679,8 +677,8 @@ static int sgi_timer_set(struct k_itimer *timr, int flags,
                 sgi_timer_get(timr, old_setting);
 
         sgi_timer_del(timr);
-        when = timespec_to_ns(new_setting->it_value);
-        period = timespec_to_ns(new_setting->it_interval);
+        when = timespec_to_ns(&new_setting->it_value);
+        period = timespec_to_ns(&new_setting->it_interval);
 
         if (when == 0)
                 /* Clear timer */
@@ -695,7 +693,7 @@ static int sgi_timer_set(struct k_itimer *timr, int flags,
                 unsigned long now;
 
                 getnstimeofday(&n);
-                now = timespec_to_ns(n);
+                now = timespec_to_ns(&n);
                 if (when > now)
                         when -= now;
                 else
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index fd2db07a50f..3b23270eaa6 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -1073,7 +1073,7 @@ static int cy_put_char(struct tty_struct *tty, unsigned char ch)
                 return 0;
 
         if (!info->xmit_buf)
-                return;
+                return 0;
 
         local_irq_save(flags);
         if (info->xmit_cnt >= PAGE_SIZE - 1) {
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index f39f6fd8935..b1a7a8cb65e 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -970,7 +970,8 @@ static int sx_set_real_termios(void *ptr)
                 sx_write_channel_byte(port, hi_mask, 0x1f);
                 break;
         default:
-                printk(KERN_INFO "sx: Invalid wordsize: %u\n", CFLAG & CSIZE);
+                printk(KERN_INFO "sx: Invalid wordsize: %u\n",
+                        (unsigned int)CFLAG & CSIZE);
                 break;
         }
 
@@ -997,7 +998,8 @@ static int sx_set_real_termios(void *ptr)
                 set_bit(TTY_HW_COOK_IN, &port->gs.tty->flags);
         }
         sx_dprintk(SX_DEBUG_TERMIOS, "iflags: %x(%d) ",
-                        port->gs.tty->termios->c_iflag, I_OTHER(port->gs.tty));
+                        (unsigned int)port->gs.tty->termios->c_iflag,
+                        I_OTHER(port->gs.tty));
 
 /* Tell line discipline whether we will do output cooking.
  * If OPOST is set and no other output flags are set then we can do output
@@ -1010,7 +1012,8 @@ static int sx_set_real_termios(void *ptr)
                 clear_bit(TTY_HW_COOK_OUT, &port->gs.tty->flags);
         }
         sx_dprintk(SX_DEBUG_TERMIOS, "oflags: %x(%d)\n",
-                        port->gs.tty->termios->c_oflag, O_OTHER(port->gs.tty));
+                        (unsigned int)port->gs.tty->termios->c_oflag,
+                        O_OTHER(port->gs.tty));
         /* port->c_dcd = sx_get_CD (port); */
         func_exit();
         return 0;
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index 513b7c2f3e2..ac5080df256 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -2028,13 +2028,13 @@ static void mgsl_change_params(struct mgsl_struct *info)
  */
 static int mgsl_put_char(struct tty_struct *tty, unsigned char ch)
 {
-        struct mgsl_struct *info = (struct mgsl_struct *)tty->driver_data;
+        struct mgsl_struct *info = tty->driver_data;
         unsigned long flags;
-        int ret;
+        int ret = 0;
 
-        if ( debug_level >= DEBUG_LEVEL_INFO ) {
-                printk( "%s(%d):mgsl_put_char(%d) on %s\n",
-                        __FILE__,__LINE__,ch,info->device_name);
+        if (debug_level >= DEBUG_LEVEL_INFO) {
+                printk(KERN_DEBUG "%s(%d):mgsl_put_char(%d) on %s\n",
+                        __FILE__, __LINE__, ch, info->device_name);
         }               
         
         if (mgsl_paranoia_check(info, tty->name, "mgsl_put_char"))
@@ -2043,9 +2043,9 @@ static int mgsl_put_char(struct tty_struct *tty, unsigned char ch)
         if (!tty || !info->xmit_buf)
                 return 0;
 
-        spin_lock_irqsave(&info->irq_spinlock,flags);
+        spin_lock_irqsave(&info->irq_spinlock, flags);
         
-        if ( (info->params.mode == MGSL_MODE_ASYNC ) || !info->tx_active ) {
+        if ((info->params.mode == MGSL_MODE_ASYNC ) || !info->tx_active) {
                 if (info->xmit_cnt < SERIAL_XMIT_SIZE - 1) {
                         info->xmit_buf[info->xmit_head++] = ch;
                         info->xmit_head &= SERIAL_XMIT_SIZE-1;
@@ -2053,7 +2053,7 @@ static int mgsl_put_char(struct tty_struct *tty, unsigned char ch)
                         ret = 1;
                 }
         }
-        spin_unlock_irqrestore(&info->irq_spinlock,flags);
+        spin_unlock_irqrestore(&info->irq_spinlock, flags);
         return ret;
         
 }       /* end of mgsl_put_char() */
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index 2001b0e52dc..55c1653be00 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -916,7 +916,7 @@ static int put_char(struct tty_struct *tty, unsigned char ch)
 {
         struct slgt_info *info = tty->driver_data;
         unsigned long flags;
-        int ret;
+        int ret = 0;
 
         if (sanity_check(info, tty->name, "put_char"))
                 return 0;
diff --git a/drivers/char/tty_audit.c b/drivers/char/tty_audit.c
index 6342b0534f4..3582f43345a 100644
--- a/drivers/char/tty_audit.c
+++ b/drivers/char/tty_audit.c
@@ -11,6 +11,7 @@
 
 #include <linux/audit.h>
 #include <linux/file.h>
+#include <linux/fdtable.h>
 #include <linux/tty.h>
 
 struct tty_audit_buf {
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 1d298c2cf93..49c1a2267a5 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -78,6 +78,7 @@
 #include <linux/tty_flip.h>
 #include <linux/devpts_fs.h>
 #include <linux/file.h>
+#include <linux/fdtable.h>
 #include <linux/console.h>
 #include <linux/timer.h>
 #include <linux/ctype.h>
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index e458b08139a..fa1ffbf2c62 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -2742,6 +2742,10 @@ static int con_open(struct tty_struct *tty, struct file *filp)
                                 tty->winsize.ws_row = vc_cons[currcons].d->vc_rows;
                                 tty->winsize.ws_col = vc_cons[currcons].d->vc_cols;
                         }
+                        if (vc->vc_utf)
+                                tty->termios->c_iflag |= IUTF8;
+                        else
+                                tty->termios->c_iflag &= ~IUTF8;
                         release_console_sem();
                         vcs_make_sysfs(tty);
                         return ret;
@@ -2918,6 +2922,8 @@ int __init vty_init(void)
         console_driver->minor_start = 1;
         console_driver->type = TTY_DRIVER_TYPE_CONSOLE;
         console_driver->init_termios = tty_std_termios;
+        if (default_utf8)
+                console_driver->init_termios.c_iflag |= IUTF8;
         console_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_RESET_TERMIOS;
         tty_set_operations(console_driver, &con_ops);
         if (tty_register_driver(console_driver))
diff --git a/drivers/char/xilinx_hwicap/xilinx_hwicap.c b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
index dfe6907ae15..3edf1fc1296 100644
--- a/drivers/char/xilinx_hwicap/xilinx_hwicap.c
+++ b/drivers/char/xilinx_hwicap/xilinx_hwicap.c
@@ -623,8 +623,8 @@ static int __devinit hwicap_setup(struct device *dev, int id,
 
         if (!request_mem_region(drvdata->mem_start,
                                         drvdata->mem_size, DRIVER_NAME)) {
-                dev_err(dev, "Couldn't lock memory region at %p\n",
-                        (void *)regs_res->start);
+                dev_err(dev, "Couldn't lock memory region at %Lx\n",
+                        regs_res->start);
                 retval = -EBUSY;
                 goto failed1;
         }
@@ -643,7 +643,7 @@ static int __devinit hwicap_setup(struct device *dev, int id,
         mutex_init(&drvdata->sem);
         drvdata->is_open = 0;
 
-        dev_info(dev, "ioremap %lx to %p with size %x\n",
+        dev_info(dev, "ioremap %lx to %p with size %Lx\n",
                  (unsigned long int)drvdata->mem_start,
                         drvdata->base_address, drvdata->mem_size);
 
diff --git a/drivers/edac/edac_core.h b/drivers/edac/edac_core.h
index a9aa845dbe7..b27b13c5eb5 100644
--- a/drivers/edac/edac_core.h
+++ b/drivers/edac/edac_core.h
@@ -97,7 +97,7 @@ extern int edac_debug_level;
 #define PCI_VEND_DEV(vend, dev) PCI_VENDOR_ID_ ## vend, \
         PCI_DEVICE_ID_ ## vend ## _ ## dev
 
-#define dev_name(dev) (dev)->dev_name
+#define edac_dev_name(dev) (dev)->dev_name
 
 /* memory devices */
 enum dev_type {
diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
index 63372fa7ecf..5fcd3d89c75 100644
--- a/drivers/edac/edac_device.c
+++ b/drivers/edac/edac_device.c
@@ -333,7 +333,7 @@ static int add_edac_dev_to_global_list(struct edac_device_ctl_info *edac_dev)
 fail0:
         edac_printk(KERN_WARNING, EDAC_MC,
                         "%s (%s) %s %s already assigned %d\n",
-                        rover->dev->bus_id, dev_name(rover),
+                        rover->dev->bus_id, edac_dev_name(rover),
                         rover->mod_name, rover->ctl_name, rover->dev_idx);
         return 1;
 
@@ -538,7 +538,7 @@ int edac_device_add_device(struct edac_device_ctl_info *edac_dev)
                                 "'%s': DEV '%s' (%s)\n",
                                 edac_dev->mod_name,
                                 edac_dev->ctl_name,
-                                dev_name(edac_dev),
+                                edac_dev_name(edac_dev),
                                 edac_op_state_to_string(edac_dev->op_state));
 
         mutex_unlock(&device_ctls_mutex);
@@ -599,7 +599,7 @@ struct edac_device_ctl_info *edac_device_del_device(struct device *dev)
         edac_printk(KERN_INFO, EDAC_MC,
                 "Removed device %d for %s %s: DEV %s\n",
                 edac_dev->dev_idx,
-                edac_dev->mod_name, edac_dev->ctl_name, dev_name(edac_dev));
+                edac_dev->mod_name, edac_dev->ctl_name, edac_dev_name(edac_dev));
 
         return edac_dev;
 }
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index a4cf1645f58..d110392d48f 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -402,7 +402,7 @@ static int add_mc_to_global_list(struct mem_ctl_info *mci)
 fail0:
         edac_printk(KERN_WARNING, EDAC_MC,
                 "%s (%s) %s %s already assigned %d\n", p->dev->bus_id,
-                dev_name(mci), p->mod_name, p->ctl_name, p->mc_idx);
+                edac_dev_name(mci), p->mod_name, p->ctl_name, p->mc_idx);
         return 1;
 
 fail1:
@@ -517,7 +517,7 @@ int edac_mc_add_mc(struct mem_ctl_info *mci)
 
         /* Report action taken */
         edac_mc_printk(mci, KERN_INFO, "Giving out device to '%s' '%s':"
-                " DEV %s\n", mci->mod_name, mci->ctl_name, dev_name(mci));
+                " DEV %s\n", mci->mod_name, mci->ctl_name, edac_dev_name(mci));
 
         mutex_unlock(&mem_ctls_mutex);
         return 0;
@@ -565,7 +565,7 @@ struct mem_ctl_info *edac_mc_del_mc(struct device *dev)
 
         edac_printk(KERN_INFO, EDAC_MC,
                 "Removed device %d for %s %s: DEV %s\n", mci->mc_idx,
-                mci->mod_name, mci->ctl_name, dev_name(mci));
+                mci->mod_name, mci->ctl_name, edac_dev_name(mci));
 
         return mci;
 }
diff --git a/drivers/edac/edac_pci.c b/drivers/edac/edac_pci.c
index 9b24340b52e..22ec9d5d431 100644
--- a/drivers/edac/edac_pci.c
+++ b/drivers/edac/edac_pci.c
@@ -150,7 +150,7 @@ static int add_edac_pci_to_global_list(struct edac_pci_ctl_info *pci)
 fail0:
         edac_printk(KERN_WARNING, EDAC_PCI,
                 "%s (%s) %s %s already assigned %d\n",
-                rover->dev->bus_id, dev_name(rover),
+                rover->dev->bus_id, edac_dev_name(rover),
                 rover->mod_name, rover->ctl_name, rover->pci_idx);
         return 1;
 
@@ -360,7 +360,7 @@ int edac_pci_add_device(struct edac_pci_ctl_info *pci, int edac_idx)
                         " DEV '%s' (%s)\n",
                         pci->mod_name,
                         pci->ctl_name,
-                        dev_name(pci), edac_op_state_to_string(pci->op_state));
+                        edac_dev_name(pci), edac_op_state_to_string(pci->op_state));
 
         mutex_unlock(&edac_pci_ctls_mutex);
         return 0;
@@ -415,7 +415,7 @@ struct edac_pci_ctl_info *edac_pci_del_device(struct device *dev)
 
         edac_printk(KERN_INFO, EDAC_PCI,
                 "Removed device %d for %s %s: DEV %s\n",
-                pci->pci_idx, pci->mod_name, pci->ctl_name, dev_name(pci));
+                pci->pci_idx, pci->mod_name, pci->ctl_name, edac_dev_name(pci));
 
         return pci;
 }
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
index 2a999373863..b2458bb8e9c 100644
--- a/drivers/firewire/fw-sbp2.c
+++ b/drivers/firewire/fw-sbp2.c
@@ -784,7 +784,7 @@ static void sbp2_release_target(struct kref *kref)
                 kfree(lu);
         }
         scsi_remove_host(shost);
-        fw_notify("released %s\n", tgt->bus_id);
+        fw_notify("released %s, target %d:0:0\n", tgt->bus_id, shost->host_no);
 
         fw_unit_put(tgt->unit);
         scsi_host_put(shost);
@@ -1487,7 +1487,7 @@ static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
         if (scsi_sg_count(cmd) && sbp2_map_scatterlist(orb, device, lu) < 0)
                 goto out;
 
-        memcpy(orb->request.command_block, cmd->cmnd, COMMAND_SIZE(*cmd->cmnd));
+        memcpy(orb->request.command_block, cmd->cmnd, cmd->cmd_len);
 
         orb->base.callback = complete_command_orb;
         orb->base.request_bus =
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index 5a99e81d278..93f916720b1 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -30,6 +30,8 @@ static const struct i2c_device_id pca953x_id[] = {
         { "pca9537", 4, },
         { "pca9538", 8, },
         { "pca9539", 16, },
+        { "pca9555", 16, },
+        { "pca9557", 8, },
         /* REVISIT several pca955x parts should work here too */
         { }
 };
@@ -193,7 +195,7 @@ static int __devinit pca953x_probe(struct i2c_client *client,
 {
         struct pca953x_platform_data *pdata;
         struct pca953x_chip *chip;
-        int ret, i;
+        int ret;
 
         pdata = client->dev.platform_data;
         if (pdata == NULL)
diff --git a/drivers/hwmon/adt7473.c b/drivers/hwmon/adt7473.c
index 9587869bdba..c1009d6f979 100644
--- a/drivers/hwmon/adt7473.c
+++ b/drivers/hwmon/adt7473.c
@@ -422,18 +422,14 @@ static ssize_t show_volt(struct device *dev, struct device_attribute *devattr,
  * number in the range -128 to 127, or as an unsigned number that must
  * be offset by 64.
  */
-static int decode_temp(struct adt7473_data *data, u8 raw)
+static int decode_temp(u8 twos_complement, u8 raw)
 {
-        if (data->temp_twos_complement)
-                return (s8)raw;
-        return raw - 64;
+        return twos_complement ? (s8)raw : raw - 64;
 }
 
-static u8 encode_temp(struct adt7473_data *data, int cooked)
+static u8 encode_temp(u8 twos_complement, int cooked)
 {
-        if (data->temp_twos_complement)
-                return (cooked & 0xFF);
-        return cooked + 64;
+        return twos_complement ? cooked & 0xFF : cooked + 64;
 }
 
 static ssize_t show_temp_min(struct device *dev,
@@ -442,8 +438,9 @@ static ssize_t show_temp_min(struct device *dev,
 {
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
         struct adt7473_data *data = adt7473_update_device(dev);
-        return sprintf(buf, "%d\n",
-                       1000 * decode_temp(data, data->temp_min[attr->index]));
+        return sprintf(buf, "%d\n", 1000 * decode_temp(
+                                                data->temp_twos_complement,
+                                                data->temp_min[attr->index]));
 }
 
 static ssize_t set_temp_min(struct device *dev,
@@ -455,7 +452,7 @@ static ssize_t set_temp_min(struct device *dev,
         struct i2c_client *client = to_i2c_client(dev);
         struct adt7473_data *data = i2c_get_clientdata(client);
         int temp = simple_strtol(buf, NULL, 10) / 1000;
-        temp = encode_temp(data, temp);
+        temp = encode_temp(data->temp_twos_complement, temp);
 
         mutex_lock(&data->lock);
         data->temp_min[attr->index] = temp;
@@ -472,8 +469,9 @@ static ssize_t show_temp_max(struct device *dev,
 {
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
         struct adt7473_data *data = adt7473_update_device(dev);
-        return sprintf(buf, "%d\n",
-                       1000 * decode_temp(data, data->temp_max[attr->index]));
+        return sprintf(buf, "%d\n", 1000 * decode_temp(
+                                                data->temp_twos_complement,
+                                                data->temp_max[attr->index]));
 }
 
 static ssize_t set_temp_max(struct device *dev,
@@ -485,7 +483,7 @@ static ssize_t set_temp_max(struct device *dev,
         struct i2c_client *client = to_i2c_client(dev);
         struct adt7473_data *data = i2c_get_clientdata(client);
         int temp = simple_strtol(buf, NULL, 10) / 1000;
-        temp = encode_temp(data, temp);
+        temp = encode_temp(data->temp_twos_complement, temp);
 
         mutex_lock(&data->lock);
         data->temp_max[attr->index] = temp;
@@ -501,8 +499,9 @@ static ssize_t show_temp(struct device *dev, struct device_attribute *devattr,
 {
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
         struct adt7473_data *data = adt7473_update_device(dev);
-        return sprintf(buf, "%d\n",
-                       1000 * decode_temp(data, data->temp[attr->index]));
+        return sprintf(buf, "%d\n", 1000 * decode_temp(
+                                                data->temp_twos_complement,
+                                                data->temp[attr->index]));
 }
 
 static ssize_t show_fan_min(struct device *dev,
@@ -671,8 +670,9 @@ static ssize_t show_temp_tmax(struct device *dev,
 {
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
         struct adt7473_data *data = adt7473_update_device(dev);
-        return sprintf(buf, "%d\n",
-                       1000 * decode_temp(data, data->temp_tmax[attr->index]));
+        return sprintf(buf, "%d\n", 1000 * decode_temp(
+                                                data->temp_twos_complement,
+                                                data->temp_tmax[attr->index]));
 }
 
 static ssize_t set_temp_tmax(struct device *dev,
@@ -684,7 +684,7 @@ static ssize_t set_temp_tmax(struct device *dev,
         struct i2c_client *client = to_i2c_client(dev);
         struct adt7473_data *data = i2c_get_clientdata(client);
         int temp = simple_strtol(buf, NULL, 10) / 1000;
-        temp = encode_temp(data, temp);
+        temp = encode_temp(data->temp_twos_complement, temp);
 
         mutex_lock(&data->lock);
         data->temp_tmax[attr->index] = temp;
@@ -701,8 +701,9 @@ static ssize_t show_temp_tmin(struct device *dev,
 {
         struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
         struct adt7473_data *data = adt7473_update_device(dev);
-        return sprintf(buf, "%d\n",
-                       1000 * decode_temp(data, data->temp_tmin[attr->index]));
+        return sprintf(buf, "%d\n", 1000 * decode_temp(
+                                                data->temp_twos_complement,
+                                                data->temp_tmin[attr->index]));
 }
 
 static ssize_t set_temp_tmin(struct device *dev,
@@ -714,7 +715,7 @@ static ssize_t set_temp_tmin(struct device *dev,
         struct i2c_client *client = to_i2c_client(dev);
         struct adt7473_data *data = i2c_get_clientdata(client);
         int temp = simple_strtol(buf, NULL, 10) / 1000;
-        temp = encode_temp(data, temp);
+        temp = encode_temp(data->temp_twos_complement, temp);
 
         mutex_lock(&data->lock);
         data->temp_tmin[attr->index] = temp;
diff --git a/drivers/hwmon/asb100.c b/drivers/hwmon/asb100.c
index 84712a22ace..fe2eea4d799 100644
--- a/drivers/hwmon/asb100.c
+++ b/drivers/hwmon/asb100.c
@@ -953,12 +953,8 @@ static void asb100_write_value(struct i2c_client *client, u16 reg, u16 value)
 static void asb100_init_client(struct i2c_client *client)
 {
         struct asb100_data *data = i2c_get_clientdata(client);
-        int vid = 0;
 
-        vid = asb100_read_value(client, ASB100_REG_VID_FANDIV) & 0x0f;
-        vid |= (asb100_read_value(client, ASB100_REG_CHIPID) & 0x01) << 4;
         data->vrm = vid_which_vrm();
-        vid = vid_from_reg(vid, data->vrm);
 
         /* Start monitoring */
         asb100_write_value(client, ASB100_REG_CONFIG,
diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
index 115f4090b98..fa769690515 100644
--- a/drivers/hwmon/lm75.c
+++ b/drivers/hwmon/lm75.c
@@ -248,7 +248,7 @@ static int lm75_detach_client(struct i2c_client *client)
 
 /* All registers are word-sized, except for the configuration register.
    LM75 uses a high-byte first convention, which is exactly opposite to
-   the usual practice. */
+   the SMBus standard. */
 static int lm75_read_value(struct i2c_client *client, u8 reg)
 {
         if (reg == LM75_REG_CONF)
@@ -257,9 +257,6 @@ static int lm75_read_value(struct i2c_client *client, u8 reg)
                 return swab16(i2c_smbus_read_word_data(client, reg));
 }
 
-/* All registers are word-sized, except for the configuration register.
-   LM75 uses a high-byte first convention, which is exactly opposite to
-   the usual practice. */
 static int lm75_write_value(struct i2c_client *client, u8 reg, u16 value)
 {
         if (reg == LM75_REG_CONF)
diff --git a/drivers/hwmon/smsc47b397.c b/drivers/hwmon/smsc47b397.c
index f61d8f4185b..eb03544c731 100644
--- a/drivers/hwmon/smsc47b397.c
+++ b/drivers/hwmon/smsc47b397.c
@@ -335,11 +335,23 @@ exit:
 static int __init smsc47b397_find(unsigned short *addr)
 {
         u8 id, rev;
+        char *name;
 
         superio_enter();
         id = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID);
 
-        if ((id != 0x6f) && (id != 0x81) && (id != 0x85)) {
+        switch(id) {
+        case 0x81:
+                name = "SCH5307-NS";
+                break;
+        case 0x6f:
+                name = "LPC47B397-NC";
+                break;
+        case 0x85:
+        case 0x8c:
+                name = "SCH5317";
+                break;
+        default:
                 superio_exit();
                 return -ENODEV;
         }
@@ -352,8 +364,7 @@ static int __init smsc47b397_find(unsigned short *addr)
 
         printk(KERN_INFO DRVNAME ": found SMSC %s "
                 "(base address 0x%04x, revision %u)\n",
-                id == 0x81 ? "SCH5307-NS" : id == 0x85 ? "SCH5317" :
-               "LPC47B397-NC", *addr, rev);
+                name, *addr, rev);
 
         superio_exit();
         return 0;
diff --git a/drivers/hwmon/w83793.c b/drivers/hwmon/w83793.c
index ee35af93b57..ed3c019b78c 100644
--- a/drivers/hwmon/w83793.c
+++ b/drivers/hwmon/w83793.c
@@ -1024,10 +1024,9 @@ static struct sensor_device_attribute_2 w83793_vid[] = {
         SENSOR_ATTR_2(cpu0_vid, S_IRUGO, show_vid, NULL, NOT_USED, 0),
         SENSOR_ATTR_2(cpu1_vid, S_IRUGO, show_vid, NULL, NOT_USED, 1),
 };
+static DEVICE_ATTR(vrm, S_IWUSR | S_IRUGO, show_vrm, store_vrm);
 
 static struct sensor_device_attribute_2 sda_single_files[] = {
-        SENSOR_ATTR_2(vrm, S_IWUSR | S_IRUGO, show_vrm, store_vrm,
-                      NOT_USED, NOT_USED),
         SENSOR_ATTR_2(chassis, S_IWUSR | S_IRUGO, show_alarm_beep,
                       store_chassis_clear, ALARM_STATUS, 30),
         SENSOR_ATTR_2(beep_enable, S_IWUSR | S_IRUGO, show_beep_enable,
@@ -1080,6 +1079,7 @@ static int w83793_detach_client(struct i2c_client *client)
 
                 for (i = 0; i < ARRAY_SIZE(w83793_vid); i++)
                         device_remove_file(dev, &w83793_vid[i].dev_attr);
+                device_remove_file(dev, &dev_attr_vrm);
 
                 for (i = 0; i < ARRAY_SIZE(w83793_left_fan); i++)
                         device_remove_file(dev, &w83793_left_fan[i].dev_attr);
@@ -1282,7 +1282,6 @@ static int w83793_detect(struct i2c_adapter *adapter, int address, int kind)
         /* Initialize the chip */
         w83793_init_client(client);
 
-        data->vrm = vid_which_vrm();
         /*
            Only fan 1-5 has their own input pins,
            Pwm 1-3 has their own pins
@@ -1293,7 +1292,9 @@ static int w83793_detect(struct i2c_adapter *adapter, int address, int kind)
         val = w83793_read_value(client, W83793_REG_FANIN_CTRL);
 
         /* check the function of pins 49-56 */
-        if (!(tmp & 0x80)) {
+        if (tmp & 0x80) {
+                data->has_vid |= 0x2;   /* has VIDB */
+        } else {
                 data->has_pwm |= 0x18;  /* pwm 4,5 */
                 if (val & 0x01) {       /* fan 6 */
                         data->has_fan |= 0x20;
@@ -1309,13 +1310,15 @@ static int w83793_detect(struct i2c_adapter *adapter, int address, int kind)
                 }
         }
 
+        /* check the function of pins 37-40 */
+        if (!(tmp & 0x29))
+                data->has_vid |= 0x1;   /* has VIDA */
         if (0x08 == (tmp & 0x0c)) {
                 if (val & 0x08) /* fan 9 */
                         data->has_fan |= 0x100;
                 if (val & 0x10) /* fan 10 */
                         data->has_fan |= 0x200;
         }
-
         if (0x20 == (tmp & 0x30)) {
                 if (val & 0x20) /* fan 11 */
                         data->has_fan |= 0x400;
@@ -1359,13 +1362,6 @@ static int w83793_detect(struct i2c_adapter *adapter, int address, int kind)
         if (tmp & 0x02)
                 data->has_temp |= 0x20;
 
-        /* Detect the VID usage and ignore unused input */
-        tmp = w83793_read_value(client, W83793_REG_MFC);
-        if (!(tmp & 0x29))
-                data->has_vid |= 0x1;   /* has VIDA */
-        if (tmp & 0x80)
-                data->has_vid |= 0x2;   /* has VIDB */
-
         /* Register sysfs hooks */
         for (i = 0; i < ARRAY_SIZE(w83793_sensor_attr_2); i++) {
                 err = device_create_file(dev,
@@ -1381,6 +1377,12 @@ static int w83793_detect(struct i2c_adapter *adapter, int address, int kind)
                 if (err)
                         goto exit_remove;
         }
+        if (data->has_vid) {
+                data->vrm = vid_which_vrm();
+                err = device_create_file(dev, &dev_attr_vrm);
+                if (err)
+                        goto exit_remove;
+        }
 
         for (i = 0; i < ARRAY_SIZE(sda_single_files); i++) {
                 err = device_create_file(dev, &sda_single_files[i].dev_attr);
diff --git a/drivers/hwmon/w83l785ts.c b/drivers/hwmon/w83l785ts.c
index 77f2d482888..52e268e25da 100644
--- a/drivers/hwmon/w83l785ts.c
+++ b/drivers/hwmon/w83l785ts.c
@@ -301,8 +301,8 @@ static u8 w83l785ts_read_value(struct i2c_client *client, u8 reg, u8 defval)
                 msleep(i);
         }
 
-        dev_err(&client->dev, "Couldn't read value from register 0x%02x. "
-                "Please report.\n", reg);
+        dev_err(&client->dev, "Couldn't read value from register 0x%02x.\n",
+                reg);
         return defval;
 }
 
diff --git a/drivers/i2c/busses/i2c-au1550.c b/drivers/i2c/busses/i2c-au1550.c
index 491718fe46b..cae9dc89d88 100644
--- a/drivers/i2c/busses/i2c-au1550.c
+++ b/drivers/i2c/busses/i2c-au1550.c
@@ -335,7 +335,7 @@ i2c_au1550_probe(struct platform_device *pdev)
                 goto out_mem;
         }
 
-        priv->psc_base = r->start;
+        priv->psc_base = CKSEG1ADDR(r->start);
         priv->xfer_timeout = 200;
         priv->ack_timeout = 200;
 
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index 18beb0ad7bf..a076129de7e 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -99,7 +99,7 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
         u32 x;
         int result = 0;
 
-        if (i2c->irq == 0)
+        if (i2c->irq == NO_IRQ)
         {
                 while (!(readb(i2c->base + MPC_I2C_SR) & CSR_MIF)) {
                         schedule();
@@ -329,10 +329,9 @@ static int fsl_i2c_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         i2c->irq = platform_get_irq(pdev, 0);
-        if (i2c->irq < 0) {
-                result = -ENXIO;
-                goto fail_get_irq;
-        }
+        if (i2c->irq < 0)
+                i2c->irq = NO_IRQ; /* Use polling */
+
         i2c->flags = pdata->device_flags;
         init_waitqueue_head(&i2c->queue);
 
@@ -344,7 +343,7 @@ static int fsl_i2c_probe(struct platform_device *pdev)
                 goto fail_map;
         }
 
-        if (i2c->irq != 0)
+        if (i2c->irq != NO_IRQ)
                 if ((result = request_irq(i2c->irq, mpc_i2c_isr,
                                           IRQF_SHARED, "i2c-mpc", i2c)) < 0) {
                         printk(KERN_ERR
@@ -367,12 +366,11 @@ static int fsl_i2c_probe(struct platform_device *pdev)
         return result;
 
       fail_add:
-        if (i2c->irq != 0)
+        if (i2c->irq != NO_IRQ)
                 free_irq(i2c->irq, i2c);
       fail_irq:
         iounmap(i2c->base);
       fail_map:
-      fail_get_irq:
         kfree(i2c);
         return result;
 };
@@ -384,7 +382,7 @@ static int fsl_i2c_remove(struct platform_device *pdev)
         i2c_del_adapter(&i2c->adap);
         platform_set_drvdata(pdev, NULL);
 
-        if (i2c->irq != 0)
+        if (i2c->irq != NO_IRQ)
                 free_irq(i2c->irq, i2c);
 
         iounmap(i2c->base);
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index fdc9ad805e3..ac916596858 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -104,10 +104,31 @@ MODULE_PARM_DESC(force_addr,
 static int piix4_transaction(void);
 
 static unsigned short piix4_smba;
+static int srvrworks_csb5_delay;
 static struct pci_driver piix4_driver;
 static struct i2c_adapter piix4_adapter;
 
-static struct dmi_system_id __devinitdata piix4_dmi_table[] = {
+static struct dmi_system_id __devinitdata piix4_dmi_blacklist[] = {
+        {
+                .ident = "Sapphire AM2RD790",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "SAPPHIRE Inc."),
+                        DMI_MATCH(DMI_BOARD_NAME, "PC-AM2RD790"),
+                },
+        },
+        {
+                .ident = "DFI Lanparty UT 790FX",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "DFI Inc."),
+                        DMI_MATCH(DMI_BOARD_NAME, "LP UT 790FX"),
+                },
+        },
+        { }
+};
+
+/* The IBM entry is in a separate table because we only check it
+   on Intel-based systems */
+static struct dmi_system_id __devinitdata piix4_dmi_ibm[] = {
         {
                 .ident = "IBM",
                 .matches = { DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
@@ -122,8 +143,20 @@ static int __devinit piix4_setup(struct pci_dev *PIIX4_dev,
 
         dev_info(&PIIX4_dev->dev, "Found %s device\n", pci_name(PIIX4_dev));
 
+        if ((PIIX4_dev->vendor == PCI_VENDOR_ID_SERVERWORKS) &&
+            (PIIX4_dev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5))
+                srvrworks_csb5_delay = 1;
+
+        /* On some motherboards, it was reported that accessing the SMBus
+           caused severe hardware problems */
+        if (dmi_check_system(piix4_dmi_blacklist)) {
+                dev_err(&PIIX4_dev->dev,
+                        "Accessing the SMBus on this system is unsafe!\n");
+                return -EPERM;
+        }
+
         /* Don't access SMBus on IBM systems which get corrupted eeproms */
-        if (dmi_check_system(piix4_dmi_table) &&
+        if (dmi_check_system(piix4_dmi_ibm) &&
                         PIIX4_dev->vendor == PCI_VENDOR_ID_INTEL) {
                 dev_err(&PIIX4_dev->dev, "IBM system detected; this module "
                         "may corrupt your serial eeprom! Refusing to load "
@@ -230,10 +263,14 @@ static int piix4_transaction(void)
         outb_p(inb(SMBHSTCNT) | 0x040, SMBHSTCNT);
 
         /* We will always wait for a fraction of a second! (See PIIX4 docs errata) */
-        do {
+        if (srvrworks_csb5_delay) /* Extra delay for SERVERWORKS_CSB5 */
+                msleep(2);
+        else
+                msleep(1);
+
+        while ((timeout++ < MAX_TIMEOUT) &&
+               ((temp = inb_p(SMBHSTSTS)) & 0x01))
                 msleep(1);
-                temp = inb_p(SMBHSTSTS);
-        } while ((temp & 0x01) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
         if (timeout >= MAX_TIMEOUT) {
diff --git a/drivers/i2c/busses/i2c-sibyte.c b/drivers/i2c/busses/i2c-sibyte.c
index 8fbbdb4c2f3..114634da6c6 100644
--- a/drivers/i2c/busses/i2c-sibyte.c
+++ b/drivers/i2c/busses/i2c-sibyte.c
@@ -132,14 +132,14 @@ static const struct i2c_algorithm i2c_sibyte_algo = {
 /*
  * registering functions to load algorithms at runtime
  */
-int __init i2c_sibyte_add_bus(struct i2c_adapter *i2c_adap, int speed)
+static int __init i2c_sibyte_add_bus(struct i2c_adapter *i2c_adap, int speed)
 {
         struct i2c_algo_sibyte_data *adap = i2c_adap->algo_data;
 
-        /* register new adapter to i2c module... */
+        /* Register new adapter to i2c module... */
         i2c_adap->algo = &i2c_sibyte_algo;
 
-        /* Set the frequency to 100 kHz */
+        /* Set the requested frequency. */
         csr_out32(speed, SMB_CSR(adap,R_SMB_FREQ));
         csr_out32(0, SMB_CSR(adap,R_SMB_CONTROL));
 
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 26384daccb9..c99ebeadb55 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -327,6 +327,11 @@ void i2c_unregister_device(struct i2c_client *client)
 EXPORT_SYMBOL_GPL(i2c_unregister_device);
 
 
+static const struct i2c_device_id dummy_id[] = {
+        { "dummy", 0 },
+        { },
+};
+
 static int dummy_probe(struct i2c_client *client,
                        const struct i2c_device_id *id)
 {
@@ -342,13 +347,13 @@ static struct i2c_driver dummy_driver = {
         .driver.name    = "dummy",
         .probe          = dummy_probe,
         .remove         = dummy_remove,
+        .id_table       = dummy_id,
 };
 
 /**
  * i2c_new_dummy - return a new i2c device bound to a dummy driver
  * @adapter: the adapter managing the device
  * @address: seven bit address to be used
- * @type: optional label used for i2c_client.name
  * Context: can sleep
  *
  * This returns an I2C client bound to the "dummy" driver, intended for use
@@ -364,15 +369,12 @@ static struct i2c_driver dummy_driver = {
  * i2c_unregister_device(); or NULL to indicate an error.
  */
 struct i2c_client *
-i2c_new_dummy(struct i2c_adapter *adapter, u16 address, const char *type)
+i2c_new_dummy(struct i2c_adapter *adapter, u16 address)
 {
         struct i2c_board_info info = {
-                .driver_name    = "dummy",
-                .addr           = address,
+                I2C_BOARD_INFO("dummy", address),
         };
 
-        if (type)
-                strlcpy(info.type, type, sizeof info.type);
         return i2c_new_device(adapter, &info);
 }
 EXPORT_SYMBOL_GPL(i2c_new_dummy);
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 099a0fe1745..34b0d4f26b5 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1347,19 +1347,14 @@ static void ide_init_port(ide_hwif_t *hwif, unsigned int port,
             (d->host_flags & IDE_HFLAG_FORCE_LEGACY_IRQS))
                 hwif->irq = port ? 15 : 14;
 
-        hwif->host_flags = d->host_flags;
+        /* ->host_flags may be set by ->init_iops (or even earlier...) */
+        hwif->host_flags |= d->host_flags;
         hwif->pio_mask = d->pio_mask;
 
         /* ->set_pio_mode for DTC2278 is currently limited to port 0 */
         if (hwif->chipset != ide_dtc2278 || hwif->channel == 0)
                 hwif->port_ops = d->port_ops;
 
-        if ((d->host_flags & IDE_HFLAG_SERIALIZE) ||
-            ((d->host_flags & IDE_HFLAG_SERIALIZE_DMA) && hwif->dma_base)) {
-                if (hwif->mate)
-                        hwif->mate->serialized = hwif->serialized = 1;
-        }
-
         hwif->swdma_mask = d->swdma_mask;
         hwif->mwdma_mask = d->mwdma_mask;
         hwif->ultra_mask = d->udma_mask;
@@ -1381,6 +1376,12 @@ static void ide_init_port(ide_hwif_t *hwif, unsigned int port,
                         hwif->dma_ops = d->dma_ops;
         }
 
+        if ((d->host_flags & IDE_HFLAG_SERIALIZE) ||
+            ((d->host_flags & IDE_HFLAG_SERIALIZE_DMA) && hwif->dma_base)) {
+                if (hwif->mate)
+                        hwif->mate->serialized = hwif->serialized = 1;
+        }
+
         if (d->host_flags & IDE_HFLAG_RQSIZE_256)
                 hwif->rqsize = 256;
 
diff --git a/drivers/ide/legacy/falconide.c b/drivers/ide/legacy/falconide.c
index 83555ca513b..9e449a0c623 100644
--- a/drivers/ide/legacy/falconide.c
+++ b/drivers/ide/legacy/falconide.c
@@ -61,7 +61,7 @@ static void falconide_output_data(ide_drive_t *drive, struct request *rq,
         unsigned long data_addr = drive->hwif->io_ports.data_addr;
 
         if (drive->media == ide_disk && rq && rq->cmd_type == REQ_TYPE_FS)
-                return outsw(data_adr, buf, (len + 1) / 2);
+                return outsw(data_addr, buf, (len + 1) / 2);
 
         outsw_swapw(data_addr, buf, (len + 1) / 2);
 }
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index 29d833e71cb..05710c7c122 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -520,8 +520,11 @@ static ssize_t fw_show_drv_device_ids(struct device_driver *drv, char *buf)
         char *scratch = buf;
 
         driver = container_of(drv, struct hpsb_protocol_driver, driver);
+        id = driver->id_table;
+        if (!id)
+                return 0;
 
-        for (id = driver->id_table; id->match_flags != 0; id++) {
+        for (; id->match_flags != 0; id++) {
                 int need_coma = 0;
 
                 if (id->match_flags & IEEE1394_MATCH_VENDOR_ID) {
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index ed2ee4ba4b7..ebf9d3043f8 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -359,9 +359,10 @@ static void insert_recv_cqe(struct t3_wq *wq, struct t3_cq *cq)
         cq->sw_wptr++;
 }
 
-void cxio_flush_rq(struct t3_wq *wq, struct t3_cq *cq, int count)
+int cxio_flush_rq(struct t3_wq *wq, struct t3_cq *cq, int count)
 {
         u32 ptr;
+        int flushed = 0;
 
         PDBG("%s wq %p cq %p\n", __func__, wq, cq);
 
@@ -369,8 +370,11 @@ void cxio_flush_rq(struct t3_wq *wq, struct t3_cq *cq, int count)
         PDBG("%s rq_rptr %u rq_wptr %u skip count %u\n", __func__,
             wq->rq_rptr, wq->rq_wptr, count);
         ptr = wq->rq_rptr + count;
-        while (ptr++ != wq->rq_wptr)
+        while (ptr++ != wq->rq_wptr) {
                 insert_recv_cqe(wq, cq);
+                flushed++;
+        }
+        return flushed;
 }
 
 static void insert_sq_cqe(struct t3_wq *wq, struct t3_cq *cq,
@@ -394,9 +398,10 @@ static void insert_sq_cqe(struct t3_wq *wq, struct t3_cq *cq,
         cq->sw_wptr++;
 }
 
-void cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count)
+int cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count)
 {
         __u32 ptr;
+        int flushed = 0;
         struct t3_swsq *sqp = wq->sq + Q_PTR2IDX(wq->sq_rptr, wq->sq_size_log2);
 
         ptr = wq->sq_rptr + count;
@@ -405,7 +410,9 @@ void cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count)
                 insert_sq_cqe(wq, cq, sqp);
                 sqp++;
                 ptr++;
+                flushed++;
         }
+        return flushed;
 }
 
 /*
@@ -581,7 +588,7 @@ static int cxio_hal_destroy_ctrl_qp(struct cxio_rdev *rdev_p)
  * caller aquires the ctrl_qp lock before the call
  */
 static int cxio_hal_ctrl_qp_write_mem(struct cxio_rdev *rdev_p, u32 addr,
-                                      u32 len, void *data, int completion)
+                                      u32 len, void *data)
 {
         u32 i, nr_wqe, copy_len;
         u8 *copy_data;
@@ -617,7 +624,7 @@ static int cxio_hal_ctrl_qp_write_mem(struct cxio_rdev *rdev_p, u32 addr,
                 flag = 0;
                 if (i == (nr_wqe - 1)) {
                         /* last WQE */
-                        flag = completion ? T3_COMPLETION_FLAG : 0;
+                        flag = T3_COMPLETION_FLAG;
                         if (len % 32)
                                 utx_len = len / 32 + 1;
                         else
@@ -676,21 +683,20 @@ static int cxio_hal_ctrl_qp_write_mem(struct cxio_rdev *rdev_p, u32 addr,
         return 0;
 }
 
-/* IN: stag key, pdid, perm, zbva, to, len, page_size, pbl, and pbl_size
- * OUT: stag index, actual pbl_size, pbl_addr allocated.
+/* IN: stag key, pdid, perm, zbva, to, len, page_size, pbl_size and pbl_addr
+ * OUT: stag index
  * TBD: shared memory region support
  */
 static int __cxio_tpt_op(struct cxio_rdev *rdev_p, u32 reset_tpt_entry,
                          u32 *stag, u8 stag_state, u32 pdid,
                          enum tpt_mem_type type, enum tpt_mem_perm perm,
-                         u32 zbva, u64 to, u32 len, u8 page_size, __be64 *pbl,
-                         u32 *pbl_size, u32 *pbl_addr)
+                         u32 zbva, u64 to, u32 len, u8 page_size,
+                         u32 pbl_size, u32 pbl_addr)
 {
         int err;
         struct tpt_entry tpt;
         u32 stag_idx;
         u32 wptr;
-        int rereg = (*stag != T3_STAG_UNSET);
 
         stag_state = stag_state > 0;
         stag_idx = (*stag) >> 8;
@@ -704,30 +710,8 @@ static int __cxio_tpt_op(struct cxio_rdev *rdev_p, u32 reset_tpt_entry,
         PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
              __func__, stag_state, type, pdid, stag_idx);
 
-        if (reset_tpt_entry)
-                cxio_hal_pblpool_free(rdev_p, *pbl_addr, *pbl_size << 3);
-        else if (!rereg) {
-                *pbl_addr = cxio_hal_pblpool_alloc(rdev_p, *pbl_size << 3);
-                if (!*pbl_addr) {
-                        return -ENOMEM;
-                }
-        }
-
         mutex_lock(&rdev_p->ctrl_qp.lock);
 
-        /* write PBL first if any - update pbl only if pbl list exist */
-        if (pbl) {
-
-                PDBG("%s *pdb_addr 0x%x, pbl_base 0x%x, pbl_size %d\n",
-                     __func__, *pbl_addr, rdev_p->rnic_info.pbl_base,
-                     *pbl_size);
-                err = cxio_hal_ctrl_qp_write_mem(rdev_p,
-                                (*pbl_addr >> 5),
-                                (*pbl_size << 3), pbl, 0);
-                if (err)
-                        goto ret;
-        }
-
         /* write TPT entry */
         if (reset_tpt_entry)
                 memset(&tpt, 0, sizeof(tpt));
@@ -742,23 +726,23 @@ static int __cxio_tpt_op(struct cxio_rdev *rdev_p, u32 reset_tpt_entry,
                                 V_TPT_ADDR_TYPE((zbva ? TPT_ZBTO : TPT_VATO)) |
                                 V_TPT_PAGE_SIZE(page_size));
                 tpt.rsvd_pbl_addr = reset_tpt_entry ? 0 :
-                                    cpu_to_be32(V_TPT_PBL_ADDR(PBL_OFF(rdev_p, *pbl_addr)>>3));
+                                    cpu_to_be32(V_TPT_PBL_ADDR(PBL_OFF(rdev_p, pbl_addr)>>3));
                 tpt.len = cpu_to_be32(len);
                 tpt.va_hi = cpu_to_be32((u32) (to >> 32));
                 tpt.va_low_or_fbo = cpu_to_be32((u32) (to & 0xFFFFFFFFULL));
                 tpt.rsvd_bind_cnt_or_pstag = 0;
                 tpt.rsvd_pbl_size = reset_tpt_entry ? 0 :
-                                  cpu_to_be32(V_TPT_PBL_SIZE((*pbl_size) >> 2));
+                                  cpu_to_be32(V_TPT_PBL_SIZE(pbl_size >> 2));
         }
         err = cxio_hal_ctrl_qp_write_mem(rdev_p,
                                        stag_idx +
                                        (rdev_p->rnic_info.tpt_base >> 5),
-                                       sizeof(tpt), &tpt, 1);
+                                       sizeof(tpt), &tpt);
 
         /* release the stag index to free pool */
         if (reset_tpt_entry)
                 cxio_hal_put_stag(rdev_p->rscp, stag_idx);
-ret:
+
         wptr = rdev_p->ctrl_qp.wptr;
         mutex_unlock(&rdev_p->ctrl_qp.lock);
         if (!err)
@@ -769,44 +753,67 @@ ret:
         return err;
 }
 
+int cxio_write_pbl(struct cxio_rdev *rdev_p, __be64 *pbl,
+                   u32 pbl_addr, u32 pbl_size)
+{
+        u32 wptr;
+        int err;
+
+        PDBG("%s *pdb_addr 0x%x, pbl_base 0x%x, pbl_size %d\n",
+             __func__, pbl_addr, rdev_p->rnic_info.pbl_base,
+             pbl_size);
+
+        mutex_lock(&rdev_p->ctrl_qp.lock);
+        err = cxio_hal_ctrl_qp_write_mem(rdev_p, pbl_addr >> 5, pbl_size << 3,
+                                         pbl);
+        wptr = rdev_p->ctrl_qp.wptr;
+        mutex_unlock(&rdev_p->ctrl_qp.lock);
+        if (err)
+                return err;
+
+        if (wait_event_interruptible(rdev_p->ctrl_qp.waitq,
+                                     SEQ32_GE(rdev_p->ctrl_qp.rptr,
+                                              wptr)))
+                return -ERESTARTSYS;
+
+        return 0;
+}
+
 int cxio_register_phys_mem(struct cxio_rdev *rdev_p, u32 *stag, u32 pdid,
                            enum tpt_mem_perm perm, u32 zbva, u64 to, u32 len,
-                           u8 page_size, __be64 *pbl, u32 *pbl_size,
-                           u32 *pbl_addr)
+                           u8 page_size, u32 pbl_size, u32 pbl_addr)
 {
         *stag = T3_STAG_UNSET;
         return __cxio_tpt_op(rdev_p, 0, stag, 1, pdid, TPT_NON_SHARED_MR, perm,
-                             zbva, to, len, page_size, pbl, pbl_size, pbl_addr);
+                             zbva, to, len, page_size, pbl_size, pbl_addr);
 }
 
 int cxio_reregister_phys_mem(struct cxio_rdev *rdev_p, u32 *stag, u32 pdid,
                            enum tpt_mem_perm perm, u32 zbva, u64 to, u32 len,
-                           u8 page_size, __be64 *pbl, u32 *pbl_size,
-                           u32 *pbl_addr)
+                           u8 page_size, u32 pbl_size, u32 pbl_addr)
 {
         return __cxio_tpt_op(rdev_p, 0, stag, 1, pdid, TPT_NON_SHARED_MR, perm,
-                             zbva, to, len, page_size, pbl, pbl_size, pbl_addr);
+                             zbva, to, len, page_size, pbl_size, pbl_addr);
 }
 
 int cxio_dereg_mem(struct cxio_rdev *rdev_p, u32 stag, u32 pbl_size,
                    u32 pbl_addr)
 {
-        return __cxio_tpt_op(rdev_p, 1, &stag, 0, 0, 0, 0, 0, 0ULL, 0, 0, NULL,
-                             &pbl_size, &pbl_addr);
+        return __cxio_tpt_op(rdev_p, 1, &stag, 0, 0, 0, 0, 0, 0ULL, 0, 0,
+                             pbl_size, pbl_addr);
 }
 
 int cxio_allocate_window(struct cxio_rdev *rdev_p, u32 * stag, u32 pdid)
 {
-        u32 pbl_size = 0;
         *stag = T3_STAG_UNSET;
         return __cxio_tpt_op(rdev_p, 0, stag, 0, pdid, TPT_MW, 0, 0, 0ULL, 0, 0,
-                             NULL, &pbl_size, NULL);
+                             0, 0);
 }
 
 int cxio_deallocate_window(struct cxio_rdev *rdev_p, u32 stag)
 {
-        return __cxio_tpt_op(rdev_p, 1, &stag, 0, 0, 0, 0, 0, 0ULL, 0, 0, NULL,
-                             NULL, NULL);
+        return __cxio_tpt_op(rdev_p, 1, &stag, 0, 0, 0, 0, 0, 0ULL, 0, 0,
+                             0, 0);
 }
 
 int cxio_rdma_init(struct cxio_rdev *rdev_p, struct t3_rdma_init_attr *attr)
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.h b/drivers/infiniband/hw/cxgb3/cxio_hal.h
index 2bcff7f5046..6e128f6bab0 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.h
@@ -154,14 +154,14 @@ int cxio_create_qp(struct cxio_rdev *rdev, u32 kernel_domain, struct t3_wq *wq,
 int cxio_destroy_qp(struct cxio_rdev *rdev, struct t3_wq *wq,
                     struct cxio_ucontext *uctx);
 int cxio_peek_cq(struct t3_wq *wr, struct t3_cq *cq, int opcode);
+int cxio_write_pbl(struct cxio_rdev *rdev_p, __be64 *pbl,
+                   u32 pbl_addr, u32 pbl_size);
 int cxio_register_phys_mem(struct cxio_rdev *rdev, u32 * stag, u32 pdid,
                            enum tpt_mem_perm perm, u32 zbva, u64 to, u32 len,
-                           u8 page_size, __be64 *pbl, u32 *pbl_size,
-                           u32 *pbl_addr);
+                           u8 page_size, u32 pbl_size, u32 pbl_addr);
 int cxio_reregister_phys_mem(struct cxio_rdev *rdev, u32 * stag, u32 pdid,
                            enum tpt_mem_perm perm, u32 zbva, u64 to, u32 len,
-                           u8 page_size, __be64 *pbl, u32 *pbl_size,
-                           u32 *pbl_addr);
+                           u8 page_size, u32 pbl_size, u32 pbl_addr);
 int cxio_dereg_mem(struct cxio_rdev *rdev, u32 stag, u32 pbl_size,
                    u32 pbl_addr);
 int cxio_allocate_window(struct cxio_rdev *rdev, u32 * stag, u32 pdid);
@@ -173,8 +173,8 @@ u32 cxio_hal_get_pdid(struct cxio_hal_resource *rscp);
 void cxio_hal_put_pdid(struct cxio_hal_resource *rscp, u32 pdid);
 int __init cxio_hal_init(void);
 void __exit cxio_hal_exit(void);
-void cxio_flush_rq(struct t3_wq *wq, struct t3_cq *cq, int count);
-void cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count);
+int cxio_flush_rq(struct t3_wq *wq, struct t3_cq *cq, int count);
+int cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count);
 void cxio_count_rcqes(struct t3_cq *cq, struct t3_wq *wq, int *count);
 void cxio_count_scqes(struct t3_cq *cq, struct t3_wq *wq, int *count);
 void cxio_flush_hw_cq(struct t3_cq *cq);
diff --git a/drivers/infiniband/hw/cxgb3/cxio_resource.c b/drivers/infiniband/hw/cxgb3/cxio_resource.c
index 45ed4f25ef7..bd233c08765 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_resource.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_resource.c
@@ -250,7 +250,6 @@ void cxio_hal_destroy_resource(struct cxio_hal_resource *rscp)
  */
 
 #define MIN_PBL_SHIFT 8                 /* 256B == min PBL size (32 entries) */
-#define PBL_CHUNK 2*1024*1024
 
 u32 cxio_hal_pblpool_alloc(struct cxio_rdev *rdev_p, int size)
 {
@@ -267,14 +266,35 @@ void cxio_hal_pblpool_free(struct cxio_rdev *rdev_p, u32 addr, int size)
 
 int cxio_hal_pblpool_create(struct cxio_rdev *rdev_p)
 {
-        unsigned long i;
+        unsigned pbl_start, pbl_chunk;
+
         rdev_p->pbl_pool = gen_pool_create(MIN_PBL_SHIFT, -1);
-        if (rdev_p->pbl_pool)
-                for (i = rdev_p->rnic_info.pbl_base;
-                     i <= rdev_p->rnic_info.pbl_top - PBL_CHUNK + 1;
-                     i += PBL_CHUNK)
-                        gen_pool_add(rdev_p->pbl_pool, i, PBL_CHUNK, -1);
-        return rdev_p->pbl_pool ? 0 : -ENOMEM;
+        if (!rdev_p->pbl_pool)
+                return -ENOMEM;
+
+        pbl_start = rdev_p->rnic_info.pbl_base;
+        pbl_chunk = rdev_p->rnic_info.pbl_top - pbl_start + 1;
+
+        while (pbl_start < rdev_p->rnic_info.pbl_top) {
+                pbl_chunk = min(rdev_p->rnic_info.pbl_top - pbl_start + 1,
+                                pbl_chunk);
+                if (gen_pool_add(rdev_p->pbl_pool, pbl_start, pbl_chunk, -1)) {
+                        PDBG("%s failed to add PBL chunk (%x/%x)\n",
+                             __func__, pbl_start, pbl_chunk);
+                        if (pbl_chunk <= 1024 << MIN_PBL_SHIFT) {
+                                printk(KERN_WARNING MOD "%s: Failed to add all PBL chunks (%x/%x)\n",
+                                       __func__, pbl_start, rdev_p->rnic_info.pbl_top - pbl_start);
+                                return 0;
+                        }
+                        pbl_chunk >>= 1;
+                } else {
+                        PDBG("%s added PBL chunk (%x/%x)\n",
+                             __func__, pbl_start, pbl_chunk);
+                        pbl_start += pbl_chunk;
+                }
+        }
+
+        return 0;
 }
 
 void cxio_hal_pblpool_destroy(struct cxio_rdev *rdev_p)
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index d44a6df9ad8..c325c44807e 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -67,10 +67,10 @@ int peer2peer = 0;
 module_param(peer2peer, int, 0644);
 MODULE_PARM_DESC(peer2peer, "Support peer2peer ULPs (default=0)");
 
-static int ep_timeout_secs = 10;
+static int ep_timeout_secs = 60;
 module_param(ep_timeout_secs, int, 0644);
 MODULE_PARM_DESC(ep_timeout_secs, "CM Endpoint operation timeout "
-                                   "in seconds (default=10)");
+                                   "in seconds (default=60)");
 
 static int mpa_rev = 1;
 module_param(mpa_rev, int, 0644);
@@ -1650,8 +1650,8 @@ static int close_con_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                 release = 1;
                 break;
         case ABORTING:
-                break;
         case DEAD:
+                break;
         default:
                 BUG_ON(1);
                 break;
diff --git a/drivers/infiniband/hw/cxgb3/iwch_mem.c b/drivers/infiniband/hw/cxgb3/iwch_mem.c
index 58c3d61bcd1..ec49a5cbdeb 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_mem.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_mem.c
@@ -35,17 +35,26 @@
 #include <rdma/ib_verbs.h>
 
 #include "cxio_hal.h"
+#include "cxio_resource.h"
 #include "iwch.h"
 #include "iwch_provider.h"
 
-int iwch_register_mem(struct iwch_dev *rhp, struct iwch_pd *php,
-                                        struct iwch_mr *mhp,
-                                        int shift,
-                                        __be64 *page_list)
+static void iwch_finish_mem_reg(struct iwch_mr *mhp, u32 stag)
 {
-        u32 stag;
         u32 mmid;
 
+        mhp->attr.state = 1;
+        mhp->attr.stag = stag;
+        mmid = stag >> 8;
+        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
+        insert_handle(mhp->rhp, &mhp->rhp->mmidr, mhp, mmid);
+        PDBG("%s mmid 0x%x mhp %p\n", __func__, mmid, mhp);
+}
+
+int iwch_register_mem(struct iwch_dev *rhp, struct iwch_pd *php,
+                      struct iwch_mr *mhp, int shift)
+{
+        u32 stag;
 
         if (cxio_register_phys_mem(&rhp->rdev,
                                    &stag, mhp->attr.pdid,
@@ -53,28 +62,21 @@ int iwch_register_mem(struct iwch_dev *rhp, struct iwch_pd *php,
                                    mhp->attr.zbva,
                                    mhp->attr.va_fbo,
                                    mhp->attr.len,
-                                   shift-12,
-                                   page_list,
-                                   &mhp->attr.pbl_size, &mhp->attr.pbl_addr))
+                                   shift - 12,
+                                   mhp->attr.pbl_size, mhp->attr.pbl_addr))
                 return -ENOMEM;
-        mhp->attr.state = 1;
-        mhp->attr.stag = stag;
-        mmid = stag >> 8;
-        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
-        insert_handle(rhp, &rhp->mmidr, mhp, mmid);
-        PDBG("%s mmid 0x%x mhp %p\n", __func__, mmid, mhp);
+
+        iwch_finish_mem_reg(mhp, stag);
+
         return 0;
 }
 
 int iwch_reregister_mem(struct iwch_dev *rhp, struct iwch_pd *php,
                                         struct iwch_mr *mhp,
                                         int shift,
-                                        __be64 *page_list,
                                         int npages)
 {
         u32 stag;
-        u32 mmid;
-
 
         /* We could support this... */
         if (npages > mhp->attr.pbl_size)
@@ -87,19 +89,40 @@ int iwch_reregister_mem(struct iwch_dev *rhp, struct iwch_pd *php,
                                    mhp->attr.zbva,
                                    mhp->attr.va_fbo,
                                    mhp->attr.len,
-                                   shift-12,
-                                   page_list,
-                                   &mhp->attr.pbl_size, &mhp->attr.pbl_addr))
+                                   shift - 12,
+                                   mhp->attr.pbl_size, mhp->attr.pbl_addr))
                 return -ENOMEM;
-        mhp->attr.state = 1;
-        mhp->attr.stag = stag;
-        mmid = stag >> 8;
-        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
-        insert_handle(rhp, &rhp->mmidr, mhp, mmid);
-        PDBG("%s mmid 0x%x mhp %p\n", __func__, mmid, mhp);
+
+        iwch_finish_mem_reg(mhp, stag);
+
+        return 0;
+}
+
+int iwch_alloc_pbl(struct iwch_mr *mhp, int npages)
+{
+        mhp->attr.pbl_addr = cxio_hal_pblpool_alloc(&mhp->rhp->rdev,
+                                                    npages << 3);
+
+        if (!mhp->attr.pbl_addr)
+                return -ENOMEM;
+
+        mhp->attr.pbl_size = npages;
+
         return 0;
 }
 
+void iwch_free_pbl(struct iwch_mr *mhp)
+{
+        cxio_hal_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
+                              mhp->attr.pbl_size << 3);
+}
+
+int iwch_write_pbl(struct iwch_mr *mhp, __be64 *pages, int npages, int offset)
+{
+        return cxio_write_pbl(&mhp->rhp->rdev, pages,
+                              mhp->attr.pbl_addr + (offset << 3), npages);
+}
+
 int build_phys_page_list(struct ib_phys_buf *buffer_list,
                                         int num_phys_buf,
                                         u64 *iova_start,
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index d07d3a377b5..8934178a23e 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -442,6 +442,7 @@ static int iwch_dereg_mr(struct ib_mr *ib_mr)
         mmid = mhp->attr.stag >> 8;
         cxio_dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
                        mhp->attr.pbl_addr);
+        iwch_free_pbl(mhp);
         remove_handle(rhp, &rhp->mmidr, mmid);
         if (mhp->kva)
                 kfree((void *) (unsigned long) mhp->kva);
@@ -475,6 +476,8 @@ static struct ib_mr *iwch_register_phys_mem(struct ib_pd *pd,
         if (!mhp)
                 return ERR_PTR(-ENOMEM);
 
+        mhp->rhp = rhp;
+
         /* First check that we have enough alignment */
         if ((*iova_start & ~PAGE_MASK) != (buffer_list[0].addr & ~PAGE_MASK)) {
                 ret = -EINVAL;
@@ -492,7 +495,17 @@ static struct ib_mr *iwch_register_phys_mem(struct ib_pd *pd,
         if (ret)
                 goto err;
 
-        mhp->rhp = rhp;
+        ret = iwch_alloc_pbl(mhp, npages);
+        if (ret) {
+                kfree(page_list);
+                goto err_pbl;
+        }
+
+        ret = iwch_write_pbl(mhp, page_list, npages, 0);
+        kfree(page_list);
+        if (ret)
+                goto err_pbl;
+
         mhp->attr.pdid = php->pdid;
         mhp->attr.zbva = 0;
 
@@ -502,12 +515,15 @@ static struct ib_mr *iwch_register_phys_mem(struct ib_pd *pd,
 
         mhp->attr.len = (u32) total_size;
         mhp->attr.pbl_size = npages;
-        ret = iwch_register_mem(rhp, php, mhp, shift, page_list);
-        kfree(page_list);
-        if (ret) {
-                goto err;
-        }
+        ret = iwch_register_mem(rhp, php, mhp, shift);
+        if (ret)
+                goto err_pbl;
+
         return &mhp->ibmr;
+
+err_pbl:
+        iwch_free_pbl(mhp);
+
 err:
         kfree(mhp);
         return ERR_PTR(ret);
@@ -560,7 +576,7 @@ static int iwch_reregister_phys_mem(struct ib_mr *mr,
                         return ret;
         }
 
-        ret = iwch_reregister_mem(rhp, php, &mh, shift, page_list, npages);
+        ret = iwch_reregister_mem(rhp, php, &mh, shift, npages);
         kfree(page_list);
         if (ret) {
                 return ret;
@@ -602,6 +618,8 @@ static struct ib_mr *iwch_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
         if (!mhp)
                 return ERR_PTR(-ENOMEM);
 
+        mhp->rhp = rhp;
+
         mhp->umem = ib_umem_get(pd->uobject->context, start, length, acc, 0);
         if (IS_ERR(mhp->umem)) {
                 err = PTR_ERR(mhp->umem);
@@ -615,10 +633,14 @@ static struct ib_mr *iwch_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
         list_for_each_entry(chunk, &mhp->umem->chunk_list, list)
                 n += chunk->nents;
 
-        pages = kmalloc(n * sizeof(u64), GFP_KERNEL);
+        err = iwch_alloc_pbl(mhp, n);
+        if (err)
+                goto err;
+
+        pages = (__be64 *) __get_free_page(GFP_KERNEL);
         if (!pages) {
                 err = -ENOMEM;
-                goto err;
+                goto err_pbl;
         }
 
         i = n = 0;
@@ -630,25 +652,38 @@ static struct ib_mr *iwch_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
                                 pages[i++] = cpu_to_be64(sg_dma_address(
                                         &chunk->page_list[j]) +
                                         mhp->umem->page_size * k);
+                                if (i == PAGE_SIZE / sizeof *pages) {
+                                        err = iwch_write_pbl(mhp, pages, i, n);
+                                        if (err)
+                                                goto pbl_done;
+                                        n += i;
+                                        i = 0;
+                                }
                         }
                 }
 
-        mhp->rhp = rhp;
+        if (i)
+                err = iwch_write_pbl(mhp, pages, i, n);
+
+pbl_done:
+        free_page((unsigned long) pages);
+        if (err)
+                goto err_pbl;
+
         mhp->attr.pdid = php->pdid;
         mhp->attr.zbva = 0;
         mhp->attr.perms = iwch_ib_to_tpt_access(acc);
         mhp->attr.va_fbo = virt;
         mhp->attr.page_size = shift - 12;
         mhp->attr.len = (u32) length;
-        mhp->attr.pbl_size = i;
-        err = iwch_register_mem(rhp, php, mhp, shift, pages);
-        kfree(pages);
+
+        err = iwch_register_mem(rhp, php, mhp, shift);
         if (err)
-                goto err;
+                goto err_pbl;
 
         if (udata && !t3a_device(rhp)) {
                 uresp.pbl_addr = (mhp->attr.pbl_addr -
-                                 rhp->rdev.rnic_info.pbl_base) >> 3;
+                                 rhp->rdev.rnic_info.pbl_base) >> 3;
                 PDBG("%s user resp pbl_addr 0x%x\n", __func__,
                      uresp.pbl_addr);
 
@@ -661,6 +696,9 @@ static struct ib_mr *iwch_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 
         return &mhp->ibmr;
 
+err_pbl:
+        iwch_free_pbl(mhp);
+
 err:
         ib_umem_release(mhp->umem);
         kfree(mhp);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.h b/drivers/infiniband/hw/cxgb3/iwch_provider.h
index db5100d27ca..836163fc542 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.h
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.h
@@ -340,14 +340,14 @@ int iwch_quiesce_qps(struct iwch_cq *chp);
 int iwch_resume_qps(struct iwch_cq *chp);
 void stop_read_rep_timer(struct iwch_qp *qhp);
 int iwch_register_mem(struct iwch_dev *rhp, struct iwch_pd *php,
-                                        struct iwch_mr *mhp,
-                                        int shift,
-                                        __be64 *page_list);
+                      struct iwch_mr *mhp, int shift);
 int iwch_reregister_mem(struct iwch_dev *rhp, struct iwch_pd *php,
                                         struct iwch_mr *mhp,
                                         int shift,
-                                        __be64 *page_list,
                                         int npages);
+int iwch_alloc_pbl(struct iwch_mr *mhp, int npages);
+void iwch_free_pbl(struct iwch_mr *mhp);
+int iwch_write_pbl(struct iwch_mr *mhp, __be64 *pages, int npages, int offset);
 int build_phys_page_list(struct ib_phys_buf *buffer_list,
                                         int num_phys_buf,
                                         u64 *iova_start,
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
index 9b4be889c58..79dbe5beae5 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_qp.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -655,6 +655,7 @@ static void __flush_qp(struct iwch_qp *qhp, unsigned long *flag)
 {
         struct iwch_cq *rchp, *schp;
         int count;
+        int flushed;
 
         rchp = get_chp(qhp->rhp, qhp->attr.rcq);
         schp = get_chp(qhp->rhp, qhp->attr.scq);
@@ -669,20 +670,22 @@ static void __flush_qp(struct iwch_qp *qhp, unsigned long *flag)
         spin_lock(&qhp->lock);
         cxio_flush_hw_cq(&rchp->cq);
         cxio_count_rcqes(&rchp->cq, &qhp->wq, &count);
-        cxio_flush_rq(&qhp->wq, &rchp->cq, count);
+        flushed = cxio_flush_rq(&qhp->wq, &rchp->cq, count);
         spin_unlock(&qhp->lock);
         spin_unlock_irqrestore(&rchp->lock, *flag);
-        (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
+        if (flushed)
+                (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
 
         /* locking heirarchy: cq lock first, then qp lock. */
         spin_lock_irqsave(&schp->lock, *flag);
         spin_lock(&qhp->lock);
         cxio_flush_hw_cq(&schp->cq);
         cxio_count_scqes(&schp->cq, &qhp->wq, &count);
-        cxio_flush_sq(&qhp->wq, &schp->cq, count);
+        flushed = cxio_flush_sq(&qhp->wq, &schp->cq, count);
         spin_unlock(&qhp->lock);
         spin_unlock_irqrestore(&schp->lock, *flag);
-        (*schp->ibcq.comp_handler)(&schp->ibcq, schp->ibcq.cq_context);
+        if (flushed)
+                (*schp->ibcq.comp_handler)(&schp->ibcq, schp->ibcq.cq_context);
 
         /* deref */
         if (atomic_dec_and_test(&qhp->refcnt))
@@ -880,7 +883,6 @@ int iwch_modify_qp(struct iwch_dev *rhp, struct iwch_qp *qhp,
                                 ep = qhp->ep;
                                 get_ep(&ep->com);
                         }
-                        flush_qp(qhp, &flag);
                         break;
                 case IWCH_QP_STATE_TERMINATE:
                         qhp->attr.state = IWCH_QP_STATE_TERMINATE;
@@ -911,6 +913,7 @@ int iwch_modify_qp(struct iwch_dev *rhp, struct iwch_qp *qhp,
                 }
                 switch (attrs->next_state) {
                         case IWCH_QP_STATE_IDLE:
+                                flush_qp(qhp, &flag);
                                 qhp->attr.state = IWCH_QP_STATE_IDLE;
                                 qhp->attr.llp_stream_handle = NULL;
                                 put_ep(&qhp->ep->com);
diff --git a/drivers/infiniband/hw/ehca/ehca_classes.h b/drivers/infiniband/hw/ehca/ehca_classes.h
index 00bab60f6de..1e9e99a1393 100644
--- a/drivers/infiniband/hw/ehca/ehca_classes.h
+++ b/drivers/infiniband/hw/ehca/ehca_classes.h
@@ -192,6 +192,8 @@ struct ehca_qp {
         int mtu_shift;
         u32 message_count;
         u32 packet_count;
+        atomic_t nr_events; /* events seen */
+        wait_queue_head_t wait_completion;
 };
 
 #define IS_SRQ(qp) (qp->ext_type == EQPT_SRQ)
diff --git a/drivers/infiniband/hw/ehca/ehca_hca.c b/drivers/infiniband/hw/ehca/ehca_hca.c
index 2515cbde7e6..bc3b37d2070 100644
--- a/drivers/infiniband/hw/ehca/ehca_hca.c
+++ b/drivers/infiniband/hw/ehca/ehca_hca.c
@@ -101,7 +101,6 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
         props->max_ee          = limit_uint(rblock->max_rd_ee_context);
         props->max_rdd         = limit_uint(rblock->max_rd_domain);
         props->max_fmr         = limit_uint(rblock->max_mr);
-        props->local_ca_ack_delay  = limit_uint(rblock->local_ca_ack_delay);
         props->max_qp_rd_atom  = limit_uint(rblock->max_rr_qp);
         props->max_ee_rd_atom  = limit_uint(rblock->max_rr_ee_context);
         props->max_res_rd_atom = limit_uint(rblock->max_rr_hca);
@@ -115,7 +114,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
         }
 
         props->max_pkeys           = 16;
-        props->local_ca_ack_delay  = limit_uint(rblock->local_ca_ack_delay);
+        props->local_ca_ack_delay  = min_t(u8, rblock->local_ca_ack_delay, 255);
         props->max_raw_ipv6_qp     = limit_uint(rblock->max_raw_ipv6_qp);
         props->max_raw_ethy_qp     = limit_uint(rblock->max_raw_ethy_qp);
         props->max_mcast_grp       = limit_uint(rblock->max_mcast_grp);
@@ -136,7 +135,7 @@ query_device1:
         return ret;
 }
 
-static int map_mtu(struct ehca_shca *shca, u32 fw_mtu)
+static enum ib_mtu map_mtu(struct ehca_shca *shca, u32 fw_mtu)
 {
         switch (fw_mtu) {
         case 0x1:
@@ -156,7 +155,7 @@ static int map_mtu(struct ehca_shca *shca, u32 fw_mtu)
         }
 }
 
-static int map_number_of_vls(struct ehca_shca *shca, u32 vl_cap)
+static u8 map_number_of_vls(struct ehca_shca *shca, u32 vl_cap)
 {
         switch (vl_cap) {
         case 0x1:
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index ca5eb0cb628..ce1ab0571be 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -204,6 +204,8 @@ static void qp_event_callback(struct ehca_shca *shca, u64 eqe,
 
         read_lock(&ehca_qp_idr_lock);
         qp = idr_find(&ehca_qp_idr, token);
+        if (qp)
+                atomic_inc(&qp->nr_events);
         read_unlock(&ehca_qp_idr_lock);
 
         if (!qp)
@@ -223,6 +225,8 @@ static void qp_event_callback(struct ehca_shca *shca, u64 eqe,
         if (fatal && qp->ext_type == EQPT_SRQBASE)
                 dispatch_qp_event(shca, qp, IB_EVENT_QP_LAST_WQE_REACHED);
 
+        if (atomic_dec_and_test(&qp->nr_events))
+                wake_up(&qp->wait_completion);
         return;
 }
 
diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/infiniband/hw/ehca/ehca_qp.c
index 18fba92fa7a..3f59587338e 100644
--- a/drivers/infiniband/hw/ehca/ehca_qp.c
+++ b/drivers/infiniband/hw/ehca/ehca_qp.c
@@ -566,6 +566,8 @@ static struct ehca_qp *internal_create_qp(
                 return ERR_PTR(-ENOMEM);
         }
 
+        atomic_set(&my_qp->nr_events, 0);
+        init_waitqueue_head(&my_qp->wait_completion);
         spin_lock_init(&my_qp->spinlock_s);
         spin_lock_init(&my_qp->spinlock_r);
         my_qp->qp_type = qp_type;
@@ -1934,6 +1936,9 @@ static int internal_destroy_qp(struct ib_device *dev, struct ehca_qp *my_qp,
         idr_remove(&ehca_qp_idr, my_qp->token);
         write_unlock_irqrestore(&ehca_qp_idr_lock, flags);
 
+        /* now wait until all pending events have completed */
+        wait_event(my_qp->wait_completion, !atomic_read(&my_qp->nr_events));
+
         h_ret = hipz_h_destroy_qp(shca->ipz_hca_handle, my_qp);
         if (h_ret != H_SUCCESS) {
                 ehca_err(dev, "hipz_h_destroy_qp() failed h_ret=%li "
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index acf30c06a0c..ce7b7c34360 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -1197,7 +1197,7 @@ void ipath_kreceive(struct ipath_portdata *pd)
         }
 
 reloop:
-        for (last = 0, i = 1; !last; i++) {
+        for (last = 0, i = 1; !last; i += !last) {
                 hdr = dd->ipath_f_get_msgheader(dd, rhf_addr);
                 eflags = ipath_hdrget_err_flags(rhf_addr);
                 etype = ipath_hdrget_rcv_type(rhf_addr);
@@ -1428,6 +1428,40 @@ static void ipath_update_pio_bufs(struct ipath_devdata *dd)
         spin_unlock_irqrestore(&ipath_pioavail_lock, flags);
 }
 
+/*
+ * used to force update of pioavailshadow if we can't get a pio buffer.
+ * Needed primarily due to exitting freeze mode after recovering
+ * from errors.  Done lazily, because it's safer (known to not
+ * be writing pio buffers).
+ */
+static void ipath_reset_availshadow(struct ipath_devdata *dd)
+{
+        int i, im;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ipath_pioavail_lock, flags);
+        for (i = 0; i < dd->ipath_pioavregs; i++) {
+                u64 val, oldval;
+                /* deal with 6110 chip bug on high register #s */
+                im = (i > 3 && (dd->ipath_flags & IPATH_SWAP_PIOBUFS)) ?
+                        i ^ 1 : i;
+                val = le64_to_cpu(dd->ipath_pioavailregs_dma[im]);
+                /*
+                 * busy out the buffers not in the kernel avail list,
+                 * without changing the generation bits.
+                 */
+                oldval = dd->ipath_pioavailshadow[i];
+                dd->ipath_pioavailshadow[i] = val |
+                        ((~dd->ipath_pioavailkernel[i] <<
+                        INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT) &
+                        0xaaaaaaaaaaaaaaaaULL); /* All BUSY bits in qword */
+                if (oldval != dd->ipath_pioavailshadow[i])
+                        ipath_dbg("shadow[%d] was %Lx, now %lx\n",
+                                i, oldval, dd->ipath_pioavailshadow[i]);
+        }
+        spin_unlock_irqrestore(&ipath_pioavail_lock, flags);
+}
+
 /**
  * ipath_setrcvhdrsize - set the receive header size
  * @dd: the infinipath device
@@ -1482,9 +1516,12 @@ static noinline void no_pio_bufs(struct ipath_devdata *dd)
          */
         ipath_stats.sps_nopiobufs++;
         if (!(++dd->ipath_consec_nopiobuf % 100000)) {
-                ipath_dbg("%u pio sends with no bufavail; dmacopy: "
-                        "%llx %llx %llx %llx; shadow:  %lx %lx %lx %lx\n",
+                ipath_force_pio_avail_update(dd); /* at start */
+                ipath_dbg("%u tries no piobufavail ts%lx; dmacopy: "
+                        "%llx %llx %llx %llx\n"
+                        "ipath  shadow:  %lx %lx %lx %lx\n",
                         dd->ipath_consec_nopiobuf,
+                        (unsigned long)get_cycles(),
                         (unsigned long long) le64_to_cpu(dma[0]),
                         (unsigned long long) le64_to_cpu(dma[1]),
                         (unsigned long long) le64_to_cpu(dma[2]),
@@ -1496,14 +1533,17 @@ static noinline void no_pio_bufs(struct ipath_devdata *dd)
                  */
                 if ((dd->ipath_piobcnt2k + dd->ipath_piobcnt4k) >
                     (sizeof(shadow[0]) * 4 * 4))
-                        ipath_dbg("2nd group: dmacopy: %llx %llx "
-                                  "%llx %llx; shadow: %lx %lx %lx %lx\n",
+                        ipath_dbg("2nd group: dmacopy: "
+                                  "%llx %llx %llx %llx\n"
+                                  "ipath  shadow:  %lx %lx %lx %lx\n",
                                   (unsigned long long)le64_to_cpu(dma[4]),
                                   (unsigned long long)le64_to_cpu(dma[5]),
                                   (unsigned long long)le64_to_cpu(dma[6]),
                                   (unsigned long long)le64_to_cpu(dma[7]),
-                                  shadow[4], shadow[5], shadow[6],
-                                  shadow[7]);
+                                  shadow[4], shadow[5], shadow[6], shadow[7]);
+
+                /* at end, so update likely happened */
+                ipath_reset_availshadow(dd);
         }
 }
 
@@ -1652,19 +1692,46 @@ void ipath_chg_pioavailkernel(struct ipath_devdata *dd, unsigned start,
                               unsigned len, int avail)
 {
         unsigned long flags;
-        unsigned end;
+        unsigned end, cnt = 0, next;
 
         /* There are two bits per send buffer (busy and generation) */
         start *= 2;
-        len *= 2;
-        end = start + len;
+        end = start + len * 2;
 
-        /* Set or clear the generation bits. */
         spin_lock_irqsave(&ipath_pioavail_lock, flags);
+        /* Set or clear the busy bit in the shadow. */
         while (start < end) {
                 if (avail) {
-                        __clear_bit(start + INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT,
-                                dd->ipath_pioavailshadow);
+                        unsigned long dma;
+                        int i, im;
+                        /*
+                         * the BUSY bit will never be set, because we disarm
+                         * the user buffers before we hand them back to the
+                         * kernel.  We do have to make sure the generation
+                         * bit is set correctly in shadow, since it could
+                         * have changed many times while allocated to user.
+                         * We can't use the bitmap functions on the full
+                         * dma array because it is always little-endian, so
+                         * we have to flip to host-order first.
+                         * BITS_PER_LONG is slightly wrong, since it's
+                         * always 64 bits per register in chip...
+                         * We only work on 64 bit kernels, so that's OK.
+                         */
+                        /* deal with 6110 chip bug on high register #s */
+                        i = start / BITS_PER_LONG;
+                        im = (i > 3 && (dd->ipath_flags & IPATH_SWAP_PIOBUFS)) ?
+                                i ^ 1 : i;
+                        __clear_bit(INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT
+                                + start, dd->ipath_pioavailshadow);
+                        dma = (unsigned long) le64_to_cpu(
+                                dd->ipath_pioavailregs_dma[im]);
+                        if (test_bit((INFINIPATH_SENDPIOAVAIL_CHECK_SHIFT
+                                + start) % BITS_PER_LONG, &dma))
+                                __set_bit(INFINIPATH_SENDPIOAVAIL_CHECK_SHIFT
+                                        + start, dd->ipath_pioavailshadow);
+                        else
+                                __clear_bit(INFINIPATH_SENDPIOAVAIL_CHECK_SHIFT
+                                        + start, dd->ipath_pioavailshadow);
                         __set_bit(start, dd->ipath_pioavailkernel);
                 } else {
                         __set_bit(start + INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT,
@@ -1673,7 +1740,44 @@ void ipath_chg_pioavailkernel(struct ipath_devdata *dd, unsigned start,
                 }
                 start += 2;
         }
+
+        if (dd->ipath_pioupd_thresh) {
+                end = 2 * (dd->ipath_piobcnt2k + dd->ipath_piobcnt4k);
+                next = find_first_bit(dd->ipath_pioavailkernel, end);
+                while (next < end) {
+                        cnt++;
+                        next = find_next_bit(dd->ipath_pioavailkernel, end,
+                                        next + 1);
+                }
+        }
         spin_unlock_irqrestore(&ipath_pioavail_lock, flags);
+
+        /*
+         * When moving buffers from kernel to user, if number assigned to
+         * the user is less than the pio update threshold, and threshold
+         * is supported (cnt was computed > 0), drop the update threshold
+         * so we update at least once per allocated number of buffers.
+         * In any case, if the kernel buffers are less than the threshold,
+         * drop the threshold.  We don't bother increasing it, having once
+         * decreased it, since it would typically just cycle back and forth.
+         * If we don't decrease below buffers in use, we can wait a long
+         * time for an update, until some other context uses PIO buffers.
+         */
+        if (!avail && len < cnt)
+                cnt = len;
+        if (cnt < dd->ipath_pioupd_thresh) {
+                dd->ipath_pioupd_thresh = cnt;
+                ipath_dbg("Decreased pio update threshold to %u\n",
+                        dd->ipath_pioupd_thresh);
+                spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
+                dd->ipath_sendctrl &= ~(INFINIPATH_S_UPDTHRESH_MASK
+                        << INFINIPATH_S_UPDTHRESH_SHIFT);
+                dd->ipath_sendctrl |= dd->ipath_pioupd_thresh
+                        << INFINIPATH_S_UPDTHRESH_SHIFT;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                        dd->ipath_sendctrl);
+                spin_unlock_irqrestore(&dd->ipath_sendctrl_lock, flags);
+        }
 }
 
 /**
@@ -1794,8 +1898,8 @@ void ipath_cancel_sends(struct ipath_devdata *dd, int restore_sendctrl)
 
                 spin_lock_irqsave(&dd->ipath_sdma_lock, flags);
                 skip_cancel =
-                        !test_bit(IPATH_SDMA_DISABLED, statp) &&
-                        test_and_set_bit(IPATH_SDMA_ABORTING, statp);
+                        test_and_set_bit(IPATH_SDMA_ABORTING, statp)
+                        && !test_bit(IPATH_SDMA_DISABLED, statp);
                 spin_unlock_irqrestore(&dd->ipath_sdma_lock, flags);
                 if (skip_cancel)
                         goto bail;
@@ -1826,6 +1930,9 @@ void ipath_cancel_sends(struct ipath_devdata *dd, int restore_sendctrl)
         ipath_disarm_piobufs(dd, 0,
                 dd->ipath_piobcnt2k + dd->ipath_piobcnt4k);
 
+        if (dd->ipath_flags & IPATH_HAS_SEND_DMA)
+                set_bit(IPATH_SDMA_DISARMED, &dd->ipath_sdma_status);
+
         if (restore_sendctrl) {
                 /* else done by caller later if needed */
                 spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
@@ -1845,7 +1952,6 @@ void ipath_cancel_sends(struct ipath_devdata *dd, int restore_sendctrl)
                 /* only wait so long for intr */
                 dd->ipath_sdma_abort_intr_timeout = jiffies + HZ;
                 dd->ipath_sdma_reset_wait = 200;
-                __set_bit(IPATH_SDMA_DISARMED, &dd->ipath_sdma_status);
                 if (!test_bit(IPATH_SDMA_SHUTDOWN, &dd->ipath_sdma_status))
                         tasklet_hi_schedule(&dd->ipath_sdma_abort_task);
                 spin_unlock_irqrestore(&dd->ipath_sdma_lock, flags);
diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c
index 8b1752202e7..3295177c937 100644
--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -173,47 +173,25 @@ static int ipath_get_base_info(struct file *fp,
                 (void *) dd->ipath_statusp -
                 (void *) dd->ipath_pioavailregs_dma;
         if (!shared) {
-                kinfo->spi_piocnt = dd->ipath_pbufsport;
+                kinfo->spi_piocnt = pd->port_piocnt;
                 kinfo->spi_piobufbase = (u64) pd->port_piobufs;
                 kinfo->__spi_uregbase = (u64) dd->ipath_uregbase +
                         dd->ipath_ureg_align * pd->port_port;
         } else if (master) {
-                kinfo->spi_piocnt = (dd->ipath_pbufsport / subport_cnt) +
-                                    (dd->ipath_pbufsport % subport_cnt);
+                kinfo->spi_piocnt = (pd->port_piocnt / subport_cnt) +
+                                    (pd->port_piocnt % subport_cnt);
                 /* Master's PIO buffers are after all the slave's */
                 kinfo->spi_piobufbase = (u64) pd->port_piobufs +
                         dd->ipath_palign *
-                        (dd->ipath_pbufsport - kinfo->spi_piocnt);
+                        (pd->port_piocnt - kinfo->spi_piocnt);
         } else {
                 unsigned slave = subport_fp(fp) - 1;
 
-                kinfo->spi_piocnt = dd->ipath_pbufsport / subport_cnt;
+                kinfo->spi_piocnt = pd->port_piocnt / subport_cnt;
                 kinfo->spi_piobufbase = (u64) pd->port_piobufs +
                         dd->ipath_palign * kinfo->spi_piocnt * slave;
         }
 
-        /*
-         * Set the PIO avail update threshold to no larger
-         * than the number of buffers per process. Note that
-         * we decrease it here, but won't ever increase it.
-         */
-        if (dd->ipath_pioupd_thresh &&
-            kinfo->spi_piocnt < dd->ipath_pioupd_thresh) {
-                unsigned long flags;
-
-                dd->ipath_pioupd_thresh = kinfo->spi_piocnt;
-                ipath_dbg("Decreased pio update threshold to %u\n",
-                        dd->ipath_pioupd_thresh);
-                spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
-                dd->ipath_sendctrl &= ~(INFINIPATH_S_UPDTHRESH_MASK
-                        << INFINIPATH_S_UPDTHRESH_SHIFT);
-                dd->ipath_sendctrl |= dd->ipath_pioupd_thresh
-                        << INFINIPATH_S_UPDTHRESH_SHIFT;
-                ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
-                        dd->ipath_sendctrl);
-                spin_unlock_irqrestore(&dd->ipath_sendctrl_lock, flags);
-        }
-
         if (shared) {
                 kinfo->spi_port_uregbase = (u64) dd->ipath_uregbase +
                         dd->ipath_ureg_align * pd->port_port;
@@ -1309,19 +1287,19 @@ static int ipath_mmap(struct file *fp, struct vm_area_struct *vma)
         ureg = dd->ipath_uregbase + dd->ipath_ureg_align * pd->port_port;
         if (!pd->port_subport_cnt) {
                 /* port is not shared */
-                piocnt = dd->ipath_pbufsport;
+                piocnt = pd->port_piocnt;
                 piobufs = pd->port_piobufs;
         } else if (!subport_fp(fp)) {
                 /* caller is the master */
-                piocnt = (dd->ipath_pbufsport / pd->port_subport_cnt) +
-                         (dd->ipath_pbufsport % pd->port_subport_cnt);
+                piocnt = (pd->port_piocnt / pd->port_subport_cnt) +
+                         (pd->port_piocnt % pd->port_subport_cnt);
                 piobufs = pd->port_piobufs +
-                        dd->ipath_palign * (dd->ipath_pbufsport - piocnt);
+                        dd->ipath_palign * (pd->port_piocnt - piocnt);
         } else {
                 unsigned slave = subport_fp(fp) - 1;
 
                 /* caller is a slave */
-                piocnt = dd->ipath_pbufsport / pd->port_subport_cnt;
+                piocnt = pd->port_piocnt / pd->port_subport_cnt;
                 piobufs = pd->port_piobufs + dd->ipath_palign * piocnt * slave;
         }
 
@@ -1633,9 +1611,6 @@ static int try_alloc_port(struct ipath_devdata *dd, int port,
                 port_fp(fp) = pd;
                 pd->port_pid = current->pid;
                 strncpy(pd->port_comm, current->comm, sizeof(pd->port_comm));
-                ipath_chg_pioavailkernel(dd,
-                        dd->ipath_pbufsport * (pd->port_port - 1),
-                        dd->ipath_pbufsport, 0);
                 ipath_stats.sps_ports++;
                 ret = 0;
         } else
@@ -1938,11 +1913,25 @@ static int ipath_do_user_init(struct file *fp,
 
         /* for now we do nothing with rcvhdrcnt: uinfo->spu_rcvhdrcnt */
 
+        /* some ports may get extra buffers, calculate that here */
+        if (pd->port_port <= dd->ipath_ports_extrabuf)
+                pd->port_piocnt = dd->ipath_pbufsport + 1;
+        else
+                pd->port_piocnt = dd->ipath_pbufsport;
+
         /* for right now, kernel piobufs are at end, so port 1 is at 0 */
+        if (pd->port_port <= dd->ipath_ports_extrabuf)
+                pd->port_pio_base = (dd->ipath_pbufsport + 1)
+                        * (pd->port_port - 1);
+        else
+                pd->port_pio_base = dd->ipath_ports_extrabuf +
+                        dd->ipath_pbufsport * (pd->port_port - 1);
         pd->port_piobufs = dd->ipath_piobufbase +
-                dd->ipath_pbufsport * (pd->port_port - 1) * dd->ipath_palign;
-        ipath_cdbg(VERBOSE, "Set base of piobufs for port %u to 0x%x\n",
-                   pd->port_port, pd->port_piobufs);
+                pd->port_pio_base * dd->ipath_palign;
+        ipath_cdbg(VERBOSE, "piobuf base for port %u is 0x%x, piocnt %u,"
+                " first pio %u\n", pd->port_port, pd->port_piobufs,
+                pd->port_piocnt, pd->port_pio_base);
+        ipath_chg_pioavailkernel(dd, pd->port_pio_base, pd->port_piocnt, 0);
 
         /*
          * Now allocate the rcvhdr Q and eager TIDs; skip the TID
@@ -2107,7 +2096,6 @@ static int ipath_close(struct inode *in, struct file *fp)
         }
 
         if (dd->ipath_kregbase) {
-                int i;
                 /* atomically clear receive enable port and intr avail. */
                 clear_bit(dd->ipath_r_portenable_shift + port,
                           &dd->ipath_rcvctrl);
@@ -2136,9 +2124,9 @@ static int ipath_close(struct inode *in, struct file *fp)
                 ipath_write_kreg_port(dd, dd->ipath_kregs->kr_rcvhdraddr,
                         pd->port_port, dd->ipath_dummy_hdrq_phys);
 
-                i = dd->ipath_pbufsport * (port - 1);
-                ipath_disarm_piobufs(dd, i, dd->ipath_pbufsport);
-                ipath_chg_pioavailkernel(dd, i, dd->ipath_pbufsport, 1);
+                ipath_disarm_piobufs(dd, pd->port_pio_base, pd->port_piocnt);
+                ipath_chg_pioavailkernel(dd, pd->port_pio_base,
+                        pd->port_piocnt, 1);
 
                 dd->ipath_f_clear_tids(dd, pd->port_port);
 
diff --git a/drivers/infiniband/hw/ipath/ipath_iba7220.c b/drivers/infiniband/hw/ipath/ipath_iba7220.c
index e3ec0d1bdf5..8eee7830f04 100644
--- a/drivers/infiniband/hw/ipath/ipath_iba7220.c
+++ b/drivers/infiniband/hw/ipath/ipath_iba7220.c
@@ -595,7 +595,7 @@ static void ipath_7220_txe_recover(struct ipath_devdata *dd)
 
         dev_info(&dd->pcidev->dev,
                 "Recovering from TXE PIO parity error\n");
-        ipath_disarm_senderrbufs(dd, 1);
+        ipath_disarm_senderrbufs(dd);
 }
 
 
@@ -675,10 +675,8 @@ static void ipath_7220_handle_hwerrors(struct ipath_devdata *dd, char *msg,
         ctrl = ipath_read_kreg32(dd, dd->ipath_kregs->kr_control);
         if ((ctrl & INFINIPATH_C_FREEZEMODE) && !ipath_diag_inuse) {
                 /*
-                 * Parity errors in send memory are recoverable,
-                 * just cancel the send (if indicated in * sendbuffererror),
-                 * count the occurrence, unfreeze (if no other handled
-                 * hardware error bits are set), and continue.
+                 * Parity errors in send memory are recoverable by h/w
+                 * just do housekeeping, exit freeze mode and continue.
                  */
                 if (hwerrs & ((INFINIPATH_HWE_TXEMEMPARITYERR_PIOBUF |
                                INFINIPATH_HWE_TXEMEMPARITYERR_PIOPBC)
@@ -687,13 +685,6 @@ static void ipath_7220_handle_hwerrors(struct ipath_devdata *dd, char *msg,
                         hwerrs &= ~((INFINIPATH_HWE_TXEMEMPARITYERR_PIOBUF |
                                      INFINIPATH_HWE_TXEMEMPARITYERR_PIOPBC)
                                     << INFINIPATH_HWE_TXEMEMPARITYERR_SHIFT);
-                        if (!hwerrs) {
-                                /* else leave in freeze mode */
-                                ipath_write_kreg(dd,
-                                                 dd->ipath_kregs->kr_control,
-                                                 dd->ipath_control);
-                                goto bail;
-                        }
                 }
                 if (hwerrs) {
                         /*
@@ -723,8 +714,8 @@ static void ipath_7220_handle_hwerrors(struct ipath_devdata *dd, char *msg,
                         *dd->ipath_statusp |= IPATH_STATUS_HWERROR;
                         dd->ipath_flags &= ~IPATH_INITTED;
                 } else {
-                        ipath_dbg("Clearing freezemode on ignored hardware "
-                                  "error\n");
+                        ipath_dbg("Clearing freezemode on ignored or "
+                                "recovered hardware error\n");
                         ipath_clear_freeze(dd);
                 }
         }
@@ -870,8 +861,9 @@ static int ipath_7220_boardname(struct ipath_devdata *dd, char *name,
                               "revision %u.%u!\n",
                               dd->ipath_majrev, dd->ipath_minrev);
                 ret = 1;
-        } else if (dd->ipath_minrev == 1) {
-                /* Rev1 chips are prototype. Complain, but allow use */
+        } else if (dd->ipath_minrev == 1 &&
+                !(dd->ipath_flags & IPATH_INITTED)) {
+                /* Rev1 chips are prototype. Complain at init, but allow use */
                 ipath_dev_err(dd, "Unsupported hardware "
                               "revision %u.%u, Contact support@qlogic.com\n",
                               dd->ipath_majrev, dd->ipath_minrev);
@@ -1966,7 +1958,7 @@ static void ipath_7220_config_ports(struct ipath_devdata *dd, ushort cfgports)
                          dd->ipath_rcvctrl);
         dd->ipath_p0_rcvegrcnt = 2048; /* always */
         if (dd->ipath_flags & IPATH_HAS_SEND_DMA)
-                dd->ipath_pioreserved = 1; /* reserve a buffer */
+                dd->ipath_pioreserved = 3; /* kpiobufs used for PIO */
 }
 
 
diff --git a/drivers/infiniband/hw/ipath/ipath_init_chip.c b/drivers/infiniband/hw/ipath/ipath_init_chip.c
index 27dd8947666..3e5baa43fc8 100644
--- a/drivers/infiniband/hw/ipath/ipath_init_chip.c
+++ b/drivers/infiniband/hw/ipath/ipath_init_chip.c
@@ -41,7 +41,7 @@
 /*
  * min buffers we want to have per port, after driver
  */
-#define IPATH_MIN_USER_PORT_BUFCNT 8
+#define IPATH_MIN_USER_PORT_BUFCNT 7
 
 /*
  * Number of ports we are configured to use (to allow for more pio
@@ -54,13 +54,9 @@ MODULE_PARM_DESC(cfgports, "Set max number of ports to use");
 
 /*
  * Number of buffers reserved for driver (verbs and layered drivers.)
- * Reserved at end of buffer list.   Initialized based on
- * number of PIO buffers if not set via module interface.
+ * Initialized based on number of PIO buffers if not set via module interface.
  * The problem with this is that it's global, but we'll use different
- * numbers for different chip types.  So the default value is not
- * very useful.  I've redefined it for the 1.3 release so that it's
- * zero unless set by the user to something else, in which case we
- * try to respect it.
+ * numbers for different chip types.
  */
 static ushort ipath_kpiobufs;
 
@@ -546,9 +542,12 @@ static void enable_chip(struct ipath_devdata *dd, int reinit)
                         pioavail = dd->ipath_pioavailregs_dma[i ^ 1];
                 else
                         pioavail = dd->ipath_pioavailregs_dma[i];
-                dd->ipath_pioavailshadow[i] = le64_to_cpu(pioavail) |
-                        (~dd->ipath_pioavailkernel[i] <<
-                        INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT);
+                /*
+                 * don't need to worry about ipath_pioavailkernel here
+                 * because we will call ipath_chg_pioavailkernel() later
+                 * in initialization, to busy out buffers as needed
+                 */
+                dd->ipath_pioavailshadow[i] = le64_to_cpu(pioavail);
         }
         /* can get counters, stats, etc. */
         dd->ipath_flags |= IPATH_PRESENT;
@@ -708,12 +707,11 @@ static void verify_interrupt(unsigned long opaque)
 int ipath_init_chip(struct ipath_devdata *dd, int reinit)
 {
         int ret = 0;
-        u32 val32, kpiobufs;
+        u32 kpiobufs, defkbufs;
         u32 piobufs, uports;
         u64 val;
         struct ipath_portdata *pd;
         gfp_t gfp_flags = GFP_USER | __GFP_COMP;
-        unsigned long flags;
 
         ret = init_housekeeping(dd, reinit);
         if (ret)
@@ -753,56 +751,46 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
         dd->ipath_pioavregs = ALIGN(piobufs, sizeof(u64) * BITS_PER_BYTE / 2)
                 / (sizeof(u64) * BITS_PER_BYTE / 2);
         uports = dd->ipath_cfgports ? dd->ipath_cfgports - 1 : 0;
-        if (ipath_kpiobufs == 0) {
-                /* not set by user (this is default) */
-                if (piobufs > 144)
-                        kpiobufs = 32;
-                else
-                        kpiobufs = 16;
-        }
+        if (piobufs > 144)
+                defkbufs = 32 + dd->ipath_pioreserved;
         else
-                kpiobufs = ipath_kpiobufs;
+                defkbufs = 16 + dd->ipath_pioreserved;
 
-        if (kpiobufs + (uports * IPATH_MIN_USER_PORT_BUFCNT) > piobufs) {
+        if (ipath_kpiobufs && (ipath_kpiobufs +
+                (uports * IPATH_MIN_USER_PORT_BUFCNT)) > piobufs) {
                 int i = (int) piobufs -
                         (int) (uports * IPATH_MIN_USER_PORT_BUFCNT);
                 if (i < 1)
                         i = 1;
                 dev_info(&dd->pcidev->dev, "Allocating %d PIO bufs of "
                          "%d for kernel leaves too few for %d user ports "
-                         "(%d each); using %u\n", kpiobufs,
+                         "(%d each); using %u\n", ipath_kpiobufs,
                          piobufs, uports, IPATH_MIN_USER_PORT_BUFCNT, i);
                 /*
                  * shouldn't change ipath_kpiobufs, because could be
                  * different for different devices...
                  */
                 kpiobufs = i;
-        }
+        } else if (ipath_kpiobufs)
+                kpiobufs = ipath_kpiobufs;
+        else
+                kpiobufs = defkbufs;
         dd->ipath_lastport_piobuf = piobufs - kpiobufs;
         dd->ipath_pbufsport =
                 uports ? dd->ipath_lastport_piobuf / uports : 0;
-        val32 = dd->ipath_lastport_piobuf - (dd->ipath_pbufsport * uports);
-        if (val32 > 0) {
-                ipath_dbg("allocating %u pbufs/port leaves %u unused, "
-                          "add to kernel\n", dd->ipath_pbufsport, val32);
-                dd->ipath_lastport_piobuf -= val32;
-                kpiobufs += val32;
-                ipath_dbg("%u pbufs/port leaves %u unused, add to kernel\n",
-                          dd->ipath_pbufsport, val32);
-        }
+        /* if not an even divisor, some user ports get extra buffers */
+        dd->ipath_ports_extrabuf = dd->ipath_lastport_piobuf -
+                (dd->ipath_pbufsport * uports);
+        if (dd->ipath_ports_extrabuf)
+                ipath_dbg("%u pbufs/port leaves some unused, add 1 buffer to "
+                        "ports <= %u\n", dd->ipath_pbufsport,
+                        dd->ipath_ports_extrabuf);
         dd->ipath_lastpioindex = 0;
         dd->ipath_lastpioindexl = dd->ipath_piobcnt2k;
-        ipath_chg_pioavailkernel(dd, 0, piobufs, 1);
+        /* ipath_pioavailshadow initialized earlier */
         ipath_cdbg(VERBOSE, "%d PIO bufs for kernel out of %d total %u "
                    "each for %u user ports\n", kpiobufs,
                    piobufs, dd->ipath_pbufsport, uports);
-        if (dd->ipath_pioupd_thresh) {
-                if (dd->ipath_pbufsport < dd->ipath_pioupd_thresh)
-                        dd->ipath_pioupd_thresh = dd->ipath_pbufsport;
-                if (kpiobufs < dd->ipath_pioupd_thresh)
-                        dd->ipath_pioupd_thresh = kpiobufs;
-        }
-
         ret = dd->ipath_f_early_init(dd);
         if (ret) {
                 ipath_dev_err(dd, "Early initialization failure\n");
@@ -810,13 +798,6 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
         }
 
         /*
-         * Cancel any possible active sends from early driver load.
-         * Follows early_init because some chips have to initialize
-         * PIO buffers in early_init to avoid false parity errors.
-         */
-        ipath_cancel_sends(dd, 0);
-
-        /*
          * Early_init sets rcvhdrentsize and rcvhdrsize, so this must be
          * done after early_init.
          */
@@ -836,6 +817,7 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
 
         ipath_write_kreg(dd, dd->ipath_kregs->kr_sendpioavailaddr,
                          dd->ipath_pioavailregs_phys);
+
         /*
          * this is to detect s/w errors, which the h/w works around by
          * ignoring the low 6 bits of address, if it wasn't aligned.
@@ -862,12 +844,6 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
                          ~0ULL&~INFINIPATH_HWE_MEMBISTFAILED);
         ipath_write_kreg(dd, dd->ipath_kregs->kr_control, 0ULL);
 
-        spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
-        dd->ipath_sendctrl = INFINIPATH_S_PIOENABLE;
-        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl, dd->ipath_sendctrl);
-        ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
-        spin_unlock_irqrestore(&dd->ipath_sendctrl_lock, flags);
-
         /*
          * before error clears, since we expect serdes pll errors during
          * this, the first time after reset
@@ -940,6 +916,19 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
         else
                 enable_chip(dd, reinit);
 
+        /* after enable_chip, so pioavailshadow setup */
+        ipath_chg_pioavailkernel(dd, 0, piobufs, 1);
+
+        /*
+         * Cancel any possible active sends from early driver load.
+         * Follows early_init because some chips have to initialize
+         * PIO buffers in early_init to avoid false parity errors.
+         * After enable and ipath_chg_pioavailkernel so we can safely
+         * enable pioavail updates and PIOENABLE; packets are now
+         * ready to go out.
+         */
+        ipath_cancel_sends(dd, 1);
+
         if (!reinit) {
                 /*
                  * Used when we close a port, for DMA already in flight
diff --git a/drivers/infiniband/hw/ipath/ipath_intr.c b/drivers/infiniband/hw/ipath/ipath_intr.c
index 1b58f4737c7..26900b3b7a4 100644
--- a/drivers/infiniband/hw/ipath/ipath_intr.c
+++ b/drivers/infiniband/hw/ipath/ipath_intr.c
@@ -38,42 +38,12 @@
 #include "ipath_verbs.h"
 #include "ipath_common.h"
 
-/*
- * clear (write) a pio buffer, to clear a parity error.   This routine
- * should only be called when in freeze mode, and the buffer should be
- * canceled afterwards.
- */
-static void ipath_clrpiobuf(struct ipath_devdata *dd, u32 pnum)
-{
-        u32 __iomem *pbuf;
-        u32 dwcnt; /* dword count to write */
-        if (pnum < dd->ipath_piobcnt2k) {
-                pbuf = (u32 __iomem *) (dd->ipath_pio2kbase + pnum *
-                        dd->ipath_palign);
-                dwcnt = dd->ipath_piosize2k >> 2;
-        }
-        else {
-                pbuf = (u32 __iomem *) (dd->ipath_pio4kbase +
-                        (pnum - dd->ipath_piobcnt2k) * dd->ipath_4kalign);
-                dwcnt = dd->ipath_piosize4k >> 2;
-        }
-        dev_info(&dd->pcidev->dev,
-                "Rewrite PIO buffer %u, to recover from parity error\n",
-                pnum);
-
-        /* no flush required, since already in freeze */
-        writel(dwcnt + 1, pbuf);
-        while (--dwcnt)
-                writel(0, pbuf++);
-}
 
 /*
  * Called when we might have an error that is specific to a particular
  * PIO buffer, and may need to cancel that buffer, so it can be re-used.
- * If rewrite is true, and bits are set in the sendbufferror registers,
- * we'll write to the buffer, for error recovery on parity errors.
  */
-void ipath_disarm_senderrbufs(struct ipath_devdata *dd, int rewrite)
+void ipath_disarm_senderrbufs(struct ipath_devdata *dd)
 {
         u32 piobcnt;
         unsigned long sbuf[4];
@@ -109,11 +79,8 @@ void ipath_disarm_senderrbufs(struct ipath_devdata *dd, int rewrite)
                 }
 
                 for (i = 0; i < piobcnt; i++)
-                        if (test_bit(i, sbuf)) {
-                                if (rewrite)
-                                        ipath_clrpiobuf(dd, i);
+                        if (test_bit(i, sbuf))
                                 ipath_disarm_piobufs(dd, i, 1);
-                        }
                 /* ignore armlaunch errs for a bit */
                 dd->ipath_lastcancel = jiffies+3;
         }
@@ -164,7 +131,7 @@ static u64 handle_e_sum_errs(struct ipath_devdata *dd, ipath_err_t errs)
 {
         u64 ignore_this_time = 0;
 
-        ipath_disarm_senderrbufs(dd, 0);
+        ipath_disarm_senderrbufs(dd);
         if ((errs & E_SUM_LINK_PKTERRS) &&
             !(dd->ipath_flags & IPATH_LINKACTIVE)) {
                 /*
@@ -909,8 +876,8 @@ static int handle_errors(struct ipath_devdata *dd, ipath_err_t errs)
  * processes (causing armlaunch), send errors due to going into freeze mode,
  * etc., and try to avoid causing extra interrupts while doing so.
  * Forcibly update the in-memory pioavail register copies after cleanup
- * because the chip won't do it for anything changing while in freeze mode
- * (we don't want to wait for the next pio buffer state change).
+ * because the chip won't do it while in freeze mode (the register values
+ * themselves are kept correct).
  * Make sure that we don't lose any important interrupts by using the chip
  * feature that says that writing 0 to a bit in *clear that is set in
  * *status will cause an interrupt to be generated again (if allowed by
@@ -918,44 +885,23 @@ static int handle_errors(struct ipath_devdata *dd, ipath_err_t errs)
  */
 void ipath_clear_freeze(struct ipath_devdata *dd)
 {
-        int i, im;
-        u64 val;
-
         /* disable error interrupts, to avoid confusion */
         ipath_write_kreg(dd, dd->ipath_kregs->kr_errormask, 0ULL);
 
         /* also disable interrupts; errormask is sometimes overwriten */
         ipath_write_kreg(dd, dd->ipath_kregs->kr_intmask, 0ULL);
 
-        /*
-         * clear all sends, because they have may been
-         * completed by usercode while in freeze mode, and
-         * therefore would not be sent, and eventually
-         * might cause the process to run out of bufs
-         */
-        ipath_cancel_sends(dd, 0);
+        ipath_cancel_sends(dd, 1);
+
+        /* clear the freeze, and be sure chip saw it */
         ipath_write_kreg(dd, dd->ipath_kregs->kr_control,
                          dd->ipath_control);
+        ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
 
-        /* ensure pio avail updates continue */
+        /* force in-memory update now we are out of freeze */
         ipath_force_pio_avail_update(dd);
 
         /*
-         * We just enabled pioavailupdate, so dma copy is almost certainly
-         * not yet right, so read the registers directly.  Similar to init
-         */
-        for (i = 0; i < dd->ipath_pioavregs; i++) {
-                /* deal with 6110 chip bug */
-                im = (i > 3 && (dd->ipath_flags & IPATH_SWAP_PIOBUFS)) ?
-                        i ^ 1 : i;
-                val = ipath_read_kreg64(dd, (0x1000 / sizeof(u64)) + im);
-                dd->ipath_pioavailregs_dma[i] = cpu_to_le64(val);
-                dd->ipath_pioavailshadow[i] = val |
-                        (~dd->ipath_pioavailkernel[i] <<
-                        INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT);
-        }
-
-        /*
          * force new interrupt if any hwerr, error or interrupt bits are
          * still set, and clear "safe" send packet errors related to freeze
          * and cancelling sends.  Re-enable error interrupts before possible
@@ -1312,10 +1258,8 @@ irqreturn_t ipath_intr(int irq, void *data)
                 ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
                 spin_unlock_irqrestore(&dd->ipath_sendctrl_lock, flags);
 
-                if (!(dd->ipath_flags & IPATH_HAS_SEND_DMA))
-                        handle_layer_pioavail(dd);
-                else
-                        ipath_dbg("unexpected BUFAVAIL intr\n");
+                /* always process; sdma verbs uses PIO for acks and VL15  */
+                handle_layer_pioavail(dd);
         }
 
         ret = IRQ_HANDLED;
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
index 202337ae90d..02b24a34059 100644
--- a/drivers/infiniband/hw/ipath/ipath_kernel.h
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -117,6 +117,10 @@ struct ipath_portdata {
         u16 port_subport_cnt;
         /* non-zero if port is being shared. */
         u16 port_subport_id;
+        /* number of pio bufs for this port (all procs, if shared) */
+        u32 port_piocnt;
+        /* first pio buffer for this port */
+        u32 port_pio_base;
         /* chip offset of PIO buffers for this port */
         u32 port_piobufs;
         /* how many alloc_pages() chunks in port_rcvegrbuf_pages */
@@ -384,6 +388,8 @@ struct ipath_devdata {
         u32 ipath_lastrpkts;
         /* pio bufs allocated per port */
         u32 ipath_pbufsport;
+        /* if remainder on bufs/port, ports < extrabuf get 1 extra */
+        u32 ipath_ports_extrabuf;
         u32 ipath_pioupd_thresh; /* update threshold, some chips */
         /*
          * number of ports configured as max; zero is set to number chip
@@ -1011,7 +1017,7 @@ void ipath_get_eeprom_info(struct ipath_devdata *);
 int ipath_update_eeprom_log(struct ipath_devdata *dd);
 void ipath_inc_eeprom_err(struct ipath_devdata *dd, u32 eidx, u32 incr);
 u64 ipath_snap_cntr(struct ipath_devdata *, ipath_creg);
-void ipath_disarm_senderrbufs(struct ipath_devdata *, int);
+void ipath_disarm_senderrbufs(struct ipath_devdata *);
 void ipath_force_pio_avail_update(struct ipath_devdata *);
 void signal_ib_event(struct ipath_devdata *dd, enum ib_event_type ev);
 
diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
index c405dfba553..08b11b56761 100644
--- a/drivers/infiniband/hw/ipath/ipath_rc.c
+++ b/drivers/infiniband/hw/ipath/ipath_rc.c
@@ -1746,7 +1746,11 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
                 qp->r_wrid_valid = 0;
                 wc.wr_id = qp->r_wr_id;
                 wc.status = IB_WC_SUCCESS;
-                wc.opcode = IB_WC_RECV;
+                if (opcode == OP(RDMA_WRITE_LAST_WITH_IMMEDIATE) ||
+                    opcode == OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE))
+                        wc.opcode = IB_WC_RECV_RDMA_WITH_IMM;
+                else
+                        wc.opcode = IB_WC_RECV;
                 wc.vendor_err = 0;
                 wc.qp = &qp->ibqp;
                 wc.src_qp = qp->remote_qpn;
diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
index 8ac5c1d82cc..9e3fe61cbd0 100644
--- a/drivers/infiniband/hw/ipath/ipath_ruc.c
+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
@@ -481,9 +481,10 @@ done:
                 wake_up(&qp->wait);
 }
 
-static void want_buffer(struct ipath_devdata *dd)
+static void want_buffer(struct ipath_devdata *dd, struct ipath_qp *qp)
 {
-        if (!(dd->ipath_flags & IPATH_HAS_SEND_DMA)) {
+        if (!(dd->ipath_flags & IPATH_HAS_SEND_DMA) ||
+                qp->ibqp.qp_type == IB_QPT_SMI) {
                 unsigned long flags;
 
                 spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
@@ -519,7 +520,7 @@ static void ipath_no_bufs_available(struct ipath_qp *qp,
         spin_lock_irqsave(&dev->pending_lock, flags);
         list_add_tail(&qp->piowait, &dev->piowait);
         spin_unlock_irqrestore(&dev->pending_lock, flags);
-        want_buffer(dev->dd);
+        want_buffer(dev->dd, qp);
         dev->n_piowait++;
 }
 
diff --git a/drivers/infiniband/hw/ipath/ipath_sdma.c b/drivers/infiniband/hw/ipath/ipath_sdma.c
index 1974df7a9f7..3697449c1ba 100644
--- a/drivers/infiniband/hw/ipath/ipath_sdma.c
+++ b/drivers/infiniband/hw/ipath/ipath_sdma.c
@@ -308,13 +308,15 @@ static void sdma_abort_task(unsigned long opaque)
                 spin_unlock_irqrestore(&dd->ipath_sdma_lock, flags);
 
                 /*
-                 * Don't restart sdma here. Wait until link is up to ACTIVE.
-                 * VL15 MADs used to bring the link up use PIO, and multiple
-                 * link transitions otherwise cause the sdma engine to be
+                 * Don't restart sdma here (with the exception
+                 * below). Wait until link is up to ACTIVE.  VL15 MADs
+                 * used to bring the link up use PIO, and multiple link
+                 * transitions otherwise cause the sdma engine to be
                  * stopped and started multiple times.
-                 * The disable is done here, including the shadow, so the
-                 * state is kept consistent.
-                 * See ipath_restart_sdma() for the actual starting of sdma.
+                 * The disable is done here, including the shadow,
+                 * so the state is kept consistent.
+                 * See ipath_restart_sdma() for the actual starting
+                 * of sdma.
                  */
                 spin_lock_irqsave(&dd->ipath_sendctrl_lock, flags);
                 dd->ipath_sendctrl &= ~INFINIPATH_S_SDMAENABLE;
@@ -326,6 +328,13 @@ static void sdma_abort_task(unsigned long opaque)
                 /* make sure I see next message */
                 dd->ipath_sdma_abort_jiffies = 0;
 
+                /*
+                 * Not everything that takes SDMA offline is a link
+                 * status change.  If the link was up, restart SDMA.
+                 */
+                if (dd->ipath_flags & IPATH_LINKACTIVE)
+                        ipath_restart_sdma(dd);
+
                 goto done;
         }
 
@@ -427,7 +436,12 @@ int setup_sdma(struct ipath_devdata *dd)
                 goto done;
         }
 
-        dd->ipath_sdma_status = 0;
+        /*
+         * Set initial status as if we had been up, then gone down.
+         * This lets initial start on transition to ACTIVE be the
+         * same as restart after link flap.
+         */
+        dd->ipath_sdma_status = IPATH_SDMA_ABORT_ABORTED;
         dd->ipath_sdma_abort_jiffies = 0;
         dd->ipath_sdma_generation = 0;
         dd->ipath_sdma_descq_tail = 0;
@@ -449,16 +463,19 @@ int setup_sdma(struct ipath_devdata *dd)
         ipath_write_kreg(dd, dd->ipath_kregs->kr_senddmaheadaddr,
                          dd->ipath_sdma_head_phys);
 
-        /* Reserve all the former "kernel" piobufs */
-        n = dd->ipath_piobcnt2k + dd->ipath_piobcnt4k - dd->ipath_pioreserved;
-        for (i = dd->ipath_lastport_piobuf; i < n; ++i) {
+        /*
+         * Reserve all the former "kernel" piobufs, using high number range
+         * so we get as many 4K buffers as possible
+         */
+        n = dd->ipath_piobcnt2k + dd->ipath_piobcnt4k;
+        i = dd->ipath_lastport_piobuf + dd->ipath_pioreserved;
+        ipath_chg_pioavailkernel(dd, i, n - i , 0);
+        for (; i < n; ++i) {
                 unsigned word = i / 64;
                 unsigned bit = i & 63;
                 BUG_ON(word >= 3);
                 senddmabufmask[word] |= 1ULL << bit;
         }
-        ipath_chg_pioavailkernel(dd, dd->ipath_lastport_piobuf,
-                n - dd->ipath_lastport_piobuf, 0);
         ipath_write_kreg(dd, dd->ipath_kregs->kr_senddmabufmask0,
                          senddmabufmask[0]);
         ipath_write_kreg(dd, dd->ipath_kregs->kr_senddmabufmask1,
@@ -615,6 +632,9 @@ void ipath_restart_sdma(struct ipath_devdata *dd)
         ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
         spin_unlock_irqrestore(&dd->ipath_sendctrl_lock, flags);
 
+        /* notify upper layers */
+        ipath_ib_piobufavail(dd->verbs_dev);
+
 bail:
         return;
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index e63927cce5b..5015cd2e57b 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -396,7 +396,6 @@ static int ipath_post_one_send(struct ipath_qp *qp, struct ib_send_wr *wr)
 
         wqe = get_swqe_ptr(qp, qp->s_head);
         wqe->wr = *wr;
-        wqe->ssn = qp->s_ssn++;
         wqe->length = 0;
         if (wr->num_sge) {
                 acc = wr->opcode >= IB_WR_RDMA_READ ?
@@ -422,6 +421,7 @@ static int ipath_post_one_send(struct ipath_qp *qp, struct ib_send_wr *wr)
                         goto bail_inval;
         } else if (wqe->length > to_idev(qp->ibqp.device)->dd->ipath_ibmtu)
                 goto bail_inval;
+        wqe->ssn = qp->s_ssn++;
         qp->s_head = next;
 
         ret = 0;
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 2f199c5c4a7..4521319b140 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -246,7 +246,7 @@ err_mtt:
         if (context)
                 ib_umem_release(cq->umem);
         else
-                mlx4_ib_free_cq_buf(dev, &cq->buf, entries);
+                mlx4_ib_free_cq_buf(dev, &cq->buf, cq->ibcq.cqe);
 
 err_db:
         if (!context)
@@ -434,7 +434,7 @@ int mlx4_ib_destroy_cq(struct ib_cq *cq)
                 mlx4_ib_db_unmap_user(to_mucontext(cq->uobject->context), &mcq->db);
                 ib_umem_release(mcq->umem);
         } else {
-                mlx4_ib_free_cq_buf(dev, &mcq->buf, cq->cqe + 1);
+                mlx4_ib_free_cq_buf(dev, &mcq->buf, cq->cqe);
                 mlx4_db_free(dev->dev, &mcq->db);
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 9044f880353..ca126fc2b85 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -334,6 +334,7 @@ struct ipoib_dev_priv {
 #endif
         int     hca_caps;
         struct ipoib_ethtool_st ethtool;
+        struct timer_list poll_timer;
 };
 
 struct ipoib_ah {
@@ -404,6 +405,7 @@ extern struct workqueue_struct *ipoib_workqueue;
 
 int ipoib_poll(struct napi_struct *napi, int budget);
 void ipoib_ib_completion(struct ib_cq *cq, void *dev_ptr);
+void ipoib_send_comp_handler(struct ib_cq *cq, void *dev_ptr);
 
 struct ipoib_ah *ipoib_create_ah(struct net_device *dev,
                                  struct ib_pd *pd, struct ib_ah_attr *attr);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 97b815c1a3f..f429bce24c2 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -461,6 +461,26 @@ void ipoib_ib_completion(struct ib_cq *cq, void *dev_ptr)
         netif_rx_schedule(dev, &priv->napi);
 }
 
+static void drain_tx_cq(struct net_device *dev)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        while (poll_tx(priv))
+                ; /* nothing */
+
+        if (netif_queue_stopped(dev))
+                mod_timer(&priv->poll_timer, jiffies + 1);
+
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+}
+
+void ipoib_send_comp_handler(struct ib_cq *cq, void *dev_ptr)
+{
+        drain_tx_cq((struct net_device *)dev_ptr);
+}
+
 static inline int post_send(struct ipoib_dev_priv *priv,
                             unsigned int wr_id,
                             struct ib_ah *address, u32 qpn,
@@ -555,12 +575,22 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
         else
                 priv->tx_wr.send_flags &= ~IB_SEND_IP_CSUM;
 
+        if (++priv->tx_outstanding == ipoib_sendq_size) {
+                ipoib_dbg(priv, "TX ring full, stopping kernel net queue\n");
+                if (ib_req_notify_cq(priv->send_cq, IB_CQ_NEXT_COMP))
+                        ipoib_warn(priv, "request notify on send CQ failed\n");
+                netif_stop_queue(dev);
+        }
+
         if (unlikely(post_send(priv, priv->tx_head & (ipoib_sendq_size - 1),
                                address->ah, qpn, tx_req, phead, hlen))) {
                 ipoib_warn(priv, "post_send failed\n");
                 ++dev->stats.tx_errors;
+                --priv->tx_outstanding;
                 ipoib_dma_unmap_tx(priv->ca, tx_req);
                 dev_kfree_skb_any(skb);
+                if (netif_queue_stopped(dev))
+                        netif_wake_queue(dev);
         } else {
                 dev->trans_start = jiffies;
 
@@ -568,14 +598,11 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 ++priv->tx_head;
                 skb_orphan(skb);
 
-                if (++priv->tx_outstanding == ipoib_sendq_size) {
-                        ipoib_dbg(priv, "TX ring full, stopping kernel net queue\n");
-                        netif_stop_queue(dev);
-                }
         }
 
         if (unlikely(priv->tx_outstanding > MAX_SEND_CQE))
-                poll_tx(priv);
+                while (poll_tx(priv))
+                        ; /* nothing */
 }
 
 static void __ipoib_reap_ah(struct net_device *dev)
@@ -609,6 +636,11 @@ void ipoib_reap_ah(struct work_struct *work)
                                    round_jiffies_relative(HZ));
 }
 
+static void ipoib_ib_tx_timer_func(unsigned long ctx)
+{
+        drain_tx_cq((struct net_device *)ctx);
+}
+
 int ipoib_ib_dev_open(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
@@ -645,6 +677,10 @@ int ipoib_ib_dev_open(struct net_device *dev)
         queue_delayed_work(ipoib_workqueue, &priv->ah_reap_task,
                            round_jiffies_relative(HZ));
 
+        init_timer(&priv->poll_timer);
+        priv->poll_timer.function = ipoib_ib_tx_timer_func;
+        priv->poll_timer.data = (unsigned long)dev;
+
         set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
 
         return 0;
@@ -810,6 +846,7 @@ int ipoib_ib_dev_stop(struct net_device *dev, int flush)
         ipoib_dbg(priv, "All sends and receives done.\n");
 
 timeout:
+        del_timer_sync(&priv->poll_timer);
         qp_attr.qp_state = IB_QPS_RESET;
         if (ib_modify_qp(priv->qp, &qp_attr, IB_QP_STATE))
                 ipoib_warn(priv, "Failed to modify QP to RESET state\n");
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index c1e7ece1fd4..8766d29ce3b 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -187,7 +187,8 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
                 goto out_free_mr;
         }
 
-        priv->send_cq = ib_create_cq(priv->ca, NULL, NULL, dev, ipoib_sendq_size, 0);
+        priv->send_cq = ib_create_cq(priv->ca, ipoib_send_comp_handler, NULL,
+                                     dev, ipoib_sendq_size, 0);
         if (IS_ERR(priv->send_cq)) {
                 printk(KERN_WARNING "%s: failed to create send CQ\n", ca->name);
                 goto out_free_recv_cq;
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index 92b683411d5..3ad8bd9f754 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -14,7 +14,7 @@ if INPUT_MISC
 
 config INPUT_PCSPKR
         tristate "PC Speaker support"
-        depends on ALPHA || X86 || MIPS || PPC_PREP || PPC_CHRP || PPC_PSERIES
+        depends on PCSPKR_PLATFORM
         depends on SND_PCSP=n
         help
           Say Y here if you want the standard PC Speaker to be used for
diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
index 02b3ad8c082..edfedd9a166 100644
--- a/drivers/input/serio/hp_sdc.c
+++ b/drivers/input/serio/hp_sdc.c
@@ -69,6 +69,7 @@
 #include <linux/time.h>
 #include <linux/slab.h>
 #include <linux/hil.h>
+#include <linux/semaphore.h>
 #include <asm/io.h>
 #include <asm/system.h>
 
diff --git a/drivers/input/serio/i8042-io.h b/drivers/input/serio/i8042-io.h
index 3b4e13b9ce1..f451c7351a9 100644
--- a/drivers/input/serio/i8042-io.h
+++ b/drivers/input/serio/i8042-io.h
@@ -25,7 +25,7 @@
 #elif defined(__arm__)
 /* defined in include/asm-arm/arch-xxx/irqs.h */
 #include <asm/irq.h>
-#elif defined(CONFIG_SUPERH64)
+#elif defined(CONFIG_SH_CAYMAN)
 #include <asm/irq.h>
 #else
 # define I8042_KBD_IRQ  1
diff --git a/drivers/isdn/hysdn/hysdn_procconf.c b/drivers/isdn/hysdn/hysdn_procconf.c
index 877be9922c3..15906d005b0 100644
--- a/drivers/isdn/hysdn/hysdn_procconf.c
+++ b/drivers/isdn/hysdn/hysdn_procconf.c
@@ -405,7 +405,8 @@ hysdn_procconf_init(void)
                 sprintf(conf_name, "%s%d", PROC_CONF_BASENAME, card->myid);
                 if ((card->procconf = (void *) proc_create(conf_name,
                                                 S_IFREG | S_IRUGO | S_IWUSR,
-                                                hysdn_proc_entry)) != NULL) {
+                                                hysdn_proc_entry,
+                                                &conf_fops)) != NULL) {
                         hysdn_proclog_init(card);       /* init the log file entry */
                 }
                 card = card->next;      /* next entry */
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index 2bc9bf7e88e..8080249957a 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -85,27 +85,34 @@ static unsigned desc_size(const struct lguest_device_desc *desc)
                 + desc->config_len;
 }
 
-/* This tests (and acknowleges) a feature bit. */
-static bool lg_feature(struct virtio_device *vdev, unsigned fbit)
+/* This gets the device's feature bits. */
+static u32 lg_get_features(struct virtio_device *vdev)
 {
+        unsigned int i;
+        u32 features = 0;
         struct lguest_device_desc *desc = to_lgdev(vdev)->desc;
-        u8 *features;
-
-        /* Obviously if they ask for a feature off the end of our feature
-         * bitmap, it's not set. */
-        if (fbit / 8 > desc->feature_len)
-                return false;
-
-        /* The feature bitmap comes after the virtqueues. */
-        features = lg_features(desc);
-        if (!(features[fbit / 8] & (1 << (fbit % 8))))
-                return false;
-
-        /* We set the matching bit in the other half of the bitmap to tell the
-         * Host we want to use this feature.  We don't use this yet, but we
-         * could in future. */
-        features[desc->feature_len + fbit / 8] |= (1 << (fbit % 8));
-        return true;
+        u8 *in_features = lg_features(desc);
+
+        /* We do this the slow but generic way. */
+        for (i = 0; i < min(desc->feature_len * 8, 32); i++)
+                if (in_features[i / 8] & (1 << (i % 8)))
+                        features |= (1 << i);
+
+        return features;
+}
+
+static void lg_set_features(struct virtio_device *vdev, u32 features)
+{
+        unsigned int i;
+        struct lguest_device_desc *desc = to_lgdev(vdev)->desc;
+        /* Second half of bitmap is features we accept. */
+        u8 *out_features = lg_features(desc) + desc->feature_len;
+
+        memset(out_features, 0, desc->feature_len);
+        for (i = 0; i < min(desc->feature_len * 8, 32); i++) {
+                if (features & (1 << i))
+                        out_features[i / 8] |= (1 << (i % 8));
+        }
 }
 
 /* Once they've found a field, getting a copy of it is easy. */
@@ -137,20 +144,26 @@ static u8 lg_get_status(struct virtio_device *vdev)
         return to_lgdev(vdev)->desc->status;
 }
 
+/* To notify on status updates, we (ab)use the NOTIFY hypercall, with the
+ * descriptor address of the device.  A zero status means "reset". */
+static void set_status(struct virtio_device *vdev, u8 status)
+{
+        unsigned long offset = (void *)to_lgdev(vdev)->desc - lguest_devices;
+
+        /* We set the status. */
+        to_lgdev(vdev)->desc->status = status;
+        hcall(LHCALL_NOTIFY, (max_pfn<<PAGE_SHIFT) + offset, 0, 0);
+}
+
 static void lg_set_status(struct virtio_device *vdev, u8 status)
 {
         BUG_ON(!status);
-        to_lgdev(vdev)->desc->status = status;
+        set_status(vdev, status);
 }
 
-/* To reset the device, we (ab)use the NOTIFY hypercall, with the descriptor
- * address of the device.  The Host will zero the status and all the
- * features. */
 static void lg_reset(struct virtio_device *vdev)
 {
-        unsigned long offset = (void *)to_lgdev(vdev)->desc - lguest_devices;
-
-        hcall(LHCALL_NOTIFY, (max_pfn<<PAGE_SHIFT) + offset, 0, 0);
+        set_status(vdev, 0);
 }
 
 /*
@@ -286,7 +299,8 @@ static void lg_del_vq(struct virtqueue *vq)
 
 /* The ops structure which hooks everything together. */
 static struct virtio_config_ops lguest_config_ops = {
-        .feature = lg_feature,
+        .get_features = lg_get_features,
+        .set_features = lg_set_features,
         .get = lg_get,
         .set = lg_set,
         .get_status = lg_get_status,
diff --git a/drivers/lguest/lguest_user.c b/drivers/lguest/lguest_user.c
index 645e6e040bf..e73a000473c 100644
--- a/drivers/lguest/lguest_user.c
+++ b/drivers/lguest/lguest_user.c
@@ -102,7 +102,7 @@ static ssize_t read(struct file *file, char __user *user, size_t size,loff_t*o)
 static int lg_cpu_start(struct lg_cpu *cpu, unsigned id, unsigned long start_ip)
 {
         /* We have a limited number the number of CPUs in the lguest struct. */
-        if (id >= NR_CPUS)
+        if (id >= ARRAY_SIZE(cpu->lg->cpus))
                 return -EINVAL;
 
         /* Set up this CPU's id, and pointer back to the lguest struct. */
@@ -251,8 +251,6 @@ static ssize_t write(struct file *file, const char __user *in,
                 if (!lg || (cpu_id >= lg->nr_cpus))
                         return -EINVAL;
                 cpu = &lg->cpus[cpu_id];
-                if (!cpu)
-                        return -EINVAL;
 
                 /* Once the Guest is dead, you can only read() why it died. */
                 if (lg->dead)
diff --git a/drivers/macintosh/adb.c b/drivers/macintosh/adb.c
index 20978205cd0..b8b9e44f7f4 100644
--- a/drivers/macintosh/adb.c
+++ b/drivers/macintosh/adb.c
@@ -37,7 +37,7 @@
 #include <linux/device.h>
 #include <linux/kthread.h>
 #include <linux/platform_device.h>
-#include <linux/semaphore.h>
+#include <linux/mutex.h>
 
 #include <asm/uaccess.h>
 #ifdef CONFIG_PPC
@@ -102,7 +102,7 @@ static struct adb_handler {
 } adb_handler[16];
 
 /*
- * The adb_handler_sem mutex protects all accesses to the original_address
+ * The adb_handler_mutex mutex protects all accesses to the original_address
  * and handler_id fields of adb_handler[i] for all i, and changes to the
  * handler field.
  * Accesses to the handler field are protected by the adb_handler_lock
@@ -110,7 +110,7 @@ static struct adb_handler {
  * time adb_unregister returns, we know that the old handler isn't being
  * called.
  */
-static DECLARE_MUTEX(adb_handler_sem);
+static DEFINE_MUTEX(adb_handler_mutex);
 static DEFINE_RWLOCK(adb_handler_lock);
 
 #if 0
@@ -355,7 +355,7 @@ do_adb_reset_bus(void)
                 msleep(500);
         }
 
-        down(&adb_handler_sem);
+        mutex_lock(&adb_handler_mutex);
         write_lock_irq(&adb_handler_lock);
         memset(adb_handler, 0, sizeof(adb_handler));
         write_unlock_irq(&adb_handler_lock);
@@ -376,7 +376,7 @@ do_adb_reset_bus(void)
                 if (adb_controller->autopoll)
                         adb_controller->autopoll(autopoll_devs);
         }
-        up(&adb_handler_sem);
+        mutex_unlock(&adb_handler_mutex);
 
         blocking_notifier_call_chain(&adb_client_list,
                 ADB_MSG_POST_RESET, NULL);
@@ -454,7 +454,7 @@ adb_register(int default_id, int handler_id, struct adb_ids *ids,
 {
         int i;
 
-        down(&adb_handler_sem);
+        mutex_lock(&adb_handler_mutex);
         ids->nids = 0;
         for (i = 1; i < 16; i++) {
                 if ((adb_handler[i].original_address == default_id) &&
@@ -472,7 +472,7 @@ adb_register(int default_id, int handler_id, struct adb_ids *ids,
                         ids->id[ids->nids++] = i;
                 }
         }
-        up(&adb_handler_sem);
+        mutex_unlock(&adb_handler_mutex);
         return ids->nids;
 }
 
@@ -481,7 +481,7 @@ adb_unregister(int index)
 {
         int ret = -ENODEV;
 
-        down(&adb_handler_sem);
+        mutex_lock(&adb_handler_mutex);
         write_lock_irq(&adb_handler_lock);
         if (adb_handler[index].handler) {
                 while(adb_handler[index].busy) {
@@ -493,7 +493,7 @@ adb_unregister(int index)
                 adb_handler[index].handler = NULL;
         }
         write_unlock_irq(&adb_handler_lock);
-        up(&adb_handler_sem);
+        mutex_unlock(&adb_handler_mutex);
         return ret;
 }
 
@@ -557,19 +557,19 @@ adb_try_handler_change(int address, int new_id)
 {
         int ret;
 
-        down(&adb_handler_sem);
+        mutex_lock(&adb_handler_mutex);
         ret = try_handler_change(address, new_id);
-        up(&adb_handler_sem);
+        mutex_unlock(&adb_handler_mutex);
         return ret;
 }
 
 int
 adb_get_infos(int address, int *original_address, int *handler_id)
 {
-        down(&adb_handler_sem);
+        mutex_lock(&adb_handler_mutex);
         *original_address = adb_handler[address].original_address;
         *handler_id = adb_handler[address].handler_id;
-        up(&adb_handler_sem);
+        mutex_unlock(&adb_handler_mutex);
 
         return (*original_address != 0);
 }
@@ -628,10 +628,10 @@ do_adb_query(struct adb_request *req)
         case ADB_QUERY_GETDEVINFO:
                 if (req->nbytes < 3)
                         break;
-                down(&adb_handler_sem);
+                mutex_lock(&adb_handler_mutex);
                 req->reply[0] = adb_handler[req->data[2]].original_address;
                 req->reply[1] = adb_handler[req->data[2]].handler_id;
-                up(&adb_handler_sem);
+                mutex_unlock(&adb_handler_mutex);
                 req->complete = 1;
                 req->reply_len = 2;
                 adb_write_done(req);
diff --git a/drivers/macintosh/therm_pm72.c b/drivers/macintosh/therm_pm72.c
index 1e0a69a5e81..ddfb426a9ab 100644
--- a/drivers/macintosh/therm_pm72.c
+++ b/drivers/macintosh/therm_pm72.c
@@ -122,6 +122,7 @@
 #include <linux/kmod.h>
 #include <linux/i2c.h>
 #include <linux/kthread.h>
+#include <linux/mutex.h>
 #include <asm/prom.h>
 #include <asm/machdep.h>
 #include <asm/io.h>
@@ -169,7 +170,7 @@ static int				rackmac;
 static s32                              dimm_output_clamp;
 static int                              fcu_rpm_shift;
 static int                              fcu_tickle_ticks;
-static DECLARE_MUTEX(driver_lock);
+static DEFINE_MUTEX(driver_lock);
 
 /*
  * We have 3 types of CPU PID control. One is "split" old style control
@@ -729,9 +730,9 @@ static void fetch_cpu_pumps_minmax(void)
 static ssize_t show_##name(struct device *dev, struct device_attribute *attr, char *buf)        \
 {                                                               \
         ssize_t r;                                              \
-        down(&driver_lock);                                     \
+        mutex_lock(&driver_lock);                                       \
         r = sprintf(buf, "%d.%03d", FIX32TOPRINT(data));        \
-        up(&driver_lock);                                       \
+        mutex_unlock(&driver_lock);                                     \
         return r;                                               \
 }
 #define BUILD_SHOW_FUNC_INT(name, data)                         \
@@ -1803,11 +1804,11 @@ static int main_control_loop(void *x)
 {
         DBG("main_control_loop started\n");
 
-        down(&driver_lock);
+        mutex_lock(&driver_lock);
 
         if (start_fcu() < 0) {
                 printk(KERN_ERR "kfand: failed to start FCU\n");
-                up(&driver_lock);
+                mutex_unlock(&driver_lock);
                 goto out;
         }
 
@@ -1822,14 +1823,14 @@ static int main_control_loop(void *x)
 
         fcu_tickle_ticks = FCU_TICKLE_TICKS;
 
-        up(&driver_lock);
+        mutex_unlock(&driver_lock);
 
         while (state == state_attached) {
                 unsigned long elapsed, start;
 
                 start = jiffies;
 
-                down(&driver_lock);
+                mutex_lock(&driver_lock);
 
                 /* Tickle the FCU just in case */
                 if (--fcu_tickle_ticks < 0) {
@@ -1861,7 +1862,7 @@ static int main_control_loop(void *x)
                         do_monitor_slots(&slots_state);
                 else
                         do_monitor_drives(&drives_state);
-                up(&driver_lock);
+                mutex_unlock(&driver_lock);
 
                 if (critical_state == 1) {
                         printk(KERN_WARNING "Temperature control detected a critical condition\n");
@@ -2019,13 +2020,13 @@ static void detach_fcu(void)
  */
 static int therm_pm72_attach(struct i2c_adapter *adapter)
 {
-        down(&driver_lock);
+        mutex_lock(&driver_lock);
 
         /* Check state */
         if (state == state_detached)
                 state = state_attaching;
         if (state != state_attaching) {
-                up(&driver_lock);
+                mutex_unlock(&driver_lock);
                 return 0;
         }
 
@@ -2054,7 +2055,7 @@ static int therm_pm72_attach(struct i2c_adapter *adapter)
                 state = state_attached;
                 start_control_loops();
         }
-        up(&driver_lock);
+        mutex_unlock(&driver_lock);
 
         return 0;
 }
@@ -2065,16 +2066,16 @@ static int therm_pm72_attach(struct i2c_adapter *adapter)
  */
 static int therm_pm72_detach(struct i2c_adapter *adapter)
 {
-        down(&driver_lock);
+        mutex_lock(&driver_lock);
 
         if (state != state_detached)
                 state = state_detaching;
 
         /* Stop control loops if any */
         DBG("stopping control loops\n");
-        up(&driver_lock);
+        mutex_unlock(&driver_lock);
         stop_control_loops();
-        down(&driver_lock);
+        mutex_lock(&driver_lock);
 
         if (u3_0 != NULL && !strcmp(adapter->name, "u3 0")) {
                 DBG("lost U3-0, disposing control loops\n");
@@ -2090,7 +2091,7 @@ static int therm_pm72_detach(struct i2c_adapter *adapter)
         if (u3_0 == NULL && u3_1 == NULL)
                 state = state_detached;
 
-        up(&driver_lock);
+        mutex_unlock(&driver_lock);
 
         return 0;
 }
diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
index 797918d0e59..7f2be4baaed 100644
--- a/drivers/macintosh/windfarm_smu_sat.c
+++ b/drivers/macintosh/windfarm_smu_sat.c
@@ -13,7 +13,7 @@
 #include <linux/init.h>
 #include <linux/wait.h>
 #include <linux/i2c.h>
-#include <linux/semaphore.h>
+#include <linux/mutex.h>
 #include <asm/prom.h>
 #include <asm/smu.h>
 #include <asm/pmac_low_i2c.h>
@@ -36,7 +36,7 @@
 struct wf_sat {
         int                     nr;
         atomic_t                refcnt;
-        struct semaphore        mutex;
+        struct mutex            mutex;
         unsigned long           last_read; /* jiffies when cache last updated */
         u8                      cache[16];
         struct i2c_client       i2c;
@@ -163,7 +163,7 @@ static int wf_sat_get(struct wf_sensor *sr, s32 *value)
         if (sat->i2c.adapter == NULL)
                 return -ENODEV;
 
-        down(&sat->mutex);
+        mutex_lock(&sat->mutex);
         if (time_after(jiffies, (sat->last_read + MAX_AGE))) {
                 err = wf_sat_read_cache(sat);
                 if (err)
@@ -182,7 +182,7 @@ static int wf_sat_get(struct wf_sensor *sr, s32 *value)
         err = 0;
 
  fail:
-        up(&sat->mutex);
+        mutex_unlock(&sat->mutex);
         return err;
 }
 
@@ -233,7 +233,7 @@ static void wf_sat_create(struct i2c_adapter *adapter, struct device_node *dev)
         sat->nr = -1;
         sat->node = of_node_get(dev);
         atomic_set(&sat->refcnt, 0);
-        init_MUTEX(&sat->mutex);
+        mutex_init(&sat->mutex);
         sat->i2c.addr = (addr >> 1) & 0x7f;
         sat->i2c.adapter = adapter;
         sat->i2c.driver = &wf_sat_driver;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 5938fa96292..faf3d891297 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -886,7 +886,7 @@ static int make_request(struct request_queue *q, struct bio * bio)
          */
         raid10_find_phys(conf, r10_bio);
  retry_write:
-        blocked_rdev = 0;
+        blocked_rdev = NULL;
         rcu_read_lock();
         for (i = 0;  i < conf->copies; i++) {
                 int d = r10_bio->devs[i].devnum;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 087eee0cb80..ee0ea918308 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2369,8 +2369,8 @@ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
 
         /* complete a check operation */
         if (test_and_clear_bit(STRIPE_OP_CHECK, &sh->ops.complete)) {
-            clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
-            clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
+                clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
+                clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
                 if (s->failed == 0) {
                         if (sh->ops.zero_sum_result == 0)
                                 /* parity is correct (on disc,
@@ -2400,16 +2400,6 @@ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
                         canceled_check = 1; /* STRIPE_INSYNC is not set */
         }
 
-        /* check if we can clear a parity disk reconstruct */
-        if (test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete) &&
-                test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
-
-                clear_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending);
-                clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete);
-                clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.ack);
-                clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
-        }
-
         /* start a new check operation if there are no failures, the stripe is
          * not insync, and a repair is not in flight
          */
@@ -2424,6 +2414,17 @@ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
                 }
         }
 
+        /* check if we can clear a parity disk reconstruct */
+        if (test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete) &&
+            test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
+
+                clear_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending);
+                clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.complete);
+                clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.ack);
+                clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
+        }
+
+
         /* Wait for check parity and compute block operations to complete
          * before write-back.  If a failure occurred while the check operation
          * was in flight we need to cycle this stripe through handle_stripe
diff --git a/drivers/media/Makefile b/drivers/media/Makefile
index 73f742c7e81..cc11c4c0e7e 100644
--- a/drivers/media/Makefile
+++ b/drivers/media/Makefile
@@ -2,6 +2,8 @@
 # Makefile for the kernel multimedia device drivers.
 #
 
+obj-y := common/
+
 obj-$(CONFIG_VIDEO_MEDIA) += common/
 
 # Since hybrid devices are here, should be compiled if DVB and/or V4L
diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
index 8f5ed9b4bf8..3f55d47bc4b 100644
--- a/drivers/media/video/cx18/cx18-driver.c
+++ b/drivers/media/video/cx18/cx18-driver.c
@@ -613,7 +613,7 @@ static int __devinit cx18_probe(struct pci_dev *dev,
         }
 
         cx = kzalloc(sizeof(struct cx18), GFP_ATOMIC);
-        if (cx == 0) {
+        if (!cx) {
                 spin_unlock(&cx18_cards_lock);
                 return -ENOMEM;
         }
diff --git a/drivers/media/video/saa7134/saa7134-video.c b/drivers/media/video/saa7134/saa7134-video.c
index a0baf2d0ba7..48e1a01718e 100644
--- a/drivers/media/video/saa7134/saa7134-video.c
+++ b/drivers/media/video/saa7134/saa7134-video.c
@@ -1634,7 +1634,7 @@ static int saa7134_s_fmt_overlay(struct file *file, void *priv,
         struct saa7134_fh *fh = priv;
         struct saa7134_dev *dev = fh->dev;
         int err;
-        unsigned int flags;
+        unsigned long flags;
 
         if (saa7134_no_overlay > 0) {
                 printk(KERN_ERR "V4L2_BUF_TYPE_VIDEO_OVERLAY: no_overlay\n");
diff --git a/drivers/media/video/tcm825x.c b/drivers/media/video/tcm825x.c
index e57a6460577..8f0100f67a9 100644
--- a/drivers/media/video/tcm825x.c
+++ b/drivers/media/video/tcm825x.c
@@ -885,12 +885,19 @@ static int __exit tcm825x_remove(struct i2c_client *client)
         return 0;
 }
 
+static const struct i2c_device_id tcm825x_id[] = {
+        { "tcm825x", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, tcm825x_id);
+
 static struct i2c_driver tcm825x_i2c_driver = {
         .driver = {
                 .name = TCM825X_NAME,
         },
         .probe  = tcm825x_probe,
         .remove = __exit_p(tcm825x_remove),
+        .id_table = tcm825x_id,
 };
 
 static struct tcm825x_sensor tcm825x = {
diff --git a/drivers/media/video/tlv320aic23b.c b/drivers/media/video/tlv320aic23b.c
index f1db54202de..28ab9f9d760 100644
--- a/drivers/media/video/tlv320aic23b.c
+++ b/drivers/media/video/tlv320aic23b.c
@@ -168,6 +168,11 @@ static int tlv320aic23b_remove(struct i2c_client *client)
 
 /* ----------------------------------------------------------------------- */
 
+static const struct i2c_device_id tlv320aic23b_id[] = {
+        { "tlv320aic23b", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, tlv320aic23b_id);
 
 static struct v4l2_i2c_driver_data v4l2_i2c_data = {
         .name = "tlv320aic23b",
@@ -175,4 +180,5 @@ static struct v4l2_i2c_driver_data v4l2_i2c_data = {
         .command = tlv320aic23b_command,
         .probe = tlv320aic23b_probe,
         .remove = tlv320aic23b_remove,
+        .id_table = tlv320aic23b_id,
 };
diff --git a/drivers/media/video/tvaudio.c b/drivers/media/video/tvaudio.c
index 6f9945b04e1..c77914d99d1 100644
--- a/drivers/media/video/tvaudio.c
+++ b/drivers/media/video/tvaudio.c
@@ -1505,7 +1505,8 @@ static int chip_probe(struct i2c_client *client, const struct i2c_device_id *id)
         }
 
         /* fill required data structures */
-        strcpy(client->name, desc->name);
+        if (!id)
+                strlcpy(client->name, desc->name, I2C_NAME_SIZE);
         chip->type = desc-chiplist;
         chip->shadow.count = desc->registers+1;
         chip->prevmode = -1;
@@ -1830,6 +1831,15 @@ static int chip_legacy_probe(struct i2c_adapter *adap)
         return 0;
 }
 
+/* This driver supports many devices and the idea is to let the driver
+   detect which device is present. So rather than listing all supported
+   devices here, we pretend to support a single, fake device type. */
+static const struct i2c_device_id chip_id[] = {
+        { "tvaudio", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, chip_id);
+
 static struct v4l2_i2c_driver_data v4l2_i2c_data = {
         .name = "tvaudio",
         .driverid = I2C_DRIVERID_TVAUDIO,
@@ -1837,6 +1847,7 @@ static struct v4l2_i2c_driver_data v4l2_i2c_data = {
         .probe = chip_probe,
         .remove = chip_remove,
         .legacy_probe = chip_legacy_probe,
+        .id_table = chip_id,
 };
 
 /*
diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
index 30a1af857c7..fa394104339 100644
--- a/drivers/misc/kgdbts.c
+++ b/drivers/misc/kgdbts.c
@@ -47,6 +47,7 @@
  *       to test the HW NMI watchdog
  * F## = Break at do_fork for ## iterations
  * S## = Break at sys_open for ## iterations
+ * I## = Run the single step test ## iterations
  *
  * NOTE: that the do_fork and sys_open tests are mutually exclusive.
  *
@@ -375,7 +376,7 @@ static void emul_sstep_get(char *arg)
                 break;
         case 1:
                 /* set breakpoint */
-                break_helper("Z0", 0, sstep_addr);
+                break_helper("Z0", NULL, sstep_addr);
                 break;
         case 2:
                 /* Continue */
@@ -383,7 +384,7 @@ static void emul_sstep_get(char *arg)
                 break;
         case 3:
                 /* Clear breakpoint */
-                break_helper("z0", 0, sstep_addr);
+                break_helper("z0", NULL, sstep_addr);
                 break;
         default:
                 eprintk("kgdbts: ERROR failed sstep get emulation\n");
@@ -465,11 +466,11 @@ static struct test_struct sw_breakpoint_test[] = {
         { "?", "S0*" }, /* Clear break points */
         { "kgdbts_break_test", "OK", sw_break, }, /* set sw breakpoint */
         { "c", "T0*", }, /* Continue */
-        { "g", "kgdbts_break_test", 0, check_and_rewind_pc },
+        { "g", "kgdbts_break_test", NULL, check_and_rewind_pc },
         { "write", "OK", write_regs },
         { "kgdbts_break_test", "OK", sw_rem_break }, /*remove breakpoint */
         { "D", "OK" }, /* Detach */
-        { "D", "OK", 0,  got_break }, /* If the test worked we made it here */
+        { "D", "OK", NULL,  got_break }, /* On success we made it here */
         { "", "" },
 };
 
@@ -499,14 +500,14 @@ static struct test_struct singlestep_break_test[] = {
         { "?", "S0*" }, /* Clear break points */
         { "kgdbts_break_test", "OK", sw_break, }, /* set sw breakpoint */
         { "c", "T0*", }, /* Continue */
-        { "g", "kgdbts_break_test", 0, check_and_rewind_pc },
+        { "g", "kgdbts_break_test", NULL, check_and_rewind_pc },
         { "write", "OK", write_regs }, /* Write registers */
         { "kgdbts_break_test", "OK", sw_rem_break }, /*remove breakpoint */
         { "s", "T0*", emul_sstep_get, emul_sstep_put }, /* Single step */
-        { "g", "kgdbts_break_test", 0, check_single_step },
+        { "g", "kgdbts_break_test", NULL, check_single_step },
         { "kgdbts_break_test", "OK", sw_break, }, /* set sw breakpoint */
         { "c", "T0*", }, /* Continue */
-        { "g", "kgdbts_break_test", 0, check_and_rewind_pc },
+        { "g", "kgdbts_break_test", NULL, check_and_rewind_pc },
         { "write", "OK", write_regs }, /* Write registers */
         { "D", "OK" }, /* Remove all breakpoints and continues */
         { "", "" },
@@ -520,14 +521,14 @@ static struct test_struct do_fork_test[] = {
         { "?", "S0*" }, /* Clear break points */
         { "do_fork", "OK", sw_break, }, /* set sw breakpoint */
         { "c", "T0*", }, /* Continue */
-        { "g", "do_fork", 0, check_and_rewind_pc }, /* check location */
+        { "g", "do_fork", NULL, check_and_rewind_pc }, /* check location */
         { "write", "OK", write_regs }, /* Write registers */
         { "do_fork", "OK", sw_rem_break }, /*remove breakpoint */
         { "s", "T0*", emul_sstep_get, emul_sstep_put }, /* Single step */
-        { "g", "do_fork", 0, check_single_step },
+        { "g", "do_fork", NULL, check_single_step },
         { "do_fork", "OK", sw_break, }, /* set sw breakpoint */
         { "7", "T0*", skip_back_repeat_test }, /* Loop based on repeat_test */
-        { "D", "OK", 0, final_ack_set }, /* detach and unregister I/O */
+        { "D", "OK", NULL, final_ack_set }, /* detach and unregister I/O */
         { "", "" },
 };
 
@@ -538,14 +539,14 @@ static struct test_struct sys_open_test[] = {
         { "?", "S0*" }, /* Clear break points */
         { "sys_open", "OK", sw_break, }, /* set sw breakpoint */
         { "c", "T0*", }, /* Continue */
-        { "g", "sys_open", 0, check_and_rewind_pc }, /* check location */
+        { "g", "sys_open", NULL, check_and_rewind_pc }, /* check location */
         { "write", "OK", write_regs }, /* Write registers */
         { "sys_open", "OK", sw_rem_break }, /*remove breakpoint */
         { "s", "T0*", emul_sstep_get, emul_sstep_put }, /* Single step */
-        { "g", "sys_open", 0, check_single_step },
+        { "g", "sys_open", NULL, check_single_step },
         { "sys_open", "OK", sw_break, }, /* set sw breakpoint */
         { "7", "T0*", skip_back_repeat_test }, /* Loop based on repeat_test */
-        { "D", "OK", 0, final_ack_set }, /* detach and unregister I/O */
+        { "D", "OK", NULL, final_ack_set }, /* detach and unregister I/O */
         { "", "" },
 };
 
@@ -556,11 +557,11 @@ static struct test_struct hw_breakpoint_test[] = {
         { "?", "S0*" }, /* Clear break points */
         { "kgdbts_break_test", "OK", hw_break, }, /* set hw breakpoint */
         { "c", "T0*", }, /* Continue */
-        { "g", "kgdbts_break_test", 0, check_and_rewind_pc },
+        { "g", "kgdbts_break_test", NULL, check_and_rewind_pc },
         { "write", "OK", write_regs },
         { "kgdbts_break_test", "OK", hw_rem_break }, /*remove breakpoint */
         { "D", "OK" }, /* Detach */
-        { "D", "OK", 0,  got_break }, /* If the test worked we made it here */
+        { "D", "OK", NULL,  got_break }, /* On success we made it here */
         { "", "" },
 };
 
@@ -570,12 +571,12 @@ static struct test_struct hw_breakpoint_test[] = {
 static struct test_struct hw_write_break_test[] = {
         { "?", "S0*" }, /* Clear break points */
         { "hw_break_val", "OK", hw_write_break, }, /* set hw breakpoint */
-        { "c", "T0*", 0, got_break }, /* Continue */
-        { "g", "silent", 0, check_and_rewind_pc },
+        { "c", "T0*", NULL, got_break }, /* Continue */
+        { "g", "silent", NULL, check_and_rewind_pc },
         { "write", "OK", write_regs },
         { "hw_break_val", "OK", hw_rem_write_break }, /*remove breakpoint */
         { "D", "OK" }, /* Detach */
-        { "D", "OK", 0,  got_break }, /* If the test worked we made it here */
+        { "D", "OK", NULL,  got_break }, /* On success we made it here */
         { "", "" },
 };
 
@@ -585,12 +586,12 @@ static struct test_struct hw_write_break_test[] = {
 static struct test_struct hw_access_break_test[] = {
         { "?", "S0*" }, /* Clear break points */
         { "hw_break_val", "OK", hw_access_break, }, /* set hw breakpoint */
-        { "c", "T0*", 0, got_break }, /* Continue */
-        { "g", "silent", 0, check_and_rewind_pc },
+        { "c", "T0*", NULL, got_break }, /* Continue */
+        { "g", "silent", NULL, check_and_rewind_pc },
         { "write", "OK", write_regs },
         { "hw_break_val", "OK", hw_rem_access_break }, /*remove breakpoint */
         { "D", "OK" }, /* Detach */
-        { "D", "OK", 0,  got_break }, /* If the test worked we made it here */
+        { "D", "OK", NULL,  got_break }, /* On success we made it here */
         { "", "" },
 };
 
@@ -599,9 +600,9 @@ static struct test_struct hw_access_break_test[] = {
  */
 static struct test_struct nmi_sleep_test[] = {
         { "?", "S0*" }, /* Clear break points */
-        { "c", "T0*", 0, got_break }, /* Continue */
+        { "c", "T0*", NULL, got_break }, /* Continue */
         { "D", "OK" }, /* Detach */
-        { "D", "OK", 0,  got_break }, /* If the test worked we made it here */
+        { "D", "OK", NULL,  got_break }, /* On success we made it here */
         { "", "" },
 };
 
@@ -874,18 +875,23 @@ static void kgdbts_run_tests(void)
 {
         char *ptr;
         int fork_test = 0;
-        int sys_open_test = 0;
+        int do_sys_open_test = 0;
+        int sstep_test = 1000;
         int nmi_sleep = 0;
+        int i;
 
         ptr = strstr(config, "F");
         if (ptr)
-                fork_test = simple_strtol(ptr+1, NULL, 10);
+                fork_test = simple_strtol(ptr + 1, NULL, 10);
         ptr = strstr(config, "S");
         if (ptr)
-                sys_open_test = simple_strtol(ptr+1, NULL, 10);
+                do_sys_open_test = simple_strtol(ptr + 1, NULL, 10);
         ptr = strstr(config, "N");
         if (ptr)
                 nmi_sleep = simple_strtol(ptr+1, NULL, 10);
+        ptr = strstr(config, "I");
+        if (ptr)
+                sstep_test = simple_strtol(ptr+1, NULL, 10);
 
         /* required internal KGDB tests */
         v1printk("kgdbts:RUN plant and detach test\n");
@@ -894,8 +900,13 @@ static void kgdbts_run_tests(void)
         run_breakpoint_test(0);
         v1printk("kgdbts:RUN bad memory access test\n");
         run_bad_read_test();
-        v1printk("kgdbts:RUN singlestep breakpoint test\n");
-        run_singlestep_break_test();
+        v1printk("kgdbts:RUN singlestep test %i iterations\n", sstep_test);
+        for (i = 0; i < sstep_test; i++) {
+                run_singlestep_break_test();
+                if (i % 100 == 0)
+                        v1printk("kgdbts:RUN singlestep [%i/%i]\n",
+                                 i, sstep_test);
+        }
 
         /* ===Optional tests=== */
 
@@ -922,7 +933,7 @@ static void kgdbts_run_tests(void)
                 repeat_test = fork_test;
                 printk(KERN_INFO "kgdbts:RUN do_fork for %i breakpoints\n",
                         repeat_test);
-                kthread_run(kgdbts_unreg_thread, 0, "kgdbts_unreg");
+                kthread_run(kgdbts_unreg_thread, NULL, "kgdbts_unreg");
                 run_do_fork_test();
                 return;
         }
@@ -931,11 +942,11 @@ static void kgdbts_run_tests(void)
          * executed because a kernel thread will be spawned at the very
          * end to unregister the debug hooks.
          */
-        if (sys_open_test) {
-                repeat_test = sys_open_test;
+        if (do_sys_open_test) {
+                repeat_test = do_sys_open_test;
                 printk(KERN_INFO "kgdbts:RUN sys_open for %i breakpoints\n",
                         repeat_test);
-                kthread_run(kgdbts_unreg_thread, 0, "kgdbts_unreg");
+                kthread_run(kgdbts_unreg_thread, NULL, "kgdbts_unreg");
                 run_sys_open_test();
                 return;
         }
diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
index 5515234be86..03a87a307e3 100644
--- a/drivers/misc/sgi-xp/xp.h
+++ b/drivers/misc/sgi-xp/xp.h
@@ -157,215 +157,136 @@ struct xpc_msg {
 /*
  * Define the return values and values passed to user's callout functions.
  * (It is important to add new value codes at the end just preceding
- * xpcUnknownReason, which must have the highest numerical value.)
+ * xpUnknownReason, which must have the highest numerical value.)
  */
-enum xpc_retval {
-        xpcSuccess = 0,
+enum xp_retval {
+        xpSuccess = 0,
 
-        xpcNotConnected,        /*  1: channel is not connected */
-        xpcConnected,           /*  2: channel connected (opened) */
-        xpcRETIRED1,            /*  3: (formerly xpcDisconnected) */
+        xpNotConnected,         /*  1: channel is not connected */
+        xpConnected,            /*  2: channel connected (opened) */
+        xpRETIRED1,             /*  3: (formerly xpDisconnected) */
 
-        xpcMsgReceived,         /*  4: message received */
-        xpcMsgDelivered,        /*  5: message delivered and acknowledged */
+        xpMsgReceived,          /*  4: message received */
+        xpMsgDelivered,         /*  5: message delivered and acknowledged */
 
-        xpcRETIRED2,            /*  6: (formerly xpcTransferFailed) */
+        xpRETIRED2,             /*  6: (formerly xpTransferFailed) */
 
-        xpcNoWait,              /*  7: operation would require wait */
-        xpcRetry,               /*  8: retry operation */
-        xpcTimeout,             /*  9: timeout in xpc_allocate_msg_wait() */
-        xpcInterrupted,         /* 10: interrupted wait */
+        xpNoWait,               /*  7: operation would require wait */
+        xpRetry,                /*  8: retry operation */
+        xpTimeout,              /*  9: timeout in xpc_allocate_msg_wait() */
+        xpInterrupted,          /* 10: interrupted wait */
 
-        xpcUnequalMsgSizes,     /* 11: message size disparity between sides */
-        xpcInvalidAddress,      /* 12: invalid address */
+        xpUnequalMsgSizes,      /* 11: message size disparity between sides */
+        xpInvalidAddress,       /* 12: invalid address */
 
-        xpcNoMemory,            /* 13: no memory available for XPC structures */
-        xpcLackOfResources,     /* 14: insufficient resources for operation */
-        xpcUnregistered,        /* 15: channel is not registered */
-        xpcAlreadyRegistered,   /* 16: channel is already registered */
+        xpNoMemory,             /* 13: no memory available for XPC structures */
+        xpLackOfResources,      /* 14: insufficient resources for operation */
+        xpUnregistered,         /* 15: channel is not registered */
+        xpAlreadyRegistered,    /* 16: channel is already registered */
 
-        xpcPartitionDown,       /* 17: remote partition is down */
-        xpcNotLoaded,           /* 18: XPC module is not loaded */
-        xpcUnloading,           /* 19: this side is unloading XPC module */
+        xpPartitionDown,        /* 17: remote partition is down */
+        xpNotLoaded,            /* 18: XPC module is not loaded */
+        xpUnloading,            /* 19: this side is unloading XPC module */
 
-        xpcBadMagic,            /* 20: XPC MAGIC string not found */
+        xpBadMagic,             /* 20: XPC MAGIC string not found */
 
-        xpcReactivating,        /* 21: remote partition was reactivated */
+        xpReactivating,         /* 21: remote partition was reactivated */
 
-        xpcUnregistering,       /* 22: this side is unregistering channel */
-        xpcOtherUnregistering,  /* 23: other side is unregistering channel */
+        xpUnregistering,        /* 22: this side is unregistering channel */
+        xpOtherUnregistering,   /* 23: other side is unregistering channel */
 
-        xpcCloneKThread,        /* 24: cloning kernel thread */
-        xpcCloneKThreadFailed,  /* 25: cloning kernel thread failed */
+        xpCloneKThread,         /* 24: cloning kernel thread */
+        xpCloneKThreadFailed,   /* 25: cloning kernel thread failed */
 
-        xpcNoHeartbeat,         /* 26: remote partition has no heartbeat */
+        xpNoHeartbeat,          /* 26: remote partition has no heartbeat */
 
-        xpcPioReadError,        /* 27: PIO read error */
-        xpcPhysAddrRegFailed,   /* 28: registration of phys addr range failed */
+        xpPioReadError,         /* 27: PIO read error */
+        xpPhysAddrRegFailed,    /* 28: registration of phys addr range failed */
 
-        xpcBteDirectoryError,   /* 29: maps to BTEFAIL_DIR */
-        xpcBtePoisonError,      /* 30: maps to BTEFAIL_POISON */
-        xpcBteWriteError,       /* 31: maps to BTEFAIL_WERR */
-        xpcBteAccessError,      /* 32: maps to BTEFAIL_ACCESS */
-        xpcBtePWriteError,      /* 33: maps to BTEFAIL_PWERR */
-        xpcBtePReadError,       /* 34: maps to BTEFAIL_PRERR */
-        xpcBteTimeOutError,     /* 35: maps to BTEFAIL_TOUT */
-        xpcBteXtalkError,       /* 36: maps to BTEFAIL_XTERR */
-        xpcBteNotAvailable,     /* 37: maps to BTEFAIL_NOTAVAIL */
-        xpcBteUnmappedError,    /* 38: unmapped BTEFAIL_ error */
+        xpRETIRED3,             /* 29: (formerly xpBteDirectoryError) */
+        xpRETIRED4,             /* 30: (formerly xpBtePoisonError) */
+        xpRETIRED5,             /* 31: (formerly xpBteWriteError) */
+        xpRETIRED6,             /* 32: (formerly xpBteAccessError) */
+        xpRETIRED7,             /* 33: (formerly xpBtePWriteError) */
+        xpRETIRED8,             /* 34: (formerly xpBtePReadError) */
+        xpRETIRED9,             /* 35: (formerly xpBteTimeOutError) */
+        xpRETIRED10,            /* 36: (formerly xpBteXtalkError) */
+        xpRETIRED11,            /* 37: (formerly xpBteNotAvailable) */
+        xpRETIRED12,            /* 38: (formerly xpBteUnmappedError) */
 
-        xpcBadVersion,          /* 39: bad version number */
-        xpcVarsNotSet,          /* 40: the XPC variables are not set up */
-        xpcNoRsvdPageAddr,      /* 41: unable to get rsvd page's phys addr */
-        xpcInvalidPartid,       /* 42: invalid partition ID */
-        xpcLocalPartid,         /* 43: local partition ID */
+        xpBadVersion,           /* 39: bad version number */
+        xpVarsNotSet,           /* 40: the XPC variables are not set up */
+        xpNoRsvdPageAddr,       /* 41: unable to get rsvd page's phys addr */
+        xpInvalidPartid,        /* 42: invalid partition ID */
+        xpLocalPartid,          /* 43: local partition ID */
 
-        xpcOtherGoingDown,      /* 44: other side going down, reason unknown */
-        xpcSystemGoingDown,     /* 45: system is going down, reason unknown */
-        xpcSystemHalt,          /* 46: system is being halted */
-        xpcSystemReboot,        /* 47: system is being rebooted */
-        xpcSystemPoweroff,      /* 48: system is being powered off */
+        xpOtherGoingDown,       /* 44: other side going down, reason unknown */
+        xpSystemGoingDown,      /* 45: system is going down, reason unknown */
+        xpSystemHalt,           /* 46: system is being halted */
+        xpSystemReboot,         /* 47: system is being rebooted */
+        xpSystemPoweroff,       /* 48: system is being powered off */
 
-        xpcDisconnecting,       /* 49: channel disconnecting (closing) */
+        xpDisconnecting,        /* 49: channel disconnecting (closing) */
 
-        xpcOpenCloseError,      /* 50: channel open/close protocol error */
+        xpOpenCloseError,       /* 50: channel open/close protocol error */
 
-        xpcDisconnected,        /* 51: channel disconnected (closed) */
+        xpDisconnected,         /* 51: channel disconnected (closed) */
 
-        xpcBteSh2Start,         /* 52: BTE CRB timeout */
+        xpBteCopyError,         /* 52: bte_copy() returned error */
 
-                                /* 53: 0x1 BTE Error Response Short */
-        xpcBteSh2RspShort = xpcBteSh2Start + BTEFAIL_SH2_RESP_SHORT,
-
-                                /* 54: 0x2 BTE Error Response Long */
-        xpcBteSh2RspLong = xpcBteSh2Start + BTEFAIL_SH2_RESP_LONG,
-
-                                /* 56: 0x4 BTE Error Response DSB */
-        xpcBteSh2RspDSB = xpcBteSh2Start + BTEFAIL_SH2_RESP_DSP,
-
-                                /* 60: 0x8 BTE Error Response Access */
-        xpcBteSh2RspAccess = xpcBteSh2Start + BTEFAIL_SH2_RESP_ACCESS,
-
-                                /* 68: 0x10 BTE Error CRB timeout */
-        xpcBteSh2CRBTO = xpcBteSh2Start + BTEFAIL_SH2_CRB_TO,
-
-                                /* 84: 0x20 BTE Error NACK limit */
-        xpcBteSh2NACKLimit = xpcBteSh2Start + BTEFAIL_SH2_NACK_LIMIT,
-
-                                /* 115: BTE end */
-        xpcBteSh2End = xpcBteSh2Start + BTEFAIL_SH2_ALL,
-
-        xpcUnknownReason        /* 116: unknown reason - must be last in enum */
+        xpUnknownReason         /* 53: unknown reason - must be last in enum */
 };
 
 /*
- * Define the callout function types used by XPC to update the user on
- * connection activity and state changes (via the user function registered by
- * xpc_connect()) and to notify them of messages received and delivered (via
- * the user function registered by xpc_send_notify()).
- *
- * The two function types are xpc_channel_func and xpc_notify_func and
- * both share the following arguments, with the exception of "data", which
- * only xpc_channel_func has.
+ * Define the callout function type used by XPC to update the user on
+ * connection activity and state changes via the user function registered
+ * by xpc_connect().
  *
  * Arguments:
  *
- *      reason - reason code. (See following table.)
+ *      reason - reason code.
  *      partid - partition ID associated with condition.
  *      ch_number - channel # associated with condition.
- *      data - pointer to optional data. (See following table.)
+ *      data - pointer to optional data.
  *      key - pointer to optional user-defined value provided as the "key"
- *            argument to xpc_connect() or xpc_send_notify().
+ *            argument to xpc_connect().
  *
- * In the following table the "Optional Data" column applies to callouts made
- * to functions registered by xpc_connect(). A "NA" in that column indicates
- * that this reason code can be passed to functions registered by
- * xpc_send_notify() (i.e. they don't have data arguments).
+ * A reason code of xpConnected indicates that a connection has been
+ * established to the specified partition on the specified channel. The data
+ * argument indicates the max number of entries allowed in the message queue.
  *
- * Also, the first three reason codes in the following table indicate
- * success, whereas the others indicate failure. When a failure reason code
- * is received, one can assume that the channel is not connected.
+ * A reason code of xpMsgReceived indicates that a XPC message arrived from
+ * the specified partition on the specified channel. The data argument
+ * specifies the address of the message's payload. The user must call
+ * xpc_received() when finished with the payload.
  *
- *
- * Reason Code          | Cause                          | Optional Data
- * =====================+================================+=====================
- * xpcConnected         | connection has been established| max #of entries
- *                      | to the specified partition on  | allowed in message
- *                      | the specified channel          | queue
- * ---------------------+--------------------------------+---------------------
- * xpcMsgReceived       | an XPC message arrived from    | address of payload
- *                      | the specified partition on the |
- *                      | specified channel              | [the user must call
- *                      |                                | xpc_received() when
- *                      |                                | finished with the
- *                      |                                | payload]
- * ---------------------+--------------------------------+---------------------
- * xpcMsgDelivered      | notification that the message  | NA
- *                      | was delivered to the intended  |
- *                      | recipient and that they have   |
- *                      | acknowledged its receipt by    |
- *                      | calling xpc_received()         |
- * =====================+================================+=====================
- * xpcUnequalMsgSizes   | can't connect to the specified | NULL
- *                      | partition on the specified     |
- *                      | channel because of mismatched  |
- *                      | message sizes                  |
- * ---------------------+--------------------------------+---------------------
- * xpcNoMemory          | insufficient memory avaiable   | NULL
- *                      | to allocate message queue      |
- * ---------------------+--------------------------------+---------------------
- * xpcLackOfResources   | lack of resources to create    | NULL
- *                      | the necessary kthreads to      |
- *                      | support the channel            |
- * ---------------------+--------------------------------+---------------------
- * xpcUnregistering     | this side's user has           | NULL or NA
- *                      | unregistered by calling        |
- *                      | xpc_disconnect()               |
- * ---------------------+--------------------------------+---------------------
- * xpcOtherUnregistering| the other side's user has      | NULL or NA
- *                      | unregistered by calling        |
- *                      | xpc_disconnect()               |
- * ---------------------+--------------------------------+---------------------
- * xpcNoHeartbeat       | the other side's XPC is no     | NULL or NA
- *                      | longer heartbeating            |
- *                      |                                |
- * ---------------------+--------------------------------+---------------------
- * xpcUnloading         | this side's XPC module is      | NULL or NA
- *                      | being unloaded                 |
- *                      |                                |
- * ---------------------+--------------------------------+---------------------
- * xpcOtherUnloading    | the other side's XPC module is | NULL or NA
- *                      | is being unloaded              |
- *                      |                                |
- * ---------------------+--------------------------------+---------------------
- * xpcPioReadError      | xp_nofault_PIOR() returned an  | NULL or NA
- *                      | error while sending an IPI     |
- *                      |                                |
- * ---------------------+--------------------------------+---------------------
- * xpcInvalidAddress    | the address either received or | NULL or NA
- *                      | sent by the specified partition|
- *                      | is invalid                     |
- * ---------------------+--------------------------------+---------------------
- * xpcBteNotAvailable   | attempt to pull data from the  | NULL or NA
- * xpcBtePoisonError    | specified partition over the   |
- * xpcBteWriteError     | specified channel via a        |
- * xpcBteAccessError    | bte_copy() failed              |
- * xpcBteTimeOutError   |                                |
- * xpcBteXtalkError     |                                |
- * xpcBteDirectoryError |                                |
- * xpcBteGenericError   |                                |
- * xpcBteUnmappedError  |                                |
- * ---------------------+--------------------------------+---------------------
- * xpcUnknownReason     | the specified channel to the   | NULL or NA
- *                      | specified partition was        |
- *                      | unavailable for unknown reasons|
- * =====================+================================+=====================
+ * All other reason codes indicate failure. The data argmument is NULL.
+ * When a failure reason code is received, one can assume that the channel
+ * is not connected.
  */
-
-typedef void (*xpc_channel_func) (enum xpc_retval reason, partid_t partid,
+typedef void (*xpc_channel_func) (enum xp_retval reason, short partid,
                                   int ch_number, void *data, void *key);
 
-typedef void (*xpc_notify_func) (enum xpc_retval reason, partid_t partid,
+/*
+ * Define the callout function type used by XPC to notify the user of
+ * messages received and delivered via the user function registered by
+ * xpc_send_notify().
+ *
+ * Arguments:
+ *
+ *      reason - reason code.
+ *      partid - partition ID associated with condition.
+ *      ch_number - channel # associated with condition.
+ *      key - pointer to optional user-defined value provided as the "key"
+ *            argument to xpc_send_notify().
+ *
+ * A reason code of xpMsgDelivered indicates that the message was delivered
+ * to the intended recipient and that they have acknowledged its receipt by
+ * calling xpc_received().
+ *
+ * All other reason codes indicate failure.
+ */
+typedef void (*xpc_notify_func) (enum xp_retval reason, short partid,
                                  int ch_number, void *key);
 
 /*
@@ -401,57 +322,57 @@ struct xpc_registration {
 struct xpc_interface {
         void (*connect) (int);
         void (*disconnect) (int);
-        enum xpc_retval (*allocate) (partid_t, int, u32, void **);
-        enum xpc_retval (*send) (partid_t, int, void *);
-        enum xpc_retval (*send_notify) (partid_t, int, void *,
+        enum xp_retval (*allocate) (short, int, u32, void **);
+        enum xp_retval (*send) (short, int, void *);
+        enum xp_retval (*send_notify) (short, int, void *,
                                         xpc_notify_func, void *);
-        void (*received) (partid_t, int, void *);
-        enum xpc_retval (*partid_to_nasids) (partid_t, void *);
+        void (*received) (short, int, void *);
+        enum xp_retval (*partid_to_nasids) (short, void *);
 };
 
 extern struct xpc_interface xpc_interface;
 
 extern void xpc_set_interface(void (*)(int),
                               void (*)(int),
-                              enum xpc_retval (*)(partid_t, int, u32, void **),
-                              enum xpc_retval (*)(partid_t, int, void *),
-                              enum xpc_retval (*)(partid_t, int, void *,
+                              enum xp_retval (*)(short, int, u32, void **),
+                              enum xp_retval (*)(short, int, void *),
+                              enum xp_retval (*)(short, int, void *,
                                                   xpc_notify_func, void *),
-                              void (*)(partid_t, int, void *),
-                              enum xpc_retval (*)(partid_t, void *));
+                              void (*)(short, int, void *),
+                              enum xp_retval (*)(short, void *));
 extern void xpc_clear_interface(void);
 
-extern enum xpc_retval xpc_connect(int, xpc_channel_func, void *, u16,
+extern enum xp_retval xpc_connect(int, xpc_channel_func, void *, u16,
                                    u16, u32, u32);
 extern void xpc_disconnect(int);
 
-static inline enum xpc_retval
-xpc_allocate(partid_t partid, int ch_number, u32 flags, void **payload)
+static inline enum xp_retval
+xpc_allocate(short partid, int ch_number, u32 flags, void **payload)
 {
         return xpc_interface.allocate(partid, ch_number, flags, payload);
 }
 
-static inline enum xpc_retval
-xpc_send(partid_t partid, int ch_number, void *payload)
+static inline enum xp_retval
+xpc_send(short partid, int ch_number, void *payload)
 {
         return xpc_interface.send(partid, ch_number, payload);
 }
 
-static inline enum xpc_retval
-xpc_send_notify(partid_t partid, int ch_number, void *payload,
+static inline enum xp_retval
+xpc_send_notify(short partid, int ch_number, void *payload,
                 xpc_notify_func func, void *key)
 {
         return xpc_interface.send_notify(partid, ch_number, payload, func, key);
 }
 
 static inline void
-xpc_received(partid_t partid, int ch_number, void *payload)
+xpc_received(short partid, int ch_number, void *payload)
 {
         return xpc_interface.received(partid, ch_number, payload);
 }
 
-static inline enum xpc_retval
-xpc_partid_to_nasids(partid_t partid, void *nasids)
+static inline enum xp_retval
+xpc_partid_to_nasids(short partid, void *nasids)
 {
         return xpc_interface.partid_to_nasids(partid, nasids);
 }
diff --git a/drivers/misc/sgi-xp/xp_main.c b/drivers/misc/sgi-xp/xp_main.c
index 1fbf99bae96..196480b691a 100644
--- a/drivers/misc/sgi-xp/xp_main.c
+++ b/drivers/misc/sgi-xp/xp_main.c
@@ -42,21 +42,21 @@ EXPORT_SYMBOL_GPL(xpc_registrations);
 /*
  * Initialize the XPC interface to indicate that XPC isn't loaded.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_notloaded(void)
 {
-        return xpcNotLoaded;
+        return xpNotLoaded;
 }
 
 struct xpc_interface xpc_interface = {
         (void (*)(int))xpc_notloaded,
         (void (*)(int))xpc_notloaded,
-        (enum xpc_retval(*)(partid_t, int, u32, void **))xpc_notloaded,
-        (enum xpc_retval(*)(partid_t, int, void *))xpc_notloaded,
-        (enum xpc_retval(*)(partid_t, int, void *, xpc_notify_func, void *))
+        (enum xp_retval(*)(short, int, u32, void **))xpc_notloaded,
+        (enum xp_retval(*)(short, int, void *))xpc_notloaded,
+        (enum xp_retval(*)(short, int, void *, xpc_notify_func, void *))
             xpc_notloaded,
-        (void (*)(partid_t, int, void *))xpc_notloaded,
-        (enum xpc_retval(*)(partid_t, void *))xpc_notloaded
+        (void (*)(short, int, void *))xpc_notloaded,
+        (enum xp_retval(*)(short, void *))xpc_notloaded
 };
 EXPORT_SYMBOL_GPL(xpc_interface);
 
@@ -66,12 +66,12 @@ EXPORT_SYMBOL_GPL(xpc_interface);
 void
 xpc_set_interface(void (*connect) (int),
                   void (*disconnect) (int),
-                  enum xpc_retval (*allocate) (partid_t, int, u32, void **),
-                  enum xpc_retval (*send) (partid_t, int, void *),
-                  enum xpc_retval (*send_notify) (partid_t, int, void *,
+                  enum xp_retval (*allocate) (short, int, u32, void **),
+                  enum xp_retval (*send) (short, int, void *),
+                  enum xp_retval (*send_notify) (short, int, void *,
                                                   xpc_notify_func, void *),
-                  void (*received) (partid_t, int, void *),
-                  enum xpc_retval (*partid_to_nasids) (partid_t, void *))
+                  void (*received) (short, int, void *),
+                  enum xp_retval (*partid_to_nasids) (short, void *))
 {
         xpc_interface.connect = connect;
         xpc_interface.disconnect = disconnect;
@@ -91,16 +91,16 @@ xpc_clear_interface(void)
 {
         xpc_interface.connect = (void (*)(int))xpc_notloaded;
         xpc_interface.disconnect = (void (*)(int))xpc_notloaded;
-        xpc_interface.allocate = (enum xpc_retval(*)(partid_t, int, u32,
+        xpc_interface.allocate = (enum xp_retval(*)(short, int, u32,
                                                      void **))xpc_notloaded;
-        xpc_interface.send = (enum xpc_retval(*)(partid_t, int, void *))
+        xpc_interface.send = (enum xp_retval(*)(short, int, void *))
             xpc_notloaded;
-        xpc_interface.send_notify = (enum xpc_retval(*)(partid_t, int, void *,
+        xpc_interface.send_notify = (enum xp_retval(*)(short, int, void *,
                                                         xpc_notify_func,
                                                         void *))xpc_notloaded;
-        xpc_interface.received = (void (*)(partid_t, int, void *))
+        xpc_interface.received = (void (*)(short, int, void *))
             xpc_notloaded;
-        xpc_interface.partid_to_nasids = (enum xpc_retval(*)(partid_t, void *))
+        xpc_interface.partid_to_nasids = (enum xp_retval(*)(short, void *))
             xpc_notloaded;
 }
 EXPORT_SYMBOL_GPL(xpc_clear_interface);
@@ -123,13 +123,13 @@ EXPORT_SYMBOL_GPL(xpc_clear_interface);
  *      nentries - max #of XPC message entries a message queue can contain.
  *                 The actual number, which is determined when a connection
  *                 is established and may be less then requested, will be
- *                 passed to the user via the xpcConnected callout.
+ *                 passed to the user via the xpConnected callout.
  *      assigned_limit - max number of kthreads allowed to be processing
  *                       messages (per connection) at any given instant.
  *      idle_limit - max number of kthreads allowed to be idle at any given
  *                   instant.
  */
-enum xpc_retval
+enum xp_retval
 xpc_connect(int ch_number, xpc_channel_func func, void *key, u16 payload_size,
             u16 nentries, u32 assigned_limit, u32 idle_limit)
 {
@@ -143,12 +143,12 @@ xpc_connect(int ch_number, xpc_channel_func func, void *key, u16 payload_size,
         registration = &xpc_registrations[ch_number];
 
         if (mutex_lock_interruptible(&registration->mutex) != 0)
-                return xpcInterrupted;
+                return xpInterrupted;
 
         /* if XPC_CHANNEL_REGISTERED(ch_number) */
         if (registration->func != NULL) {
                 mutex_unlock(&registration->mutex);
-                return xpcAlreadyRegistered;
+                return xpAlreadyRegistered;
         }
 
         /* register the channel for connection */
@@ -163,7 +163,7 @@ xpc_connect(int ch_number, xpc_channel_func func, void *key, u16 payload_size,
 
         xpc_interface.connect(ch_number);
 
-        return xpcSuccess;
+        return xpSuccess;
 }
 EXPORT_SYMBOL_GPL(xpc_connect);
 
diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
index 9eb6d4a3269..11ac267ed68 100644
--- a/drivers/misc/sgi-xp/xpc.h
+++ b/drivers/misc/sgi-xp/xpc.h
@@ -172,13 +172,13 @@ struct xpc_vars {
                         (_version >= _XPC_VERSION(3, 1))
 
 static inline int
-xpc_hb_allowed(partid_t partid, struct xpc_vars *vars)
+xpc_hb_allowed(short partid, struct xpc_vars *vars)
 {
         return ((vars->heartbeating_to_mask & (1UL << partid)) != 0);
 }
 
 static inline void
-xpc_allow_hb(partid_t partid, struct xpc_vars *vars)
+xpc_allow_hb(short partid, struct xpc_vars *vars)
 {
         u64 old_mask, new_mask;
 
@@ -190,7 +190,7 @@ xpc_allow_hb(partid_t partid, struct xpc_vars *vars)
 }
 
 static inline void
-xpc_disallow_hb(partid_t partid, struct xpc_vars *vars)
+xpc_disallow_hb(short partid, struct xpc_vars *vars)
 {
         u64 old_mask, new_mask;
 
@@ -408,11 +408,11 @@ struct xpc_notify {
  *      messages.
  */
 struct xpc_channel {
-        partid_t partid;        /* ID of remote partition connected */
+        short partid;           /* ID of remote partition connected */
         spinlock_t lock;        /* lock for updating this structure */
         u32 flags;              /* general flags */
 
-        enum xpc_retval reason; /* reason why channel is disconnect'g */
+        enum xp_retval reason;  /* reason why channel is disconnect'g */
         int reason_line;        /* line# disconnect initiated from */
 
         u16 number;             /* channel # */
@@ -522,7 +522,7 @@ struct xpc_partition {
         spinlock_t act_lock;    /* protect updating of act_state */
         u8 act_state;           /* from XPC HB viewpoint */
         u8 remote_vars_version; /* version# of partition's vars */
-        enum xpc_retval reason; /* reason partition is deactivating */
+        enum xp_retval reason;  /* reason partition is deactivating */
         int reason_line;        /* line# deactivation initiated from */
         int reactivate_nasid;   /* nasid in partition to reactivate */
 
@@ -615,7 +615,7 @@ struct xpc_partition {
 /* interval in seconds to print 'waiting disengagement' messages */
 #define XPC_DISENGAGE_PRINTMSG_INTERVAL         10
 
-#define XPC_PARTID(_p)  ((partid_t) ((_p) - &xpc_partitions[0]))
+#define XPC_PARTID(_p)  ((short)((_p) - &xpc_partitions[0]))
 
 /* found in xp_main.c */
 extern struct xpc_registration xpc_registrations[];
@@ -646,31 +646,31 @@ extern void xpc_allow_IPI_ops(void);
 extern void xpc_restrict_IPI_ops(void);
 extern int xpc_identify_act_IRQ_sender(void);
 extern int xpc_partition_disengaged(struct xpc_partition *);
-extern enum xpc_retval xpc_mark_partition_active(struct xpc_partition *);
+extern enum xp_retval xpc_mark_partition_active(struct xpc_partition *);
 extern void xpc_mark_partition_inactive(struct xpc_partition *);
 extern void xpc_discovery(void);
 extern void xpc_check_remote_hb(void);
 extern void xpc_deactivate_partition(const int, struct xpc_partition *,
-                                     enum xpc_retval);
-extern enum xpc_retval xpc_initiate_partid_to_nasids(partid_t, void *);
+                                     enum xp_retval);
+extern enum xp_retval xpc_initiate_partid_to_nasids(short, void *);
 
 /* found in xpc_channel.c */
 extern void xpc_initiate_connect(int);
 extern void xpc_initiate_disconnect(int);
-extern enum xpc_retval xpc_initiate_allocate(partid_t, int, u32, void **);
-extern enum xpc_retval xpc_initiate_send(partid_t, int, void *);
-extern enum xpc_retval xpc_initiate_send_notify(partid_t, int, void *,
-                                                xpc_notify_func, void *);
-extern void xpc_initiate_received(partid_t, int, void *);
-extern enum xpc_retval xpc_setup_infrastructure(struct xpc_partition *);
-extern enum xpc_retval xpc_pull_remote_vars_part(struct xpc_partition *);
+extern enum xp_retval xpc_initiate_allocate(short, int, u32, void **);
+extern enum xp_retval xpc_initiate_send(short, int, void *);
+extern enum xp_retval xpc_initiate_send_notify(short, int, void *,
+                                               xpc_notify_func, void *);
+extern void xpc_initiate_received(short, int, void *);
+extern enum xp_retval xpc_setup_infrastructure(struct xpc_partition *);
+extern enum xp_retval xpc_pull_remote_vars_part(struct xpc_partition *);
 extern void xpc_process_channel_activity(struct xpc_partition *);
 extern void xpc_connected_callout(struct xpc_channel *);
 extern void xpc_deliver_msg(struct xpc_channel *);
 extern void xpc_disconnect_channel(const int, struct xpc_channel *,
-                                   enum xpc_retval, unsigned long *);
-extern void xpc_disconnect_callout(struct xpc_channel *, enum xpc_retval);
-extern void xpc_partition_going_down(struct xpc_partition *, enum xpc_retval);
+                                   enum xp_retval, unsigned long *);
+extern void xpc_disconnect_callout(struct xpc_channel *, enum xp_retval);
+extern void xpc_partition_going_down(struct xpc_partition *, enum xp_retval);
 extern void xpc_teardown_infrastructure(struct xpc_partition *);
 
 static inline void
@@ -901,7 +901,7 @@ xpc_IPI_receive(AMO_t *amo)
         return FETCHOP_LOAD_OP(TO_AMO((u64)&amo->variable), FETCHOP_CLEAR);
 }
 
-static inline enum xpc_retval
+static inline enum xp_retval
 xpc_IPI_send(AMO_t *amo, u64 flag, int nasid, int phys_cpuid, int vector)
 {
         int ret = 0;
@@ -923,7 +923,7 @@ xpc_IPI_send(AMO_t *amo, u64 flag, int nasid, int phys_cpuid, int vector)
 
         local_irq_restore(irq_flags);
 
-        return ((ret == 0) ? xpcSuccess : xpcPioReadError);
+        return ((ret == 0) ? xpSuccess : xpPioReadError);
 }
 
 /*
@@ -992,7 +992,7 @@ xpc_notify_IRQ_send(struct xpc_channel *ch, u8 ipi_flag, char *ipi_flag_string,
                     unsigned long *irq_flags)
 {
         struct xpc_partition *part = &xpc_partitions[ch->partid];
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         if (likely(part->act_state != XPC_P_DEACTIVATING)) {
                 ret = xpc_IPI_send(part->remote_IPI_amo_va,
@@ -1001,7 +1001,7 @@ xpc_notify_IRQ_send(struct xpc_channel *ch, u8 ipi_flag, char *ipi_flag_string,
                                    part->remote_IPI_phys_cpuid, SGI_XPC_NOTIFY);
                 dev_dbg(xpc_chan, "%s sent to partid=%d, channel=%d, ret=%d\n",
                         ipi_flag_string, ch->partid, ch->number, ret);
-                if (unlikely(ret != xpcSuccess)) {
+                if (unlikely(ret != xpSuccess)) {
                         if (irq_flags != NULL)
                                 spin_unlock_irqrestore(&ch->lock, *irq_flags);
                         XPC_DEACTIVATE_PARTITION(part, ret);
@@ -1123,41 +1123,10 @@ xpc_IPI_init(int index)
         return amo;
 }
 
-static inline enum xpc_retval
+static inline enum xp_retval
 xpc_map_bte_errors(bte_result_t error)
 {
-        if (error == BTE_SUCCESS)
-                return xpcSuccess;
-
-        if (is_shub2()) {
-                if (BTE_VALID_SH2_ERROR(error))
-                        return xpcBteSh2Start + error;
-                return xpcBteUnmappedError;
-        }
-        switch (error) {
-        case BTE_SUCCESS:
-                return xpcSuccess;
-        case BTEFAIL_DIR:
-                return xpcBteDirectoryError;
-        case BTEFAIL_POISON:
-                return xpcBtePoisonError;
-        case BTEFAIL_WERR:
-                return xpcBteWriteError;
-        case BTEFAIL_ACCESS:
-                return xpcBteAccessError;
-        case BTEFAIL_PWERR:
-                return xpcBtePWriteError;
-        case BTEFAIL_PRERR:
-                return xpcBtePReadError;
-        case BTEFAIL_TOUT:
-                return xpcBteTimeOutError;
-        case BTEFAIL_XTERR:
-                return xpcBteXtalkError;
-        case BTEFAIL_NOTAVAIL:
-                return xpcBteNotAvailable;
-        default:
-                return xpcBteUnmappedError;
-        }
+        return ((error == BTE_SUCCESS) ? xpSuccess : xpBteCopyError);
 }
 
 /*
diff --git a/drivers/misc/sgi-xp/xpc_channel.c b/drivers/misc/sgi-xp/xpc_channel.c
index bfcb9ea968e..9c90c2d55c0 100644
--- a/drivers/misc/sgi-xp/xpc_channel.c
+++ b/drivers/misc/sgi-xp/xpc_channel.c
@@ -53,7 +53,7 @@ xpc_kzalloc_cacheline_aligned(size_t size, gfp_t flags, void **base)
  * Set up the initial values for the XPartition Communication channels.
  */
 static void
-xpc_initialize_channels(struct xpc_partition *part, partid_t partid)
+xpc_initialize_channels(struct xpc_partition *part, short partid)
 {
         int ch_number;
         struct xpc_channel *ch;
@@ -90,12 +90,12 @@ xpc_initialize_channels(struct xpc_partition *part, partid_t partid)
  * Setup the infrastructure necessary to support XPartition Communication
  * between the specified remote partition and the local one.
  */
-enum xpc_retval
+enum xp_retval
 xpc_setup_infrastructure(struct xpc_partition *part)
 {
         int ret, cpuid;
         struct timer_list *timer;
-        partid_t partid = XPC_PARTID(part);
+        short partid = XPC_PARTID(part);
 
         /*
          * Zero out MOST of the entry for this partition. Only the fields
@@ -114,7 +114,7 @@ xpc_setup_infrastructure(struct xpc_partition *part)
                                  GFP_KERNEL);
         if (part->channels == NULL) {
                 dev_err(xpc_chan, "can't get memory for channels\n");
-                return xpcNoMemory;
+                return xpNoMemory;
         }
 
         part->nchannels = XPC_NCHANNELS;
@@ -129,7 +129,7 @@ xpc_setup_infrastructure(struct xpc_partition *part)
                 part->channels = NULL;
                 dev_err(xpc_chan, "can't get memory for local get/put "
                         "values\n");
-                return xpcNoMemory;
+                return xpNoMemory;
         }
 
         part->remote_GPs = xpc_kzalloc_cacheline_aligned(XPC_GP_SIZE,
@@ -143,7 +143,7 @@ xpc_setup_infrastructure(struct xpc_partition *part)
                 part->local_GPs = NULL;
                 kfree(part->channels);
                 part->channels = NULL;
-                return xpcNoMemory;
+                return xpNoMemory;
         }
 
         /* allocate all the required open and close args */
@@ -159,7 +159,7 @@ xpc_setup_infrastructure(struct xpc_partition *part)
                 part->local_GPs = NULL;
                 kfree(part->channels);
                 part->channels = NULL;
-                return xpcNoMemory;
+                return xpNoMemory;
         }
 
         part->remote_openclose_args =
@@ -175,7 +175,7 @@ xpc_setup_infrastructure(struct xpc_partition *part)
                 part->local_GPs = NULL;
                 kfree(part->channels);
                 part->channels = NULL;
-                return xpcNoMemory;
+                return xpNoMemory;
         }
 
         xpc_initialize_channels(part, partid);
@@ -209,7 +209,7 @@ xpc_setup_infrastructure(struct xpc_partition *part)
                 part->local_GPs = NULL;
                 kfree(part->channels);
                 part->channels = NULL;
-                return xpcLackOfResources;
+                return xpLackOfResources;
         }
 
         /* Setup a timer to check for dropped IPIs */
@@ -243,7 +243,7 @@ xpc_setup_infrastructure(struct xpc_partition *part)
         xpc_vars_part[partid].nchannels = part->nchannels;
         xpc_vars_part[partid].magic = XPC_VP_MAGIC1;
 
-        return xpcSuccess;
+        return xpSuccess;
 }
 
 /*
@@ -254,7 +254,7 @@ xpc_setup_infrastructure(struct xpc_partition *part)
  * dst must be a cacheline aligned virtual address on this partition.
  * cnt must be an cacheline sized
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_pull_remote_cachelines(struct xpc_partition *part, void *dst,
                            const void *src, size_t cnt)
 {
@@ -270,7 +270,7 @@ xpc_pull_remote_cachelines(struct xpc_partition *part, void *dst,
         bte_ret = xp_bte_copy((u64)src, (u64)dst, (u64)cnt,
                               (BTE_NORMAL | BTE_WACQUIRE), NULL);
         if (bte_ret == BTE_SUCCESS)
-                return xpcSuccess;
+                return xpSuccess;
 
         dev_dbg(xpc_chan, "xp_bte_copy() from partition %d failed, ret=%d\n",
                 XPC_PARTID(part), bte_ret);
@@ -282,7 +282,7 @@ xpc_pull_remote_cachelines(struct xpc_partition *part, void *dst,
  * Pull the remote per partition specific variables from the specified
  * partition.
  */
-enum xpc_retval
+enum xp_retval
 xpc_pull_remote_vars_part(struct xpc_partition *part)
 {
         u8 buffer[L1_CACHE_BYTES * 2];
@@ -290,8 +290,8 @@ xpc_pull_remote_vars_part(struct xpc_partition *part)
             (struct xpc_vars_part *)L1_CACHE_ALIGN((u64)buffer);
         struct xpc_vars_part *pulled_entry;
         u64 remote_entry_cacheline_pa, remote_entry_pa;
-        partid_t partid = XPC_PARTID(part);
-        enum xpc_retval ret;
+        short partid = XPC_PARTID(part);
+        enum xp_retval ret;
 
         /* pull the cacheline that contains the variables we're interested in */
 
@@ -311,7 +311,7 @@ xpc_pull_remote_vars_part(struct xpc_partition *part)
         ret = xpc_pull_remote_cachelines(part, pulled_entry_cacheline,
                                          (void *)remote_entry_cacheline_pa,
                                          L1_CACHE_BYTES);
-        if (ret != xpcSuccess) {
+        if (ret != xpSuccess) {
                 dev_dbg(xpc_chan, "failed to pull XPC vars_part from "
                         "partition %d, ret=%d\n", partid, ret);
                 return ret;
@@ -326,11 +326,11 @@ xpc_pull_remote_vars_part(struct xpc_partition *part)
                         dev_dbg(xpc_chan, "partition %d's XPC vars_part for "
                                 "partition %d has bad magic value (=0x%lx)\n",
                                 partid, sn_partition_id, pulled_entry->magic);
-                        return xpcBadMagic;
+                        return xpBadMagic;
                 }
 
                 /* they've not been initialized yet */
-                return xpcRetry;
+                return xpRetry;
         }
 
         if (xpc_vars_part[partid].magic == XPC_VP_MAGIC1) {
@@ -344,7 +344,7 @@ xpc_pull_remote_vars_part(struct xpc_partition *part)
                         dev_err(xpc_chan, "partition %d's XPC vars_part for "
                                 "partition %d are not valid\n", partid,
                                 sn_partition_id);
-                        return xpcInvalidAddress;
+                        return xpInvalidAddress;
                 }
 
                 /* the variables we imported look to be valid */
@@ -366,9 +366,9 @@ xpc_pull_remote_vars_part(struct xpc_partition *part)
         }
 
         if (pulled_entry->magic == XPC_VP_MAGIC1)
-                return xpcRetry;
+                return xpRetry;
 
-        return xpcSuccess;
+        return xpSuccess;
 }
 
 /*
@@ -379,7 +379,7 @@ xpc_get_IPI_flags(struct xpc_partition *part)
 {
         unsigned long irq_flags;
         u64 IPI_amo;
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         /*
          * See if there are any IPI flags to be handled.
@@ -398,7 +398,7 @@ xpc_get_IPI_flags(struct xpc_partition *part)
                                                  (void *)part->
                                                  remote_openclose_args_pa,
                                                  XPC_OPENCLOSE_ARGS_SIZE);
-                if (ret != xpcSuccess) {
+                if (ret != xpSuccess) {
                         XPC_DEACTIVATE_PARTITION(part, ret);
 
                         dev_dbg(xpc_chan, "failed to pull openclose args from "
@@ -414,7 +414,7 @@ xpc_get_IPI_flags(struct xpc_partition *part)
                 ret = xpc_pull_remote_cachelines(part, part->remote_GPs,
                                                  (void *)part->remote_GPs_pa,
                                                  XPC_GP_SIZE);
-                if (ret != xpcSuccess) {
+                if (ret != xpSuccess) {
                         XPC_DEACTIVATE_PARTITION(part, ret);
 
                         dev_dbg(xpc_chan, "failed to pull GPs from partition "
@@ -431,7 +431,7 @@ xpc_get_IPI_flags(struct xpc_partition *part)
 /*
  * Allocate the local message queue and the notify queue.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_allocate_local_msgqueue(struct xpc_channel *ch)
 {
         unsigned long irq_flags;
@@ -464,18 +464,18 @@ xpc_allocate_local_msgqueue(struct xpc_channel *ch)
                         ch->local_nentries = nentries;
                 }
                 spin_unlock_irqrestore(&ch->lock, irq_flags);
-                return xpcSuccess;
+                return xpSuccess;
         }
 
         dev_dbg(xpc_chan, "can't get memory for local message queue and notify "
                 "queue, partid=%d, channel=%d\n", ch->partid, ch->number);
-        return xpcNoMemory;
+        return xpNoMemory;
 }
 
 /*
  * Allocate the cached remote message queue.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_allocate_remote_msgqueue(struct xpc_channel *ch)
 {
         unsigned long irq_flags;
@@ -502,12 +502,12 @@ xpc_allocate_remote_msgqueue(struct xpc_channel *ch)
                         ch->remote_nentries = nentries;
                 }
                 spin_unlock_irqrestore(&ch->lock, irq_flags);
-                return xpcSuccess;
+                return xpSuccess;
         }
 
         dev_dbg(xpc_chan, "can't get memory for cached remote message queue, "
                 "partid=%d, channel=%d\n", ch->partid, ch->number);
-        return xpcNoMemory;
+        return xpNoMemory;
 }
 
 /*
@@ -515,20 +515,20 @@ xpc_allocate_remote_msgqueue(struct xpc_channel *ch)
  *
  * Note: Assumes all of the channel sizes are filled in.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_allocate_msgqueues(struct xpc_channel *ch)
 {
         unsigned long irq_flags;
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         DBUG_ON(ch->flags & XPC_C_SETUP);
 
         ret = xpc_allocate_local_msgqueue(ch);
-        if (ret != xpcSuccess)
+        if (ret != xpSuccess)
                 return ret;
 
         ret = xpc_allocate_remote_msgqueue(ch);
-        if (ret != xpcSuccess) {
+        if (ret != xpSuccess) {
                 kfree(ch->local_msgqueue_base);
                 ch->local_msgqueue = NULL;
                 kfree(ch->notify_queue);
@@ -540,7 +540,7 @@ xpc_allocate_msgqueues(struct xpc_channel *ch)
         ch->flags |= XPC_C_SETUP;
         spin_unlock_irqrestore(&ch->lock, irq_flags);
 
-        return xpcSuccess;
+        return xpSuccess;
 }
 
 /*
@@ -552,7 +552,7 @@ xpc_allocate_msgqueues(struct xpc_channel *ch)
 static void
 xpc_process_connect(struct xpc_channel *ch, unsigned long *irq_flags)
 {
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         DBUG_ON(!spin_is_locked(&ch->lock));
 
@@ -568,7 +568,7 @@ xpc_process_connect(struct xpc_channel *ch, unsigned long *irq_flags)
                 ret = xpc_allocate_msgqueues(ch);
                 spin_lock_irqsave(&ch->lock, *irq_flags);
 
-                if (ret != xpcSuccess)
+                if (ret != xpSuccess)
                         XPC_DISCONNECT_CHANNEL(ch, ret, irq_flags);
 
                 if (ch->flags & (XPC_C_CONNECTED | XPC_C_DISCONNECTING))
@@ -603,7 +603,7 @@ xpc_process_connect(struct xpc_channel *ch, unsigned long *irq_flags)
  * Notify those who wanted to be notified upon delivery of their message.
  */
 static void
-xpc_notify_senders(struct xpc_channel *ch, enum xpc_retval reason, s64 put)
+xpc_notify_senders(struct xpc_channel *ch, enum xp_retval reason, s64 put)
 {
         struct xpc_notify *notify;
         u8 notify_type;
@@ -748,7 +748,7 @@ xpc_process_disconnect(struct xpc_channel *ch, unsigned long *irq_flags)
 
         if (ch->flags & XPC_C_DISCONNECTINGCALLOUT_MADE) {
                 spin_unlock_irqrestore(&ch->lock, *irq_flags);
-                xpc_disconnect_callout(ch, xpcDisconnected);
+                xpc_disconnect_callout(ch, xpDisconnected);
                 spin_lock_irqsave(&ch->lock, *irq_flags);
         }
 
@@ -791,7 +791,7 @@ xpc_process_openclose_IPI(struct xpc_partition *part, int ch_number,
         struct xpc_openclose_args *args =
             &part->remote_openclose_args[ch_number];
         struct xpc_channel *ch = &part->channels[ch_number];
-        enum xpc_retval reason;
+        enum xp_retval reason;
 
         spin_lock_irqsave(&ch->lock, irq_flags);
 
@@ -871,10 +871,10 @@ again:
 
                 if (!(ch->flags & XPC_C_DISCONNECTING)) {
                         reason = args->reason;
-                        if (reason <= xpcSuccess || reason > xpcUnknownReason)
-                                reason = xpcUnknownReason;
-                        else if (reason == xpcUnregistering)
-                                reason = xpcOtherUnregistering;
+                        if (reason <= xpSuccess || reason > xpUnknownReason)
+                                reason = xpUnknownReason;
+                        else if (reason == xpUnregistering)
+                                reason = xpOtherUnregistering;
 
                         XPC_DISCONNECT_CHANNEL(ch, reason, &irq_flags);
 
@@ -961,7 +961,7 @@ again:
 
                 if (ch->flags & XPC_C_OPENREQUEST) {
                         if (args->msg_size != ch->msg_size) {
-                                XPC_DISCONNECT_CHANNEL(ch, xpcUnequalMsgSizes,
+                                XPC_DISCONNECT_CHANNEL(ch, xpUnequalMsgSizes,
                                                        &irq_flags);
                                 spin_unlock_irqrestore(&ch->lock, irq_flags);
                                 return;
@@ -991,7 +991,7 @@ again:
                         return;
                 }
                 if (!(ch->flags & XPC_C_OPENREQUEST)) {
-                        XPC_DISCONNECT_CHANNEL(ch, xpcOpenCloseError,
+                        XPC_DISCONNECT_CHANNEL(ch, xpOpenCloseError,
                                                &irq_flags);
                         spin_unlock_irqrestore(&ch->lock, irq_flags);
                         return;
@@ -1042,18 +1042,18 @@ again:
 /*
  * Attempt to establish a channel connection to a remote partition.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_connect_channel(struct xpc_channel *ch)
 {
         unsigned long irq_flags;
         struct xpc_registration *registration = &xpc_registrations[ch->number];
 
         if (mutex_trylock(&registration->mutex) == 0)
-                return xpcRetry;
+                return xpRetry;
 
         if (!XPC_CHANNEL_REGISTERED(ch->number)) {
                 mutex_unlock(&registration->mutex);
-                return xpcUnregistered;
+                return xpUnregistered;
         }
 
         spin_lock_irqsave(&ch->lock, irq_flags);
@@ -1095,10 +1095,10 @@ xpc_connect_channel(struct xpc_channel *ch)
                          * the channel lock as needed.
                          */
                         mutex_unlock(&registration->mutex);
-                        XPC_DISCONNECT_CHANNEL(ch, xpcUnequalMsgSizes,
+                        XPC_DISCONNECT_CHANNEL(ch, xpUnequalMsgSizes,
                                                &irq_flags);
                         spin_unlock_irqrestore(&ch->lock, irq_flags);
-                        return xpcUnequalMsgSizes;
+                        return xpUnequalMsgSizes;
                 }
         } else {
                 ch->msg_size = registration->msg_size;
@@ -1120,7 +1120,7 @@ xpc_connect_channel(struct xpc_channel *ch)
 
         spin_unlock_irqrestore(&ch->lock, irq_flags);
 
-        return xpcSuccess;
+        return xpSuccess;
 }
 
 /*
@@ -1203,7 +1203,7 @@ xpc_process_msg_IPI(struct xpc_partition *part, int ch_number)
                          * Notify senders that messages sent have been
                          * received and delivered by the other side.
                          */
-                        xpc_notify_senders(ch, xpcMsgDelivered,
+                        xpc_notify_senders(ch, xpMsgDelivered,
                                            ch->remote_GP.get);
                 }
 
@@ -1335,7 +1335,7 @@ xpc_process_channel_activity(struct xpc_partition *part)
  * at the same time.
  */
 void
-xpc_partition_going_down(struct xpc_partition *part, enum xpc_retval reason)
+xpc_partition_going_down(struct xpc_partition *part, enum xp_retval reason)
 {
         unsigned long irq_flags;
         int ch_number;
@@ -1375,7 +1375,7 @@ xpc_partition_going_down(struct xpc_partition *part, enum xpc_retval reason)
 void
 xpc_teardown_infrastructure(struct xpc_partition *part)
 {
-        partid_t partid = XPC_PARTID(part);
+        short partid = XPC_PARTID(part);
 
         /*
          * We start off by making this partition inaccessible to local
@@ -1428,7 +1428,7 @@ xpc_teardown_infrastructure(struct xpc_partition *part)
 void
 xpc_initiate_connect(int ch_number)
 {
-        partid_t partid;
+        short partid;
         struct xpc_partition *part;
         struct xpc_channel *ch;
 
@@ -1456,13 +1456,13 @@ xpc_connected_callout(struct xpc_channel *ch)
         /* let the registerer know that a connection has been established */
 
         if (ch->func != NULL) {
-                dev_dbg(xpc_chan, "ch->func() called, reason=xpcConnected, "
+                dev_dbg(xpc_chan, "ch->func() called, reason=xpConnected, "
                         "partid=%d, channel=%d\n", ch->partid, ch->number);
 
-                ch->func(xpcConnected, ch->partid, ch->number,
+                ch->func(xpConnected, ch->partid, ch->number,
                          (void *)(u64)ch->local_nentries, ch->key);
 
-                dev_dbg(xpc_chan, "ch->func() returned, reason=xpcConnected, "
+                dev_dbg(xpc_chan, "ch->func() returned, reason=xpConnected, "
                         "partid=%d, channel=%d\n", ch->partid, ch->number);
         }
 }
@@ -1484,7 +1484,7 @@ void
 xpc_initiate_disconnect(int ch_number)
 {
         unsigned long irq_flags;
-        partid_t partid;
+        short partid;
         struct xpc_partition *part;
         struct xpc_channel *ch;
 
@@ -1503,7 +1503,7 @@ xpc_initiate_disconnect(int ch_number)
                         if (!(ch->flags & XPC_C_DISCONNECTED)) {
                                 ch->flags |= XPC_C_WDISCONNECT;
 
-                                XPC_DISCONNECT_CHANNEL(ch, xpcUnregistering,
+                                XPC_DISCONNECT_CHANNEL(ch, xpUnregistering,
                                                        &irq_flags);
                         }
 
@@ -1528,7 +1528,7 @@ xpc_initiate_disconnect(int ch_number)
  */
 void
 xpc_disconnect_channel(const int line, struct xpc_channel *ch,
-                       enum xpc_retval reason, unsigned long *irq_flags)
+                       enum xp_retval reason, unsigned long *irq_flags)
 {
         u32 channel_was_connected = (ch->flags & XPC_C_CONNECTED);
 
@@ -1563,7 +1563,7 @@ xpc_disconnect_channel(const int line, struct xpc_channel *ch,
 
         } else if ((ch->flags & XPC_C_CONNECTEDCALLOUT_MADE) &&
                    !(ch->flags & XPC_C_DISCONNECTINGCALLOUT)) {
-                /* start a kthread that will do the xpcDisconnecting callout */
+                /* start a kthread that will do the xpDisconnecting callout */
                 xpc_create_kthreads(ch, 1, 1);
         }
 
@@ -1575,7 +1575,7 @@ xpc_disconnect_channel(const int line, struct xpc_channel *ch,
 }
 
 void
-xpc_disconnect_callout(struct xpc_channel *ch, enum xpc_retval reason)
+xpc_disconnect_callout(struct xpc_channel *ch, enum xp_retval reason)
 {
         /*
          * Let the channel's registerer know that the channel is being
@@ -1598,13 +1598,13 @@ xpc_disconnect_callout(struct xpc_channel *ch, enum xpc_retval reason)
  * Wait for a message entry to become available for the specified channel,
  * but don't wait any longer than 1 jiffy.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_allocate_msg_wait(struct xpc_channel *ch)
 {
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         if (ch->flags & XPC_C_DISCONNECTING) {
-                DBUG_ON(ch->reason == xpcInterrupted);
+                DBUG_ON(ch->reason == xpInterrupted);
                 return ch->reason;
         }
 
@@ -1614,11 +1614,11 @@ xpc_allocate_msg_wait(struct xpc_channel *ch)
 
         if (ch->flags & XPC_C_DISCONNECTING) {
                 ret = ch->reason;
-                DBUG_ON(ch->reason == xpcInterrupted);
+                DBUG_ON(ch->reason == xpInterrupted);
         } else if (ret == 0) {
-                ret = xpcTimeout;
+                ret = xpTimeout;
         } else {
-                ret = xpcInterrupted;
+                ret = xpInterrupted;
         }
 
         return ret;
@@ -1628,12 +1628,12 @@ xpc_allocate_msg_wait(struct xpc_channel *ch)
  * Allocate an entry for a message from the message queue associated with the
  * specified channel.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_allocate_msg(struct xpc_channel *ch, u32 flags,
                  struct xpc_msg **address_of_msg)
 {
         struct xpc_msg *msg;
-        enum xpc_retval ret;
+        enum xp_retval ret;
         s64 put;
 
         /* this reference will be dropped in xpc_send_msg() */
@@ -1645,7 +1645,7 @@ xpc_allocate_msg(struct xpc_channel *ch, u32 flags,
         }
         if (!(ch->flags & XPC_C_CONNECTED)) {
                 xpc_msgqueue_deref(ch);
-                return xpcNotConnected;
+                return xpNotConnected;
         }
 
         /*
@@ -1653,7 +1653,7 @@ xpc_allocate_msg(struct xpc_channel *ch, u32 flags,
          * If none are available, we'll make sure that we grab the latest
          * GP values.
          */
-        ret = xpcTimeout;
+        ret = xpTimeout;
 
         while (1) {
 
@@ -1683,16 +1683,16 @@ xpc_allocate_msg(struct xpc_channel *ch, u32 flags,
                  * that will cause the IPI handler to fetch the latest
                  * GP values as if an IPI was sent by the other side.
                  */
-                if (ret == xpcTimeout)
+                if (ret == xpTimeout)
                         xpc_IPI_send_local_msgrequest(ch);
 
                 if (flags & XPC_NOWAIT) {
                         xpc_msgqueue_deref(ch);
-                        return xpcNoWait;
+                        return xpNoWait;
                 }
 
                 ret = xpc_allocate_msg_wait(ch);
-                if (ret != xpcInterrupted && ret != xpcTimeout) {
+                if (ret != xpInterrupted && ret != xpTimeout) {
                         xpc_msgqueue_deref(ch);
                         return ret;
                 }
@@ -1711,7 +1711,7 @@ xpc_allocate_msg(struct xpc_channel *ch, u32 flags,
 
         *address_of_msg = msg;
 
-        return xpcSuccess;
+        return xpSuccess;
 }
 
 /*
@@ -1727,11 +1727,11 @@ xpc_allocate_msg(struct xpc_channel *ch, u32 flags,
  *      payload - address of the allocated payload area pointer (filled in on
  *                return) in which the user-defined message is constructed.
  */
-enum xpc_retval
-xpc_initiate_allocate(partid_t partid, int ch_number, u32 flags, void **payload)
+enum xp_retval
+xpc_initiate_allocate(short partid, int ch_number, u32 flags, void **payload)
 {
         struct xpc_partition *part = &xpc_partitions[partid];
-        enum xpc_retval ret = xpcUnknownReason;
+        enum xp_retval ret = xpUnknownReason;
         struct xpc_msg *msg = NULL;
 
         DBUG_ON(partid <= 0 || partid >= XP_MAX_PARTITIONS);
@@ -1814,11 +1814,11 @@ xpc_send_msgs(struct xpc_channel *ch, s64 initial_put)
  * local message queue's Put value and sends an IPI to the partition the
  * message is being sent to.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_send_msg(struct xpc_channel *ch, struct xpc_msg *msg, u8 notify_type,
              xpc_notify_func func, void *key)
 {
-        enum xpc_retval ret = xpcSuccess;
+        enum xp_retval ret = xpSuccess;
         struct xpc_notify *notify = notify;
         s64 put, msg_number = msg->number;
 
@@ -1908,12 +1908,12 @@ xpc_send_msg(struct xpc_channel *ch, struct xpc_msg *msg, u8 notify_type,
  *      payload - pointer to the payload area allocated via
  *                      xpc_initiate_allocate().
  */
-enum xpc_retval
-xpc_initiate_send(partid_t partid, int ch_number, void *payload)
+enum xp_retval
+xpc_initiate_send(short partid, int ch_number, void *payload)
 {
         struct xpc_partition *part = &xpc_partitions[partid];
         struct xpc_msg *msg = XPC_MSG_ADDRESS(payload);
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         dev_dbg(xpc_chan, "msg=0x%p, partid=%d, channel=%d\n", (void *)msg,
                 partid, ch_number);
@@ -1957,13 +1957,13 @@ xpc_initiate_send(partid_t partid, int ch_number, void *payload)
  *                receipt. THIS FUNCTION MUST BE NON-BLOCKING.
  *      key - user-defined key to be passed to the function when it's called.
  */
-enum xpc_retval
-xpc_initiate_send_notify(partid_t partid, int ch_number, void *payload,
+enum xp_retval
+xpc_initiate_send_notify(short partid, int ch_number, void *payload,
                          xpc_notify_func func, void *key)
 {
         struct xpc_partition *part = &xpc_partitions[partid];
         struct xpc_msg *msg = XPC_MSG_ADDRESS(payload);
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         dev_dbg(xpc_chan, "msg=0x%p, partid=%d, channel=%d\n", (void *)msg,
                 partid, ch_number);
@@ -1985,7 +1985,7 @@ xpc_pull_remote_msg(struct xpc_channel *ch, s64 get)
         struct xpc_msg *remote_msg, *msg;
         u32 msg_index, nmsgs;
         u64 msg_offset;
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         if (mutex_lock_interruptible(&ch->msg_to_pull_mutex) != 0) {
                 /* we were interrupted by a signal */
@@ -2012,7 +2012,7 @@ xpc_pull_remote_msg(struct xpc_channel *ch, s64 get)
 
                 ret = xpc_pull_remote_cachelines(part, msg, remote_msg,
                                                  nmsgs * ch->msg_size);
-                if (ret != xpcSuccess) {
+                if (ret != xpSuccess) {
 
                         dev_dbg(xpc_chan, "failed to pull %d msgs starting with"
                                 " msg %ld from partition %d, channel=%d, "
@@ -2112,7 +2112,7 @@ xpc_deliver_msg(struct xpc_channel *ch)
                                 ch->number);
 
                         /* deliver the message to its intended recipient */
-                        ch->func(xpcMsgReceived, ch->partid, ch->number,
+                        ch->func(xpMsgReceived, ch->partid, ch->number,
                                  &msg->payload, ch->key);
 
                         dev_dbg(xpc_chan, "ch->func() returned, msg=0x%p, "
@@ -2203,7 +2203,7 @@ xpc_acknowledge_msgs(struct xpc_channel *ch, s64 initial_get, u8 msg_flags)
  *                      xpc_initiate_allocate().
  */
 void
-xpc_initiate_received(partid_t partid, int ch_number, void *payload)
+xpc_initiate_received(short partid, int ch_number, void *payload)
 {
         struct xpc_partition *part = &xpc_partitions[partid];
         struct xpc_channel *ch;
diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
index f673ba90eb0..08256ed0d9a 100644
--- a/drivers/misc/sgi-xp/xpc_main.c
+++ b/drivers/misc/sgi-xp/xpc_main.c
@@ -315,13 +315,13 @@ xpc_initiate_discovery(void *ignore)
  * the XPC per partition variables from the remote partition and waiting for
  * the remote partition to pull ours.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_make_first_contact(struct xpc_partition *part)
 {
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
-        while ((ret = xpc_pull_remote_vars_part(part)) != xpcSuccess) {
-                if (ret != xpcRetry) {
+        while ((ret = xpc_pull_remote_vars_part(part)) != xpSuccess) {
+                if (ret != xpRetry) {
                         XPC_DEACTIVATE_PARTITION(part, ret);
                         return ret;
                 }
@@ -406,7 +406,7 @@ xpc_partition_up(struct xpc_partition *part)
 
         dev_dbg(xpc_chan, "activating partition %d\n", XPC_PARTID(part));
 
-        if (xpc_setup_infrastructure(part) != xpcSuccess)
+        if (xpc_setup_infrastructure(part) != xpSuccess)
                 return;
 
         /*
@@ -418,7 +418,7 @@ xpc_partition_up(struct xpc_partition *part)
 
         (void)xpc_part_ref(part);       /* this will always succeed */
 
-        if (xpc_make_first_contact(part) == xpcSuccess)
+        if (xpc_make_first_contact(part) == xpSuccess)
                 xpc_channel_mgr(part);
 
         xpc_part_deref(part);
@@ -429,7 +429,7 @@ xpc_partition_up(struct xpc_partition *part)
 static int
 xpc_activating(void *__partid)
 {
-        partid_t partid = (u64)__partid;
+        short partid = (u64)__partid;
         struct xpc_partition *part = &xpc_partitions[partid];
         unsigned long irq_flags;
 
@@ -470,7 +470,7 @@ xpc_activating(void *__partid)
 
                 spin_lock_irqsave(&part->act_lock, irq_flags);
                 part->act_state = XPC_P_INACTIVE;
-                XPC_SET_REASON(part, xpcPhysAddrRegFailed, __LINE__);
+                XPC_SET_REASON(part, xpPhysAddrRegFailed, __LINE__);
                 spin_unlock_irqrestore(&part->act_lock, irq_flags);
                 part->remote_rp_pa = 0;
                 return 0;
@@ -488,7 +488,7 @@ xpc_activating(void *__partid)
         xpc_disallow_hb(partid, xpc_vars);
         xpc_mark_partition_inactive(part);
 
-        if (part->reason == xpcReactivating) {
+        if (part->reason == xpReactivating) {
                 /* interrupting ourselves results in activating partition */
                 xpc_IPI_send_reactivate(part);
         }
@@ -499,7 +499,7 @@ xpc_activating(void *__partid)
 void
 xpc_activate_partition(struct xpc_partition *part)
 {
-        partid_t partid = XPC_PARTID(part);
+        short partid = XPC_PARTID(part);
         unsigned long irq_flags;
         struct task_struct *kthread;
 
@@ -508,7 +508,7 @@ xpc_activate_partition(struct xpc_partition *part)
         DBUG_ON(part->act_state != XPC_P_INACTIVE);
 
         part->act_state = XPC_P_ACTIVATION_REQ;
-        XPC_SET_REASON(part, xpcCloneKThread, __LINE__);
+        XPC_SET_REASON(part, xpCloneKThread, __LINE__);
 
         spin_unlock_irqrestore(&part->act_lock, irq_flags);
 
@@ -517,7 +517,7 @@ xpc_activate_partition(struct xpc_partition *part)
         if (IS_ERR(kthread)) {
                 spin_lock_irqsave(&part->act_lock, irq_flags);
                 part->act_state = XPC_P_INACTIVE;
-                XPC_SET_REASON(part, xpcCloneKThreadFailed, __LINE__);
+                XPC_SET_REASON(part, xpCloneKThreadFailed, __LINE__);
                 spin_unlock_irqrestore(&part->act_lock, irq_flags);
         }
 }
@@ -541,7 +541,7 @@ xpc_activate_partition(struct xpc_partition *part)
 irqreturn_t
 xpc_notify_IRQ_handler(int irq, void *dev_id)
 {
-        partid_t partid = (partid_t) (u64)dev_id;
+        short partid = (short)(u64)dev_id;
         struct xpc_partition *part = &xpc_partitions[partid];
 
         DBUG_ON(partid <= 0 || partid >= XP_MAX_PARTITIONS);
@@ -643,7 +643,7 @@ xpc_kthread_waitmsgs(struct xpc_partition *part, struct xpc_channel *ch)
 static int
 xpc_kthread_start(void *args)
 {
-        partid_t partid = XPC_UNPACK_ARG1(args);
+        short partid = XPC_UNPACK_ARG1(args);
         u16 ch_number = XPC_UNPACK_ARG2(args);
         struct xpc_partition *part = &xpc_partitions[partid];
         struct xpc_channel *ch;
@@ -696,7 +696,7 @@ xpc_kthread_start(void *args)
                 ch->flags |= XPC_C_DISCONNECTINGCALLOUT;
                 spin_unlock_irqrestore(&ch->lock, irq_flags);
 
-                xpc_disconnect_callout(ch, xpcDisconnecting);
+                xpc_disconnect_callout(ch, xpDisconnecting);
 
                 spin_lock_irqsave(&ch->lock, irq_flags);
                 ch->flags |= XPC_C_DISCONNECTINGCALLOUT_MADE;
@@ -776,7 +776,7 @@ xpc_create_kthreads(struct xpc_channel *ch, int needed,
                          * then we'll deadlock if all other kthreads assigned
                          * to this channel are blocked in the channel's
                          * registerer, because the only thing that will unblock
-                         * them is the xpcDisconnecting callout that this
+                         * them is the xpDisconnecting callout that this
                          * failed kthread_run() would have made.
                          */
 
@@ -796,7 +796,7 @@ xpc_create_kthreads(struct xpc_channel *ch, int needed,
                                  * to function.
                                  */
                                 spin_lock_irqsave(&ch->lock, irq_flags);
-                                XPC_DISCONNECT_CHANNEL(ch, xpcLackOfResources,
+                                XPC_DISCONNECT_CHANNEL(ch, xpLackOfResources,
                                                        &irq_flags);
                                 spin_unlock_irqrestore(&ch->lock, irq_flags);
                         }
@@ -809,7 +809,7 @@ void
 xpc_disconnect_wait(int ch_number)
 {
         unsigned long irq_flags;
-        partid_t partid;
+        short partid;
         struct xpc_partition *part;
         struct xpc_channel *ch;
         int wakeup_channel_mgr;
@@ -857,9 +857,9 @@ xpc_disconnect_wait(int ch_number)
 }
 
 static void
-xpc_do_exit(enum xpc_retval reason)
+xpc_do_exit(enum xp_retval reason)
 {
-        partid_t partid;
+        short partid;
         int active_part_count, printed_waiting_msg = 0;
         struct xpc_partition *part;
         unsigned long printmsg_time, disengage_request_timeout = 0;
@@ -955,7 +955,7 @@ xpc_do_exit(enum xpc_retval reason)
         del_timer_sync(&xpc_hb_timer);
         DBUG_ON(xpc_vars->heartbeating_to_mask != 0);
 
-        if (reason == xpcUnloading) {
+        if (reason == xpUnloading) {
                 /* take ourselves off of the reboot_notifier_list */
                 (void)unregister_reboot_notifier(&xpc_reboot_notifier);
 
@@ -981,20 +981,20 @@ xpc_do_exit(enum xpc_retval reason)
 static int
 xpc_system_reboot(struct notifier_block *nb, unsigned long event, void *unused)
 {
-        enum xpc_retval reason;
+        enum xp_retval reason;
 
         switch (event) {
         case SYS_RESTART:
-                reason = xpcSystemReboot;
+                reason = xpSystemReboot;
                 break;
         case SYS_HALT:
-                reason = xpcSystemHalt;
+                reason = xpSystemHalt;
                 break;
         case SYS_POWER_OFF:
-                reason = xpcSystemPoweroff;
+                reason = xpSystemPoweroff;
                 break;
         default:
-                reason = xpcSystemGoingDown;
+                reason = xpSystemGoingDown;
         }
 
         xpc_do_exit(reason);
@@ -1008,7 +1008,7 @@ static void
 xpc_die_disengage(void)
 {
         struct xpc_partition *part;
-        partid_t partid;
+        short partid;
         unsigned long engaged;
         long time, printmsg_time, disengage_request_timeout;
 
@@ -1124,7 +1124,7 @@ int __init
 xpc_init(void)
 {
         int ret;
-        partid_t partid;
+        short partid;
         struct xpc_partition *part;
         struct task_struct *kthread;
         size_t buf_size;
@@ -1279,7 +1279,7 @@ xpc_init(void)
                 /* mark this new thread as a non-starter */
                 complete(&xpc_discovery_exited);
 
-                xpc_do_exit(xpcUnloading);
+                xpc_do_exit(xpUnloading);
                 return -EBUSY;
         }
 
@@ -1297,7 +1297,7 @@ module_init(xpc_init);
 void __exit
 xpc_exit(void)
 {
-        xpc_do_exit(xpcUnloading);
+        xpc_do_exit(xpUnloading);
 }
 
 module_exit(xpc_exit);
diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index acd3fd4285d..7dd4b5812c4 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -403,7 +403,7 @@ xpc_check_remote_hb(void)
 {
         struct xpc_vars *remote_vars;
         struct xpc_partition *part;
-        partid_t partid;
+        short partid;
         bte_result_t bres;
 
         remote_vars = (struct xpc_vars *)xpc_remote_copy_buffer;
@@ -444,7 +444,7 @@ xpc_check_remote_hb(void)
                      (remote_vars->heartbeat_offline == 0)) ||
                     !xpc_hb_allowed(sn_partition_id, remote_vars)) {
 
-                        XPC_DEACTIVATE_PARTITION(part, xpcNoHeartbeat);
+                        XPC_DEACTIVATE_PARTITION(part, xpNoHeartbeat);
                         continue;
                 }
 
@@ -459,7 +459,7 @@ xpc_check_remote_hb(void)
  * is large enough to contain a copy of their reserved page header and
  * part_nasids mask.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_get_remote_rp(int nasid, u64 *discovered_nasids,
                   struct xpc_rsvd_page *remote_rp, u64 *remote_rp_pa)
 {
@@ -469,7 +469,7 @@ xpc_get_remote_rp(int nasid, u64 *discovered_nasids,
 
         *remote_rp_pa = xpc_get_rsvd_page_pa(nasid);
         if (*remote_rp_pa == 0)
-                return xpcNoRsvdPageAddr;
+                return xpNoRsvdPageAddr;
 
         /* pull over the reserved page header and part_nasids mask */
         bres = xp_bte_copy(*remote_rp_pa, (u64)remote_rp,
@@ -489,18 +489,18 @@ xpc_get_remote_rp(int nasid, u64 *discovered_nasids,
 
         if (remote_rp->partid < 1 ||
             remote_rp->partid > (XP_MAX_PARTITIONS - 1)) {
-                return xpcInvalidPartid;
+                return xpInvalidPartid;
         }
 
         if (remote_rp->partid == sn_partition_id)
-                return xpcLocalPartid;
+                return xpLocalPartid;
 
         if (XPC_VERSION_MAJOR(remote_rp->version) !=
             XPC_VERSION_MAJOR(XPC_RP_VERSION)) {
-                return xpcBadVersion;
+                return xpBadVersion;
         }
 
-        return xpcSuccess;
+        return xpSuccess;
 }
 
 /*
@@ -509,13 +509,13 @@ xpc_get_remote_rp(int nasid, u64 *discovered_nasids,
  * remote_vars points to a buffer that is cacheline aligned for BTE copies and
  * assumed to be of size XPC_RP_VARS_SIZE.
  */
-static enum xpc_retval
+static enum xp_retval
 xpc_get_remote_vars(u64 remote_vars_pa, struct xpc_vars *remote_vars)
 {
         int bres;
 
         if (remote_vars_pa == 0)
-                return xpcVarsNotSet;
+                return xpVarsNotSet;
 
         /* pull over the cross partition variables */
         bres = xp_bte_copy(remote_vars_pa, (u64)remote_vars, XPC_RP_VARS_SIZE,
@@ -525,10 +525,10 @@ xpc_get_remote_vars(u64 remote_vars_pa, struct xpc_vars *remote_vars)
 
         if (XPC_VERSION_MAJOR(remote_vars->version) !=
             XPC_VERSION_MAJOR(XPC_V_VERSION)) {
-                return xpcBadVersion;
+                return xpBadVersion;
         }
 
-        return xpcSuccess;
+        return xpSuccess;
 }
 
 /*
@@ -604,16 +604,16 @@ xpc_identify_act_IRQ_req(int nasid)
         int reactivate = 0;
         int stamp_diff;
         struct timespec remote_rp_stamp = { 0, 0 };
-        partid_t partid;
+        short partid;
         struct xpc_partition *part;
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         /* pull over the reserved page structure */
 
         remote_rp = (struct xpc_rsvd_page *)xpc_remote_copy_buffer;
 
         ret = xpc_get_remote_rp(nasid, NULL, remote_rp, &remote_rp_pa);
-        if (ret != xpcSuccess) {
+        if (ret != xpSuccess) {
                 dev_warn(xpc_part, "unable to get reserved page from nasid %d, "
                          "which sent interrupt, reason=%d\n", nasid, ret);
                 return;
@@ -632,7 +632,7 @@ xpc_identify_act_IRQ_req(int nasid)
         remote_vars = (struct xpc_vars *)xpc_remote_copy_buffer;
 
         ret = xpc_get_remote_vars(remote_vars_pa, remote_vars);
-        if (ret != xpcSuccess) {
+        if (ret != xpSuccess) {
 
                 dev_warn(xpc_part, "unable to get XPC variables from nasid %d, "
                          "which sent interrupt, reason=%d\n", nasid, ret);
@@ -699,7 +699,7 @@ xpc_identify_act_IRQ_req(int nasid)
                                           &remote_rp_stamp, remote_rp_pa,
                                           remote_vars_pa, remote_vars);
                 part->reactivate_nasid = nasid;
-                XPC_DEACTIVATE_PARTITION(part, xpcReactivating);
+                XPC_DEACTIVATE_PARTITION(part, xpReactivating);
                 return;
         }
 
@@ -754,11 +754,11 @@ xpc_identify_act_IRQ_req(int nasid)
 
         if (reactivate) {
                 part->reactivate_nasid = nasid;
-                XPC_DEACTIVATE_PARTITION(part, xpcReactivating);
+                XPC_DEACTIVATE_PARTITION(part, xpReactivating);
 
         } else if (XPC_SUPPORTS_DISENGAGE_REQUEST(part->remote_vars_version) &&
                    xpc_partition_disengage_requested(1UL << partid)) {
-                XPC_DEACTIVATE_PARTITION(part, xpcOtherGoingDown);
+                XPC_DEACTIVATE_PARTITION(part, xpOtherGoingDown);
         }
 }
 
@@ -825,7 +825,7 @@ xpc_identify_act_IRQ_sender(void)
 int
 xpc_partition_disengaged(struct xpc_partition *part)
 {
-        partid_t partid = XPC_PARTID(part);
+        short partid = XPC_PARTID(part);
         int disengaged;
 
         disengaged = (xpc_partition_engaged(1UL << partid) == 0);
@@ -870,20 +870,20 @@ xpc_partition_disengaged(struct xpc_partition *part)
 /*
  * Mark specified partition as active.
  */
-enum xpc_retval
+enum xp_retval
 xpc_mark_partition_active(struct xpc_partition *part)
 {
         unsigned long irq_flags;
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         dev_dbg(xpc_part, "setting partition %d to ACTIVE\n", XPC_PARTID(part));
 
         spin_lock_irqsave(&part->act_lock, irq_flags);
         if (part->act_state == XPC_P_ACTIVATING) {
                 part->act_state = XPC_P_ACTIVE;
-                ret = xpcSuccess;
+                ret = xpSuccess;
         } else {
-                DBUG_ON(part->reason == xpcSuccess);
+                DBUG_ON(part->reason == xpSuccess);
                 ret = part->reason;
         }
         spin_unlock_irqrestore(&part->act_lock, irq_flags);
@@ -896,7 +896,7 @@ xpc_mark_partition_active(struct xpc_partition *part)
  */
 void
 xpc_deactivate_partition(const int line, struct xpc_partition *part,
-                         enum xpc_retval reason)
+                         enum xp_retval reason)
 {
         unsigned long irq_flags;
 
@@ -905,15 +905,15 @@ xpc_deactivate_partition(const int line, struct xpc_partition *part,
         if (part->act_state == XPC_P_INACTIVE) {
                 XPC_SET_REASON(part, reason, line);
                 spin_unlock_irqrestore(&part->act_lock, irq_flags);
-                if (reason == xpcReactivating) {
+                if (reason == xpReactivating) {
                         /* we interrupt ourselves to reactivate partition */
                         xpc_IPI_send_reactivate(part);
                 }
                 return;
         }
         if (part->act_state == XPC_P_DEACTIVATING) {
-                if ((part->reason == xpcUnloading && reason != xpcUnloading) ||
-                    reason == xpcReactivating) {
+                if ((part->reason == xpUnloading && reason != xpUnloading) ||
+                    reason == xpReactivating) {
                         XPC_SET_REASON(part, reason, line);
                 }
                 spin_unlock_irqrestore(&part->act_lock, irq_flags);
@@ -982,10 +982,10 @@ xpc_discovery(void)
         int max_regions;
         int nasid;
         struct xpc_rsvd_page *rp;
-        partid_t partid;
+        short partid;
         struct xpc_partition *part;
         u64 *discovered_nasids;
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         remote_rp = xpc_kmalloc_cacheline_aligned(XPC_RP_HEADER_SIZE +
                                                   xp_nasid_mask_bytes,
@@ -1063,12 +1063,12 @@ xpc_discovery(void)
 
                         ret = xpc_get_remote_rp(nasid, discovered_nasids,
                                                 remote_rp, &remote_rp_pa);
-                        if (ret != xpcSuccess) {
+                        if (ret != xpSuccess) {
                                 dev_dbg(xpc_part, "unable to get reserved page "
                                         "from nasid %d, reason=%d\n", nasid,
                                         ret);
 
-                                if (ret == xpcLocalPartid)
+                                if (ret == xpLocalPartid)
                                         break;
 
                                 continue;
@@ -1082,7 +1082,7 @@ xpc_discovery(void)
                         /* pull over the cross partition variables */
 
                         ret = xpc_get_remote_vars(remote_vars_pa, remote_vars);
-                        if (ret != xpcSuccess) {
+                        if (ret != xpSuccess) {
                                 dev_dbg(xpc_part, "unable to get XPC variables "
                                         "from nasid %d, reason=%d\n", nasid,
                                         ret);
@@ -1116,7 +1116,7 @@ xpc_discovery(void)
                                         "register xp_addr region 0x%016lx\n",
                                         partid, remote_vars->amos_page_pa);
 
-                                XPC_SET_REASON(part, xpcPhysAddrRegFailed,
+                                XPC_SET_REASON(part, xpPhysAddrRegFailed,
                                                __LINE__);
                                 break;
                         }
@@ -1151,8 +1151,8 @@ xpc_discovery(void)
  * Given a partid, get the nasids owned by that partition from the
  * remote partition's reserved page.
  */
-enum xpc_retval
-xpc_initiate_partid_to_nasids(partid_t partid, void *nasid_mask)
+enum xp_retval
+xpc_initiate_partid_to_nasids(short partid, void *nasid_mask)
 {
         struct xpc_partition *part;
         u64 part_nasid_pa;
@@ -1160,7 +1160,7 @@ xpc_initiate_partid_to_nasids(partid_t partid, void *nasid_mask)
 
         part = &xpc_partitions[partid];
         if (part->remote_rp_pa == 0)
-                return xpcPartitionDown;
+                return xpPartitionDown;
 
         memset(nasid_mask, 0, XP_NASID_MASK_BYTES);
 
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index a9543c65814..822dc8e8d7f 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -166,7 +166,7 @@ struct device *xpnet = &xpnet_dbg_subname;
  * Packet was recevied by XPC and forwarded to us.
  */
 static void
-xpnet_receive(partid_t partid, int channel, struct xpnet_message *msg)
+xpnet_receive(short partid, int channel, struct xpnet_message *msg)
 {
         struct sk_buff *skb;
         bte_result_t bret;
@@ -282,7 +282,7 @@ xpnet_receive(partid_t partid, int channel, struct xpnet_message *msg)
  * state or message reception on a connection.
  */
 static void
-xpnet_connection_activity(enum xpc_retval reason, partid_t partid, int channel,
+xpnet_connection_activity(enum xp_retval reason, short partid, int channel,
                           void *data, void *key)
 {
         long bp;
@@ -291,13 +291,13 @@ xpnet_connection_activity(enum xpc_retval reason, partid_t partid, int channel,
         DBUG_ON(channel != XPC_NET_CHANNEL);
 
         switch (reason) {
-        case xpcMsgReceived:    /* message received */
+        case xpMsgReceived:     /* message received */
                 DBUG_ON(data == NULL);
 
                 xpnet_receive(partid, channel, (struct xpnet_message *)data);
                 break;
 
-        case xpcConnected:      /* connection completed to a partition */
+        case xpConnected:       /* connection completed to a partition */
                 spin_lock_bh(&xpnet_broadcast_lock);
                 xpnet_broadcast_partitions |= 1UL << (partid - 1);
                 bp = xpnet_broadcast_partitions;
@@ -330,7 +330,7 @@ xpnet_connection_activity(enum xpc_retval reason, partid_t partid, int channel,
 static int
 xpnet_dev_open(struct net_device *dev)
 {
-        enum xpc_retval ret;
+        enum xp_retval ret;
 
         dev_dbg(xpnet, "calling xpc_connect(%d, 0x%p, NULL, %ld, %ld, %ld, "
                 "%ld)\n", XPC_NET_CHANNEL, xpnet_connection_activity,
@@ -340,7 +340,7 @@ xpnet_dev_open(struct net_device *dev)
         ret = xpc_connect(XPC_NET_CHANNEL, xpnet_connection_activity, NULL,
                           XPNET_MSG_SIZE, XPNET_MSG_NENTRIES,
                           XPNET_MAX_KTHREADS, XPNET_MAX_IDLE_KTHREADS);
-        if (ret != xpcSuccess) {
+        if (ret != xpSuccess) {
                 dev_err(xpnet, "ifconfig up of %s failed on XPC connect, "
                         "ret=%d\n", dev->name, ret);
 
@@ -407,7 +407,7 @@ xpnet_dev_get_stats(struct net_device *dev)
  * release the skb and then release our pending message structure.
  */
 static void
-xpnet_send_completed(enum xpc_retval reason, partid_t partid, int channel,
+xpnet_send_completed(enum xp_retval reason, short partid, int channel,
                      void *__qm)
 {
         struct xpnet_pending_msg *queued_msg = (struct xpnet_pending_msg *)__qm;
@@ -439,12 +439,12 @@ static int
 xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct xpnet_pending_msg *queued_msg;
-        enum xpc_retval ret;
+        enum xp_retval ret;
         struct xpnet_message *msg;
         u64 start_addr, end_addr;
         long dp;
         u8 second_mac_octet;
-        partid_t dest_partid;
+        short dest_partid;
         struct xpnet_dev_private *priv;
         u16 embedded_bytes;
 
@@ -528,7 +528,7 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 ret = xpc_allocate(dest_partid, XPC_NET_CHANNEL,
                                    XPC_NOWAIT, (void **)&msg);
-                if (unlikely(ret != xpcSuccess))
+                if (unlikely(ret != xpSuccess))
                         continue;
 
                 msg->embedded_bytes = embedded_bytes;
@@ -557,7 +557,7 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 ret = xpc_send_notify(dest_partid, XPC_NET_CHANNEL, msg,
                                       xpnet_send_completed, queued_msg);
-                if (unlikely(ret != xpcSuccess)) {
+                if (unlikely(ret != xpSuccess)) {
                         atomic_dec(&queued_msg->use_count);
                         continue;
                 }
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 626ac083f4e..da5fecad74d 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -425,7 +425,7 @@ static void mmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                         host->cclk = host->mclk;
                 } else {
                         clk = host->mclk / (2 * ios->clock) - 1;
-                        if (clk > 256)
+                        if (clk >= 256)
                                 clk = 255;
                         host->cclk = host->mclk / (2 * (clk + 1));
                 }
@@ -512,6 +512,18 @@ static int mmci_probe(struct amba_device *dev, void *id)
 
         host->plat = plat;
         host->mclk = clk_get_rate(host->clk);
+        /*
+         * According to the spec, mclk is max 100 MHz,
+         * so we try to adjust the clock down to this,
+         * (if possible).
+         */
+        if (host->mclk > 100000000) {
+                ret = clk_set_rate(host->clk, 100000000);
+                if (ret < 0)
+                        goto clk_disable;
+                host->mclk = clk_get_rate(host->clk);
+                DBG(host, "eventual mclk rate: %u Hz\n", host->mclk);
+        }
         host->mmc = mmc;
         host->base = ioremap(dev->res.start, SZ_4K);
         if (!host->base) {
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 7fb02e177a3..299118de893 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -187,7 +187,7 @@ struct sdhci_host {
         struct mmc_request      *mrq;           /* Current request */
         struct mmc_command      *cmd;           /* Current command */
         struct mmc_data         *data;          /* Current data request */
-        int                     data_early:1;   /* Data finished before cmd */
+        unsigned int            data_early:1;   /* Data finished before cmd */
 
         struct scatterlist      *cur_sg;        /* We're working on this */
         int                     num_sg;         /* Entries left */
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index e812df607a5..fcd1aeccdf9 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -82,9 +82,8 @@ static struct mtd_info *cfi_intelext_setup (struct mtd_info *);
 static int cfi_intelext_partition_fixup(struct mtd_info *, struct cfi_private **);
 
 static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len,
-                     size_t *retlen, u_char **mtdbuf);
-static void cfi_intelext_unpoint (struct mtd_info *mtd, u_char *addr, loff_t from,
-                        size_t len);
+                     size_t *retlen, void **virt, resource_size_t *phys);
+static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len);
 
 static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
 static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
@@ -1240,7 +1239,8 @@ static int do_point_onechip (struct map_info *map, struct flchip *chip, loff_t a
         return ret;
 }
 
-static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen, u_char **mtdbuf)
+static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
+                size_t *retlen, void **virt, resource_size_t *phys)
 {
         struct map_info *map = mtd->priv;
         struct cfi_private *cfi = map->fldrv_priv;
@@ -1257,8 +1257,10 @@ static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len, si
         chipnum = (from >> cfi->chipshift);
         ofs = from - (chipnum << cfi->chipshift);
 
-        *mtdbuf = (void *)map->virt + cfi->chips[chipnum].start + ofs;
+        *virt = map->virt + cfi->chips[chipnum].start + ofs;
         *retlen = 0;
+        if (phys)
+                *phys = map->phys + cfi->chips[chipnum].start + ofs;
 
         while (len) {
                 unsigned long thislen;
@@ -1291,7 +1293,7 @@ static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len, si
         return 0;
 }
 
-static void cfi_intelext_unpoint (struct mtd_info *mtd, u_char *addr, loff_t from, size_t len)
+static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
         struct map_info *map = mtd->priv;
         struct cfi_private *cfi = map->fldrv_priv;
diff --git a/drivers/mtd/devices/mtdram.c b/drivers/mtd/devices/mtdram.c
index bf485ff4945..0399be17862 100644
--- a/drivers/mtd/devices/mtdram.c
+++ b/drivers/mtd/devices/mtdram.c
@@ -48,18 +48,21 @@ static int ram_erase(struct mtd_info *mtd, struct erase_info *instr)
 }
 
 static int ram_point(struct mtd_info *mtd, loff_t from, size_t len,
-                size_t *retlen, u_char **mtdbuf)
+                size_t *retlen, void **virt, resource_size_t *phys)
 {
         if (from + len > mtd->size)
                 return -EINVAL;
 
-        *mtdbuf = mtd->priv + from;
+        /* can we return a physical address with this driver? */
+        if (phys)
+                return -EINVAL;
+
+        *virt = mtd->priv + from;
         *retlen = len;
         return 0;
 }
 
-static void ram_unpoint(struct mtd_info *mtd, u_char * addr, loff_t from,
-                size_t len)
+static void ram_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
 }
 
diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 5f960182da9..c7987b1c5e0 100644
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -57,20 +57,21 @@ static int phram_erase(struct mtd_info *mtd, struct erase_info *instr)
 }
 
 static int phram_point(struct mtd_info *mtd, loff_t from, size_t len,
-                size_t *retlen, u_char **mtdbuf)
+                size_t *retlen, void **virt, resource_size_t *phys)
 {
-        u_char *start = mtd->priv;
-
         if (from + len > mtd->size)
                 return -EINVAL;
 
-        *mtdbuf = start + from;
+        /* can we return a physical address with this driver? */
+        if (phys)
+                return -EINVAL;
+
+        *virt = mtd->priv + from;
         *retlen = len;
         return 0;
 }
 
-static void phram_unpoint(struct mtd_info *mtd, u_char *addr, loff_t from,
-                size_t len)
+static void phram_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
 }
 
diff --git a/drivers/mtd/devices/pmc551.c b/drivers/mtd/devices/pmc551.c
index 7060a0895ce..bc998174906 100644
--- a/drivers/mtd/devices/pmc551.c
+++ b/drivers/mtd/devices/pmc551.c
@@ -134,7 +134,8 @@ static int pmc551_erase(struct mtd_info *mtd, struct erase_info *instr)
         eoff_lo = end & (priv->asize - 1);
         soff_lo = instr->addr & (priv->asize - 1);
 
-        pmc551_point(mtd, instr->addr, instr->len, &retlen, &ptr);
+        pmc551_point(mtd, instr->addr, instr->len, &retlen,
+                     (void **)&ptr, NULL);
 
         if (soff_hi == eoff_hi || mtd->size == priv->asize) {
                 /* The whole thing fits within one access, so just one shot
@@ -154,7 +155,8 @@ static int pmc551_erase(struct mtd_info *mtd, struct erase_info *instr)
                         }
                         soff_hi += priv->asize;
                         pmc551_point(mtd, (priv->base_map0 | soff_hi),
-                                     priv->asize, &retlen, &ptr);
+                                     priv->asize, &retlen,
+                                     (void **)&ptr, NULL);
                 }
                 memset(ptr, 0xff, eoff_lo);
         }
@@ -170,7 +172,7 @@ static int pmc551_erase(struct mtd_info *mtd, struct erase_info *instr)
 }
 
 static int pmc551_point(struct mtd_info *mtd, loff_t from, size_t len,
-                        size_t * retlen, u_char ** mtdbuf)
+                        size_t *retlen, void **virt, resource_size_t *phys)
 {
         struct mypriv *priv = mtd->priv;
         u32 soff_hi;
@@ -188,6 +190,10 @@ static int pmc551_point(struct mtd_info *mtd, loff_t from, size_t len,
                 return -EINVAL;
         }
 
+        /* can we return a physical address with this driver? */
+        if (phys)
+                return -EINVAL;
+
         soff_hi = from & ~(priv->asize - 1);
         soff_lo = from & (priv->asize - 1);
 
@@ -198,13 +204,12 @@ static int pmc551_point(struct mtd_info *mtd, loff_t from, size_t len,
                 priv->curr_map0 = soff_hi;
         }
 
-        *mtdbuf = priv->start + soff_lo;
+        *virt = priv->start + soff_lo;
         *retlen = len;
         return 0;
 }
 
-static void pmc551_unpoint(struct mtd_info *mtd, u_char * addr, loff_t from,
-                           size_t len)
+static void pmc551_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
 #ifdef CONFIG_MTD_PMC551_DEBUG
         printk(KERN_DEBUG "pmc551_unpoint()\n");
@@ -242,7 +247,7 @@ static int pmc551_read(struct mtd_info *mtd, loff_t from, size_t len,
         soff_lo = from & (priv->asize - 1);
         eoff_lo = end & (priv->asize - 1);
 
-        pmc551_point(mtd, from, len, retlen, &ptr);
+        pmc551_point(mtd, from, len, retlen, (void **)&ptr, NULL);
 
         if (soff_hi == eoff_hi) {
                 /* The whole thing fits within one access, so just one shot
@@ -263,7 +268,8 @@ static int pmc551_read(struct mtd_info *mtd, loff_t from, size_t len,
                                 goto out;
                         }
                         soff_hi += priv->asize;
-                        pmc551_point(mtd, soff_hi, priv->asize, retlen, &ptr);
+                        pmc551_point(mtd, soff_hi, priv->asize, retlen,
+                                     (void **)&ptr, NULL);
                 }
                 memcpy(copyto, ptr, eoff_lo);
                 copyto += eoff_lo;
@@ -308,7 +314,7 @@ static int pmc551_write(struct mtd_info *mtd, loff_t to, size_t len,
         soff_lo = to & (priv->asize - 1);
         eoff_lo = end & (priv->asize - 1);
 
-        pmc551_point(mtd, to, len, retlen, &ptr);
+        pmc551_point(mtd, to, len, retlen, (void **)&ptr, NULL);
 
         if (soff_hi == eoff_hi) {
                 /* The whole thing fits within one access, so just one shot
@@ -329,7 +335,8 @@ static int pmc551_write(struct mtd_info *mtd, loff_t to, size_t len,
                                 goto out;
                         }
                         soff_hi += priv->asize;
-                        pmc551_point(mtd, soff_hi, priv->asize, retlen, &ptr);
+                        pmc551_point(mtd, soff_hi, priv->asize, retlen,
+                                     (void **)&ptr, NULL);
                 }
                 memcpy(ptr, copyfrom, eoff_lo);
                 copyfrom += eoff_lo;
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index d293add1857..cb86db746f2 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -76,8 +76,9 @@ static char *map;
 static slram_mtd_list_t *slram_mtdlist = NULL;
 
 static int slram_erase(struct mtd_info *, struct erase_info *);
-static int slram_point(struct mtd_info *, loff_t, size_t, size_t *, u_char **);
-static void slram_unpoint(struct mtd_info *, u_char *, loff_t,  size_t);
+static int slram_point(struct mtd_info *, loff_t, size_t, size_t *, void **,
+                resource_size_t *);
+static void slram_unpoint(struct mtd_info *, loff_t, size_t);
 static int slram_read(struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int slram_write(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
 
@@ -104,19 +105,23 @@ static int slram_erase(struct mtd_info *mtd, struct erase_info *instr)
 }
 
 static int slram_point(struct mtd_info *mtd, loff_t from, size_t len,
-                size_t *retlen, u_char **mtdbuf)
+                size_t *retlen, void **virt, resource_size_t *phys)
 {
         slram_priv_t *priv = mtd->priv;
 
+        /* can we return a physical address with this driver? */
+        if (phys)
+                return -EINVAL;
+
         if (from + len > mtd->size)
                 return -EINVAL;
 
-        *mtdbuf = priv->start + from;
+        *virt = priv->start + from;
         *retlen = len;
         return(0);
 }
 
-static void slram_unpoint(struct mtd_info *mtd, u_char *addr, loff_t from, size_t len)
+static void slram_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
 }
 
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 1bd69aa9e22..17bc87a43ff 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -374,7 +374,7 @@ config MTD_REDWOOD
 
 config MTD_SOLUTIONENGINE
         tristate "CFI Flash device mapped on Hitachi SolutionEngine"
-        depends on SUPERH && MTD_CFI && MTD_REDBOOT_PARTS
+        depends on SUPERH && SOLUTION_ENGINE && MTD_CFI && MTD_REDBOOT_PARTS
         help
           This enables access to the flash chips on the Hitachi SolutionEngine and
           similar boards. Say 'Y' if you are building a kernel for such a board.
@@ -480,13 +480,6 @@ config MTD_H720X
           This enables access to the flash chips on the Hynix evaluation boards.
           If you have such a board, say 'Y'.
 
-config MTD_MPC1211
-        tristate "CFI Flash device mapped on Interface MPC-1211"
-        depends on SH_MPC1211 && MTD_CFI
-        help
-          This enables access to the flash chips on the Interface MPC-1211(CTP/PCI/MPC-SH02).
-          If you have such a board, say 'Y'.
-
 config MTD_OMAP_NOR
         tristate "TI OMAP board mappings"
         depends on MTD_CFI && ARCH_OMAP
diff --git a/drivers/mtd/maps/Makefile b/drivers/mtd/maps/Makefile
index a9cbe80f99a..957fb5f70f5 100644
--- a/drivers/mtd/maps/Makefile
+++ b/drivers/mtd/maps/Makefile
@@ -58,7 +58,6 @@ obj-$(CONFIG_MTD_WALNUT)        += walnut.o
 obj-$(CONFIG_MTD_H720X)         += h720x-flash.o
 obj-$(CONFIG_MTD_SBC8240)       += sbc8240.o
 obj-$(CONFIG_MTD_NOR_TOTO)      += omap-toto-flash.o
-obj-$(CONFIG_MTD_MPC1211)       += mpc1211.o
 obj-$(CONFIG_MTD_IXP4XX)        += ixp4xx.o
 obj-$(CONFIG_MTD_IXP2000)       += ixp2000.o
 obj-$(CONFIG_MTD_WRSBC8260)     += wr_sbc82xx_flash.o
diff --git a/drivers/mtd/maps/mpc1211.c b/drivers/mtd/maps/mpc1211.c
deleted file mode 100644
index 45a00fac88a..00000000000
--- a/drivers/mtd/maps/mpc1211.c
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Flash on MPC-1211
- *
- * $Id: mpc1211.c,v 1.4 2004/09/16 23:27:13 gleixner Exp $
- *
- * (C) 2002 Interface, Saito.K & Jeanne
- *
- * GPL'd
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <asm/io.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-
-static struct mtd_info *flash_mtd;
-static struct mtd_partition *parsed_parts;
-
-struct map_info mpc1211_flash_map = {
-        .name           = "MPC-1211 FLASH",
-        .size           = 0x80000,
-        .bankwidth      = 1,
-};
-
-static struct mtd_partition mpc1211_partitions[] = {
-        {
-                .name   = "IPL & ETH-BOOT",
-                .offset = 0x00000000,
-                .size   = 0x10000,
-        },
-        {
-                .name   = "Flash FS",
-                .offset = 0x00010000,
-                .size   = MTDPART_SIZ_FULL,
-        }
-};
-
-static int __init init_mpc1211_maps(void)
-{
-        int nr_parts;
-
-        mpc1211_flash_map.phys = 0;
-        mpc1211_flash_map.virt = (void __iomem *)P2SEGADDR(0);
-
-        simple_map_init(&mpc1211_flash_map);
-
-        printk(KERN_NOTICE "Probing for flash chips at 0x00000000:\n");
-        flash_mtd = do_map_probe("jedec_probe", &mpc1211_flash_map);
-        if (!flash_mtd) {
-                printk(KERN_NOTICE "Flash chips not detected at either possible location.\n");
-                return -ENXIO;
-        }
-        printk(KERN_NOTICE "MPC-1211: Flash at 0x%08lx\n", mpc1211_flash_map.virt & 0x1fffffff);
-        flash_mtd->module = THIS_MODULE;
-
-        parsed_parts = mpc1211_partitions;
-        nr_parts = ARRAY_SIZE(mpc1211_partitions);
-
-        add_mtd_partitions(flash_mtd, parsed_parts, nr_parts);
-        return 0;
-}
-
-static void __exit cleanup_mpc1211_maps(void)
-{
-        if (parsed_parts)
-                del_mtd_partitions(flash_mtd);
-        else
-                del_mtd_device(flash_mtd);
-        map_destroy(flash_mtd);
-}
-
-module_init(init_mpc1211_maps);
-module_exit(cleanup_mpc1211_maps);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Saito.K & Jeanne <ksaito@interface.co.jp>");
-MODULE_DESCRIPTION("MTD map driver for MPC-1211 boards. Interface");
diff --git a/drivers/mtd/maps/uclinux.c b/drivers/mtd/maps/uclinux.c
index 14ffb1a9302..c42f4b83f68 100644
--- a/drivers/mtd/maps/uclinux.c
+++ b/drivers/mtd/maps/uclinux.c
@@ -40,10 +40,12 @@ struct mtd_partition uclinux_romfs[] = {
 /****************************************************************************/
 
 int uclinux_point(struct mtd_info *mtd, loff_t from, size_t len,
-        size_t *retlen, u_char **mtdbuf)
+        size_t *retlen, void **virt, resource_size_t *phys)
 {
         struct map_info *map = mtd->priv;
-        *mtdbuf = (u_char *) (map->virt + ((int) from));
+        *virt = map->virt + from;
+        if (phys)
+                *phys = map->phys + from;
         *retlen = len;
         return(0);
 }
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index c66902df317..07c70116934 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -68,7 +68,7 @@ static int part_read (struct mtd_info *mtd, loff_t from, size_t len,
 }
 
 static int part_point (struct mtd_info *mtd, loff_t from, size_t len,
-                        size_t *retlen, u_char **buf)
+                        size_t *retlen, void **virt, resource_size_t *phys)
 {
         struct mtd_part *part = PART(mtd);
         if (from >= mtd->size)
@@ -76,14 +76,14 @@ static int part_point (struct mtd_info *mtd, loff_t from, size_t len,
         else if (from + len > mtd->size)
                 len = mtd->size - from;
         return part->master->point (part->master, from + part->offset,
-                                    len, retlen, buf);
+                                    len, retlen, virt, phys);
 }
 
-static void part_unpoint (struct mtd_info *mtd, u_char *addr, loff_t from, size_t len)
+static void part_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
         struct mtd_part *part = PART(mtd);
 
-        part->master->unpoint (part->master, addr, from + part->offset, len);
+        part->master->unpoint(part->master, from + part->offset, len);
 }
 
 static int part_read_oob(struct mtd_info *mtd, loff_t from,
diff --git a/drivers/mtd/nand/at91_nand.c b/drivers/mtd/nand/at91_nand.c
index 414ceaecdb3..0adb287027a 100644
--- a/drivers/mtd/nand/at91_nand.c
+++ b/drivers/mtd/nand/at91_nand.c
@@ -94,6 +94,24 @@ struct at91_nand_host {
 };
 
 /*
+ * Enable NAND.
+ */
+static void at91_nand_enable(struct at91_nand_host *host)
+{
+        if (host->board->enable_pin)
+                at91_set_gpio_value(host->board->enable_pin, 0);
+}
+
+/*
+ * Disable NAND.
+ */
+static void at91_nand_disable(struct at91_nand_host *host)
+{
+        if (host->board->enable_pin)
+                at91_set_gpio_value(host->board->enable_pin, 1);
+}
+
+/*
  * Hardware specific access to control-lines
  */
 static void at91_nand_cmd_ctrl(struct mtd_info *mtd, int cmd, unsigned int ctrl)
@@ -101,11 +119,11 @@ static void at91_nand_cmd_ctrl(struct mtd_info *mtd, int cmd, unsigned int ctrl)
         struct nand_chip *nand_chip = mtd->priv;
         struct at91_nand_host *host = nand_chip->priv;
 
-        if (host->board->enable_pin && (ctrl & NAND_CTRL_CHANGE)) {
+        if (ctrl & NAND_CTRL_CHANGE) {
                 if (ctrl & NAND_NCE)
-                        at91_set_gpio_value(host->board->enable_pin, 0);
+                        at91_nand_enable(host);
                 else
-                        at91_set_gpio_value(host->board->enable_pin, 1);
+                        at91_nand_disable(host);
         }
         if (cmd == NAND_CMD_NONE)
                 return;
@@ -128,24 +146,6 @@ static int at91_nand_device_ready(struct mtd_info *mtd)
 }
 
 /*
- * Enable NAND.
- */
-static void at91_nand_enable(struct at91_nand_host *host)
-{
-        if (host->board->enable_pin)
-                at91_set_gpio_value(host->board->enable_pin, 0);
-}
-
-/*
- * Disable NAND.
- */
-static void at91_nand_disable(struct at91_nand_host *host)
-{
-        if (host->board->enable_pin)
-                at91_set_gpio_value(host->board->enable_pin, 1);
-}
-
-/*
  * write oob for small pages
  */
 static int at91_nand_write_oob_512(struct mtd_info *mtd,
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index d7a3ea88edd..32a4f17d35f 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -67,6 +67,10 @@
 #define FEC_MAX_PORTS   1
 #endif
 
+#if defined(CONFIG_FADS) || defined(CONFIG_RPXCLASSIC) || defined(CONFIG_M5272)
+#define HAVE_mii_link_interrupt
+#endif
+
 /*
  * Define the fixed address of the FEC hardware.
  */
@@ -205,7 +209,10 @@ struct fec_enet_private {
         cbd_t   *cur_rx, *cur_tx;               /* The next free ring entry */
         cbd_t   *dirty_tx;      /* The ring entries to be free()ed. */
         uint    tx_full;
-        spinlock_t lock;
+        /* hold while accessing the HW like ringbuffer for tx/rx but not MAC */
+        spinlock_t hw_lock;
+        /* hold while accessing the mii_list_t() elements */
+        spinlock_t mii_lock;
 
         uint    phy_id;
         uint    phy_id_done;
@@ -309,6 +316,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         volatile fec_t  *fecp;
         volatile cbd_t  *bdp;
         unsigned short  status;
+        unsigned long flags;
 
         fep = netdev_priv(dev);
         fecp = (volatile fec_t*)dev->base_addr;
@@ -318,6 +326,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 return 1;
         }
 
+        spin_lock_irqsave(&fep->hw_lock, flags);
         /* Fill in a Tx ring entry */
         bdp = fep->cur_tx;
 
@@ -328,6 +337,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
                  * This should not happen, since dev->tbusy should be set.
                  */
                 printk("%s: tx queue full!.\n", dev->name);
+                spin_unlock_irqrestore(&fep->hw_lock, flags);
                 return 1;
         }
 #endif
@@ -366,8 +376,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         flush_dcache_range((unsigned long)skb->data,
                            (unsigned long)skb->data + skb->len);
 
-        spin_lock_irq(&fep->lock);
-
         /* Send it on its way.  Tell FEC it's ready, interrupt when done,
          * it's the last BD of the frame, and to put the CRC on the end.
          */
@@ -396,7 +404,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         fep->cur_tx = (cbd_t *)bdp;
 
-        spin_unlock_irq(&fep->lock);
+        spin_unlock_irqrestore(&fep->hw_lock, flags);
 
         return 0;
 }
@@ -454,19 +462,20 @@ fec_enet_interrupt(int irq, void * dev_id)
         struct  net_device *dev = dev_id;
         volatile fec_t  *fecp;
         uint    int_events;
-        int handled = 0;
+        irqreturn_t ret = IRQ_NONE;
 
         fecp = (volatile fec_t*)dev->base_addr;
 
         /* Get the interrupt events that caused us to be here.
         */
-        while ((int_events = fecp->fec_ievent) != 0) {
+        do {
+                int_events = fecp->fec_ievent;
                 fecp->fec_ievent = int_events;
 
                 /* Handle receive event in its own function.
                  */
                 if (int_events & FEC_ENET_RXF) {
-                        handled = 1;
+                        ret = IRQ_HANDLED;
                         fec_enet_rx(dev);
                 }
 
@@ -475,17 +484,18 @@ fec_enet_interrupt(int irq, void * dev_id)
                    them as part of the transmit process.
                 */
                 if (int_events & FEC_ENET_TXF) {
-                        handled = 1;
+                        ret = IRQ_HANDLED;
                         fec_enet_tx(dev);
                 }
 
                 if (int_events & FEC_ENET_MII) {
-                        handled = 1;
+                        ret = IRQ_HANDLED;
                         fec_enet_mii(dev);
                 }
 
-        }
-        return IRQ_RETVAL(handled);
+        } while (int_events);
+
+        return ret;
 }
 
 
@@ -498,7 +508,7 @@ fec_enet_tx(struct net_device *dev)
         struct  sk_buff *skb;
 
         fep = netdev_priv(dev);
-        spin_lock(&fep->lock);
+        spin_lock_irq(&fep->hw_lock);
         bdp = fep->dirty_tx;
 
         while (((status = bdp->cbd_sc) & BD_ENET_TX_READY) == 0) {
@@ -557,7 +567,7 @@ fec_enet_tx(struct net_device *dev)
                 }
         }
         fep->dirty_tx = (cbd_t *)bdp;
-        spin_unlock(&fep->lock);
+        spin_unlock_irq(&fep->hw_lock);
 }
 
 
@@ -584,6 +594,8 @@ fec_enet_rx(struct net_device *dev)
         fep = netdev_priv(dev);
         fecp = (volatile fec_t*)dev->base_addr;
 
+        spin_lock_irq(&fep->hw_lock);
+
         /* First, grab all of the stats for the incoming packet.
          * These get messed up if we get called due to a busy condition.
          */
@@ -689,6 +701,8 @@ while (!((status = bdp->cbd_sc) & BD_ENET_RX_EMPTY)) {
          */
         fecp->fec_r_des_active = 0;
 #endif
+
+        spin_unlock_irq(&fep->hw_lock);
 }
 
 
@@ -702,11 +716,11 @@ fec_enet_mii(struct net_device *dev)
         uint            mii_reg;
 
         fep = netdev_priv(dev);
+        spin_lock_irq(&fep->mii_lock);
+
         ep = fep->hwp;
         mii_reg = ep->fec_mii_data;
 
-        spin_lock(&fep->lock);
-
         if ((mip = mii_head) == NULL) {
                 printk("MII and no head!\n");
                 goto unlock;
@@ -723,7 +737,7 @@ fec_enet_mii(struct net_device *dev)
                 ep->fec_mii_data = mip->mii_regval;
 
 unlock:
-        spin_unlock(&fep->lock);
+        spin_unlock_irq(&fep->mii_lock);
 }
 
 static int
@@ -737,12 +751,11 @@ mii_queue(struct net_device *dev, int regval, void (*func)(uint, struct net_devi
         /* Add PHY address to register command.
         */
         fep = netdev_priv(dev);
-        regval |= fep->phy_addr << 23;
+        spin_lock_irqsave(&fep->mii_lock, flags);
 
+        regval |= fep->phy_addr << 23;
         retval = 0;
 
-        spin_lock_irqsave(&fep->lock,flags);
-
         if ((mip = mii_free) != NULL) {
                 mii_free = mip->mii_next;
                 mip->mii_regval = regval;
@@ -759,9 +772,8 @@ mii_queue(struct net_device *dev, int regval, void (*func)(uint, struct net_devi
                 retval = 1;
         }
 
-        spin_unlock_irqrestore(&fep->lock,flags);
-
-        return(retval);
+        spin_unlock_irqrestore(&fep->mii_lock, flags);
+        return retval;
 }
 
 static void mii_do_cmd(struct net_device *dev, const phy_cmd_t *c)
@@ -1222,7 +1234,7 @@ static phy_info_t const * const phy_info[] = {
 };
 
 /* ------------------------------------------------------------------------- */
-#if !defined(CONFIG_M532x)
+#ifdef HAVE_mii_link_interrupt
 #ifdef CONFIG_RPXCLASSIC
 static void
 mii_link_interrupt(void *dev_id);
@@ -1362,18 +1374,8 @@ static void __inline__ fec_request_intrs(struct net_device *dev)
                 unsigned short irq;
         } *idp, id[] = {
                 { "fec(TXF)", 23 },
-                { "fec(TXB)", 24 },
-                { "fec(TXFIFO)", 25 },
-                { "fec(TXCR)", 26 },
                 { "fec(RXF)", 27 },
-                { "fec(RXB)", 28 },
                 { "fec(MII)", 29 },
-                { "fec(LC)", 30 },
-                { "fec(HBERR)", 31 },
-                { "fec(GRA)", 32 },
-                { "fec(EBERR)", 33 },
-                { "fec(BABT)", 34 },
-                { "fec(BABR)", 35 },
                 { NULL },
         };
 
@@ -1533,18 +1535,8 @@ static void __inline__ fec_request_intrs(struct net_device *dev)
                 unsigned short irq;
         } *idp, id[] = {
                 { "fec(TXF)", 23 },
-                { "fec(TXB)", 24 },
-                { "fec(TXFIFO)", 25 },
-                { "fec(TXCR)", 26 },
                 { "fec(RXF)", 27 },
-                { "fec(RXB)", 28 },
                 { "fec(MII)", 29 },
-                { "fec(LC)", 30 },
-                { "fec(HBERR)", 31 },
-                { "fec(GRA)", 32 },
-                { "fec(EBERR)", 33 },
-                { "fec(BABT)", 34 },
-                { "fec(BABR)", 35 },
                 { NULL },
         };
 
@@ -1660,18 +1652,8 @@ static void __inline__ fec_request_intrs(struct net_device *dev)
                 unsigned short irq;
         } *idp, id[] = {
             { "fec(TXF)", 36 },
-            { "fec(TXB)", 37 },
-            { "fec(TXFIFO)", 38 },
-            { "fec(TXCR)", 39 },
             { "fec(RXF)", 40 },
-            { "fec(RXB)", 41 },
             { "fec(MII)", 42 },
-            { "fec(LC)", 43 },
-            { "fec(HBERR)", 44 },
-            { "fec(GRA)", 45 },
-            { "fec(EBERR)", 46 },
-            { "fec(BABT)", 47 },
-            { "fec(BABR)", 48 },
             { NULL },
         };
 
@@ -2126,6 +2108,7 @@ mii_discover_phy(uint mii_reg, struct net_device *dev)
 
 /* This interrupt occurs when the PHY detects a link change.
 */
+#ifdef HAVE_mii_link_interrupt
 #ifdef CONFIG_RPXCLASSIC
 static void
 mii_link_interrupt(void *dev_id)
@@ -2148,6 +2131,7 @@ mii_link_interrupt(int irq, void * dev_id)
 
         return IRQ_HANDLED;
 }
+#endif
 
 static int
 fec_enet_open(struct net_device *dev)
@@ -2243,13 +2227,13 @@ static void set_multicast_list(struct net_device *dev)
                         /* Catch all multicast addresses, so set the
                          * filter to all 1's.
                          */
-                        ep->fec_hash_table_high = 0xffffffff;
-                        ep->fec_hash_table_low = 0xffffffff;
+                        ep->fec_grp_hash_table_high = 0xffffffff;
+                        ep->fec_grp_hash_table_low = 0xffffffff;
                 } else {
                         /* Clear filter and add the addresses in hash register.
                         */
-                        ep->fec_hash_table_high = 0;
-                        ep->fec_hash_table_low = 0;
+                        ep->fec_grp_hash_table_high = 0;
+                        ep->fec_grp_hash_table_low = 0;
 
                         dmi = dev->mc_list;
 
@@ -2280,9 +2264,9 @@ static void set_multicast_list(struct net_device *dev)
                                 hash = (crc >> (32 - HASH_BITS)) & 0x3f;
 
                                 if (hash > 31)
-                                        ep->fec_hash_table_high |= 1 << (hash - 32);
+                                        ep->fec_grp_hash_table_high |= 1 << (hash - 32);
                                 else
-                                        ep->fec_hash_table_low |= 1 << hash;
+                                        ep->fec_grp_hash_table_low |= 1 << hash;
                         }
                 }
         }
@@ -2332,6 +2316,9 @@ int __init fec_enet_init(struct net_device *dev)
                 return -ENOMEM;
         }
 
+        spin_lock_init(&fep->hw_lock);
+        spin_lock_init(&fep->mii_lock);
+
         /* Create an Ethernet device instance.
         */
         fecp = (volatile fec_t *) fec_hw[index];
@@ -2430,11 +2417,15 @@ int __init fec_enet_init(struct net_device *dev)
         */
         fec_request_intrs(dev);
 
-        fecp->fec_hash_table_high = 0;
-        fecp->fec_hash_table_low = 0;
+        fecp->fec_grp_hash_table_high = 0;
+        fecp->fec_grp_hash_table_low = 0;
         fecp->fec_r_buff_size = PKT_MAXBLR_SIZE;
         fecp->fec_ecntrl = 2;
         fecp->fec_r_des_active = 0;
+#ifndef CONFIG_M5272
+        fecp->fec_hash_table_high = 0;
+        fecp->fec_hash_table_low = 0;
+#endif
 
         dev->base_addr = (unsigned long)fecp;
 
@@ -2455,8 +2446,7 @@ int __init fec_enet_init(struct net_device *dev)
 
         /* Clear and enable interrupts */
         fecp->fec_ievent = 0xffc00000;
-        fecp->fec_imask = (FEC_ENET_TXF | FEC_ENET_TXB |
-                FEC_ENET_RXF | FEC_ENET_RXB | FEC_ENET_MII);
+        fecp->fec_imask = (FEC_ENET_TXF | FEC_ENET_RXF | FEC_ENET_MII);
 
         /* Queue up command to detect the PHY and initialize the
          * remainder of the interface.
@@ -2500,8 +2490,8 @@ fec_restart(struct net_device *dev, int duplex)
 
         /* Reset all multicast.
         */
-        fecp->fec_hash_table_high = 0;
-        fecp->fec_hash_table_low = 0;
+        fecp->fec_grp_hash_table_high = 0;
+        fecp->fec_grp_hash_table_low = 0;
 
         /* Set maximum receive buffer size.
         */
@@ -2583,8 +2573,7 @@ fec_restart(struct net_device *dev, int duplex)
 
         /* Enable interrupts we wish to service.
         */
-        fecp->fec_imask = (FEC_ENET_TXF | FEC_ENET_TXB |
-                FEC_ENET_RXF | FEC_ENET_RXB | FEC_ENET_MII);
+        fecp->fec_imask = (FEC_ENET_TXF | FEC_ENET_RXF | FEC_ENET_MII);
 }
 
 static void
@@ -2624,7 +2613,7 @@ fec_stop(struct net_device *dev)
 static int __init fec_enet_module_init(void)
 {
         struct net_device *dev;
-        int i, j, err;
+        int i, err;
         DECLARE_MAC_BUF(mac);
 
         printk("FEC ENET Version 0.2\n");
diff --git a/drivers/net/fec.h b/drivers/net/fec.h
index 1d421606984..292719dacef 100644
--- a/drivers/net/fec.h
+++ b/drivers/net/fec.h
@@ -88,8 +88,8 @@ typedef struct fec {
         unsigned long   fec_reserved7[158];
         unsigned long   fec_addr_low;           /* Low 32bits MAC address */
         unsigned long   fec_addr_high;          /* High 16bits MAC address */
-        unsigned long   fec_hash_table_high;    /* High 32bits hash table */
-        unsigned long   fec_hash_table_low;     /* Low 32bits hash table */
+        unsigned long   fec_grp_hash_table_high;/* High 32bits hash table */
+        unsigned long   fec_grp_hash_table_low; /* Low 32bits hash table */
         unsigned long   fec_r_des_start;        /* Receive descriptor ring */
         unsigned long   fec_x_des_start;        /* Transmit descriptor ring */
         unsigned long   fec_r_buff_size;        /* Maximum receive buff size */
diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c
index d21b7ab64bd..5f9c42e7a7f 100644
--- a/drivers/net/fec_mpc52xx.c
+++ b/drivers/net/fec_mpc52xx.c
@@ -43,6 +43,29 @@
 
 #define DRIVER_NAME "mpc52xx-fec"
 
+#define FEC5200_PHYADDR_NONE    (-1)
+#define FEC5200_PHYADDR_7WIRE   (-2)
+
+/* Private driver data structure */
+struct mpc52xx_fec_priv {
+        int duplex;
+        int speed;
+        int r_irq;
+        int t_irq;
+        struct mpc52xx_fec __iomem *fec;
+        struct bcom_task *rx_dmatsk;
+        struct bcom_task *tx_dmatsk;
+        spinlock_t lock;
+        int msg_enable;
+
+        /* MDIO link details */
+        int phy_addr;
+        unsigned int phy_speed;
+        struct phy_device *phydev;
+        enum phy_state link;
+};
+
+
 static irqreturn_t mpc52xx_fec_interrupt(int, void *);
 static irqreturn_t mpc52xx_fec_rx_interrupt(int, void *);
 static irqreturn_t mpc52xx_fec_tx_interrupt(int, void *);
@@ -223,7 +246,7 @@ static int mpc52xx_fec_phy_start(struct net_device *dev)
         struct mpc52xx_fec_priv *priv = netdev_priv(dev);
         int err;
 
-        if (!priv->has_phy)
+        if (priv->phy_addr < 0)
                 return 0;
 
         err = mpc52xx_fec_init_phy(dev);
@@ -243,7 +266,7 @@ static void mpc52xx_fec_phy_stop(struct net_device *dev)
 {
         struct mpc52xx_fec_priv *priv = netdev_priv(dev);
 
-        if (!priv->has_phy)
+        if (!priv->phydev)
                 return;
 
         phy_disconnect(priv->phydev);
@@ -255,7 +278,7 @@ static void mpc52xx_fec_phy_stop(struct net_device *dev)
 static int mpc52xx_fec_phy_mii_ioctl(struct mpc52xx_fec_priv *priv,
                 struct mii_ioctl_data *mii_data, int cmd)
 {
-        if (!priv->has_phy)
+        if (!priv->phydev)
                 return -ENOTSUPP;
 
         return phy_mii_ioctl(priv->phydev, mii_data, cmd);
@@ -265,7 +288,7 @@ static void mpc52xx_fec_phy_hw_init(struct mpc52xx_fec_priv *priv)
 {
         struct mpc52xx_fec __iomem *fec = priv->fec;
 
-        if (!priv->has_phy)
+        if (priv->phydev)
                 return;
 
         out_be32(&fec->mii_speed, priv->phy_speed);
@@ -704,7 +727,7 @@ static void mpc52xx_fec_start(struct net_device *dev)
         rcntrl = FEC_RX_BUFFER_SIZE << 16;      /* max frame length */
         rcntrl |= FEC_RCNTRL_FCE;
 
-        if (priv->has_phy)
+        if (priv->phy_addr != FEC5200_PHYADDR_7WIRE)
                 rcntrl |= FEC_RCNTRL_MII_MODE;
 
         if (priv->duplex == DUPLEX_FULL)
@@ -864,7 +887,10 @@ mpc52xx_fec_probe(struct of_device *op, const struct of_device_id *match)
         struct net_device *ndev;
         struct mpc52xx_fec_priv *priv = NULL;
         struct resource mem;
-        const phandle *ph;
+        struct device_node *phy_node;
+        const phandle *phy_handle;
+        const u32 *prop;
+        int prop_size;
 
         phys_addr_t rx_fifo;
         phys_addr_t tx_fifo;
@@ -948,26 +974,37 @@ mpc52xx_fec_probe(struct of_device *op, const struct of_device_id *match)
                 mpc52xx_fec_get_paddr(ndev, ndev->dev_addr);
 
         priv->msg_enable = netif_msg_init(debug, MPC52xx_MESSAGES_DEFAULT);
-        priv->duplex = DUPLEX_FULL;
-
-        /* is the phy present in device tree? */
-        ph = of_get_property(op->node, "phy-handle", NULL);
-        if (ph) {
-                const unsigned int *prop;
-                struct device_node *phy_dn;
-                priv->has_phy = 1;
 
-                phy_dn = of_find_node_by_phandle(*ph);
-                prop = of_get_property(phy_dn, "reg", NULL);
-                priv->phy_addr = *prop;
+        /*
+         * Link mode configuration
+         */
 
-                of_node_put(phy_dn);
+        /* Start with safe defaults for link connection */
+        priv->phy_addr = FEC5200_PHYADDR_NONE;
+        priv->speed = 100;
+        priv->duplex = DUPLEX_HALF;
+        priv->phy_speed = ((mpc52xx_find_ipb_freq(op->node) >> 20) / 5) << 1;
+
+        /* the 7-wire property means don't use MII mode */
+        if (of_find_property(op->node, "fsl,7-wire-mode", NULL))
+                priv->phy_addr = FEC5200_PHYADDR_7WIRE;
+
+        /* The current speed preconfigures the speed of the MII link */
+        prop = of_get_property(op->node, "current-speed", &prop_size);
+        if (prop && (prop_size >= sizeof(u32) * 2)) {
+                priv->speed = prop[0];
+                priv->duplex = prop[1] ? DUPLEX_FULL : DUPLEX_HALF;
+        }
 
-                /* Phy speed */
-                priv->phy_speed = ((mpc52xx_find_ipb_freq(op->node) >> 20) / 5) << 1;
-        } else {
-                dev_info(&ndev->dev, "can't find \"phy-handle\" in device"
-                                " tree, using 7-wire mode\n");
+        /* If there is a phy handle, setup link to that phy */
+        phy_handle = of_get_property(op->node, "phy-handle", &prop_size);
+        if (phy_handle && (prop_size >= sizeof(phandle))) {
+                phy_node = of_find_node_by_phandle(*phy_handle);
+                prop = of_get_property(phy_node, "reg", &prop_size);
+                if (prop && (prop_size >= sizeof(u32)))
+                        if ((*prop >= 0) && (*prop < PHY_MAX_ADDR))
+                                priv->phy_addr = *prop;
+                of_node_put(phy_node);
         }
 
         /* Hardware init */
@@ -982,6 +1019,20 @@ mpc52xx_fec_probe(struct of_device *op, const struct of_device_id *match)
         if (rv < 0)
                 goto probe_error;
 
+        /* Now report the link setup */
+        switch (priv->phy_addr) {
+         case FEC5200_PHYADDR_NONE:
+                dev_info(&ndev->dev, "Fixed speed MII link: %i%cD\n",
+                         priv->speed, priv->duplex ? 'F' : 'H');
+                break;
+         case FEC5200_PHYADDR_7WIRE:
+                dev_info(&ndev->dev, "using 7-wire PHY mode\n");
+                break;
+         default:
+                dev_info(&ndev->dev, "Using PHY at MDIO address %i\n",
+                         priv->phy_addr);
+        }
+
         /* We're done ! */
         dev_set_drvdata(&op->dev, ndev);
 
diff --git a/drivers/net/fec_mpc52xx.h b/drivers/net/fec_mpc52xx.h
index 8b1f75397b9..a227a525bdb 100644
--- a/drivers/net/fec_mpc52xx.h
+++ b/drivers/net/fec_mpc52xx.h
@@ -26,25 +26,6 @@
 
 #define FEC_WATCHDOG_TIMEOUT    ((400*HZ)/1000)
 
-struct mpc52xx_fec_priv {
-        int duplex;
-        int r_irq;
-        int t_irq;
-        struct mpc52xx_fec __iomem *fec;
-        struct bcom_task *rx_dmatsk;
-        struct bcom_task *tx_dmatsk;
-        spinlock_t lock;
-        int msg_enable;
-
-        int has_phy;
-        unsigned int phy_speed;
-        unsigned int phy_addr;
-        struct phy_device *phydev;
-        enum phy_state link;
-        int speed;
-};
-
-
 /* ======================================================================== */
 /* Hardware register sets & bits                                            */
 /* ======================================================================== */
diff --git a/drivers/net/mlx4/mr.c b/drivers/net/mlx4/mr.c
index cb46446b269..03a9abcce52 100644
--- a/drivers/net/mlx4/mr.c
+++ b/drivers/net/mlx4/mr.c
@@ -551,7 +551,7 @@ int mlx4_fmr_alloc(struct mlx4_dev *dev, u32 pd, u32 access, int max_pages,
         u64 mtt_seg;
         int err = -ENOMEM;
 
-        if (page_shift < 12 || page_shift >= 32)
+        if (page_shift < (ffs(dev->caps.page_size_cap) - 1) || page_shift >= 32)
                 return -EINVAL;
 
         /* All MTTs must fit in the same page */
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 6f245cfb662..dc6f097062d 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1381,6 +1381,10 @@ static const struct usb_device_id	products [] = {
         USB_DEVICE (0x0411, 0x003d),
         .driver_info =  (unsigned long) &ax8817x_info,
 }, {
+        // Buffalo LUA-U2-GT 10/100/1000
+        USB_DEVICE (0x0411, 0x006e),
+        .driver_info =  (unsigned long) &ax88178_info,
+}, {
         // Sitecom LN-029 "USB 2.0 10/100 Ethernet adapter"
         USB_DEVICE (0x6189, 0x182d),
         .driver_info =  (unsigned long) &ax8817x_info,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 555b70c8b86..f926b5ab3d0 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -41,6 +41,9 @@ struct virtnet_info
         struct net_device *dev;
         struct napi_struct napi;
 
+        /* The skb we couldn't send because buffers were full. */
+        struct sk_buff *last_xmit_skb;
+
         /* Number of input buffers, and max we've ever had. */
         unsigned int num, max;
 
@@ -142,10 +145,10 @@ drop:
 static void try_fill_recv(struct virtnet_info *vi)
 {
         struct sk_buff *skb;
-        struct scatterlist sg[1+MAX_SKB_FRAGS];
+        struct scatterlist sg[2+MAX_SKB_FRAGS];
         int num, err;
 
-        sg_init_table(sg, 1+MAX_SKB_FRAGS);
+        sg_init_table(sg, 2+MAX_SKB_FRAGS);
         for (;;) {
                 skb = netdev_alloc_skb(vi->dev, MAX_PACKET_LEN);
                 if (unlikely(!skb))
@@ -221,23 +224,22 @@ static void free_old_xmit_skbs(struct virtnet_info *vi)
         while ((skb = vi->svq->vq_ops->get_buf(vi->svq, &len)) != NULL) {
                 pr_debug("Sent skb %p\n", skb);
                 __skb_unlink(skb, &vi->send);
-                vi->dev->stats.tx_bytes += len;
+                vi->dev->stats.tx_bytes += skb->len;
                 vi->dev->stats.tx_packets++;
                 kfree_skb(skb);
         }
 }
 
-static int start_xmit(struct sk_buff *skb, struct net_device *dev)
+static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
 {
-        struct virtnet_info *vi = netdev_priv(dev);
-        int num, err;
-        struct scatterlist sg[1+MAX_SKB_FRAGS];
+        int num;
+        struct scatterlist sg[2+MAX_SKB_FRAGS];
         struct virtio_net_hdr *hdr;
         const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
 
-        sg_init_table(sg, 1+MAX_SKB_FRAGS);
+        sg_init_table(sg, 2+MAX_SKB_FRAGS);
 
-        pr_debug("%s: xmit %p " MAC_FMT "\n", dev->name, skb,
+        pr_debug("%s: xmit %p " MAC_FMT "\n", vi->dev->name, skb,
                  dest[0], dest[1], dest[2],
                  dest[3], dest[4], dest[5]);
 
@@ -272,30 +274,51 @@ static int start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         vnet_hdr_to_sg(sg, skb);
         num = skb_to_sgvec(skb, sg+1, 0, skb->len) + 1;
-        __skb_queue_head(&vi->send, skb);
+
+        return vi->svq->vq_ops->add_buf(vi->svq, sg, num, 0, skb);
+}
+
+static int start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct virtnet_info *vi = netdev_priv(dev);
 
 again:
         /* Free up any pending old buffers before queueing new ones. */
         free_old_xmit_skbs(vi);
-        err = vi->svq->vq_ops->add_buf(vi->svq, sg, num, 0, skb);
-        if (err) {
-                pr_debug("%s: virtio not prepared to send\n", dev->name);
-                netif_stop_queue(dev);
-
-                /* Activate callback for using skbs: if this returns false it
-                 * means some were used in the meantime. */
-                if (unlikely(!vi->svq->vq_ops->enable_cb(vi->svq))) {
-                        vi->svq->vq_ops->disable_cb(vi->svq);
-                        netif_start_queue(dev);
-                        goto again;
+
+        /* If we has a buffer left over from last time, send it now. */
+        if (vi->last_xmit_skb) {
+                if (xmit_skb(vi, vi->last_xmit_skb) != 0) {
+                        /* Drop this skb: we only queue one. */
+                        vi->dev->stats.tx_dropped++;
+                        kfree_skb(skb);
+                        goto stop_queue;
                 }
-                __skb_unlink(skb, &vi->send);
+                vi->last_xmit_skb = NULL;
+        }
 
-                return NETDEV_TX_BUSY;
+        /* Put new one in send queue and do transmit */
+        __skb_queue_head(&vi->send, skb);
+        if (xmit_skb(vi, skb) != 0) {
+                vi->last_xmit_skb = skb;
+                goto stop_queue;
         }
+done:
         vi->svq->vq_ops->kick(vi->svq);
-
-        return 0;
+        return NETDEV_TX_OK;
+
+stop_queue:
+        pr_debug("%s: virtio not prepared to send\n", dev->name);
+        netif_stop_queue(dev);
+
+        /* Activate callback for using skbs: if this returns false it
+         * means some were used in the meantime. */
+        if (unlikely(!vi->svq->vq_ops->enable_cb(vi->svq))) {
+                vi->svq->vq_ops->disable_cb(vi->svq);
+                netif_start_queue(dev);
+                goto again;
+        }
+        goto done;
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -355,17 +378,26 @@ static int virtnet_probe(struct virtio_device *vdev)
         SET_NETDEV_DEV(dev, &vdev->dev);
 
         /* Do we support "hardware" checksums? */
-        if (csum && vdev->config->feature(vdev, VIRTIO_NET_F_CSUM)) {
+        if (csum && virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
                 /* This opens up the world of extra features. */
                 dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
-                if (gso && vdev->config->feature(vdev, VIRTIO_NET_F_GSO)) {
+                if (gso && virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
                         dev->features |= NETIF_F_TSO | NETIF_F_UFO
                                 | NETIF_F_TSO_ECN | NETIF_F_TSO6;
                 }
+                /* Individual feature bits: what can host handle? */
+                if (gso && virtio_has_feature(vdev, VIRTIO_NET_F_HOST_TSO4))
+                        dev->features |= NETIF_F_TSO;
+                if (gso && virtio_has_feature(vdev, VIRTIO_NET_F_HOST_TSO6))
+                        dev->features |= NETIF_F_TSO6;
+                if (gso && virtio_has_feature(vdev, VIRTIO_NET_F_HOST_ECN))
+                        dev->features |= NETIF_F_TSO_ECN;
+                if (gso && virtio_has_feature(vdev, VIRTIO_NET_F_HOST_UFO))
+                        dev->features |= NETIF_F_UFO;
         }
 
         /* Configuration may specify what MAC to use.  Otherwise random. */
-        if (vdev->config->feature(vdev, VIRTIO_NET_F_MAC)) {
+        if (virtio_has_feature(vdev, VIRTIO_NET_F_MAC)) {
                 vdev->config->get(vdev,
                                   offsetof(struct virtio_net_config, mac),
                                   dev->dev_addr, dev->addr_len);
@@ -454,7 +486,15 @@ static struct virtio_device_id id_table[] = {
         { 0 },
 };
 
+static unsigned int features[] = {
+        VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
+        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
+        VIRTIO_NET_F_HOST_ECN,
+};
+
 static struct virtio_driver virtio_net = {
+        .feature_table = features,
+        .feature_table_size = ARRAY_SIZE(features),
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index 5dd23c93497..883af891ebf 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -2611,7 +2611,7 @@ static int strip_open(struct tty_struct *tty)
          * We need a write method.
          */
 
-        if (tty->ops->write == NULL)
+        if (tty->ops->write == NULL || tty->ops->set_termios == NULL)
                 return -EOPNOTSUPP;
 
         /*
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 1fd8bb76570..66c0fd21894 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -49,7 +49,7 @@
 
 #define DEFAULT_DOMAIN_ADDRESS_WIDTH 48
 
-#define DMAR_OPERATION_TIMEOUT (HZ*60) /* 1m */
+#define DMAR_OPERATION_TIMEOUT ((cycles_t) tsc_khz*10*1000) /* 10sec */
 
 #define DOMAIN_MAX_ADDR(gaw) ((((u64)1) << gaw) - 1)
 
@@ -490,12 +490,12 @@ static int iommu_alloc_root_entry(struct intel_iommu *iommu)
 
 #define IOMMU_WAIT_OP(iommu, offset, op, cond, sts) \
 {\
-        unsigned long start_time = jiffies;\
+        cycles_t start_time = get_cycles();\
         while (1) {\
                 sts = op (iommu->reg + offset);\
                 if (cond)\
                         break;\
-                if (time_after(jiffies, start_time + DMAR_OPERATION_TIMEOUT))\
+                if (DMAR_OPERATION_TIMEOUT < (get_cycles() - start_time))\
                         panic("DMAR hardware is malfunctioning\n");\
                 cpu_relax();\
         }\
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 72f7476930c..9d6fc8e6285 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -19,8 +19,31 @@
 #include <linux/pci-acpi.h>
 #include "pci.h"
 
-static u32 ctrlset_buf[3] = {0, 0, 0};
-static u32 global_ctrlsets = 0;
+struct acpi_osc_data {
+        acpi_handle handle;
+        u32 ctrlset_buf[3];
+        u32 global_ctrlsets;
+        struct list_head sibiling;
+};
+static LIST_HEAD(acpi_osc_data_list);
+
+static struct acpi_osc_data *acpi_get_osc_data(acpi_handle handle)
+{
+        struct acpi_osc_data *data;
+
+        list_for_each_entry(data, &acpi_osc_data_list, sibiling) {
+                if (data->handle == handle)
+                        return data;
+        }
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return NULL;
+        INIT_LIST_HEAD(&data->sibiling);
+        data->handle = handle;
+        list_add_tail(&data->sibiling, &acpi_osc_data_list);
+        return data;
+}
+
 static u8 OSC_UUID[16] = {0x5B, 0x4D, 0xDB, 0x33, 0xF7, 0x1F, 0x1C, 0x40, 0x96, 0x57, 0x74, 0x41, 0xC0, 0x3D, 0xD7, 0x66};
 
 static acpi_status  
@@ -37,8 +60,27 @@ acpi_query_osc (
         union acpi_object       *out_obj;
         u32                     osc_dw0;
         acpi_status *ret_status = (acpi_status *)retval;
+        struct acpi_osc_data *osc_data;
+        u32 flags = (unsigned long)context, temp;
+        acpi_handle tmp;
+
+        status = acpi_get_handle(handle, "_OSC", &tmp);
+        if (ACPI_FAILURE(status))
+                return status;
+
+        osc_data = acpi_get_osc_data(handle);
+        if (!osc_data) {
+                printk(KERN_ERR "acpi osc data array is full\n");
+                return AE_ERROR;
+        }
+
+        osc_data->ctrlset_buf[OSC_SUPPORT_TYPE] |= (flags & OSC_SUPPORT_MASKS);
+
+        /* do _OSC query for all possible controls */
+        temp = osc_data->ctrlset_buf[OSC_CONTROL_TYPE];
+        osc_data->ctrlset_buf[OSC_QUERY_TYPE] = OSC_QUERY_ENABLE;
+        osc_data->ctrlset_buf[OSC_CONTROL_TYPE] = OSC_CONTROL_MASKS;
 
-        
         /* Setting up input parameters */
         input.count = 4;
         input.pointer = in_params;
@@ -51,13 +93,11 @@ acpi_query_osc (
         in_params[2].integer.value      = 3;
         in_params[3].type               = ACPI_TYPE_BUFFER;
         in_params[3].buffer.length      = 12;
-        in_params[3].buffer.pointer     = (u8 *)context;
+        in_params[3].buffer.pointer     = (u8 *)osc_data->ctrlset_buf;
 
         status = acpi_evaluate_object(handle, "_OSC", &input, &output);
-        if (ACPI_FAILURE (status)) {
-                *ret_status = status;
-                return status;
-        }
+        if (ACPI_FAILURE(status))
+                goto out_nofree;
         out_obj = output.pointer;
 
         if (out_obj->type != ACPI_TYPE_BUFFER) {
@@ -76,7 +116,8 @@ acpi_query_osc (
                         printk(KERN_DEBUG "_OSC invalid revision\n"); 
                 if (osc_dw0 & OSC_CAPABILITIES_MASK_ERROR) {
                         /* Update Global Control Set */
-                        global_ctrlsets = *((u32 *)(out_obj->buffer.pointer+8));
+                        osc_data->global_ctrlsets =
+                                *((u32 *)(out_obj->buffer.pointer + 8));
                         status = AE_OK;
                         goto query_osc_out;
                 }
@@ -85,12 +126,21 @@ acpi_query_osc (
         }
 
         /* Update Global Control Set */
-        global_ctrlsets = *((u32 *)(out_obj->buffer.pointer + 8));
+        osc_data->global_ctrlsets = *((u32 *)(out_obj->buffer.pointer + 8));
         status = AE_OK;
 
 query_osc_out:
         kfree(output.pointer);
+out_nofree:
         *ret_status = status;
+
+        osc_data->ctrlset_buf[OSC_QUERY_TYPE] = !OSC_QUERY_ENABLE;
+        osc_data->ctrlset_buf[OSC_CONTROL_TYPE] = temp;
+        if (ACPI_FAILURE(status)) {
+                /* no osc support at all */
+                osc_data->ctrlset_buf[OSC_SUPPORT_TYPE] = 0;
+        }
+
         return status;
 }
 
@@ -165,28 +215,15 @@ run_osc_out:
  **/
 acpi_status __pci_osc_support_set(u32 flags, const char *hid)
 {
-        u32 temp;
-        acpi_status retval;
+        acpi_status retval = AE_NOT_FOUND;
 
         if (!(flags & OSC_SUPPORT_MASKS)) {
                 return AE_TYPE;
         }
-        ctrlset_buf[OSC_SUPPORT_TYPE] |= (flags & OSC_SUPPORT_MASKS);
-
-        /* do _OSC query for all possible controls */
-        temp = ctrlset_buf[OSC_CONTROL_TYPE];
-        ctrlset_buf[OSC_QUERY_TYPE] = OSC_QUERY_ENABLE;
-        ctrlset_buf[OSC_CONTROL_TYPE] = OSC_CONTROL_MASKS;
         acpi_get_devices(hid,
                         acpi_query_osc,
-                        ctrlset_buf,
+                        (void *)(unsigned long)flags,
                         (void **) &retval );
-        ctrlset_buf[OSC_QUERY_TYPE] = !OSC_QUERY_ENABLE;
-        ctrlset_buf[OSC_CONTROL_TYPE] = temp;
-        if (ACPI_FAILURE(retval)) {
-                /* no osc support at all */
-                ctrlset_buf[OSC_SUPPORT_TYPE] = 0;
-        }
         return AE_OK;
 }
 
@@ -201,19 +238,31 @@ acpi_status pci_osc_control_set(acpi_handle handle, u32 flags)
 {
         acpi_status     status;
         u32             ctrlset;
+        acpi_handle tmp;
+        struct acpi_osc_data *osc_data;
+
+        status = acpi_get_handle(handle, "_OSC", &tmp);
+        if (ACPI_FAILURE(status))
+                return status;
+
+        osc_data = acpi_get_osc_data(handle);
+        if (!osc_data) {
+                printk(KERN_ERR "acpi osc data array is full\n");
+                return AE_ERROR;
+        }
 
         ctrlset = (flags & OSC_CONTROL_MASKS);
         if (!ctrlset) {
                 return AE_TYPE;
         }
-        if (ctrlset_buf[OSC_SUPPORT_TYPE] && 
-                ((global_ctrlsets & ctrlset) != ctrlset)) {
+        if (osc_data->ctrlset_buf[OSC_SUPPORT_TYPE] &&
+                ((osc_data->global_ctrlsets & ctrlset) != ctrlset)) {
                 return AE_SUPPORT;
         }
-        ctrlset_buf[OSC_CONTROL_TYPE] |= ctrlset;
-        status = acpi_run_osc(handle, ctrlset_buf);
+        osc_data->ctrlset_buf[OSC_CONTROL_TYPE] |= ctrlset;
+        status = acpi_run_osc(handle, osc_data->ctrlset_buf);
         if (ACPI_FAILURE (status)) {
-                ctrlset_buf[OSC_CONTROL_TYPE] &= ~ctrlset;
+                osc_data->ctrlset_buf[OSC_CONTROL_TYPE] &= ~ctrlset;
         }
         
         return status;
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 4a55bf38095..3706ce7972d 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -842,13 +842,25 @@ static void set_pcie_port_type(struct pci_dev *pdev)
  * reading the dword at 0x100 which must either be 0 or a valid extended
  * capability header.
  */
-int pci_cfg_space_size_ext(struct pci_dev *dev, unsigned check_exp_pcix)
+int pci_cfg_space_size_ext(struct pci_dev *dev)
 {
-        int pos;
         u32 status;
 
-        if (!check_exp_pcix)
-                goto skip;
+        if (pci_read_config_dword(dev, 256, &status) != PCIBIOS_SUCCESSFUL)
+                goto fail;
+        if (status == 0xffffffff)
+                goto fail;
+
+        return PCI_CFG_SPACE_EXP_SIZE;
+
+ fail:
+        return PCI_CFG_SPACE_SIZE;
+}
+
+int pci_cfg_space_size(struct pci_dev *dev)
+{
+        int pos;
+        u32 status;
 
         pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
         if (!pos) {
@@ -861,23 +873,12 @@ int pci_cfg_space_size_ext(struct pci_dev *dev, unsigned check_exp_pcix)
                         goto fail;
         }
 
- skip:
-        if (pci_read_config_dword(dev, 256, &status) != PCIBIOS_SUCCESSFUL)
-                goto fail;
-        if (status == 0xffffffff)
-                goto fail;
-
-        return PCI_CFG_SPACE_EXP_SIZE;
+        return pci_cfg_space_size_ext(dev);
 
  fail:
         return PCI_CFG_SPACE_SIZE;
 }
 
-int pci_cfg_space_size(struct pci_dev *dev)
-{
-        return pci_cfg_space_size_ext(dev, 1);
-}
-
 static void pci_release_bus_bridge_dev(struct device *dev)
 {
         kfree(dev);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index afd914ebe21..f2d9c770f51 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1826,6 +1826,7 @@ static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
         }
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk);
 
 static void __devinit quirk_msi_intx_disable_bug(struct pci_dev *dev)
 {
diff --git a/drivers/pcmcia/au1000_db1x00.c b/drivers/pcmcia/au1000_db1x00.c
index 74e051535d6..c78d77fd7e3 100644
--- a/drivers/pcmcia/au1000_db1x00.c
+++ b/drivers/pcmcia/au1000_db1x00.c
@@ -194,7 +194,7 @@ db1x00_pcmcia_configure_socket(struct au1000_pcmcia_socket *skt, struct socket_s
                                 default:
                                         pwr |= SET_VCC_VPP(0,0,sock);
                                         printk("%s: bad Vcc/Vpp (%d:%d)\n",
-                                                        __FUNCTION__,
+                                                        __func__,
                                                         state->Vcc,
                                                         state->Vpp);
                                         break;
@@ -215,7 +215,7 @@ db1x00_pcmcia_configure_socket(struct au1000_pcmcia_socket *skt, struct socket_s
                                 default:
                                         pwr |= SET_VCC_VPP(0,0,sock);
                                         printk("%s: bad Vcc/Vpp (%d:%d)\n",
-                                                        __FUNCTION__,
+                                                        __func__,
                                                         state->Vcc,
                                                         state->Vpp);
                                         break;
@@ -224,7 +224,7 @@ db1x00_pcmcia_configure_socket(struct au1000_pcmcia_socket *skt, struct socket_s
                 default: /* what's this ? */
                         pwr |= SET_VCC_VPP(0,0,sock);
                         printk(KERN_ERR "%s: bad Vcc %d\n",
-                                        __FUNCTION__, state->Vcc);
+                                        __func__, state->Vcc);
                         break;
         }
 
diff --git a/drivers/pcmcia/au1000_generic.c b/drivers/pcmcia/au1000_generic.c
index b693367d38c..75e8f8505e4 100644
--- a/drivers/pcmcia/au1000_generic.c
+++ b/drivers/pcmcia/au1000_generic.c
@@ -41,6 +41,7 @@
 #include <linux/notifier.h>
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
+#include <linux/mutex.h>
 #include <linux/platform_device.h>
 
 #include <asm/io.h>
@@ -71,7 +72,7 @@ extern struct au1000_pcmcia_socket au1000_pcmcia_socket[];
 u32 *pcmcia_base_vaddrs[2];
 extern const unsigned long mips_io_port_base;
 
-DECLARE_MUTEX(pcmcia_sockets_lock);
+static DEFINE_MUTEX(pcmcia_sockets_lock);
 
 static int (*au1x00_pcmcia_hw_init[])(struct device *dev) = {
         au1x_board_init,
@@ -472,7 +473,7 @@ int au1x00_drv_pcmcia_remove(struct device *dev)
         struct skt_dev_info *sinfo = dev_get_drvdata(dev);
         int i;
 
-        down(&pcmcia_sockets_lock);
+        mutex_lock(&pcmcia_sockets_lock);
         dev_set_drvdata(dev, NULL);
 
         for (i = 0; i < sinfo->nskt; i++) {
@@ -488,7 +489,7 @@ int au1x00_drv_pcmcia_remove(struct device *dev)
         }
 
         kfree(sinfo);
-        up(&pcmcia_sockets_lock);
+        mutex_unlock(&pcmcia_sockets_lock);
         return 0;
 }
 
@@ -501,13 +502,13 @@ static int au1x00_drv_pcmcia_probe(struct device *dev)
 {
         int i, ret = -ENODEV;
 
-        down(&pcmcia_sockets_lock);
+        mutex_lock(&pcmcia_sockets_lock);
         for (i=0; i < ARRAY_SIZE(au1x00_pcmcia_hw_init); i++) {
                 ret = au1x00_pcmcia_hw_init[i](dev);
                 if (ret == 0)
                         break;
         }
-        up(&pcmcia_sockets_lock);
+        mutex_unlock(&pcmcia_sockets_lock);
         return ret;
 }
 
diff --git a/drivers/pcmcia/au1000_pb1x00.c b/drivers/pcmcia/au1000_pb1x00.c
index 86c0808d6a0..157e41423a0 100644
--- a/drivers/pcmcia/au1000_pb1x00.c
+++ b/drivers/pcmcia/au1000_pb1x00.c
@@ -244,7 +244,7 @@ pb1x00_pcmcia_configure_socket(const struct pcmcia_configure *configure)
                                         pcr |= SET_VCC_VPP(VCC_HIZ,VPP_HIZ,
                                                         configure->sock);
                                         printk("%s: bad Vcc/Vpp (%d:%d)\n", 
-                                                        __FUNCTION__, 
+                                                        __func__,
                                                         configure->vcc, 
                                                         configure->vpp);
                                         break;
@@ -272,7 +272,7 @@ pb1x00_pcmcia_configure_socket(const struct pcmcia_configure *configure)
                                         pcr |= SET_VCC_VPP(VCC_HIZ,VPP_HIZ,
                                                         configure->sock);
                                         printk("%s: bad Vcc/Vpp (%d:%d)\n", 
-                                                        __FUNCTION__, 
+                                                        __func__,
                                                         configure->vcc, 
                                                         configure->vpp);
                                         break;
@@ -300,7 +300,7 @@ pb1x00_pcmcia_configure_socket(const struct pcmcia_configure *configure)
                                         pcr |= SET_VCC_VPP(VCC_HIZ,VPP_HIZ,
                                                         configure->sock);
                                         printk("%s: bad Vcc/Vpp (%d:%d)\n", 
-                                                        __FUNCTION__, 
+                                                        __func__,
                                                         configure->vcc, 
                                                         configure->vpp);
                                         break;
@@ -309,7 +309,7 @@ pb1x00_pcmcia_configure_socket(const struct pcmcia_configure *configure)
                 default: /* what's this ? */
                         pcr |= SET_VCC_VPP(VCC_HIZ,VPP_HIZ,configure->sock);
                         printk(KERN_ERR "%s: bad Vcc %d\n", 
-                                        __FUNCTION__, configure->vcc);
+                                        __func__, configure->vcc);
                         break;
         }
 
@@ -353,7 +353,7 @@ pb1x00_pcmcia_configure_socket(const struct pcmcia_configure *configure)
                                 default:
                                         pcr |= SET_VCC_VPP(0,0);
                                         printk("%s: bad Vcc/Vpp (%d:%d)\n", 
-                                                        __FUNCTION__, 
+                                                        __func__,
                                                         configure->vcc, 
                                                         configure->vpp);
                                         break;
@@ -374,7 +374,7 @@ pb1x00_pcmcia_configure_socket(const struct pcmcia_configure *configure)
                                 default:
                                         pcr |= SET_VCC_VPP(0,0);
                                         printk("%s: bad Vcc/Vpp (%d:%d)\n", 
-                                                        __FUNCTION__, 
+                                                        __func__,
                                                         configure->vcc, 
                                                         configure->vpp);
                                         break;
@@ -383,7 +383,7 @@ pb1x00_pcmcia_configure_socket(const struct pcmcia_configure *configure)
                 default: /* what's this ? */
                         pcr |= SET_VCC_VPP(0,0);
                         printk(KERN_ERR "%s: bad Vcc %d\n", 
-                                        __FUNCTION__, configure->vcc);
+                                        __func__, configure->vcc);
                         break;
         }
 
diff --git a/drivers/pcmcia/au1000_xxs1500.c b/drivers/pcmcia/au1000_xxs1500.c
index ce9d5c44a7b..c78ed534751 100644
--- a/drivers/pcmcia/au1000_xxs1500.c
+++ b/drivers/pcmcia/au1000_xxs1500.c
@@ -56,7 +56,7 @@
 #define PCMCIA_IRQ              AU1000_GPIO_4
 
 #if 0
-#define DEBUG(x,args...)        printk(__FUNCTION__ ": " x,##args)
+#define DEBUG(x, args...)       printk(__func__ ": " x, ##args)
 #else
 #define DEBUG(x,args...)
 #endif
diff --git a/drivers/pcmcia/cardbus.c b/drivers/pcmcia/cardbus.c
index 714baaeb6da..fb2f38dc92c 100644
--- a/drivers/pcmcia/cardbus.c
+++ b/drivers/pcmcia/cardbus.c
@@ -209,7 +209,7 @@ static void cardbus_assign_irqs(struct pci_bus *bus, int irq)
         }
 }
 
-int cb_alloc(struct pcmcia_socket * s)
+int __ref cb_alloc(struct pcmcia_socket * s)
 {
         struct pci_bus *bus = s->cb_dev->subordinate;
         struct pci_dev *dev;
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 5a85871f5ee..e40775443d0 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -1520,7 +1520,7 @@ static void pcmcia_bus_remove_socket(struct device *dev,
 
 
 /* the pcmcia_bus_interface is used to handle pcmcia socket devices */
-static struct class_interface pcmcia_bus_interface = {
+static struct class_interface pcmcia_bus_interface __refdata = {
         .class = &pcmcia_socket_class,
         .add_dev = &pcmcia_bus_add_socket,
         .remove_dev = &pcmcia_bus_remove_socket,
diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
index e54ecc580d9..e13618656ff 100644
--- a/drivers/pcmcia/i82092.c
+++ b/drivers/pcmcia/i82092.c
@@ -53,7 +53,7 @@ static int i82092aa_socket_resume (struct pci_dev *dev)
 }
 #endif
 
-static struct pci_driver i82092aa_pci_drv = {
+static struct pci_driver i82092aa_pci_driver = {
         .name           = "i82092aa",
         .id_table       = i82092aa_pci_ids,
         .probe          = i82092aa_pci_probe,
@@ -714,13 +714,13 @@ static int i82092aa_set_mem_map(struct pcmcia_socket *socket, struct pccard_mem_
 
 static int i82092aa_module_init(void)
 {
-        return pci_register_driver(&i82092aa_pci_drv);
+        return pci_register_driver(&i82092aa_pci_driver);
 }
 
 static void i82092aa_module_exit(void)
 {
         enter("i82092aa_module_exit");
-        pci_unregister_driver(&i82092aa_pci_drv);
+        pci_unregister_driver(&i82092aa_pci_driver);
         if (sockets[0].io_base>0)
                          release_region(sockets[0].io_base, 2);
         leave("i82092aa_module_exit");
diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
index bb6db3a582b..46314b42076 100644
--- a/drivers/pcmcia/omap_cf.c
+++ b/drivers/pcmcia/omap_cf.c
@@ -153,7 +153,7 @@ omap_cf_set_socket(struct pcmcia_socket *sock, struct socket_state_t *s)
 
 static int omap_cf_ss_suspend(struct pcmcia_socket *s)
 {
-        pr_debug("%s: %s\n", driver_name, __FUNCTION__);
+        pr_debug("%s: %s\n", driver_name, __func__);
         return omap_cf_set_socket(s, &dead_socket);
 }
 
diff --git a/drivers/pcmcia/pd6729.c b/drivers/pcmcia/pd6729.c
index abc10fe49bd..8bed1dab903 100644
--- a/drivers/pcmcia/pd6729.c
+++ b/drivers/pcmcia/pd6729.c
@@ -778,7 +778,7 @@ static struct pci_device_id pd6729_pci_ids[] = {
 };
 MODULE_DEVICE_TABLE(pci, pd6729_pci_ids);
 
-static struct pci_driver pd6729_pci_drv = {
+static struct pci_driver pd6729_pci_driver = {
         .name           = "pd6729",
         .id_table       = pd6729_pci_ids,
         .probe          = pd6729_pci_probe,
@@ -791,12 +791,12 @@ static struct pci_driver pd6729_pci_drv = {
 
 static int pd6729_module_init(void)
 {
-        return pci_register_driver(&pd6729_pci_drv);
+        return pci_register_driver(&pd6729_pci_driver);
 }
 
 static void pd6729_module_exit(void)
 {
-        pci_unregister_driver(&pd6729_pci_drv);
+        pci_unregister_driver(&pd6729_pci_driver);
 }
 
 module_init(pd6729_module_init);
diff --git a/drivers/pcmcia/pxa2xx_lubbock.c b/drivers/pcmcia/pxa2xx_lubbock.c
index 4a05802213c..881ec8a8e38 100644
--- a/drivers/pcmcia/pxa2xx_lubbock.c
+++ b/drivers/pcmcia/pxa2xx_lubbock.c
@@ -87,7 +87,7 @@ lubbock_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
 
                 default:
                         printk(KERN_ERR "%s(): unrecognized Vcc %u\n",
-                               __FUNCTION__, state->Vcc);
+                               __func__, state->Vcc);
                         ret = -1;
                 }
 
@@ -104,7 +104,7 @@ lubbock_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
                                 pa_dwr_set |= GPIO_A0;
                         else {
                                 printk(KERN_ERR "%s(): unrecognized Vpp %u\n",
-                                       __FUNCTION__, state->Vpp);
+                                       __func__, state->Vpp);
                                 ret = -1;
                                 break;
                         }
@@ -128,14 +128,14 @@ lubbock_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
 
                 default:
                         printk(KERN_ERR "%s(): unrecognized Vcc %u\n",
-                               __FUNCTION__, state->Vcc);
+                               __func__, state->Vcc);
                         ret = -1;
                         break;
                 }
 
                 if (state->Vpp != state->Vcc && state->Vpp != 0) {
                         printk(KERN_ERR "%s(): CF slot cannot support Vpp %u\n",
-                               __FUNCTION__, state->Vpp);
+                               __func__, state->Vpp);
                         ret = -1;
                         break;
                 }
diff --git a/drivers/pcmcia/pxa2xx_mainstone.c b/drivers/pcmcia/pxa2xx_mainstone.c
index 6fa5eaaab8a..145b85e0f02 100644
--- a/drivers/pcmcia/pxa2xx_mainstone.c
+++ b/drivers/pcmcia/pxa2xx_mainstone.c
@@ -99,7 +99,7 @@ static int mst_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
         case 50: power |= MST_PCMCIA_PWR_VCC_50; break;
         default:
                  printk(KERN_ERR "%s(): bad Vcc %u\n",
-                                 __FUNCTION__, state->Vcc);
+                                 __func__, state->Vcc);
                  ret = -1;
         }
 
@@ -111,7 +111,7 @@ static int mst_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
                           power |= MST_PCMCIA_PWR_VPP_VCC;
                   } else {
                           printk(KERN_ERR "%s(): bad Vpp %u\n",
-                                          __FUNCTION__, state->Vpp);
+                                          __func__, state->Vpp);
                           ret = -1;
                   }
         }
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index a8d10070772..0fcf763b917 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -1045,7 +1045,7 @@ static void __devexit pccard_sysfs_remove_rsrc(struct device *dev,
                 device_remove_file(dev, *attr);
 }
 
-static struct class_interface pccard_rsrc_interface = {
+static struct class_interface pccard_rsrc_interface __refdata = {
         .class = &pcmcia_socket_class,
         .add_dev = &pccard_sysfs_add_rsrc,
         .remove_dev = __devexit_p(&pccard_sysfs_remove_rsrc),
diff --git a/drivers/pcmcia/sa1100_assabet.c b/drivers/pcmcia/sa1100_assabet.c
index 7c57fdd3c8d..ce133ce81c1 100644
--- a/drivers/pcmcia/sa1100_assabet.c
+++ b/drivers/pcmcia/sa1100_assabet.c
@@ -66,14 +66,14 @@ assabet_pcmcia_configure_socket(struct soc_pcmcia_socket *skt, const socket_stat
 
         case 50:
                 printk(KERN_WARNING "%s(): CS asked for 5V, applying 3.3V...\n",
-                        __FUNCTION__);
+                        __func__);
 
         case 33:  /* Can only apply 3.3V to the CF slot. */
                 mask = ASSABET_BCR_CF_PWR;
                 break;
 
         default:
-                printk(KERN_ERR "%s(): unrecognized Vcc %u\n", __FUNCTION__,
+                printk(KERN_ERR "%s(): unrecognized Vcc %u\n", __func__,
                         state->Vcc);
                 return -1;
         }
diff --git a/drivers/pcmcia/sa1100_badge4.c b/drivers/pcmcia/sa1100_badge4.c
index 62bfc7566ec..607c3f326ec 100644
--- a/drivers/pcmcia/sa1100_badge4.c
+++ b/drivers/pcmcia/sa1100_badge4.c
@@ -82,14 +82,14 @@ badge4_pcmcia_configure_socket(struct soc_pcmcia_socket *skt, const socket_state
         case 0:
                 if ((state->Vcc != 0) &&
                     (state->Vcc != badge4_pcmvcc)) {
-                        complain_about_jumpering(__FUNCTION__, "pcmvcc",
+                        complain_about_jumpering(__func__, "pcmvcc",
                                                  badge4_pcmvcc, state->Vcc);
                         // Apply power regardless of the jumpering.
                         // return -1;
                 }
                 if ((state->Vpp != 0) &&
                     (state->Vpp != badge4_pcmvpp)) {
-                        complain_about_jumpering(__FUNCTION__, "pcmvpp",
+                        complain_about_jumpering(__func__, "pcmvpp",
                                                  badge4_pcmvpp, state->Vpp);
                         return -1;
                 }
@@ -98,7 +98,7 @@ badge4_pcmcia_configure_socket(struct soc_pcmcia_socket *skt, const socket_state
         case 1:
                 if ((state->Vcc != 0) &&
                     (state->Vcc != badge4_cfvcc)) {
-                        complain_about_jumpering(__FUNCTION__, "cfvcc",
+                        complain_about_jumpering(__func__, "cfvcc",
                                                  badge4_cfvcc, state->Vcc);
                         return -1;
                 }
@@ -143,7 +143,7 @@ int pcmcia_badge4_init(struct device *dev)
         if (machine_is_badge4()) {
                 printk(KERN_INFO
                        "%s: badge4_pcmvcc=%d, badge4_pcmvpp=%d, badge4_cfvcc=%d\n",
-                       __FUNCTION__,
+                       __func__,
                        badge4_pcmvcc, badge4_pcmvpp, badge4_cfvcc);
 
                 ret = sa11xx_drv_pcmcia_probe(dev, &badge4_pcmcia_ops, 0, 2);
diff --git a/drivers/pcmcia/sa1100_cerf.c b/drivers/pcmcia/sa1100_cerf.c
index 549a1529fe3..7c3951a2675 100644
--- a/drivers/pcmcia/sa1100_cerf.c
+++ b/drivers/pcmcia/sa1100_cerf.c
@@ -63,7 +63,7 @@ cerf_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
 
         default:
                 printk(KERN_ERR "%s(): unrecognized Vcc %u\n",
-                        __FUNCTION__, state->Vcc);
+                        __func__, state->Vcc);
                 return -1;
         }
 
diff --git a/drivers/pcmcia/sa1100_jornada720.c b/drivers/pcmcia/sa1100_jornada720.c
index 6284c35dabc..2167e6714d2 100644
--- a/drivers/pcmcia/sa1100_jornada720.c
+++ b/drivers/pcmcia/sa1100_jornada720.c
@@ -42,7 +42,7 @@ jornada720_pcmcia_configure_socket(struct soc_pcmcia_socket *skt, const socket_s
   unsigned int pa_dwr_mask, pa_dwr_set;
   int ret;
 
-printk("%s(): config socket %d vcc %d vpp %d\n", __FUNCTION__,
+printk("%s(): config socket %d vcc %d vpp %d\n", __func__,
         skt->nr, state->Vcc, state->Vpp);
 
   switch (skt->nr) {
@@ -74,7 +74,7 @@ printk("%s(): config socket %d vcc %d vpp %d\n", __FUNCTION__,
 
   if (state->Vpp != state->Vcc && state->Vpp != 0) {
     printk(KERN_ERR "%s(): slot cannot support VPP %u\n",
-           __FUNCTION__, state->Vpp);
+           __func__, state->Vpp);
     return -1;
   }
 
diff --git a/drivers/pcmcia/sa1100_neponset.c b/drivers/pcmcia/sa1100_neponset.c
index 5bc9e9532b9..687492fcd5b 100644
--- a/drivers/pcmcia/sa1100_neponset.c
+++ b/drivers/pcmcia/sa1100_neponset.c
@@ -59,7 +59,7 @@ neponset_pcmcia_configure_socket(struct soc_pcmcia_socket *skt, const socket_sta
                         ncr_set = NCR_A0VPP;
                 else {
                         printk(KERN_ERR "%s(): unrecognized VPP %u\n",
-                               __FUNCTION__, state->Vpp);
+                               __func__, state->Vpp);
                         return -1;
                 }
                 break;
@@ -71,7 +71,7 @@ neponset_pcmcia_configure_socket(struct soc_pcmcia_socket *skt, const socket_sta
 
                 if (state->Vpp != state->Vcc && state->Vpp != 0) {
                         printk(KERN_ERR "%s(): CF slot cannot support VPP %u\n",
-                               __FUNCTION__, state->Vpp);
+                               __func__, state->Vpp);
                         return -1;
                 }
                 break;
diff --git a/drivers/pcmcia/sa1100_shannon.c b/drivers/pcmcia/sa1100_shannon.c
index 9456f5478d0..494912fccc0 100644
--- a/drivers/pcmcia/sa1100_shannon.c
+++ b/drivers/pcmcia/sa1100_shannon.c
@@ -73,19 +73,19 @@ shannon_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
 {
         switch (state->Vcc) {
         case 0: /* power off */
-                printk(KERN_WARNING "%s(): CS asked for 0V, still applying 3.3V..\n", __FUNCTION__);
+                printk(KERN_WARNING "%s(): CS asked for 0V, still applying 3.3V..\n", __func__);
                 break;
         case 50:
-                printk(KERN_WARNING "%s(): CS asked for 5V, applying 3.3V..\n", __FUNCTION__);
+                printk(KERN_WARNING "%s(): CS asked for 5V, applying 3.3V..\n", __func__);
         case 33:
                 break;
         default:
                 printk(KERN_ERR "%s(): unrecognized Vcc %u\n",
-                       __FUNCTION__, state->Vcc);
+                       __func__, state->Vcc);
                 return -1;
         }
 
-        printk(KERN_WARNING "%s(): Warning, Can't perform reset\n", __FUNCTION__);
+        printk(KERN_WARNING "%s(): Warning, Can't perform reset\n", __func__);
         
         /* Silently ignore Vpp, output enable, speaker enable. */
 
diff --git a/drivers/pcmcia/sa1100_simpad.c b/drivers/pcmcia/sa1100_simpad.c
index 04d6f7f75f7..42567de894b 100644
--- a/drivers/pcmcia/sa1100_simpad.c
+++ b/drivers/pcmcia/sa1100_simpad.c
@@ -90,7 +90,7 @@ simpad_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
 
         default:
                 printk(KERN_ERR "%s(): unrecognized Vcc %u\n",
-                        __FUNCTION__, state->Vcc);
+                        __func__, state->Vcc);
                 clear_cs3_bit(VCC_3V_EN|VCC_5V_EN|EN0|EN1);
                 local_irq_restore(flags);
                 return -1;
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index aa7779d8975..420a77540f4 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -37,6 +37,7 @@
 #include <linux/kernel.h>
 #include <linux/timer.h>
 #include <linux/mm.h>
+#include <linux/mutex.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/spinlock.h>
@@ -353,7 +354,7 @@ soc_common_pcmcia_set_io_map(struct pcmcia_socket *sock, struct pccard_io_map *m
                 (map->flags&MAP_PREFETCH)?"PREFETCH ":"");
 
         if (map->map >= MAX_IO_WIN) {
-                printk(KERN_ERR "%s(): map (%d) out of range\n", __FUNCTION__,
+                printk(KERN_ERR "%s(): map (%d) out of range\n", __func__,
                        map->map);
                 return -1;
         }
@@ -578,7 +579,7 @@ EXPORT_SYMBOL(soc_pcmcia_enable_irqs);
 
 
 LIST_HEAD(soc_pcmcia_sockets);
-DECLARE_MUTEX(soc_pcmcia_sockets_lock);
+static DEFINE_MUTEX(soc_pcmcia_sockets_lock);
 
 static const char *skt_names[] = {
         "PCMCIA socket 0",
@@ -601,11 +602,11 @@ soc_pcmcia_notifier(struct notifier_block *nb, unsigned long val, void *data)
         struct cpufreq_freqs *freqs = data;
         int ret = 0;
 
-        down(&soc_pcmcia_sockets_lock);
+        mutex_lock(&soc_pcmcia_sockets_lock);
         list_for_each_entry(skt, &soc_pcmcia_sockets, node)
                 if ( skt->ops->frequency_change )
                         ret += skt->ops->frequency_change(skt, val, freqs);
-        up(&soc_pcmcia_sockets_lock);
+        mutex_unlock(&soc_pcmcia_sockets_lock);
 
         return ret;
 }
@@ -642,7 +643,7 @@ int soc_common_drv_pcmcia_probe(struct device *dev, struct pcmcia_low_level *ops
         struct soc_pcmcia_socket *skt;
         int ret, i;
 
-        down(&soc_pcmcia_sockets_lock);
+        mutex_lock(&soc_pcmcia_sockets_lock);
 
         sinfo = kzalloc(SKT_DEV_INFO_SIZE(nr), GFP_KERNEL);
         if (!sinfo) {
@@ -782,7 +783,7 @@ int soc_common_drv_pcmcia_probe(struct device *dev, struct pcmcia_low_level *ops
         kfree(sinfo);
 
  out:
-        up(&soc_pcmcia_sockets_lock);
+        mutex_unlock(&soc_pcmcia_sockets_lock);
         return ret;
 }
 
@@ -793,7 +794,7 @@ int soc_common_drv_pcmcia_remove(struct device *dev)
 
         dev_set_drvdata(dev, NULL);
 
-        down(&soc_pcmcia_sockets_lock);
+        mutex_lock(&soc_pcmcia_sockets_lock);
         for (i = 0; i < sinfo->nskt; i++) {
                 struct soc_pcmcia_socket *skt = &sinfo->skt[i];
 
@@ -818,7 +819,7 @@ int soc_common_drv_pcmcia_remove(struct device *dev)
         if (list_empty(&soc_pcmcia_sockets))
                 soc_pcmcia_cpufreq_unregister();
 
-        up(&soc_pcmcia_sockets_lock);
+        mutex_unlock(&soc_pcmcia_sockets_lock);
 
         kfree(sinfo);
 
diff --git a/drivers/pcmcia/soc_common.h b/drivers/pcmcia/soc_common.h
index 6f14126889b..1edc1da9d35 100644
--- a/drivers/pcmcia/soc_common.h
+++ b/drivers/pcmcia/soc_common.h
@@ -133,7 +133,6 @@ extern void soc_common_pcmcia_get_timing(struct soc_pcmcia_socket *, struct soc_
 
 
 extern struct list_head soc_pcmcia_sockets;
-extern struct semaphore soc_pcmcia_sockets_lock;
 
 extern int soc_common_drv_pcmcia_probe(struct device *dev, struct pcmcia_low_level *ops, int first, int nr);
 extern int soc_common_drv_pcmcia_remove(struct device *dev);
diff --git a/drivers/pnp/interface.c b/drivers/pnp/interface.c
index 5d9301de177..5695a79f3a5 100644
--- a/drivers/pnp/interface.c
+++ b/drivers/pnp/interface.c
@@ -424,7 +424,7 @@ pnp_set_current_resources(struct device *dmdev, struct device_attribute *attr,
                                 start = simple_strtoul(buf, &buf, 0);
                                 pnp_res = pnp_add_irq_resource(dev, start, 0);
                                 if (pnp_res)
-                                        nirq++;
+                                        pnp_res->index = nirq++;
                                 continue;
                         }
                         if (!strnicmp(buf, "dma", 3)) {
diff --git a/drivers/pnp/pnpbios/rsparser.c b/drivers/pnp/pnpbios/rsparser.c
index 2e2c457a0fe..5ff9a4c0447 100644
--- a/drivers/pnp/pnpbios/rsparser.c
+++ b/drivers/pnp/pnpbios/rsparser.c
@@ -591,7 +591,8 @@ static void pnpbios_encode_irq(struct pnp_dev *dev, unsigned char *p,
         p[1] = map & 0xff;
         p[2] = (map >> 8) & 0xff;
 
-        dev_dbg(&dev->dev, "  encode irq %d\n", res->start);
+        dev_dbg(&dev->dev, "  encode irq %llu\n",
+                (unsigned long long)res->start);
 }
 
 static void pnpbios_encode_dma(struct pnp_dev *dev, unsigned char *p,
@@ -602,7 +603,8 @@ static void pnpbios_encode_dma(struct pnp_dev *dev, unsigned char *p,
         map = 1 << res->start;
         p[1] = map & 0xff;
 
-        dev_dbg(&dev->dev, "  encode dma %d\n", res->start);
+        dev_dbg(&dev->dev, "  encode dma %llu\n",
+                (unsigned long long)res->start);
 }
 
 static void pnpbios_encode_port(struct pnp_dev *dev, unsigned char *p,
diff --git a/drivers/power/pda_power.c b/drivers/power/pda_power.c
index c8aa55b81fd..82810b7bff9 100644
--- a/drivers/power/pda_power.c
+++ b/drivers/power/pda_power.c
@@ -209,6 +209,12 @@ static int pda_power_probe(struct platform_device *pdev)
 
         pdata = pdev->dev.platform_data;
 
+        if (pdata->init) {
+                ret = pdata->init(dev);
+                if (ret < 0)
+                        goto init_failed;
+        }
+
         update_status();
         update_charger();
 
@@ -298,6 +304,9 @@ ac_irq_failed:
         if (pdata->is_ac_online)
                 power_supply_unregister(&pda_psy_ac);
 ac_supply_failed:
+        if (pdata->exit)
+                pdata->exit(dev);
+init_failed:
 wrongid:
         return ret;
 }
@@ -318,6 +327,8 @@ static int pda_power_remove(struct platform_device *pdev)
                 power_supply_unregister(&pda_psy_usb);
         if (pdata->is_ac_online)
                 power_supply_unregister(&pda_psy_ac);
+        if (pdata->exit)
+                pdata->exit(dev);
 
         return 0;
 }
diff --git a/drivers/power/pmu_battery.c b/drivers/power/pmu_battery.c
index 60a8cf3a043..9346a862f1f 100644
--- a/drivers/power/pmu_battery.c
+++ b/drivers/power/pmu_battery.c
@@ -159,7 +159,7 @@ static int __init pmu_bat_init(void)
                 if (!pbat)
                         break;
 
-                sprintf(pbat->name, "PMU battery %d", i);
+                sprintf(pbat->name, "PMU_battery_%d", i);
                 pbat->bat.name = pbat->name;
                 pbat->bat.properties = pmu_bat_props;
                 pbat->bat.num_properties = ARRAY_SIZE(pmu_bat_props);
diff --git a/drivers/ps3/ps3-lpm.c b/drivers/ps3/ps3-lpm.c
index 6c9592ce499..85edf945ab8 100644
--- a/drivers/ps3/ps3-lpm.c
+++ b/drivers/ps3/ps3-lpm.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/uaccess.h>
+#include <asm/time.h>
 #include <asm/ps3.h>
 #include <asm/lv1call.h>
 #include <asm/cell-pmu.h>
diff --git a/drivers/ps3/ps3-sys-manager.c b/drivers/ps3/ps3-sys-manager.c
index 7605453b74f..f17513dd9d4 100644
--- a/drivers/ps3/ps3-sys-manager.c
+++ b/drivers/ps3/ps3-sys-manager.c
@@ -184,10 +184,7 @@ enum ps3_sys_manager_next_op {
 
 /**
  * enum ps3_sys_manager_wake_source - Next-op wakeup source (bit position mask).
- * @PS3_SM_WAKE_DEFAULT: Disk insert, power button, eject button, IR
- * controller, and bluetooth controller.
- * @PS3_SM_WAKE_RTC:
- * @PS3_SM_WAKE_RTC_ERROR:
+ * @PS3_SM_WAKE_DEFAULT: Disk insert, power button, eject button.
  * @PS3_SM_WAKE_W_O_L: Ether or wireless LAN.
  * @PS3_SM_WAKE_P_O_R: Power on reset.
  *
@@ -200,8 +197,6 @@ enum ps3_sys_manager_next_op {
 enum ps3_sys_manager_wake_source {
         /* version 3 */
         PS3_SM_WAKE_DEFAULT   = 0,
-        PS3_SM_WAKE_RTC       = 0x00000040,
-        PS3_SM_WAKE_RTC_ERROR = 0x00000080,
         PS3_SM_WAKE_W_O_L     = 0x00000400,
         PS3_SM_WAKE_P_O_R     = 0x80000000,
 };
diff --git a/drivers/rtc/rtc-ds1511.c b/drivers/rtc/rtc-ds1511.c
index a83a40b3eba..0f0d27d1c4c 100644
--- a/drivers/rtc/rtc-ds1511.c
+++ b/drivers/rtc/rtc-ds1511.c
@@ -184,7 +184,7 @@ ds1511_wdog_disable(void)
 static int ds1511_rtc_set_time(struct device *dev, struct rtc_time *rtc_tm)
 {
         u8 mon, day, dow, hrs, min, sec, yrs, cen;
-        unsigned int flags;
+        unsigned long flags;
 
         /*
          * won't have to change this for a while
@@ -247,7 +247,7 @@ static int ds1511_rtc_set_time(struct device *dev, struct rtc_time *rtc_tm)
 static int ds1511_rtc_read_time(struct device *dev, struct rtc_time *rtc_tm)
 {
         unsigned int century;
-        unsigned int flags;
+        unsigned long flags;
 
         spin_lock_irqsave(&ds1511_lock, flags);
         rtc_disable_update();
diff --git a/drivers/rtc/rtc-lib.c b/drivers/rtc/rtc-lib.c
index ba795a4db1e..9f996ec881c 100644
--- a/drivers/rtc/rtc-lib.c
+++ b/drivers/rtc/rtc-lib.c
@@ -51,7 +51,7 @@ EXPORT_SYMBOL(rtc_year_days);
  */
 void rtc_time_to_tm(unsigned long time, struct rtc_time *tm)
 {
-        register int days, month, year;
+        unsigned int days, month, year;
 
         days = time / 86400;
         time -= days * 86400;
diff --git a/drivers/rtc/rtc-m41t80.c b/drivers/rtc/rtc-m41t80.c
index 316bfaa8087..a3e0880b38f 100644
--- a/drivers/rtc/rtc-m41t80.c
+++ b/drivers/rtc/rtc-m41t80.c
@@ -15,6 +15,7 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/i2c.h>
@@ -803,6 +804,7 @@ static int m41t80_probe(struct i2c_client *client,
 
 #ifdef CONFIG_RTC_DRV_M41T80_WDT
         if (clientdata->features & M41T80_FEATURE_HT) {
+                save_client = client;
                 rc = misc_register(&wdt_dev);
                 if (rc)
                         goto exit;
@@ -811,7 +813,6 @@ static int m41t80_probe(struct i2c_client *client,
                         misc_deregister(&wdt_dev);
                         goto exit;
                 }
-                save_client = client;
         }
 #endif
         return 0;
diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c
index 29f47bacfc7..a6fa1f2f2ca 100644
--- a/drivers/rtc/rtc-s35390a.c
+++ b/drivers/rtc/rtc-s35390a.c
@@ -227,7 +227,7 @@ static int s35390a_probe(struct i2c_client *client,
         /* This chip uses multiple addresses, use dummy devices for them */
         for (i = 1; i < 8; ++i) {
                 s35390a->client[i] = i2c_new_dummy(client->adapter,
-                                        client->addr + i, "rtc-s35390a");
+                                        client->addr + i);
                 if (!s35390a->client[i]) {
                         dev_err(&client->dev, "Address %02x unavailable\n",
                                                 client->addr + i);
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index 110699bb478..1f88e9e914e 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -616,7 +616,7 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
                 goto err_badres;
         }
 
-        rtc->regbase = (void __iomem *)rtc->res->start;
+        rtc->regbase = ioremap_nocache(rtc->res->start, rtc->regsize);
         if (unlikely(!rtc->regbase)) {
                 ret = -EINVAL;
                 goto err_badmap;
@@ -626,7 +626,7 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
                                            &sh_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc->rtc_dev)) {
                 ret = PTR_ERR(rtc->rtc_dev);
-                goto err_badmap;
+                goto err_unmap;
         }
 
         rtc->capabilities = RTC_DEF_CAPABILITIES;
@@ -653,7 +653,7 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev,
                         "request period IRQ failed with %d, IRQ %d\n", ret,
                         rtc->periodic_irq);
-                goto err_badmap;
+                goto err_unmap;
         }
 
         ret = request_irq(rtc->carry_irq, sh_rtc_interrupt, IRQF_DISABLED,
@@ -663,7 +663,7 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
                         "request carry IRQ failed with %d, IRQ %d\n", ret,
                         rtc->carry_irq);
                 free_irq(rtc->periodic_irq, rtc);
-                goto err_badmap;
+                goto err_unmap;
         }
 
         ret = request_irq(rtc->alarm_irq, sh_rtc_alarm, IRQF_DISABLED,
@@ -674,7 +674,7 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
                         rtc->alarm_irq);
                 free_irq(rtc->carry_irq, rtc);
                 free_irq(rtc->periodic_irq, rtc);
-                goto err_badmap;
+                goto err_unmap;
         }
 
         tmp = readb(rtc->regbase + RCR1);
@@ -684,6 +684,8 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
 
         return 0;
 
+err_unmap:
+        iounmap(rtc->regbase);
 err_badmap:
         release_resource(rtc->res);
 err_badres:
@@ -708,6 +710,8 @@ static int __devexit sh_rtc_remove(struct platform_device *pdev)
 
         release_resource(rtc->res);
 
+        iounmap(rtc->regbase);
+
         platform_set_drvdata(pdev, NULL);
 
         kfree(rtc);
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index c1f2adefad4..5043150019a 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -965,8 +965,7 @@ tty3270_write_room(struct tty_struct *tty)
  * Insert character into the screen at the current position with the
  * current color and highlight. This function does NOT do cursor movement.
  */
-static int
-tty3270_put_character(struct tty3270 *tp, char ch)
+static void tty3270_put_character(struct tty3270 *tp, char ch)
 {
         struct tty3270_line *line;
         struct tty3270_cell *cell;
@@ -986,7 +985,6 @@ tty3270_put_character(struct tty3270 *tp, char ch)
         cell->character = tp->view.ascebc[(unsigned int) ch];
         cell->highlight = tp->highlight;
         cell->f_color = tp->f_color;
-        return 1;
 }
 
 /*
@@ -1612,16 +1610,15 @@ tty3270_write(struct tty_struct * tty,
 /*
  * Put single characters to the ttys character buffer
  */
-static void
-tty3270_put_char(struct tty_struct *tty, unsigned char ch)
+static int tty3270_put_char(struct tty_struct *tty, unsigned char ch)
 {
         struct tty3270 *tp;
 
         tp = tty->driver_data;
-        if (!tp)
-                return;
-        if (tp->char_count < TTY3270_CHAR_BUF_SIZE)
-                tp->char_buf[tp->char_count++] = ch;
+        if (!tp || tp->char_count >= TTY3270_CHAR_BUF_SIZE)
+                return 0;
+        tp->char_buf[tp->char_count++] = ch;
+        return 1;
 }
 
 /*
diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c
index 40ef948fcb3..9c21b8f43f9 100644
--- a/drivers/s390/cio/blacklist.c
+++ b/drivers/s390/cio/blacklist.c
@@ -19,6 +19,7 @@
 
 #include <asm/cio.h>
 #include <asm/uaccess.h>
+#include <asm/cio.h>
 
 #include "blacklist.h"
 #include "cio.h"
@@ -43,164 +44,169 @@ typedef enum {add, free} range_action;
  * Function: blacklist_range
  * (Un-)blacklist the devices from-to
  */
-static void
-blacklist_range (range_action action, unsigned int from, unsigned int to,
-                 unsigned int ssid)
+static int blacklist_range(range_action action, unsigned int from_ssid,
+                           unsigned int to_ssid, unsigned int from,
+                           unsigned int to, int msgtrigger)
 {
-        if (!to)
-                to = from;
-
-        if (from > to || to > __MAX_SUBCHANNEL || ssid > __MAX_SSID) {
-                printk (KERN_WARNING "cio: Invalid blacklist range "
-                        "0.%x.%04x to 0.%x.%04x, skipping\n",
-                        ssid, from, ssid, to);
-                return;
+        if ((from_ssid > to_ssid) || ((from_ssid == to_ssid) && (from > to))) {
+                if (msgtrigger)
+                        printk(KERN_WARNING "cio: Invalid cio_ignore range "
+                               "0.%x.%04x-0.%x.%04x\n", from_ssid, from,
+                               to_ssid, to);
+                return 1;
         }
-        for (; from <= to; from++) {
+
+        while ((from_ssid < to_ssid) || ((from_ssid == to_ssid) &&
+               (from <= to))) {
                 if (action == add)
-                        set_bit (from, bl_dev[ssid]);
+                        set_bit(from, bl_dev[from_ssid]);
                 else
-                        clear_bit (from, bl_dev[ssid]);
+                        clear_bit(from, bl_dev[from_ssid]);
+                from++;
+                if (from > __MAX_SUBCHANNEL) {
+                        from_ssid++;
+                        from = 0;
+                }
         }
+
+        return 0;
 }
 
-/*
- * Function: blacklist_busid
- * Get devno/busid from given string.
- * Shamelessly grabbed from dasd_devmap.c.
- */
-static int
-blacklist_busid(char **str, int *id0, int *ssid, int *devno)
+static int pure_hex(char **cp, unsigned int *val, int min_digit,
+                    int max_digit, int max_val)
 {
-        int val, old_style;
-        char *sav;
+        int diff;
+        unsigned int value;
 
-        sav = *str;
+        diff = 0;
+        *val = 0;
 
-        /* check for leading '0x' */
-        old_style = 0;
-        if ((*str)[0] == '0' && (*str)[1] == 'x') {
-                *str += 2;
-                old_style = 1;
-        }
-        if (!isxdigit((*str)[0]))       /* We require at least one hex digit */
-                goto confused;
-        val = simple_strtoul(*str, str, 16);
-        if (old_style || (*str)[0] != '.') {
-                *id0 = *ssid = 0;
-                if (val < 0 || val > 0xffff)
-                        goto confused;
-                *devno = val;
-                if ((*str)[0] != ',' && (*str)[0] != '-' &&
-                    (*str)[0] != '\n' && (*str)[0] != '\0')
-                        goto confused;
-                return 0;
+        while (isxdigit(**cp) && (diff <= max_digit)) {
+
+                if (isdigit(**cp))
+                        value = **cp - '0';
+                else
+                        value = tolower(**cp) - 'a' + 10;
+                *val = *val * 16 + value;
+                (*cp)++;
+                diff++;
         }
-        /* New style x.y.z busid */
-        if (val < 0 || val > 0xff)
-                goto confused;
-        *id0 = val;
-        (*str)++;
-        if (!isxdigit((*str)[0]))       /* We require at least one hex digit */
-                goto confused;
-        val = simple_strtoul(*str, str, 16);
-        if (val < 0 || val > 0xff || (*str)++[0] != '.')
-                goto confused;
-        *ssid = val;
-        if (!isxdigit((*str)[0]))       /* We require at least one hex digit */
-                goto confused;
-        val = simple_strtoul(*str, str, 16);
-        if (val < 0 || val > 0xffff)
-                goto confused;
-        *devno = val;
-        if ((*str)[0] != ',' && (*str)[0] != '-' &&
-            (*str)[0] != '\n' && (*str)[0] != '\0')
-                goto confused;
+
+        if ((diff < min_digit) || (diff > max_digit) || (*val > max_val))
+                return 1;
+
         return 0;
-confused:
-        strsep(str, ",\n");
-        printk(KERN_WARNING "cio: Invalid cio_ignore parameter '%s'\n", sav);
-        return 1;
 }
 
-static int
-blacklist_parse_parameters (char *str, range_action action)
+static int parse_busid(char *str, int *cssid, int *ssid, int *devno,
+                       int msgtrigger)
 {
-        int from, to, from_id0, to_id0, from_ssid, to_ssid;
-
-        while (*str != 0 && *str != '\n') {
-                range_action ra = action;
-                while(*str == ',')
-                        str++;
-                if (*str == '!') {
-                        ra = !action;
-                        ++str;
+        char *str_work;
+        int val, rc, ret;
+
+        rc = 1;
+
+        if (*str == '\0')
+                goto out;
+
+        /* old style */
+        str_work = str;
+        val = simple_strtoul(str, &str_work, 16);
+
+        if (*str_work == '\0') {
+                if (val <= __MAX_SUBCHANNEL) {
+                        *devno = val;
+                        *ssid = 0;
+                        *cssid = 0;
+                        rc = 0;
                 }
+                goto out;
+        }
 
-                /*
-                 * Since we have to parse the proc commands and the
-                 * kernel arguments we have to check four cases
-                 */
-                if (strncmp(str,"all,",4) == 0 || strcmp(str,"all") == 0 ||
-                    strncmp(str,"all\n",4) == 0 || strncmp(str,"all ",4) == 0) {
-                        int j;
-
-                        str += 3;
-                        for (j=0; j <= __MAX_SSID; j++)
-                                blacklist_range(ra, 0, __MAX_SUBCHANNEL, j);
-                } else {
-                        int rc;
+        /* new style */
+        str_work = str;
+        ret = pure_hex(&str_work, cssid, 1, 2, __MAX_CSSID);
+        if (ret || (str_work[0] != '.'))
+                goto out;
+        str_work++;
+        ret = pure_hex(&str_work, ssid, 1, 1, __MAX_SSID);
+        if (ret || (str_work[0] != '.'))
+                goto out;
+        str_work++;
+        ret = pure_hex(&str_work, devno, 4, 4, __MAX_SUBCHANNEL);
+        if (ret || (str_work[0] != '\0'))
+                goto out;
+
+        rc = 0;
+out:
+        if (rc && msgtrigger)
+                printk(KERN_WARNING "cio: Invalid cio_ignore device '%s'\n",
+                       str);
+
+        return rc;
+}
 
-                        rc = blacklist_busid(&str, &from_id0,
-                                             &from_ssid, &from);
-                        if (rc)
-                                continue;
-                        to = from;
-                        to_id0 = from_id0;
-                        to_ssid = from_ssid;
-                        if (*str == '-') {
-                                str++;
-                                rc = blacklist_busid(&str, &to_id0,
-                                                     &to_ssid, &to);
-                                if (rc)
-                                        continue;
-                        }
-                        if (*str == '-') {
-                                printk(KERN_WARNING "cio: invalid cio_ignore "
-                                        "parameter '%s'\n",
-                                        strsep(&str, ",\n"));
-                                continue;
-                        }
-                        if ((from_id0 != to_id0) ||
-                            (from_ssid != to_ssid)) {
-                                printk(KERN_WARNING "cio: invalid cio_ignore "
-                                       "range %x.%x.%04x-%x.%x.%04x\n",
-                                       from_id0, from_ssid, from,
-                                       to_id0, to_ssid, to);
-                                continue;
+static int blacklist_parse_parameters(char *str, range_action action,
+                                      int msgtrigger)
+{
+        int from_cssid, to_cssid, from_ssid, to_ssid, from, to;
+        int rc, totalrc;
+        char *parm;
+        range_action ra;
+
+        totalrc = 0;
+
+        while ((parm = strsep(&str, ","))) {
+                rc = 0;
+                ra = action;
+                if (*parm == '!') {
+                        if (ra == add)
+                                ra = free;
+                        else
+                                ra = add;
+                        parm++;
+                }
+                if (strcmp(parm, "all") == 0) {
+                        from_cssid = 0;
+                        from_ssid = 0;
+                        from = 0;
+                        to_cssid = __MAX_CSSID;
+                        to_ssid = __MAX_SSID;
+                        to = __MAX_SUBCHANNEL;
+                } else {
+                        rc = parse_busid(strsep(&parm, "-"), &from_cssid,
+                                         &from_ssid, &from, msgtrigger);
+                        if (!rc) {
+                                if (parm != NULL)
+                                        rc = parse_busid(parm, &to_cssid,
+                                                         &to_ssid, &to,
+                                                         msgtrigger);
+                                else {
+                                        to_cssid = from_cssid;
+                                        to_ssid = from_ssid;
+                                        to = from;
+                                }
                         }
-                        blacklist_range (ra, from, to, to_ssid);
                 }
+                if (!rc) {
+                        rc = blacklist_range(ra, from_ssid, to_ssid, from, to,
+                                             msgtrigger);
+                        if (rc)
+                                totalrc = 1;
+                } else
+                        totalrc = 1;
         }
-        return 1;
+
+        return totalrc;
 }
 
-/* Parsing the commandline for blacklist parameters, e.g. to blacklist
- * bus ids 0.0.1234, 0.0.1235 and 0.0.1236, you could use any of:
- * - cio_ignore=1234-1236
- * - cio_ignore=0x1234-0x1235,1236
- * - cio_ignore=0x1234,1235-1236
- * - cio_ignore=1236 cio_ignore=1234-0x1236
- * - cio_ignore=1234 cio_ignore=1236 cio_ignore=0x1235
- * - cio_ignore=0.0.1234-0.0.1236
- * - cio_ignore=0.0.1234,0x1235,1236
- * - ...
- */
 static int __init
 blacklist_setup (char *str)
 {
         CIO_MSG_EVENT(6, "Reading blacklist parameters\n");
-        return blacklist_parse_parameters (str, add);
+        if (blacklist_parse_parameters(str, add, 1))
+                return 0;
+        return 1;
 }
 
 __setup ("cio_ignore=", blacklist_setup);
@@ -224,27 +230,23 @@ is_blacklisted (int ssid, int devno)
  * Function: blacklist_parse_proc_parameters
  * parse the stuff which is piped to /proc/cio_ignore
  */
-static void
-blacklist_parse_proc_parameters (char *buf)
+static int blacklist_parse_proc_parameters(char *buf)
 {
-        if (strncmp (buf, "free ", 5) == 0) {
-                blacklist_parse_parameters (buf + 5, free);
-        } else if (strncmp (buf, "add ", 4) == 0) {
-                /* 
-                 * We don't need to check for known devices since
-                 * css_probe_device will handle this correctly. 
-                 */
-                blacklist_parse_parameters (buf + 4, add);
-        } else {
-                printk (KERN_WARNING "cio: cio_ignore: Parse error; \n"
-                        KERN_WARNING "try using 'free all|<devno-range>,"
-                                     "<devno-range>,...'\n"
-                        KERN_WARNING "or 'add <devno-range>,"
-                                     "<devno-range>,...'\n");
-                return;
-        }
+        int rc;
+        char *parm;
+
+        parm = strsep(&buf, " ");
+
+        if (strcmp("free", parm) == 0)
+                rc = blacklist_parse_parameters(buf, free, 0);
+        else if (strcmp("add", parm) == 0)
+                rc = blacklist_parse_parameters(buf, add, 0);
+        else
+                return 1;
 
         css_schedule_reprobe();
+
+        return rc;
 }
 
 /* Iterator struct for all devices. */
@@ -328,6 +330,8 @@ cio_ignore_write(struct file *file, const char __user *user_buf,
                  size_t user_len, loff_t *offset)
 {
         char *buf;
+        size_t i;
+        ssize_t rc, ret;
 
         if (*offset)
                 return -EINVAL;
@@ -336,16 +340,27 @@ cio_ignore_write(struct file *file, const char __user *user_buf,
         buf = vmalloc (user_len + 1); /* maybe better use the stack? */
         if (buf == NULL)
                 return -ENOMEM;
+        memset(buf, 0, user_len + 1);
+
         if (strncpy_from_user (buf, user_buf, user_len) < 0) {
-                vfree (buf);
-                return -EFAULT;
+                rc = -EFAULT;
+                goto out_free;
         }
-        buf[user_len] = '\0';
 
-        blacklist_parse_proc_parameters (buf);
+        i = user_len - 1;
+        while ((i >= 0) && (isspace(buf[i]) || (buf[i] == 0))) {
+                buf[i] = '\0';
+                i--;
+        }
+        ret = blacklist_parse_proc_parameters(buf);
+        if (ret)
+                rc = -EINVAL;
+        else
+                rc = user_len;
 
+out_free:
         vfree (buf);
-        return user_len;
+        return rc;
 }
 
 static const struct seq_operations cio_ignore_proc_seq_ops = {
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 08a57816130..82c6a2d4512 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -39,23 +39,6 @@ debug_info_t *cio_debug_msg_id;
 debug_info_t *cio_debug_trace_id;
 debug_info_t *cio_debug_crw_id;
 
-int cio_show_msg;
-
-static int __init
-cio_setup (char *parm)
-{
-        if (!strcmp (parm, "yes"))
-                cio_show_msg = 1;
-        else if (!strcmp (parm, "no"))
-                cio_show_msg = 0;
-        else
-                printk(KERN_ERR "cio: cio_setup: "
-                       "invalid cio_msg parameter '%s'", parm);
-        return 1;
-}
-
-__setup ("cio_msg=", cio_setup);
-
 /*
  * Function: cio_debug_init
  * Initializes three debug logs for common I/O:
@@ -166,7 +149,7 @@ cio_start_handle_notoper(struct subchannel *sch, __u8 lpm)
 
         stsch (sch->schid, &sch->schib);
 
-        CIO_MSG_EVENT(0, "cio_start: 'not oper' status for "
+        CIO_MSG_EVENT(2, "cio_start: 'not oper' status for "
                       "subchannel 0.%x.%04x!\n", sch->schid.ssid,
                       sch->schid.sch_no);
         sprintf(dbf_text, "no%s", sch->dev.bus_id);
@@ -567,10 +550,9 @@ cio_validate_subchannel (struct subchannel *sch, struct subchannel_id schid)
          * ... just being curious we check for non I/O subchannels
          */
         if (sch->st != 0) {
-                CIO_DEBUG(KERN_INFO, 0,
-                          "Subchannel 0.%x.%04x reports "
-                          "non-I/O subchannel type %04X\n",
-                          sch->schid.ssid, sch->schid.sch_no, sch->st);
+                CIO_MSG_EVENT(4, "Subchannel 0.%x.%04x reports "
+                              "non-I/O subchannel type %04X\n",
+                              sch->schid.ssid, sch->schid.sch_no, sch->st);
                 /* We stop here for non-io subchannels. */
                 err = sch->st;
                 goto out;
@@ -588,7 +570,7 @@ cio_validate_subchannel (struct subchannel *sch, struct subchannel_id schid)
                  * This device must not be known to Linux. So we simply
                  * say that there is no device and return ENODEV.
                  */
-                CIO_MSG_EVENT(4, "Blacklisted device detected "
+                CIO_MSG_EVENT(6, "Blacklisted device detected "
                               "at devno %04X, subchannel set %x\n",
                               sch->schib.pmcw.dev, sch->schid.ssid);
                 err = -ENODEV;
@@ -601,12 +583,11 @@ cio_validate_subchannel (struct subchannel *sch, struct subchannel_id schid)
         sch->lpm = sch->schib.pmcw.pam & sch->opm;
         sch->isc = 3;
 
-        CIO_DEBUG(KERN_INFO, 0,
-                  "Detected device %04x on subchannel 0.%x.%04X"
-                  " - PIM = %02X, PAM = %02X, POM = %02X\n",
-                  sch->schib.pmcw.dev, sch->schid.ssid,
-                  sch->schid.sch_no, sch->schib.pmcw.pim,
-                  sch->schib.pmcw.pam, sch->schib.pmcw.pom);
+        CIO_MSG_EVENT(6, "Detected device %04x on subchannel 0.%x.%04X "
+                      "- PIM = %02X, PAM = %02X, POM = %02X\n",
+                      sch->schib.pmcw.dev, sch->schid.ssid,
+                      sch->schid.sch_no, sch->schib.pmcw.pim,
+                      sch->schib.pmcw.pam, sch->schib.pmcw.pom);
 
         /*
          * We now have to initially ...
diff --git a/drivers/s390/cio/cio.h b/drivers/s390/cio/cio.h
index 3c75412904d..6e933aebe01 100644
--- a/drivers/s390/cio/cio.h
+++ b/drivers/s390/cio/cio.h
@@ -118,6 +118,4 @@ extern void *cio_get_console_priv(void);
 #define cio_get_console_priv() NULL
 #endif
 
-extern int cio_show_msg;
-
 #endif
diff --git a/drivers/s390/cio/cio_debug.h b/drivers/s390/cio/cio_debug.h
index d7429ef6c66..e64e8278c42 100644
--- a/drivers/s390/cio/cio_debug.h
+++ b/drivers/s390/cio/cio_debug.h
@@ -31,10 +31,4 @@ static inline void CIO_HEX_EVENT(int level, void *data, int length)
         }
 }
 
-#define CIO_DEBUG(printk_level, event_level, msg...) do {       \
-                if (cio_show_msg)                               \
-                        printk(printk_level "cio: " msg);       \
-                CIO_MSG_EVENT(event_level, msg);                \
-        } while (0)
-
 #endif
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 595e327d2f7..a76956512b2 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -570,7 +570,7 @@ static void reprobe_all(struct work_struct *unused)
 {
         int ret;
 
-        CIO_MSG_EVENT(2, "reprobe start\n");
+        CIO_MSG_EVENT(4, "reprobe start\n");
 
         need_reprobe = 0;
         /* Make sure initial subchannel scan is done. */
@@ -578,7 +578,7 @@ static void reprobe_all(struct work_struct *unused)
                    atomic_read(&ccw_device_init_count) == 0);
         ret = for_each_subchannel_staged(NULL, reprobe_subchannel, NULL);
 
-        CIO_MSG_EVENT(2, "reprobe done (rc=%d, need_reprobe=%d)\n", ret,
+        CIO_MSG_EVENT(4, "reprobe done (rc=%d, need_reprobe=%d)\n", ret,
                       need_reprobe);
 }
 
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index abfd601d237..e22813db74a 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -341,7 +341,7 @@ ccw_device_remove_disconnected(struct ccw_device *cdev)
                 rc = device_schedule_callback(&cdev->dev,
                                               ccw_device_remove_orphan_cb);
                 if (rc)
-                        CIO_MSG_EVENT(2, "Couldn't unregister orphan "
+                        CIO_MSG_EVENT(0, "Couldn't unregister orphan "
                                       "0.%x.%04x\n",
                                       cdev->private->dev_id.ssid,
                                       cdev->private->dev_id.devno);
@@ -351,7 +351,7 @@ ccw_device_remove_disconnected(struct ccw_device *cdev)
         rc = device_schedule_callback(cdev->dev.parent,
                                       ccw_device_remove_sch_cb);
         if (rc)
-                CIO_MSG_EVENT(2, "Couldn't unregister disconnected device "
+                CIO_MSG_EVENT(0, "Couldn't unregister disconnected device "
                               "0.%x.%04x\n",
                               cdev->private->dev_id.ssid,
                               cdev->private->dev_id.devno);
@@ -397,7 +397,7 @@ int ccw_device_set_offline(struct ccw_device *cdev)
         if (ret == 0)
                 wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev));
         else {
-                CIO_MSG_EVENT(2, "ccw_device_offline returned %d, "
+                CIO_MSG_EVENT(0, "ccw_device_offline returned %d, "
                               "device 0.%x.%04x\n",
                               ret, cdev->private->dev_id.ssid,
                               cdev->private->dev_id.devno);
@@ -433,7 +433,7 @@ int ccw_device_set_online(struct ccw_device *cdev)
         if (ret == 0)
                 wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev));
         else {
-                CIO_MSG_EVENT(2, "ccw_device_online returned %d, "
+                CIO_MSG_EVENT(0, "ccw_device_online returned %d, "
                               "device 0.%x.%04x\n",
                               ret, cdev->private->dev_id.ssid,
                               cdev->private->dev_id.devno);
@@ -451,7 +451,7 @@ int ccw_device_set_online(struct ccw_device *cdev)
         if (ret == 0)
                 wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev));
         else
-                CIO_MSG_EVENT(2, "ccw_device_offline returned %d, "
+                CIO_MSG_EVENT(0, "ccw_device_offline returned %d, "
                               "device 0.%x.%04x\n",
                               ret, cdev->private->dev_id.ssid,
                               cdev->private->dev_id.devno);
@@ -803,7 +803,7 @@ static void sch_attach_disconnected_device(struct subchannel *sch,
         other_sch = to_subchannel(get_device(cdev->dev.parent));
         ret = device_move(&cdev->dev, &sch->dev);
         if (ret) {
-                CIO_MSG_EVENT(2, "Moving disconnected device 0.%x.%04x failed "
+                CIO_MSG_EVENT(0, "Moving disconnected device 0.%x.%04x failed "
                               "(ret=%d)!\n", cdev->private->dev_id.ssid,
                               cdev->private->dev_id.devno, ret);
                 put_device(&other_sch->dev);
@@ -933,7 +933,7 @@ io_subchannel_register(struct work_struct *work)
                         ret = device_reprobe(&cdev->dev);
                         if (ret)
                                 /* We can't do much here. */
-                                CIO_MSG_EVENT(2, "device_reprobe() returned"
+                                CIO_MSG_EVENT(0, "device_reprobe() returned"
                                               " %d for 0.%x.%04x\n", ret,
                                               cdev->private->dev_id.ssid,
                                               cdev->private->dev_id.devno);
@@ -1086,7 +1086,7 @@ static void ccw_device_move_to_sch(struct work_struct *work)
         rc = device_move(&cdev->dev, &sch->dev);
         mutex_unlock(&sch->reg_mutex);
         if (rc) {
-                CIO_MSG_EVENT(2, "Moving device 0.%x.%04x to subchannel "
+                CIO_MSG_EVENT(0, "Moving device 0.%x.%04x to subchannel "
                               "0.%x.%04x failed (ret=%d)!\n",
                               cdev->private->dev_id.ssid,
                               cdev->private->dev_id.devno, sch->schid.ssid,
@@ -1446,8 +1446,7 @@ ccw_device_remove (struct device *dev)
                         wait_event(cdev->private->wait_q,
                                    dev_fsm_final_state(cdev));
                 else
-                        //FIXME: we can't fail!
-                        CIO_MSG_EVENT(2, "ccw_device_offline returned %d, "
+                        CIO_MSG_EVENT(0, "ccw_device_offline returned %d, "
                                       "device 0.%x.%04x\n",
                                       ret, cdev->private->dev_id.ssid,
                                       cdev->private->dev_id.devno);
@@ -1524,7 +1523,7 @@ static int recovery_check(struct device *dev, void *data)
         spin_lock_irq(cdev->ccwlock);
         switch (cdev->private->state) {
         case DEV_STATE_DISCONNECTED:
-                CIO_MSG_EVENT(3, "recovery: trigger 0.%x.%04x\n",
+                CIO_MSG_EVENT(4, "recovery: trigger 0.%x.%04x\n",
                               cdev->private->dev_id.ssid,
                               cdev->private->dev_id.devno);
                 dev_fsm_event(cdev, DEV_EVENT_VERIFY);
@@ -1554,7 +1553,7 @@ static void recovery_work_func(struct work_struct *unused)
                 }
                 spin_unlock_irq(&recovery_lock);
         } else
-                CIO_MSG_EVENT(2, "recovery: end\n");
+                CIO_MSG_EVENT(4, "recovery: end\n");
 }
 
 static DECLARE_WORK(recovery_work, recovery_work_func);
@@ -1572,7 +1571,7 @@ void ccw_device_schedule_recovery(void)
 {
         unsigned long flags;
 
-        CIO_MSG_EVENT(2, "recovery: schedule\n");
+        CIO_MSG_EVENT(4, "recovery: schedule\n");
         spin_lock_irqsave(&recovery_lock, flags);
         if (!timer_pending(&recovery_timer) || (recovery_phase != 0)) {
                 recovery_phase = 0;
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 99403b0a97a..e268d5a77c1 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -322,10 +322,10 @@ ccw_device_recog_done(struct ccw_device *cdev, int state)
         same_dev = 0; /* Keep the compiler quiet... */
         switch (state) {
         case DEV_STATE_NOT_OPER:
-                CIO_DEBUG(KERN_WARNING, 2,
-                          "SenseID : unknown device %04x on subchannel "
-                          "0.%x.%04x\n", cdev->private->dev_id.devno,
-                          sch->schid.ssid, sch->schid.sch_no);
+                CIO_MSG_EVENT(2, "SenseID : unknown device %04x on "
+                              "subchannel 0.%x.%04x\n",
+                              cdev->private->dev_id.devno,
+                              sch->schid.ssid, sch->schid.sch_no);
                 break;
         case DEV_STATE_OFFLINE:
                 if (cdev->private->state == DEV_STATE_DISCONNECTED_SENSE_ID) {
@@ -348,20 +348,19 @@ ccw_device_recog_done(struct ccw_device *cdev, int state)
                         return;
                 }
                 /* Issue device info message. */
-                CIO_DEBUG(KERN_INFO, 2,
-                          "SenseID : device 0.%x.%04x reports: "
-                          "CU  Type/Mod = %04X/%02X, Dev Type/Mod = "
-                          "%04X/%02X\n",
-                          cdev->private->dev_id.ssid,
-                          cdev->private->dev_id.devno,
-                          cdev->id.cu_type, cdev->id.cu_model,
-                          cdev->id.dev_type, cdev->id.dev_model);
+                CIO_MSG_EVENT(4, "SenseID : device 0.%x.%04x reports: "
+                              "CU  Type/Mod = %04X/%02X, Dev Type/Mod = "
+                              "%04X/%02X\n",
+                              cdev->private->dev_id.ssid,
+                              cdev->private->dev_id.devno,
+                              cdev->id.cu_type, cdev->id.cu_model,
+                              cdev->id.dev_type, cdev->id.dev_model);
                 break;
         case DEV_STATE_BOXED:
-                CIO_DEBUG(KERN_WARNING, 2,
-                          "SenseID : boxed device %04x on subchannel "
-                          "0.%x.%04x\n", cdev->private->dev_id.devno,
-                          sch->schid.ssid, sch->schid.sch_no);
+                CIO_MSG_EVENT(0, "SenseID : boxed device %04x on "
+                              " subchannel 0.%x.%04x\n",
+                              cdev->private->dev_id.devno,
+                              sch->schid.ssid, sch->schid.sch_no);
                 break;
         }
         cdev->private->state = state;
@@ -443,9 +442,8 @@ ccw_device_done(struct ccw_device *cdev, int state)
 
 
         if (state == DEV_STATE_BOXED)
-                CIO_DEBUG(KERN_WARNING, 2,
-                          "Boxed device %04x on subchannel %04x\n",
-                          cdev->private->dev_id.devno, sch->schid.sch_no);
+                CIO_MSG_EVENT(0, "Boxed device %04x on subchannel %04x\n",
+                              cdev->private->dev_id.devno, sch->schid.sch_no);
 
         if (cdev->private->flags.donotify) {
                 cdev->private->flags.donotify = 0;
@@ -900,7 +898,7 @@ ccw_device_w4sense(struct ccw_device *cdev, enum dev_event dev_event)
                         /* Basic sense hasn't started. Try again. */
                         ccw_device_do_sense(cdev, irb);
                 else {
-                        CIO_MSG_EVENT(2, "Huh? 0.%x.%04x: unsolicited "
+                        CIO_MSG_EVENT(0, "0.%x.%04x: unsolicited "
                                       "interrupt during w4sense...\n",
                                       cdev->private->dev_id.ssid,
                                       cdev->private->dev_id.devno);
@@ -1169,8 +1167,10 @@ ccw_device_nop(struct ccw_device *cdev, enum dev_event dev_event)
 static void
 ccw_device_bug(struct ccw_device *cdev, enum dev_event dev_event)
 {
-        CIO_MSG_EVENT(0, "dev_jumptable[%i][%i] == NULL\n",
-                      cdev->private->state, dev_event);
+        CIO_MSG_EVENT(0, "Internal state [%i][%i] not handled for device "
+                      "0.%x.%04x\n", cdev->private->state, dev_event,
+                      cdev->private->dev_id.ssid,
+                      cdev->private->dev_id.devno);
         BUG();
 }
 
diff --git a/drivers/s390/cio/device_id.c b/drivers/s390/cio/device_id.c
index dc4d87f77f6..cba7020517e 100644
--- a/drivers/s390/cio/device_id.c
+++ b/drivers/s390/cio/device_id.c
@@ -214,7 +214,7 @@ ccw_device_check_sense_id(struct ccw_device *cdev)
                  *     sense id information. So, for intervention required,
                  *     we use the "whack it until it talks" strategy...
                  */
-                CIO_MSG_EVENT(2, "SenseID : device %04x on Subchannel "
+                CIO_MSG_EVENT(0, "SenseID : device %04x on Subchannel "
                               "0.%x.%04x reports cmd reject\n",
                               cdev->private->dev_id.devno, sch->schid.ssid,
                               sch->schid.sch_no);
@@ -239,7 +239,7 @@ ccw_device_check_sense_id(struct ccw_device *cdev)
 
                 lpm = to_io_private(sch)->orb.lpm;
                 if ((lpm & sch->schib.pmcw.pim & sch->schib.pmcw.pam) != 0)
-                        CIO_MSG_EVENT(2, "SenseID : path %02X for device %04x "
+                        CIO_MSG_EVENT(4, "SenseID : path %02X for device %04x "
                                       "on subchannel 0.%x.%04x is "
                                       "'not operational'\n", lpm,
                                       cdev->private->dev_id.devno,
diff --git a/drivers/s390/cio/device_pgid.c b/drivers/s390/cio/device_pgid.c
index c52449a1f9f..ba559053402 100644
--- a/drivers/s390/cio/device_pgid.c
+++ b/drivers/s390/cio/device_pgid.c
@@ -79,7 +79,7 @@ __ccw_device_sense_pgid_start(struct ccw_device *cdev)
                         /* ret is 0, -EBUSY, -EACCES or -ENODEV */
                         if (ret != -EACCES)
                                 return ret;
-                        CIO_MSG_EVENT(2, "SNID - Device %04x on Subchannel "
+                        CIO_MSG_EVENT(3, "SNID - Device %04x on Subchannel "
                                       "0.%x.%04x, lpm %02X, became 'not "
                                       "operational'\n",
                                       cdev->private->dev_id.devno,
@@ -159,7 +159,7 @@ __ccw_device_check_sense_pgid(struct ccw_device *cdev)
                 u8 lpm;
 
                 lpm = to_io_private(sch)->orb.lpm;
-                CIO_MSG_EVENT(2, "SNID - Device %04x on Subchannel 0.%x.%04x,"
+                CIO_MSG_EVENT(3, "SNID - Device %04x on Subchannel 0.%x.%04x,"
                               " lpm %02X, became 'not operational'\n",
                               cdev->private->dev_id.devno, sch->schid.ssid,
                               sch->schid.sch_no, lpm);
@@ -275,7 +275,7 @@ __ccw_device_do_pgid(struct ccw_device *cdev, __u8 func)
                         return ret;
         }
         /* PGID command failed on this path. */
-        CIO_MSG_EVENT(2, "SPID - Device %04x on Subchannel "
+        CIO_MSG_EVENT(3, "SPID - Device %04x on Subchannel "
                       "0.%x.%04x, lpm %02X, became 'not operational'\n",
                       cdev->private->dev_id.devno, sch->schid.ssid,
                       sch->schid.sch_no, cdev->private->imask);
@@ -317,7 +317,7 @@ static int __ccw_device_do_nop(struct ccw_device *cdev)
                         return ret;
         }
         /* nop command failed on this path. */
-        CIO_MSG_EVENT(2, "NOP - Device %04x on Subchannel "
+        CIO_MSG_EVENT(3, "NOP - Device %04x on Subchannel "
                       "0.%x.%04x, lpm %02X, became 'not operational'\n",
                       cdev->private->dev_id.devno, sch->schid.ssid,
                       sch->schid.sch_no, cdev->private->imask);
@@ -362,7 +362,7 @@ __ccw_device_check_pgid(struct ccw_device *cdev)
                 return -EAGAIN;
         }
         if (irb->scsw.cc == 3) {
-                CIO_MSG_EVENT(2, "SPID - Device %04x on Subchannel 0.%x.%04x,"
+                CIO_MSG_EVENT(3, "SPID - Device %04x on Subchannel 0.%x.%04x,"
                               " lpm %02X, became 'not operational'\n",
                               cdev->private->dev_id.devno, sch->schid.ssid,
                               sch->schid.sch_no, cdev->private->imask);
@@ -391,7 +391,7 @@ static int __ccw_device_check_nop(struct ccw_device *cdev)
                 return -ETIME;
         }
         if (irb->scsw.cc == 3) {
-                CIO_MSG_EVENT(2, "NOP - Device %04x on Subchannel 0.%x.%04x,"
+                CIO_MSG_EVENT(3, "NOP - Device %04x on Subchannel 0.%x.%04x,"
                               " lpm %02X, became 'not operational'\n",
                               cdev->private->dev_id.devno, sch->schid.ssid,
                               sch->schid.sch_no, cdev->private->imask);
diff --git a/drivers/s390/s390mach.c b/drivers/s390/s390mach.c
index 4d4b54277c4..5080f343ad7 100644
--- a/drivers/s390/s390mach.c
+++ b/drivers/s390/s390mach.c
@@ -48,10 +48,11 @@ s390_collect_crw_info(void *param)
         int ccode;
         struct semaphore *sem;
         unsigned int chain;
+        int ignore;
 
         sem = (struct semaphore *)param;
 repeat:
-        down_interruptible(sem);
+        ignore = down_interruptible(sem);
         chain = 0;
         while (1) {
                 if (unlikely(chain > 1)) {
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 37b85c67b11..c8bad675dbd 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -1055,7 +1055,7 @@ static void zfcp_scsi_dbf_event(const char *tag, const char *tag2, int level,
                                 rec->scsi_result = scsi_cmnd->result;
                                 rec->scsi_cmnd = (unsigned long)scsi_cmnd;
                                 rec->scsi_serial = scsi_cmnd->serial_number;
-                                memcpy(rec->scsi_opcode, &scsi_cmnd->cmnd,
+                                memcpy(rec->scsi_opcode, scsi_cmnd->cmnd,
                                         min((int)scsi_cmnd->cmd_len,
                                                 ZFCP_DBF_SCSI_OPCODE));
                                 rec->scsi_retries = scsi_cmnd->retries;
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 9af2330f07a..b2ea4ea051f 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -4014,7 +4014,7 @@ zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *fsf_req)
                 ZFCP_LOG_TRACE("scpnt->result =0x%x, command was:\n",
                                scpnt->result);
                 ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_TRACE,
-                              (void *) &scpnt->cmnd, scpnt->cmd_len);
+                              scpnt->cmnd, scpnt->cmd_len);
 
                 ZFCP_LOG_TRACE("%i bytes sense data provided by FCP\n",
                                fcp_rsp_iu->fcp_sns_len);
diff --git a/drivers/sbus/char/bpp.c b/drivers/sbus/char/bpp.c
index 4fab0c23814..b87037ec980 100644
--- a/drivers/sbus/char/bpp.c
+++ b/drivers/sbus/char/bpp.c
@@ -41,7 +41,7 @@
 #define BPP_DELAY 100
 
 static const unsigned  BPP_MAJOR = LP_MAJOR;
-static const char* dev_name = "bpp";
+static const char *bpp_dev_name = "bpp";
 
 /* When switching from compatibility to a mode where I can read, try
    the following mode first. */
diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index f4c4fe90240..f5a9addb705 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -599,7 +599,7 @@ NCR_700_scsi_done(struct NCR_700_Host_Parameters *hostdata,
                         (struct NCR_700_command_slot *)SCp->host_scribble;
                 
                 dma_unmap_single(hostdata->dev, slot->pCmd,
-                                 sizeof(SCp->cmnd), DMA_TO_DEVICE);
+                                 MAX_COMMAND_SIZE, DMA_TO_DEVICE);
                 if (slot->flags == NCR_700_FLAG_AUTOSENSE) {
                         char *cmnd = NCR_700_get_sense_cmnd(SCp->device);
 #ifdef NCR_700_DEBUG
@@ -1004,7 +1004,7 @@ process_script_interrupt(__u32 dsps, __u32 dsp, struct scsi_cmnd *SCp,
                                  * here */
                                 NCR_700_unmap(hostdata, SCp, slot);
                                 dma_unmap_single(hostdata->dev, slot->pCmd,
-                                                 sizeof(SCp->cmnd),
+                                                 MAX_COMMAND_SIZE,
                                                  DMA_TO_DEVICE);
 
                                 cmnd[0] = REQUEST_SENSE;
@@ -1901,7 +1901,7 @@ NCR_700_queuecommand(struct scsi_cmnd *SCp, void (*done)(struct scsi_cmnd *))
         }
         slot->resume_offset = 0;
         slot->pCmd = dma_map_single(hostdata->dev, SCp->cmnd,
-                                    sizeof(SCp->cmnd), DMA_TO_DEVICE);
+                                    MAX_COMMAND_SIZE, DMA_TO_DEVICE);
         NCR_700_start_command(SCp);
         return 0;
 }
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 99c57b0c1d5..81ccbd7f9e3 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -504,10 +504,9 @@ config SCSI_AIC7XXX_OLD
 source "drivers/scsi/aic7xxx/Kconfig.aic79xx"
 source "drivers/scsi/aic94xx/Kconfig"
 
-# All the I2O code and drivers do not seem to be 64bit safe.
 config SCSI_DPT_I2O
         tristate "Adaptec I2O RAID support "
-        depends on !64BIT && SCSI && PCI && VIRT_TO_BUS
+        depends on SCSI && PCI && VIRT_TO_BUS
         help
           This driver supports all of Adaptec's I2O based RAID controllers as 
           well as the DPT SmartRaid V cards.  This is an Adaptec maintained
@@ -1680,6 +1679,7 @@ config MAC_SCSI
 config SCSI_MAC_ESP
         tristate "Macintosh NCR53c9[46] SCSI"
         depends on MAC && SCSI
+        select SCSI_SPI_ATTRS
         help
           This is the NCR 53c9x SCSI controller found on most of the 68040
           based Macintoshes.
diff --git a/drivers/scsi/a100u2w.c b/drivers/scsi/a100u2w.c
index 792b2e807bf..ced3eebe252 100644
--- a/drivers/scsi/a100u2w.c
+++ b/drivers/scsi/a100u2w.c
@@ -895,7 +895,7 @@ static void inia100_build_scb(struct orc_host * host, struct orc_scb * scb, stru
         } else {
                 scb->tag_msg = 0;       /* No tag support               */
         }
-        memcpy(&scb->cdb[0], &cmd->cmnd, scb->cdb_len);
+        memcpy(scb->cdb, cmd->cmnd, scb->cdb_len);
 }
 
 /**
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 460d4024c46..aa4e77c2527 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -498,6 +498,11 @@ static void _aac_probe_container2(void * context, struct fib * fibptr)
                     (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE) &&
                     (le32_to_cpu(dresp->mnt[0].state) != FSCS_HIDDEN)) {
                         fsa_dev_ptr->valid = 1;
+                        /* sense_key holds the current state of the spin-up */
+                        if (dresp->mnt[0].state & cpu_to_le32(FSCS_NOT_READY))
+                                fsa_dev_ptr->sense_data.sense_key = NOT_READY;
+                        else if (fsa_dev_ptr->sense_data.sense_key == NOT_READY)
+                                fsa_dev_ptr->sense_data.sense_key = NO_SENSE;
                         fsa_dev_ptr->type = le32_to_cpu(dresp->mnt[0].vol);
                         fsa_dev_ptr->size
                           = ((u64)le32_to_cpu(dresp->mnt[0].capacity)) +
@@ -1509,20 +1514,35 @@ static void io_callback(void *context, struct fib * fibptr)
         scsi_dma_unmap(scsicmd);
 
         readreply = (struct aac_read_reply *)fib_data(fibptr);
-        if (le32_to_cpu(readreply->status) == ST_OK)
-                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_GOOD;
-        else {
+        switch (le32_to_cpu(readreply->status)) {
+        case ST_OK:
+                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+                        SAM_STAT_GOOD;
+                dev->fsa_dev[cid].sense_data.sense_key = NO_SENSE;
+                break;
+        case ST_NOT_READY:
+                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+                        SAM_STAT_CHECK_CONDITION;
+                set_sense(&dev->fsa_dev[cid].sense_data, NOT_READY,
+                  SENCODE_BECOMING_READY, ASENCODE_BECOMING_READY, 0, 0);
+                memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
+                       min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data),
+                             SCSI_SENSE_BUFFERSIZE));
+                break;
+        default:
 #ifdef AAC_DETAILED_STATUS_INFO
                 printk(KERN_WARNING "io_callback: io failed, status = %d\n",
                   le32_to_cpu(readreply->status));
 #endif
-                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_CHECK_CONDITION;
+                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+                        SAM_STAT_CHECK_CONDITION;
                 set_sense(&dev->fsa_dev[cid].sense_data,
                   HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE,
                   ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0);
                 memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
                        min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data),
                              SCSI_SENSE_BUFFERSIZE));
+                break;
         }
         aac_fib_complete(fibptr);
         aac_fib_free(fibptr);
@@ -1863,6 +1883,84 @@ static int aac_synchronize(struct scsi_cmnd *scsicmd)
         return SCSI_MLQUEUE_HOST_BUSY;
 }
 
+static void aac_start_stop_callback(void *context, struct fib *fibptr)
+{
+        struct scsi_cmnd *scsicmd = context;
+
+        if (!aac_valid_context(scsicmd, fibptr))
+                return;
+
+        BUG_ON(fibptr == NULL);
+
+        scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_GOOD;
+
+        aac_fib_complete(fibptr);
+        aac_fib_free(fibptr);
+        scsicmd->scsi_done(scsicmd);
+}
+
+static int aac_start_stop(struct scsi_cmnd *scsicmd)
+{
+        int status;
+        struct fib *cmd_fibcontext;
+        struct aac_power_management *pmcmd;
+        struct scsi_device *sdev = scsicmd->device;
+        struct aac_dev *aac = (struct aac_dev *)sdev->host->hostdata;
+
+        if (!(aac->supplement_adapter_info.SupportedOptions2 &
+              AAC_OPTION_POWER_MANAGEMENT)) {
+                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+                                  SAM_STAT_GOOD;
+                scsicmd->scsi_done(scsicmd);
+                return 0;
+        }
+
+        if (aac->in_reset)
+                return SCSI_MLQUEUE_HOST_BUSY;
+
+        /*
+         *      Allocate and initialize a Fib
+         */
+        cmd_fibcontext = aac_fib_alloc(aac);
+        if (!cmd_fibcontext)
+                return SCSI_MLQUEUE_HOST_BUSY;
+
+        aac_fib_init(cmd_fibcontext);
+
+        pmcmd = fib_data(cmd_fibcontext);
+        pmcmd->command = cpu_to_le32(VM_ContainerConfig);
+        pmcmd->type = cpu_to_le32(CT_POWER_MANAGEMENT);
+        /* Eject bit ignored, not relevant */
+        pmcmd->sub = (scsicmd->cmnd[4] & 1) ?
+                cpu_to_le32(CT_PM_START_UNIT) : cpu_to_le32(CT_PM_STOP_UNIT);
+        pmcmd->cid = cpu_to_le32(sdev_id(sdev));
+        pmcmd->parm = (scsicmd->cmnd[1] & 1) ?
+                cpu_to_le32(CT_PM_UNIT_IMMEDIATE) : 0;
+
+        /*
+         *      Now send the Fib to the adapter
+         */
+        status = aac_fib_send(ContainerCommand,
+                  cmd_fibcontext,
+                  sizeof(struct aac_power_management),
+                  FsaNormal,
+                  0, 1,
+                  (fib_callback)aac_start_stop_callback,
+                  (void *)scsicmd);
+
+        /*
+         *      Check that the command queued to the controller
+         */
+        if (status == -EINPROGRESS) {
+                scsicmd->SCp.phase = AAC_OWNER_FIRMWARE;
+                return 0;
+        }
+
+        aac_fib_complete(cmd_fibcontext);
+        aac_fib_free(cmd_fibcontext);
+        return SCSI_MLQUEUE_HOST_BUSY;
+}
+
 /**
  *      aac_scsi_cmd()          -       Process SCSI command
  *      @scsicmd:               SCSI command block
@@ -1899,7 +1997,9 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
                          *      If the target container doesn't exist, it may have
                          *      been newly created
                          */
-                        if ((fsa_dev_ptr[cid].valid & 1) == 0) {
+                        if (((fsa_dev_ptr[cid].valid & 1) == 0) ||
+                          (fsa_dev_ptr[cid].sense_data.sense_key ==
+                           NOT_READY)) {
                                 switch (scsicmd->cmnd[0]) {
                                 case SERVICE_ACTION_IN:
                                         if (!(dev->raw_io_interface) ||
@@ -2091,8 +2191,8 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
                 scsi_sg_copy_from_buffer(scsicmd, cp, sizeof(cp));
                 /* Do not cache partition table for arrays */
                 scsicmd->device->removable = 1;
-
-                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_GOOD;
+                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+                  SAM_STAT_GOOD;
                 scsicmd->scsi_done(scsicmd);
 
                 return 0;
@@ -2187,15 +2287,32 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
          *      These commands are all No-Ops
          */
         case TEST_UNIT_READY:
+                if (fsa_dev_ptr[cid].sense_data.sense_key == NOT_READY) {
+                        scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+                                SAM_STAT_CHECK_CONDITION;
+                        set_sense(&dev->fsa_dev[cid].sense_data,
+                                  NOT_READY, SENCODE_BECOMING_READY,
+                                  ASENCODE_BECOMING_READY, 0, 0);
+                        memcpy(scsicmd->sense_buffer,
+                               &dev->fsa_dev[cid].sense_data,
+                               min_t(size_t,
+                                     sizeof(dev->fsa_dev[cid].sense_data),
+                                     SCSI_SENSE_BUFFERSIZE));
+                        scsicmd->scsi_done(scsicmd);
+                        return 0;
+                }
+                /* FALLTHRU */
         case RESERVE:
         case RELEASE:
         case REZERO_UNIT:
         case REASSIGN_BLOCKS:
         case SEEK_10:
-        case START_STOP:
                 scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_GOOD;
                 scsicmd->scsi_done(scsicmd);
                 return 0;
+
+        case START_STOP:
+                return aac_start_stop(scsicmd);
         }
 
         switch (scsicmd->cmnd[0])
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 113ca9c8934..73916adb8f8 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -12,7 +12,7 @@
  *----------------------------------------------------------------------------*/
 
 #ifndef AAC_DRIVER_BUILD
-# define AAC_DRIVER_BUILD 2455
+# define AAC_DRIVER_BUILD 2456
 # define AAC_DRIVER_BRANCH "-ms"
 #endif
 #define MAXIMUM_NUM_CONTAINERS  32
@@ -34,8 +34,8 @@
 #define CONTAINER_TO_ID(cont)           (cont)
 #define CONTAINER_TO_LUN(cont)          (0)
 
-#define aac_phys_to_logical(x)  (x+1)
-#define aac_logical_to_phys(x)  (x?x-1:0)
+#define aac_phys_to_logical(x)  ((x)+1)
+#define aac_logical_to_phys(x)  ((x)?(x)-1:0)
 
 /* #define AAC_DETAILED_STATUS_INFO */
 
@@ -424,6 +424,8 @@ struct aac_init
          */
         __le32  InitFlags;      /* flags for supported features */
 #define INITFLAGS_NEW_COMM_SUPPORTED    0x00000001
+#define INITFLAGS_DRIVER_USES_UTC_TIME  0x00000010
+#define INITFLAGS_DRIVER_SUPPORTS_PM    0x00000020
         __le32  MaxIoCommands;  /* max outstanding commands */
         __le32  MaxIoSize;      /* largest I/O command */
         __le32  MaxFibSize;     /* largest FIB to adapter */
@@ -867,8 +869,10 @@ struct aac_supplement_adapter_info
 };
 #define AAC_FEATURE_FALCON      cpu_to_le32(0x00000010)
 #define AAC_FEATURE_JBOD        cpu_to_le32(0x08000000)
-#define AAC_OPTION_MU_RESET     cpu_to_le32(0x00000001)
-#define AAC_OPTION_IGNORE_RESET cpu_to_le32(0x00000002)
+/* SupportedOptions2 */
+#define AAC_OPTION_MU_RESET             cpu_to_le32(0x00000001)
+#define AAC_OPTION_IGNORE_RESET         cpu_to_le32(0x00000002)
+#define AAC_OPTION_POWER_MANAGEMENT     cpu_to_le32(0x00000004)
 #define AAC_SIS_VERSION_V3      3
 #define AAC_SIS_SLOT_UNKNOWN    0xFF
 
@@ -1148,6 +1152,7 @@ struct aac_dev
 #define         ST_DQUOT        69
 #define         ST_STALE        70
 #define         ST_REMOTE       71
+#define         ST_NOT_READY    72
 #define         ST_BADHANDLE    10001
 #define         ST_NOT_SYNC     10002
 #define         ST_BAD_COOKIE   10003
@@ -1269,6 +1274,18 @@ struct aac_synchronize_reply {
         u8              data[16];
 };
 
+#define CT_POWER_MANAGEMENT     245
+#define CT_PM_START_UNIT        2
+#define CT_PM_STOP_UNIT         3
+#define CT_PM_UNIT_IMMEDIATE    1
+struct aac_power_management {
+        __le32          command;        /* VM_ContainerConfig */
+        __le32          type;           /* CT_POWER_MANAGEMENT */
+        __le32          sub;            /* CT_PM_* */
+        __le32          cid;
+        __le32          parm;           /* CT_PM_sub_* */
+};
+
 #define CT_PAUSE_IO    65
 #define CT_RELEASE_IO  66
 struct aac_pause {
@@ -1536,6 +1553,7 @@ struct aac_mntent {
 #define FSCS_NOTCLEAN   0x0001  /* fsck is necessary before mounting */
 #define FSCS_READONLY   0x0002  /* possible result of broken mirror */
 #define FSCS_HIDDEN     0x0004  /* should be ignored - set during a clear */
+#define FSCS_NOT_READY  0x0008  /* Array spinning up to fulfil request */
 
 struct aac_query_mount {
         __le32          command;
diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
index 294a802450b..cbac0635510 100644
--- a/drivers/scsi/aacraid/comminit.c
+++ b/drivers/scsi/aacraid/comminit.c
@@ -97,6 +97,8 @@ static int aac_alloc_comm(struct aac_dev *dev, void **commaddr, unsigned long co
                 init->InitFlags = cpu_to_le32(INITFLAGS_NEW_COMM_SUPPORTED);
                 dprintk((KERN_WARNING"aacraid: New Comm Interface enabled\n"));
         }
+        init->InitFlags |= cpu_to_le32(INITFLAGS_DRIVER_USES_UTC_TIME |
+                                       INITFLAGS_DRIVER_SUPPORTS_PM);
         init->MaxIoCommands = cpu_to_le32(dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB);
         init->MaxIoSize = cpu_to_le32(dev->scsi_host_ptr->max_sectors << 9);
         init->MaxFibSize = cpu_to_le32(dev->max_fib_size);
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index ef67816a6fe..289304aab69 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -515,7 +515,7 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
                                 }
                                 udelay(5);
                         }
-                } else if (down_interruptible(&fibptr->event_wait) == 0) {
+                } else if (down_interruptible(&fibptr->event_wait)) {
                         fibptr->done = 2;
                         up(&fibptr->event_wait);
                 }
@@ -906,15 +906,22 @@ static void aac_handle_aif(struct aac_dev * dev, struct fib * fibptr)
                 case AifEnAddJBOD:
                 case AifEnDeleteJBOD:
                         container = le32_to_cpu(((__le32 *)aifcmd->data)[1]);
-                        if ((container >> 28))
+                        if ((container >> 28)) {
+                                container = (u32)-1;
                                 break;
+                        }
                         channel = (container >> 24) & 0xF;
-                        if (channel >= dev->maximum_num_channels)
+                        if (channel >= dev->maximum_num_channels) {
+                                container = (u32)-1;
                                 break;
+                        }
                         id = container & 0xFFFF;
-                        if (id >= dev->maximum_num_physicals)
+                        if (id >= dev->maximum_num_physicals) {
+                                container = (u32)-1;
                                 break;
+                        }
                         lun = (container >> 16) & 0xFF;
+                        container = (u32)-1;
                         channel = aac_phys_to_logical(channel);
                         device_config_needed =
                           (((__le32 *)aifcmd->data)[0] ==
@@ -933,13 +940,18 @@ static void aac_handle_aif(struct aac_dev * dev, struct fib * fibptr)
                         case EM_DRIVE_REMOVAL:
                                 container = le32_to_cpu(
                                         ((__le32 *)aifcmd->data)[2]);
-                                if ((container >> 28))
+                                if ((container >> 28)) {
+                                        container = (u32)-1;
                                         break;
+                                }
                                 channel = (container >> 24) & 0xF;
-                                if (channel >= dev->maximum_num_channels)
+                                if (channel >= dev->maximum_num_channels) {
+                                        container = (u32)-1;
                                         break;
+                                }
                                 id = container & 0xFFFF;
                                 lun = (container >> 16) & 0xFF;
+                                container = (u32)-1;
                                 if (id >= dev->maximum_num_physicals) {
                                         /* legacy dev_t ? */
                                         if ((0x2000 <= id) || lun || channel ||
@@ -1025,9 +1037,10 @@ static void aac_handle_aif(struct aac_dev * dev, struct fib * fibptr)
                 break;
         }
 
+        container = 0;
+retry_next:
         if (device_config_needed == NOTHING)
-        for (container = 0; container < dev->maximum_num_containers;
-            ++container) {
+        for (; container < dev->maximum_num_containers; ++container) {
                 if ((dev->fsa_dev[container].config_waiting_on == 0) &&
                         (dev->fsa_dev[container].config_needed != NOTHING) &&
                         time_before(jiffies, dev->fsa_dev[container].config_waiting_stamp + AIF_SNIFF_TIMEOUT)) {
@@ -1110,6 +1123,11 @@ static void aac_handle_aif(struct aac_dev * dev, struct fib * fibptr)
         }
         if (device_config_needed == ADD)
                 scsi_add_device(dev->scsi_host_ptr, channel, id, lun);
+        if (channel == CONTAINER_CHANNEL) {
+                container++;
+                device_config_needed = NOTHING;
+                goto retry_next;
+        }
 }
 
 static int _aac_reset_adapter(struct aac_dev *aac, int forced)
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index c109f63f827..1f7c83607f8 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -401,6 +401,8 @@ static int aac_biosparm(struct scsi_device *sdev, struct block_device *bdev,
 static int aac_slave_configure(struct scsi_device *sdev)
 {
         struct aac_dev *aac = (struct aac_dev *)sdev->host->hostdata;
+        if (aac->jbod && (sdev->type == TYPE_DISK))
+                sdev->removable = 1;
         if ((sdev->type == TYPE_DISK) &&
                         (sdev_channel(sdev) != CONTAINER_CHANNEL) &&
                         (!aac->jbod || sdev->inq_periph_qual) &&
@@ -809,6 +811,12 @@ static ssize_t aac_show_flags(struct device *cdev,
                                 "SAI_READ_CAPACITY_16\n");
         if (dev->jbod)
                 len += snprintf(buf + len, PAGE_SIZE - len, "SUPPORTED_JBOD\n");
+        if (dev->supplement_adapter_info.SupportedOptions2 &
+                AAC_OPTION_POWER_MANAGEMENT)
+                len += snprintf(buf + len, PAGE_SIZE - len,
+                                "SUPPORTED_POWER_MANAGEMENT\n");
+        if (dev->msi)
+                len += snprintf(buf + len, PAGE_SIZE - len, "PCI_HAS_MSI\n");
         return len;
 }
 
@@ -1106,7 +1114,7 @@ static int __devinit aac_probe_one(struct pci_dev *pdev,
         aac->pdev = pdev;
         aac->name = aac_driver_template.name;
         aac->id = shost->unique_id;
-        aac->cardtype =  index;
+        aac->cardtype = index;
         INIT_LIST_HEAD(&aac->entry);
 
         aac->fibs = kmalloc(sizeof(struct fib) * (shost->can_queue + AAC_NUM_MGT_FIB), GFP_KERNEL);
@@ -1146,19 +1154,19 @@ static int __devinit aac_probe_one(struct pci_dev *pdev,
                 goto out_deinit;
 
         /*
-         * Lets override negotiations and drop the maximum SG limit to 34
-         */
+         * Lets override negotiations and drop the maximum SG limit to 34
+         */
         if ((aac_drivers[index].quirks & AAC_QUIRK_34SG) &&
                         (shost->sg_tablesize > 34)) {
                 shost->sg_tablesize = 34;
                 shost->max_sectors = (shost->sg_tablesize * 8) + 112;
-        }
+        }
 
-        if ((aac_drivers[index].quirks & AAC_QUIRK_17SG) &&
+        if ((aac_drivers[index].quirks & AAC_QUIRK_17SG) &&
                         (shost->sg_tablesize > 17)) {
                 shost->sg_tablesize = 17;
                 shost->max_sectors = (shost->sg_tablesize * 8) + 112;
-        }
+        }
 
         error = pci_set_dma_max_seg_size(pdev,
                 (aac->adapter_info.options & AAC_OPT_NEW_COMM) ?
@@ -1174,7 +1182,7 @@ static int __devinit aac_probe_one(struct pci_dev *pdev,
         else
                 aac->printf_enabled = 0;
 
-        /*
+        /*
          * max channel will be the physical channels plus 1 virtual channel
          * all containers are on the virtual channel 0 (CONTAINER_CHANNEL)
          * physical channels are address by their actual physical number+1
diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
index f5215fd4b73..1dca1775f4b 100644
--- a/drivers/scsi/aha152x.c
+++ b/drivers/scsi/aha152x.c
@@ -3830,7 +3830,7 @@ static int __init aha152x_init(void)
                         iounmap(p);
                 }
                 if (!ok && setup_count == 0)
-                        return 0;
+                        return -ENODEV;
 
                 printk(KERN_INFO "aha152x: BIOS test: passed, ");
 #else
@@ -3909,14 +3909,14 @@ static int __init aha152x_init(void)
 #endif
         }
 
-        return 1;
+        return 0;
 }
 
 static void __exit aha152x_exit(void)
 {
-        struct aha152x_hostdata *hd;
+        struct aha152x_hostdata *hd, *tmp;
 
-        list_for_each_entry(hd, &aha152x_host_list, host_list) {
+        list_for_each_entry_safe(hd, tmp, &aha152x_host_list, host_list) {
                 struct Scsi_Host *shost = container_of((void *)hd, struct Scsi_Host, hostdata);
 
                 aha152x_release(shost);
diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index 90f5e0a6f2e..2a730c470f6 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -529,10 +529,10 @@ static void asd_remove_dev_attrs(struct asd_ha_struct *asd_ha)
 /* The first entry, 0, is used for dynamic ids, the rest for devices
  * we know about.
  */
-static struct asd_pcidev_struct {
+static const struct asd_pcidev_struct {
         const char * name;
         int (*setup)(struct asd_ha_struct *asd_ha);
-} asd_pcidev_data[] = {
+} asd_pcidev_data[] __devinitconst = {
         /* Id 0 is used for dynamic ids. */
         { .name  = "Adaptec AIC-94xx SAS/SATA Host Adapter",
           .setup = asd_aic9410_setup
@@ -735,7 +735,7 @@ static int asd_unregister_sas_ha(struct asd_ha_struct *asd_ha)
 static int __devinit asd_pci_probe(struct pci_dev *dev,
                                    const struct pci_device_id *id)
 {
-        struct asd_pcidev_struct *asd_dev;
+        const struct asd_pcidev_struct *asd_dev;
         unsigned asd_id = (unsigned) id->driver_data;
         struct asd_ha_struct *asd_ha;
         struct Scsi_Host *shost;
diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index 403a7f2d8f9..9785d738419 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -28,7 +28,6 @@
 #define SERVICE_ACTION_OUT_12 0xa9
 #define SERVICE_ACTION_IN_16 0x9e
 #define SERVICE_ACTION_OUT_16 0x9f
-#define VARIABLE_LENGTH_CMD 0x7f
 
 
 
@@ -210,7 +209,7 @@ static void print_opcode_name(unsigned char * cdbp, int cdb_len)
         cdb0 = cdbp[0];
         switch(cdb0) {
         case VARIABLE_LENGTH_CMD:
-                len = cdbp[7] + 8;
+                len = scsi_varlen_cdb_length(cdbp);
                 if (len < 10) {
                         printk("short variable length command, "
                                "len=%d ext_len=%d", len, cdb_len);
@@ -300,7 +299,7 @@ static void print_opcode_name(unsigned char * cdbp, int cdb_len)
         cdb0 = cdbp[0];
         switch(cdb0) {
         case VARIABLE_LENGTH_CMD:
-                len = cdbp[7] + 8;
+                len = scsi_varlen_cdb_length(cdbp);
                 if (len < 10) {
                         printk("short opcode=0x%x command, len=%d "
                                "ext_len=%d", cdb0, len, cdb_len);
@@ -335,10 +334,7 @@ void __scsi_print_command(unsigned char *cdb)
         int k, len;
 
         print_opcode_name(cdb, 0);
-        if (VARIABLE_LENGTH_CMD == cdb[0])
-                len = cdb[7] + 8;
-        else
-                len = COMMAND_SIZE(cdb[0]);
+        len = scsi_command_size(cdb);
         /* print out all bytes in cdb */
         for (k = 0; k < len; ++k) 
                 printk(" %02x", cdb[k]);
diff --git a/drivers/scsi/dpt/dpti_ioctl.h b/drivers/scsi/dpt/dpti_ioctl.h
index cc784e8f6e9..f60236721e0 100644
--- a/drivers/scsi/dpt/dpti_ioctl.h
+++ b/drivers/scsi/dpt/dpti_ioctl.h
@@ -89,7 +89,7 @@ typedef struct {
         int      njobs;            /* # of jobs sent to HA            */
         int      qdepth;           /* Controller queue depth.         */
         int      wakebase;         /* mpx wakeup base index.          */
-        uLONG    SGsize;           /* Scatter/Gather list size.       */
+        uINT     SGsize;           /* Scatter/Gather list size.       */
         unsigned heads;            /* heads for drives on cntlr.      */
         unsigned sectors;          /* sectors for drives on cntlr.    */
         uCHAR    do_drive32;       /* Flag for Above 16 MB Ability    */
@@ -97,8 +97,8 @@ typedef struct {
         char     idPAL[4];         /* 4 Bytes Of The ID Pal           */
         uCHAR    primary;          /* 1 For Primary, 0 For Secondary  */
         uCHAR    eataVersion;      /* EATA Version                    */
-        uLONG    cpLength;         /* EATA Command Packet Length      */
-        uLONG    spLength;         /* EATA Status Packet Length       */
+        uINT     cpLength;         /* EATA Command Packet Length      */
+        uINT     spLength;         /* EATA Status Packet Length       */
         uCHAR    drqNum;           /* DRQ Index (0,5,6,7)             */
         uCHAR    flag1;            /* EATA Flags 1 (Byte 9)           */
         uCHAR    flag2;            /* EATA Flags 2 (Byte 30)          */
@@ -107,23 +107,23 @@ typedef struct {
 typedef struct {
         uSHORT length;          // Remaining length of this
         uSHORT drvrHBAnum;      // Relative HBA # used by the driver
-        uLONG baseAddr;         // Base I/O address
+        uINT baseAddr;          // Base I/O address
         uSHORT blinkState;      // Blink LED state (0=Not in blink LED)
         uCHAR pciBusNum;        // PCI Bus # (Optional)
         uCHAR pciDeviceNum;     // PCI Device # (Optional)
         uSHORT hbaFlags;        // Miscellaneous HBA flags
         uSHORT Interrupt;       // Interrupt set for this device.
 #   if (defined(_DPT_ARC))
-        uLONG baseLength;
+        uINT baseLength;
         ADAPTER_OBJECT *AdapterObject;
         LARGE_INTEGER DmaLogicalAddress;
         PVOID DmaVirtualAddress;
         LARGE_INTEGER ReplyLogicalAddress;
         PVOID ReplyVirtualAddress;
 #   else
-        uLONG reserved1;        // Reserved for future expansion
-        uLONG reserved2;        // Reserved for future expansion
-        uLONG reserved3;        // Reserved for future expansion
+        uINT reserved1;         // Reserved for future expansion
+        uINT reserved2;         // Reserved for future expansion
+        uINT reserved3;         // Reserved for future expansion
 #   endif
 } drvrHBAinfo_S;
 
diff --git a/drivers/scsi/dpt/dptsig.h b/drivers/scsi/dpt/dptsig.h
index 94bc894d120..72c8992fdf2 100644
--- a/drivers/scsi/dpt/dptsig.h
+++ b/drivers/scsi/dpt/dptsig.h
@@ -33,11 +33,7 @@
 /* to make sure we are talking the same size under all OS's     */
 typedef unsigned char sigBYTE;
 typedef unsigned short sigWORD;
-#if (defined(_MULTI_DATAMODEL) && defined(sun) && !defined(_ILP32))
-typedef uint32_t sigLONG;
-#else
-typedef unsigned long sigLONG;
-#endif
+typedef unsigned int sigINT;
 
 /*
  * use sigWORDLittleEndian for:
@@ -300,7 +296,7 @@ typedef struct dpt_sig {
     sigBYTE dsFiletype;          /* type of file */
     sigBYTE dsFiletypeFlags;     /* flags to specify load type, etc. */
     sigBYTE dsOEM;               /* OEM file was created for */
-    sigLONG dsOS;                /* which Operating systems */
+    sigINT  dsOS;                /* which Operating systems */
     sigWORD dsCapabilities;      /* RAID levels, etc. */
     sigWORD dsDeviceSupp;        /* Types of SCSI devices supported */
     sigWORD dsAdapterSupp;       /* DPT adapter families supported */
diff --git a/drivers/scsi/dpt/sys_info.h b/drivers/scsi/dpt/sys_info.h
index d23b70c8c76..a90c4cb8ea8 100644
--- a/drivers/scsi/dpt/sys_info.h
+++ b/drivers/scsi/dpt/sys_info.h
@@ -145,8 +145,8 @@
    uCHAR        smartROMRevision;
    uSHORT       flags;                  /* See bit definitions above */
    uSHORT       conventionalMemSize;    /* in KB */
-   uLONG        extendedMemSize;        /* in KB */
-   uLONG        osType;                 /* Same as DPTSIG's definition */
+   uINT         extendedMemSize;        /* in KB */
+   uINT         osType;                 /* Same as DPTSIG's definition */
    uCHAR        osMajorVersion;
    uCHAR        osMinorVersion;         /* The OS version */
    uCHAR        osRevision;
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index ac92ac143b4..8508816f303 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -29,11 +29,6 @@
 /*#define DEBUG 1 */
 /*#define UARTDELAY 1 */
 
-/* On the real kernel ADDR32 should always be zero for 2.4. GFP_HIGH allocates
-   high pages. Keep the macro around because of the broken unmerged ia64 tree */
-
-#define ADDR32 (0)
-
 #include <linux/module.h>
 
 MODULE_AUTHOR("Deanna Bonds, with _lots_ of help from Mark Salyzyn");
@@ -108,27 +103,28 @@ static dpt_sig_S DPTI_sig = {
 
 static DEFINE_MUTEX(adpt_configuration_lock);
 
-static struct i2o_sys_tbl *sys_tbl = NULL;
-static int sys_tbl_ind = 0;
-static int sys_tbl_len = 0;
+static struct i2o_sys_tbl *sys_tbl;
+static dma_addr_t sys_tbl_pa;
+static int sys_tbl_ind;
+static int sys_tbl_len;
 
 static adpt_hba* hba_chain = NULL;
 static int hba_count = 0;
 
+static struct class *adpt_sysfs_class;
+
+#ifdef CONFIG_COMPAT
+static long compat_adpt_ioctl(struct file *, unsigned int, unsigned long);
+#endif
+
 static const struct file_operations adpt_fops = {
         .ioctl          = adpt_ioctl,
         .open           = adpt_open,
-        .release        = adpt_close
-};
-
-#ifdef REBOOT_NOTIFIER
-static struct notifier_block adpt_reboot_notifier =
-{
-         adpt_reboot_event,
-         NULL,
-         0
-};
+        .release        = adpt_close,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = compat_adpt_ioctl,
 #endif
+};
 
 /* Structures and definitions for synchronous message posting.
  * See adpt_i2o_post_wait() for description
@@ -151,6 +147,21 @@ static DEFINE_SPINLOCK(adpt_post_wait_lock);
  *============================================================================
  */
 
+static inline int dpt_dma64(adpt_hba *pHba)
+{
+        return (sizeof(dma_addr_t) > 4 && (pHba)->dma64);
+}
+
+static inline u32 dma_high(dma_addr_t addr)
+{
+        return upper_32_bits(addr);
+}
+
+static inline u32 dma_low(dma_addr_t addr)
+{
+        return (u32)addr;
+}
+
 static u8 adpt_read_blink_led(adpt_hba* host)
 {
         if (host->FwDebugBLEDflag_P) {
@@ -178,8 +189,6 @@ static int adpt_detect(struct scsi_host_template* sht)
         struct pci_dev *pDev = NULL;
         adpt_hba* pHba;
 
-        adpt_init();
-
         PINFO("Detecting Adaptec I2O RAID controllers...\n");
 
         /* search for all Adatpec I2O RAID cards */
@@ -247,13 +256,29 @@ rebuild_sys_tab:
                 adpt_inquiry(pHba);
         }
 
+        adpt_sysfs_class = class_create(THIS_MODULE, "dpt_i2o");
+        if (IS_ERR(adpt_sysfs_class)) {
+                printk(KERN_WARNING"dpti: unable to create dpt_i2o class\n");
+                adpt_sysfs_class = NULL;
+        }
+
         for (pHba = hba_chain; pHba; pHba = pHba->next) {
-                if( adpt_scsi_register(pHba,sht) < 0){
+                if (adpt_scsi_host_alloc(pHba, sht) < 0){
                         adpt_i2o_delete_hba(pHba);
                         continue;
                 }
                 pHba->initialized = TRUE;
                 pHba->state &= ~DPTI_STATE_RESET;
+                if (adpt_sysfs_class) {
+                        struct device *dev = device_create(adpt_sysfs_class,
+                                NULL, MKDEV(DPTI_I2O_MAJOR, pHba->unit),
+                                "dpti%d", pHba->unit);
+                        if (IS_ERR(dev)) {
+                                printk(KERN_WARNING"dpti%d: unable to "
+                                        "create device in dpt_i2o class\n",
+                                        pHba->unit);
+                        }
+                }
         }
 
         // Register our control device node
@@ -282,7 +307,7 @@ static int adpt_release(struct Scsi_Host *host)
 
 static void adpt_inquiry(adpt_hba* pHba)
 {
-        u32 msg[14]; 
+        u32 msg[17]; 
         u32 *mptr;
         u32 *lenptr;
         int direction;
@@ -290,11 +315,12 @@ static void adpt_inquiry(adpt_hba* pHba)
         u32 len;
         u32 reqlen;
         u8* buf;
+        dma_addr_t addr;
         u8  scb[16];
         s32 rcode;
 
         memset(msg, 0, sizeof(msg));
-        buf = kmalloc(80,GFP_KERNEL|ADDR32);
+        buf = dma_alloc_coherent(&pHba->pDev->dev, 80, &addr, GFP_KERNEL);
         if(!buf){
                 printk(KERN_ERR"%s: Could not allocate buffer\n",pHba->name);
                 return;
@@ -305,7 +331,10 @@ static void adpt_inquiry(adpt_hba* pHba)
         direction = 0x00000000; 
         scsidir  =0x40000000;   // DATA IN  (iop<--dev)
 
-        reqlen = 14;            // SINGLE SGE
+        if (dpt_dma64(pHba))
+                reqlen = 17;            // SINGLE SGE, 64 bit
+        else
+                reqlen = 14;            // SINGLE SGE, 32 bit
         /* Stick the headers on */
         msg[0] = reqlen<<16 | SGL_OFFSET_12;
         msg[1] = (0xff<<24|HOST_TID<<12|ADAPTER_TID);
@@ -338,8 +367,16 @@ static void adpt_inquiry(adpt_hba* pHba)
 
         /* Now fill in the SGList and command */
         *lenptr = len;
-        *mptr++ = 0xD0000000|direction|len;
-        *mptr++ = virt_to_bus(buf);
+        if (dpt_dma64(pHba)) {
+                *mptr++ = (0x7C<<24)+(2<<16)+0x02; /* Enable 64 bit */
+                *mptr++ = 1 << PAGE_SHIFT;
+                *mptr++ = 0xD0000000|direction|len;
+                *mptr++ = dma_low(addr);
+                *mptr++ = dma_high(addr);
+        } else {
+                *mptr++ = 0xD0000000|direction|len;
+                *mptr++ = addr;
+        }
 
         // Send it on it's way
         rcode = adpt_i2o_post_wait(pHba, msg, reqlen<<2, 120);
@@ -347,7 +384,7 @@ static void adpt_inquiry(adpt_hba* pHba)
                 sprintf(pHba->detail, "Adaptec I2O RAID");
                 printk(KERN_INFO "%s: Inquiry Error (%d)\n",pHba->name,rcode);
                 if (rcode != -ETIME && rcode != -EINTR)
-                        kfree(buf);
+                        dma_free_coherent(&pHba->pDev->dev, 80, buf, addr);
         } else {
                 memset(pHba->detail, 0, sizeof(pHba->detail));
                 memcpy(&(pHba->detail), "Vendor: Adaptec ", 16);
@@ -356,7 +393,7 @@ static void adpt_inquiry(adpt_hba* pHba)
                 memcpy(&(pHba->detail[40]), " FW: ", 4);
                 memcpy(&(pHba->detail[44]), (u8*) &buf[32], 4);
                 pHba->detail[48] = '\0';        /* precautionary */
-                kfree(buf);
+                dma_free_coherent(&pHba->pDev->dev, 80, buf, addr);
         }
         adpt_i2o_status_get(pHba);
         return ;
@@ -632,6 +669,91 @@ stop_output:
         return len;
 }
 
+/*
+ *      Turn a struct scsi_cmnd * into a unique 32 bit 'context'.
+ */
+static u32 adpt_cmd_to_context(struct scsi_cmnd *cmd)
+{
+        return (u32)cmd->serial_number;
+}
+
+/*
+ *      Go from a u32 'context' to a struct scsi_cmnd * .
+ *      This could probably be made more efficient.
+ */
+static struct scsi_cmnd *
+        adpt_cmd_from_context(adpt_hba * pHba, u32 context)
+{
+        struct scsi_cmnd * cmd;
+        struct scsi_device * d;
+
+        if (context == 0)
+                return NULL;
+
+        spin_unlock(pHba->host->host_lock);
+        shost_for_each_device(d, pHba->host) {
+                unsigned long flags;
+                spin_lock_irqsave(&d->list_lock, flags);
+                list_for_each_entry(cmd, &d->cmd_list, list) {
+                        if (((u32)cmd->serial_number == context)) {
+                                spin_unlock_irqrestore(&d->list_lock, flags);
+                                scsi_device_put(d);
+                                spin_lock(pHba->host->host_lock);
+                                return cmd;
+                        }
+                }
+                spin_unlock_irqrestore(&d->list_lock, flags);
+        }
+        spin_lock(pHba->host->host_lock);
+
+        return NULL;
+}
+
+/*
+ *      Turn a pointer to ioctl reply data into an u32 'context'
+ */
+static u32 adpt_ioctl_to_context(adpt_hba * pHba, void *reply)
+{
+#if BITS_PER_LONG == 32
+        return (u32)(unsigned long)reply;
+#else
+        ulong flags = 0;
+        u32 nr, i;
+
+        spin_lock_irqsave(pHba->host->host_lock, flags);
+        nr = ARRAY_SIZE(pHba->ioctl_reply_context);
+        for (i = 0; i < nr; i++) {
+                if (pHba->ioctl_reply_context[i] == NULL) {
+                        pHba->ioctl_reply_context[i] = reply;
+                        break;
+                }
+        }
+        spin_unlock_irqrestore(pHba->host->host_lock, flags);
+        if (i >= nr) {
+                kfree (reply);
+                printk(KERN_WARNING"%s: Too many outstanding "
+                                "ioctl commands\n", pHba->name);
+                return (u32)-1;
+        }
+
+        return i;
+#endif
+}
+
+/*
+ *      Go from an u32 'context' to a pointer to ioctl reply data.
+ */
+static void *adpt_ioctl_from_context(adpt_hba *pHba, u32 context)
+{
+#if BITS_PER_LONG == 32
+        return (void *)(unsigned long)context;
+#else
+        void *p = pHba->ioctl_reply_context[context];
+        pHba->ioctl_reply_context[context] = NULL;
+
+        return p;
+#endif
+}
 
 /*===========================================================================
  * Error Handling routines
@@ -660,7 +782,7 @@ static int adpt_abort(struct scsi_cmnd * cmd)
         msg[1] = I2O_CMD_SCSI_ABORT<<24|HOST_TID<<12|dptdevice->tid;
         msg[2] = 0;
         msg[3]= 0; 
-        msg[4] = (u32)cmd;
+        msg[4] = adpt_cmd_to_context(cmd);
         if (pHba->host)
                 spin_lock_irq(pHba->host->host_lock);
         rcode = adpt_i2o_post_wait(pHba, msg, sizeof(msg), FOREVER);
@@ -861,27 +983,6 @@ static void adpt_i2o_sys_shutdown(void)
          printk(KERN_INFO "Adaptec I2O controllers down.\n");
 }
 
-/*
- * reboot/shutdown notification.
- *
- * - Quiesce each IOP in the system
- *
- */
-
-#ifdef REBOOT_NOTIFIER
-static int adpt_reboot_event(struct notifier_block *n, ulong code, void *p)
-{
-
-         if(code != SYS_RESTART && code != SYS_HALT && code != SYS_POWER_OFF)
-                  return NOTIFY_DONE;
-
-         adpt_i2o_sys_shutdown();
-
-         return NOTIFY_DONE;
-}
-#endif
-
-
 static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev)
 {
 
@@ -893,6 +994,7 @@ static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev
         u32 hba_map1_area_size = 0;
         void __iomem *base_addr_virt = NULL;
         void __iomem *msg_addr_virt = NULL;
+        int dma64 = 0;
 
         int raptorFlag = FALSE;
 
@@ -906,9 +1008,21 @@ static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev
         }
 
         pci_set_master(pDev);
-        if (pci_set_dma_mask(pDev, DMA_32BIT_MASK))
+
+        /*
+         *      See if we should enable dma64 mode.
+         */
+        if (sizeof(dma_addr_t) > 4 &&
+            pci_set_dma_mask(pDev, DMA_64BIT_MASK) == 0) {
+                if (dma_get_required_mask(&pDev->dev) > DMA_32BIT_MASK)
+                        dma64 = 1;
+        }
+        if (!dma64 && pci_set_dma_mask(pDev, DMA_32BIT_MASK) != 0)
                 return -EINVAL;
 
+        /* adapter only supports message blocks below 4GB */
+        pci_set_consistent_dma_mask(pDev, DMA_32BIT_MASK);
+
         base_addr0_phys = pci_resource_start(pDev,0);
         hba_map0_area_size = pci_resource_len(pDev,0);
 
@@ -929,6 +1043,25 @@ static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev
                 raptorFlag = TRUE;
         }
 
+#if BITS_PER_LONG == 64
+        /*
+         *      The original Adaptec 64 bit driver has this comment here:
+         *      "x86_64 machines need more optimal mappings"
+         *
+         *      I assume some HBAs report ridiculously large mappings
+         *      and we need to limit them on platforms with IOMMUs.
+         */
+        if (raptorFlag == TRUE) {
+                if (hba_map0_area_size > 128)
+                        hba_map0_area_size = 128;
+                if (hba_map1_area_size > 524288)
+                        hba_map1_area_size = 524288;
+        } else {
+                if (hba_map0_area_size > 524288)
+                        hba_map0_area_size = 524288;
+        }
+#endif
+
         base_addr_virt = ioremap(base_addr0_phys,hba_map0_area_size);
         if (!base_addr_virt) {
                 pci_release_regions(pDev);
@@ -991,16 +1124,22 @@ static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev
         pHba->state = DPTI_STATE_RESET;
         pHba->pDev = pDev;
         pHba->devices = NULL;
+        pHba->dma64 = dma64;
 
         // Initializing the spinlocks
         spin_lock_init(&pHba->state_lock);
         spin_lock_init(&adpt_post_wait_lock);
 
         if(raptorFlag == 0){
-                printk(KERN_INFO"Adaptec I2O RAID controller %d at %p size=%x irq=%d\n", 
-                        hba_count-1, base_addr_virt, hba_map0_area_size, pDev->irq);
+                printk(KERN_INFO "Adaptec I2O RAID controller"
+                                 " %d at %p size=%x irq=%d%s\n", 
+                        hba_count-1, base_addr_virt,
+                        hba_map0_area_size, pDev->irq,
+                        dma64 ? " (64-bit DMA)" : "");
         } else {
-                printk(KERN_INFO"Adaptec I2O RAID controller %d irq=%d\n",hba_count-1, pDev->irq);
+                printk(KERN_INFO"Adaptec I2O RAID controller %d irq=%d%s\n",
+                        hba_count-1, pDev->irq,
+                        dma64 ? " (64-bit DMA)" : "");
                 printk(KERN_INFO"     BAR0 %p - size= %x\n",base_addr_virt,hba_map0_area_size);
                 printk(KERN_INFO"     BAR1 %p - size= %x\n",msg_addr_virt,hba_map1_area_size);
         }
@@ -1053,10 +1192,26 @@ static void adpt_i2o_delete_hba(adpt_hba* pHba)
         if(pHba->msg_addr_virt != pHba->base_addr_virt){
                 iounmap(pHba->msg_addr_virt);
         }
-        kfree(pHba->hrt);
-        kfree(pHba->lct);
-        kfree(pHba->status_block);
-        kfree(pHba->reply_pool);
+        if(pHba->FwDebugBuffer_P)
+                iounmap(pHba->FwDebugBuffer_P);
+        if(pHba->hrt) {
+                dma_free_coherent(&pHba->pDev->dev,
+                        pHba->hrt->num_entries * pHba->hrt->entry_len << 2,
+                        pHba->hrt, pHba->hrt_pa);
+        }
+        if(pHba->lct) {
+                dma_free_coherent(&pHba->pDev->dev, pHba->lct_size,
+                        pHba->lct, pHba->lct_pa);
+        }
+        if(pHba->status_block) {
+                dma_free_coherent(&pHba->pDev->dev, sizeof(i2o_status_block),
+                        pHba->status_block, pHba->status_block_pa);
+        }
+        if(pHba->reply_pool) {
+                dma_free_coherent(&pHba->pDev->dev,
+                        pHba->reply_fifo_size * REPLY_FRAME_SIZE * 4,
+                        pHba->reply_pool, pHba->reply_pool_pa);
+        }
 
         for(d = pHba->devices; d ; d = next){
                 next = d->next;
@@ -1075,23 +1230,19 @@ static void adpt_i2o_delete_hba(adpt_hba* pHba)
         pci_dev_put(pHba->pDev);
         kfree(pHba);
 
+        if (adpt_sysfs_class)
+                device_destroy(adpt_sysfs_class,
+                                MKDEV(DPTI_I2O_MAJOR, pHba->unit));
+
         if(hba_count <= 0){
                 unregister_chrdev(DPTI_I2O_MAJOR, DPT_DRIVER);   
+                if (adpt_sysfs_class) {
+                        class_destroy(adpt_sysfs_class);
+                        adpt_sysfs_class = NULL;
+                }
         }
 }
 
-
-static int adpt_init(void)
-{
-        printk("Loading Adaptec I2O RAID: Version " DPT_I2O_VERSION "\n");
-#ifdef REBOOT_NOTIFIER
-        register_reboot_notifier(&adpt_reboot_notifier);
-#endif
-
-        return 0;
-}
-
-
 static struct adpt_device* adpt_find_device(adpt_hba* pHba, u32 chan, u32 id, u32 lun)
 {
         struct adpt_device* d;
@@ -1283,6 +1434,7 @@ static s32 adpt_i2o_reset_hba(adpt_hba* pHba)
 {
         u32 msg[8];
         u8* status;
+        dma_addr_t addr;
         u32 m = EMPTY_QUEUE ;
         ulong timeout = jiffies + (TMOUT_IOPRESET*HZ);
 
@@ -1305,12 +1457,13 @@ static s32 adpt_i2o_reset_hba(adpt_hba* pHba)
                 schedule_timeout_uninterruptible(1);
         } while (m == EMPTY_QUEUE);
 
-        status = kzalloc(4, GFP_KERNEL|ADDR32);
+        status = dma_alloc_coherent(&pHba->pDev->dev, 4, &addr, GFP_KERNEL);
         if(status == NULL) {
                 adpt_send_nop(pHba, m);
                 printk(KERN_ERR"IOP reset failed - no free memory.\n");
                 return -ENOMEM;
         }
+        memset(status,0,4);
 
         msg[0]=EIGHT_WORD_MSG_SIZE|SGL_OFFSET_0;
         msg[1]=I2O_CMD_ADAPTER_RESET<<24|HOST_TID<<12|ADAPTER_TID;
@@ -1318,8 +1471,8 @@ static s32 adpt_i2o_reset_hba(adpt_hba* pHba)
         msg[3]=0;
         msg[4]=0;
         msg[5]=0;
-        msg[6]=virt_to_bus(status);
-        msg[7]=0;     
+        msg[6]=dma_low(addr);
+        msg[7]=dma_high(addr);
 
         memcpy_toio(pHba->msg_addr_virt+m, msg, sizeof(msg));
         wmb();
@@ -1329,7 +1482,10 @@ static s32 adpt_i2o_reset_hba(adpt_hba* pHba)
         while(*status == 0){
                 if(time_after(jiffies,timeout)){
                         printk(KERN_WARNING"%s: IOP Reset Timeout\n",pHba->name);
-                        kfree(status);
+                        /* We lose 4 bytes of "status" here, but we cannot
+                           free these because controller may awake and corrupt
+                           those bytes at any time */
+                        /* dma_free_coherent(&pHba->pDev->dev, 4, buf, addr); */
                         return -ETIMEDOUT;
                 }
                 rmb();
@@ -1348,6 +1504,10 @@ static s32 adpt_i2o_reset_hba(adpt_hba* pHba)
                         }
                         if(time_after(jiffies,timeout)){
                                 printk(KERN_ERR "%s:Timeout waiting for IOP Reset.\n",pHba->name);
+                                /* We lose 4 bytes of "status" here, but we
+                                   cannot free these because controller may
+                                   awake and corrupt those bytes at any time */
+                                /* dma_free_coherent(&pHba->pDev->dev, 4, buf, addr); */
                                 return -ETIMEDOUT;
                         }
                         schedule_timeout_uninterruptible(1);
@@ -1364,7 +1524,7 @@ static s32 adpt_i2o_reset_hba(adpt_hba* pHba)
                 PDEBUG("%s: Reset completed.\n", pHba->name);
         }
 
-        kfree(status);
+        dma_free_coherent(&pHba->pDev->dev, 4, status, addr);
 #ifdef UARTDELAY
         // This delay is to allow someone attached to the card through the debug UART to 
         // set up the dump levels that they want before the rest of the initialization sequence
@@ -1636,6 +1796,7 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
         u32 i = 0;
         u32 rcode = 0;
         void *p = NULL;
+        dma_addr_t addr;
         ulong flags = 0;
 
         memset(&msg, 0, MAX_MESSAGE_SIZE*4);
@@ -1668,10 +1829,13 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
         }
         sg_offset = (msg[0]>>4)&0xf;
         msg[2] = 0x40000000; // IOCTL context
-        msg[3] = (u32)reply;
+        msg[3] = adpt_ioctl_to_context(pHba, reply);
+        if (msg[3] == (u32)-1)
+                return -EBUSY;
+
         memset(sg_list,0, sizeof(sg_list[0])*pHba->sg_tablesize);
         if(sg_offset) {
-                // TODO 64bit fix
+                // TODO add 64 bit API
                 struct sg_simple_element *sg =  (struct sg_simple_element*) (msg+sg_offset);
                 sg_count = (size - sg_offset*4) / sizeof(struct sg_simple_element);
                 if (sg_count > pHba->sg_tablesize){
@@ -1690,7 +1854,7 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
                         }
                         sg_size = sg[i].flag_count & 0xffffff;      
                         /* Allocate memory for the transfer */
-                        p = kmalloc(sg_size, GFP_KERNEL|ADDR32);
+                        p = dma_alloc_coherent(&pHba->pDev->dev, sg_size, &addr, GFP_KERNEL);
                         if(!p) {
                                 printk(KERN_DEBUG"%s: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
                                                 pHba->name,sg_size,i,sg_count);
@@ -1700,15 +1864,15 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
                         sg_list[sg_index++] = p; // sglist indexed with input frame, not our internal frame.
                         /* Copy in the user's SG buffer if necessary */
                         if(sg[i].flag_count & 0x04000000 /*I2O_SGL_FLAGS_DIR*/) {
-                                // TODO 64bit fix
-                                if (copy_from_user(p,(void __user *)sg[i].addr_bus, sg_size)) {
+                                // sg_simple_element API is 32 bit
+                                if (copy_from_user(p,(void __user *)(ulong)sg[i].addr_bus, sg_size)) {
                                         printk(KERN_DEBUG"%s: Could not copy SG buf %d FROM user\n",pHba->name,i);
                                         rcode = -EFAULT;
                                         goto cleanup;
                                 }
                         }
-                        //TODO 64bit fix
-                        sg[i].addr_bus = (u32)virt_to_bus(p);
+                        /* sg_simple_element API is 32 bit, but addr < 4GB */
+                        sg[i].addr_bus = addr;
                 }
         }
 
@@ -1736,7 +1900,7 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
         if(sg_offset) {
         /* Copy back the Scatter Gather buffers back to user space */
                 u32 j;
-                // TODO 64bit fix
+                // TODO add 64 bit API
                 struct sg_simple_element* sg;
                 int sg_size;
 
@@ -1756,14 +1920,14 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
                 }
                 sg_count = (size - sg_offset*4) / sizeof(struct sg_simple_element);
 
-                // TODO 64bit fix
+                // TODO add 64 bit API
                 sg       = (struct sg_simple_element*)(msg + sg_offset);
                 for (j = 0; j < sg_count; j++) {
                         /* Copy out the SG list to user's buffer if necessary */
                         if(! (sg[j].flag_count & 0x4000000 /*I2O_SGL_FLAGS_DIR*/)) {
                                 sg_size = sg[j].flag_count & 0xffffff; 
-                                // TODO 64bit fix
-                                if (copy_to_user((void __user *)sg[j].addr_bus,sg_list[j], sg_size)) {
+                                // sg_simple_element API is 32 bit
+                                if (copy_to_user((void __user *)(ulong)sg[j].addr_bus,sg_list[j], sg_size)) {
                                         printk(KERN_WARNING"%s: Could not copy %p TO user %x\n",pHba->name, sg_list[j], sg[j].addr_bus);
                                         rcode = -EFAULT;
                                         goto cleanup;
@@ -1787,56 +1951,22 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
 
 
 cleanup:
-        if (rcode != -ETIME && rcode != -EINTR)
+        if (rcode != -ETIME && rcode != -EINTR) {
+                struct sg_simple_element *sg =
+                                (struct sg_simple_element*) (msg +sg_offset);
                 kfree (reply);
-        while(sg_index) {
-                if(sg_list[--sg_index]) {
-                        if (rcode != -ETIME && rcode != -EINTR)
-                                kfree(sg_list[sg_index]);
+                while(sg_index) {
+                        if(sg_list[--sg_index]) {
+                                dma_free_coherent(&pHba->pDev->dev,
+                                        sg[sg_index].flag_count & 0xffffff,
+                                        sg_list[sg_index],
+                                        sg[sg_index].addr_bus);
+                        }
                 }
         }
         return rcode;
 }
 
-
-/*
- * This routine returns information about the system.  This does not effect
- * any logic and if the info is wrong - it doesn't matter.
- */
-
-/* Get all the info we can not get from kernel services */
-static int adpt_system_info(void __user *buffer)
-{
-        sysInfo_S si;
-
-        memset(&si, 0, sizeof(si));
-
-        si.osType = OS_LINUX;
-        si.osMajorVersion = 0;
-        si.osMinorVersion = 0;
-        si.osRevision = 0;
-        si.busType = SI_PCI_BUS;
-        si.processorFamily = DPTI_sig.dsProcessorFamily;
-
-#if defined __i386__ 
-        adpt_i386_info(&si);
-#elif defined (__ia64__)
-        adpt_ia64_info(&si);
-#elif defined(__sparc__)
-        adpt_sparc_info(&si);
-#elif defined (__alpha__)
-        adpt_alpha_info(&si);
-#else
-        si.processorType = 0xff ;
-#endif
-        if(copy_to_user(buffer, &si, sizeof(si))){
-                printk(KERN_WARNING"dpti: Could not copy buffer TO user\n");
-                return -EFAULT;
-        }
-
-        return 0;
-}
-
 #if defined __ia64__ 
 static void adpt_ia64_info(sysInfo_S* si)
 {
@@ -1847,7 +1977,6 @@ static void adpt_ia64_info(sysInfo_S* si)
 }
 #endif
 
-
 #if defined __sparc__ 
 static void adpt_sparc_info(sysInfo_S* si)
 {
@@ -1857,7 +1986,6 @@ static void adpt_sparc_info(sysInfo_S* si)
         si->processorType = PROC_ULTRASPARC;
 }
 #endif
-
 #if defined __alpha__ 
 static void adpt_alpha_info(sysInfo_S* si)
 {
@@ -1869,7 +1997,6 @@ static void adpt_alpha_info(sysInfo_S* si)
 #endif
 
 #if defined __i386__
-
 static void adpt_i386_info(sysInfo_S* si)
 {
         // This is all the info we need for now
@@ -1890,9 +2017,45 @@ static void adpt_i386_info(sysInfo_S* si)
                 break;
         }
 }
+#endif
 
+/*
+ * This routine returns information about the system.  This does not effect
+ * any logic and if the info is wrong - it doesn't matter.
+ */
+
+/* Get all the info we can not get from kernel services */
+static int adpt_system_info(void __user *buffer)
+{
+        sysInfo_S si;
+
+        memset(&si, 0, sizeof(si));
+
+        si.osType = OS_LINUX;
+        si.osMajorVersion = 0;
+        si.osMinorVersion = 0;
+        si.osRevision = 0;
+        si.busType = SI_PCI_BUS;
+        si.processorFamily = DPTI_sig.dsProcessorFamily;
+
+#if defined __i386__
+        adpt_i386_info(&si);
+#elif defined (__ia64__)
+        adpt_ia64_info(&si);
+#elif defined(__sparc__)
+        adpt_sparc_info(&si);
+#elif defined (__alpha__)
+        adpt_alpha_info(&si);
+#else
+        si.processorType = 0xff ;
 #endif
+        if (copy_to_user(buffer, &si, sizeof(si))){
+                printk(KERN_WARNING"dpti: Could not copy buffer TO user\n");
+                return -EFAULT;
+        }
 
+        return 0;
+}
 
 static int adpt_ioctl(struct inode *inode, struct file *file, uint cmd,
               ulong arg)
@@ -1978,6 +2141,38 @@ static int adpt_ioctl(struct inode *inode, struct file *file, uint cmd,
         return error;
 }
 
+#ifdef CONFIG_COMPAT
+static long compat_adpt_ioctl(struct file *file,
+                                unsigned int cmd, unsigned long arg)
+{
+        struct inode *inode;
+        long ret;
+ 
+        inode = file->f_dentry->d_inode;
+ 
+        lock_kernel();
+ 
+        switch(cmd) {
+                case DPT_SIGNATURE:
+                case I2OUSRCMD:
+                case DPT_CTRLINFO:
+                case DPT_SYSINFO:
+                case DPT_BLINKLED:
+                case I2ORESETCMD:
+                case I2ORESCANCMD:
+                case (DPT_TARGET_BUSY & 0xFFFF):
+                case DPT_TARGET_BUSY:
+                        ret = adpt_ioctl(inode, file, cmd, arg);
+                        break;
+                default:
+                        ret =  -ENOIOCTLCMD;
+        }
+ 
+        unlock_kernel();
+ 
+        return ret;
+}
+#endif
 
 static irqreturn_t adpt_isr(int irq, void *dev_id)
 {
@@ -2009,7 +2204,16 @@ static irqreturn_t adpt_isr(int irq, void *dev_id)
                                 goto out;
                         }
                 }
-                reply = bus_to_virt(m);
+                if (pHba->reply_pool_pa <= m &&
+                    m < pHba->reply_pool_pa +
+                        (pHba->reply_fifo_size * REPLY_FRAME_SIZE * 4)) {
+                        reply = (u8 *)pHba->reply_pool +
+                                                (m - pHba->reply_pool_pa);
+                } else {
+                        /* Ick, we should *never* be here */
+                        printk(KERN_ERR "dpti: reply frame not from pool\n");
+                        reply = (u8 *)bus_to_virt(m);
+                }
 
                 if (readl(reply) & MSG_FAIL) {
                         u32 old_m = readl(reply+28); 
@@ -2029,7 +2233,7 @@ static irqreturn_t adpt_isr(int irq, void *dev_id)
                 } 
                 context = readl(reply+8);
                 if(context & 0x40000000){ // IOCTL
-                        void *p = (void *)readl(reply+12);
+                        void *p = adpt_ioctl_from_context(pHba, readl(reply+12));
                         if( p != NULL) {
                                 memcpy_fromio(p, reply, REPLY_FRAME_SIZE * 4);
                         }
@@ -2043,15 +2247,17 @@ static irqreturn_t adpt_isr(int irq, void *dev_id)
                                 status = I2O_POST_WAIT_OK;
                         }
                         if(!(context & 0x40000000)) {
-                                cmd = (struct scsi_cmnd*) readl(reply+12); 
+                                cmd = adpt_cmd_from_context(pHba,
+                                                        readl(reply+12));
                                 if(cmd != NULL) {
                                         printk(KERN_WARNING"%s: Apparent SCSI cmd in Post Wait Context - cmd=%p context=%x\n", pHba->name, cmd, context);
                                 }
                         }
                         adpt_i2o_post_wait_complete(context, status);
                 } else { // SCSI message
-                        cmd = (struct scsi_cmnd*) readl(reply+12); 
+                        cmd = adpt_cmd_from_context (pHba, readl(reply+12));
                         if(cmd != NULL){
+                                scsi_dma_unmap(cmd);
                                 if(cmd->serial_number != 0) { // If not timedout
                                         adpt_i2o_to_scsi(reply, cmd);
                                 }
@@ -2072,6 +2278,7 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
         int i;
         u32 msg[MAX_MESSAGE_SIZE];
         u32* mptr;
+        u32* lptr;
         u32 *lenptr;
         int direction;
         int scsidir;
@@ -2079,6 +2286,7 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
         u32 len;
         u32 reqlen;
         s32 rcode;
+        dma_addr_t addr;
 
         memset(msg, 0 , sizeof(msg));
         len = scsi_bufflen(cmd);
@@ -2118,7 +2326,7 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
         // I2O_CMD_SCSI_EXEC
         msg[1] = ((0xff<<24)|(HOST_TID<<12)|d->tid);
         msg[2] = 0;
-        msg[3] = (u32)cmd;      /* We want the SCSI control block back */
+        msg[3] = adpt_cmd_to_context(cmd);  /* Want SCSI control block back */
         // Our cards use the transaction context as the tag for queueing
         // Adaptec/DPT Private stuff 
         msg[4] = I2O_CMD_SCSI_EXEC|(DPT_ORGANIZATION_ID<<16);
@@ -2136,7 +2344,13 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
         memcpy(mptr, cmd->cmnd, cmd->cmd_len);
         mptr+=4;
         lenptr=mptr++;          /* Remember me - fill in when we know */
-        reqlen = 14;            // SINGLE SGE
+        if (dpt_dma64(pHba)) {
+                reqlen = 16;            // SINGLE SGE
+                *mptr++ = (0x7C<<24)+(2<<16)+0x02; /* Enable 64 bit */
+                *mptr++ = 1 << PAGE_SHIFT;
+        } else {
+                reqlen = 14;            // SINGLE SGE
+        }
         /* Now fill in the SGList and command */
 
         nseg = scsi_dma_map(cmd);
@@ -2146,12 +2360,16 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
 
                 len = 0;
                 scsi_for_each_sg(cmd, sg, nseg, i) {
+                        lptr = mptr;
                         *mptr++ = direction|0x10000000|sg_dma_len(sg);
                         len+=sg_dma_len(sg);
-                        *mptr++ = sg_dma_address(sg);
+                        addr = sg_dma_address(sg);
+                        *mptr++ = dma_low(addr);
+                        if (dpt_dma64(pHba))
+                                *mptr++ = dma_high(addr);
                         /* Make this an end of list */
                         if (i == nseg - 1)
-                                mptr[-2] = direction|0xD0000000|sg_dma_len(sg);
+                                *lptr = direction|0xD0000000|sg_dma_len(sg);
                 }
                 reqlen = mptr - msg;
                 *lenptr = len;
@@ -2177,13 +2395,13 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
 }
 
 
-static s32 adpt_scsi_register(adpt_hba* pHba,struct scsi_host_template * sht)
+static s32 adpt_scsi_host_alloc(adpt_hba* pHba, struct scsi_host_template *sht)
 {
-        struct Scsi_Host *host = NULL;
+        struct Scsi_Host *host;
 
-        host = scsi_register(sht, sizeof(adpt_hba*));
+        host = scsi_host_alloc(sht, sizeof(adpt_hba*));
         if (host == NULL) {
-                printk ("%s: scsi_register returned NULL\n",pHba->name);
+                printk("%s: scsi_host_alloc returned NULL\n", pHba->name);
                 return -1;
         }
         host->hostdata[0] = (unsigned long)pHba;
@@ -2200,7 +2418,7 @@ static s32 adpt_scsi_register(adpt_hba* pHba,struct scsi_host_template * sht)
         host->max_lun = 256;
         host->max_channel = pHba->top_scsi_channel + 1;
         host->cmd_per_lun = 1;
-        host->unique_id = (uint) pHba;
+        host->unique_id = (u32)sys_tbl_pa + pHba->unit;
         host->sg_tablesize = pHba->sg_tablesize;
         host->can_queue = pHba->post_fifo_size;
 
@@ -2640,11 +2858,10 @@ static s32 adpt_send_nop(adpt_hba*pHba,u32 m)
 static s32 adpt_i2o_init_outbound_q(adpt_hba* pHba)
 {
         u8 *status;
+        dma_addr_t addr;
         u32 __iomem *msg = NULL;
         int i;
         ulong timeout = jiffies + TMOUT_INITOUTBOUND*HZ;
-        u32* ptr;
-        u32 outbound_frame;  // This had to be a 32 bit address
         u32 m;
 
         do {
@@ -2663,13 +2880,14 @@ static s32 adpt_i2o_init_outbound_q(adpt_hba* pHba)
 
         msg=(u32 __iomem *)(pHba->msg_addr_virt+m);
 
-        status = kzalloc(4, GFP_KERNEL|ADDR32);
+        status = dma_alloc_coherent(&pHba->pDev->dev, 4, &addr, GFP_KERNEL);
         if (!status) {
                 adpt_send_nop(pHba, m);
                 printk(KERN_WARNING"%s: IOP reset failed - no free memory.\n",
                         pHba->name);
                 return -ENOMEM;
         }
+        memset(status, 0, 4);
 
         writel(EIGHT_WORD_MSG_SIZE| SGL_OFFSET_6, &msg[0]);
         writel(I2O_CMD_OUTBOUND_INIT<<24 | HOST_TID<<12 | ADAPTER_TID, &msg[1]);
@@ -2678,7 +2896,7 @@ static s32 adpt_i2o_init_outbound_q(adpt_hba* pHba)
         writel(4096, &msg[4]);          /* Host page frame size */
         writel((REPLY_FRAME_SIZE)<<16|0x80, &msg[5]);   /* Outbound msg frame size and Initcode */
         writel(0xD0000004, &msg[6]);            /* Simple SG LE, EOB */
-        writel(virt_to_bus(status), &msg[7]);
+        writel((u32)addr, &msg[7]);
 
         writel(m, pHba->post_port);
         wmb();
@@ -2693,6 +2911,10 @@ static s32 adpt_i2o_init_outbound_q(adpt_hba* pHba)
                 rmb();
                 if(time_after(jiffies,timeout)){
                         printk(KERN_WARNING"%s: Timeout Initializing\n",pHba->name);
+                        /* We lose 4 bytes of "status" here, but we
+                           cannot free these because controller may
+                           awake and corrupt those bytes at any time */
+                        /* dma_free_coherent(&pHba->pDev->dev, 4, status, addr); */
                         return -ETIMEDOUT;
                 }
                 schedule_timeout_uninterruptible(1);
@@ -2701,25 +2923,30 @@ static s32 adpt_i2o_init_outbound_q(adpt_hba* pHba)
         // If the command was successful, fill the fifo with our reply
         // message packets
         if(*status != 0x04 /*I2O_EXEC_OUTBOUND_INIT_COMPLETE*/) {
-                kfree(status);
+                dma_free_coherent(&pHba->pDev->dev, 4, status, addr);
                 return -2;
         }
-        kfree(status);
+        dma_free_coherent(&pHba->pDev->dev, 4, status, addr);
 
-        kfree(pHba->reply_pool);
+        if(pHba->reply_pool != NULL) {
+                dma_free_coherent(&pHba->pDev->dev,
+                        pHba->reply_fifo_size * REPLY_FRAME_SIZE * 4,
+                        pHba->reply_pool, pHba->reply_pool_pa);
+        }
 
-        pHba->reply_pool = kzalloc(pHba->reply_fifo_size * REPLY_FRAME_SIZE * 4, GFP_KERNEL|ADDR32);
+        pHba->reply_pool = dma_alloc_coherent(&pHba->pDev->dev,
+                                pHba->reply_fifo_size * REPLY_FRAME_SIZE * 4,
+                                &pHba->reply_pool_pa, GFP_KERNEL);
         if (!pHba->reply_pool) {
                 printk(KERN_ERR "%s: Could not allocate reply pool\n", pHba->name);
                 return -ENOMEM;
         }
+        memset(pHba->reply_pool, 0 , pHba->reply_fifo_size * REPLY_FRAME_SIZE * 4);
 
-        ptr = pHba->reply_pool;
         for(i = 0; i < pHba->reply_fifo_size; i++) {
-                outbound_frame = (u32)virt_to_bus(ptr);
-                writel(outbound_frame, pHba->reply_port);
+                writel(pHba->reply_pool_pa + (i * REPLY_FRAME_SIZE * 4),
+                        pHba->reply_port);
                 wmb();
-                ptr +=  REPLY_FRAME_SIZE;
         }
         adpt_i2o_status_get(pHba);
         return 0;
@@ -2743,11 +2970,11 @@ static s32 adpt_i2o_status_get(adpt_hba* pHba)
         u32 m;
         u32 __iomem *msg;
         u8 *status_block=NULL;
-        ulong status_block_bus;
 
         if(pHba->status_block == NULL) {
-                pHba->status_block = (i2o_status_block*)
-                        kmalloc(sizeof(i2o_status_block),GFP_KERNEL|ADDR32);
+                pHba->status_block = dma_alloc_coherent(&pHba->pDev->dev,
+                                        sizeof(i2o_status_block),
+                                        &pHba->status_block_pa, GFP_KERNEL);
                 if(pHba->status_block == NULL) {
                         printk(KERN_ERR
                         "dpti%d: Get Status Block failed; Out of memory. \n", 
@@ -2757,7 +2984,6 @@ static s32 adpt_i2o_status_get(adpt_hba* pHba)
         }
         memset(pHba->status_block, 0, sizeof(i2o_status_block));
         status_block = (u8*)(pHba->status_block);
-        status_block_bus = virt_to_bus(pHba->status_block);
         timeout = jiffies+TMOUT_GETSTATUS*HZ;
         do {
                 rmb();
@@ -2782,8 +3008,8 @@ static s32 adpt_i2o_status_get(adpt_hba* pHba)
         writel(0, &msg[3]);
         writel(0, &msg[4]);
         writel(0, &msg[5]);
-        writel(((u32)status_block_bus)&0xffffffff, &msg[6]);
-        writel(0, &msg[7]);
+        writel( dma_low(pHba->status_block_pa), &msg[6]);
+        writel( dma_high(pHba->status_block_pa), &msg[7]);
         writel(sizeof(i2o_status_block), &msg[8]); // 88 bytes
 
         //post message
@@ -2812,7 +3038,17 @@ static s32 adpt_i2o_status_get(adpt_hba* pHba)
         }
 
         // Calculate the Scatter Gather list size
-        pHba->sg_tablesize = (pHba->status_block->inbound_frame_size * 4 -40)/ sizeof(struct sg_simple_element);
+        if (dpt_dma64(pHba)) {
+                pHba->sg_tablesize
+                  = ((pHba->status_block->inbound_frame_size * 4
+                  - 14 * sizeof(u32))
+                  / (sizeof(struct sg_simple_element) + sizeof(u32)));
+        } else {
+                pHba->sg_tablesize
+                  = ((pHba->status_block->inbound_frame_size * 4
+                  - 12 * sizeof(u32))
+                  / sizeof(struct sg_simple_element));
+        }
         if (pHba->sg_tablesize > SG_LIST_ELEMENTS) {
                 pHba->sg_tablesize = SG_LIST_ELEMENTS;
         }
@@ -2863,7 +3099,9 @@ static int adpt_i2o_lct_get(adpt_hba* pHba)
         }
         do {
                 if (pHba->lct == NULL) {
-                        pHba->lct = kmalloc(pHba->lct_size, GFP_KERNEL|ADDR32);
+                        pHba->lct = dma_alloc_coherent(&pHba->pDev->dev,
+                                        pHba->lct_size, &pHba->lct_pa,
+                                        GFP_KERNEL);
                         if(pHba->lct == NULL) {
                                 printk(KERN_CRIT "%s: Lct Get failed. Out of memory.\n",
                                         pHba->name);
@@ -2879,7 +3117,7 @@ static int adpt_i2o_lct_get(adpt_hba* pHba)
                 msg[4] = 0xFFFFFFFF;    /* All devices */
                 msg[5] = 0x00000000;    /* Report now */
                 msg[6] = 0xD0000000|pHba->lct_size;
-                msg[7] = virt_to_bus(pHba->lct);
+                msg[7] = (u32)pHba->lct_pa;
 
                 if ((ret=adpt_i2o_post_wait(pHba, msg, sizeof(msg), 360))) {
                         printk(KERN_ERR "%s: LCT Get failed (status=%#10x.\n", 
@@ -2890,7 +3128,8 @@ static int adpt_i2o_lct_get(adpt_hba* pHba)
 
                 if ((pHba->lct->table_size << 2) > pHba->lct_size) {
                         pHba->lct_size = pHba->lct->table_size << 2;
-                        kfree(pHba->lct);
+                        dma_free_coherent(&pHba->pDev->dev, pHba->lct_size,
+                                        pHba->lct, pHba->lct_pa);
                         pHba->lct = NULL;
                 }
         } while (pHba->lct == NULL);
@@ -2901,13 +3140,19 @@ static int adpt_i2o_lct_get(adpt_hba* pHba)
         // I2O_DPT_EXEC_IOP_BUFFERS_GROUP_NO;
         if(adpt_i2o_query_scalar(pHba, 0 , 0x8000, -1, buf, sizeof(buf))>=0) {
                 pHba->FwDebugBufferSize = buf[1];
-                pHba->FwDebugBuffer_P    = pHba->base_addr_virt + buf[0];
-                pHba->FwDebugFlags_P     = pHba->FwDebugBuffer_P + FW_DEBUG_FLAGS_OFFSET;
-                pHba->FwDebugBLEDvalue_P = pHba->FwDebugBuffer_P + FW_DEBUG_BLED_OFFSET;
-                pHba->FwDebugBLEDflag_P  = pHba->FwDebugBLEDvalue_P + 1;
-                pHba->FwDebugStrLength_P = pHba->FwDebugBuffer_P + FW_DEBUG_STR_LENGTH_OFFSET;
-                pHba->FwDebugBuffer_P += buf[2]; 
-                pHba->FwDebugFlags = 0;
+                pHba->FwDebugBuffer_P = ioremap(pHba->base_addr_phys + buf[0],
+                                                pHba->FwDebugBufferSize);
+                if (pHba->FwDebugBuffer_P) {
+                        pHba->FwDebugFlags_P     = pHba->FwDebugBuffer_P +
+                                                        FW_DEBUG_FLAGS_OFFSET;
+                        pHba->FwDebugBLEDvalue_P = pHba->FwDebugBuffer_P +
+                                                        FW_DEBUG_BLED_OFFSET;
+                        pHba->FwDebugBLEDflag_P  = pHba->FwDebugBLEDvalue_P + 1;
+                        pHba->FwDebugStrLength_P = pHba->FwDebugBuffer_P +
+                                                FW_DEBUG_STR_LENGTH_OFFSET;
+                        pHba->FwDebugBuffer_P += buf[2]; 
+                        pHba->FwDebugFlags = 0;
+                }
         }
 
         return 0;
@@ -2915,25 +3160,30 @@ static int adpt_i2o_lct_get(adpt_hba* pHba)
 
 static int adpt_i2o_build_sys_table(void)
 {
-        adpt_hba* pHba = NULL;
+        adpt_hba* pHba = hba_chain;
         int count = 0;
 
+        if (sys_tbl)
+                dma_free_coherent(&pHba->pDev->dev, sys_tbl_len,
+                                        sys_tbl, sys_tbl_pa);
+
         sys_tbl_len = sizeof(struct i2o_sys_tbl) +      // Header + IOPs
                                 (hba_count) * sizeof(struct i2o_sys_tbl_entry);
 
-        kfree(sys_tbl);
-
-        sys_tbl = kzalloc(sys_tbl_len, GFP_KERNEL|ADDR32);
+        sys_tbl = dma_alloc_coherent(&pHba->pDev->dev,
+                                sys_tbl_len, &sys_tbl_pa, GFP_KERNEL);
         if (!sys_tbl) {
                 printk(KERN_WARNING "SysTab Set failed. Out of memory.\n");     
                 return -ENOMEM;
         }
+        memset(sys_tbl, 0, sys_tbl_len);
 
         sys_tbl->num_entries = hba_count;
         sys_tbl->version = I2OVERSION;
         sys_tbl->change_ind = sys_tbl_ind++;
 
         for(pHba = hba_chain; pHba; pHba = pHba->next) {
+                u64 addr;
                 // Get updated Status Block so we have the latest information
                 if (adpt_i2o_status_get(pHba)) {
                         sys_tbl->num_entries--;
@@ -2949,8 +3199,9 @@ static int adpt_i2o_build_sys_table(void)
                 sys_tbl->iops[count].frame_size = pHba->status_block->inbound_frame_size;
                 sys_tbl->iops[count].last_changed = sys_tbl_ind - 1; // ??
                 sys_tbl->iops[count].iop_capabilities = pHba->status_block->iop_capabilities;
-                sys_tbl->iops[count].inbound_low = (u32)virt_to_bus(pHba->post_port);
-                sys_tbl->iops[count].inbound_high = (u32)((u64)virt_to_bus(pHba->post_port)>>32);
+                addr = pHba->base_addr_phys + 0x40;
+                sys_tbl->iops[count].inbound_low = dma_low(addr);
+                sys_tbl->iops[count].inbound_high = dma_high(addr);
 
                 count++;
         }
@@ -3086,7 +3337,8 @@ static s32 adpt_i2o_hrt_get(adpt_hba* pHba)
 
         do {
                 if (pHba->hrt == NULL) {
-                        pHba->hrt=kmalloc(size, GFP_KERNEL|ADDR32);
+                        pHba->hrt = dma_alloc_coherent(&pHba->pDev->dev,
+                                        size, &pHba->hrt_pa, GFP_KERNEL);
                         if (pHba->hrt == NULL) {
                                 printk(KERN_CRIT "%s: Hrt Get failed; Out of memory.\n", pHba->name);
                                 return -ENOMEM;
@@ -3098,7 +3350,7 @@ static s32 adpt_i2o_hrt_get(adpt_hba* pHba)
                 msg[2]= 0;
                 msg[3]= 0;
                 msg[4]= (0xD0000000 | size);    /* Simple transaction */
-                msg[5]= virt_to_bus(pHba->hrt);   /* Dump it here */
+                msg[5]= (u32)pHba->hrt_pa;      /* Dump it here */
 
                 if ((ret = adpt_i2o_post_wait(pHba, msg, sizeof(msg),20))) {
                         printk(KERN_ERR "%s: Unable to get HRT (status=%#10x)\n", pHba->name, ret);
@@ -3106,8 +3358,10 @@ static s32 adpt_i2o_hrt_get(adpt_hba* pHba)
                 }
 
                 if (pHba->hrt->num_entries * pHba->hrt->entry_len << 2 > size) {
-                        size = pHba->hrt->num_entries * pHba->hrt->entry_len << 2;
-                        kfree(pHba->hrt);
+                        int newsize = pHba->hrt->num_entries * pHba->hrt->entry_len << 2;
+                        dma_free_coherent(&pHba->pDev->dev, size,
+                                pHba->hrt, pHba->hrt_pa);
+                        size = newsize;
                         pHba->hrt = NULL;
                 }
         } while(pHba->hrt == NULL);
@@ -3121,33 +3375,54 @@ static int adpt_i2o_query_scalar(adpt_hba* pHba, int tid,
                         int group, int field, void *buf, int buflen)
 {
         u16 opblk[] = { 1, 0, I2O_PARAMS_FIELD_GET, group, 1, field };
-        u8 *resblk;
+        u8 *opblk_va;
+        dma_addr_t opblk_pa;
+        u8 *resblk_va;
+        dma_addr_t resblk_pa;
 
         int size;
 
         /* 8 bytes for header */
-        resblk = kmalloc(sizeof(u8) * (8+buflen), GFP_KERNEL|ADDR32);
-        if (resblk == NULL) {
+        resblk_va = dma_alloc_coherent(&pHba->pDev->dev,
+                        sizeof(u8) * (8 + buflen), &resblk_pa, GFP_KERNEL);
+        if (resblk_va == NULL) {
                 printk(KERN_CRIT "%s: query scalar failed; Out of memory.\n", pHba->name);
                 return -ENOMEM;
         }
 
+        opblk_va = dma_alloc_coherent(&pHba->pDev->dev,
+                        sizeof(opblk), &opblk_pa, GFP_KERNEL);
+        if (opblk_va == NULL) {
+                dma_free_coherent(&pHba->pDev->dev, sizeof(u8) * (8+buflen),
+                        resblk_va, resblk_pa);
+                printk(KERN_CRIT "%s: query operatio failed; Out of memory.\n",
+                        pHba->name);
+                return -ENOMEM;
+        }
         if (field == -1)                /* whole group */
                         opblk[4] = -1;
 
+        memcpy(opblk_va, opblk, sizeof(opblk));
         size = adpt_i2o_issue_params(I2O_CMD_UTIL_PARAMS_GET, pHba, tid, 
-                opblk, sizeof(opblk), resblk, sizeof(u8)*(8+buflen));
+                opblk_va, opblk_pa, sizeof(opblk),
+                resblk_va, resblk_pa, sizeof(u8)*(8+buflen));
+        dma_free_coherent(&pHba->pDev->dev, sizeof(opblk), opblk_va, opblk_pa);
         if (size == -ETIME) {
+                dma_free_coherent(&pHba->pDev->dev, sizeof(u8) * (8+buflen),
+                                                        resblk_va, resblk_pa);
                 printk(KERN_WARNING "%s: issue params failed; Timed out.\n", pHba->name);
                 return -ETIME;
         } else if (size == -EINTR) {
+                dma_free_coherent(&pHba->pDev->dev, sizeof(u8) * (8+buflen),
+                                                        resblk_va, resblk_pa);
                 printk(KERN_WARNING "%s: issue params failed; Interrupted.\n", pHba->name);
                 return -EINTR;
         }
                         
-        memcpy(buf, resblk+8, buflen);  /* cut off header */
+        memcpy(buf, resblk_va+8, buflen);  /* cut off header */
 
-        kfree(resblk);
+        dma_free_coherent(&pHba->pDev->dev, sizeof(u8) * (8+buflen),
+                                                resblk_va, resblk_pa);
         if (size < 0)
                 return size;    
 
@@ -3164,10 +3439,11 @@ static int adpt_i2o_query_scalar(adpt_hba* pHba, int tid,
  *      ResultCount, ErrorInfoSize, BlockStatus and BlockSize.
  */
 static int adpt_i2o_issue_params(int cmd, adpt_hba* pHba, int tid, 
-                  void *opblk, int oplen, void *resblk, int reslen)
+                  void *opblk_va,  dma_addr_t opblk_pa, int oplen,
+                void *resblk_va, dma_addr_t resblk_pa, int reslen)
 {
         u32 msg[9]; 
-        u32 *res = (u32 *)resblk;
+        u32 *res = (u32 *)resblk_va;
         int wait_status;
 
         msg[0] = NINE_WORD_MSG_SIZE | SGL_OFFSET_5;
@@ -3176,12 +3452,12 @@ static int adpt_i2o_issue_params(int cmd, adpt_hba* pHba, int tid,
         msg[3] = 0;
         msg[4] = 0;
         msg[5] = 0x54000000 | oplen;    /* OperationBlock */
-        msg[6] = virt_to_bus(opblk);
+        msg[6] = (u32)opblk_pa;
         msg[7] = 0xD0000000 | reslen;   /* ResultBlock */
-        msg[8] = virt_to_bus(resblk);
+        msg[8] = (u32)resblk_pa;
 
         if ((wait_status = adpt_i2o_post_wait(pHba, msg, sizeof(msg), 20))) {
-                printk("adpt_i2o_issue_params: post_wait failed (%p)\n", resblk);
+                printk("adpt_i2o_issue_params: post_wait failed (%p)\n", resblk_va);
                 return wait_status;     /* -DetailedStatus */
         }
 
@@ -3284,7 +3560,7 @@ static int adpt_i2o_systab_send(adpt_hba* pHba)
          * Private i/o space declaration  
          */
         msg[6] = 0x54000000 | sys_tbl_len;
-        msg[7] = virt_to_phys(sys_tbl);
+        msg[7] = (u32)sys_tbl_pa;
         msg[8] = 0x54000000 | 0;
         msg[9] = 0;
         msg[10] = 0xD4000000 | 0;
@@ -3323,11 +3599,10 @@ static static void adpt_delay(int millisec)
 #endif
 
 static struct scsi_host_template driver_template = {
+        .module                 = THIS_MODULE,
         .name                   = "dpt_i2o",
         .proc_name              = "dpt_i2o",
         .proc_info              = adpt_proc_info,
-        .detect                 = adpt_detect,
-        .release                = adpt_release,
         .info                   = adpt_info,
         .queuecommand           = adpt_queue,
         .eh_abort_handler       = adpt_abort,
@@ -3341,5 +3616,48 @@ static struct scsi_host_template driver_template = {
         .cmd_per_lun            = 1,
         .use_clustering         = ENABLE_CLUSTERING,
 };
-#include "scsi_module.c"
+
+static int __init adpt_init(void)
+{
+        int             error;
+        adpt_hba        *pHba, *next;
+
+        printk("Loading Adaptec I2O RAID: Version " DPT_I2O_VERSION "\n");
+
+        error = adpt_detect(&driver_template);
+        if (error < 0)
+                return error;
+        if (hba_chain == NULL)
+                return -ENODEV;
+
+        for (pHba = hba_chain; pHba; pHba = pHba->next) {
+                error = scsi_add_host(pHba->host, &pHba->pDev->dev);
+                if (error)
+                        goto fail;
+                scsi_scan_host(pHba->host);
+        }
+        return 0;
+fail:
+        for (pHba = hba_chain; pHba; pHba = next) {
+                next = pHba->next;
+                scsi_remove_host(pHba->host);
+        }
+        return error;
+}
+
+static void __exit adpt_exit(void)
+{
+        adpt_hba        *pHba, *next;
+
+        for (pHba = hba_chain; pHba; pHba = pHba->next)
+                scsi_remove_host(pHba->host);
+        for (pHba = hba_chain; pHba; pHba = next) {
+                next = pHba->next;
+                adpt_release(pHba->host);
+        }
+}
+
+module_init(adpt_init);
+module_exit(adpt_exit);
+
 MODULE_LICENSE("GPL");
diff --git a/drivers/scsi/dpti.h b/drivers/scsi/dpti.h
index fd79068c586..337746d4604 100644
--- a/drivers/scsi/dpti.h
+++ b/drivers/scsi/dpti.h
@@ -84,7 +84,6 @@ static int adpt_device_reset(struct scsi_cmnd* cmd);
 #define PCI_DPT_DEVICE_ID         (0xA501)      // DPT PCI I2O Device ID
 #define PCI_DPT_RAPTOR_DEVICE_ID  (0xA511)      
 
-//#define REBOOT_NOTIFIER 1
 /* Debugging macro from Linux Device Drivers - Rubini */
 #undef PDEBUG
 #ifdef DEBUG
@@ -229,14 +228,19 @@ typedef struct _adpt_hba {
         u32  post_fifo_size;
         u32  reply_fifo_size;
         u32* reply_pool;
+        dma_addr_t reply_pool_pa;
         u32  sg_tablesize;      // Scatter/Gather List Size.       
         u8  top_scsi_channel;
         u8  top_scsi_id;
         u8  top_scsi_lun;
+        u8  dma64;
 
         i2o_status_block* status_block;
+        dma_addr_t status_block_pa;
         i2o_hrt* hrt;
+        dma_addr_t hrt_pa;
         i2o_lct* lct;
+        dma_addr_t lct_pa;
         uint lct_size;
         struct i2o_device* devices;
         struct adpt_channel channel[MAX_CHANNEL];
@@ -249,6 +253,7 @@ typedef struct _adpt_hba {
         void __iomem *FwDebugBLEDflag_P;// Virtual Addr Of FW Debug BLED
         void __iomem *FwDebugBLEDvalue_P;// Virtual Addr Of FW Debug BLED
         u32 FwDebugFlags;
+        u32 *ioctl_reply_context[4];
 } adpt_hba;
 
 struct sg_simple_element {
@@ -264,9 +269,6 @@ static void adpt_i2o_sys_shutdown(void);
 static int adpt_init(void);
 static int adpt_i2o_build_sys_table(void);
 static irqreturn_t adpt_isr(int irq, void *dev_id);
-#ifdef REBOOT_NOTIFIER
-static int adpt_reboot_event(struct notifier_block *n, ulong code, void *p);
-#endif
 
 static void adpt_i2o_report_hba_unit(adpt_hba* pHba, struct i2o_device *d);
 static int adpt_i2o_query_scalar(adpt_hba* pHba, int tid, 
@@ -275,7 +277,8 @@ static int adpt_i2o_query_scalar(adpt_hba* pHba, int tid,
 static const char *adpt_i2o_get_class_name(int class);
 #endif
 static int adpt_i2o_issue_params(int cmd, adpt_hba* pHba, int tid, 
-                  void *opblk, int oplen, void *resblk, int reslen);
+                  void *opblk, dma_addr_t opblk_pa, int oplen,
+                  void *resblk, dma_addr_t resblk_pa, int reslen);
 static int adpt_i2o_post_wait(adpt_hba* pHba, u32* msg, int len, int timeout);
 static int adpt_i2o_lct_get(adpt_hba* pHba);
 static int adpt_i2o_parse_lct(adpt_hba* pHba);
@@ -289,7 +292,7 @@ static s32 adpt_i2o_init_outbound_q(adpt_hba* pHba);
 static s32 adpt_i2o_hrt_get(adpt_hba* pHba);
 static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_device* dptdevice);
 static s32 adpt_i2o_to_scsi(void __iomem *reply, struct scsi_cmnd* cmd);
-static s32 adpt_scsi_register(adpt_hba* pHba,struct scsi_host_template * sht);
+static s32 adpt_scsi_host_alloc(adpt_hba* pHba,struct scsi_host_template * sht);
 static s32 adpt_hba_reset(adpt_hba* pHba);
 static s32 adpt_i2o_reset_hba(adpt_hba* pHba);
 static s32 adpt_rescan(adpt_hba* pHba);
@@ -313,19 +316,6 @@ static int adpt_close(struct inode *inode, struct file *file);
 static void adpt_delay(int millisec);
 #endif
 
-#if defined __ia64__ 
-static void adpt_ia64_info(sysInfo_S* si);
-#endif
-#if defined __sparc__ 
-static void adpt_sparc_info(sysInfo_S* si);
-#endif
-#if defined __alpha__ 
-static void adpt_sparc_info(sysInfo_S* si);
-#endif
-#if defined __i386__
-static void adpt_i386_info(sysInfo_S* si);
-#endif
-
 #define PRINT_BUFFER_SIZE     512
 
 #define HBA_FLAGS_DBG_FLAGS_MASK         0xffff0000     // Mask for debug flags
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index c6d6e7c6559..46771d4c81b 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -465,7 +465,7 @@ int __gdth_execute(struct scsi_device *sdev, gdth_cmd_str *gdtcmd, char *cmnd,
     scp->request = (struct request *)&wait;
     scp->timeout_per_command = timeout*HZ;
     scp->cmd_len = 12;
-    memcpy(scp->cmnd, cmnd, 12);
+    scp->cmnd = cmnd;
     cmndinfo.priority = IOCTL_PRI;
     cmndinfo.internal_cmd_str = gdtcmd;
     cmndinfo.internal_command = 1;
@@ -550,7 +550,6 @@ static int __init gdth_search_isa(ulong32 bios_adr)
 #endif /* CONFIG_ISA */
 
 #ifdef CONFIG_PCI
-static bool gdth_pci_registered;
 
 static bool gdth_search_vortex(ushort device)
 {
@@ -3724,6 +3723,8 @@ static void gdth_log_event(gdth_evt_data *dvr, char *buffer)
 }
 
 #ifdef GDTH_STATISTICS
+static unchar   gdth_timer_running;
+
 static void gdth_timeout(ulong data)
 {
     ulong32 i;
@@ -3731,7 +3732,10 @@ static void gdth_timeout(ulong data)
     gdth_ha_str *ha;
     ulong flags;
 
-    BUG_ON(list_empty(&gdth_instances));
+    if(unlikely(list_empty(&gdth_instances))) {
+            gdth_timer_running = 0;
+            return;
+    }
 
     ha = list_first_entry(&gdth_instances, gdth_ha_str, list);
     spin_lock_irqsave(&ha->smp_lock, flags);
@@ -3751,6 +3755,22 @@ static void gdth_timeout(ulong data)
     add_timer(&gdth_timer);
     spin_unlock_irqrestore(&ha->smp_lock, flags);
 }
+
+static void gdth_timer_init(void)
+{
+        if (gdth_timer_running)
+                return;
+        gdth_timer_running = 1;
+        TRACE2(("gdth_detect(): Initializing timer !\n"));
+        gdth_timer.expires = jiffies + HZ;
+        gdth_timer.data = 0L;
+        gdth_timer.function = gdth_timeout;
+        add_timer(&gdth_timer);
+}
+#else
+static inline void gdth_timer_init(void)
+{
+}
 #endif
 
 static void __init internal_setup(char *str,int *ints)
@@ -4735,6 +4755,7 @@ static int __init gdth_isa_probe_one(ulong32 isa_bios)
         if (error)
                 goto out_free_coal_stat;
         list_add_tail(&ha->list, &gdth_instances);
+        gdth_timer_init();
 
         scsi_scan_host(shp);
 
@@ -4865,6 +4886,7 @@ static int __init gdth_eisa_probe_one(ushort eisa_slot)
         if (error)
                 goto out_free_coal_stat;
         list_add_tail(&ha->list, &gdth_instances);
+        gdth_timer_init();
 
         scsi_scan_host(shp);
 
@@ -5011,6 +5033,7 @@ static int gdth_pci_probe_one(gdth_pci_str *pcistr,
         list_add_tail(&ha->list, &gdth_instances);
 
         pci_set_drvdata(ha->pdev, ha);
+        gdth_timer_init();
 
         scsi_scan_host(shp);
 
@@ -5110,6 +5133,7 @@ static int __init gdth_init(void)
         /* initializations */
         gdth_polling = TRUE;
         gdth_clear_events();
+        init_timer(&gdth_timer);
 
         /* As default we do not probe for EISA or ISA controllers */
         if (probe_eisa_isa) {
@@ -5132,23 +5156,17 @@ static int __init gdth_init(void)
 
 #ifdef CONFIG_PCI
         /* scanning for PCI controllers */
-        if (pci_register_driver(&gdth_pci_driver) == 0)
-                gdth_pci_registered = true;
+        if (pci_register_driver(&gdth_pci_driver)) {
+                gdth_ha_str *ha;
+
+                list_for_each_entry(ha, &gdth_instances, list)
+                        gdth_remove_one(ha);
+                return -ENODEV;
+        }
 #endif /* CONFIG_PCI */
 
         TRACE2(("gdth_detect() %d controller detected\n", gdth_ctr_count));
 
-        if (list_empty(&gdth_instances))
-                return -ENODEV;
-
-#ifdef GDTH_STATISTICS
-        TRACE2(("gdth_detect(): Initializing timer !\n"));
-        init_timer(&gdth_timer);
-        gdth_timer.expires = jiffies + HZ;
-        gdth_timer.data = 0L;
-        gdth_timer.function = gdth_timeout;
-        add_timer(&gdth_timer);
-#endif
         major = register_chrdev(0,"gdth", &gdth_fops);
         register_reboot_notifier(&gdth_notifier);
         gdth_polling = FALSE;
@@ -5167,8 +5185,7 @@ static void __exit gdth_exit(void)
 #endif
 
 #ifdef CONFIG_PCI
-        if (gdth_pci_registered)
-                pci_unregister_driver(&gdth_pci_driver);
+        pci_unregister_driver(&gdth_pci_driver);
 #endif
 
         list_for_each_entry(ha, &gdth_instances, list)
diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
index 5b7be1e9841..aaa48e0c8ed 100644
--- a/drivers/scsi/hptiop.c
+++ b/drivers/scsi/hptiop.c
@@ -763,9 +763,9 @@ static int hptiop_queuecommand(struct scsi_cmnd *scp,
                         scp,
                         host->host_no, scp->device->channel,
                         scp->device->id, scp->device->lun,
-                        *((u32 *)&scp->cmnd),
-                        *((u32 *)&scp->cmnd + 1),
-                        *((u32 *)&scp->cmnd + 2),
+                        ((u32 *)scp->cmnd)[0],
+                        ((u32 *)scp->cmnd)[1],
+                        ((u32 *)scp->cmnd)[2],
                         _req->index, _req->req_virt);
 
         scp->result = 0;
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 4a922c57125..ccfd8aca376 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -686,7 +686,7 @@ static void handle_cmd_rsp(struct srp_event_struct *evt_struct)
         }
         
         if (cmnd) {
-                cmnd->result = rsp->status;
+                cmnd->result |= rsp->status;
                 if (((cmnd->result >> 1) & 0x1f) == CHECK_CONDITION)
                         memcpy(cmnd->sense_buffer,
                                rsp->data,
@@ -730,6 +730,7 @@ static int ibmvscsi_queuecommand(struct scsi_cmnd *cmnd,
         u16 lun = lun_from_dev(cmnd->device);
         u8 out_fmt, in_fmt;
 
+        cmnd->result = (DID_OK << 16);
         evt_struct = get_event_struct(&hostdata->pool);
         if (!evt_struct)
                 return SCSI_MLQUEUE_HOST_BUSY;
@@ -738,7 +739,7 @@ static int ibmvscsi_queuecommand(struct scsi_cmnd *cmnd,
         srp_cmd = &evt_struct->iu.srp.cmd;
         memset(srp_cmd, 0x00, SRP_MAX_IU_LEN);
         srp_cmd->opcode = SRP_CMD;
-        memcpy(srp_cmd->cdb, cmnd->cmnd, sizeof(cmnd->cmnd));
+        memcpy(srp_cmd->cdb, cmnd->cmnd, sizeof(srp_cmd->cdb));
         srp_cmd->lun = ((u64) lun) << 48;
 
         if (!map_data_for_srp_cmd(cmnd, evt_struct, srp_cmd, hostdata->dev)) {
@@ -1347,6 +1348,8 @@ void ibmvscsi_handle_crq(struct viosrp_crq *crq,
 
         del_timer(&evt_struct->timer);
 
+        if (crq->status != VIOSRP_OK && evt_struct->cmnd)
+                evt_struct->cmnd->result = DID_ERROR << 16;
         if (evt_struct->done)
                 evt_struct->done(evt_struct);
         else
diff --git a/drivers/scsi/ibmvscsi/viosrp.h b/drivers/scsi/ibmvscsi/viosrp.h
index 90f1a61283a..4c4aadb3e40 100644
--- a/drivers/scsi/ibmvscsi/viosrp.h
+++ b/drivers/scsi/ibmvscsi/viosrp.h
@@ -59,6 +59,15 @@ enum viosrp_crq_formats {
         VIOSRP_INLINE_FORMAT = 0x07
 };
 
+enum viosrp_crq_status {
+        VIOSRP_OK = 0x0,
+        VIOSRP_NONRECOVERABLE_ERR = 0x1,
+        VIOSRP_VIOLATES_MAX_XFER = 0x2,
+        VIOSRP_PARTNER_PANIC = 0x3,
+        VIOSRP_DEVICE_BUSY = 0x8,
+        VIOSRP_ADAPTER_FAIL = 0x10
+};
+
 struct viosrp_crq {
         u8 valid;               /* used by RPA */
         u8 format;              /* SCSI vs out-of-band */
diff --git a/drivers/scsi/initio.c b/drivers/scsi/initio.c
index dbae3fdb850..e3f739776ba 100644
--- a/drivers/scsi/initio.c
+++ b/drivers/scsi/initio.c
@@ -2590,7 +2590,7 @@ static void initio_build_scb(struct initio_host * host, struct scsi_ctrl_blk * c
         cblk->hastat = 0;
         cblk->tastat = 0;
         /* Command the command */
-        memcpy(&cblk->cdb[0], &cmnd->cmnd, cmnd->cmd_len);
+        memcpy(cblk->cdb, cmnd->cmnd, cmnd->cmd_len);
 
         /* Set up tags */
         if (cmnd->device->tagged_supported) {   /* Tag Support                  */
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index de5ae6a6502..999e91ea745 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -2791,7 +2791,7 @@ static ssize_t ipr_store_adapter_state(struct device *dev,
 
 static struct device_attribute ipr_ioa_state_attr = {
         .attr = {
-                .name =         "state",
+                .name =         "online_state",
                 .mode =         S_IRUGO | S_IWUSR,
         },
         .show = ipr_show_adapter_state,
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 010c1b9b178..b43bf1d60da 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -730,7 +730,9 @@ static int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                                 if (iscsi_recv_pdu(conn->cls_conn, hdr, data,
                                                    datalen))
                                         rc = ISCSI_ERR_CONN_FAILED;
-                        }
+                        } else
+                                mod_timer(&conn->transport_timer,
+                                          jiffies + conn->recv_timeout);
                         iscsi_free_mgmt_task(conn, mtask);
                         break;
                 default:
@@ -1453,19 +1455,20 @@ static void iscsi_check_transport_timeouts(unsigned long data)
 {
         struct iscsi_conn *conn = (struct iscsi_conn *)data;
         struct iscsi_session *session = conn->session;
-        unsigned long timeout, next_timeout = 0, last_recv;
+        unsigned long recv_timeout, next_timeout = 0, last_recv;
 
         spin_lock(&session->lock);
         if (session->state != ISCSI_STATE_LOGGED_IN)
                 goto done;
 
-        timeout = conn->recv_timeout;
-        if (!timeout)
+        recv_timeout = conn->recv_timeout;
+        if (!recv_timeout)
                 goto done;
 
-        timeout *= HZ;
+        recv_timeout *= HZ;
         last_recv = conn->last_recv;
-        if (time_before_eq(last_recv + timeout + (conn->ping_timeout * HZ),
+        if (conn->ping_mtask &&
+            time_before_eq(conn->last_ping + (conn->ping_timeout * HZ),
                            jiffies)) {
                 iscsi_conn_printk(KERN_ERR, conn, "ping timeout of %d secs "
                                   "expired, last rx %lu, last ping %lu, "
@@ -1476,15 +1479,13 @@ static void iscsi_check_transport_timeouts(unsigned long data)
                 return;
         }
 
-        if (time_before_eq(last_recv + timeout, jiffies)) {
-                if (time_before_eq(conn->last_ping, last_recv)) {
-                        /* send a ping to try to provoke some traffic */
-                        debug_scsi("Sending nopout as ping on conn %p\n", conn);
-                        iscsi_send_nopout(conn, NULL);
-                }
-                next_timeout = last_recv + timeout + (conn->ping_timeout * HZ);
+        if (time_before_eq(last_recv + recv_timeout, jiffies)) {
+                /* send a ping to try to provoke some traffic */
+                debug_scsi("Sending nopout as ping on conn %p\n", conn);
+                iscsi_send_nopout(conn, NULL);
+                next_timeout = conn->last_ping + (conn->ping_timeout * HZ);
         } else
-                next_timeout = last_recv + timeout;
+                next_timeout = last_recv + recv_timeout;
 
         debug_scsi("Setting next tmo %lu\n", next_timeout);
         mod_timer(&conn->transport_timer, next_timeout);
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index 820f91fb63b..70a0f11f48b 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -3168,6 +3168,23 @@ megaraid_mbox_support_random_del(adapter_t *adapter)
         uint8_t         raw_mbox[sizeof(mbox_t)];
         int             rval;
 
+        /*
+         * Newer firmware on Dell CERC expect a different
+         * random deletion handling, so disable it.
+         */
+        if (adapter->pdev->vendor == PCI_VENDOR_ID_AMI &&
+            adapter->pdev->device == PCI_DEVICE_ID_AMI_MEGARAID3 &&
+            adapter->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
+            adapter->pdev->subsystem_device == PCI_SUBSYS_ID_CERC_ATA100_4CH &&
+            (adapter->fw_version[0] > '6' ||
+             (adapter->fw_version[0] == '6' &&
+              adapter->fw_version[2] > '6') ||
+             (adapter->fw_version[0] == '6'
+              && adapter->fw_version[2] == '6'
+              && adapter->fw_version[3] > '1'))) {
+                con_log(CL_DLEVEL1, ("megaraid: disable random deletion\n"));
+                return 0;
+        }
 
         mbox = (mbox_t *)raw_mbox;
 
diff --git a/drivers/scsi/megaraid/megaraid_mbox.h b/drivers/scsi/megaraid/megaraid_mbox.h
index 626459d1e90..c1d86d961a9 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.h
+++ b/drivers/scsi/megaraid/megaraid_mbox.h
@@ -88,6 +88,7 @@
 #define PCI_SUBSYS_ID_PERC3_QC                          0x0471
 #define PCI_SUBSYS_ID_PERC3_DC                          0x0493
 #define PCI_SUBSYS_ID_PERC3_SC                          0x0475
+#define PCI_SUBSYS_ID_CERC_ATA100_4CH                   0x0511
 
 
 #define MBOX_MAX_SCSI_CMDS      128     // number of cmds reserved for kernel
diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
index b937e9cddb2..7d84c8bbcf3 100644
--- a/drivers/scsi/megaraid/megaraid_sas.c
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -10,7 +10,7 @@
  *         2 of the License, or (at your option) any later version.
  *
  * FILE         : megaraid_sas.c
- * Version      : v00.00.03.16-rc1
+ * Version      : v00.00.03.20-rc1
  *
  * Authors:
  *      (email-id : megaraidlinux@lsi.com)
@@ -2650,12 +2650,13 @@ static void megasas_shutdown_controller(struct megasas_instance *instance,
         return;
 }
 
+#ifdef CONFIG_PM
 /**
  * megasas_suspend -    driver suspend entry point
  * @pdev:               PCI device structure
  * @state:              PCI power state to suspend routine
  */
-static int __devinit
+static int
 megasas_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct Scsi_Host *host;
@@ -2687,7 +2688,7 @@ megasas_suspend(struct pci_dev *pdev, pm_message_t state)
  * megasas_resume-      driver resume entry point
  * @pdev:               PCI device structure
  */
-static int __devinit
+static int
 megasas_resume(struct pci_dev *pdev)
 {
         int rval;
@@ -2782,12 +2783,16 @@ fail_ready_state:
 
         return -ENODEV;
 }
+#else
+#define megasas_suspend NULL
+#define megasas_resume  NULL
+#endif
 
 /**
  * megasas_detach_one - PCI hot"un"plug entry point
  * @pdev:               PCI device structure
  */
-static void megasas_detach_one(struct pci_dev *pdev)
+static void __devexit megasas_detach_one(struct pci_dev *pdev)
 {
         int i;
         struct Scsi_Host *host;
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index 3a997eb457b..b0c41e67170 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -18,9 +18,9 @@
 /*
  * MegaRAID SAS Driver meta data
  */
-#define MEGASAS_VERSION                         "00.00.03.16-rc1"
-#define MEGASAS_RELDATE                         "Nov. 07, 2007"
-#define MEGASAS_EXT_VERSION                     "Thu. Nov. 07 10:09:32 PDT 2007"
+#define MEGASAS_VERSION                 "00.00.03.20-rc1"
+#define MEGASAS_RELDATE                 "March 10, 2008"
+#define MEGASAS_EXT_VERSION             "Mon. March 10 11:02:31 PDT 2008"
 
 /*
  * Device IDs
diff --git a/drivers/scsi/mvsas.c b/drivers/scsi/mvsas.c
index e55b9037adb..1dd70d7a494 100644
--- a/drivers/scsi/mvsas.c
+++ b/drivers/scsi/mvsas.c
@@ -2822,7 +2822,9 @@ static void mvs_update_phyinfo(struct mvs_info *mvi, int i,
                 dev_printk(KERN_DEBUG, &pdev->dev,
                         "phy[%d] Get Attached Address 0x%llX ,"
                         " SAS Address 0x%llX\n",
-                        i, phy->att_dev_sas_addr, phy->dev_sas_addr);
+                        i,
+                        (unsigned long long)phy->att_dev_sas_addr,
+                        (unsigned long long)phy->dev_sas_addr);
                 dev_printk(KERN_DEBUG, &pdev->dev,
                         "Rate = %x , type = %d\n",
                         sas_phy->linkrate, phy->phy_type);
diff --git a/drivers/scsi/ncr53c8xx.c b/drivers/scsi/ncr53c8xx.c
index ceab4f73caf..c57c94c0ffd 100644
--- a/drivers/scsi/ncr53c8xx.c
+++ b/drivers/scsi/ncr53c8xx.c
@@ -8222,7 +8222,7 @@ static void process_waiting_list(struct ncb *np, int sts)
 #ifdef DEBUG_WAITING_LIST
         if (waiting_list) printk("%s: waiting_list=%lx processing sts=%d\n", ncr_name(np), (u_long) waiting_list, sts);
 #endif
-        while (wcmd = waiting_list) {
+        while ((wcmd = waiting_list) != NULL) {
                 waiting_list = (struct scsi_cmnd *) wcmd->next_wcmd;
                 wcmd->next_wcmd = NULL;
                 if (sts == DID_OK) {
diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
index 09ab3eac1c1..51e2f299dbb 100644
--- a/drivers/scsi/qla1280.c
+++ b/drivers/scsi/qla1280.c
@@ -2007,7 +2007,7 @@ qla1280_set_defaults(struct scsi_qla_host *ha)
                 nv->bus[bus].config_2.req_ack_active_negation = 1;
                 nv->bus[bus].config_2.data_line_active_negation = 1;
                 nv->bus[bus].selection_timeout = 250;
-                nv->bus[bus].max_queue_depth = 256;
+                nv->bus[bus].max_queue_depth = 32;
 
                 if (IS_ISP1040(ha)) {
                         nv->bus[bus].bus_reset_delay = 3;
@@ -2051,7 +2051,7 @@ qla1280_config_target(struct scsi_qla_host *ha, int bus, int target)
         status = qla1280_mailbox_command(ha, 0x0f, mb);
 
         /* Save Tag queuing enable flag. */
-        flag = (BIT_0 << target) & mb[0];
+        flag = (BIT_0 << target);
         if (nv->bus[bus].target[target].parameter.tag_queuing)
                 ha->bus_settings[bus].qtag_enables |= flag;
 
@@ -2858,7 +2858,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
 
         /* Load SCSI command packet. */
         pkt->cdb_len = cpu_to_le16(CMD_CDBLEN(cmd));
-        memcpy(pkt->scsi_cdb, &(CMD_CDBP(cmd)), CMD_CDBLEN(cmd));
+        memcpy(pkt->scsi_cdb, CMD_CDBP(cmd), CMD_CDBLEN(cmd));
         /* dprintk(1, "Build packet for command[0]=0x%x\n",pkt->scsi_cdb[0]); */
 
         /* Set transfer direction. */
@@ -3127,7 +3127,7 @@ qla1280_32bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
 
         /* Load SCSI command packet. */
         pkt->cdb_len = cpu_to_le16(CMD_CDBLEN(cmd));
-        memcpy(pkt->scsi_cdb, &(CMD_CDBP(cmd)), CMD_CDBLEN(cmd));
+        memcpy(pkt->scsi_cdb, CMD_CDBP(cmd), CMD_CDBLEN(cmd));
 
         /*dprintk(1, "Build packet for command[0]=0x%x\n",pkt->scsi_cdb[0]); */
         /* Set transfer direction. */
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 12d69d7c857..110e776d1a0 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -79,15 +79,6 @@ static void scsi_done(struct scsi_cmnd *cmd);
 #define MIN_RESET_PERIOD (15*HZ)
 
 /*
- * Macro to determine the size of SCSI command. This macro takes vendor
- * unique commands into account. SCSI commands in groups 6 and 7 are
- * vendor unique and we will depend upon the command length being
- * supplied correctly in cmd_len.
- */
-#define CDB_SIZE(cmd)   (((((cmd)->cmnd[0] >> 5) & 7) < 6) ? \
-                                COMMAND_SIZE((cmd)->cmnd[0]) : (cmd)->cmd_len)
-
-/*
  * Note - the initial logging level can be set here to log events at boot time.
  * After the system is up, you may enable logging via the /proc interface.
  */
@@ -469,6 +460,7 @@ int scsi_setup_command_freelist(struct Scsi_Host *shost)
         cmd = scsi_pool_alloc_command(shost->cmd_pool, gfp_mask);
         if (!cmd) {
                 scsi_put_host_cmd_pool(gfp_mask);
+                shost->cmd_pool = NULL;
                 return -ENOMEM;
         }
         list_add(&cmd->list, &shost->free_list);
@@ -481,6 +473,13 @@ int scsi_setup_command_freelist(struct Scsi_Host *shost)
  */
 void scsi_destroy_command_freelist(struct Scsi_Host *shost)
 {
+        /*
+         * If cmd_pool is NULL the free list was not initialized, so
+         * do not attempt to release resources.
+         */
+        if (!shost->cmd_pool)
+                return;
+
         while (!list_empty(&shost->free_list)) {
                 struct scsi_cmnd *cmd;
 
@@ -701,9 +700,11 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
          * Before we queue this command, check if the command
          * length exceeds what the host adapter can handle.
          */
-        if (CDB_SIZE(cmd) > cmd->device->host->max_cmd_len) {
+        if (cmd->cmd_len > cmd->device->host->max_cmd_len) {
                 SCSI_LOG_MLQUEUE(3,
-                                printk("queuecommand : command too long.\n"));
+                        printk("queuecommand : command too long. "
+                               "cdb_size=%d host->max_cmd_len=%d\n",
+                               cmd->cmd_len, cmd->device->host->max_cmd_len));
                 cmd->result = (DID_ABORT << 16);
 
                 scsi_done(cmd);
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 1eaba6cd80f..eaf5a8add1b 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -626,7 +626,7 @@ static void scsi_abort_eh_cmnd(struct scsi_cmnd *scmd)
  * @scmd:       SCSI command structure to hijack
  * @ses:        structure to save restore information
  * @cmnd:       CDB to send. Can be NULL if no new cmnd is needed
- * @cmnd_size:  size in bytes of @cmnd
+ * @cmnd_size:  size in bytes of @cmnd (must be <= BLK_MAX_CDB)
  * @sense_bytes: size of sense data to copy. or 0 (if != 0 @cmnd is ignored)
  *
  * This function is used to save a scsi command information before re-execution
@@ -648,12 +648,14 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
          * command.
          */
         ses->cmd_len = scmd->cmd_len;
-        memcpy(ses->cmnd, scmd->cmnd, sizeof(scmd->cmnd));
+        ses->cmnd = scmd->cmnd;
         ses->data_direction = scmd->sc_data_direction;
         ses->sdb = scmd->sdb;
         ses->next_rq = scmd->request->next_rq;
         ses->result = scmd->result;
 
+        scmd->cmnd = ses->eh_cmnd;
+        memset(scmd->cmnd, 0, BLK_MAX_CDB);
         memset(&scmd->sdb, 0, sizeof(scmd->sdb));
         scmd->request->next_rq = NULL;
 
@@ -665,14 +667,13 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
                 scmd->sdb.table.sgl = &ses->sense_sgl;
                 scmd->sc_data_direction = DMA_FROM_DEVICE;
                 scmd->sdb.table.nents = 1;
-                memset(scmd->cmnd, 0, sizeof(scmd->cmnd));
                 scmd->cmnd[0] = REQUEST_SENSE;
                 scmd->cmnd[4] = scmd->sdb.length;
                 scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
         } else {
                 scmd->sc_data_direction = DMA_NONE;
                 if (cmnd) {
-                        memset(scmd->cmnd, 0, sizeof(scmd->cmnd));
+                        BUG_ON(cmnd_size > BLK_MAX_CDB);
                         memcpy(scmd->cmnd, cmnd, cmnd_size);
                         scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
                 }
@@ -705,7 +706,7 @@ void scsi_eh_restore_cmnd(struct scsi_cmnd* scmd, struct scsi_eh_save *ses)
          * Restore original data
          */
         scmd->cmd_len = ses->cmd_len;
-        memcpy(scmd->cmnd, ses->cmnd, sizeof(scmd->cmnd));
+        scmd->cmnd = ses->cmnd;
         scmd->sc_data_direction = ses->data_direction;
         scmd->sdb = ses->sdb;
         scmd->request->next_rq = ses->next_rq;
@@ -1775,8 +1776,8 @@ scsi_reset_provider(struct scsi_device *dev, int flag)
         scmd->request = &req;
         memset(&scmd->eh_timeout, 0, sizeof(scmd->eh_timeout));
 
-        memset(&scmd->cmnd, '\0', sizeof(scmd->cmnd));
-    
+        scmd->cmnd = req.cmd;
+
         scmd->scsi_done         = scsi_reset_provider_done_command;
         memset(&scmd->sdb, 0, sizeof(scmd->sdb));
 
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index d545ad1cf47..a82d2fe80fb 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -445,7 +445,7 @@ static void scsi_init_cmd_errh(struct scsi_cmnd *cmd)
         scsi_set_resid(cmd, 0);
         memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
         if (cmd->cmd_len == 0)
-                cmd->cmd_len = COMMAND_SIZE(cmd->cmnd[0]);
+                cmd->cmd_len = scsi_command_size(cmd->cmnd);
 }
 
 void scsi_device_unbusy(struct scsi_device *sdev)
@@ -1094,6 +1094,8 @@ static struct scsi_cmnd *scsi_get_cmd_from_req(struct scsi_device *sdev,
         cmd->tag = req->tag;
         cmd->request = req;
 
+        cmd->cmnd = req->cmd;
+
         return cmd;
 }
 
@@ -1131,8 +1133,6 @@ int scsi_setup_blk_pc_cmnd(struct scsi_device *sdev, struct request *req)
                 req->buffer = NULL;
         }
 
-        BUILD_BUG_ON(sizeof(req->cmd) > sizeof(cmd->cmnd));
-        memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd));
         cmd->cmd_len = req->cmd_len;
         if (!req->data_len)
                 cmd->sc_data_direction = DMA_NONE;
@@ -1169,6 +1169,7 @@ int scsi_setup_fs_cmnd(struct scsi_device *sdev, struct request *req)
         if (unlikely(!cmd))
                 return BLKPREP_DEFER;
 
+        memset(cmd->cmnd, 0, BLK_MAX_CDB);
         return scsi_init_io(cmd, GFP_ATOMIC);
 }
 EXPORT_SYMBOL(scsi_setup_fs_cmnd);
diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
index ee8496aa033..257e097c39a 100644
--- a/drivers/scsi/scsi_tgt_lib.c
+++ b/drivers/scsi/scsi_tgt_lib.c
@@ -107,6 +107,8 @@ struct scsi_cmnd *scsi_host_get_command(struct Scsi_Host *shost,
         cmd->jiffies_at_alloc = jiffies;
         cmd->request = rq;
 
+        cmd->cmnd = rq->cmd;
+
         rq->special = cmd;
         rq->cmd_type = REQ_TYPE_SPECIAL;
         rq->cmd_flags |= REQ_TYPE_BLOCK_PC;
diff --git a/drivers/scsi/u14-34f.c b/drivers/scsi/u14-34f.c
index 640333b1e75..329eb8780e7 100644
--- a/drivers/scsi/u14-34f.c
+++ b/drivers/scsi/u14-34f.c
@@ -744,7 +744,8 @@ static int wait_on_busy(unsigned long iobase, unsigned int loop) {
 static int board_inquiry(unsigned int j) {
    struct mscp *cpp;
    dma_addr_t id_dma_addr;
-   unsigned int time, limit = 0;
+   unsigned int limit = 0;
+   unsigned long time;
 
    id_dma_addr = pci_map_single(HD(j)->pdev, HD(j)->board_id,
                     sizeof(HD(j)->board_id), PCI_DMA_BIDIRECTIONAL);
@@ -1392,7 +1393,8 @@ static int u14_34f_eh_abort(struct scsi_cmnd *SCarg) {
 }
 
 static int u14_34f_eh_host_reset(struct scsi_cmnd *SCarg) {
-   unsigned int i, j, time, k, c, limit = 0;
+   unsigned int i, j, k, c, limit = 0;
+   unsigned long time;
    int arg_done = FALSE;
    struct scsi_cmnd *SCpnt;
 
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index ea41f262645..a1ca9b7bf2d 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -2271,7 +2271,8 @@ static int serial8250_request_std_resource(struct uart_8250_port *up)
                 }
 
                 if (up->port.flags & UPF_IOREMAP) {
-                        up->port.membase = ioremap(up->port.mapbase, size);
+                        up->port.membase = ioremap_nocache(up->port.mapbase,
+                                                                        size);
                         if (!up->port.membase) {
                                 release_mem_region(up->port.mapbase, size);
                                 ret = -ENOMEM;
diff --git a/drivers/serial/8250_early.c b/drivers/serial/8250_early.c
index cd898704ba4..f279745e9fe 100644
--- a/drivers/serial/8250_early.c
+++ b/drivers/serial/8250_early.c
@@ -153,7 +153,7 @@ static int __init parse_options(struct early_serial8250_device *device,
                         (void __iomem *)__fix_to_virt(FIX_EARLYCON_MEM_BASE);
                 port->membase += port->mapbase & ~PAGE_MASK;
 #else
-                port->membase = ioremap(port->mapbase, 64);
+                port->membase = ioremap_nocache(port->mapbase, 64);
                 if (!port->membase) {
                         printk(KERN_ERR "%s: Couldn't ioremap 0x%llx\n",
                                 __func__,
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index 6e57382b913..53fa19cf2f0 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -86,7 +86,7 @@ setup_port(struct serial_private *priv, struct uart_port *port,
                 len =  pci_resource_len(dev, bar);
 
                 if (!priv->remapped_bar[bar])
-                        priv->remapped_bar[bar] = ioremap(base, len);
+                        priv->remapped_bar[bar] = ioremap_nocache(base, len);
                 if (!priv->remapped_bar[bar])
                         return -ENOMEM;
 
@@ -270,7 +270,7 @@ static int pci_plx9050_init(struct pci_dev *dev)
         /*
          * enable/disable interrupts
          */
-        p = ioremap(pci_resource_start(dev, 0), 0x80);
+        p = ioremap_nocache(pci_resource_start(dev, 0), 0x80);
         if (p == NULL)
                 return -ENOMEM;
         writel(irq_config, p + 0x4c);
@@ -294,7 +294,7 @@ static void __devexit pci_plx9050_exit(struct pci_dev *dev)
         /*
          * disable interrupts
          */
-        p = ioremap(pci_resource_start(dev, 0), 0x80);
+        p = ioremap_nocache(pci_resource_start(dev, 0), 0x80);
         if (p != NULL) {
                 writel(0, p + 0x4c);
 
@@ -341,7 +341,8 @@ static int sbs_init(struct pci_dev *dev)
 {
         u8 __iomem *p;
 
-        p = ioremap(pci_resource_start(dev, 0), pci_resource_len(dev, 0));
+        p = ioremap_nocache(pci_resource_start(dev, 0),
+                                                pci_resource_len(dev, 0));
 
         if (p == NULL)
                 return -ENOMEM;
@@ -365,7 +366,8 @@ static void __devexit sbs_exit(struct pci_dev *dev)
 {
         u8 __iomem *p;
 
-        p = ioremap(pci_resource_start(dev, 0), pci_resource_len(dev, 0));
+        p = ioremap_nocache(pci_resource_start(dev, 0),
+                                        pci_resource_len(dev, 0));
         /* FIXME: What if resource_len < OCT_REG_CR_OFF */
         if (p != NULL)
                 writeb(0, p + OCT_REG_CR_OFF);
@@ -419,7 +421,7 @@ static int pci_siig10x_init(struct pci_dev *dev)
                 break;
         }
 
-        p = ioremap(pci_resource_start(dev, 0), 0x80);
+        p = ioremap_nocache(pci_resource_start(dev, 0), 0x80);
         if (p == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/serial/bfin_5xx.c b/drivers/serial/bfin_5xx.c
index 8a2f6a1baa7..d6b4ead693b 100644
--- a/drivers/serial/bfin_5xx.c
+++ b/drivers/serial/bfin_5xx.c
@@ -65,9 +65,6 @@ static void bfin_serial_stop_tx(struct uart_port *port)
 {
         struct bfin_serial_port *uart = (struct bfin_serial_port *)port;
         struct circ_buf *xmit = &uart->port.info->xmit;
-#if !defined(CONFIG_BF54x) && !defined(CONFIG_SERIAL_BFIN_DMA)
-        unsigned short ier;
-#endif
 
         while (!(UART_GET_LSR(uart) & TEMT))
                 cpu_relax();
@@ -82,12 +79,8 @@ static void bfin_serial_stop_tx(struct uart_port *port)
 #ifdef CONFIG_BF54x
         /* Clear TFI bit */
         UART_PUT_LSR(uart, TFI);
-        UART_CLEAR_IER(uart, ETBEI);
-#else
-        ier = UART_GET_IER(uart);
-        ier &= ~ETBEI;
-        UART_PUT_IER(uart, ier);
 #endif
+        UART_CLEAR_IER(uart, ETBEI);
 #endif
 }
 
@@ -102,14 +95,7 @@ static void bfin_serial_start_tx(struct uart_port *port)
         if (uart->tx_done)
                 bfin_serial_dma_tx_chars(uart);
 #else
-#ifdef CONFIG_BF54x
         UART_SET_IER(uart, ETBEI);
-#else
-        unsigned short ier;
-        ier = UART_GET_IER(uart);
-        ier |= ETBEI;
-        UART_PUT_IER(uart, ier);
-#endif
         bfin_serial_tx_chars(uart);
 #endif
 }
@@ -120,21 +106,10 @@ static void bfin_serial_start_tx(struct uart_port *port)
 static void bfin_serial_stop_rx(struct uart_port *port)
 {
         struct bfin_serial_port *uart = (struct bfin_serial_port *)port;
-#ifdef  CONFIG_KGDB_UART
-        if (uart->port.line != CONFIG_KGDB_UART_PORT) {
+#ifdef CONFIG_KGDB_UART
+        if (uart->port.line != CONFIG_KGDB_UART_PORT)
 #endif
-#ifdef CONFIG_BF54x
         UART_CLEAR_IER(uart, ERBFI);
-#else
-        unsigned short ier;
-
-        ier = UART_GET_IER(uart);
-        ier &= ~ERBFI;
-        UART_PUT_IER(uart, ier);
-#endif
-#ifdef  CONFIG_KGDB_UART
-        }
-#endif
 }
 
 /*
@@ -161,10 +136,7 @@ void kgdb_put_debug_char(int chr)
                 SSYNC();
         }
 
-#ifndef CONFIG_BF54x
-        UART_PUT_LCR(uart, UART_GET_LCR(uart)&(~DLAB));
-        SSYNC();
-#endif
+        UART_CLEAR_DLAB(uart);
         UART_PUT_CHAR(uart, (unsigned char)chr);
         SSYNC();
 }
@@ -183,10 +155,7 @@ int kgdb_get_debug_char(void)
         while(!(UART_GET_LSR(uart) & DR)) {
                 SSYNC();
         }
-#ifndef CONFIG_BF54x
-        UART_PUT_LCR(uart, UART_GET_LCR(uart)&(~DLAB));
-        SSYNC();
-#endif
+        UART_CLEAR_DLAB(uart);
         chr = UART_GET_CHAR(uart);
         SSYNC();
 
@@ -208,9 +177,6 @@ static void bfin_serial_rx_chars(struct bfin_serial_port *uart)
         struct tty_struct *tty = uart->port.info->tty;
         unsigned int status, ch, flg;
         static struct timeval anomaly_start = { .tv_sec = 0 };
-#ifdef CONFIG_KGDB_UART
-        struct pt_regs *regs = get_irq_regs();
-#endif
 
         status = UART_GET_LSR(uart);
         UART_CLEAR_LSR(uart);
@@ -220,6 +186,7 @@ static void bfin_serial_rx_chars(struct bfin_serial_port *uart)
 
 #ifdef CONFIG_KGDB_UART
         if (uart->port.line == CONFIG_KGDB_UART_PORT) {
+                struct pt_regs *regs = get_irq_regs();
                 if (uart->port.cons->index == CONFIG_KGDB_UART_PORT && ch == 0x1) { /* Ctrl + A */
                         kgdb_breakkey_pressed(regs);
                         return;
@@ -391,7 +358,6 @@ static void bfin_serial_do_work(struct work_struct *work)
 static void bfin_serial_dma_tx_chars(struct bfin_serial_port *uart)
 {
         struct circ_buf *xmit = &uart->port.info->xmit;
-        unsigned short ier;
 
         uart->tx_done = 0;
 
@@ -429,13 +395,7 @@ static void bfin_serial_dma_tx_chars(struct bfin_serial_port *uart)
         set_dma_x_modify(uart->tx_dma_channel, 1);
         enable_dma(uart->tx_dma_channel);
 
-#ifdef CONFIG_BF54x
         UART_SET_IER(uart, ETBEI);
-#else
-        ier = UART_GET_IER(uart);
-        ier |= ETBEI;
-        UART_PUT_IER(uart, ier);
-#endif
 }
 
 static void bfin_serial_dma_rx_chars(struct bfin_serial_port *uart)
@@ -513,19 +473,12 @@ static irqreturn_t bfin_serial_dma_tx_int(int irq, void *dev_id)
 {
         struct bfin_serial_port *uart = dev_id;
         struct circ_buf *xmit = &uart->port.info->xmit;
-        unsigned short ier;
 
         spin_lock(&uart->port.lock);
         if (!(get_dma_curr_irqstat(uart->tx_dma_channel)&DMA_RUN)) {
                 disable_dma(uart->tx_dma_channel);
                 clear_dma_irqstat(uart->tx_dma_channel);
-#ifdef CONFIG_BF54x
                 UART_CLEAR_IER(uart, ETBEI);
-#else
-                ier = UART_GET_IER(uart);
-                ier &= ~ETBEI;
-                UART_PUT_IER(uart, ier);
-#endif
                 xmit->tail = (xmit->tail + uart->tx_count) & (UART_XMIT_SIZE - 1);
                 uart->port.icount.tx += uart->tx_count;
 
@@ -701,7 +654,6 @@ static int bfin_serial_startup(struct uart_port *port)
 # endif
         }
 
-
         if (request_irq
             (uart->port.irq+1, bfin_serial_tx_int, IRQF_DISABLED,
              "BFIN_UART_TX", uart)) {
@@ -710,11 +662,7 @@ static int bfin_serial_startup(struct uart_port *port)
                 return -EBUSY;
         }
 #endif
-#ifdef CONFIG_BF54x
         UART_SET_IER(uart, ERBFI);
-#else
-        UART_PUT_IER(uart, UART_GET_IER(uart) | ERBFI);
-#endif
         return 0;
 }
 
@@ -810,26 +758,15 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
         UART_PUT_IER(uart, 0);
 #endif
 
-#ifndef CONFIG_BF54x
         /* Set DLAB in LCR to Access DLL and DLH */
-        val = UART_GET_LCR(uart);
-        val |= DLAB;
-        UART_PUT_LCR(uart, val);
-        SSYNC();
-#endif
+        UART_SET_DLAB(uart);
 
         UART_PUT_DLL(uart, quot & 0xFF);
-        SSYNC();
         UART_PUT_DLH(uart, (quot >> 8) & 0xFF);
         SSYNC();
 
-#ifndef CONFIG_BF54x
         /* Clear DLAB in LCR to Access THR RBR IER */
-        val = UART_GET_LCR(uart);
-        val &= ~DLAB;
-        UART_PUT_LCR(uart, val);
-        SSYNC();
-#endif
+        UART_CLEAR_DLAB(uart);
 
         UART_PUT_LCR(uart, lcr);
 
@@ -992,8 +929,7 @@ bfin_serial_console_get_options(struct bfin_serial_port *uart, int *baud,
         status = UART_GET_IER(uart) & (ERBFI | ETBEI);
         if (status == (ERBFI | ETBEI)) {
                 /* ok, the port was enabled */
-                unsigned short lcr, val;
-                unsigned short dlh, dll;
+                u16 lcr, dlh, dll;
 
                 lcr = UART_GET_LCR(uart);
 
@@ -1010,22 +946,14 @@ bfin_serial_console_get_options(struct bfin_serial_port *uart, int *baud,
                         case 2: *bits = 7; break;
                         case 3: *bits = 8; break;
                 }
-#ifndef CONFIG_BF54x
                 /* Set DLAB in LCR to Access DLL and DLH */
-                val = UART_GET_LCR(uart);
-                val |= DLAB;
-                UART_PUT_LCR(uart, val);
-#endif
+                UART_SET_DLAB(uart);
 
                 dll = UART_GET_DLL(uart);
                 dlh = UART_GET_DLH(uart);
 
-#ifndef CONFIG_BF54x
                 /* Clear DLAB in LCR to Access THR RBR IER */
-                val = UART_GET_LCR(uart);
-                val &= ~DLAB;
-                UART_PUT_LCR(uart, val);
-#endif
+                UART_CLEAR_DLAB(uart);
 
                 *baud = get_sclk() / (16*(dll | dlh << 8));
         }
@@ -1290,11 +1218,7 @@ static int __init bfin_serial_init(void)
                 request_irq(uart->port.irq, bfin_serial_rx_int,
                         IRQF_DISABLED, "BFIN_UART_RX", uart);
                 pr_info("Request irq for kgdb uart port\n");
-#ifdef CONFIG_BF54x
                 UART_SET_IER(uart, ERBFI);
-#else
-                UART_PUT_IER(uart, UART_GET_IER(uart) | ERBFI);
-#endif
                 SSYNC();
                 t.c_cflag = CS8|B57600;
                 t.c_iflag = 0;
diff --git a/drivers/serial/crisv10.c b/drivers/serial/crisv10.c
index f9fa237aa94..3e0366eab41 100644
--- a/drivers/serial/crisv10.c
+++ b/drivers/serial/crisv10.c
@@ -3808,7 +3808,7 @@ rs_close(struct tty_struct *tty, struct file * filp)
 
         shutdown(info);
         rs_flush_buffer(tty);
-        tty_ldisc_flush_buffer(tty);
+        tty_ldisc_flush(tty);
         tty->closing = 0;
         info->event = 0;
         info->tty = 0;
diff --git a/drivers/serial/jsm/jsm.h b/drivers/serial/jsm/jsm.h
index 12c934a1f27..8871aaa3dba 100644
--- a/drivers/serial/jsm/jsm.h
+++ b/drivers/serial/jsm/jsm.h
@@ -373,6 +373,7 @@ struct neo_uart_struct {
 #define PCI_DEVICE_NEO_2DB9PRI_PCI_NAME         "Neo 2 - DB9 Universal PCI - Powered Ring Indicator"
 #define PCI_DEVICE_NEO_2RJ45_PCI_NAME           "Neo 2 - RJ45 Universal PCI"
 #define PCI_DEVICE_NEO_2RJ45PRI_PCI_NAME        "Neo 2 - RJ45 Universal PCI - Powered Ring Indicator"
+#define PCIE_DEVICE_NEO_IBM_PCI_NAME            "Neo 4 - PCI Express - IBM"
 
 /*
  * Our Global Variables.
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/serial/jsm/jsm_driver.c
index 6767ee381cd..338cf8a08b4 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/serial/jsm/jsm_driver.c
@@ -82,7 +82,10 @@ static int jsm_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         /* store the info for the board we've found */
         brd->boardnum = adapter_count++;
         brd->pci_dev = pdev;
-        brd->maxports = 2;
+        if (pdev->device == PCIE_DEVICE_ID_NEO_4_IBM)
+                brd->maxports = 4;
+        else
+                brd->maxports = 2;
 
         spin_lock_init(&brd->bd_lock);
         spin_lock_init(&brd->bd_intr_lock);
@@ -208,6 +211,7 @@ static struct pci_device_id jsm_pci_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2DB9PRI), 0, 0, 1 },
         { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2RJ45), 0, 0, 2 },
         { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_NEO_2RJ45PRI), 0, 0, 3 },
+        { PCI_DEVICE(PCI_VENDOR_ID_DIGI, PCIE_DEVICE_ID_NEO_4_IBM), 0, 0, 4 },
         { 0, }
 };
 MODULE_DEVICE_TABLE(pci, jsm_pci_tbl);
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 7a3625f52a0..efc971d9647 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -783,7 +783,9 @@ mpc52xx_uart_int_rx_chars(struct uart_port *port)
                 }
         }
 
+        spin_unlock(&port->lock);
         tty_flip_buffer_push(tty);
+        spin_lock(&port->lock);
 
         return psc_ops->raw_rx_rdy(port);
 }
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index 1e2b9d826f6..eab03273379 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -556,7 +556,7 @@ static int uart_chars_in_buffer(struct tty_struct *tty)
 static void uart_flush_buffer(struct tty_struct *tty)
 {
         struct uart_state *state = tty->driver_data;
-        struct uart_port *port = state->port;
+        struct uart_port *port;
         unsigned long flags;
 
         /*
@@ -568,6 +568,7 @@ static void uart_flush_buffer(struct tty_struct *tty)
                 return;
         }
 
+        port = state->port;
         pr_debug("uart_flush_buffer(%d) called\n", tty->index);
 
         spin_lock_irqsave(&port->lock, flags);
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 96910618771..8fdafc27fce 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -42,14 +42,12 @@
 #include <linux/console.h>
 #include <linux/platform_device.h>
 #include <linux/serial_sci.h>
-
-#ifdef CONFIG_CPU_FREQ
 #include <linux/notifier.h>
 #include <linux/cpufreq.h>
-#endif
-
-#if defined(CONFIG_SUPERH) && !defined(CONFIG_SUPERH64)
+#include <linux/clk.h>
 #include <linux/ctype.h>
+
+#ifdef CONFIG_SUPERH
 #include <asm/clock.h>
 #include <asm/sh_bios.h>
 #include <asm/kgdb.h>
@@ -80,7 +78,7 @@ struct sci_port {
         struct timer_list       break_timer;
         int                     break_flag;
 
-#if defined(CONFIG_SUPERH) && !defined(CONFIG_SUPERH64)
+#ifdef CONFIG_SUPERH
         /* Port clock */
         struct clk              *clk;
 #endif
@@ -365,21 +363,19 @@ static void sci_init_pins_scif(struct uart_port *port, unsigned int cflag)
 static void sci_init_pins_scif(struct uart_port *port, unsigned int cflag)
 {
         unsigned int fcr_val = 0;
+        unsigned short data;
 
-        if (cflag & CRTSCTS) {
-                fcr_val |= SCFCR_MCE;
-
-                ctrl_outw(0x0000, PORT_PSCR);
-        } else {
-                unsigned short data;
-
-                data = ctrl_inw(PORT_PSCR);
-                data &= 0x033f;
-                data |= 0x0400;
-                ctrl_outw(data, PORT_PSCR);
+        if (port->mapbase == 0xffe00000) {
+                data = ctrl_inw(PSCR);
+                data &= ~0x03cf;
+                if (cflag & CRTSCTS)
+                        fcr_val |= SCFCR_MCE;
+                else
+                        data |= 0x0340;
 
-                ctrl_outw(ctrl_inw(SCSPTR0) & 0x17, SCSPTR0);
+                ctrl_outw(data, PSCR);
         }
+        /* SCIF1 and SCIF2 should be setup by board code */
 
         sci_out(port, SCFCR, fcr_val);
 }
diff --git a/drivers/serial/sh-sci.h b/drivers/serial/sh-sci.h
index fa8700a968f..eb84833233f 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/serial/sh-sci.h
@@ -76,12 +76,13 @@
 # define SCSCR_INIT(port) 0x32  /* TIE=0,RIE=0,TE=1,RE=1,REIE=0,CKE=1 */
 # define SCIF_ONLY
 #elif defined(CONFIG_CPU_SUBTYPE_SH7722)
-# define SCPDR0                 0xA405013E      /* 16 bit SCIF0 PSDR */
-# define SCSPTR0                SCPDR0
+# define PADR                   0xA4050120
+# define PSDR                   0xA405013e
+# define PWDR                   0xA4050166
+# define PSCR                   0xA405011E
 # define SCIF_ORER              0x0001  /* overrun error bit */
 # define SCSCR_INIT(port)       0x0038  /* TIE=0,RIE=0,TE=1,RE=1,REIE=1 */
 # define SCIF_ONLY
-# define PORT_PSCR              0xA405011E
 #elif defined(CONFIG_CPU_SUBTYPE_SH7366)
 # define SCPDR0                 0xA405013E      /* 16 bit SCIF0 PSDR */
 # define SCSPTR0                SCPDR0
@@ -320,7 +321,7 @@
   unsigned int addr = port->mapbase + (offset);                 \
   if ((size) == 8) {                                            \
     ctrl_outb(value, addr);                                     \
-  } else {                                                      \
+  } else if ((size) == 16) {                                    \
     ctrl_outw(value, addr);                                     \
   }
 
@@ -451,7 +452,11 @@ SCIF_FNS(SCSPTR,			0,  0, 0x24, 16)
 SCIF_FNS(SCLSR,                         0,  0, 0x28, 16)
 #else
 SCIF_FNS(SCFDR,                      0x0e, 16, 0x1C, 16)
+#if defined(CONFIG_CPU_SUBTYPE_SH7722)
+SCIF_FNS(SCSPTR,                        0,  0, 0, 0)
+#else
 SCIF_FNS(SCSPTR,                        0,  0, 0x20, 16)
+#endif
 SCIF_FNS(SCLSR,                         0,  0, 0x24, 16)
 #endif
 #endif
@@ -593,13 +598,25 @@ static inline int sci_rxd_in(struct uart_port *port)
                 return ctrl_inw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
         return 1;
 }
-#elif defined(CONFIG_CPU_SUBTYPE_SH7722) || defined(CONFIG_CPU_SUBTYPE_SH7366)
+#elif defined(CONFIG_CPU_SUBTYPE_SH7366)
 static inline int sci_rxd_in(struct uart_port *port)
 {
         if (port->mapbase == 0xffe00000)
                 return ctrl_inb(SCPDR0) & 0x0001 ? 1 : 0; /* SCIF0 */
         return 1;
 }
+#elif defined(CONFIG_CPU_SUBTYPE_SH7722)
+static inline int sci_rxd_in(struct uart_port *port)
+{
+        if (port->mapbase == 0xffe00000)
+                return ctrl_inb(PSDR) & 0x02 ? 1 : 0; /* SCIF0 */
+        if (port->mapbase == 0xffe10000)
+                return ctrl_inb(PADR) & 0x40 ? 1 : 0; /* SCIF1 */
+        if (port->mapbase == 0xffe20000)
+                return ctrl_inb(PWDR) & 0x04 ? 1 : 0; /* SCIF2 */
+
+        return 1;
+}
 #elif defined(CONFIG_CPU_SUBTYPE_SH7723)
 static inline int sci_rxd_in(struct uart_port *port)
 {
diff --git a/drivers/serial/sunhv.c b/drivers/serial/sunhv.c
index be0fe152891..145c0281495 100644
--- a/drivers/serial/sunhv.c
+++ b/drivers/serial/sunhv.c
@@ -392,7 +392,7 @@ static struct uart_ops sunhv_pops = {
 
 static struct uart_driver sunhv_reg = {
         .owner                  = THIS_MODULE,
-        .driver_name            = "serial",
+        .driver_name            = "sunhv",
         .dev_name               = "ttyS",
         .major                  = TTY_MAJOR,
 };
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index 543f93741e6..9ff5b38f3be 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -826,7 +826,7 @@ static struct uart_ops sunsab_pops = {
 
 static struct uart_driver sunsab_reg = {
         .owner                  = THIS_MODULE,
-        .driver_name            = "serial",
+        .driver_name            = "sunsab",
         .dev_name               = "ttyS",
         .major                  = TTY_MAJOR,
 };
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index 4e2302d43ab..03806a93520 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -1173,7 +1173,7 @@ out:
 
 static struct uart_driver sunsu_reg = {
         .owner                  = THIS_MODULE,
-        .driver_name            = "serial",
+        .driver_name            = "sunsu",
         .dev_name               = "ttyS",
         .major                  = TTY_MAJOR,
 };
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index 90a20a152eb..7e9fa5ef0eb 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -1023,7 +1023,7 @@ static struct uart_sunzilog_port *sunzilog_irq_chain;
 
 static struct uart_driver sunzilog_reg = {
         .owner          =       THIS_MODULE,
-        .driver_name    =       "ttyS",
+        .driver_name    =       "sunzilog",
         .dev_name       =       "ttyS",
         .major          =       TTY_MAJOR,
 };
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index fae9e8f3d09..66ec5d8808d 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -126,7 +126,6 @@ config SPI_MPC52xx_PSC
 config SPI_MPC83xx
         tristate "Freescale MPC83xx/QUICC Engine SPI controller"
         depends on SPI_MASTER && (PPC_83xx || QUICC_ENGINE) && EXPERIMENTAL
-        select SPI_BITBANG
         help
           This enables using the Freescale MPC83xx and QUICC Engine SPI
           controllers in master mode.
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 654bb58be63..0c452c46ab0 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1567,7 +1567,7 @@ static int pxa2xx_spi_resume(struct platform_device *pdev)
         int status = 0;
 
         /* Enable the SSP clock */
-        clk_disable(ssp->clk);
+        clk_enable(ssp->clk);
 
         /* Start the queue running */
         status = start_queue(drv_data);
diff --git a/drivers/spi/spi_bfin5xx.c b/drivers/spi/spi_bfin5xx.c
index a9ac1fdb309..7fea3cf4588 100644
--- a/drivers/spi/spi_bfin5xx.c
+++ b/drivers/spi/spi_bfin5xx.c
@@ -608,6 +608,7 @@ static void pump_transfers(unsigned long data)
         u8 width;
         u16 cr, dma_width, dma_config;
         u32 tranf_success = 1;
+        u8 full_duplex = 0;
 
         /* Get current state information */
         message = drv_data->cur_msg;
@@ -658,6 +659,7 @@ static void pump_transfers(unsigned long data)
         }
 
         if (transfer->rx_buf != NULL) {
+                full_duplex = transfer->tx_buf != NULL;
                 drv_data->rx = transfer->rx_buf;
                 drv_data->rx_end = drv_data->rx + transfer->len;
                 dev_dbg(&drv_data->pdev->dev, "rx_buf is %p, rx_end is %p\n",
@@ -740,7 +742,8 @@ static void pump_transfers(unsigned long data)
          * successful use different way to r/w according to
          * drv_data->cur_chip->enable_dma
          */
-        if (drv_data->cur_chip->enable_dma && drv_data->len > 6) {
+        if (!full_duplex && drv_data->cur_chip->enable_dma
+                                && drv_data->len > 6) {
 
                 disable_dma(drv_data->dma_channel);
                 clear_dma_irqstat(drv_data->dma_channel);
@@ -828,7 +831,7 @@ static void pump_transfers(unsigned long data)
                 /* IO mode write then read */
                 dev_dbg(&drv_data->pdev->dev, "doing IO transfer\n");
 
-                if (drv_data->tx != NULL && drv_data->rx != NULL) {
+                if (full_duplex) {
                         /* full duplex mode */
                         BUG_ON((drv_data->tx_end - drv_data->tx) !=
                                (drv_data->rx_end - drv_data->rx));
diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c
index 189f706b9e4..6832da6f710 100644
--- a/drivers/spi/spi_mpc83xx.c
+++ b/drivers/spi/spi_mpc83xx.c
@@ -49,6 +49,7 @@ struct mpc83xx_spi_reg {
 #define SPMODE_LEN(x)           ((x) << 20)
 #define SPMODE_PM(x)            ((x) << 16)
 #define SPMODE_OP               (1 << 14)
+#define SPMODE_CG(x)            ((x) << 7)
 
 /*
  * Default for SPI Mode:
@@ -67,10 +68,6 @@ struct mpc83xx_spi_reg {
 
 /* SPI Controller driver's private data. */
 struct mpc83xx_spi {
-        /* bitbang has to be first */
-        struct spi_bitbang bitbang;
-        struct completion done;
-
         struct mpc83xx_spi_reg __iomem *base;
 
         /* rx & tx bufs from the spi_transfer */
@@ -82,7 +79,7 @@ struct mpc83xx_spi {
         u32(*get_tx) (struct mpc83xx_spi *);
 
         unsigned int count;
-        u32 irq;
+        int irq;
 
         unsigned nsecs;         /* (clock cycle time)/2 */
 
@@ -94,6 +91,25 @@ struct mpc83xx_spi {
 
         void (*activate_cs) (u8 cs, u8 polarity);
         void (*deactivate_cs) (u8 cs, u8 polarity);
+
+        u8 busy;
+
+        struct workqueue_struct *workqueue;
+        struct work_struct work;
+
+        struct list_head queue;
+        spinlock_t lock;
+
+        struct completion done;
+};
+
+struct spi_mpc83xx_cs {
+        /* functions to deal with different sized buffers */
+        void (*get_rx) (u32 rx_data, struct mpc83xx_spi *);
+        u32 (*get_tx) (struct mpc83xx_spi *);
+        u32 rx_shift;           /* RX data reg shift when in qe mode */
+        u32 tx_shift;           /* TX data reg shift when in qe mode */
+        u32 hw_mode;            /* Holds HW mode register settings */
 };
 
 static inline void mpc83xx_spi_write_reg(__be32 __iomem * reg, u32 val)
@@ -137,6 +153,7 @@ static void mpc83xx_spi_chipselect(struct spi_device *spi, int value)
 {
         struct mpc83xx_spi *mpc83xx_spi;
         u8 pol = spi->mode & SPI_CS_HIGH ? 1 : 0;
+        struct spi_mpc83xx_cs   *cs = spi->controller_state;
 
         mpc83xx_spi = spi_master_get_devdata(spi->master);
 
@@ -147,50 +164,26 @@ static void mpc83xx_spi_chipselect(struct spi_device *spi, int value)
 
         if (value == BITBANG_CS_ACTIVE) {
                 u32 regval = mpc83xx_spi_read_reg(&mpc83xx_spi->base->mode);
-                u32 len = spi->bits_per_word;
-                u8 pm;
 
-                if (len == 32)
-                        len = 0;
-                else
-                        len = len - 1;
-
-                /* mask out bits we are going to set */
-                regval &= ~(SPMODE_CP_BEGIN_EDGECLK | SPMODE_CI_INACTIVEHIGH
-                                | SPMODE_LEN(0xF) | SPMODE_DIV16
-                                | SPMODE_PM(0xF) | SPMODE_REV | SPMODE_LOOP);
-
-                if (spi->mode & SPI_CPHA)
-                        regval |= SPMODE_CP_BEGIN_EDGECLK;
-                if (spi->mode & SPI_CPOL)
-                        regval |= SPMODE_CI_INACTIVEHIGH;
-                if (!(spi->mode & SPI_LSB_FIRST))
-                        regval |= SPMODE_REV;
-                if (spi->mode & SPI_LOOP)
-                        regval |= SPMODE_LOOP;
-
-                regval |= SPMODE_LEN(len);
-
-                if ((mpc83xx_spi->spibrg / spi->max_speed_hz) >= 64) {
-                        pm = mpc83xx_spi->spibrg / (spi->max_speed_hz * 64) - 1;
-                        if (pm > 0x0f) {
-                                dev_err(&spi->dev, "Requested speed is too "
-                                        "low: %d Hz. Will use %d Hz instead.\n",
-                                        spi->max_speed_hz,
-                                        mpc83xx_spi->spibrg / 1024);
-                                pm = 0x0f;
-                        }
-                        regval |= SPMODE_PM(pm) | SPMODE_DIV16;
-                } else {
-                        pm = mpc83xx_spi->spibrg / (spi->max_speed_hz * 4);
-                        if (pm)
-                                pm--;
-                        regval |= SPMODE_PM(pm);
+                mpc83xx_spi->rx_shift = cs->rx_shift;
+                mpc83xx_spi->tx_shift = cs->tx_shift;
+                mpc83xx_spi->get_rx = cs->get_rx;
+                mpc83xx_spi->get_tx = cs->get_tx;
+
+                if (cs->hw_mode != regval) {
+                        unsigned long flags;
+                        void *tmp_ptr = &mpc83xx_spi->base->mode;
+
+                        regval = cs->hw_mode;
+                        /* Turn off IRQs locally to minimize time that
+                         * SPI is disabled
+                         */
+                        local_irq_save(flags);
+                        /* Turn off SPI unit prior changing mode */
+                        mpc83xx_spi_write_reg(tmp_ptr, regval & ~SPMODE_ENABLE);
+                        mpc83xx_spi_write_reg(tmp_ptr, regval);
+                        local_irq_restore(flags);
                 }
-
-                /* Turn off SPI unit prior changing mode */
-                mpc83xx_spi_write_reg(&mpc83xx_spi->base->mode, 0);
-                mpc83xx_spi_write_reg(&mpc83xx_spi->base->mode, regval);
                 if (mpc83xx_spi->activate_cs)
                         mpc83xx_spi->activate_cs(spi->chip_select, pol);
         }
@@ -201,8 +194,9 @@ int mpc83xx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
 {
         struct mpc83xx_spi *mpc83xx_spi;
         u32 regval;
-        u8 bits_per_word;
+        u8 bits_per_word, pm;
         u32 hz;
+        struct spi_mpc83xx_cs   *cs = spi->controller_state;
 
         mpc83xx_spi = spi_master_get_devdata(spi->master);
 
@@ -223,61 +217,191 @@ int mpc83xx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
             || ((bits_per_word > 16) && (bits_per_word != 32)))
                 return -EINVAL;
 
-        mpc83xx_spi->rx_shift = 0;
-        mpc83xx_spi->tx_shift = 0;
+        if (!hz)
+                hz = spi->max_speed_hz;
+
+        cs->rx_shift = 0;
+        cs->tx_shift = 0;
         if (bits_per_word <= 8) {
-                mpc83xx_spi->get_rx = mpc83xx_spi_rx_buf_u8;
-                mpc83xx_spi->get_tx = mpc83xx_spi_tx_buf_u8;
+                cs->get_rx = mpc83xx_spi_rx_buf_u8;
+                cs->get_tx = mpc83xx_spi_tx_buf_u8;
                 if (mpc83xx_spi->qe_mode) {
-                        mpc83xx_spi->rx_shift = 16;
-                        mpc83xx_spi->tx_shift = 24;
+                        cs->rx_shift = 16;
+                        cs->tx_shift = 24;
                 }
         } else if (bits_per_word <= 16) {
-                mpc83xx_spi->get_rx = mpc83xx_spi_rx_buf_u16;
-                mpc83xx_spi->get_tx = mpc83xx_spi_tx_buf_u16;
+                cs->get_rx = mpc83xx_spi_rx_buf_u16;
+                cs->get_tx = mpc83xx_spi_tx_buf_u16;
                 if (mpc83xx_spi->qe_mode) {
-                        mpc83xx_spi->rx_shift = 16;
-                        mpc83xx_spi->tx_shift = 16;
+                        cs->rx_shift = 16;
+                        cs->tx_shift = 16;
                 }
         } else if (bits_per_word <= 32) {
-                mpc83xx_spi->get_rx = mpc83xx_spi_rx_buf_u32;
-                mpc83xx_spi->get_tx = mpc83xx_spi_tx_buf_u32;
+                cs->get_rx = mpc83xx_spi_rx_buf_u32;
+                cs->get_tx = mpc83xx_spi_tx_buf_u32;
         } else
                 return -EINVAL;
 
         if (mpc83xx_spi->qe_mode && spi->mode & SPI_LSB_FIRST) {
-                mpc83xx_spi->tx_shift = 0;
+                cs->tx_shift = 0;
                 if (bits_per_word <= 8)
-                        mpc83xx_spi->rx_shift = 8;
+                        cs->rx_shift = 8;
                 else
-                        mpc83xx_spi->rx_shift = 0;
+                        cs->rx_shift = 0;
         }
 
-        /* nsecs = (clock period)/2 */
-        if (!hz)
-                hz = spi->max_speed_hz;
-        mpc83xx_spi->nsecs = (1000000000 / 2) / hz;
-        if (mpc83xx_spi->nsecs > MAX_UDELAY_MS * 1000)
-                return -EINVAL;
+        mpc83xx_spi->rx_shift = cs->rx_shift;
+        mpc83xx_spi->tx_shift = cs->tx_shift;
+        mpc83xx_spi->get_rx = cs->get_rx;
+        mpc83xx_spi->get_tx = cs->get_tx;
 
         if (bits_per_word == 32)
                 bits_per_word = 0;
         else
                 bits_per_word = bits_per_word - 1;
 
-        regval = mpc83xx_spi_read_reg(&mpc83xx_spi->base->mode);
-
         /* mask out bits we are going to set */
-        regval &= ~(SPMODE_LEN(0xF) | SPMODE_REV);
-        regval |= SPMODE_LEN(bits_per_word);
-        if (!(spi->mode & SPI_LSB_FIRST))
-                regval |= SPMODE_REV;
+        cs->hw_mode &= ~(SPMODE_LEN(0xF) | SPMODE_DIV16
+                                  | SPMODE_PM(0xF));
+
+        cs->hw_mode |= SPMODE_LEN(bits_per_word);
+
+        if ((mpc83xx_spi->spibrg / hz) >= 64) {
+                pm = mpc83xx_spi->spibrg / (hz * 64) - 1;
+                if (pm > 0x0f) {
+                        dev_err(&spi->dev, "Requested speed is too "
+                                "low: %d Hz. Will use %d Hz instead.\n",
+                                hz, mpc83xx_spi->spibrg / 1024);
+                        pm = 0x0f;
+                }
+                cs->hw_mode |= SPMODE_PM(pm) | SPMODE_DIV16;
+        } else {
+                pm = mpc83xx_spi->spibrg / (hz * 4);
+                if (pm)
+                        pm--;
+                cs->hw_mode |= SPMODE_PM(pm);
+        }
+        regval =  mpc83xx_spi_read_reg(&mpc83xx_spi->base->mode);
+        if (cs->hw_mode != regval) {
+                unsigned long flags;
+                void *tmp_ptr = &mpc83xx_spi->base->mode;
+
+                regval = cs->hw_mode;
+                /* Turn off IRQs locally to minimize time
+                 * that SPI is disabled
+                 */
+                local_irq_save(flags);
+                /* Turn off SPI unit prior changing mode */
+                mpc83xx_spi_write_reg(tmp_ptr, regval & ~SPMODE_ENABLE);
+                mpc83xx_spi_write_reg(tmp_ptr, regval);
+                local_irq_restore(flags);
+        }
+        return 0;
+}
 
-        /* Turn off SPI unit prior changing mode */
-        mpc83xx_spi_write_reg(&mpc83xx_spi->base->mode, 0);
-        mpc83xx_spi_write_reg(&mpc83xx_spi->base->mode, regval);
+static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
+{
+        struct mpc83xx_spi *mpc83xx_spi;
+        u32 word, len, bits_per_word;
 
-        return 0;
+        mpc83xx_spi = spi_master_get_devdata(spi->master);
+
+        mpc83xx_spi->tx = t->tx_buf;
+        mpc83xx_spi->rx = t->rx_buf;
+        bits_per_word = spi->bits_per_word;
+        if (t->bits_per_word)
+                bits_per_word = t->bits_per_word;
+        len = t->len;
+        if (bits_per_word > 8)
+                len /= 2;
+        if (bits_per_word > 16)
+                len /= 2;
+        mpc83xx_spi->count = len;
+        INIT_COMPLETION(mpc83xx_spi->done);
+
+        /* enable rx ints */
+        mpc83xx_spi_write_reg(&mpc83xx_spi->base->mask, SPIM_NE);
+
+        /* transmit word */
+        word = mpc83xx_spi->get_tx(mpc83xx_spi);
+        mpc83xx_spi_write_reg(&mpc83xx_spi->base->transmit, word);
+
+        wait_for_completion(&mpc83xx_spi->done);
+
+        /* disable rx ints */
+        mpc83xx_spi_write_reg(&mpc83xx_spi->base->mask, 0);
+
+        return mpc83xx_spi->count;
+}
+
+static void mpc83xx_spi_work(struct work_struct *work)
+{
+        struct mpc83xx_spi *mpc83xx_spi =
+                container_of(work, struct mpc83xx_spi, work);
+
+        spin_lock_irq(&mpc83xx_spi->lock);
+        mpc83xx_spi->busy = 1;
+        while (!list_empty(&mpc83xx_spi->queue)) {
+                struct spi_message *m;
+                struct spi_device *spi;
+                struct spi_transfer *t = NULL;
+                unsigned cs_change;
+                int status, nsecs = 50;
+
+                m = container_of(mpc83xx_spi->queue.next,
+                                struct spi_message, queue);
+                list_del_init(&m->queue);
+                spin_unlock_irq(&mpc83xx_spi->lock);
+
+                spi = m->spi;
+                cs_change = 1;
+                status = 0;
+                list_for_each_entry(t, &m->transfers, transfer_list) {
+                        if (t->bits_per_word || t->speed_hz) {
+                                /* Don't allow changes if CS is active */
+                                status = -EINVAL;
+
+                                if (cs_change)
+                                        status = mpc83xx_spi_setup_transfer(spi, t);
+                                if (status < 0)
+                                        break;
+                        }
+
+                        if (cs_change)
+                                mpc83xx_spi_chipselect(spi, BITBANG_CS_ACTIVE);
+                        cs_change = t->cs_change;
+                        if (t->len)
+                                status = mpc83xx_spi_bufs(spi, t);
+                        if (status) {
+                                status = -EMSGSIZE;
+                                break;
+                        }
+                        m->actual_length += t->len;
+
+                        if (t->delay_usecs)
+                                udelay(t->delay_usecs);
+
+                        if (cs_change) {
+                                ndelay(nsecs);
+                                mpc83xx_spi_chipselect(spi, BITBANG_CS_INACTIVE);
+                                ndelay(nsecs);
+                        }
+                }
+
+                m->status = status;
+                m->complete(m->context);
+
+                if (status || !cs_change) {
+                        ndelay(nsecs);
+                        mpc83xx_spi_chipselect(spi, BITBANG_CS_INACTIVE);
+                }
+
+                mpc83xx_spi_setup_transfer(spi, NULL);
+
+                spin_lock_irq(&mpc83xx_spi->lock);
+        }
+        mpc83xx_spi->busy = 0;
+        spin_unlock_irq(&mpc83xx_spi->lock);
 }
 
 /* the spi->mode bits understood by this driver: */
@@ -286,9 +410,10 @@ int mpc83xx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
 
 static int mpc83xx_spi_setup(struct spi_device *spi)
 {
-        struct spi_bitbang *bitbang;
         struct mpc83xx_spi *mpc83xx_spi;
         int retval;
+        u32 hw_mode;
+        struct spi_mpc83xx_cs   *cs = spi->controller_state;
 
         if (spi->mode & ~MODEBITS) {
                 dev_dbg(&spi->dev, "setup: unsupported mode bits %x\n",
@@ -299,63 +424,56 @@ static int mpc83xx_spi_setup(struct spi_device *spi)
         if (!spi->max_speed_hz)
                 return -EINVAL;
 
-        bitbang = spi_master_get_devdata(spi->master);
+        if (!cs) {
+                cs = kzalloc(sizeof *cs, GFP_KERNEL);
+                if (!cs)
+                        return -ENOMEM;
+                spi->controller_state = cs;
+        }
         mpc83xx_spi = spi_master_get_devdata(spi->master);
 
         if (!spi->bits_per_word)
                 spi->bits_per_word = 8;
 
+        hw_mode = cs->hw_mode; /* Save orginal settings */
+        cs->hw_mode = mpc83xx_spi_read_reg(&mpc83xx_spi->base->mode);
+        /* mask out bits we are going to set */
+        cs->hw_mode &= ~(SPMODE_CP_BEGIN_EDGECLK | SPMODE_CI_INACTIVEHIGH
+                         | SPMODE_REV | SPMODE_LOOP);
+
+        if (spi->mode & SPI_CPHA)
+                cs->hw_mode |= SPMODE_CP_BEGIN_EDGECLK;
+        if (spi->mode & SPI_CPOL)
+                cs->hw_mode |= SPMODE_CI_INACTIVEHIGH;
+        if (!(spi->mode & SPI_LSB_FIRST))
+                cs->hw_mode |= SPMODE_REV;
+        if (spi->mode & SPI_LOOP)
+                cs->hw_mode |= SPMODE_LOOP;
+
         retval = mpc83xx_spi_setup_transfer(spi, NULL);
-        if (retval < 0)
+        if (retval < 0) {
+                cs->hw_mode = hw_mode; /* Restore settings */
                 return retval;
+        }
 
-        dev_dbg(&spi->dev, "%s, mode %d, %u bits/w, %u nsec\n",
+        dev_dbg(&spi->dev, "%s, mode %d, %u bits/w, %u Hz\n",
                 __func__, spi->mode & (SPI_CPOL | SPI_CPHA),
-                spi->bits_per_word, 2 * mpc83xx_spi->nsecs);
-
+                spi->bits_per_word, spi->max_speed_hz);
+#if 0 /* Don't think this is needed */
         /* NOTE we _need_ to call chipselect() early, ideally with adapter
          * setup, unless the hardware defaults cooperate to avoid confusion
          * between normal (active low) and inverted chipselects.
          */
 
         /* deselect chip (low or high) */
-        spin_lock(&bitbang->lock);
-        if (!bitbang->busy) {
-                bitbang->chipselect(spi, BITBANG_CS_INACTIVE);
-                ndelay(mpc83xx_spi->nsecs);
-        }
-        spin_unlock(&bitbang->lock);
-
+        spin_lock(&mpc83xx_spi->lock);
+        if (!mpc83xx_spi->busy)
+                mpc83xx_spi_chipselect(spi, BITBANG_CS_INACTIVE);
+        spin_unlock(&mpc83xx_spi->lock);
+#endif
         return 0;
 }
 
-static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
-{
-        struct mpc83xx_spi *mpc83xx_spi;
-        u32 word;
-
-        mpc83xx_spi = spi_master_get_devdata(spi->master);
-
-        mpc83xx_spi->tx = t->tx_buf;
-        mpc83xx_spi->rx = t->rx_buf;
-        mpc83xx_spi->count = t->len;
-        INIT_COMPLETION(mpc83xx_spi->done);
-
-        /* enable rx ints */
-        mpc83xx_spi_write_reg(&mpc83xx_spi->base->mask, SPIM_NE);
-
-        /* transmit word */
-        word = mpc83xx_spi->get_tx(mpc83xx_spi);
-        mpc83xx_spi_write_reg(&mpc83xx_spi->base->transmit, word);
-
-        wait_for_completion(&mpc83xx_spi->done);
-
-        /* disable rx ints */
-        mpc83xx_spi_write_reg(&mpc83xx_spi->base->mask, 0);
-
-        return t->len - mpc83xx_spi->count;
-}
-
 irqreturn_t mpc83xx_spi_irq(s32 irq, void *context_data)
 {
         struct mpc83xx_spi *mpc83xx_spi = context_data;
@@ -395,6 +513,28 @@ irqreturn_t mpc83xx_spi_irq(s32 irq, void *context_data)
 
         return ret;
 }
+static int mpc83xx_spi_transfer(struct spi_device *spi,
+                                struct spi_message *m)
+{
+        struct mpc83xx_spi *mpc83xx_spi = spi_master_get_devdata(spi->master);
+        unsigned long flags;
+
+        m->actual_length = 0;
+        m->status = -EINPROGRESS;
+
+        spin_lock_irqsave(&mpc83xx_spi->lock, flags);
+        list_add_tail(&m->queue, &mpc83xx_spi->queue);
+        queue_work(mpc83xx_spi->workqueue, &mpc83xx_spi->work);
+        spin_unlock_irqrestore(&mpc83xx_spi->lock, flags);
+
+        return 0;
+}
+
+
+static void mpc83xx_spi_cleanup(struct spi_device *spi)
+{
+        kfree(spi->controller_state);
+}
 
 static int __init mpc83xx_spi_probe(struct platform_device *dev)
 {
@@ -426,11 +566,11 @@ static int __init mpc83xx_spi_probe(struct platform_device *dev)
                 ret = -ENODEV;
                 goto free_master;
         }
+        master->setup = mpc83xx_spi_setup;
+        master->transfer = mpc83xx_spi_transfer;
+        master->cleanup = mpc83xx_spi_cleanup;
+
         mpc83xx_spi = spi_master_get_devdata(master);
-        mpc83xx_spi->bitbang.master = spi_master_get(master);
-        mpc83xx_spi->bitbang.chipselect = mpc83xx_spi_chipselect;
-        mpc83xx_spi->bitbang.setup_transfer = mpc83xx_spi_setup_transfer;
-        mpc83xx_spi->bitbang.txrx_bufs = mpc83xx_spi_bufs;
         mpc83xx_spi->activate_cs = pdata->activate_cs;
         mpc83xx_spi->deactivate_cs = pdata->deactivate_cs;
         mpc83xx_spi->qe_mode = pdata->qe_mode;
@@ -445,7 +585,6 @@ static int __init mpc83xx_spi_probe(struct platform_device *dev)
                 mpc83xx_spi->tx_shift = 24;
         }
 
-        mpc83xx_spi->bitbang.master->setup = mpc83xx_spi_setup;
         init_completion(&mpc83xx_spi->done);
 
         mpc83xx_spi->base = ioremap(r->start, r->end - r->start + 1);
@@ -483,11 +622,21 @@ static int __init mpc83xx_spi_probe(struct platform_device *dev)
                 regval |= SPMODE_OP;
 
         mpc83xx_spi_write_reg(&mpc83xx_spi->base->mode, regval);
+        spin_lock_init(&mpc83xx_spi->lock);
+        init_completion(&mpc83xx_spi->done);
+        INIT_WORK(&mpc83xx_spi->work, mpc83xx_spi_work);
+        INIT_LIST_HEAD(&mpc83xx_spi->queue);
 
-        ret = spi_bitbang_start(&mpc83xx_spi->bitbang);
-
-        if (ret != 0)
+        mpc83xx_spi->workqueue = create_singlethread_workqueue(
+                master->dev.parent->bus_id);
+        if (mpc83xx_spi->workqueue == NULL) {
+                ret = -EBUSY;
                 goto free_irq;
+        }
+
+        ret = spi_register_master(master);
+        if (ret < 0)
+                goto unreg_master;
 
         printk(KERN_INFO
                "%s: MPC83xx SPI Controller driver at 0x%p (irq = %d)\n",
@@ -495,6 +644,8 @@ static int __init mpc83xx_spi_probe(struct platform_device *dev)
 
         return ret;
 
+unreg_master:
+        destroy_workqueue(mpc83xx_spi->workqueue);
 free_irq:
         free_irq(mpc83xx_spi->irq, mpc83xx_spi);
 unmap_io:
@@ -515,10 +666,12 @@ static int __exit mpc83xx_spi_remove(struct platform_device *dev)
         master = platform_get_drvdata(dev);
         mpc83xx_spi = spi_master_get_devdata(master);
 
-        spi_bitbang_stop(&mpc83xx_spi->bitbang);
+        flush_workqueue(mpc83xx_spi->workqueue);
+        destroy_workqueue(mpc83xx_spi->workqueue);
+        spi_unregister_master(master);
+
         free_irq(mpc83xx_spi->irq, mpc83xx_spi);
         iounmap(mpc83xx_spi->base);
-        spi_master_put(mpc83xx_spi->bitbang.master);
 
         return 0;
 }
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index 34bfb7dd776..0885cc357a3 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -125,10 +125,10 @@ static int s3c24xx_spi_setupxfer(struct spi_device *spi,
         /* is clk = pclk / (2 * (pre+1)), or is it
          *    clk = (pclk * 2) / ( pre + 1) */
 
-        div = (div / 2) - 1;
+        div /= 2;
 
-        if (div < 0)
-                div = 1;
+        if (div > 0)
+                div -= 1;
 
         if (div > 255)
                 div = 255;
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 516a6400db4..a419c42e880 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -17,6 +17,8 @@ obj-$(CONFIG_USB_SL811_HCD)	+= host/
 obj-$(CONFIG_USB_U132_HCD)      += host/
 obj-$(CONFIG_USB_R8A66597_HCD)  += host/
 
+obj-$(CONFIG_USB_C67X00_HCD)    += c67x00/
+
 obj-$(CONFIG_USB_ACM)           += class/
 obj-$(CONFIG_USB_PRINTER)       += class/
 
diff --git a/drivers/usb/atm/Kconfig b/drivers/usb/atm/Kconfig
index 86e64035edb..be0b8daac9c 100644
--- a/drivers/usb/atm/Kconfig
+++ b/drivers/usb/atm/Kconfig
@@ -19,7 +19,6 @@ if USB_ATM
 
 config USB_SPEEDTOUCH
         tristate "Speedtouch USB support"
-        depends on USB_ATM
         select FW_LOADER
         help
           Say Y here if you have an SpeedTouch USB or SpeedTouch 330
@@ -32,7 +31,6 @@ config USB_SPEEDTOUCH
 
 config USB_CXACRU
         tristate "Conexant AccessRunner USB support"
-        depends on USB_ATM
         select FW_LOADER
         help
           Say Y here if you have an ADSL USB modem based on the Conexant
@@ -45,7 +43,6 @@ config USB_CXACRU
 
 config USB_UEAGLEATM
         tristate "ADI 930 and eagle USB DSL modem"
-        depends on USB_ATM
         select FW_LOADER
         help
           Say Y here if you have an ADSL USB modem based on the ADI 930
@@ -58,7 +55,6 @@ config USB_UEAGLEATM
 
 config USB_XUSBATM
         tristate "Other USB DSL modem support"
-        depends on USB_ATM
         help
           Say Y here if you have a DSL USB modem not explicitly supported by
           another USB DSL drivers.  In order to use your modem you will need to
diff --git a/drivers/usb/c67x00/Makefile b/drivers/usb/c67x00/Makefile
new file mode 100644
index 00000000000..868bc41b598
--- /dev/null
+++ b/drivers/usb/c67x00/Makefile
@@ -0,0 +1,9 @@
+#
+# Makefile for Cypress C67X00 USB Controller
+#
+
+ccflags-$(CONFIG_USB_DEBUG)             += -DDEBUG
+
+obj-$(CONFIG_USB_C67X00_HCD)            += c67x00.o
+
+c67x00-objs := c67x00-drv.o c67x00-ll-hpi.o c67x00-hcd.o c67x00-sched.o
diff --git a/drivers/usb/c67x00/c67x00-drv.c b/drivers/usb/c67x00/c67x00-drv.c
new file mode 100644
index 00000000000..5633bc5c8bf
--- /dev/null
+++ b/drivers/usb/c67x00/c67x00-drv.c
@@ -0,0 +1,243 @@
+/*
+ * c67x00-drv.c: Cypress C67X00 USB Common infrastructure
+ *
+ * Copyright (C) 2006-2008 Barco N.V.
+ *    Derived from the Cypress cy7c67200/300 ezusb linux driver and
+ *    based on multiple host controller drivers inside the linux kernel.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA  02110-1301  USA.
+ */
+
+/*
+ * This file implements the common infrastructure for using the c67x00.
+ * It is both the link between the platform configuration and subdrivers and
+ * the link between the common hardware parts and the subdrivers (e.g.
+ * interrupt handling).
+ *
+ * The c67x00 has 2 SIE's (serial interface engine) wich can be configured
+ * to be host, device or OTG (with some limitations, E.G. only SIE1 can be OTG).
+ *
+ * Depending on the platform configuration, the SIE's are created and
+ * the corresponding subdriver is initialized (c67x00_probe_sie).
+ */
+
+#include <linux/device.h>
+#include <linux/io.h>
+#include <linux/list.h>
+#include <linux/usb.h>
+#include <linux/usb/c67x00.h>
+
+#include "c67x00.h"
+#include "c67x00-hcd.h"
+
+static void c67x00_probe_sie(struct c67x00_sie *sie,
+                             struct c67x00_device *dev, int sie_num)
+{
+        spin_lock_init(&sie->lock);
+        sie->dev = dev;
+        sie->sie_num = sie_num;
+        sie->mode = c67x00_sie_config(dev->pdata->sie_config, sie_num);
+
+        switch (sie->mode) {
+        case C67X00_SIE_HOST:
+                c67x00_hcd_probe(sie);
+                break;
+
+        case C67X00_SIE_UNUSED:
+                dev_info(sie_dev(sie),
+                         "Not using SIE %d as requested\n", sie->sie_num);
+                break;
+
+        default:
+                dev_err(sie_dev(sie),
+                        "Unsupported configuration: 0x%x for SIE %d\n",
+                        sie->mode, sie->sie_num);
+                break;
+        }
+}
+
+static void c67x00_remove_sie(struct c67x00_sie *sie)
+{
+        switch (sie->mode) {
+        case C67X00_SIE_HOST:
+                c67x00_hcd_remove(sie);
+                break;
+
+        default:
+                break;
+        }
+}
+
+static irqreturn_t c67x00_irq(int irq, void *__dev)
+{
+        struct c67x00_device *c67x00 = __dev;
+        struct c67x00_sie *sie;
+        u16 msg, int_status;
+        int i, count = 8;
+
+        int_status = c67x00_ll_hpi_status(c67x00);
+        if (!int_status)
+                return IRQ_NONE;
+
+        while (int_status != 0 && (count-- >= 0)) {
+                c67x00_ll_irq(c67x00, int_status);
+                for (i = 0; i < C67X00_SIES; i++) {
+                        sie = &c67x00->sie[i];
+                        msg = 0;
+                        if (int_status & SIEMSG_FLG(i))
+                                msg = c67x00_ll_fetch_siemsg(c67x00, i);
+                        if (sie->irq)
+                                sie->irq(sie, int_status, msg);
+                }
+                int_status = c67x00_ll_hpi_status(c67x00);
+        }
+
+        if (int_status)
+                dev_warn(&c67x00->pdev->dev, "Not all interrupts handled! "
+                         "status = 0x%04x\n", int_status);
+
+        return IRQ_HANDLED;
+}
+
+/* ------------------------------------------------------------------------- */
+
+static int __devinit c67x00_drv_probe(struct platform_device *pdev)
+{
+        struct c67x00_device *c67x00;
+        struct c67x00_platform_data *pdata;
+        struct resource *res, *res2;
+        int ret, i;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -ENODEV;
+
+        res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!res2)
+                return -ENODEV;
+
+        pdata = pdev->dev.platform_data;
+        if (!pdata)
+                return -ENODEV;
+
+        c67x00 = kzalloc(sizeof(*c67x00), GFP_KERNEL);
+        if (!c67x00)
+                return -ENOMEM;
+
+        if (!request_mem_region(res->start, res->end - res->start + 1,
+                                pdev->name)) {
+                dev_err(&pdev->dev, "Memory region busy\n");
+                ret = -EBUSY;
+                goto request_mem_failed;
+        }
+        c67x00->hpi.base = ioremap(res->start, res->end - res->start + 1);
+        if (!c67x00->hpi.base) {
+                dev_err(&pdev->dev, "Unable to map HPI registers\n");
+                ret = -EIO;
+                goto map_failed;
+        }
+
+        spin_lock_init(&c67x00->hpi.lock);
+        c67x00->hpi.regstep = pdata->hpi_regstep;
+        c67x00->pdata = pdev->dev.platform_data;
+        c67x00->pdev = pdev;
+
+        c67x00_ll_init(c67x00);
+        c67x00_ll_hpi_reg_init(c67x00);
+
+        ret = request_irq(res2->start, c67x00_irq, 0, pdev->name, c67x00);
+        if (ret) {
+                dev_err(&pdev->dev, "Cannot claim IRQ\n");
+                goto request_irq_failed;
+        }
+
+        ret = c67x00_ll_reset(c67x00);
+        if (ret) {
+                dev_err(&pdev->dev, "Device reset failed\n");
+                goto reset_failed;
+        }
+
+        for (i = 0; i < C67X00_SIES; i++)
+                c67x00_probe_sie(&c67x00->sie[i], c67x00, i);
+
+        platform_set_drvdata(pdev, c67x00);
+
+        return 0;
+
+ reset_failed:
+        free_irq(res2->start, c67x00);
+ request_irq_failed:
+        iounmap(c67x00->hpi.base);
+ map_failed:
+        release_mem_region(res->start, res->end - res->start + 1);
+ request_mem_failed:
+        kfree(c67x00);
+
+        return ret;
+}
+
+static int __devexit c67x00_drv_remove(struct platform_device *pdev)
+{
+        struct c67x00_device *c67x00 = platform_get_drvdata(pdev);
+        struct resource *res;
+        int i;
+
+        for (i = 0; i < C67X00_SIES; i++)
+                c67x00_remove_sie(&c67x00->sie[i]);
+
+        c67x00_ll_release(c67x00);
+
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (res)
+                free_irq(res->start, c67x00);
+
+        iounmap(c67x00->hpi.base);
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (res)
+                release_mem_region(res->start, res->end - res->start + 1);
+
+        kfree(c67x00);
+
+        return 0;
+}
+
+static struct platform_driver c67x00_driver = {
+        .probe  = c67x00_drv_probe,
+        .remove = __devexit_p(c67x00_drv_remove),
+        .driver = {
+                .owner = THIS_MODULE,
+                .name = "c67x00",
+        },
+};
+MODULE_ALIAS("platform:c67x00");
+
+static int __init c67x00_init(void)
+{
+        return platform_driver_register(&c67x00_driver);
+}
+
+static void __exit c67x00_exit(void)
+{
+        platform_driver_unregister(&c67x00_driver);
+}
+
+module_init(c67x00_init);
+module_exit(c67x00_exit);
+
+MODULE_AUTHOR("Peter Korsgaard, Jan Veldeman, Grant Likely");
+MODULE_DESCRIPTION("Cypress C67X00 USB Controller Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/c67x00/c67x00-hcd.c b/drivers/usb/c67x00/c67x00-hcd.c
new file mode 100644
index 00000000000..a22b887f4e9
--- /dev/null
+++ b/drivers/usb/c67x00/c67x00-hcd.c
@@ -0,0 +1,412 @@
+/*
+ * c67x00-hcd.c: Cypress C67X00 USB Host Controller Driver
+ *
+ * Copyright (C) 2006-2008 Barco N.V.
+ *    Derived from the Cypress cy7c67200/300 ezusb linux driver and
+ *    based on multiple host controller drivers inside the linux kernel.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA  02110-1301  USA.
+ */
+
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/usb.h>
+
+#include "c67x00.h"
+#include "c67x00-hcd.h"
+
+/* --------------------------------------------------------------------------
+ * Root Hub Support
+ */
+
+static __u8 c67x00_hub_des[] = {
+        0x09,                   /*  __u8  bLength; */
+        0x29,                   /*  __u8  bDescriptorType; Hub-descriptor */
+        0x02,                   /*  __u8  bNbrPorts; */
+        0x00,                   /* __u16  wHubCharacteristics; */
+        0x00,                   /*   (per-port OC, no power switching) */
+        0x32,                   /*  __u8  bPwrOn2pwrGood; 2ms */
+        0x00,                   /*  __u8  bHubContrCurrent; 0 mA */
+        0x00,                   /*  __u8  DeviceRemovable; ** 7 Ports max ** */
+        0xff,                   /*  __u8  PortPwrCtrlMask; ** 7 ports max ** */
+};
+
+static void c67x00_hub_reset_host_port(struct c67x00_sie *sie, int port)
+{
+        struct c67x00_hcd *c67x00 = sie->private_data;
+        unsigned long flags;
+
+        c67x00_ll_husb_reset(sie, port);
+
+        spin_lock_irqsave(&c67x00->lock, flags);
+        c67x00_ll_husb_reset_port(sie, port);
+        spin_unlock_irqrestore(&c67x00->lock, flags);
+
+        c67x00_ll_set_husb_eot(sie->dev, DEFAULT_EOT);
+}
+
+static int c67x00_hub_status_data(struct usb_hcd *hcd, char *buf)
+{
+        struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
+        struct c67x00_sie *sie = c67x00->sie;
+        u16 status;
+        int i;
+
+        *buf = 0;
+        status = c67x00_ll_usb_get_status(sie);
+        for (i = 0; i < C67X00_PORTS; i++)
+                if (status & PORT_CONNECT_CHANGE(i))
+                        *buf |= (1 << i);
+
+        /* bit 0 denotes hub change, b1..n port change */
+        *buf <<= 1;
+
+        return !!*buf;
+}
+
+static int c67x00_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+                              u16 wIndex, char *buf, u16 wLength)
+{
+        struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
+        struct c67x00_sie *sie = c67x00->sie;
+        u16 status, usb_status;
+        int len = 0;
+        unsigned int port = wIndex-1;
+        u16 wPortChange, wPortStatus;
+
+        switch (typeReq) {
+
+        case GetHubStatus:
+                *(__le32 *) buf = cpu_to_le32(0);
+                len = 4;                /* hub power */
+                break;
+
+        case GetPortStatus:
+                if (wIndex > C67X00_PORTS)
+                        return -EPIPE;
+
+                status = c67x00_ll_usb_get_status(sie);
+                usb_status = c67x00_ll_get_usb_ctl(sie);
+
+                wPortChange = 0;
+                if (status & PORT_CONNECT_CHANGE(port))
+                        wPortChange |= USB_PORT_STAT_C_CONNECTION;
+
+                wPortStatus = USB_PORT_STAT_POWER;
+                if (!(status & PORT_SE0_STATUS(port)))
+                        wPortStatus |= USB_PORT_STAT_CONNECTION;
+                if (usb_status & LOW_SPEED_PORT(port)) {
+                        wPortStatus |= USB_PORT_STAT_LOW_SPEED;
+                        c67x00->low_speed_ports |= (1 << port);
+                } else
+                        c67x00->low_speed_ports &= ~(1 << port);
+
+                if (usb_status & SOF_EOP_EN(port))
+                        wPortStatus |= USB_PORT_STAT_ENABLE;
+
+                *(__le16 *) buf = cpu_to_le16(wPortStatus);
+                *(__le16 *) (buf + 2) = cpu_to_le16(wPortChange);
+                len = 4;
+                break;
+
+        case SetHubFeature:     /* We don't implement these */
+        case ClearHubFeature:
+                switch (wValue) {
+                case C_HUB_OVER_CURRENT:
+                case C_HUB_LOCAL_POWER:
+                        len = 0;
+                        break;
+
+                default:
+                        return -EPIPE;
+                }
+                break;
+
+        case SetPortFeature:
+                if (wIndex > C67X00_PORTS)
+                        return -EPIPE;
+
+                switch (wValue) {
+                case USB_PORT_FEAT_SUSPEND:
+                        dev_dbg(c67x00_hcd_dev(c67x00),
+                                "SetPortFeature %d (SUSPEND)\n", port);
+                        len = 0;
+                        break;
+
+                case USB_PORT_FEAT_RESET:
+                        c67x00_hub_reset_host_port(sie, port);
+                        len = 0;
+                        break;
+
+                case USB_PORT_FEAT_POWER:
+                        /* Power always enabled */
+                        len = 0;
+                        break;
+
+                default:
+                        dev_dbg(c67x00_hcd_dev(c67x00),
+                                "%s: SetPortFeature %d (0x%04x) Error!\n",
+                                __func__, port, wValue);
+                        return -EPIPE;
+                }
+                break;
+
+        case ClearPortFeature:
+                if (wIndex > C67X00_PORTS)
+                        return -EPIPE;
+
+                switch (wValue) {
+                case USB_PORT_FEAT_ENABLE:
+                        /* Reset the port so that the c67x00 also notices the
+                         * disconnect */
+                        c67x00_hub_reset_host_port(sie, port);
+                        len = 0;
+                        break;
+
+                case USB_PORT_FEAT_C_ENABLE:
+                        dev_dbg(c67x00_hcd_dev(c67x00),
+                                "ClearPortFeature (%d): C_ENABLE\n", port);
+                        len = 0;
+                        break;
+
+                case USB_PORT_FEAT_SUSPEND:
+                        dev_dbg(c67x00_hcd_dev(c67x00),
+                                "ClearPortFeature (%d): SUSPEND\n", port);
+                        len = 0;
+                        break;
+
+                case USB_PORT_FEAT_C_SUSPEND:
+                        dev_dbg(c67x00_hcd_dev(c67x00),
+                                "ClearPortFeature (%d): C_SUSPEND\n", port);
+                        len = 0;
+                        break;
+
+                case USB_PORT_FEAT_POWER:
+                        dev_dbg(c67x00_hcd_dev(c67x00),
+                                "ClearPortFeature (%d): POWER\n", port);
+                        return -EPIPE;
+
+                case USB_PORT_FEAT_C_CONNECTION:
+                        c67x00_ll_usb_clear_status(sie,
+                                                   PORT_CONNECT_CHANGE(port));
+                        len = 0;
+                        break;
+
+                case USB_PORT_FEAT_C_OVER_CURRENT:
+                        dev_dbg(c67x00_hcd_dev(c67x00),
+                                "ClearPortFeature (%d): OVER_CURRENT\n", port);
+                        len = 0;
+                        break;
+
+                case USB_PORT_FEAT_C_RESET:
+                        dev_dbg(c67x00_hcd_dev(c67x00),
+                                "ClearPortFeature (%d): C_RESET\n", port);
+                        len = 0;
+                        break;
+
+                default:
+                        dev_dbg(c67x00_hcd_dev(c67x00),
+                                "%s: ClearPortFeature %d (0x%04x) Error!\n",
+                                __func__, port, wValue);
+                        return -EPIPE;
+                }
+                break;
+
+        case GetHubDescriptor:
+                len = min_t(unsigned int, sizeof(c67x00_hub_des), wLength);
+                memcpy(buf, c67x00_hub_des, len);
+                break;
+
+        default:
+                dev_dbg(c67x00_hcd_dev(c67x00), "%s: unknown\n", __func__);
+                return -EPIPE;
+        }
+
+        return 0;
+}
+
+/* ---------------------------------------------------------------------
+ * Main part of host controller driver
+ */
+
+/**
+ * c67x00_hcd_irq
+ *
+ * This function is called from the interrupt handler in c67x00-drv.c
+ */
+static void c67x00_hcd_irq(struct c67x00_sie *sie, u16 int_status, u16 msg)
+{
+        struct c67x00_hcd *c67x00 = sie->private_data;
+        struct usb_hcd *hcd = c67x00_hcd_to_hcd(c67x00);
+
+        /* Handle sie message flags */
+        if (msg) {
+                if (msg & HUSB_TDListDone)
+                        c67x00_sched_kick(c67x00);
+                else
+                        dev_warn(c67x00_hcd_dev(c67x00),
+                                 "Unknown SIE msg flag(s): 0x%04x\n", msg);
+        }
+
+        if (unlikely(hcd->state == HC_STATE_HALT))
+                return;
+
+        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
+                return;
+
+        /* Handle Start of frame events */
+        if (int_status & SOFEOP_FLG(sie->sie_num)) {
+                c67x00_ll_usb_clear_status(sie, SOF_EOP_IRQ_FLG);
+                c67x00_sched_kick(c67x00);
+                set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);
+        }
+}
+
+/**
+ * c67x00_hcd_start: Host controller start hook
+ */
+static int c67x00_hcd_start(struct usb_hcd *hcd)
+{
+        hcd->uses_new_polling = 1;
+        hcd->state = HC_STATE_RUNNING;
+        hcd->poll_rh = 1;
+
+        return 0;
+}
+
+/**
+ * c67x00_hcd_stop: Host controller stop hook
+ */
+static void c67x00_hcd_stop(struct usb_hcd *hcd)
+{
+        /* Nothing to do */
+}
+
+static int c67x00_hcd_get_frame(struct usb_hcd *hcd)
+{
+        struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
+        u16 temp_val;
+
+        dev_dbg(c67x00_hcd_dev(c67x00), "%s\n", __func__);
+        temp_val = c67x00_ll_husb_get_frame(c67x00->sie);
+        temp_val &= HOST_FRAME_MASK;
+        return temp_val ? (temp_val - 1) : HOST_FRAME_MASK;
+}
+
+static struct hc_driver c67x00_hc_driver = {
+        .description    = "c67x00-hcd",
+        .product_desc   = "Cypress C67X00 Host Controller",
+        .hcd_priv_size  = sizeof(struct c67x00_hcd),
+        .flags          = HCD_USB11 | HCD_MEMORY,
+
+        /*
+         * basic lifecycle operations
+         */
+        .start          = c67x00_hcd_start,
+        .stop           = c67x00_hcd_stop,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue    = c67x00_urb_enqueue,
+        .urb_dequeue    = c67x00_urb_dequeue,
+        .endpoint_disable = c67x00_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number = c67x00_hcd_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data = c67x00_hub_status_data,
+        .hub_control    = c67x00_hub_control,
+};
+
+/* ---------------------------------------------------------------------
+ * Setup/Teardown routines
+ */
+
+int c67x00_hcd_probe(struct c67x00_sie *sie)
+{
+        struct c67x00_hcd *c67x00;
+        struct usb_hcd *hcd;
+        unsigned long flags;
+        int retval;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        hcd = usb_create_hcd(&c67x00_hc_driver, sie_dev(sie), "c67x00_sie");
+        if (!hcd) {
+                retval = -ENOMEM;
+                goto err0;
+        }
+        c67x00 = hcd_to_c67x00_hcd(hcd);
+
+        spin_lock_init(&c67x00->lock);
+        c67x00->sie = sie;
+
+        INIT_LIST_HEAD(&c67x00->list[PIPE_ISOCHRONOUS]);
+        INIT_LIST_HEAD(&c67x00->list[PIPE_INTERRUPT]);
+        INIT_LIST_HEAD(&c67x00->list[PIPE_CONTROL]);
+        INIT_LIST_HEAD(&c67x00->list[PIPE_BULK]);
+        c67x00->urb_count = 0;
+        INIT_LIST_HEAD(&c67x00->td_list);
+        c67x00->td_base_addr = CY_HCD_BUF_ADDR + SIE_TD_OFFSET(sie->sie_num);
+        c67x00->buf_base_addr = CY_HCD_BUF_ADDR + SIE_BUF_OFFSET(sie->sie_num);
+        c67x00->max_frame_bw = MAX_FRAME_BW_STD;
+
+        c67x00_ll_husb_init_host_port(sie);
+
+        init_completion(&c67x00->endpoint_disable);
+        retval = c67x00_sched_start_scheduler(c67x00);
+        if (retval)
+                goto err1;
+
+        retval = usb_add_hcd(hcd, 0, 0);
+        if (retval) {
+                dev_dbg(sie_dev(sie), "%s: usb_add_hcd returned %d\n",
+                        __func__, retval);
+                goto err2;
+        }
+
+        spin_lock_irqsave(&sie->lock, flags);
+        sie->private_data = c67x00;
+        sie->irq = c67x00_hcd_irq;
+        spin_unlock_irqrestore(&sie->lock, flags);
+
+        return retval;
+
+ err2:
+        c67x00_sched_stop_scheduler(c67x00);
+ err1:
+        usb_put_hcd(hcd);
+ err0:
+        return retval;
+}
+
+/* may be called with controller, bus, and devices active */
+void c67x00_hcd_remove(struct c67x00_sie *sie)
+{
+        struct c67x00_hcd *c67x00 = sie->private_data;
+        struct usb_hcd *hcd = c67x00_hcd_to_hcd(c67x00);
+
+        c67x00_sched_stop_scheduler(c67x00);
+        usb_remove_hcd(hcd);
+        usb_put_hcd(hcd);
+}
diff --git a/drivers/usb/c67x00/c67x00-hcd.h b/drivers/usb/c67x00/c67x00-hcd.h
new file mode 100644
index 00000000000..e8c6d94b251
--- /dev/null
+++ b/drivers/usb/c67x00/c67x00-hcd.h
@@ -0,0 +1,133 @@
+/*
+ * c67x00-hcd.h: Cypress C67X00 USB HCD
+ *
+ * Copyright (C) 2006-2008 Barco N.V.
+ *    Derived from the Cypress cy7c67200/300 ezusb linux driver and
+ *    based on multiple host controller drivers inside the linux kernel.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA  02110-1301  USA.
+ */
+
+#ifndef _USB_C67X00_HCD_H
+#define _USB_C67X00_HCD_H
+
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/list.h>
+#include <linux/usb.h>
+#include "../core/hcd.h"
+#include "c67x00.h"
+
+/*
+ * The following parameters depend on the CPU speed, bus speed, ...
+ * These can be tuned for specific use cases, e.g. if isochronous transfers
+ * are very important, bandwith can be sacrificed to guarantee that the
+ * 1ms deadline will be met.
+ * If bulk transfers are important, the MAX_FRAME_BW can be increased,
+ * but some (or many) isochronous deadlines might not be met.
+ *
+ * The values are specified in bittime.
+ */
+
+/*
+ * The current implementation switches between _STD (default) and _ISO (when
+ * isochronous transfers are scheduled), in order to optimize the throughput
+ * in normal cicrumstances, but also provide good isochronous behaviour.
+ *
+ * Bandwidth is described in bit time so with a 12MHz USB clock and 1ms
+ * frames; there are 12000 bit times per frame.
+ */
+
+#define TOTAL_FRAME_BW          12000
+#define DEFAULT_EOT             2250
+
+#define MAX_FRAME_BW_STD        (TOTAL_FRAME_BW - DEFAULT_EOT)
+#define MAX_FRAME_BW_ISO        2400
+
+/*
+ * Periodic transfers may only use 90% of the full frame, but as
+ * we currently don't even use 90% of the full frame, we may
+ * use the full usable time for periodic transfers.
+ */
+#define MAX_PERIODIC_BW(full_bw)        full_bw
+
+/* -------------------------------------------------------------------------- */
+
+struct c67x00_hcd {
+        spinlock_t lock;
+        struct c67x00_sie *sie;
+        unsigned int low_speed_ports;   /* bitmask of low speed ports */
+        unsigned int urb_count;
+        unsigned int urb_iso_count;
+
+        struct list_head list[4];       /* iso, int, ctrl, bulk */
+#if PIPE_BULK != 3
+#error "Sanity check failed, this code presumes PIPE_... to range from 0 to 3"
+#endif
+
+        /* USB bandwidth allocated to td_list */
+        int bandwidth_allocated;
+        /* USB bandwidth allocated for isoc/int transfer */
+        int periodic_bw_allocated;
+        struct list_head td_list;
+        int max_frame_bw;
+
+        u16 td_base_addr;
+        u16 buf_base_addr;
+        u16 next_td_addr;
+        u16 next_buf_addr;
+
+        struct tasklet_struct tasklet;
+
+        struct completion endpoint_disable;
+
+        u16 current_frame;
+        u16 last_frame;
+};
+
+static inline struct c67x00_hcd *hcd_to_c67x00_hcd(struct usb_hcd *hcd)
+{
+        return (struct c67x00_hcd *)(hcd->hcd_priv);
+}
+
+static inline struct usb_hcd *c67x00_hcd_to_hcd(struct c67x00_hcd *c67x00)
+{
+        return container_of((void *)c67x00, struct usb_hcd, hcd_priv);
+}
+
+/* ---------------------------------------------------------------------
+ * Functions used by c67x00-drv
+ */
+
+int c67x00_hcd_probe(struct c67x00_sie *sie);
+void c67x00_hcd_remove(struct c67x00_sie *sie);
+
+/* ---------------------------------------------------------------------
+ * Transfer Descriptor scheduling functions
+ */
+int c67x00_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags);
+int c67x00_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status);
+void c67x00_endpoint_disable(struct usb_hcd *hcd,
+                             struct usb_host_endpoint *ep);
+
+void c67x00_hcd_msg_received(struct c67x00_sie *sie, u16 msg);
+void c67x00_sched_kick(struct c67x00_hcd *c67x00);
+int c67x00_sched_start_scheduler(struct c67x00_hcd *c67x00);
+void c67x00_sched_stop_scheduler(struct c67x00_hcd *c67x00);
+
+#define c67x00_hcd_dev(x)       (c67x00_hcd_to_hcd(x)->self.controller)
+
+#endif                          /* _USB_C67X00_HCD_H */
diff --git a/drivers/usb/c67x00/c67x00-ll-hpi.c b/drivers/usb/c67x00/c67x00-ll-hpi.c
new file mode 100644
index 00000000000..5100fbbf6cb
--- /dev/null
+++ b/drivers/usb/c67x00/c67x00-ll-hpi.c
@@ -0,0 +1,481 @@
+/*
+ * c67x00-ll-hpi.c: Cypress C67X00 USB Low level interface using HPI
+ *
+ * Copyright (C) 2006-2008 Barco N.V.
+ *    Derived from the Cypress cy7c67200/300 ezusb linux driver and
+ *    based on multiple host controller drivers inside the linux kernel.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA  02110-1301  USA.
+ */
+
+#include <asm/byteorder.h>
+#include <linux/io.h>
+#include <linux/jiffies.h>
+#include <linux/usb/c67x00.h>
+#include "c67x00.h"
+
+#define COMM_REGS 14
+
+struct c67x00_lcp_int_data {
+        u16 regs[COMM_REGS];
+};
+
+/* -------------------------------------------------------------------------- */
+/* Interface definitions */
+
+#define COMM_ACK                        0x0FED
+#define COMM_NAK                        0xDEAD
+
+#define COMM_RESET                      0xFA50
+#define COMM_EXEC_INT                   0xCE01
+#define COMM_INT_NUM                    0x01C2
+
+/* Registers 0 to COMM_REGS-1 */
+#define COMM_R(x)                       (0x01C4 + 2 * (x))
+
+#define HUSB_SIE_pCurrentTDPtr(x)       ((x) ? 0x01B2 : 0x01B0)
+#define HUSB_SIE_pTDListDone_Sem(x)     ((x) ? 0x01B8 : 0x01B6)
+#define HUSB_pEOT                       0x01B4
+
+/* Software interrupts */
+/* 114, 115: */
+#define HUSB_SIE_INIT_INT(x)            ((x) ? 0x0073 : 0x0072)
+#define HUSB_RESET_INT                  0x0074
+
+#define SUSB_INIT_INT                   0x0071
+#define SUSB_INIT_INT_LOC               (SUSB_INIT_INT * 2)
+
+/* -----------------------------------------------------------------------
+ * HPI implementation
+ *
+ * The c67x00 chip also support control via SPI or HSS serial
+ * interfaces.  However, this driver assumes that register access can
+ * be performed from IRQ context.  While this is a safe assuption with
+ * the HPI interface, it is not true for the serial interfaces.
+ */
+
+/* HPI registers */
+#define HPI_DATA        0
+#define HPI_MAILBOX     1
+#define HPI_ADDR        2
+#define HPI_STATUS      3
+
+static inline u16 hpi_read_reg(struct c67x00_device *dev, int reg)
+{
+        return __raw_readw(dev->hpi.base + reg * dev->hpi.regstep);
+}
+
+static inline void hpi_write_reg(struct c67x00_device *dev, int reg, u16 value)
+{
+        __raw_writew(value, dev->hpi.base + reg * dev->hpi.regstep);
+}
+
+static inline u16 hpi_read_word_nolock(struct c67x00_device *dev, u16 reg)
+{
+        hpi_write_reg(dev, HPI_ADDR, reg);
+        return hpi_read_reg(dev, HPI_DATA);
+}
+
+static u16 hpi_read_word(struct c67x00_device *dev, u16 reg)
+{
+        u16 value;
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->hpi.lock, flags);
+        value = hpi_read_word_nolock(dev, reg);
+        spin_unlock_irqrestore(&dev->hpi.lock, flags);
+
+        return value;
+}
+
+static void hpi_write_word_nolock(struct c67x00_device *dev, u16 reg, u16 value)
+{
+        hpi_write_reg(dev, HPI_ADDR, reg);
+        hpi_write_reg(dev, HPI_DATA, value);
+}
+
+static void hpi_write_word(struct c67x00_device *dev, u16 reg, u16 value)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->hpi.lock, flags);
+        hpi_write_word_nolock(dev, reg, value);
+        spin_unlock_irqrestore(&dev->hpi.lock, flags);
+}
+
+/*
+ * Only data is little endian, addr has cpu endianess
+ */
+static void hpi_write_words_le16(struct c67x00_device *dev, u16 addr,
+                                 u16 *data, u16 count)
+{
+        unsigned long flags;
+        int i;
+
+        spin_lock_irqsave(&dev->hpi.lock, flags);
+
+        hpi_write_reg(dev, HPI_ADDR, addr);
+        for (i = 0; i < count; i++)
+                hpi_write_reg(dev, HPI_DATA, cpu_to_le16(*data++));
+
+        spin_unlock_irqrestore(&dev->hpi.lock, flags);
+}
+
+/*
+ * Only data is little endian, addr has cpu endianess
+ */
+static void hpi_read_words_le16(struct c67x00_device *dev, u16 addr,
+                                u16 *data, u16 count)
+{
+        unsigned long flags;
+        int i;
+
+        spin_lock_irqsave(&dev->hpi.lock, flags);
+        hpi_write_reg(dev, HPI_ADDR, addr);
+        for (i = 0; i < count; i++)
+                *data++ = le16_to_cpu(hpi_read_reg(dev, HPI_DATA));
+
+        spin_unlock_irqrestore(&dev->hpi.lock, flags);
+}
+
+static void hpi_set_bits(struct c67x00_device *dev, u16 reg, u16 mask)
+{
+        u16 value;
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->hpi.lock, flags);
+        value = hpi_read_word_nolock(dev, reg);
+        hpi_write_word_nolock(dev, reg, value | mask);
+        spin_unlock_irqrestore(&dev->hpi.lock, flags);
+}
+
+static void hpi_clear_bits(struct c67x00_device *dev, u16 reg, u16 mask)
+{
+        u16 value;
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->hpi.lock, flags);
+        value = hpi_read_word_nolock(dev, reg);
+        hpi_write_word_nolock(dev, reg, value & ~mask);
+        spin_unlock_irqrestore(&dev->hpi.lock, flags);
+}
+
+static u16 hpi_recv_mbox(struct c67x00_device *dev)
+{
+        u16 value;
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->hpi.lock, flags);
+        value = hpi_read_reg(dev, HPI_MAILBOX);
+        spin_unlock_irqrestore(&dev->hpi.lock, flags);
+
+        return value;
+}
+
+static u16 hpi_send_mbox(struct c67x00_device *dev, u16 value)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->hpi.lock, flags);
+        hpi_write_reg(dev, HPI_MAILBOX, value);
+        spin_unlock_irqrestore(&dev->hpi.lock, flags);
+
+        return value;
+}
+
+u16 c67x00_ll_hpi_status(struct c67x00_device *dev)
+{
+        u16 value;
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->hpi.lock, flags);
+        value = hpi_read_reg(dev, HPI_STATUS);
+        spin_unlock_irqrestore(&dev->hpi.lock, flags);
+
+        return value;
+}
+
+void c67x00_ll_hpi_reg_init(struct c67x00_device *dev)
+{
+        int i;
+
+        hpi_recv_mbox(dev);
+        c67x00_ll_hpi_status(dev);
+        hpi_write_word(dev, HPI_IRQ_ROUTING_REG, 0);
+
+        for (i = 0; i < C67X00_SIES; i++) {
+                hpi_write_word(dev, SIEMSG_REG(i), 0);
+                hpi_read_word(dev, SIEMSG_REG(i));
+        }
+}
+
+void c67x00_ll_hpi_enable_sofeop(struct c67x00_sie *sie)
+{
+        hpi_set_bits(sie->dev, HPI_IRQ_ROUTING_REG,
+                     SOFEOP_TO_HPI_EN(sie->sie_num));
+}
+
+void c67x00_ll_hpi_disable_sofeop(struct c67x00_sie *sie)
+{
+        hpi_clear_bits(sie->dev, HPI_IRQ_ROUTING_REG,
+                       SOFEOP_TO_HPI_EN(sie->sie_num));
+}
+
+/* -------------------------------------------------------------------------- */
+/* Transactions */
+
+static inline u16 ll_recv_msg(struct c67x00_device *dev)
+{
+        u16 res;
+
+        res = wait_for_completion_timeout(&dev->hpi.lcp.msg_received, 5 * HZ);
+        WARN_ON(!res);
+
+        return (res == 0) ? -EIO : 0;
+}
+
+/* -------------------------------------------------------------------------- */
+/* General functions */
+
+u16 c67x00_ll_fetch_siemsg(struct c67x00_device *dev, int sie_num)
+{
+        u16 val;
+
+        val = hpi_read_word(dev, SIEMSG_REG(sie_num));
+        /* clear register to allow next message */
+        hpi_write_word(dev, SIEMSG_REG(sie_num), 0);
+
+        return val;
+}
+
+u16 c67x00_ll_get_usb_ctl(struct c67x00_sie *sie)
+{
+        return hpi_read_word(sie->dev, USB_CTL_REG(sie->sie_num));
+}
+
+/**
+ * c67x00_ll_usb_clear_status - clear the USB status bits
+ */
+void c67x00_ll_usb_clear_status(struct c67x00_sie *sie, u16 bits)
+{
+        hpi_write_word(sie->dev, USB_STAT_REG(sie->sie_num), bits);
+}
+
+u16 c67x00_ll_usb_get_status(struct c67x00_sie *sie)
+{
+        return hpi_read_word(sie->dev, USB_STAT_REG(sie->sie_num));
+}
+
+/* -------------------------------------------------------------------------- */
+
+static int c67x00_comm_exec_int(struct c67x00_device *dev, u16 nr,
+                                struct c67x00_lcp_int_data *data)
+{
+        int i, rc;
+
+        mutex_lock(&dev->hpi.lcp.mutex);
+        hpi_write_word(dev, COMM_INT_NUM, nr);
+        for (i = 0; i < COMM_REGS; i++)
+                hpi_write_word(dev, COMM_R(i), data->regs[i]);
+        hpi_send_mbox(dev, COMM_EXEC_INT);
+        rc = ll_recv_msg(dev);
+        mutex_unlock(&dev->hpi.lcp.mutex);
+
+        return rc;
+}
+
+/* -------------------------------------------------------------------------- */
+/* Host specific functions */
+
+void c67x00_ll_set_husb_eot(struct c67x00_device *dev, u16 value)
+{
+        mutex_lock(&dev->hpi.lcp.mutex);
+        hpi_write_word(dev, HUSB_pEOT, value);
+        mutex_unlock(&dev->hpi.lcp.mutex);
+}
+
+static inline void c67x00_ll_husb_sie_init(struct c67x00_sie *sie)
+{
+        struct c67x00_device *dev = sie->dev;
+        struct c67x00_lcp_int_data data;
+        int rc;
+
+        rc = c67x00_comm_exec_int(dev, HUSB_SIE_INIT_INT(sie->sie_num), &data);
+        BUG_ON(rc); /* No return path for error code; crash spectacularly */
+}
+
+void c67x00_ll_husb_reset(struct c67x00_sie *sie, int port)
+{
+        struct c67x00_device *dev = sie->dev;
+        struct c67x00_lcp_int_data data;
+        int rc;
+
+        data.regs[0] = 50;      /* Reset USB port for 50ms */
+        data.regs[1] = port | (sie->sie_num << 1);
+        rc = c67x00_comm_exec_int(dev, HUSB_RESET_INT, &data);
+        BUG_ON(rc); /* No return path for error code; crash spectacularly */
+}
+
+void c67x00_ll_husb_set_current_td(struct c67x00_sie *sie, u16 addr)
+{
+        hpi_write_word(sie->dev, HUSB_SIE_pCurrentTDPtr(sie->sie_num), addr);
+}
+
+u16 c67x00_ll_husb_get_current_td(struct c67x00_sie *sie)
+{
+        return hpi_read_word(sie->dev, HUSB_SIE_pCurrentTDPtr(sie->sie_num));
+}
+
+u16 c67x00_ll_husb_get_frame(struct c67x00_sie *sie)
+{
+        return hpi_read_word(sie->dev, HOST_FRAME_REG(sie->sie_num));
+}
+
+void c67x00_ll_husb_init_host_port(struct c67x00_sie *sie)
+{
+        /* Set port into host mode */
+        hpi_set_bits(sie->dev, USB_CTL_REG(sie->sie_num), HOST_MODE);
+        c67x00_ll_husb_sie_init(sie);
+        /* Clear interrupts */
+        c67x00_ll_usb_clear_status(sie, HOST_STAT_MASK);
+        /* Check */
+        if (!(hpi_read_word(sie->dev, USB_CTL_REG(sie->sie_num)) & HOST_MODE))
+                dev_warn(sie_dev(sie),
+                         "SIE %d not set to host mode\n", sie->sie_num);
+}
+
+void c67x00_ll_husb_reset_port(struct c67x00_sie *sie, int port)
+{
+        /* Clear connect change */
+        c67x00_ll_usb_clear_status(sie, PORT_CONNECT_CHANGE(port));
+
+        /* Enable interrupts */
+        hpi_set_bits(sie->dev, HPI_IRQ_ROUTING_REG,
+                     SOFEOP_TO_CPU_EN(sie->sie_num));
+        hpi_set_bits(sie->dev, HOST_IRQ_EN_REG(sie->sie_num),
+                     SOF_EOP_IRQ_EN | DONE_IRQ_EN);
+
+        /* Enable pull down transistors */
+        hpi_set_bits(sie->dev, USB_CTL_REG(sie->sie_num), PORT_RES_EN(port));
+}
+
+/* -------------------------------------------------------------------------- */
+
+void c67x00_ll_irq(struct c67x00_device *dev, u16 int_status)
+{
+        if ((int_status & MBX_OUT_FLG) == 0)
+                return;
+
+        dev->hpi.lcp.last_msg = hpi_recv_mbox(dev);
+        complete(&dev->hpi.lcp.msg_received);
+}
+
+/* -------------------------------------------------------------------------- */
+
+int c67x00_ll_reset(struct c67x00_device *dev)
+{
+        int rc;
+
+        mutex_lock(&dev->hpi.lcp.mutex);
+        hpi_send_mbox(dev, COMM_RESET);
+        rc = ll_recv_msg(dev);
+        mutex_unlock(&dev->hpi.lcp.mutex);
+
+        return rc;
+}
+
+/* -------------------------------------------------------------------------- */
+
+/**
+ * c67x00_ll_write_mem_le16 - write into c67x00 memory
+ * Only data is little endian, addr has cpu endianess.
+ */
+void c67x00_ll_write_mem_le16(struct c67x00_device *dev, u16 addr,
+                              void *data, int len)
+{
+        u8 *buf = data;
+
+        /* Sanity check */
+        if (addr + len > 0xffff) {
+                dev_err(&dev->pdev->dev,
+                        "Trying to write beyond writable region!\n");
+                return;
+        }
+
+        if (addr & 0x01) {
+                /* unaligned access */
+                u16 tmp;
+                tmp = hpi_read_word(dev, addr - 1);
+                tmp = (tmp & 0x00ff) | (*buf++ << 8);
+                hpi_write_word(dev, addr - 1, tmp);
+                addr++;
+                len--;
+        }
+
+        hpi_write_words_le16(dev, addr, (u16 *)buf, len / 2);
+        buf += len & ~0x01;
+        addr += len & ~0x01;
+        len &= 0x01;
+
+        if (len) {
+                u16 tmp;
+                tmp = hpi_read_word(dev, addr);
+                tmp = (tmp & 0xff00) | *buf;
+                hpi_write_word(dev, addr, tmp);
+        }
+}
+
+/**
+ * c67x00_ll_read_mem_le16 - read from c67x00 memory
+ * Only data is little endian, addr has cpu endianess.
+ */
+void c67x00_ll_read_mem_le16(struct c67x00_device *dev, u16 addr,
+                             void *data, int len)
+{
+        u8 *buf = data;
+
+        if (addr & 0x01) {
+                /* unaligned access */
+                u16 tmp;
+                tmp = hpi_read_word(dev, addr - 1);
+                *buf++ = (tmp >> 8) & 0x00ff;
+                addr++;
+                len--;
+        }
+
+        hpi_read_words_le16(dev, addr, (u16 *)buf, len / 2);
+        buf += len & ~0x01;
+        addr += len & ~0x01;
+        len &= 0x01;
+
+        if (len) {
+                u16 tmp;
+                tmp = hpi_read_word(dev, addr);
+                *buf = tmp & 0x00ff;
+        }
+}
+
+/* -------------------------------------------------------------------------- */
+
+void c67x00_ll_init(struct c67x00_device *dev)
+{
+        mutex_init(&dev->hpi.lcp.mutex);
+        init_completion(&dev->hpi.lcp.msg_received);
+}
+
+void c67x00_ll_release(struct c67x00_device *dev)
+{
+}
diff --git a/drivers/usb/c67x00/c67x00-sched.c b/drivers/usb/c67x00/c67x00-sched.c
new file mode 100644
index 00000000000..85dfe296566
--- /dev/null
+++ b/drivers/usb/c67x00/c67x00-sched.c
@@ -0,0 +1,1170 @@
+/*
+ * c67x00-sched.c: Cypress C67X00 USB Host Controller Driver - TD scheduling
+ *
+ * Copyright (C) 2006-2008 Barco N.V.
+ *    Derived from the Cypress cy7c67200/300 ezusb linux driver and
+ *    based on multiple host controller drivers inside the linux kernel.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA  02110-1301  USA.
+ */
+
+#include <linux/kthread.h>
+
+#include "c67x00.h"
+#include "c67x00-hcd.h"
+
+/*
+ * These are the stages for a control urb, they are kept
+ * in both urb->interval and td->privdata.
+ */
+#define SETUP_STAGE             0
+#define DATA_STAGE              1
+#define STATUS_STAGE            2
+
+/* -------------------------------------------------------------------------- */
+
+/**
+ * struct c67x00_ep_data: Host endpoint data structure
+ */
+struct c67x00_ep_data {
+        struct list_head queue;
+        struct list_head node;
+        struct usb_host_endpoint *hep;
+        struct usb_device *dev;
+        u16 next_frame;         /* For int/isoc transactions */
+};
+
+/**
+ * struct c67x00_td
+ *
+ * Hardware parts are little endiannes, SW in CPU endianess.
+ */
+struct c67x00_td {
+        /* HW specific part */
+        __le16 ly_base_addr;    /* Bytes 0-1 */
+        __le16 port_length;     /* Bytes 2-3 */
+        u8 pid_ep;              /* Byte 4 */
+        u8 dev_addr;            /* Byte 5 */
+        u8 ctrl_reg;            /* Byte 6 */
+        u8 status;              /* Byte 7 */
+        u8 retry_cnt;           /* Byte 8 */
+#define TT_OFFSET               2
+#define TT_CONTROL              0
+#define TT_ISOCHRONOUS          1
+#define TT_BULK                 2
+#define TT_INTERRUPT            3
+        u8 residue;             /* Byte 9 */
+        __le16 next_td_addr;    /* Bytes 10-11 */
+        /* SW part */
+        struct list_head td_list;
+        u16 td_addr;
+        void *data;
+        struct urb *urb;
+        unsigned long privdata;
+
+        /* These are needed for handling the toggle bits:
+         * an urb can be dequeued while a td is in progress
+         * after checking the td, the toggle bit might need to
+         * be fixed */
+        struct c67x00_ep_data *ep_data;
+        unsigned int pipe;
+};
+
+struct c67x00_urb_priv {
+        struct list_head hep_node;
+        struct urb *urb;
+        int port;
+        int cnt;                /* packet number for isoc */
+        int status;
+        struct c67x00_ep_data *ep_data;
+};
+
+#define td_udev(td)     ((td)->ep_data->dev)
+
+#define CY_TD_SIZE              12
+
+#define TD_PIDEP_OFFSET         0x04
+#define TD_PIDEPMASK_PID        0xF0
+#define TD_PIDEPMASK_EP         0x0F
+#define TD_PORTLENMASK_DL       0x02FF
+#define TD_PORTLENMASK_PN       0xC000
+
+#define TD_STATUS_OFFSET        0x07
+#define TD_STATUSMASK_ACK       0x01
+#define TD_STATUSMASK_ERR       0x02
+#define TD_STATUSMASK_TMOUT     0x04
+#define TD_STATUSMASK_SEQ       0x08
+#define TD_STATUSMASK_SETUP     0x10
+#define TD_STATUSMASK_OVF       0x20
+#define TD_STATUSMASK_NAK       0x40
+#define TD_STATUSMASK_STALL     0x80
+
+#define TD_ERROR_MASK           (TD_STATUSMASK_ERR | TD_STATUSMASK_TMOUT | \
+                                 TD_STATUSMASK_STALL)
+
+#define TD_RETRYCNT_OFFSET      0x08
+#define TD_RETRYCNTMASK_ACT_FLG 0x10
+#define TD_RETRYCNTMASK_TX_TYPE 0x0C
+#define TD_RETRYCNTMASK_RTY_CNT 0x03
+
+#define TD_RESIDUE_OVERFLOW     0x80
+
+#define TD_PID_IN               0x90
+
+/* Residue: signed 8bits, neg -> OVERFLOW, pos -> UNDERFLOW */
+#define td_residue(td)          ((__s8)(td->residue))
+#define td_ly_base_addr(td)     (__le16_to_cpu((td)->ly_base_addr))
+#define td_port_length(td)      (__le16_to_cpu((td)->port_length))
+#define td_next_td_addr(td)     (__le16_to_cpu((td)->next_td_addr))
+
+#define td_active(td)           ((td)->retry_cnt & TD_RETRYCNTMASK_ACT_FLG)
+#define td_length(td)           (td_port_length(td) & TD_PORTLENMASK_DL)
+
+#define td_sequence_ok(td)      (!td->status || \
+                                 (!(td->status & TD_STATUSMASK_SEQ) ==  \
+                                  !(td->ctrl_reg & SEQ_SEL)))
+
+#define td_acked(td)            (!td->status || \
+                                 (td->status & TD_STATUSMASK_ACK))
+#define td_actual_bytes(td)     (td_length(td) - td_residue(td))
+
+/* -------------------------------------------------------------------------- */
+
+#ifdef DEBUG
+
+/**
+ * dbg_td - Dump the contents of the TD
+ */
+static void dbg_td(struct c67x00_hcd *c67x00, struct c67x00_td *td, char *msg)
+{
+        struct device *dev = c67x00_hcd_dev(c67x00);
+
+        dev_dbg(dev, "### %s at 0x%04x\n", msg, td->td_addr);
+        dev_dbg(dev, "urb:      0x%p\n", td->urb);
+        dev_dbg(dev, "endpoint:   %4d\n", usb_pipeendpoint(td->pipe));
+        dev_dbg(dev, "pipeout:    %4d\n", usb_pipeout(td->pipe));
+        dev_dbg(dev, "ly_base_addr: 0x%04x\n", td_ly_base_addr(td));
+        dev_dbg(dev, "port_length:  0x%04x\n", td_port_length(td));
+        dev_dbg(dev, "pid_ep:         0x%02x\n", td->pid_ep);
+        dev_dbg(dev, "dev_addr:       0x%02x\n", td->dev_addr);
+        dev_dbg(dev, "ctrl_reg:       0x%02x\n", td->ctrl_reg);
+        dev_dbg(dev, "status:         0x%02x\n", td->status);
+        dev_dbg(dev, "retry_cnt:      0x%02x\n", td->retry_cnt);
+        dev_dbg(dev, "residue:        0x%02x\n", td->residue);
+        dev_dbg(dev, "next_td_addr: 0x%04x\n", td_next_td_addr(td));
+        dev_dbg(dev, "data:");
+        print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 16, 1,
+                       td->data, td_length(td), 1);
+}
+#else                           /* DEBUG */
+
+static inline void
+dbg_td(struct c67x00_hcd *c67x00, struct c67x00_td *td, char *msg) { }
+
+#endif                          /* DEBUG */
+
+/* -------------------------------------------------------------------------- */
+/* Helper functions */
+
+static inline u16 c67x00_get_current_frame_number(struct c67x00_hcd *c67x00)
+{
+        return c67x00_ll_husb_get_frame(c67x00->sie) & HOST_FRAME_MASK;
+}
+
+/**
+ * frame_add
+ * Software wraparound for framenumbers.
+ */
+static inline u16 frame_add(u16 a, u16 b)
+{
+        return (a + b) & HOST_FRAME_MASK;
+}
+
+/**
+ * frame_after - is frame a after frame b
+ */
+static inline int frame_after(u16 a, u16 b)
+{
+        return ((HOST_FRAME_MASK + a - b) & HOST_FRAME_MASK) <
+            (HOST_FRAME_MASK / 2);
+}
+
+/**
+ * frame_after_eq - is frame a after or equal to frame b
+ */
+static inline int frame_after_eq(u16 a, u16 b)
+{
+        return ((HOST_FRAME_MASK + 1 + a - b) & HOST_FRAME_MASK) <
+            (HOST_FRAME_MASK / 2);
+}
+
+/* -------------------------------------------------------------------------- */
+
+/**
+ * c67x00_release_urb - remove link from all tds to this urb
+ * Disconnects the urb from it's tds, so that it can be given back.
+ * pre: urb->hcpriv != NULL
+ */
+static void c67x00_release_urb(struct c67x00_hcd *c67x00, struct urb *urb)
+{
+        struct c67x00_td *td;
+        struct c67x00_urb_priv *urbp;
+
+        BUG_ON(!urb);
+
+        c67x00->urb_count--;
+
+        if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+                c67x00->urb_iso_count--;
+                if (c67x00->urb_iso_count == 0)
+                        c67x00->max_frame_bw = MAX_FRAME_BW_STD;
+        }
+
+        /* TODO this might be not so efficient when we've got many urbs!
+         * Alternatives:
+         *   * only clear when needed
+         *   * keep a list of tds with each urbp
+         */
+        list_for_each_entry(td, &c67x00->td_list, td_list)
+                if (urb == td->urb)
+                        td->urb = NULL;
+
+        urbp = urb->hcpriv;
+        urb->hcpriv = NULL;
+        list_del(&urbp->hep_node);
+        kfree(urbp);
+}
+
+/* -------------------------------------------------------------------------- */
+
+static struct c67x00_ep_data *
+c67x00_ep_data_alloc(struct c67x00_hcd *c67x00, struct urb *urb)
+{
+        struct usb_host_endpoint *hep = urb->ep;
+        struct c67x00_ep_data *ep_data;
+        int type;
+
+        c67x00->current_frame = c67x00_get_current_frame_number(c67x00);
+
+        /* Check if endpoint already has a c67x00_ep_data struct allocated */
+        if (hep->hcpriv) {
+                ep_data = hep->hcpriv;
+                if (frame_after(c67x00->current_frame, ep_data->next_frame))
+                        ep_data->next_frame =
+                            frame_add(c67x00->current_frame, 1);
+                return hep->hcpriv;
+        }
+
+        /* Allocate and initialize a new c67x00 endpoint data structure */
+        ep_data = kzalloc(sizeof(*ep_data), GFP_ATOMIC);
+        if (!ep_data)
+                return NULL;
+
+        INIT_LIST_HEAD(&ep_data->queue);
+        INIT_LIST_HEAD(&ep_data->node);
+        ep_data->hep = hep;
+
+        /* hold a reference to udev as long as this endpoint lives,
+         * this is needed to possibly fix the data toggle */
+        ep_data->dev = usb_get_dev(urb->dev);
+        hep->hcpriv = ep_data;
+
+        /* For ISOC and INT endpoints, start ASAP: */
+        ep_data->next_frame = frame_add(c67x00->current_frame, 1);
+
+        /* Add the endpoint data to one of the pipe lists; must be added
+           in order of endpoint address */
+        type = usb_pipetype(urb->pipe);
+        if (list_empty(&ep_data->node)) {
+                list_add(&ep_data->node, &c67x00->list[type]);
+        } else {
+                struct c67x00_ep_data *prev;
+
+                list_for_each_entry(prev, &c67x00->list[type], node) {
+                        if (prev->hep->desc.bEndpointAddress >
+                            hep->desc.bEndpointAddress) {
+                                list_add(&ep_data->node, prev->node.prev);
+                                break;
+                        }
+                }
+        }
+
+        return ep_data;
+}
+
+static int c67x00_ep_data_free(struct usb_host_endpoint *hep)
+{
+        struct c67x00_ep_data *ep_data = hep->hcpriv;
+
+        if (!ep_data)
+                return 0;
+
+        if (!list_empty(&ep_data->queue))
+                return -EBUSY;
+
+        usb_put_dev(ep_data->dev);
+        list_del(&ep_data->queue);
+        list_del(&ep_data->node);
+
+        kfree(ep_data);
+        hep->hcpriv = NULL;
+
+        return 0;
+}
+
+void c67x00_endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
+{
+        struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
+        unsigned long flags;
+
+        if (!list_empty(&ep->urb_list))
+                dev_warn(c67x00_hcd_dev(c67x00), "error: urb list not empty\n");
+
+        spin_lock_irqsave(&c67x00->lock, flags);
+
+        /* loop waiting for all transfers in the endpoint queue to complete */
+        while (c67x00_ep_data_free(ep)) {
+                /* Drop the lock so we can sleep waiting for the hardware */
+                spin_unlock_irqrestore(&c67x00->lock, flags);
+
+                /* it could happen that we reinitialize this completion, while
+                 * somebody was waiting for that completion.  The timeout and
+                 * while loop handle such cases, but this might be improved */
+                INIT_COMPLETION(c67x00->endpoint_disable);
+                c67x00_sched_kick(c67x00);
+                wait_for_completion_timeout(&c67x00->endpoint_disable, 1 * HZ);
+
+                spin_lock_irqsave(&c67x00->lock, flags);
+        }
+
+        spin_unlock_irqrestore(&c67x00->lock, flags);
+}
+
+/* -------------------------------------------------------------------------- */
+
+static inline int get_root_port(struct usb_device *dev)
+{
+        while (dev->parent->parent)
+                dev = dev->parent;
+        return dev->portnum;
+}
+
+int c67x00_urb_enqueue(struct usb_hcd *hcd,
+                       struct urb *urb, gfp_t mem_flags)
+{
+        int ret;
+        unsigned long flags;
+        struct c67x00_urb_priv *urbp;
+        struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
+        int port = get_root_port(urb->dev)-1;
+
+        spin_lock_irqsave(&c67x00->lock, flags);
+
+        /* Make sure host controller is running */
+        if (!HC_IS_RUNNING(hcd->state)) {
+                ret = -ENODEV;
+                goto err_not_linked;
+        }
+
+        ret = usb_hcd_link_urb_to_ep(hcd, urb);
+        if (ret)
+                goto err_not_linked;
+
+        /* Allocate and initialize urb private data */
+        urbp = kzalloc(sizeof(*urbp), mem_flags);
+        if (!urbp) {
+                ret = -ENOMEM;
+                goto err_urbp;
+        }
+
+        INIT_LIST_HEAD(&urbp->hep_node);
+        urbp->urb = urb;
+        urbp->port = port;
+
+        urbp->ep_data = c67x00_ep_data_alloc(c67x00, urb);
+
+        if (!urbp->ep_data) {
+                ret = -ENOMEM;
+                goto err_epdata;
+        }
+
+        /* TODO claim bandwidth with usb_claim_bandwidth?
+         * also release it somewhere! */
+
+        urb->hcpriv = urbp;
+
+        urb->actual_length = 0; /* Nothing received/transmitted yet */
+
+        switch (usb_pipetype(urb->pipe)) {
+        case PIPE_CONTROL:
+                urb->interval = SETUP_STAGE;
+                break;
+        case PIPE_INTERRUPT:
+                break;
+        case PIPE_BULK:
+                break;
+        case PIPE_ISOCHRONOUS:
+                if (c67x00->urb_iso_count == 0)
+                        c67x00->max_frame_bw = MAX_FRAME_BW_ISO;
+                c67x00->urb_iso_count++;
+                /* Assume always URB_ISO_ASAP, FIXME */
+                if (list_empty(&urbp->ep_data->queue))
+                        urb->start_frame = urbp->ep_data->next_frame;
+                else {
+                        /* Go right after the last one */
+                        struct urb *last_urb;
+
+                        last_urb = list_entry(urbp->ep_data->queue.prev,
+                                              struct c67x00_urb_priv,
+                                              hep_node)->urb;
+                        urb->start_frame =
+                            frame_add(last_urb->start_frame,
+                                      last_urb->number_of_packets *
+                                      last_urb->interval);
+                }
+                urbp->cnt = 0;
+                break;
+        }
+
+        /* Add the URB to the endpoint queue */
+        list_add_tail(&urbp->hep_node, &urbp->ep_data->queue);
+
+        /* If this is the only URB, kick start the controller */
+        if (!c67x00->urb_count++)
+                c67x00_ll_hpi_enable_sofeop(c67x00->sie);
+
+        c67x00_sched_kick(c67x00);
+        spin_unlock_irqrestore(&c67x00->lock, flags);
+
+        return 0;
+
+err_epdata:
+        kfree(urbp);
+err_urbp:
+        usb_hcd_unlink_urb_from_ep(hcd, urb);
+err_not_linked:
+        spin_unlock_irqrestore(&c67x00->lock, flags);
+
+        return ret;
+}
+
+int c67x00_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+{
+        struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
+        unsigned long flags;
+        int rc;
+
+        spin_lock_irqsave(&c67x00->lock, flags);
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (rc)
+                goto done;
+
+        c67x00_release_urb(c67x00, urb);
+        usb_hcd_unlink_urb_from_ep(hcd, urb);
+
+        spin_unlock(&c67x00->lock);
+        usb_hcd_giveback_urb(hcd, urb, status);
+        spin_lock(&c67x00->lock);
+
+        spin_unlock_irqrestore(&c67x00->lock, flags);
+
+        return 0;
+
+ done:
+        spin_unlock_irqrestore(&c67x00->lock, flags);
+        return rc;
+}
+
+/* -------------------------------------------------------------------------- */
+
+/*
+ * pre: c67x00 locked, urb unlocked
+ */
+static void
+c67x00_giveback_urb(struct c67x00_hcd *c67x00, struct urb *urb, int status)
+{
+        struct c67x00_urb_priv *urbp;
+
+        if (!urb)
+                return;
+
+        urbp = urb->hcpriv;
+        urbp->status = status;
+
+        list_del_init(&urbp->hep_node);
+
+        c67x00_release_urb(c67x00, urb);
+        usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
+        spin_unlock(&c67x00->lock);
+        usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
+        spin_lock(&c67x00->lock);
+}
+
+/* -------------------------------------------------------------------------- */
+
+static int c67x00_claim_frame_bw(struct c67x00_hcd *c67x00, struct urb *urb,
+                                 int len, int periodic)
+{
+        struct c67x00_urb_priv *urbp = urb->hcpriv;
+        int bit_time;
+
+        /* According to the C67x00 BIOS user manual, page 3-18,19, the
+         * following calculations provide the full speed bit times for
+         * a transaction.
+         *
+         * FS(in)       = 112.5 +  9.36*BC + HOST_DELAY
+         * FS(in,iso)   =  90.5 +  9.36*BC + HOST_DELAY
+         * FS(out)      = 112.5 +  9.36*BC + HOST_DELAY
+         * FS(out,iso)  =  78.4 +  9.36*BC + HOST_DELAY
+         * LS(in)       = 802.4 + 75.78*BC + HOST_DELAY
+         * LS(out)      = 802.6 + 74.67*BC + HOST_DELAY
+         *
+         * HOST_DELAY == 106 for the c67200 and c67300.
+         */
+
+        /* make calculations in 1/100 bit times to maintain resolution */
+        if (urbp->ep_data->dev->speed == USB_SPEED_LOW) {
+                /* Low speed pipe */
+                if (usb_pipein(urb->pipe))
+                        bit_time = 80240 + 7578*len;
+                else
+                        bit_time = 80260 + 7467*len;
+        } else {
+                /* FS pipes */
+                if (usb_pipeisoc(urb->pipe))
+                        bit_time = usb_pipein(urb->pipe) ? 9050 : 7840;
+                else
+                        bit_time = 11250;
+                bit_time += 936*len;
+        }
+
+        /* Scale back down to integer bit times.  Use a host delay of 106.
+         * (this is the only place it is used) */
+        bit_time = ((bit_time+50) / 100) + 106;
+
+        if (unlikely(bit_time + c67x00->bandwidth_allocated >=
+                     c67x00->max_frame_bw))
+                return -EMSGSIZE;
+
+        if (unlikely(c67x00->next_td_addr + CY_TD_SIZE >=
+                     c67x00->td_base_addr + SIE_TD_SIZE))
+                return -EMSGSIZE;
+
+        if (unlikely(c67x00->next_buf_addr + len >=
+                     c67x00->buf_base_addr + SIE_TD_BUF_SIZE))
+                return -EMSGSIZE;
+
+        if (periodic) {
+                if (unlikely(bit_time + c67x00->periodic_bw_allocated >=
+                             MAX_PERIODIC_BW(c67x00->max_frame_bw)))
+                        return -EMSGSIZE;
+                c67x00->periodic_bw_allocated += bit_time;
+        }
+
+        c67x00->bandwidth_allocated += bit_time;
+        return 0;
+}
+
+/* -------------------------------------------------------------------------- */
+
+/**
+ * td_addr and buf_addr must be word aligned
+ */
+static int c67x00_create_td(struct c67x00_hcd *c67x00, struct urb *urb,
+                            void *data, int len, int pid, int toggle,
+                            unsigned long privdata)
+{
+        struct c67x00_td *td;
+        struct c67x00_urb_priv *urbp = urb->hcpriv;
+        const __u8 active_flag = 1, retry_cnt = 1;
+        __u8 cmd = 0;
+        int tt = 0;
+
+        if (c67x00_claim_frame_bw(c67x00, urb, len, usb_pipeisoc(urb->pipe)
+                                  || usb_pipeint(urb->pipe)))
+                return -EMSGSIZE;       /* Not really an error, but expected */
+
+        td = kzalloc(sizeof(*td), GFP_ATOMIC);
+        if (!td)
+                return -ENOMEM;
+
+        td->pipe = urb->pipe;
+        td->ep_data = urbp->ep_data;
+
+        if ((td_udev(td)->speed == USB_SPEED_LOW) &&
+            !(c67x00->low_speed_ports & (1 << urbp->port)))
+                cmd |= PREAMBLE_EN;
+
+        switch (usb_pipetype(td->pipe)) {
+        case PIPE_ISOCHRONOUS:
+                tt = TT_ISOCHRONOUS;
+                cmd |= ISO_EN;
+                break;
+        case PIPE_CONTROL:
+                tt = TT_CONTROL;
+                break;
+        case PIPE_BULK:
+                tt = TT_BULK;
+                break;
+        case PIPE_INTERRUPT:
+                tt = TT_INTERRUPT;
+                break;
+        }
+
+        if (toggle)
+                cmd |= SEQ_SEL;
+
+        cmd |= ARM_EN;
+
+        /* SW part */
+        td->td_addr = c67x00->next_td_addr;
+        c67x00->next_td_addr = c67x00->next_td_addr + CY_TD_SIZE;
+
+        /* HW part */
+        td->ly_base_addr = __cpu_to_le16(c67x00->next_buf_addr);
+        td->port_length = __cpu_to_le16((c67x00->sie->sie_num << 15) |
+                                        (urbp->port << 14) | (len & 0x3FF));
+        td->pid_ep = ((pid & 0xF) << TD_PIDEP_OFFSET) |
+            (usb_pipeendpoint(td->pipe) & 0xF);
+        td->dev_addr = usb_pipedevice(td->pipe) & 0x7F;
+        td->ctrl_reg = cmd;
+        td->status = 0;
+        td->retry_cnt = (tt << TT_OFFSET) | (active_flag << 4) | retry_cnt;
+        td->residue = 0;
+        td->next_td_addr = __cpu_to_le16(c67x00->next_td_addr);
+
+        /* SW part */
+        td->data = data;
+        td->urb = urb;
+        td->privdata = privdata;
+
+        c67x00->next_buf_addr += (len + 1) & ~0x01;     /* properly align */
+
+        list_add_tail(&td->td_list, &c67x00->td_list);
+        return 0;
+}
+
+static inline void c67x00_release_td(struct c67x00_td *td)
+{
+        list_del_init(&td->td_list);
+        kfree(td);
+}
+
+/* -------------------------------------------------------------------------- */
+
+static int c67x00_add_data_urb(struct c67x00_hcd *c67x00, struct urb *urb)
+{
+        int remaining;
+        int toggle;
+        int pid;
+        int ret = 0;
+        int maxps;
+        int need_empty;
+
+        toggle = usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
+                               usb_pipeout(urb->pipe));
+        remaining = urb->transfer_buffer_length - urb->actual_length;
+
+        maxps = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
+
+        need_empty = (urb->transfer_flags & URB_ZERO_PACKET) &&
+            usb_pipeout(urb->pipe) && !(remaining % maxps);
+
+        while (remaining || need_empty) {
+                int len;
+                char *td_buf;
+
+                len = (remaining > maxps) ? maxps : remaining;
+                if (!len)
+                        need_empty = 0;
+
+                pid = usb_pipeout(urb->pipe) ? USB_PID_OUT : USB_PID_IN;
+                td_buf = urb->transfer_buffer + urb->transfer_buffer_length -
+                    remaining;
+                ret = c67x00_create_td(c67x00, urb, td_buf, len, pid, toggle,
+                                       DATA_STAGE);
+                if (ret)
+                        return ret;     /* td wasn't created */
+
+                toggle ^= 1;
+                remaining -= len;
+                if (usb_pipecontrol(urb->pipe))
+                        break;
+        }
+
+        return 0;
+}
+
+/**
+ * return 0 in case more bandwidth is available, else errorcode
+ */
+static int c67x00_add_ctrl_urb(struct c67x00_hcd *c67x00, struct urb *urb)
+{
+        int ret;
+        int pid;
+
+        switch (urb->interval) {
+        default:
+        case SETUP_STAGE:
+                ret = c67x00_create_td(c67x00, urb, urb->setup_packet,
+                                       8, USB_PID_SETUP, 0, SETUP_STAGE);
+                if (ret)
+                        return ret;
+                urb->interval = SETUP_STAGE;
+                usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
+                              usb_pipeout(urb->pipe), 1);
+                break;
+        case DATA_STAGE:
+                if (urb->transfer_buffer_length) {
+                        ret = c67x00_add_data_urb(c67x00, urb);
+                        if (ret)
+                                return ret;
+                        break;
+                }               /* else fallthrough */
+        case STATUS_STAGE:
+                pid = !usb_pipeout(urb->pipe) ? USB_PID_OUT : USB_PID_IN;
+                ret = c67x00_create_td(c67x00, urb, NULL, 0, pid, 1,
+                                       STATUS_STAGE);
+                if (ret)
+                        return ret;
+                break;
+        }
+
+        return 0;
+}
+
+/*
+ * return 0 in case more bandwidth is available, else errorcode
+ */
+static int c67x00_add_int_urb(struct c67x00_hcd *c67x00, struct urb *urb)
+{
+        struct c67x00_urb_priv *urbp = urb->hcpriv;
+
+        if (frame_after_eq(c67x00->current_frame, urbp->ep_data->next_frame)) {
+                urbp->ep_data->next_frame =
+                    frame_add(urbp->ep_data->next_frame, urb->interval);
+                return c67x00_add_data_urb(c67x00, urb);
+        }
+        return 0;
+}
+
+static int c67x00_add_iso_urb(struct c67x00_hcd *c67x00, struct urb *urb)
+{
+        struct c67x00_urb_priv *urbp = urb->hcpriv;
+
+        if (frame_after_eq(c67x00->current_frame, urbp->ep_data->next_frame)) {
+                char *td_buf;
+                int len, pid, ret;
+
+                BUG_ON(urbp->cnt >= urb->number_of_packets);
+
+                td_buf = urb->transfer_buffer +
+                    urb->iso_frame_desc[urbp->cnt].offset;
+                len = urb->iso_frame_desc[urbp->cnt].length;
+                pid = usb_pipeout(urb->pipe) ? USB_PID_OUT : USB_PID_IN;
+
+                ret = c67x00_create_td(c67x00, urb, td_buf, len, pid, 0,
+                                       urbp->cnt);
+                if (ret) {
+                        printk(KERN_DEBUG "create failed: %d\n", ret);
+                        urb->iso_frame_desc[urbp->cnt].actual_length = 0;
+                        urb->iso_frame_desc[urbp->cnt].status = ret;
+                        if (urbp->cnt + 1 == urb->number_of_packets)
+                                c67x00_giveback_urb(c67x00, urb, 0);
+                }
+
+                urbp->ep_data->next_frame =
+                    frame_add(urbp->ep_data->next_frame, urb->interval);
+                urbp->cnt++;
+        }
+        return 0;
+}
+
+/* -------------------------------------------------------------------------- */
+
+static void c67x00_fill_from_list(struct c67x00_hcd *c67x00, int type,
+                                  int (*add)(struct c67x00_hcd *, struct urb *))
+{
+        struct c67x00_ep_data *ep_data;
+        struct urb *urb;
+
+        /* traverse every endpoint on the list */
+        list_for_each_entry(ep_data, &c67x00->list[type], node) {
+                if (!list_empty(&ep_data->queue)) {
+                        /* and add the first urb */
+                        /* isochronous transfer rely on this */
+                        urb = list_entry(ep_data->queue.next,
+                                         struct c67x00_urb_priv,
+                                         hep_node)->urb;
+                        add(c67x00, urb);
+                }
+        }
+}
+
+static void c67x00_fill_frame(struct c67x00_hcd *c67x00)
+{
+        struct c67x00_td *td, *ttd;
+
+        /* Check if we can proceed */
+        if (!list_empty(&c67x00->td_list)) {
+                dev_warn(c67x00_hcd_dev(c67x00),
+                         "TD list not empty! This should not happen!\n");
+                list_for_each_entry_safe(td, ttd, &c67x00->td_list, td_list) {
+                        dbg_td(c67x00, td, "Unprocessed td");
+                        c67x00_release_td(td);
+                }
+        }
+
+        /* Reinitialize variables */
+        c67x00->bandwidth_allocated = 0;
+        c67x00->periodic_bw_allocated = 0;
+
+        c67x00->next_td_addr = c67x00->td_base_addr;
+        c67x00->next_buf_addr = c67x00->buf_base_addr;
+
+        /* Fill the list */
+        c67x00_fill_from_list(c67x00, PIPE_ISOCHRONOUS, c67x00_add_iso_urb);
+        c67x00_fill_from_list(c67x00, PIPE_INTERRUPT, c67x00_add_int_urb);
+        c67x00_fill_from_list(c67x00, PIPE_CONTROL, c67x00_add_ctrl_urb);
+        c67x00_fill_from_list(c67x00, PIPE_BULK, c67x00_add_data_urb);
+}
+
+/* -------------------------------------------------------------------------- */
+
+/**
+ * Get TD from C67X00
+ */
+static inline void
+c67x00_parse_td(struct c67x00_hcd *c67x00, struct c67x00_td *td)
+{
+        c67x00_ll_read_mem_le16(c67x00->sie->dev,
+                                td->td_addr, td, CY_TD_SIZE);
+
+        if (usb_pipein(td->pipe) && td_actual_bytes(td))
+                c67x00_ll_read_mem_le16(c67x00->sie->dev, td_ly_base_addr(td),
+                                        td->data, td_actual_bytes(td));
+}
+
+static int c67x00_td_to_error(struct c67x00_hcd *c67x00, struct c67x00_td *td)
+{
+        if (td->status & TD_STATUSMASK_ERR) {
+                dbg_td(c67x00, td, "ERROR_FLAG");
+                return -EILSEQ;
+        }
+        if (td->status & TD_STATUSMASK_STALL) {
+                /* dbg_td(c67x00, td, "STALL"); */
+                return -EPIPE;
+        }
+        if (td->status & TD_STATUSMASK_TMOUT) {
+                dbg_td(c67x00, td, "TIMEOUT");
+                return -ETIMEDOUT;
+        }
+
+        return 0;
+}
+
+static inline int c67x00_end_of_data(struct c67x00_td *td)
+{
+        int maxps, need_empty, remaining;
+        struct urb *urb = td->urb;
+        int act_bytes;
+
+        act_bytes = td_actual_bytes(td);
+
+        if (unlikely(!act_bytes))
+                return 1;       /* This was an empty packet */
+
+        maxps = usb_maxpacket(td_udev(td), td->pipe, usb_pipeout(td->pipe));
+
+        if (unlikely(act_bytes < maxps))
+                return 1;       /* Smaller then full packet */
+
+        remaining = urb->transfer_buffer_length - urb->actual_length;
+        need_empty = (urb->transfer_flags & URB_ZERO_PACKET) &&
+            usb_pipeout(urb->pipe) && !(remaining % maxps);
+
+        if (unlikely(!remaining && !need_empty))
+                return 1;
+
+        return 0;
+}
+
+/* -------------------------------------------------------------------------- */
+
+/* Remove all td's from the list which come
+ * after last_td and are meant for the same pipe.
+ * This is used when a short packet has occured */
+static inline void c67x00_clear_pipe(struct c67x00_hcd *c67x00,
+                                     struct c67x00_td *last_td)
+{
+        struct c67x00_td *td, *tmp;
+        td = last_td;
+        tmp = last_td;
+        while (td->td_list.next != &c67x00->td_list) {
+                td = list_entry(td->td_list.next, struct c67x00_td, td_list);
+                if (td->pipe == last_td->pipe) {
+                        c67x00_release_td(td);
+                        td = tmp;
+                }
+                tmp = td;
+        }
+}
+
+/* -------------------------------------------------------------------------- */
+
+static void c67x00_handle_successful_td(struct c67x00_hcd *c67x00,
+                                        struct c67x00_td *td)
+{
+        struct urb *urb = td->urb;
+
+        if (!urb)
+                return;
+
+        urb->actual_length += td_actual_bytes(td);
+
+        switch (usb_pipetype(td->pipe)) {
+                /* isochronous tds are handled separately */
+        case PIPE_CONTROL:
+                switch (td->privdata) {
+                case SETUP_STAGE:
+                        urb->interval =
+                            urb->transfer_buffer_length ?
+                            DATA_STAGE : STATUS_STAGE;
+                        /* Don't count setup_packet with normal data: */
+                        urb->actual_length = 0;
+                        break;
+
+                case DATA_STAGE:
+                        if (c67x00_end_of_data(td)) {
+                                urb->interval = STATUS_STAGE;
+                                c67x00_clear_pipe(c67x00, td);
+                        }
+                        break;
+
+                case STATUS_STAGE:
+                        urb->interval = 0;
+                        c67x00_giveback_urb(c67x00, urb, 0);
+                        break;
+                }
+                break;
+
+        case PIPE_INTERRUPT:
+        case PIPE_BULK:
+                if (unlikely(c67x00_end_of_data(td))) {
+                        c67x00_clear_pipe(c67x00, td);
+                        c67x00_giveback_urb(c67x00, urb, 0);
+                }
+                break;
+        }
+}
+
+static void c67x00_handle_isoc(struct c67x00_hcd *c67x00, struct c67x00_td *td)
+{
+        struct urb *urb = td->urb;
+        struct c67x00_urb_priv *urbp;
+        int cnt;
+
+        if (!urb)
+                return;
+
+        urbp = urb->hcpriv;
+        cnt = td->privdata;
+
+        if (td->status & TD_ERROR_MASK)
+                urb->error_count++;
+
+        urb->iso_frame_desc[cnt].actual_length = td_actual_bytes(td);
+        urb->iso_frame_desc[cnt].status = c67x00_td_to_error(c67x00, td);
+        if (cnt + 1 == urb->number_of_packets)  /* Last packet */
+                c67x00_giveback_urb(c67x00, urb, 0);
+}
+
+/* -------------------------------------------------------------------------- */
+
+/**
+ * c67x00_check_td_list - handle tds which have been processed by the c67x00
+ * pre: current_td == 0
+ */
+static inline void c67x00_check_td_list(struct c67x00_hcd *c67x00)
+{
+        struct c67x00_td *td, *tmp;
+        struct urb *urb;
+        int ack_ok;
+        int clear_endpoint;
+
+        list_for_each_entry_safe(td, tmp, &c67x00->td_list, td_list) {
+                /* get the TD */
+                c67x00_parse_td(c67x00, td);
+                urb = td->urb;  /* urb can be NULL! */
+                ack_ok = 0;
+                clear_endpoint = 1;
+
+                /* Handle isochronous transfers separately */
+                if (usb_pipeisoc(td->pipe)) {
+                        clear_endpoint = 0;
+                        c67x00_handle_isoc(c67x00, td);
+                        goto cont;
+                }
+
+                /* When an error occurs, all td's for that pipe go into an
+                 * inactive state. This state matches successful transfers so
+                 * we must make sure not to service them. */
+                if (td->status & TD_ERROR_MASK) {
+                        c67x00_giveback_urb(c67x00, urb,
+                                            c67x00_td_to_error(c67x00, td));
+                        goto cont;
+                }
+
+                if ((td->status & TD_STATUSMASK_NAK) || !td_sequence_ok(td) ||
+                    !td_acked(td))
+                        goto cont;
+
+                /* Sequence ok and acked, don't need to fix toggle */
+                ack_ok = 1;
+
+                if (unlikely(td->status & TD_STATUSMASK_OVF)) {
+                        if (td_residue(td) & TD_RESIDUE_OVERFLOW) {
+                                /* Overflow */
+                                c67x00_giveback_urb(c67x00, urb, -EOVERFLOW);
+                                goto cont;
+                        }
+                }
+
+                clear_endpoint = 0;
+                c67x00_handle_successful_td(c67x00, td);
+
+cont:
+                if (clear_endpoint)
+                        c67x00_clear_pipe(c67x00, td);
+                if (ack_ok)
+                        usb_settoggle(td_udev(td), usb_pipeendpoint(td->pipe),
+                                      usb_pipeout(td->pipe),
+                                      !(td->ctrl_reg & SEQ_SEL));
+                /* next in list could have been removed, due to clear_pipe! */
+                tmp = list_entry(td->td_list.next, typeof(*td), td_list);
+                c67x00_release_td(td);
+        }
+}
+
+/* -------------------------------------------------------------------------- */
+
+static inline int c67x00_all_tds_processed(struct c67x00_hcd *c67x00)
+{
+        /* If all tds are processed, we can check the previous frame (if
+         * there was any) and start our next frame.
+         */
+        return !c67x00_ll_husb_get_current_td(c67x00->sie);
+}
+
+/**
+ * Send td to C67X00
+ */
+static void c67x00_send_td(struct c67x00_hcd *c67x00, struct c67x00_td *td)
+{
+        int len = td_length(td);
+
+        if (len && ((td->pid_ep & TD_PIDEPMASK_PID) != TD_PID_IN))
+                c67x00_ll_write_mem_le16(c67x00->sie->dev, td_ly_base_addr(td),
+                                         td->data, len);
+
+        c67x00_ll_write_mem_le16(c67x00->sie->dev,
+                                 td->td_addr, td, CY_TD_SIZE);
+}
+
+static void c67x00_send_frame(struct c67x00_hcd *c67x00)
+{
+        struct c67x00_td *td;
+
+        if (list_empty(&c67x00->td_list))
+                dev_warn(c67x00_hcd_dev(c67x00),
+                         "%s: td list should not be empty here!\n",
+                         __func__);
+
+        list_for_each_entry(td, &c67x00->td_list, td_list) {
+                if (td->td_list.next == &c67x00->td_list)
+                        td->next_td_addr = 0;   /* Last td in list */
+
+                c67x00_send_td(c67x00, td);
+        }
+
+        c67x00_ll_husb_set_current_td(c67x00->sie, c67x00->td_base_addr);
+}
+
+/* -------------------------------------------------------------------------- */
+
+/**
+ * c67x00_do_work - Schedulers state machine
+ */
+static void c67x00_do_work(struct c67x00_hcd *c67x00)
+{
+        spin_lock(&c67x00->lock);
+        /* Make sure all tds are processed */
+        if (!c67x00_all_tds_processed(c67x00))
+                goto out;
+
+        c67x00_check_td_list(c67x00);
+
+        /* no td's are being processed (current == 0)
+         * and all have been "checked" */
+        complete(&c67x00->endpoint_disable);
+
+        if (!list_empty(&c67x00->td_list))
+                goto out;
+
+        c67x00->current_frame = c67x00_get_current_frame_number(c67x00);
+        if (c67x00->current_frame == c67x00->last_frame)
+                goto out;       /* Don't send tds in same frame */
+        c67x00->last_frame = c67x00->current_frame;
+
+        /* If no urbs are scheduled, our work is done */
+        if (!c67x00->urb_count) {
+                c67x00_ll_hpi_disable_sofeop(c67x00->sie);
+                goto out;
+        }
+
+        c67x00_fill_frame(c67x00);
+        if (!list_empty(&c67x00->td_list))
+                /* TD's have been added to the frame */
+                c67x00_send_frame(c67x00);
+
+ out:
+        spin_unlock(&c67x00->lock);
+}
+
+/* -------------------------------------------------------------------------- */
+
+static void c67x00_sched_tasklet(unsigned long __c67x00)
+{
+        struct c67x00_hcd *c67x00 = (struct c67x00_hcd *)__c67x00;
+        c67x00_do_work(c67x00);
+}
+
+void c67x00_sched_kick(struct c67x00_hcd *c67x00)
+{
+        tasklet_hi_schedule(&c67x00->tasklet);
+}
+
+int c67x00_sched_start_scheduler(struct c67x00_hcd *c67x00)
+{
+        tasklet_init(&c67x00->tasklet, c67x00_sched_tasklet,
+                     (unsigned long)c67x00);
+        return 0;
+}
+
+void c67x00_sched_stop_scheduler(struct c67x00_hcd *c67x00)
+{
+        tasklet_kill(&c67x00->tasklet);
+}
diff --git a/drivers/usb/c67x00/c67x00.h b/drivers/usb/c67x00/c67x00.h
new file mode 100644
index 00000000000..a26e9ded0f3
--- /dev/null
+++ b/drivers/usb/c67x00/c67x00.h
@@ -0,0 +1,294 @@
+/*
+ * c67x00.h: Cypress C67X00 USB register and field definitions
+ *
+ * Copyright (C) 2006-2008 Barco N.V.
+ *    Derived from the Cypress cy7c67200/300 ezusb linux driver and
+ *    based on multiple host controller drivers inside the linux kernel.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA  02110-1301  USA.
+ */
+
+#ifndef _USB_C67X00_H
+#define _USB_C67X00_H
+
+#include <linux/spinlock.h>
+#include <linux/platform_device.h>
+#include <linux/completion.h>
+#include <linux/mutex.h>
+
+/* ---------------------------------------------------------------------
+ * Cypress C67x00 register definitions
+ */
+
+/* Hardware Revision Register */
+#define HW_REV_REG              0xC004
+
+/* General USB registers */
+/* ===================== */
+
+/* USB Control Register */
+#define USB_CTL_REG(x)          ((x) ? 0xC0AA : 0xC08A)
+
+#define LOW_SPEED_PORT(x)       ((x) ? 0x0800 : 0x0400)
+#define HOST_MODE               0x0200
+#define PORT_RES_EN(x)          ((x) ? 0x0100 : 0x0080)
+#define SOF_EOP_EN(x)           ((x) ? 0x0002 : 0x0001)
+
+/* USB status register - Notice it has different content in hcd/udc mode */
+#define USB_STAT_REG(x)         ((x) ? 0xC0B0 : 0xC090)
+
+#define EP0_IRQ_FLG             0x0001
+#define EP1_IRQ_FLG             0x0002
+#define EP2_IRQ_FLG             0x0004
+#define EP3_IRQ_FLG             0x0008
+#define EP4_IRQ_FLG             0x0010
+#define EP5_IRQ_FLG             0x0020
+#define EP6_IRQ_FLG             0x0040
+#define EP7_IRQ_FLG             0x0080
+#define RESET_IRQ_FLG           0x0100
+#define SOF_EOP_IRQ_FLG         0x0200
+#define ID_IRQ_FLG              0x4000
+#define VBUS_IRQ_FLG            0x8000
+
+/* USB Host only registers */
+/* ======================= */
+
+/* Host n Control Register */
+#define HOST_CTL_REG(x)         ((x) ? 0xC0A0 : 0xC080)
+
+#define PREAMBLE_EN             0x0080  /* Preamble enable */
+#define SEQ_SEL                 0x0040  /* Data Toggle Sequence Bit Select */
+#define ISO_EN                  0x0010  /* Isochronous enable  */
+#define ARM_EN                  0x0001  /* Arm operation */
+
+/* Host n Interrupt Enable Register */
+#define HOST_IRQ_EN_REG(x)      ((x) ? 0xC0AC : 0xC08C)
+
+#define SOF_EOP_IRQ_EN          0x0200  /* SOF/EOP Interrupt Enable  */
+#define SOF_EOP_TMOUT_IRQ_EN    0x0800  /* SOF/EOP Timeout Interrupt Enable  */
+#define ID_IRQ_EN               0x4000  /* ID interrupt enable */
+#define VBUS_IRQ_EN             0x8000  /* VBUS interrupt enable */
+#define DONE_IRQ_EN             0x0001  /* Done Interrupt Enable  */
+
+/* USB status register */
+#define HOST_STAT_MASK          0x02FD
+#define PORT_CONNECT_CHANGE(x)  ((x) ? 0x0020 : 0x0010)
+#define PORT_SE0_STATUS(x)      ((x) ? 0x0008 : 0x0004)
+
+/* Host Frame Register */
+#define HOST_FRAME_REG(x)       ((x) ? 0xC0B6 : 0xC096)
+
+#define HOST_FRAME_MASK         0x07FF
+
+/* USB Peripheral only registers */
+/* ============================= */
+
+/* Device n Port Sel reg */
+#define DEVICE_N_PORT_SEL(x)    ((x) ? 0xC0A4 : 0xC084)
+
+/* Device n Interrupt Enable Register */
+#define DEVICE_N_IRQ_EN_REG(x)  ((x) ? 0xC0AC : 0xC08C)
+
+#define DEVICE_N_ENDPOINT_N_CTL_REG(dev, ep)    ((dev)                  \
+                                                 ? (0x0280 + (ep << 4)) \
+                                                 : (0x0200 + (ep << 4)))
+#define DEVICE_N_ENDPOINT_N_STAT_REG(dev, ep)   ((dev)                  \
+                                                 ? (0x0286 + (ep << 4)) \
+                                                 : (0x0206 + (ep << 4)))
+
+#define DEVICE_N_ADDRESS(dev)   ((dev) ? (0xC0AE) : (0xC08E))
+
+/* HPI registers */
+/* ============= */
+
+/* HPI Status register */
+#define SOFEOP_FLG(x)           (1 << ((x) ? 12 : 10))
+#define SIEMSG_FLG(x)           (1 << (4 + (x)))
+#define RESET_FLG(x)            ((x) ? 0x0200 : 0x0002)
+#define DONE_FLG(x)             (1 << (2 + (x)))
+#define RESUME_FLG(x)           (1 << (6 + (x)))
+#define MBX_OUT_FLG             0x0001  /* Message out available */
+#define MBX_IN_FLG              0x0100
+#define ID_FLG                  0x4000
+#define VBUS_FLG                0x8000
+
+/* Interrupt routing register */
+#define HPI_IRQ_ROUTING_REG     0x0142
+
+#define HPI_SWAP_ENABLE(x)      ((x) ? 0x0100 : 0x0001)
+#define RESET_TO_HPI_ENABLE(x)  ((x) ? 0x0200 : 0x0002)
+#define DONE_TO_HPI_ENABLE(x)   ((x) ? 0x0008 : 0x0004)
+#define RESUME_TO_HPI_ENABLE(x) ((x) ? 0x0080 : 0x0040)
+#define SOFEOP_TO_HPI_EN(x)     ((x) ? 0x2000 : 0x0800)
+#define SOFEOP_TO_CPU_EN(x)     ((x) ? 0x1000 : 0x0400)
+#define ID_TO_HPI_ENABLE        0x4000
+#define VBUS_TO_HPI_ENABLE      0x8000
+
+/* SIE msg registers */
+#define SIEMSG_REG(x)           ((x) ? 0x0148 : 0x0144)
+
+#define HUSB_TDListDone         0x1000
+
+#define SUSB_EP0_MSG            0x0001
+#define SUSB_EP1_MSG            0x0002
+#define SUSB_EP2_MSG            0x0004
+#define SUSB_EP3_MSG            0x0008
+#define SUSB_EP4_MSG            0x0010
+#define SUSB_EP5_MSG            0x0020
+#define SUSB_EP6_MSG            0x0040
+#define SUSB_EP7_MSG            0x0080
+#define SUSB_RST_MSG            0x0100
+#define SUSB_SOF_MSG            0x0200
+#define SUSB_CFG_MSG            0x0400
+#define SUSB_SUS_MSG            0x0800
+#define SUSB_ID_MSG             0x4000
+#define SUSB_VBUS_MSG           0x8000
+
+/* BIOS interrupt routines */
+
+#define SUSBx_RECEIVE_INT(x)    ((x) ? 97 : 81)
+#define SUSBx_SEND_INT(x)       ((x) ? 96 : 80)
+
+#define SUSBx_DEV_DESC_VEC(x)   ((x) ? 0x00D4 : 0x00B4)
+#define SUSBx_CONF_DESC_VEC(x)  ((x) ? 0x00D6 : 0x00B6)
+#define SUSBx_STRING_DESC_VEC(x) ((x) ? 0x00D8 : 0x00B8)
+
+#define CY_HCD_BUF_ADDR         0x500   /* Base address for host */
+#define SIE_TD_SIZE             0x200   /* size of the td list */
+#define SIE_TD_BUF_SIZE         0x400   /* size of the data buffer */
+
+#define SIE_TD_OFFSET(host)     ((host) ? (SIE_TD_SIZE+SIE_TD_BUF_SIZE) : 0)
+#define SIE_BUF_OFFSET(host)    (SIE_TD_OFFSET(host) + SIE_TD_SIZE)
+
+/* Base address of HCD + 2 x TD_SIZE + 2 x TD_BUF_SIZE */
+#define CY_UDC_REQ_HEADER_BASE  0x1100
+/* 8- byte request headers for IN/OUT transfers */
+#define CY_UDC_REQ_HEADER_SIZE  8
+
+#define CY_UDC_REQ_HEADER_ADDR(ep_num)  (CY_UDC_REQ_HEADER_BASE + \
+                                         ((ep_num) * CY_UDC_REQ_HEADER_SIZE))
+#define CY_UDC_DESC_BASE_ADDRESS        (CY_UDC_REQ_HEADER_ADDR(8))
+
+#define CY_UDC_BIOS_REPLACE_BASE        0x1800
+#define CY_UDC_REQ_BUFFER_BASE          0x2000
+#define CY_UDC_REQ_BUFFER_SIZE          0x0400
+#define CY_UDC_REQ_BUFFER_ADDR(ep_num)  (CY_UDC_REQ_BUFFER_BASE + \
+                                         ((ep_num) * CY_UDC_REQ_BUFFER_SIZE))
+
+/* ---------------------------------------------------------------------
+ * Driver data structures
+ */
+
+struct c67x00_device;
+
+/**
+ * struct c67x00_sie - Common data associated with a SIE
+ * @lock: lock to protect this struct and the associated chip registers
+ * @private_data: subdriver dependent data
+ * @irq: subdriver dependent irq handler, set NULL when not used
+ * @dev: link to common driver structure
+ * @sie_num: SIE number on chip, starting from 0
+ * @mode: SIE mode (host/peripheral/otg/not used)
+ */
+struct c67x00_sie {
+        /* Entries to be used by the subdrivers */
+        spinlock_t lock;        /* protect this structure */
+        void *private_data;
+        void (*irq) (struct c67x00_sie *sie, u16 int_status, u16 msg);
+
+        /* Read only: */
+        struct c67x00_device *dev;
+        int sie_num;
+        int mode;
+};
+
+#define sie_dev(s)      (&(s)->dev->pdev->dev)
+
+/**
+ * struct c67x00_lcp
+ */
+struct c67x00_lcp {
+        /* Internal use only */
+        struct mutex mutex;
+        struct completion msg_received;
+        u16 last_msg;
+};
+
+/*
+ * struct c67x00_hpi
+ */
+struct c67x00_hpi {
+        void __iomem *base;
+        int regstep;
+        spinlock_t lock;
+        struct c67x00_lcp lcp;
+};
+
+#define C67X00_SIES     2
+#define C67X00_PORTS    2
+
+/**
+ * struct c67x00_device - Common data associated with a c67x00 instance
+ * @hpi: hpi addresses
+ * @sie: array of sie's on this chip
+ * @pdev: platform device of instance
+ * @pdata: configuration provided by the platform
+ */
+struct c67x00_device {
+        struct c67x00_hpi hpi;
+        struct c67x00_sie sie[C67X00_SIES];
+        struct platform_device *pdev;
+        struct c67x00_platform_data *pdata;
+};
+
+/* ---------------------------------------------------------------------
+ * Low level interface functions
+ */
+
+/* Host Port Interface (HPI) functions */
+u16 c67x00_ll_hpi_status(struct c67x00_device *dev);
+void c67x00_ll_hpi_reg_init(struct c67x00_device *dev);
+void c67x00_ll_hpi_enable_sofeop(struct c67x00_sie *sie);
+void c67x00_ll_hpi_disable_sofeop(struct c67x00_sie *sie);
+
+/* General functions */
+u16 c67x00_ll_fetch_siemsg(struct c67x00_device *dev, int sie_num);
+u16 c67x00_ll_get_usb_ctl(struct c67x00_sie *sie);
+void c67x00_ll_usb_clear_status(struct c67x00_sie *sie, u16 bits);
+u16 c67x00_ll_usb_get_status(struct c67x00_sie *sie);
+void c67x00_ll_write_mem_le16(struct c67x00_device *dev, u16 addr,
+                              void *data, int len);
+void c67x00_ll_read_mem_le16(struct c67x00_device *dev, u16 addr,
+                             void *data, int len);
+
+/* Host specific functions */
+void c67x00_ll_set_husb_eot(struct c67x00_device *dev, u16 value);
+void c67x00_ll_husb_reset(struct c67x00_sie *sie, int port);
+void c67x00_ll_husb_set_current_td(struct c67x00_sie *sie, u16 addr);
+u16 c67x00_ll_husb_get_current_td(struct c67x00_sie *sie);
+u16 c67x00_ll_husb_get_frame(struct c67x00_sie *sie);
+void c67x00_ll_husb_init_host_port(struct c67x00_sie *sie);
+void c67x00_ll_husb_reset_port(struct c67x00_sie *sie, int port);
+
+/* Called by c67x00_irq to handle lcp interrupts */
+void c67x00_ll_irq(struct c67x00_device *dev, u16 int_status);
+
+/* Setup and teardown */
+void c67x00_ll_init(struct c67x00_device *dev);
+void c67x00_ll_release(struct c67x00_device *dev);
+int c67x00_ll_reset(struct c67x00_device *dev);
+
+#endif                          /* _USB_C67X00_H */
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index e819e5359d5..3e69266e1f4 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -394,7 +394,9 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
         if (!io->urbs)
                 goto nomem;
 
-        urb_flags = URB_NO_TRANSFER_DMA_MAP | URB_NO_INTERRUPT;
+        urb_flags = URB_NO_INTERRUPT;
+        if (dma)
+                urb_flags |= URB_NO_TRANSFER_DMA_MAP;
         if (usb_pipein(pipe))
                 urb_flags |= URB_SHORT_NOT_OK;
 
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index f7b54651dd4..6e784d2db42 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -231,6 +231,26 @@ config SUPERH_BUILT_IN_M66592
            However, this problem is improved if change a value of
            NET_IP_ALIGN to 4.
 
+config USB_GADGET_PXA27X
+        boolean "PXA 27x"
+        depends on ARCH_PXA && PXA27x
+        help
+           Intel's PXA 27x series XScale ARM v5TE processors include
+           an integrated full speed USB 1.1 device controller.
+
+           It has up to 23 endpoints, as well as endpoint zero (for
+           control transfers).
+
+           Say "y" to link the driver statically, or "m" to build a
+           dynamically linked module called "pxa27x_udc" and force all
+           gadget drivers to also be dynamically linked.
+
+config USB_PXA27X
+        tristate
+        depends on USB_GADGET_PXA27X
+        default USB_GADGET
+        select USB_GADGET_SELECTED
+
 config USB_GADGET_GOKU
         boolean "Toshiba TC86C001 'Goku-S'"
         depends on PCI
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index c3aab80b6c7..12357255d74 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_DUMMY_HCD)	+= dummy_hcd.o
 obj-$(CONFIG_USB_NET2280)       += net2280.o
 obj-$(CONFIG_USB_AMD5536UDC)    += amd5536udc.o
 obj-$(CONFIG_USB_PXA2XX)        += pxa2xx_udc.o
+obj-$(CONFIG_USB_PXA27X)        += pxa27x_udc.o
 obj-$(CONFIG_USB_GOKU)          += goku_udc.o
 obj-$(CONFIG_USB_OMAP)          += omap_udc.o
 obj-$(CONFIG_USB_LH7A40X)       += lh7a40x_udc.o
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index bb93bdd7659..8d61ea67a81 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -235,10 +235,6 @@ MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
 #define DEV_CONFIG_CDC
 #endif
 
-#ifdef CONFIG_USB_GADGET_PXA27X
-#define DEV_CONFIG_CDC
-#endif
-
 #ifdef CONFIG_USB_GADGET_S3C2410
 #define DEV_CONFIG_CDC
 #endif
@@ -270,6 +266,10 @@ MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
 #define DEV_CONFIG_SUBSET
 #endif
 
+#ifdef CONFIG_USB_GADGET_PXA27X
+#define DEV_CONFIG_SUBSET
+#endif
+
 #ifdef CONFIG_USB_GADGET_SUPERH
 #define DEV_CONFIG_SUBSET
 #endif
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index bf3f946fd45..47bb9f09a1a 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -2307,6 +2307,29 @@ static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
         return rc;
 }
 
+static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+        int     rc;
+
+        DBG(fsg, "bulk-in set wedge\n");
+        rc = usb_ep_set_wedge(fsg->bulk_in);
+        if (rc == -EAGAIN)
+                VDBG(fsg, "delayed bulk-in endpoint wedge\n");
+        while (rc != 0) {
+                if (rc != -EAGAIN) {
+                        WARN(fsg, "usb_ep_set_wedge -> %d\n", rc);
+                        rc = 0;
+                        break;
+                }
+
+                /* Wait for a short time and then try again */
+                if (msleep_interruptible(100) != 0)
+                        return -EINTR;
+                rc = usb_ep_set_wedge(fsg->bulk_in);
+        }
+        return rc;
+}
+
 static int pad_with_zeros(struct fsg_dev *fsg)
 {
         struct fsg_buffhd       *bh = fsg->next_buffhd_to_fill;
@@ -2957,7 +2980,7 @@ static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
                  * We aren't required to halt the OUT endpoint; instead
                  * we can simply accept and discard any data received
                  * until the next reset. */
-                halt_bulk_in_endpoint(fsg);
+                wedge_bulk_in_endpoint(fsg);
                 set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
                 return -EINVAL;
         }
diff --git a/drivers/usb/gadget/pxa27x_udc.c b/drivers/usb/gadget/pxa27x_udc.c
new file mode 100644
index 00000000000..75eba202f73
--- /dev/null
+++ b/drivers/usb/gadget/pxa27x_udc.c
@@ -0,0 +1,2404 @@
+/*
+ * Handles the Intel 27x USB Device Controller (UDC)
+ *
+ * Inspired by original driver by Frank Becker, David Brownell, and others.
+ * Copyright (C) 2008 Robert Jarzmik
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/version.h>
+#include <linux/errno.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/proc_fs.h>
+#include <linux/clk.h>
+#include <linux/irq.h>
+
+#include <asm/byteorder.h>
+#include <asm/hardware.h>
+
+#include <linux/usb.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+
+#include <asm/arch/udc.h>
+
+#include "pxa27x_udc.h"
+
+/*
+ * This driver handles the USB Device Controller (UDC) in Intel's PXA 27x
+ * series processors.
+ *
+ * Such controller drivers work with a gadget driver.  The gadget driver
+ * returns descriptors, implements configuration and data protocols used
+ * by the host to interact with this device, and allocates endpoints to
+ * the different protocol interfaces.  The controller driver virtualizes
+ * usb hardware so that the gadget drivers will be more portable.
+ *
+ * This UDC hardware wants to implement a bit too much USB protocol. The
+ * biggest issues are:  that the endpoints have to be set up before the
+ * controller can be enabled (minor, and not uncommon); and each endpoint
+ * can only have one configuration, interface and alternative interface
+ * number (major, and very unusual). Once set up, these cannot be changed
+ * without a controller reset.
+ *
+ * The workaround is to setup all combinations necessary for the gadgets which
+ * will work with this driver. This is done in pxa_udc structure, statically.
+ * See pxa_udc, udc_usb_ep versus pxa_ep, and matching function find_pxa_ep.
+ * (You could modify this if needed.  Some drivers have a "fifo_mode" module
+ * parameter to facilitate such changes.)
+ *
+ * The combinations have been tested with these gadgets :
+ *  - zero gadget
+ *  - file storage gadget
+ *  - ether gadget
+ *
+ * The driver doesn't use DMA, only IO access and IRQ callbacks. No use is
+ * made of UDC's double buffering either. USB "On-The-Go" is not implemented.
+ *
+ * All the requests are handled the same way :
+ *  - the drivers tries to handle the request directly to the IO
+ *  - if the IO fifo is not big enough, the remaining is send/received in
+ *    interrupt handling.
+ */
+
+#define DRIVER_VERSION  "2008-04-18"
+#define DRIVER_DESC     "PXA 27x USB Device Controller driver"
+
+static const char driver_name[] = "pxa27x_udc";
+static struct pxa_udc *the_controller;
+
+static void handle_ep(struct pxa_ep *ep);
+
+/*
+ * Debug filesystem
+ */
+#ifdef CONFIG_USB_GADGET_DEBUG_FS
+
+#include <linux/debugfs.h>
+#include <linux/uaccess.h>
+#include <linux/seq_file.h>
+
+static int state_dbg_show(struct seq_file *s, void *p)
+{
+        struct pxa_udc *udc = s->private;
+        int pos = 0, ret;
+        u32 tmp;
+
+        ret = -ENODEV;
+        if (!udc->driver)
+                goto out;
+
+        /* basic device status */
+        pos += seq_printf(s, DRIVER_DESC "\n"
+                         "%s version: %s\nGadget driver: %s\n",
+                         driver_name, DRIVER_VERSION,
+                         udc->driver ? udc->driver->driver.name : "(none)");
+
+        tmp = udc_readl(udc, UDCCR);
+        pos += seq_printf(s,
+                         "udccr=0x%0x(%s%s%s%s%s%s%s%s%s%s), "
+                         "con=%d,inter=%d,altinter=%d\n", tmp,
+                         (tmp & UDCCR_OEN) ? " oen":"",
+                         (tmp & UDCCR_AALTHNP) ? " aalthnp":"",
+                         (tmp & UDCCR_AHNP) ? " rem" : "",
+                         (tmp & UDCCR_BHNP) ? " rstir" : "",
+                         (tmp & UDCCR_DWRE) ? " dwre" : "",
+                         (tmp & UDCCR_SMAC) ? " smac" : "",
+                         (tmp & UDCCR_EMCE) ? " emce" : "",
+                         (tmp & UDCCR_UDR) ? " udr" : "",
+                         (tmp & UDCCR_UDA) ? " uda" : "",
+                         (tmp & UDCCR_UDE) ? " ude" : "",
+                         (tmp & UDCCR_ACN) >> UDCCR_ACN_S,
+                         (tmp & UDCCR_AIN) >> UDCCR_AIN_S,
+                         (tmp & UDCCR_AAISN) >> UDCCR_AAISN_S);
+        /* registers for device and ep0 */
+        pos += seq_printf(s, "udcicr0=0x%08x udcicr1=0x%08x\n",
+                        udc_readl(udc, UDCICR0), udc_readl(udc, UDCICR1));
+        pos += seq_printf(s, "udcisr0=0x%08x udcisr1=0x%08x\n",
+                        udc_readl(udc, UDCISR0), udc_readl(udc, UDCISR1));
+        pos += seq_printf(s, "udcfnr=%d\n", udc_readl(udc, UDCFNR));
+        pos += seq_printf(s, "irqs: reset=%lu, suspend=%lu, resume=%lu, "
+                        "reconfig=%lu\n",
+                        udc->stats.irqs_reset, udc->stats.irqs_suspend,
+                        udc->stats.irqs_resume, udc->stats.irqs_reconfig);
+
+        ret = 0;
+out:
+        return ret;
+}
+
+static int queues_dbg_show(struct seq_file *s, void *p)
+{
+        struct pxa_udc *udc = s->private;
+        struct pxa_ep *ep;
+        struct pxa27x_request *req;
+        int pos = 0, i, maxpkt, ret;
+
+        ret = -ENODEV;
+        if (!udc->driver)
+                goto out;
+
+        /* dump endpoint queues */
+        for (i = 0; i < NR_PXA_ENDPOINTS; i++) {
+                ep = &udc->pxa_ep[i];
+                maxpkt = ep->fifo_size;
+                pos += seq_printf(s,  "%-12s max_pkt=%d %s\n",
+                                EPNAME(ep), maxpkt, "pio");
+
+                if (list_empty(&ep->queue)) {
+                        pos += seq_printf(s, "\t(nothing queued)\n");
+                        continue;
+                }
+
+                list_for_each_entry(req, &ep->queue, queue) {
+                        pos += seq_printf(s,  "\treq %p len %d/%d buf %p\n",
+                                        &req->req, req->req.actual,
+                                        req->req.length, req->req.buf);
+                }
+        }
+
+        ret = 0;
+out:
+        return ret;
+}
+
+static int eps_dbg_show(struct seq_file *s, void *p)
+{
+        struct pxa_udc *udc = s->private;
+        struct pxa_ep *ep;
+        int pos = 0, i, ret;
+        u32 tmp;
+
+        ret = -ENODEV;
+        if (!udc->driver)
+                goto out;
+
+        ep = &udc->pxa_ep[0];
+        tmp = udc_ep_readl(ep, UDCCSR);
+        pos += seq_printf(s, "udccsr0=0x%03x(%s%s%s%s%s%s%s)\n", tmp,
+                         (tmp & UDCCSR0_SA) ? " sa" : "",
+                         (tmp & UDCCSR0_RNE) ? " rne" : "",
+                         (tmp & UDCCSR0_FST) ? " fst" : "",
+                         (tmp & UDCCSR0_SST) ? " sst" : "",
+                         (tmp & UDCCSR0_DME) ? " dme" : "",
+                         (tmp & UDCCSR0_IPR) ? " ipr" : "",
+                         (tmp & UDCCSR0_OPC) ? " opc" : "");
+        for (i = 0; i < NR_PXA_ENDPOINTS; i++) {
+                ep = &udc->pxa_ep[i];
+                tmp = i? udc_ep_readl(ep, UDCCR) : udc_readl(udc, UDCCR);
+                pos += seq_printf(s, "%-12s: "
+                                "IN %lu(%lu reqs), OUT %lu(%lu reqs), "
+                                "irqs=%lu, udccr=0x%08x, udccsr=0x%03x, "
+                                "udcbcr=%d\n",
+                                EPNAME(ep),
+                                ep->stats.in_bytes, ep->stats.in_ops,
+                                ep->stats.out_bytes, ep->stats.out_ops,
+                                ep->stats.irqs,
+                                tmp, udc_ep_readl(ep, UDCCSR),
+                                udc_ep_readl(ep, UDCBCR));
+        }
+
+        ret = 0;
+out:
+        return ret;
+}
+
+static int eps_dbg_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, eps_dbg_show, inode->i_private);
+}
+
+static int queues_dbg_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, queues_dbg_show, inode->i_private);
+}
+
+static int state_dbg_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, state_dbg_show, inode->i_private);
+}
+
+static const struct file_operations state_dbg_fops = {
+        .owner          = THIS_MODULE,
+        .open           = state_dbg_open,
+        .llseek         = seq_lseek,
+        .read           = seq_read,
+        .release        = single_release,
+};
+
+static const struct file_operations queues_dbg_fops = {
+        .owner          = THIS_MODULE,
+        .open           = queues_dbg_open,
+        .llseek         = seq_lseek,
+        .read           = seq_read,
+        .release        = single_release,
+};
+
+static const struct file_operations eps_dbg_fops = {
+        .owner          = THIS_MODULE,
+        .open           = eps_dbg_open,
+        .llseek         = seq_lseek,
+        .read           = seq_read,
+        .release        = single_release,
+};
+
+static void pxa_init_debugfs(struct pxa_udc *udc)
+{
+        struct dentry *root, *state, *queues, *eps;
+
+        root = debugfs_create_dir(udc->gadget.name, NULL);
+        if (IS_ERR(root) || !root)
+                goto err_root;
+
+        state = debugfs_create_file("udcstate", 0400, root, udc,
+                        &state_dbg_fops);
+        if (!state)
+                goto err_state;
+        queues = debugfs_create_file("queues", 0400, root, udc,
+                        &queues_dbg_fops);
+        if (!queues)
+                goto err_queues;
+        eps = debugfs_create_file("epstate", 0400, root, udc,
+                        &eps_dbg_fops);
+        if (!queues)
+                goto err_eps;
+
+        udc->debugfs_root = root;
+        udc->debugfs_state = state;
+        udc->debugfs_queues = queues;
+        udc->debugfs_eps = eps;
+        return;
+err_eps:
+        debugfs_remove(eps);
+err_queues:
+        debugfs_remove(queues);
+err_state:
+        debugfs_remove(root);
+err_root:
+        dev_err(udc->dev, "debugfs is not available\n");
+}
+
+static void pxa_cleanup_debugfs(struct pxa_udc *udc)
+{
+        debugfs_remove(udc->debugfs_eps);
+        debugfs_remove(udc->debugfs_queues);
+        debugfs_remove(udc->debugfs_state);
+        debugfs_remove(udc->debugfs_root);
+        udc->debugfs_eps = NULL;
+        udc->debugfs_queues = NULL;
+        udc->debugfs_state = NULL;
+        udc->debugfs_root = NULL;
+}
+
+#else
+static inline void pxa_init_debugfs(struct pxa_udc *udc)
+{
+}
+
+static inline void pxa_cleanup_debugfs(struct pxa_udc *udc)
+{
+}
+#endif
+
+/**
+ * is_match_usb_pxa - check if usb_ep and pxa_ep match
+ * @udc_usb_ep: usb endpoint
+ * @ep: pxa endpoint
+ * @config: configuration required in pxa_ep
+ * @interface: interface required in pxa_ep
+ * @altsetting: altsetting required in pxa_ep
+ *
+ * Returns 1 if all criteria match between pxa and usb endpoint, 0 otherwise
+ */
+static int is_match_usb_pxa(struct udc_usb_ep *udc_usb_ep, struct pxa_ep *ep,
+                int config, int interface, int altsetting)
+{
+        if (usb_endpoint_num(&udc_usb_ep->desc) != ep->addr)
+                return 0;
+        if (usb_endpoint_dir_in(&udc_usb_ep->desc) != ep->dir_in)
+                return 0;
+        if (usb_endpoint_type(&udc_usb_ep->desc) != ep->type)
+                return 0;
+        if ((ep->config != config) || (ep->interface != interface)
+                        || (ep->alternate != altsetting))
+                return 0;
+        return 1;
+}
+
+/**
+ * find_pxa_ep - find pxa_ep structure matching udc_usb_ep
+ * @udc: pxa udc
+ * @udc_usb_ep: udc_usb_ep structure
+ *
+ * Match udc_usb_ep and all pxa_ep available, to see if one matches.
+ * This is necessary because of the strong pxa hardware restriction requiring
+ * that once pxa endpoints are initialized, their configuration is freezed, and
+ * no change can be made to their address, direction, or in which configuration,
+ * interface or altsetting they are active ... which differs from more usual
+ * models which have endpoints be roughly just addressable fifos, and leave
+ * configuration events up to gadget drivers (like all control messages).
+ *
+ * Note that there is still a blurred point here :
+ *   - we rely on UDCCR register "active interface" and "active altsetting".
+ *     This is a nonsense in regard of USB spec, where multiple interfaces are
+ *     active at the same time.
+ *   - if we knew for sure that the pxa can handle multiple interface at the
+ *     same time, assuming Intel's Developer Guide is wrong, this function
+ *     should be reviewed, and a cache of couples (iface, altsetting) should
+ *     be kept in the pxa_udc structure. In this case this function would match
+ *     against the cache of couples instead of the "last altsetting" set up.
+ *
+ * Returns the matched pxa_ep structure or NULL if none found
+ */
+static struct pxa_ep *find_pxa_ep(struct pxa_udc *udc,
+                struct udc_usb_ep *udc_usb_ep)
+{
+        int i;
+        struct pxa_ep *ep;
+        int cfg = udc->config;
+        int iface = udc->last_interface;
+        int alt = udc->last_alternate;
+
+        if (udc_usb_ep == &udc->udc_usb_ep[0])
+                return &udc->pxa_ep[0];
+
+        for (i = 1; i < NR_PXA_ENDPOINTS; i++) {
+                ep = &udc->pxa_ep[i];
+                if (is_match_usb_pxa(udc_usb_ep, ep, cfg, iface, alt))
+                        return ep;
+        }
+        return NULL;
+}
+
+/**
+ * update_pxa_ep_matches - update pxa_ep cached values in all udc_usb_ep
+ * @udc: pxa udc
+ *
+ * Context: in_interrupt()
+ *
+ * Updates all pxa_ep fields in udc_usb_ep structures, if this field was
+ * previously set up (and is not NULL). The update is necessary is a
+ * configuration change or altsetting change was issued by the USB host.
+ */
+static void update_pxa_ep_matches(struct pxa_udc *udc)
+{
+        int i;
+        struct udc_usb_ep *udc_usb_ep;
+
+        for (i = 1; i < NR_USB_ENDPOINTS; i++) {
+                udc_usb_ep = &udc->udc_usb_ep[i];
+                if (udc_usb_ep->pxa_ep)
+                        udc_usb_ep->pxa_ep = find_pxa_ep(udc, udc_usb_ep);
+        }
+}
+
+/**
+ * pio_irq_enable - Enables irq generation for one endpoint
+ * @ep: udc endpoint
+ */
+static void pio_irq_enable(struct pxa_ep *ep)
+{
+        struct pxa_udc *udc = ep->dev;
+        int index = EPIDX(ep);
+        u32 udcicr0 = udc_readl(udc, UDCICR0);
+        u32 udcicr1 = udc_readl(udc, UDCICR1);
+
+        if (index < 16)
+                udc_writel(udc, UDCICR0, udcicr0 | (3 << (index * 2)));
+        else
+                udc_writel(udc, UDCICR1, udcicr1 | (3 << ((index - 16) * 2)));
+}
+
+/**
+ * pio_irq_disable - Disables irq generation for one endpoint
+ * @ep: udc endpoint
+ * @index: endpoint number
+ */
+static void pio_irq_disable(struct pxa_ep *ep)
+{
+        struct pxa_udc *udc = ep->dev;
+        int index = EPIDX(ep);
+        u32 udcicr0 = udc_readl(udc, UDCICR0);
+        u32 udcicr1 = udc_readl(udc, UDCICR1);
+
+        if (index < 16)
+                udc_writel(udc, UDCICR0, udcicr0 & ~(3 << (index * 2)));
+        else
+                udc_writel(udc, UDCICR1, udcicr1 & ~(3 << ((index - 16) * 2)));
+}
+
+/**
+ * udc_set_mask_UDCCR - set bits in UDCCR
+ * @udc: udc device
+ * @mask: bits to set in UDCCR
+ *
+ * Sets bits in UDCCR, leaving DME and FST bits as they were.
+ */
+static inline void udc_set_mask_UDCCR(struct pxa_udc *udc, int mask)
+{
+        u32 udccr = udc_readl(udc, UDCCR);
+        udc_writel(udc, UDCCR,
+                        (udccr & UDCCR_MASK_BITS) | (mask & UDCCR_MASK_BITS));
+}
+
+/**
+ * udc_clear_mask_UDCCR - clears bits in UDCCR
+ * @udc: udc device
+ * @mask: bit to clear in UDCCR
+ *
+ * Clears bits in UDCCR, leaving DME and FST bits as they were.
+ */
+static inline void udc_clear_mask_UDCCR(struct pxa_udc *udc, int mask)
+{
+        u32 udccr = udc_readl(udc, UDCCR);
+        udc_writel(udc, UDCCR,
+                        (udccr & UDCCR_MASK_BITS) & ~(mask & UDCCR_MASK_BITS));
+}
+
+/**
+ * ep_count_bytes_remain - get how many bytes in udc endpoint
+ * @ep: udc endpoint
+ *
+ * Returns number of bytes in OUT fifos. Broken for IN fifos (-EOPNOTSUPP)
+ */
+static int ep_count_bytes_remain(struct pxa_ep *ep)
+{
+        if (ep->dir_in)
+                return -EOPNOTSUPP;
+        return udc_ep_readl(ep, UDCBCR) & 0x3ff;
+}
+
+/**
+ * ep_is_empty - checks if ep has byte ready for reading
+ * @ep: udc endpoint
+ *
+ * If endpoint is the control endpoint, checks if there are bytes in the
+ * control endpoint fifo. If endpoint is a data endpoint, checks if bytes
+ * are ready for reading on OUT endpoint.
+ *
+ * Returns 0 if ep not empty, 1 if ep empty, -EOPNOTSUPP if IN endpoint
+ */
+static int ep_is_empty(struct pxa_ep *ep)
+{
+        int ret;
+
+        if (!is_ep0(ep) && ep->dir_in)
+                return -EOPNOTSUPP;
+        if (is_ep0(ep))
+                ret = !(udc_ep_readl(ep, UDCCSR) & UDCCSR0_RNE);
+        else
+                ret = !(udc_ep_readl(ep, UDCCSR) & UDCCSR_BNE);
+        return ret;
+}
+
+/**
+ * ep_is_full - checks if ep has place to write bytes
+ * @ep: udc endpoint
+ *
+ * If endpoint is not the control endpoint and is an IN endpoint, checks if
+ * there is place to write bytes into the endpoint.
+ *
+ * Returns 0 if ep not full, 1 if ep full, -EOPNOTSUPP if OUT endpoint
+ */
+static int ep_is_full(struct pxa_ep *ep)
+{
+        if (is_ep0(ep))
+                return (udc_ep_readl(ep, UDCCSR) & UDCCSR0_IPR);
+        if (!ep->dir_in)
+                return -EOPNOTSUPP;
+        return (!(udc_ep_readl(ep, UDCCSR) & UDCCSR_BNF));
+}
+
+/**
+ * epout_has_pkt - checks if OUT endpoint fifo has a packet available
+ * @ep: pxa endpoint
+ *
+ * Returns 1 if a complete packet is available, 0 if not, -EOPNOTSUPP for IN ep.
+ */
+static int epout_has_pkt(struct pxa_ep *ep)
+{
+        if (!is_ep0(ep) && ep->dir_in)
+                return -EOPNOTSUPP;
+        if (is_ep0(ep))
+                return (udc_ep_readl(ep, UDCCSR) & UDCCSR0_OPC);
+        return (udc_ep_readl(ep, UDCCSR) & UDCCSR_PC);
+}
+
+/**
+ * set_ep0state - Set ep0 automata state
+ * @dev: udc device
+ * @state: state
+ */
+static void set_ep0state(struct pxa_udc *udc, int state)
+{
+        struct pxa_ep *ep = &udc->pxa_ep[0];
+        char *old_stname = EP0_STNAME(udc);
+
+        udc->ep0state = state;
+        ep_dbg(ep, "state=%s->%s, udccsr0=0x%03x, udcbcr=%d\n", old_stname,
+                EP0_STNAME(udc), udc_ep_readl(ep, UDCCSR),
+                udc_ep_readl(ep, UDCBCR));
+}
+
+/**
+ * ep0_idle - Put control endpoint into idle state
+ * @dev: udc device
+ */
+static void ep0_idle(struct pxa_udc *dev)
+{
+        set_ep0state(dev, WAIT_FOR_SETUP);
+}
+
+/**
+ * inc_ep_stats_reqs - Update ep stats counts
+ * @ep: physical endpoint
+ * @req: usb request
+ * @is_in: ep direction (USB_DIR_IN or 0)
+ *
+ */
+static void inc_ep_stats_reqs(struct pxa_ep *ep, int is_in)
+{
+        if (is_in)
+                ep->stats.in_ops++;
+        else
+                ep->stats.out_ops++;
+}
+
+/**
+ * inc_ep_stats_bytes - Update ep stats counts
+ * @ep: physical endpoint
+ * @count: bytes transfered on endpoint
+ * @req: usb request
+ * @is_in: ep direction (USB_DIR_IN or 0)
+ */
+static void inc_ep_stats_bytes(struct pxa_ep *ep, int count, int is_in)
+{
+        if (is_in)
+                ep->stats.in_bytes += count;
+        else
+                ep->stats.out_bytes += count;
+}
+
+/**
+ * pxa_ep_setup - Sets up an usb physical endpoint
+ * @ep: pxa27x physical endpoint
+ *
+ * Find the physical pxa27x ep, and setup its UDCCR
+ */
+static __init void pxa_ep_setup(struct pxa_ep *ep)
+{
+        u32 new_udccr;
+
+        new_udccr = ((ep->config << UDCCONR_CN_S) & UDCCONR_CN)
+                | ((ep->interface << UDCCONR_IN_S) & UDCCONR_IN)
+                | ((ep->alternate << UDCCONR_AISN_S) & UDCCONR_AISN)
+                | ((EPADDR(ep) << UDCCONR_EN_S) & UDCCONR_EN)
+                | ((EPXFERTYPE(ep) << UDCCONR_ET_S) & UDCCONR_ET)
+                | ((ep->dir_in) ? UDCCONR_ED : 0)
+                | ((ep->fifo_size << UDCCONR_MPS_S) & UDCCONR_MPS)
+                | UDCCONR_EE;
+
+        udc_ep_writel(ep, UDCCR, new_udccr);
+}
+
+/**
+ * pxa_eps_setup - Sets up all usb physical endpoints
+ * @dev: udc device
+ *
+ * Setup all pxa physical endpoints, except ep0
+ */
+static __init void pxa_eps_setup(struct pxa_udc *dev)
+{
+        unsigned int i;
+
+        dev_dbg(dev->dev, "%s: dev=%p\n", __func__, dev);
+
+        for (i = 1; i < NR_PXA_ENDPOINTS; i++)
+                pxa_ep_setup(&dev->pxa_ep[i]);
+}
+
+/**
+ * pxa_ep_alloc_request - Allocate usb request
+ * @_ep: usb endpoint
+ * @gfp_flags:
+ *
+ * For the pxa27x, these can just wrap kmalloc/kfree.  gadget drivers
+ * must still pass correctly initialized endpoints, since other controller
+ * drivers may care about how it's currently set up (dma issues etc).
+  */
+static struct usb_request *
+pxa_ep_alloc_request(struct usb_ep *_ep, gfp_t gfp_flags)
+{
+        struct pxa27x_request *req;
+
+        req = kzalloc(sizeof *req, gfp_flags);
+        if (!req || !_ep)
+                return NULL;
+
+        INIT_LIST_HEAD(&req->queue);
+        req->in_use = 0;
+        req->udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
+
+        return &req->req;
+}
+
+/**
+ * pxa_ep_free_request - Free usb request
+ * @_ep: usb endpoint
+ * @_req: usb request
+ *
+ * Wrapper around kfree to free _req
+ */
+static void pxa_ep_free_request(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct pxa27x_request *req;
+
+        req = container_of(_req, struct pxa27x_request, req);
+        WARN_ON(!list_empty(&req->queue));
+        kfree(req);
+}
+
+/**
+ * ep_add_request - add a request to the endpoint's queue
+ * @ep: usb endpoint
+ * @req: usb request
+ *
+ * Context: ep->lock held
+ *
+ * Queues the request in the endpoint's queue, and enables the interrupts
+ * on the endpoint.
+ */
+static void ep_add_request(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        if (unlikely(!req))
+                return;
+        ep_vdbg(ep, "req:%p, lg=%d, udccsr=0x%03x\n", req,
+                req->req.length, udc_ep_readl(ep, UDCCSR));
+
+        req->in_use = 1;
+        list_add_tail(&req->queue, &ep->queue);
+        pio_irq_enable(ep);
+}
+
+/**
+ * ep_del_request - removes a request from the endpoint's queue
+ * @ep: usb endpoint
+ * @req: usb request
+ *
+ * Context: ep->lock held
+ *
+ * Unqueue the request from the endpoint's queue. If there are no more requests
+ * on the endpoint, and if it's not the control endpoint, interrupts are
+ * disabled on the endpoint.
+ */
+static void ep_del_request(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        if (unlikely(!req))
+                return;
+        ep_vdbg(ep, "req:%p, lg=%d, udccsr=0x%03x\n", req,
+                req->req.length, udc_ep_readl(ep, UDCCSR));
+
+        list_del_init(&req->queue);
+        req->in_use = 0;
+        if (!is_ep0(ep) && list_empty(&ep->queue))
+                pio_irq_disable(ep);
+}
+
+/**
+ * req_done - Complete an usb request
+ * @ep: pxa physical endpoint
+ * @req: pxa request
+ * @status: usb request status sent to gadget API
+ *
+ * Context: ep->lock held
+ *
+ * Retire a pxa27x usb request. Endpoint must be locked.
+ */
+static void req_done(struct pxa_ep *ep, struct pxa27x_request *req, int status)
+{
+        ep_del_request(ep, req);
+        if (likely(req->req.status == -EINPROGRESS))
+                req->req.status = status;
+        else
+                status = req->req.status;
+
+        if (status && status != -ESHUTDOWN)
+                ep_dbg(ep, "complete req %p stat %d len %u/%u\n",
+                        &req->req, status,
+                        req->req.actual, req->req.length);
+
+        req->req.complete(&req->udc_usb_ep->usb_ep, &req->req);
+}
+
+/**
+ * ep_end_out_req - Ends control endpoint in request
+ * @ep: physical endpoint
+ * @req: pxa request
+ *
+ * Context: ep->lock held
+ *
+ * Ends endpoint in request (completes usb request).
+ */
+static void ep_end_out_req(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        inc_ep_stats_reqs(ep, !USB_DIR_IN);
+        req_done(ep, req, 0);
+}
+
+/**
+ * ep0_end_out_req - Ends control endpoint in request (ends data stage)
+ * @ep: physical endpoint
+ * @req: pxa request
+ *
+ * Context: ep->lock held
+ *
+ * Ends control endpoint in request (completes usb request), and puts
+ * control endpoint into idle state
+ */
+static void ep0_end_out_req(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        set_ep0state(ep->dev, OUT_STATUS_STAGE);
+        ep_end_out_req(ep, req);
+        ep0_idle(ep->dev);
+}
+
+/**
+ * ep_end_in_req - Ends endpoint out request
+ * @ep: physical endpoint
+ * @req: pxa request
+ *
+ * Context: ep->lock held
+ *
+ * Ends endpoint out request (completes usb request).
+ */
+static void ep_end_in_req(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        inc_ep_stats_reqs(ep, USB_DIR_IN);
+        req_done(ep, req, 0);
+}
+
+/**
+ * ep0_end_in_req - Ends control endpoint out request (ends data stage)
+ * @ep: physical endpoint
+ * @req: pxa request
+ *
+ * Context: ep->lock held
+ *
+ * Ends control endpoint out request (completes usb request), and puts
+ * control endpoint into status state
+ */
+static void ep0_end_in_req(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        struct pxa_udc *udc = ep->dev;
+
+        set_ep0state(udc, IN_STATUS_STAGE);
+        ep_end_in_req(ep, req);
+}
+
+/**
+ * nuke - Dequeue all requests
+ * @ep: pxa endpoint
+ * @status: usb request status
+ *
+ * Context: ep->lock held
+ *
+ * Dequeues all requests on an endpoint. As a side effect, interrupts will be
+ * disabled on that endpoint (because no more requests).
+ */
+static void nuke(struct pxa_ep *ep, int status)
+{
+        struct pxa27x_request *req;
+
+        while (!list_empty(&ep->queue)) {
+                req = list_entry(ep->queue.next, struct pxa27x_request, queue);
+                req_done(ep, req, status);
+        }
+}
+
+/**
+ * read_packet - transfer 1 packet from an OUT endpoint into request
+ * @ep: pxa physical endpoint
+ * @req: usb request
+ *
+ * Takes bytes from OUT endpoint and transfers them info the usb request.
+ * If there is less space in request than bytes received in OUT endpoint,
+ * bytes are left in the OUT endpoint.
+ *
+ * Returns how many bytes were actually transfered
+ */
+static int read_packet(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        u32 *buf;
+        int bytes_ep, bufferspace, count, i;
+
+        bytes_ep = ep_count_bytes_remain(ep);
+        bufferspace = req->req.length - req->req.actual;
+
+        buf = (u32 *)(req->req.buf + req->req.actual);
+        prefetchw(buf);
+
+        if (likely(!ep_is_empty(ep)))
+                count = min(bytes_ep, bufferspace);
+        else /* zlp */
+                count = 0;
+
+        for (i = count; i > 0; i -= 4)
+                *buf++ = udc_ep_readl(ep, UDCDR);
+        req->req.actual += count;
+
+        udc_ep_writel(ep, UDCCSR, UDCCSR_PC);
+
+        return count;
+}
+
+/**
+ * write_packet - transfer 1 packet from request into an IN endpoint
+ * @ep: pxa physical endpoint
+ * @req: usb request
+ * @max: max bytes that fit into endpoint
+ *
+ * Takes bytes from usb request, and transfers them into the physical
+ * endpoint. If there are no bytes to transfer, doesn't write anything
+ * to physical endpoint.
+ *
+ * Returns how many bytes were actually transfered.
+ */
+static int write_packet(struct pxa_ep *ep, struct pxa27x_request *req,
+                        unsigned int max)
+{
+        int length, count, remain, i;
+        u32 *buf;
+        u8 *buf_8;
+
+        buf = (u32 *)(req->req.buf + req->req.actual);
+        prefetch(buf);
+
+        length = min(req->req.length - req->req.actual, max);
+        req->req.actual += length;
+
+        remain = length & 0x3;
+        count = length & ~(0x3);
+        for (i = count; i > 0 ; i -= 4)
+                udc_ep_writel(ep, UDCDR, *buf++);
+
+        buf_8 = (u8 *)buf;
+        for (i = remain; i > 0; i--)
+                udc_ep_writeb(ep, UDCDR, *buf_8++);
+
+        ep_vdbg(ep, "length=%d+%d, udccsr=0x%03x\n", count, remain,
+                udc_ep_readl(ep, UDCCSR));
+
+        return length;
+}
+
+/**
+ * read_fifo - Transfer packets from OUT endpoint into usb request
+ * @ep: pxa physical endpoint
+ * @req: usb request
+ *
+ * Context: callable when in_interrupt()
+ *
+ * Unload as many packets as possible from the fifo we use for usb OUT
+ * transfers and put them into the request. Caller should have made sure
+ * there's at least one packet ready.
+ * Doesn't complete the request, that's the caller's job
+ *
+ * Returns 1 if the request completed, 0 otherwise
+ */
+static int read_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        int count, is_short, completed = 0;
+
+        while (epout_has_pkt(ep)) {
+                count = read_packet(ep, req);
+                inc_ep_stats_bytes(ep, count, !USB_DIR_IN);
+
+                is_short = (count < ep->fifo_size);
+                ep_dbg(ep, "read udccsr:%03x, count:%d bytes%s req %p %d/%d\n",
+                        udc_ep_readl(ep, UDCCSR), count, is_short ? "/S" : "",
+                        &req->req, req->req.actual, req->req.length);
+
+                /* completion */
+                if (is_short || req->req.actual == req->req.length) {
+                        completed = 1;
+                        break;
+                }
+                /* finished that packet.  the next one may be waiting... */
+        }
+        return completed;
+}
+
+/**
+ * write_fifo - transfer packets from usb request into an IN endpoint
+ * @ep: pxa physical endpoint
+ * @req: pxa usb request
+ *
+ * Write to an IN endpoint fifo, as many packets as possible.
+ * irqs will use this to write the rest later.
+ * caller guarantees at least one packet buffer is ready (or a zlp).
+ * Doesn't complete the request, that's the caller's job
+ *
+ * Returns 1 if request fully transfered, 0 if partial transfer
+ */
+static int write_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        unsigned max;
+        int count, is_short, is_last = 0, completed = 0, totcount = 0;
+        u32 udccsr;
+
+        max = ep->fifo_size;
+        do {
+                is_short = 0;
+
+                udccsr = udc_ep_readl(ep, UDCCSR);
+                if (udccsr & UDCCSR_PC) {
+                        ep_vdbg(ep, "Clearing Transmit Complete, udccsr=%x\n",
+                                udccsr);
+                        udc_ep_writel(ep, UDCCSR, UDCCSR_PC);
+                }
+                if (udccsr & UDCCSR_TRN) {
+                        ep_vdbg(ep, "Clearing Underrun on, udccsr=%x\n",
+                                udccsr);
+                        udc_ep_writel(ep, UDCCSR, UDCCSR_TRN);
+                }
+
+                count = write_packet(ep, req, max);
+                inc_ep_stats_bytes(ep, count, USB_DIR_IN);
+                totcount += count;
+
+                /* last packet is usually short (or a zlp) */
+                if (unlikely(count < max)) {
+                        is_last = 1;
+                        is_short = 1;
+                } else {
+                        if (likely(req->req.length > req->req.actual)
+                                        || req->req.zero)
+                                is_last = 0;
+                        else
+                                is_last = 1;
+                        /* interrupt/iso maxpacket may not fill the fifo */
+                        is_short = unlikely(max < ep->fifo_size);
+                }
+
+                if (is_short)
+                        udc_ep_writel(ep, UDCCSR, UDCCSR_SP);
+
+                /* requests complete when all IN data is in the FIFO */
+                if (is_last) {
+                        completed = 1;
+                        break;
+                }
+        } while (!ep_is_full(ep));
+
+        ep_dbg(ep, "wrote count:%d bytes%s%s, left:%d req=%p\n",
+                        totcount, is_last ? "/L" : "", is_short ? "/S" : "",
+                        req->req.length - req->req.actual, &req->req);
+
+        return completed;
+}
+
+/**
+ * read_ep0_fifo - Transfer packets from control endpoint into usb request
+ * @ep: control endpoint
+ * @req: pxa usb request
+ *
+ * Special ep0 version of the above read_fifo. Reads as many bytes from control
+ * endpoint as can be read, and stores them into usb request (limited by request
+ * maximum length).
+ *
+ * Returns 0 if usb request only partially filled, 1 if fully filled
+ */
+static int read_ep0_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        int count, is_short, completed = 0;
+
+        while (epout_has_pkt(ep)) {
+                count = read_packet(ep, req);
+                udc_ep_writel(ep, UDCCSR, UDCCSR0_OPC);
+                inc_ep_stats_bytes(ep, count, !USB_DIR_IN);
+
+                is_short = (count < ep->fifo_size);
+                ep_dbg(ep, "read udccsr:%03x, count:%d bytes%s req %p %d/%d\n",
+                        udc_ep_readl(ep, UDCCSR), count, is_short ? "/S" : "",
+                        &req->req, req->req.actual, req->req.length);
+
+                if (is_short || req->req.actual >= req->req.length) {
+                        completed = 1;
+                        break;
+                }
+        }
+
+        return completed;
+}
+
+/**
+ * write_ep0_fifo - Send a request to control endpoint (ep0 in)
+ * @ep: control endpoint
+ * @req: request
+ *
+ * Context: callable when in_interrupt()
+ *
+ * Sends a request (or a part of the request) to the control endpoint (ep0 in).
+ * If the request doesn't fit, the remaining part will be sent from irq.
+ * The request is considered fully written only if either :
+ *   - last write transfered all remaining bytes, but fifo was not fully filled
+ *   - last write was a 0 length write
+ *
+ * Returns 1 if request fully written, 0 if request only partially sent
+ */
+static int write_ep0_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
+{
+        unsigned        count;
+        int             is_last, is_short;
+
+        count = write_packet(ep, req, EP0_FIFO_SIZE);
+        inc_ep_stats_bytes(ep, count, USB_DIR_IN);
+
+        is_short = (count < EP0_FIFO_SIZE);
+        is_last = ((count == 0) || (count < EP0_FIFO_SIZE));
+
+        /* Sends either a short packet or a 0 length packet */
+        if (unlikely(is_short))
+                udc_ep_writel(ep, UDCCSR, UDCCSR0_IPR);
+
+        ep_dbg(ep, "in %d bytes%s%s, %d left, req=%p, udccsr0=0x%03x\n",
+                count, is_short ? "/S" : "", is_last ? "/L" : "",
+                req->req.length - req->req.actual,
+                &req->req, udc_ep_readl(ep, UDCCSR));
+
+        return is_last;
+}
+
+/**
+ * pxa_ep_queue - Queue a request into an IN endpoint
+ * @_ep: usb endpoint
+ * @_req: usb request
+ * @gfp_flags: flags
+ *
+ * Context: normally called when !in_interrupt, but callable when in_interrupt()
+ * in the special case of ep0 setup :
+ *   (irq->handle_ep0_ctrl_req->gadget_setup->pxa_ep_queue)
+ *
+ * Returns 0 if succedeed, error otherwise
+ */
+static int pxa_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
+                        gfp_t gfp_flags)
+{
+        struct udc_usb_ep       *udc_usb_ep;
+        struct pxa_ep           *ep;
+        struct pxa27x_request   *req;
+        struct pxa_udc          *dev;
+        unsigned long           flags;
+        int                     rc = 0;
+        int                     is_first_req;
+        unsigned                length;
+
+        req = container_of(_req, struct pxa27x_request, req);
+        udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
+
+        if (unlikely(!_req || !_req->complete || !_req->buf))
+                return -EINVAL;
+
+        if (unlikely(!_ep))
+                return -EINVAL;
+
+        dev = udc_usb_ep->dev;
+        ep = udc_usb_ep->pxa_ep;
+        if (unlikely(!ep))
+                return -EINVAL;
+
+        dev = ep->dev;
+        if (unlikely(!dev->driver || dev->gadget.speed == USB_SPEED_UNKNOWN)) {
+                ep_dbg(ep, "bogus device state\n");
+                return -ESHUTDOWN;
+        }
+
+        /* iso is always one packet per request, that's the only way
+         * we can report per-packet status.  that also helps with dma.
+         */
+        if (unlikely(EPXFERTYPE_is_ISO(ep)
+                        && req->req.length > ep->fifo_size))
+                return -EMSGSIZE;
+
+        spin_lock_irqsave(&ep->lock, flags);
+
+        is_first_req = list_empty(&ep->queue);
+        ep_dbg(ep, "queue req %p(first=%s), len %d buf %p\n",
+                        _req, is_first_req ? "yes" : "no",
+                        _req->length, _req->buf);
+
+        if (!ep->enabled) {
+                _req->status = -ESHUTDOWN;
+                rc = -ESHUTDOWN;
+                goto out;
+        }
+
+        if (req->in_use) {
+                ep_err(ep, "refusing to queue req %p (already queued)\n", req);
+                goto out;
+        }
+
+        length = _req->length;
+        _req->status = -EINPROGRESS;
+        _req->actual = 0;
+
+        ep_add_request(ep, req);
+
+        if (is_ep0(ep)) {
+                switch (dev->ep0state) {
+                case WAIT_ACK_SET_CONF_INTERF:
+                        if (length == 0) {
+                                ep_end_in_req(ep, req);
+                        } else {
+                                ep_err(ep, "got a request of %d bytes while"
+                                        "in state WATI_ACK_SET_CONF_INTERF\n",
+                                        length);
+                                ep_del_request(ep, req);
+                                rc = -EL2HLT;
+                        }
+                        ep0_idle(ep->dev);
+                        break;
+                case IN_DATA_STAGE:
+                        if (!ep_is_full(ep))
+                                if (write_ep0_fifo(ep, req))
+                                        ep0_end_in_req(ep, req);
+                        break;
+                case OUT_DATA_STAGE:
+                        if ((length == 0) || !epout_has_pkt(ep))
+                                if (read_ep0_fifo(ep, req))
+                                        ep0_end_out_req(ep, req);
+                        break;
+                default:
+                        ep_err(ep, "odd state %s to send me a request\n",
+                                EP0_STNAME(ep->dev));
+                        ep_del_request(ep, req);
+                        rc = -EL2HLT;
+                        break;
+                }
+        } else {
+                handle_ep(ep);
+        }
+
+out:
+        spin_unlock_irqrestore(&ep->lock, flags);
+        return rc;
+}
+
+/**
+ * pxa_ep_dequeue - Dequeue one request
+ * @_ep: usb endpoint
+ * @_req: usb request
+ *
+ * Return 0 if no error, -EINVAL or -ECONNRESET otherwise
+ */
+static int pxa_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct pxa_ep           *ep;
+        struct udc_usb_ep       *udc_usb_ep;
+        struct pxa27x_request   *req;
+        unsigned long           flags;
+        int                     rc;
+
+        if (!_ep)
+                return -EINVAL;
+        udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
+        ep = udc_usb_ep->pxa_ep;
+        if (!ep || is_ep0(ep))
+                return -EINVAL;
+
+        spin_lock_irqsave(&ep->lock, flags);
+
+        /* make sure it's actually queued on this endpoint */
+        list_for_each_entry(req, &ep->queue, queue) {
+                if (&req->req == _req)
+                        break;
+        }
+
+        rc = -EINVAL;
+        if (&req->req != _req)
+                goto out;
+
+        rc = 0;
+        req_done(ep, req, -ECONNRESET);
+out:
+        spin_unlock_irqrestore(&ep->lock, flags);
+        return rc;
+}
+
+/**
+ * pxa_ep_set_halt - Halts operations on one endpoint
+ * @_ep: usb endpoint
+ * @value:
+ *
+ * Returns 0 if no error, -EINVAL, -EROFS, -EAGAIN otherwise
+ */
+static int pxa_ep_set_halt(struct usb_ep *_ep, int value)
+{
+        struct pxa_ep           *ep;
+        struct udc_usb_ep       *udc_usb_ep;
+        unsigned long flags;
+        int rc;
+
+
+        if (!_ep)
+                return -EINVAL;
+        udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
+        ep = udc_usb_ep->pxa_ep;
+        if (!ep || is_ep0(ep))
+                return -EINVAL;
+
+        if (value == 0) {
+                /*
+                 * This path (reset toggle+halt) is needed to implement
+                 * SET_INTERFACE on normal hardware.  but it can't be
+                 * done from software on the PXA UDC, and the hardware
+                 * forgets to do it as part of SET_INTERFACE automagic.
+                 */
+                ep_dbg(ep, "only host can clear halt\n");
+                return -EROFS;
+        }
+
+        spin_lock_irqsave(&ep->lock, flags);
+
+        rc = -EAGAIN;
+        if (ep->dir_in  && (ep_is_full(ep) || !list_empty(&ep->queue)))
+                goto out;
+
+        /* FST, FEF bits are the same for control and non control endpoints */
+        rc = 0;
+        udc_ep_writel(ep, UDCCSR, UDCCSR_FST | UDCCSR_FEF);
+        if (is_ep0(ep))
+                set_ep0state(ep->dev, STALL);
+
+out:
+        spin_unlock_irqrestore(&ep->lock, flags);
+        return rc;
+}
+
+/**
+ * pxa_ep_fifo_status - Get how many bytes in physical endpoint
+ * @_ep: usb endpoint
+ *
+ * Returns number of bytes in OUT fifos. Broken for IN fifos.
+ */
+static int pxa_ep_fifo_status(struct usb_ep *_ep)
+{
+        struct pxa_ep           *ep;
+        struct udc_usb_ep       *udc_usb_ep;
+
+        if (!_ep)
+                return -ENODEV;
+        udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
+        ep = udc_usb_ep->pxa_ep;
+        if (!ep || is_ep0(ep))
+                return -ENODEV;
+
+        if (ep->dir_in)
+                return -EOPNOTSUPP;
+        if (ep->dev->gadget.speed == USB_SPEED_UNKNOWN || ep_is_empty(ep))
+                return 0;
+        else
+                return ep_count_bytes_remain(ep) + 1;
+}
+
+/**
+ * pxa_ep_fifo_flush - Flushes one endpoint
+ * @_ep: usb endpoint
+ *
+ * Discards all data in one endpoint(IN or OUT), except control endpoint.
+ */
+static void pxa_ep_fifo_flush(struct usb_ep *_ep)
+{
+        struct pxa_ep           *ep;
+        struct udc_usb_ep       *udc_usb_ep;
+        unsigned long           flags;
+
+        if (!_ep)
+                return;
+        udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
+        ep = udc_usb_ep->pxa_ep;
+        if (!ep || is_ep0(ep))
+                return;
+
+        spin_lock_irqsave(&ep->lock, flags);
+
+        if (unlikely(!list_empty(&ep->queue)))
+                ep_dbg(ep, "called while queue list not empty\n");
+        ep_dbg(ep, "called\n");
+
+        /* for OUT, just read and discard the FIFO contents. */
+        if (!ep->dir_in) {
+                while (!ep_is_empty(ep))
+                        udc_ep_readl(ep, UDCDR);
+        } else {
+                /* most IN status is the same, but ISO can't stall */
+                udc_ep_writel(ep, UDCCSR,
+                                UDCCSR_PC | UDCCSR_FEF | UDCCSR_TRN
+                                | (EPXFERTYPE_is_ISO(ep) ? 0 : UDCCSR_SST));
+        }
+
+        spin_unlock_irqrestore(&ep->lock, flags);
+
+        return;
+}
+
+/**
+ * pxa_ep_enable - Enables usb endpoint
+ * @_ep: usb endpoint
+ * @desc: usb endpoint descriptor
+ *
+ * Nothing much to do here, as ep configuration is done once and for all
+ * before udc is enabled. After udc enable, no physical endpoint configuration
+ * can be changed.
+ * Function makes sanity checks and flushes the endpoint.
+ */
+static int pxa_ep_enable(struct usb_ep *_ep,
+        const struct usb_endpoint_descriptor *desc)
+{
+        struct pxa_ep           *ep;
+        struct udc_usb_ep       *udc_usb_ep;
+        struct pxa_udc          *udc;
+
+        if (!_ep || !desc)
+                return -EINVAL;
+
+        udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
+        if (udc_usb_ep->pxa_ep) {
+                ep = udc_usb_ep->pxa_ep;
+                ep_warn(ep, "usb_ep %s already enabled, doing nothing\n",
+                        _ep->name);
+        } else {
+                ep = find_pxa_ep(udc_usb_ep->dev, udc_usb_ep);
+        }
+
+        if (!ep || is_ep0(ep)) {
+                dev_err(udc_usb_ep->dev->dev,
+                        "unable to match pxa_ep for ep %s\n",
+                        _ep->name);
+                return -EINVAL;
+        }
+
+        if ((desc->bDescriptorType != USB_DT_ENDPOINT)
+                        || (ep->type != usb_endpoint_type(desc))) {
+                ep_err(ep, "type mismatch\n");
+                return -EINVAL;
+        }
+
+        if (ep->fifo_size < le16_to_cpu(desc->wMaxPacketSize)) {
+                ep_err(ep, "bad maxpacket\n");
+                return -ERANGE;
+        }
+
+        udc_usb_ep->pxa_ep = ep;
+        udc = ep->dev;
+
+        if (!udc->driver || udc->gadget.speed == USB_SPEED_UNKNOWN) {
+                ep_err(ep, "bogus device state\n");
+                return -ESHUTDOWN;
+        }
+
+        ep->enabled = 1;
+
+        /* flush fifo (mostly for OUT buffers) */
+        pxa_ep_fifo_flush(_ep);
+
+        ep_dbg(ep, "enabled\n");
+        return 0;
+}
+
+/**
+ * pxa_ep_disable - Disable usb endpoint
+ * @_ep: usb endpoint
+ *
+ * Same as for pxa_ep_enable, no physical endpoint configuration can be
+ * changed.
+ * Function flushes the endpoint and related requests.
+ */
+static int pxa_ep_disable(struct usb_ep *_ep)
+{
+        struct pxa_ep           *ep;
+        struct udc_usb_ep       *udc_usb_ep;
+        unsigned long           flags;
+
+        if (!_ep)
+                return -EINVAL;
+
+        udc_usb_ep = container_of(_ep, struct udc_usb_ep, usb_ep);
+        ep = udc_usb_ep->pxa_ep;
+        if (!ep || is_ep0(ep) || !list_empty(&ep->queue))
+                return -EINVAL;
+
+        spin_lock_irqsave(&ep->lock, flags);
+        ep->enabled = 0;
+        nuke(ep, -ESHUTDOWN);
+        spin_unlock_irqrestore(&ep->lock, flags);
+
+        pxa_ep_fifo_flush(_ep);
+        udc_usb_ep->pxa_ep = NULL;
+
+        ep_dbg(ep, "disabled\n");
+        return 0;
+}
+
+static struct usb_ep_ops pxa_ep_ops = {
+        .enable         = pxa_ep_enable,
+        .disable        = pxa_ep_disable,
+
+        .alloc_request  = pxa_ep_alloc_request,
+        .free_request   = pxa_ep_free_request,
+
+        .queue          = pxa_ep_queue,
+        .dequeue        = pxa_ep_dequeue,
+
+        .set_halt       = pxa_ep_set_halt,
+        .fifo_status    = pxa_ep_fifo_status,
+        .fifo_flush     = pxa_ep_fifo_flush,
+};
+
+
+/**
+ * pxa_udc_get_frame - Returns usb frame number
+ * @_gadget: usb gadget
+ */
+static int pxa_udc_get_frame(struct usb_gadget *_gadget)
+{
+        struct pxa_udc *udc = to_gadget_udc(_gadget);
+
+        return (udc_readl(udc, UDCFNR) & 0x7ff);
+}
+
+/**
+ * pxa_udc_wakeup - Force udc device out of suspend
+ * @_gadget: usb gadget
+ *
+ * Returns 0 if succesfull, error code otherwise
+ */
+static int pxa_udc_wakeup(struct usb_gadget *_gadget)
+{
+        struct pxa_udc *udc = to_gadget_udc(_gadget);
+
+        /* host may not have enabled remote wakeup */
+        if ((udc_readl(udc, UDCCR) & UDCCR_DWRE) == 0)
+                return -EHOSTUNREACH;
+        udc_set_mask_UDCCR(udc, UDCCR_UDR);
+        return 0;
+}
+
+static const struct usb_gadget_ops pxa_udc_ops = {
+        .get_frame      = pxa_udc_get_frame,
+        .wakeup         = pxa_udc_wakeup,
+        /* current versions must always be self-powered */
+};
+
+/**
+ * udc_disable - disable udc device controller
+ * @udc: udc device
+ *
+ * Disables the udc device : disables clocks, udc interrupts, control endpoint
+ * interrupts.
+ */
+static void udc_disable(struct pxa_udc *udc)
+{
+        udc_writel(udc, UDCICR0, 0);
+        udc_writel(udc, UDCICR1, 0);
+
+        udc_clear_mask_UDCCR(udc, UDCCR_UDE);
+        clk_disable(udc->clk);
+
+        ep0_idle(udc);
+        udc->gadget.speed = USB_SPEED_UNKNOWN;
+        udc->mach->udc_command(PXA2XX_UDC_CMD_DISCONNECT);
+}
+
+/**
+ * udc_init_data - Initialize udc device data structures
+ * @dev: udc device
+ *
+ * Initializes gadget endpoint list, endpoints locks. No action is taken
+ * on the hardware.
+ */
+static __init void udc_init_data(struct pxa_udc *dev)
+{
+        int i;
+        struct pxa_ep *ep;
+
+        /* device/ep0 records init */
+        INIT_LIST_HEAD(&dev->gadget.ep_list);
+        INIT_LIST_HEAD(&dev->gadget.ep0->ep_list);
+        dev->udc_usb_ep[0].pxa_ep = &dev->pxa_ep[0];
+        ep0_idle(dev);
+        strcpy(dev->dev->bus_id, "");
+
+        /* PXA endpoints init */
+        for (i = 0; i < NR_PXA_ENDPOINTS; i++) {
+                ep = &dev->pxa_ep[i];
+
+                ep->enabled = is_ep0(ep);
+                INIT_LIST_HEAD(&ep->queue);
+                spin_lock_init(&ep->lock);
+        }
+
+        /* USB endpoints init */
+        for (i = 0; i < NR_USB_ENDPOINTS; i++)
+                if (i != 0)
+                        list_add_tail(&dev->udc_usb_ep[i].usb_ep.ep_list,
+                                        &dev->gadget.ep_list);
+}
+
+/**
+ * udc_enable - Enables the udc device
+ * @dev: udc device
+ *
+ * Enables the udc device : enables clocks, udc interrupts, control endpoint
+ * interrupts, sets usb as UDC client and setups endpoints.
+ */
+static void udc_enable(struct pxa_udc *udc)
+{
+        udc_writel(udc, UDCICR0, 0);
+        udc_writel(udc, UDCICR1, 0);
+        udc_writel(udc, UP2OCR, UP2OCR_HXOE);
+        udc_clear_mask_UDCCR(udc, UDCCR_UDE);
+
+        clk_enable(udc->clk);
+
+        ep0_idle(udc);
+        udc->gadget.speed = USB_SPEED_FULL;
+        memset(&udc->stats, 0, sizeof(udc->stats));
+
+        udc_set_mask_UDCCR(udc, UDCCR_UDE);
+        udelay(2);
+        if (udc_readl(udc, UDCCR) & UDCCR_EMCE)
+                dev_err(udc->dev, "Configuration errors, udc disabled\n");
+
+        /*
+         * Caller must be able to sleep in order to cope with startup transients
+         */
+        msleep(100);
+
+        /* enable suspend/resume and reset irqs */
+        udc_writel(udc, UDCICR1,
+                        UDCICR1_IECC | UDCICR1_IERU
+                        | UDCICR1_IESU | UDCICR1_IERS);
+
+        /* enable ep0 irqs */
+        pio_irq_enable(&udc->pxa_ep[0]);
+
+        dev_info(udc->dev, "UDC connecting\n");
+        if (udc->mach->udc_command)
+                udc->mach->udc_command(PXA2XX_UDC_CMD_CONNECT);
+}
+
+/**
+ * usb_gadget_register_driver - Register gadget driver
+ * @driver: gadget driver
+ *
+ * When a driver is successfully registered, it will receive control requests
+ * including set_configuration(), which enables non-control requests.  Then
+ * usb traffic follows until a disconnect is reported.  Then a host may connect
+ * again, or the driver might get unbound.
+ *
+ * Returns 0 if no error, -EINVAL, -ENODEV, -EBUSY otherwise
+ */
+int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+{
+        struct pxa_udc *udc = the_controller;
+        int retval;
+
+        if (!driver || driver->speed != USB_SPEED_FULL || !driver->bind
+                        || !driver->disconnect || !driver->setup)
+                return -EINVAL;
+        if (!udc)
+                return -ENODEV;
+        if (udc->driver)
+                return -EBUSY;
+
+        /* first hook up the driver ... */
+        udc->driver = driver;
+        udc->gadget.dev.driver = &driver->driver;
+
+        retval = device_add(&udc->gadget.dev);
+        if (retval) {
+                dev_err(udc->dev, "device_add error %d\n", retval);
+                goto add_fail;
+        }
+        retval = driver->bind(&udc->gadget);
+        if (retval) {
+                dev_err(udc->dev, "bind to driver %s --> error %d\n",
+                        driver->driver.name, retval);
+                goto bind_fail;
+        }
+        dev_dbg(udc->dev, "registered gadget driver '%s'\n",
+                driver->driver.name);
+
+        udc_enable(udc);
+        return 0;
+
+bind_fail:
+        device_del(&udc->gadget.dev);
+add_fail:
+        udc->driver = NULL;
+        udc->gadget.dev.driver = NULL;
+        return retval;
+}
+EXPORT_SYMBOL(usb_gadget_register_driver);
+
+
+/**
+ * stop_activity - Stops udc endpoints
+ * @udc: udc device
+ * @driver: gadget driver
+ *
+ * Disables all udc endpoints (even control endpoint), report disconnect to
+ * the gadget user.
+ */
+static void stop_activity(struct pxa_udc *udc, struct usb_gadget_driver *driver)
+{
+        int i;
+
+        /* don't disconnect drivers more than once */
+        if (udc->gadget.speed == USB_SPEED_UNKNOWN)
+                driver = NULL;
+        udc->gadget.speed = USB_SPEED_UNKNOWN;
+
+        for (i = 0; i < NR_USB_ENDPOINTS; i++)
+                pxa_ep_disable(&udc->udc_usb_ep[i].usb_ep);
+
+        if (driver)
+                driver->disconnect(&udc->gadget);
+}
+
+/**
+ * usb_gadget_unregister_driver - Unregister the gadget driver
+ * @driver: gadget driver
+ *
+ * Returns 0 if no error, -ENODEV, -EINVAL otherwise
+ */
+int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
+{
+        struct pxa_udc *udc = the_controller;
+
+        if (!udc)
+                return -ENODEV;
+        if (!driver || driver != udc->driver || !driver->unbind)
+                return -EINVAL;
+
+        stop_activity(udc, driver);
+        udc_disable(udc);
+
+        driver->unbind(&udc->gadget);
+        udc->driver = NULL;
+
+        device_del(&udc->gadget.dev);
+
+        dev_info(udc->dev, "unregistered gadget driver '%s'\n",
+                 driver->driver.name);
+        return 0;
+}
+EXPORT_SYMBOL(usb_gadget_unregister_driver);
+
+/**
+ * handle_ep0_ctrl_req - handle control endpoint control request
+ * @udc: udc device
+ * @req: control request
+ */
+static void handle_ep0_ctrl_req(struct pxa_udc *udc,
+                                struct pxa27x_request *req)
+{
+        struct pxa_ep *ep = &udc->pxa_ep[0];
+        union {
+                struct usb_ctrlrequest  r;
+                u32                     word[2];
+        } u;
+        int i;
+        int have_extrabytes = 0;
+
+        nuke(ep, -EPROTO);
+
+        /* read SETUP packet */
+        for (i = 0; i < 2; i++) {
+                if (unlikely(ep_is_empty(ep)))
+                        goto stall;
+                u.word[i] = udc_ep_readl(ep, UDCDR);
+        }
+
+        have_extrabytes = !ep_is_empty(ep);
+        while (!ep_is_empty(ep)) {
+                i = udc_ep_readl(ep, UDCDR);
+                ep_err(ep, "wrong to have extra bytes for setup : 0x%08x\n", i);
+        }
+
+        le16_to_cpus(&u.r.wValue);
+        le16_to_cpus(&u.r.wIndex);
+        le16_to_cpus(&u.r.wLength);
+
+        ep_dbg(ep, "SETUP %02x.%02x v%04x i%04x l%04x\n",
+                u.r.bRequestType, u.r.bRequest,
+                u.r.wValue, u.r.wIndex, u.r.wLength);
+        if (unlikely(have_extrabytes))
+                goto stall;
+
+        if (u.r.bRequestType & USB_DIR_IN)
+                set_ep0state(udc, IN_DATA_STAGE);
+        else
+                set_ep0state(udc, OUT_DATA_STAGE);
+
+        /* Tell UDC to enter Data Stage */
+        udc_ep_writel(ep, UDCCSR, UDCCSR0_SA | UDCCSR0_OPC);
+
+        i = udc->driver->setup(&udc->gadget, &u.r);
+        if (i < 0)
+                goto stall;
+out:
+        return;
+stall:
+        ep_dbg(ep, "protocol STALL, udccsr0=%03x err %d\n",
+                udc_ep_readl(ep, UDCCSR), i);
+        udc_ep_writel(ep, UDCCSR, UDCCSR0_FST | UDCCSR0_FTF);
+        set_ep0state(udc, STALL);
+        goto out;
+}
+
+/**
+ * handle_ep0 - Handle control endpoint data transfers
+ * @udc: udc device
+ * @fifo_irq: 1 if triggered by fifo service type irq
+ * @opc_irq: 1 if triggered by output packet complete type irq
+ *
+ * Context : when in_interrupt() or with ep->lock held
+ *
+ * Tries to transfer all pending request data into the endpoint and/or
+ * transfer all pending data in the endpoint into usb requests.
+ * Handles states of ep0 automata.
+ *
+ * PXA27x hardware handles several standard usb control requests without
+ * driver notification.  The requests fully handled by hardware are :
+ *  SET_ADDRESS, SET_FEATURE, CLEAR_FEATURE, GET_CONFIGURATION, GET_INTERFACE,
+ *  GET_STATUS
+ * The requests handled by hardware, but with irq notification are :
+ *  SYNCH_FRAME, SET_CONFIGURATION, SET_INTERFACE
+ * The remaining standard requests really handled by handle_ep0 are :
+ *  GET_DESCRIPTOR, SET_DESCRIPTOR, specific requests.
+ * Requests standardized outside of USB 2.0 chapter 9 are handled more
+ * uniformly, by gadget drivers.
+ *
+ * The control endpoint state machine is _not_ USB spec compliant, it's even
+ * hardly compliant with Intel PXA270 developers guide.
+ * The key points which inferred this state machine are :
+ *   - on every setup token, bit UDCCSR0_SA is raised and held until cleared by
+ *     software.
+ *   - on every OUT packet received, UDCCSR0_OPC is raised and held until
+ *     cleared by software.
+ *   - clearing UDCCSR0_OPC always flushes ep0. If in setup stage, never do it
+ *     before reading ep0.
+ *   - irq can be called on a "packet complete" event (opc_irq=1), while
+ *     UDCCSR0_OPC is not yet raised (delta can be as big as 100ms
+ *     from experimentation).
+ *   - as UDCCSR0_SA can be activated while in irq handling, and clearing
+ *     UDCCSR0_OPC would flush the setup data, we almost never clear UDCCSR0_OPC
+ *     => we never actually read the "status stage" packet of an IN data stage
+ *     => this is not documented in Intel documentation
+ *   - hardware as no idea of STATUS STAGE, it only handle SETUP STAGE and DATA
+ *     STAGE. The driver add STATUS STAGE to send last zero length packet in
+ *     OUT_STATUS_STAGE.
+ *   - special attention was needed for IN_STATUS_STAGE. If a packet complete
+ *     event is detected, we terminate the status stage without ackowledging the
+ *     packet (not to risk to loose a potential SETUP packet)
+ */
+static void handle_ep0(struct pxa_udc *udc, int fifo_irq, int opc_irq)
+{
+        u32                     udccsr0;
+        struct pxa_ep           *ep = &udc->pxa_ep[0];
+        struct pxa27x_request   *req = NULL;
+        int                     completed = 0;
+
+        udccsr0 = udc_ep_readl(ep, UDCCSR);
+        ep_dbg(ep, "state=%s, req=%p, udccsr0=0x%03x, udcbcr=%d, irq_msk=%x\n",
+                EP0_STNAME(udc), req, udccsr0, udc_ep_readl(ep, UDCBCR),
+                (fifo_irq << 1 | opc_irq));
+
+        if (!list_empty(&ep->queue))
+                req = list_entry(ep->queue.next, struct pxa27x_request, queue);
+
+        if (udccsr0 & UDCCSR0_SST) {
+                ep_dbg(ep, "clearing stall status\n");
+                nuke(ep, -EPIPE);
+                udc_ep_writel(ep, UDCCSR, UDCCSR0_SST);
+                ep0_idle(udc);
+        }
+
+        if (udccsr0 & UDCCSR0_SA) {
+                nuke(ep, 0);
+                set_ep0state(udc, SETUP_STAGE);
+        }
+
+        switch (udc->ep0state) {
+        case WAIT_FOR_SETUP:
+                /*
+                 * Hardware bug : beware, we cannot clear OPC, since we would
+                 * miss a potential OPC irq for a setup packet.
+                 * So, we only do ... nothing, and hope for a next irq with
+                 * UDCCSR0_SA set.
+                 */
+                break;
+        case SETUP_STAGE:
+                udccsr0 &= UDCCSR0_CTRL_REQ_MASK;
+                if (likely(udccsr0 == UDCCSR0_CTRL_REQ_MASK))
+                        handle_ep0_ctrl_req(udc, req);
+                break;
+        case IN_DATA_STAGE:                     /* GET_DESCRIPTOR */
+                if (epout_has_pkt(ep))
+                        udc_ep_writel(ep, UDCCSR, UDCCSR0_OPC);
+                if (req && !ep_is_full(ep))
+                        completed = write_ep0_fifo(ep, req);
+                if (completed)
+                        ep0_end_in_req(ep, req);
+                break;
+        case OUT_DATA_STAGE:                    /* SET_DESCRIPTOR */
+                if (epout_has_pkt(ep) && req)
+                        completed = read_ep0_fifo(ep, req);
+                if (completed)
+                        ep0_end_out_req(ep, req);
+                break;
+        case STALL:
+                udc_ep_writel(ep, UDCCSR, UDCCSR0_FST);
+                break;
+        case IN_STATUS_STAGE:
+                /*
+                 * Hardware bug : beware, we cannot clear OPC, since we would
+                 * miss a potential PC irq for a setup packet.
+                 * So, we only put the ep0 into WAIT_FOR_SETUP state.
+                 */
+                if (opc_irq)
+                        ep0_idle(udc);
+                break;
+        case OUT_STATUS_STAGE:
+        case WAIT_ACK_SET_CONF_INTERF:
+                ep_warn(ep, "should never get in %s state here!!!\n",
+                                EP0_STNAME(ep->dev));
+                ep0_idle(udc);
+                break;
+        }
+}
+
+/**
+ * handle_ep - Handle endpoint data tranfers
+ * @ep: pxa physical endpoint
+ *
+ * Tries to transfer all pending request data into the endpoint and/or
+ * transfer all pending data in the endpoint into usb requests.
+ *
+ * Is always called when in_interrupt() or with ep->lock held.
+ */
+static void handle_ep(struct pxa_ep *ep)
+{
+        struct pxa27x_request   *req;
+        int completed;
+        u32 udccsr;
+        int is_in = ep->dir_in;
+        int loop = 0;
+
+        do {
+                completed = 0;
+                udccsr = udc_ep_readl(ep, UDCCSR);
+                if (likely(!list_empty(&ep->queue)))
+                        req = list_entry(ep->queue.next,
+                                        struct pxa27x_request, queue);
+                else
+                        req = NULL;
+
+                ep_dbg(ep, "req:%p, udccsr 0x%03x loop=%d\n",
+                                req, udccsr, loop++);
+
+                if (unlikely(udccsr & (UDCCSR_SST | UDCCSR_TRN)))
+                        udc_ep_writel(ep, UDCCSR,
+                                        udccsr & (UDCCSR_SST | UDCCSR_TRN));
+                if (!req)
+                        break;
+
+                if (unlikely(is_in)) {
+                        if (likely(!ep_is_full(ep)))
+                                completed = write_fifo(ep, req);
+                        if (completed)
+                                ep_end_in_req(ep, req);
+                } else {
+                        if (likely(epout_has_pkt(ep)))
+                                completed = read_fifo(ep, req);
+                        if (completed)
+                                ep_end_out_req(ep, req);
+                }
+        } while (completed);
+}
+
+/**
+ * pxa27x_change_configuration - Handle SET_CONF usb request notification
+ * @udc: udc device
+ * @config: usb configuration
+ *
+ * Post the request to upper level.
+ * Don't use any pxa specific harware configuration capabilities
+ */
+static void pxa27x_change_configuration(struct pxa_udc *udc, int config)
+{
+        struct usb_ctrlrequest req ;
+
+        dev_dbg(udc->dev, "config=%d\n", config);
+
+        udc->config = config;
+        udc->last_interface = 0;
+        udc->last_alternate = 0;
+
+        req.bRequestType = 0;
+        req.bRequest = USB_REQ_SET_CONFIGURATION;
+        req.wValue = config;
+        req.wIndex = 0;
+        req.wLength = 0;
+
+        set_ep0state(udc, WAIT_ACK_SET_CONF_INTERF);
+        udc->driver->setup(&udc->gadget, &req);
+}
+
+/**
+ * pxa27x_change_interface - Handle SET_INTERF usb request notification
+ * @udc: udc device
+ * @iface: interface number
+ * @alt: alternate setting number
+ *
+ * Post the request to upper level.
+ * Don't use any pxa specific harware configuration capabilities
+ */
+static void pxa27x_change_interface(struct pxa_udc *udc, int iface, int alt)
+{
+        struct usb_ctrlrequest  req;
+
+        dev_dbg(udc->dev, "interface=%d, alternate setting=%d\n", iface, alt);
+
+        udc->last_interface = iface;
+        udc->last_alternate = alt;
+
+        req.bRequestType = USB_RECIP_INTERFACE;
+        req.bRequest = USB_REQ_SET_INTERFACE;
+        req.wValue = alt;
+        req.wIndex = iface;
+        req.wLength = 0;
+
+        set_ep0state(udc, WAIT_ACK_SET_CONF_INTERF);
+        udc->driver->setup(&udc->gadget, &req);
+}
+
+/*
+ * irq_handle_data - Handle data transfer
+ * @irq: irq IRQ number
+ * @udc: dev pxa_udc device structure
+ *
+ * Called from irq handler, transferts data to or from endpoint to queue
+ */
+static void irq_handle_data(int irq, struct pxa_udc *udc)
+{
+        int i;
+        struct pxa_ep *ep;
+        u32 udcisr0 = udc_readl(udc, UDCISR0) & UDCCISR0_EP_MASK;
+        u32 udcisr1 = udc_readl(udc, UDCISR1) & UDCCISR1_EP_MASK;
+
+        if (udcisr0 & UDCISR_INT_MASK) {
+                udc->pxa_ep[0].stats.irqs++;
+                udc_writel(udc, UDCISR0, UDCISR_INT(0, UDCISR_INT_MASK));
+                handle_ep0(udc, !!(udcisr0 & UDCICR_FIFOERR),
+                                !!(udcisr0 & UDCICR_PKTCOMPL));
+        }
+
+        udcisr0 >>= 2;
+        for (i = 1; udcisr0 != 0 && i < 16; udcisr0 >>= 2, i++) {
+                if (!(udcisr0 & UDCISR_INT_MASK))
+                        continue;
+
+                udc_writel(udc, UDCISR0, UDCISR_INT(i, UDCISR_INT_MASK));
+                ep = &udc->pxa_ep[i];
+                ep->stats.irqs++;
+                handle_ep(ep);
+        }
+
+        for (i = 16; udcisr1 != 0 && i < 24; udcisr1 >>= 2, i++) {
+                udc_writel(udc, UDCISR1, UDCISR_INT(i - 16, UDCISR_INT_MASK));
+                if (!(udcisr1 & UDCISR_INT_MASK))
+                        continue;
+
+                ep = &udc->pxa_ep[i];
+                ep->stats.irqs++;
+                handle_ep(ep);
+        }
+
+}
+
+/**
+ * irq_udc_suspend - Handle IRQ "UDC Suspend"
+ * @udc: udc device
+ */
+static void irq_udc_suspend(struct pxa_udc *udc)
+{
+        udc_writel(udc, UDCISR1, UDCISR1_IRSU);
+        udc->stats.irqs_suspend++;
+
+        if (udc->gadget.speed != USB_SPEED_UNKNOWN
+                        && udc->driver && udc->driver->suspend)
+                udc->driver->suspend(&udc->gadget);
+        ep0_idle(udc);
+}
+
+/**
+  * irq_udc_resume - Handle IRQ "UDC Resume"
+  * @udc: udc device
+  */
+static void irq_udc_resume(struct pxa_udc *udc)
+{
+        udc_writel(udc, UDCISR1, UDCISR1_IRRU);
+        udc->stats.irqs_resume++;
+
+        if (udc->gadget.speed != USB_SPEED_UNKNOWN
+                        && udc->driver && udc->driver->resume)
+                udc->driver->resume(&udc->gadget);
+}
+
+/**
+ * irq_udc_reconfig - Handle IRQ "UDC Change Configuration"
+ * @udc: udc device
+ */
+static void irq_udc_reconfig(struct pxa_udc *udc)
+{
+        unsigned config, interface, alternate, config_change;
+        u32 udccr = udc_readl(udc, UDCCR);
+
+        udc_writel(udc, UDCISR1, UDCISR1_IRCC);
+        udc->stats.irqs_reconfig++;
+
+        config = (udccr & UDCCR_ACN) >> UDCCR_ACN_S;
+        config_change = (config != udc->config);
+        pxa27x_change_configuration(udc, config);
+
+        interface = (udccr & UDCCR_AIN) >> UDCCR_AIN_S;
+        alternate = (udccr & UDCCR_AAISN) >> UDCCR_AAISN_S;
+        pxa27x_change_interface(udc, interface, alternate);
+
+        if (config_change)
+                update_pxa_ep_matches(udc);
+        udc_set_mask_UDCCR(udc, UDCCR_SMAC);
+}
+
+/**
+ * irq_udc_reset - Handle IRQ "UDC Reset"
+ * @udc: udc device
+ */
+static void irq_udc_reset(struct pxa_udc *udc)
+{
+        u32 udccr = udc_readl(udc, UDCCR);
+        struct pxa_ep *ep = &udc->pxa_ep[0];
+
+        dev_info(udc->dev, "USB reset\n");
+        udc_writel(udc, UDCISR1, UDCISR1_IRRS);
+        udc->stats.irqs_reset++;
+
+        if ((udccr & UDCCR_UDA) == 0) {
+                dev_dbg(udc->dev, "USB reset start\n");
+                stop_activity(udc, udc->driver);
+        }
+        udc->gadget.speed = USB_SPEED_FULL;
+        memset(&udc->stats, 0, sizeof udc->stats);
+
+        nuke(ep, -EPROTO);
+        udc_ep_writel(ep, UDCCSR, UDCCSR0_FTF | UDCCSR0_OPC);
+        ep0_idle(udc);
+}
+
+/**
+ * pxa_udc_irq - Main irq handler
+ * @irq: irq number
+ * @_dev: udc device
+ *
+ * Handles all udc interrupts
+ */
+static irqreturn_t pxa_udc_irq(int irq, void *_dev)
+{
+        struct pxa_udc *udc = _dev;
+        u32 udcisr0 = udc_readl(udc, UDCISR0);
+        u32 udcisr1 = udc_readl(udc, UDCISR1);
+        u32 udccr = udc_readl(udc, UDCCR);
+        u32 udcisr1_spec;
+
+        dev_vdbg(udc->dev, "Interrupt, UDCISR0:0x%08x, UDCISR1:0x%08x, "
+                 "UDCCR:0x%08x\n", udcisr0, udcisr1, udccr);
+
+        udcisr1_spec = udcisr1 & 0xf8000000;
+        if (unlikely(udcisr1_spec & UDCISR1_IRSU))
+                irq_udc_suspend(udc);
+        if (unlikely(udcisr1_spec & UDCISR1_IRRU))
+                irq_udc_resume(udc);
+        if (unlikely(udcisr1_spec & UDCISR1_IRCC))
+                irq_udc_reconfig(udc);
+        if (unlikely(udcisr1_spec & UDCISR1_IRRS))
+                irq_udc_reset(udc);
+
+        if ((udcisr0 & UDCCISR0_EP_MASK) | (udcisr1 & UDCCISR1_EP_MASK))
+                irq_handle_data(irq, udc);
+
+        return IRQ_HANDLED;
+}
+
+static struct pxa_udc memory = {
+        .gadget = {
+                .ops            = &pxa_udc_ops,
+                .ep0            = &memory.udc_usb_ep[0].usb_ep,
+                .name           = driver_name,
+                .dev = {
+                        .bus_id         = "gadget",
+                },
+        },
+
+        .udc_usb_ep = {
+                USB_EP_CTRL,
+                USB_EP_OUT_BULK(1),
+                USB_EP_IN_BULK(2),
+                USB_EP_IN_ISO(3),
+                USB_EP_OUT_ISO(4),
+                USB_EP_IN_INT(5),
+        },
+
+        .pxa_ep = {
+                PXA_EP_CTRL,
+                /* Endpoints for gadget zero */
+                PXA_EP_OUT_BULK(1, 1, 3, 0, 0),
+                PXA_EP_IN_BULK(2,  2, 3, 0, 0),
+                /* Endpoints for ether gadget, file storage gadget */
+                PXA_EP_OUT_BULK(3, 1, 1, 0, 0),
+                PXA_EP_IN_BULK(4,  2, 1, 0, 0),
+                PXA_EP_IN_ISO(5,   3, 1, 0, 0),
+                PXA_EP_OUT_ISO(6,  4, 1, 0, 0),
+                PXA_EP_IN_INT(7,   5, 1, 0, 0),
+                /* Endpoints for RNDIS, serial */
+                PXA_EP_OUT_BULK(8, 1, 2, 0, 0),
+                PXA_EP_IN_BULK(9,  2, 2, 0, 0),
+                PXA_EP_IN_INT(10,  5, 2, 0, 0),
+                /*
+                 * All the following endpoints are only for completion.  They
+                 * won't never work, as multiple interfaces are really broken on
+                 * the pxa.
+                */
+                PXA_EP_OUT_BULK(11, 1, 2, 1, 0),
+                PXA_EP_IN_BULK(12,  2, 2, 1, 0),
+                /* Endpoint for CDC Ether */
+                PXA_EP_OUT_BULK(13, 1, 1, 1, 1),
+                PXA_EP_IN_BULK(14,  2, 1, 1, 1),
+        }
+};
+
+/**
+ * pxa_udc_probe - probes the udc device
+ * @_dev: platform device
+ *
+ * Perform basic init : allocates udc clock, creates sysfs files, requests
+ * irq.
+ */
+static int __init pxa_udc_probe(struct platform_device *pdev)
+{
+        struct resource *regs;
+        struct pxa_udc *udc = &memory;
+        int retval;
+
+        regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!regs)
+                return -ENXIO;
+        udc->irq = platform_get_irq(pdev, 0);
+        if (udc->irq < 0)
+                return udc->irq;
+
+        udc->dev = &pdev->dev;
+        udc->mach = pdev->dev.platform_data;
+
+        udc->clk = clk_get(&pdev->dev, "UDCCLK");
+        if (IS_ERR(udc->clk)) {
+                retval = PTR_ERR(udc->clk);
+                goto err_clk;
+        }
+
+        retval = -ENOMEM;
+        udc->regs = ioremap(regs->start, regs->end - regs->start + 1);
+        if (!udc->regs) {
+                dev_err(&pdev->dev, "Unable to map UDC I/O memory\n");
+                goto err_map;
+        }
+
+        device_initialize(&udc->gadget.dev);
+        udc->gadget.dev.parent = &pdev->dev;
+        udc->gadget.dev.dma_mask = NULL;
+
+        the_controller = udc;
+        platform_set_drvdata(pdev, udc);
+        udc_init_data(udc);
+        pxa_eps_setup(udc);
+
+        /* irq setup after old hardware state is cleaned up */
+        retval = request_irq(udc->irq, pxa_udc_irq,
+                        IRQF_SHARED, driver_name, udc);
+        if (retval != 0) {
+                dev_err(udc->dev, "%s: can't get irq %i, err %d\n",
+                        driver_name, IRQ_USB, retval);
+                goto err_irq;
+        }
+
+        pxa_init_debugfs(udc);
+        return 0;
+err_irq:
+        iounmap(udc->regs);
+err_map:
+        clk_put(udc->clk);
+        udc->clk = NULL;
+err_clk:
+        return retval;
+}
+
+/**
+ * pxa_udc_remove - removes the udc device driver
+ * @_dev: platform device
+ */
+static int __exit pxa_udc_remove(struct platform_device *_dev)
+{
+        struct pxa_udc *udc = platform_get_drvdata(_dev);
+
+        usb_gadget_unregister_driver(udc->driver);
+        free_irq(udc->irq, udc);
+        pxa_cleanup_debugfs(udc);
+
+        platform_set_drvdata(_dev, NULL);
+        the_controller = NULL;
+        clk_put(udc->clk);
+
+        return 0;
+}
+
+static void pxa_udc_shutdown(struct platform_device *_dev)
+{
+        struct pxa_udc *udc = platform_get_drvdata(_dev);
+
+        udc_disable(udc);
+}
+
+#ifdef CONFIG_PM
+/**
+ * pxa_udc_suspend - Suspend udc device
+ * @_dev: platform device
+ * @state: suspend state
+ *
+ * Suspends udc : saves configuration registers (UDCCR*), then disables the udc
+ * device.
+ */
+static int pxa_udc_suspend(struct platform_device *_dev, pm_message_t state)
+{
+        int i;
+        struct pxa_udc *udc = platform_get_drvdata(_dev);
+        struct pxa_ep *ep;
+
+        ep = &udc->pxa_ep[0];
+        udc->udccsr0 = udc_ep_readl(ep, UDCCSR);
+        for (i = 1; i < NR_PXA_ENDPOINTS; i++) {
+                ep = &udc->pxa_ep[i];
+                ep->udccsr_value = udc_ep_readl(ep, UDCCSR);
+                ep->udccr_value  = udc_ep_readl(ep, UDCCR);
+                ep_dbg(ep, "udccsr:0x%03x, udccr:0x%x\n",
+                                ep->udccsr_value, ep->udccr_value);
+        }
+
+        udc_disable(udc);
+
+        return 0;
+}
+
+/**
+ * pxa_udc_resume - Resume udc device
+ * @_dev: platform device
+ *
+ * Resumes udc : restores configuration registers (UDCCR*), then enables the udc
+ * device.
+ */
+static int pxa_udc_resume(struct platform_device *_dev)
+{
+        int i;
+        struct pxa_udc *udc = platform_get_drvdata(_dev);
+        struct pxa_ep *ep;
+
+        ep = &udc->pxa_ep[0];
+        udc_ep_writel(ep, UDCCSR, udc->udccsr0 & (UDCCSR0_FST | UDCCSR0_DME));
+        for (i = 1; i < NR_PXA_ENDPOINTS; i++) {
+                ep = &udc->pxa_ep[i];
+                udc_ep_writel(ep, UDCCSR, ep->udccsr_value);
+                udc_ep_writel(ep, UDCCR,  ep->udccr_value);
+                ep_dbg(ep, "udccsr:0x%03x, udccr:0x%x\n",
+                                ep->udccsr_value, ep->udccr_value);
+        }
+
+        udc_enable(udc);
+        /*
+         * We do not handle OTG yet.
+         *
+         * OTGPH bit is set when sleep mode is entered.
+         * it indicates that OTG pad is retaining its state.
+         * Upon exit from sleep mode and before clearing OTGPH,
+         * Software must configure the USB OTG pad, UDC, and UHC
+         * to the state they were in before entering sleep mode.
+         *
+         * Should be : PSSR |= PSSR_OTGPH;
+         */
+
+        return 0;
+}
+#endif
+
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:pxa2xx-udc");
+
+static struct platform_driver udc_driver = {
+        .driver         = {
+                .name   = "pxa2xx-udc",
+                .owner  = THIS_MODULE,
+        },
+        .remove         = __exit_p(pxa_udc_remove),
+        .shutdown       = pxa_udc_shutdown,
+#ifdef CONFIG_PM
+        .suspend        = pxa_udc_suspend,
+        .resume         = pxa_udc_resume
+#endif
+};
+
+static int __init udc_init(void)
+{
+        printk(KERN_INFO "%s: version %s\n", driver_name, DRIVER_VERSION);
+        return platform_driver_probe(&udc_driver, pxa_udc_probe);
+}
+module_init(udc_init);
+
+
+static void __exit udc_exit(void)
+{
+        platform_driver_unregister(&udc_driver);
+}
+module_exit(udc_exit);
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Robert Jarzmik");
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/gadget/pxa27x_udc.h b/drivers/usb/gadget/pxa27x_udc.h
new file mode 100644
index 00000000000..1d1b7936ee1
--- /dev/null
+++ b/drivers/usb/gadget/pxa27x_udc.h
@@ -0,0 +1,487 @@
+/*
+ * linux/drivers/usb/gadget/pxa27x_udc.h
+ * Intel PXA27x on-chip full speed USB device controller
+ *
+ * Inspired by original driver by Frank Becker, David Brownell, and others.
+ * Copyright (C) 2008 Robert Jarzmik
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#ifndef __LINUX_USB_GADGET_PXA27X_H
+#define __LINUX_USB_GADGET_PXA27X_H
+
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/io.h>
+
+/*
+ * Register definitions
+ */
+/* Offsets */
+#define UDCCR           0x0000          /* UDC Control Register */
+#define UDCICR0         0x0004          /* UDC Interrupt Control Register0 */
+#define UDCICR1         0x0008          /* UDC Interrupt Control Register1 */
+#define UDCISR0         0x000C          /* UDC Interrupt Status Register 0 */
+#define UDCISR1         0x0010          /* UDC Interrupt Status Register 1 */
+#define UDCFNR          0x0014          /* UDC Frame Number Register */
+#define UDCOTGICR       0x0018          /* UDC On-The-Go interrupt control */
+#define UP2OCR          0x0020          /* USB Port 2 Output Control register */
+#define UP3OCR          0x0024          /* USB Port 3 Output Control register */
+#define UDCCSRn(x)      (0x0100 + ((x)<<2)) /* UDC Control/Status register */
+#define UDCBCRn(x)      (0x0200 + ((x)<<2)) /* UDC Byte Count Register */
+#define UDCDRn(x)       (0x0300 + ((x)<<2)) /* UDC Data Register  */
+#define UDCCRn(x)       (0x0400 + ((x)<<2)) /* UDC Control Register */
+
+#define UDCCR_OEN       (1 << 31)       /* On-the-Go Enable */
+#define UDCCR_AALTHNP   (1 << 30)       /* A-device Alternate Host Negotiation
+                                           Protocol Port Support */
+#define UDCCR_AHNP      (1 << 29)       /* A-device Host Negotiation Protocol
+                                           Support */
+#define UDCCR_BHNP      (1 << 28)       /* B-device Host Negotiation Protocol
+                                           Enable */
+#define UDCCR_DWRE      (1 << 16)       /* Device Remote Wake-up Enable */
+#define UDCCR_ACN       (0x03 << 11)    /* Active UDC configuration Number */
+#define UDCCR_ACN_S     11
+#define UDCCR_AIN       (0x07 << 8)     /* Active UDC interface Number */
+#define UDCCR_AIN_S     8
+#define UDCCR_AAISN     (0x07 << 5)     /* Active UDC Alternate Interface
+                                           Setting Number */
+#define UDCCR_AAISN_S   5
+#define UDCCR_SMAC      (1 << 4)        /* Switch Endpoint Memory to Active
+                                           Configuration */
+#define UDCCR_EMCE      (1 << 3)        /* Endpoint Memory Configuration
+                                           Error */
+#define UDCCR_UDR       (1 << 2)        /* UDC Resume */
+#define UDCCR_UDA       (1 << 1)        /* UDC Active */
+#define UDCCR_UDE       (1 << 0)        /* UDC Enable */
+
+#define UDCICR_INT(n, intr) (((intr) & 0x03) << (((n) & 0x0F) * 2))
+#define UDCICR1_IECC    (1 << 31)       /* IntEn - Configuration Change */
+#define UDCICR1_IESOF   (1 << 30)       /* IntEn - Start of Frame */
+#define UDCICR1_IERU    (1 << 29)       /* IntEn - Resume */
+#define UDCICR1_IESU    (1 << 28)       /* IntEn - Suspend */
+#define UDCICR1_IERS    (1 << 27)       /* IntEn - Reset */
+#define UDCICR_FIFOERR  (1 << 1)        /* FIFO Error interrupt for EP */
+#define UDCICR_PKTCOMPL (1 << 0)        /* Packet Complete interrupt for EP */
+#define UDCICR_INT_MASK (UDCICR_FIFOERR | UDCICR_PKTCOMPL)
+
+#define UDCISR_INT(n, intr) (((intr) & 0x03) << (((n) & 0x0F) * 2))
+#define UDCISR1_IRCC    (1 << 31)       /* IntReq - Configuration Change */
+#define UDCISR1_IRSOF   (1 << 30)       /* IntReq - Start of Frame */
+#define UDCISR1_IRRU    (1 << 29)       /* IntReq - Resume */
+#define UDCISR1_IRSU    (1 << 28)       /* IntReq - Suspend */
+#define UDCISR1_IRRS    (1 << 27)       /* IntReq - Reset */
+#define UDCISR_INT_MASK (UDCICR_FIFOERR | UDCICR_PKTCOMPL)
+
+#define UDCOTGICR_IESF  (1 << 24)       /* OTG SET_FEATURE command recvd */
+#define UDCOTGICR_IEXR  (1 << 17)       /* Extra Transciever Interrupt
+                                           Rising Edge Interrupt Enable */
+#define UDCOTGICR_IEXF  (1 << 16)       /* Extra Transciever Interrupt
+                                           Falling Edge Interrupt Enable */
+#define UDCOTGICR_IEVV40R (1 << 9)      /* OTG Vbus Valid 4.0V Rising Edge
+                                           Interrupt Enable */
+#define UDCOTGICR_IEVV40F (1 << 8)      /* OTG Vbus Valid 4.0V Falling Edge
+                                           Interrupt Enable */
+#define UDCOTGICR_IEVV44R (1 << 7)      /* OTG Vbus Valid 4.4V Rising Edge
+                                           Interrupt Enable */
+#define UDCOTGICR_IEVV44F (1 << 6)      /* OTG Vbus Valid 4.4V Falling Edge
+                                           Interrupt Enable */
+#define UDCOTGICR_IESVR (1 << 5)        /* OTG Session Valid Rising Edge
+                                           Interrupt Enable */
+#define UDCOTGICR_IESVF (1 << 4)        /* OTG Session Valid Falling Edge
+                                           Interrupt Enable */
+#define UDCOTGICR_IESDR (1 << 3)        /* OTG A-Device SRP Detect Rising
+                                           Edge Interrupt Enable */
+#define UDCOTGICR_IESDF (1 << 2)        /* OTG A-Device SRP Detect Falling
+                                           Edge Interrupt Enable */
+#define UDCOTGICR_IEIDR (1 << 1)        /* OTG ID Change Rising Edge
+                                           Interrupt Enable */
+#define UDCOTGICR_IEIDF (1 << 0)        /* OTG ID Change Falling Edge
+                                           Interrupt Enable */
+
+/* Host Port 2 field bits */
+#define UP2OCR_CPVEN    (1 << 0)        /* Charge Pump Vbus Enable */
+#define UP2OCR_CPVPE    (1 << 1)        /* Charge Pump Vbus Pulse Enable */
+                                        /* Transceiver enablers */
+#define UP2OCR_DPPDE    (1 << 2)        /*   D+ Pull Down Enable */
+#define UP2OCR_DMPDE    (1 << 3)        /*   D- Pull Down Enable */
+#define UP2OCR_DPPUE    (1 << 4)        /*   D+ Pull Up Enable */
+#define UP2OCR_DMPUE    (1 << 5)        /*   D- Pull Up Enable */
+#define UP2OCR_DPPUBE   (1 << 6)        /*   D+ Pull Up Bypass Enable */
+#define UP2OCR_DMPUBE   (1 << 7)        /*   D- Pull Up Bypass Enable */
+#define UP2OCR_EXSP     (1 << 8)        /* External Transceiver Speed Control */
+#define UP2OCR_EXSUS    (1 << 9)        /* External Transceiver Speed Enable */
+#define UP2OCR_IDON     (1 << 10)       /* OTG ID Read Enable */
+#define UP2OCR_HXS      (1 << 16)       /* Transceiver Output Select */
+#define UP2OCR_HXOE     (1 << 17)       /* Transceiver Output Enable */
+#define UP2OCR_SEOS     (1 << 24)       /* Single-Ended Output Select */
+
+#define UDCCSR0_SA      (1 << 7)        /* Setup Active */
+#define UDCCSR0_RNE     (1 << 6)        /* Receive FIFO Not Empty */
+#define UDCCSR0_FST     (1 << 5)        /* Force Stall */
+#define UDCCSR0_SST     (1 << 4)        /* Sent Stall */
+#define UDCCSR0_DME     (1 << 3)        /* DMA Enable */
+#define UDCCSR0_FTF     (1 << 2)        /* Flush Transmit FIFO */
+#define UDCCSR0_IPR     (1 << 1)        /* IN Packet Ready */
+#define UDCCSR0_OPC     (1 << 0)        /* OUT Packet Complete */
+
+#define UDCCSR_DPE      (1 << 9)        /* Data Packet Error */
+#define UDCCSR_FEF      (1 << 8)        /* Flush Endpoint FIFO */
+#define UDCCSR_SP       (1 << 7)        /* Short Packet Control/Status */
+#define UDCCSR_BNE      (1 << 6)        /* Buffer Not Empty (IN endpoints) */
+#define UDCCSR_BNF      (1 << 6)        /* Buffer Not Full (OUT endpoints) */
+#define UDCCSR_FST      (1 << 5)        /* Force STALL */
+#define UDCCSR_SST      (1 << 4)        /* Sent STALL */
+#define UDCCSR_DME      (1 << 3)        /* DMA Enable */
+#define UDCCSR_TRN      (1 << 2)        /* Tx/Rx NAK */
+#define UDCCSR_PC       (1 << 1)        /* Packet Complete */
+#define UDCCSR_FS       (1 << 0)        /* FIFO needs service */
+
+#define UDCCONR_CN      (0x03 << 25)    /* Configuration Number */
+#define UDCCONR_CN_S    25
+#define UDCCONR_IN      (0x07 << 22)    /* Interface Number */
+#define UDCCONR_IN_S    22
+#define UDCCONR_AISN    (0x07 << 19)    /* Alternate Interface Number */
+#define UDCCONR_AISN_S  19
+#define UDCCONR_EN      (0x0f << 15)    /* Endpoint Number */
+#define UDCCONR_EN_S    15
+#define UDCCONR_ET      (0x03 << 13)    /* Endpoint Type: */
+#define UDCCONR_ET_S    13
+#define UDCCONR_ET_INT  (0x03 << 13)    /*   Interrupt */
+#define UDCCONR_ET_BULK (0x02 << 13)    /*   Bulk */
+#define UDCCONR_ET_ISO  (0x01 << 13)    /*   Isochronous */
+#define UDCCONR_ET_NU   (0x00 << 13)    /*   Not used */
+#define UDCCONR_ED      (1 << 12)       /* Endpoint Direction */
+#define UDCCONR_MPS     (0x3ff << 2)    /* Maximum Packet Size */
+#define UDCCONR_MPS_S   2
+#define UDCCONR_DE      (1 << 1)        /* Double Buffering Enable */
+#define UDCCONR_EE      (1 << 0)        /* Endpoint Enable */
+
+#define UDCCR_MASK_BITS (UDCCR_OEN | UDCCR_SMAC | UDCCR_UDR | UDCCR_UDE)
+#define UDCCSR_WR_MASK  (UDCCSR_DME | UDCCSR_FST)
+#define UDC_FNR_MASK    (0x7ff)
+#define UDC_BCR_MASK    (0x3ff)
+
+/*
+ * UDCCR = UDC Endpoint Configuration Registers
+ * UDCCSR = UDC Control/Status Register for this EP
+ * UDCBCR = UDC Byte Count Remaining (contents of OUT fifo)
+ * UDCDR = UDC Endpoint Data Register (the fifo)
+ */
+#define ofs_UDCCR(ep)   (UDCCRn(ep->idx))
+#define ofs_UDCCSR(ep)  (UDCCSRn(ep->idx))
+#define ofs_UDCBCR(ep)  (UDCBCRn(ep->idx))
+#define ofs_UDCDR(ep)   (UDCDRn(ep->idx))
+
+/* Register access macros */
+#define udc_ep_readl(ep, reg)   \
+        __raw_readl((ep)->dev->regs + ofs_##reg(ep))
+#define udc_ep_writel(ep, reg, value)   \
+        __raw_writel((value), ep->dev->regs + ofs_##reg(ep))
+#define udc_ep_readb(ep, reg)   \
+        __raw_readb((ep)->dev->regs + ofs_##reg(ep))
+#define udc_ep_writeb(ep, reg, value)   \
+        __raw_writeb((value), ep->dev->regs + ofs_##reg(ep))
+#define udc_readl(dev, reg)     \
+        __raw_readl((dev)->regs + (reg))
+#define udc_writel(udc, reg, value)     \
+        __raw_writel((value), (udc)->regs + (reg))
+
+#define UDCCSR_MASK             (UDCCSR_FST | UDCCSR_DME)
+#define UDCCISR0_EP_MASK        ~0
+#define UDCCISR1_EP_MASK        0xffff
+#define UDCCSR0_CTRL_REQ_MASK   (UDCCSR0_OPC | UDCCSR0_SA | UDCCSR0_RNE)
+
+#define EPIDX(ep)       (ep->idx)
+#define EPADDR(ep)      (ep->addr)
+#define EPXFERTYPE(ep)  (ep->type)
+#define EPNAME(ep)      (ep->name)
+#define is_ep0(ep)      (!ep->idx)
+#define EPXFERTYPE_is_ISO(ep) (EPXFERTYPE(ep) == USB_ENDPOINT_XFER_ISOC)
+
+/*
+ * Endpoint definitions
+ *
+ * Once enabled, pxa endpoint configuration is freezed, and cannot change
+ * unless a reset happens or the udc is disabled.
+ * Therefore, we must define all pxa potential endpoint definitions needed for
+ * all gadget and set them up before the udc is enabled.
+ *
+ * As the architecture chosen is fully static, meaning the pxa endpoint
+ * configurations are set up once and for all, we must provide a way to match
+ * one usb endpoint (usb_ep) to several pxa endpoints. The reason is that gadget
+ * layer autoconf doesn't choose the usb_ep endpoint on (config, interface, alt)
+ * criteria, while the pxa architecture requires that.
+ *
+ * The solution is to define several pxa endpoints matching one usb_ep. Ex:
+ *   - "ep1-in" matches pxa endpoint EPA (which is an IN ep at addr 1, when
+ *     the udc talks on (config=3, interface=0, alt=0)
+ *   - "ep1-in" matches pxa endpoint EPB (which is an IN ep at addr 1, when
+ *     the udc talks on (config=3, interface=0, alt=1)
+ *   - "ep1-in" matches pxa endpoint EPC (which is an IN ep at addr 1, when
+ *     the udc talks on (config=2, interface=0, alt=0)
+ *
+ * We'll define the pxa endpoint by its index (EPA => idx=1, EPB => idx=2, ...)
+ */
+
+/*
+ * Endpoint definition helpers
+ */
+#define USB_EP_DEF(addr, bname, dir, type, maxpkt) \
+{ .usb_ep = { .name = bname, .ops = &pxa_ep_ops, .maxpacket = maxpkt, }, \
+  .desc = {     .bEndpointAddress = addr | (dir ? USB_DIR_IN : 0), \
+                .bmAttributes = type, \
+                .wMaxPacketSize = maxpkt, }, \
+  .dev = &memory \
+}
+#define USB_EP_BULK(addr, bname, dir) \
+  USB_EP_DEF(addr, bname, dir, USB_ENDPOINT_XFER_BULK, BULK_FIFO_SIZE)
+#define USB_EP_ISO(addr, bname, dir) \
+  USB_EP_DEF(addr, bname, dir, USB_ENDPOINT_XFER_ISOC, ISO_FIFO_SIZE)
+#define USB_EP_INT(addr, bname, dir) \
+  USB_EP_DEF(addr, bname, dir, USB_ENDPOINT_XFER_INT, INT_FIFO_SIZE)
+#define USB_EP_IN_BULK(n)       USB_EP_BULK(n, "ep" #n "in-bulk", 1)
+#define USB_EP_OUT_BULK(n)      USB_EP_BULK(n, "ep" #n "out-bulk", 0)
+#define USB_EP_IN_ISO(n)        USB_EP_ISO(n,  "ep" #n "in-iso", 1)
+#define USB_EP_OUT_ISO(n)       USB_EP_ISO(n,  "ep" #n "out-iso", 0)
+#define USB_EP_IN_INT(n)        USB_EP_INT(n,  "ep" #n "in-int", 1)
+#define USB_EP_CTRL             USB_EP_DEF(0,  "ep0", 0, 0, EP0_FIFO_SIZE)
+
+#define PXA_EP_DEF(_idx, _addr, dir, _type, maxpkt, _config, iface, altset) \
+{ \
+        .dev = &memory, \
+        .name = "ep" #_idx, \
+        .idx = _idx, .enabled = 0, \
+        .dir_in = dir, .addr = _addr, \
+        .config = _config, .interface = iface, .alternate = altset, \
+        .type = _type, .fifo_size = maxpkt, \
+}
+#define PXA_EP_BULK(_idx, addr, dir, config, iface, alt) \
+  PXA_EP_DEF(_idx, addr, dir, USB_ENDPOINT_XFER_BULK, BULK_FIFO_SIZE, \
+                config, iface, alt)
+#define PXA_EP_ISO(_idx, addr, dir, config, iface, alt) \
+  PXA_EP_DEF(_idx, addr, dir, USB_ENDPOINT_XFER_ISOC, ISO_FIFO_SIZE, \
+                config, iface, alt)
+#define PXA_EP_INT(_idx, addr, dir, config, iface, alt) \
+  PXA_EP_DEF(_idx, addr, dir, USB_ENDPOINT_XFER_INT, INT_FIFO_SIZE, \
+                config, iface, alt)
+#define PXA_EP_IN_BULK(i, adr, c, f, a)         PXA_EP_BULK(i, adr, 1, c, f, a)
+#define PXA_EP_OUT_BULK(i, adr, c, f, a)        PXA_EP_BULK(i, adr, 0, c, f, a)
+#define PXA_EP_IN_ISO(i, adr, c, f, a)          PXA_EP_ISO(i, adr, 1, c, f, a)
+#define PXA_EP_OUT_ISO(i, adr, c, f, a)         PXA_EP_ISO(i, adr, 0, c, f, a)
+#define PXA_EP_IN_INT(i, adr, c, f, a)          PXA_EP_INT(i, adr, 1, c, f, a)
+#define PXA_EP_CTRL     PXA_EP_DEF(0, 0, 0, 0, EP0_FIFO_SIZE, 0, 0, 0)
+
+struct pxa27x_udc;
+
+struct stats {
+        unsigned long in_ops;
+        unsigned long out_ops;
+        unsigned long in_bytes;
+        unsigned long out_bytes;
+        unsigned long irqs;
+};
+
+/**
+ * struct udc_usb_ep - container of each usb_ep structure
+ * @usb_ep: usb endpoint
+ * @desc: usb descriptor, especially type and address
+ * @dev: udc managing this endpoint
+ * @pxa_ep: matching pxa_ep (cache of find_pxa_ep() call)
+ */
+struct udc_usb_ep {
+        struct usb_ep usb_ep;
+        struct usb_endpoint_descriptor desc;
+        struct pxa_udc *dev;
+        struct pxa_ep *pxa_ep;
+};
+
+/**
+ * struct pxa_ep - pxa endpoint
+ * @dev: udc device
+ * @queue: requests queue
+ * @lock: lock to pxa_ep data (queues and stats)
+ * @enabled: true when endpoint enabled (not stopped by gadget layer)
+ * @idx: endpoint index (1 => epA, 2 => epB, ..., 24 => epX)
+ * @name: endpoint name (for trace/debug purpose)
+ * @dir_in: 1 if IN endpoint, 0 if OUT endpoint
+ * @addr: usb endpoint number
+ * @config: configuration in which this endpoint is active
+ * @interface: interface in which this endpoint is active
+ * @alternate: altsetting in which this endpoitn is active
+ * @fifo_size: max packet size in the endpoint fifo
+ * @type: endpoint type (bulk, iso, int, ...)
+ * @udccsr_value: save register of UDCCSR0 for suspend/resume
+ * @udccr_value: save register of UDCCR for suspend/resume
+ * @stats: endpoint statistics
+ *
+ * The *PROBLEM* is that pxa's endpoint configuration scheme is both misdesigned
+ * (cares about config/interface/altsetting, thus placing needless limits on
+ * device capability) and full of implementation bugs forcing it to be set up
+ * for use more or less like a pxa255.
+ *
+ * As we define the pxa_ep statically, we must guess all needed pxa_ep for all
+ * gadget which may work with this udc driver.
+ */
+struct pxa_ep {
+        struct pxa_udc          *dev;
+
+        struct list_head        queue;
+        spinlock_t              lock;           /* Protects this structure */
+                                                /* (queues, stats) */
+        unsigned                enabled:1;
+
+        unsigned                idx:5;
+        char                    *name;
+
+        /*
+         * Specific pxa endpoint data, needed for hardware initialization
+         */
+        unsigned                dir_in:1;
+        unsigned                addr:3;
+        unsigned                config:2;
+        unsigned                interface:3;
+        unsigned                alternate:3;
+        unsigned                fifo_size;
+        unsigned                type;
+
+#ifdef CONFIG_PM
+        u32                     udccsr_value;
+        u32                     udccr_value;
+#endif
+        struct stats            stats;
+};
+
+/**
+ * struct pxa27x_request - container of each usb_request structure
+ * @req: usb request
+ * @udc_usb_ep: usb endpoint the request was submitted on
+ * @in_use: sanity check if request already queued on an pxa_ep
+ * @queue: linked list of requests, linked on pxa_ep->queue
+ */
+struct pxa27x_request {
+        struct usb_request                      req;
+        struct udc_usb_ep                       *udc_usb_ep;
+        unsigned                                in_use:1;
+        struct list_head                        queue;
+};
+
+enum ep0_state {
+        WAIT_FOR_SETUP,
+        SETUP_STAGE,
+        IN_DATA_STAGE,
+        OUT_DATA_STAGE,
+        IN_STATUS_STAGE,
+        OUT_STATUS_STAGE,
+        STALL,
+        WAIT_ACK_SET_CONF_INTERF
+};
+
+static char *ep0_state_name[] = {
+        "WAIT_FOR_SETUP", "SETUP_STAGE", "IN_DATA_STAGE", "OUT_DATA_STAGE",
+        "IN_STATUS_STAGE", "OUT_STATUS_STAGE", "STALL",
+        "WAIT_ACK_SET_CONF_INTERF"
+};
+#define EP0_STNAME(udc) ep0_state_name[(udc)->ep0state]
+
+#define EP0_FIFO_SIZE   16U
+#define BULK_FIFO_SIZE  64U
+#define ISO_FIFO_SIZE   256U
+#define INT_FIFO_SIZE   16U
+
+struct udc_stats {
+        unsigned long   irqs_reset;
+        unsigned long   irqs_suspend;
+        unsigned long   irqs_resume;
+        unsigned long   irqs_reconfig;
+};
+
+#define NR_USB_ENDPOINTS (1 + 5)        /* ep0 + ep1in-bulk + .. + ep3in-iso */
+#define NR_PXA_ENDPOINTS (1 + 14)       /* ep0 + epA + epB + .. + epX */
+
+/**
+ * struct pxa_udc - udc structure
+ * @regs: mapped IO space
+ * @irq: udc irq
+ * @clk: udc clock
+ * @usb_gadget: udc gadget structure
+ * @driver: bound gadget (zero, g_ether, g_file_storage, ...)
+ * @dev: device
+ * @mach: machine info, used to activate specific GPIO
+ * @ep0state: control endpoint state machine state
+ * @stats: statistics on udc usage
+ * @udc_usb_ep: array of usb endpoints offered by the gadget
+ * @pxa_ep: array of pxa available endpoints
+ * @config: UDC active configuration
+ * @last_interface: UDC interface of the last SET_INTERFACE host request
+ * @last_alternate: UDC altsetting of the last SET_INTERFACE host request
+ * @udccsr0: save of udccsr0 in case of suspend
+ * @debugfs_root: root entry of debug filesystem
+ * @debugfs_state: debugfs entry for "udcstate"
+ * @debugfs_queues: debugfs entry for "queues"
+ * @debugfs_eps: debugfs entry for "epstate"
+ */
+struct pxa_udc {
+        void __iomem                            *regs;
+        int                                     irq;
+        struct clk                              *clk;
+
+        struct usb_gadget                       gadget;
+        struct usb_gadget_driver                *driver;
+        struct device                           *dev;
+        struct pxa2xx_udc_mach_info             *mach;
+
+        enum ep0_state                          ep0state;
+        struct udc_stats                        stats;
+
+        struct udc_usb_ep                       udc_usb_ep[NR_USB_ENDPOINTS];
+        struct pxa_ep                           pxa_ep[NR_PXA_ENDPOINTS];
+
+        unsigned                                config:2;
+        unsigned                                last_interface:3;
+        unsigned                                last_alternate:3;
+
+#ifdef CONFIG_PM
+        unsigned                                udccsr0;
+#endif
+#ifdef CONFIG_USB_GADGET_DEBUG_FS
+        struct dentry                           *debugfs_root;
+        struct dentry                           *debugfs_state;
+        struct dentry                           *debugfs_queues;
+        struct dentry                           *debugfs_eps;
+#endif
+};
+
+static inline struct pxa_udc *to_gadget_udc(struct usb_gadget *gadget)
+{
+        return container_of(gadget, struct pxa_udc, gadget);
+}
+
+/*
+ * Debugging/message support
+ */
+#define ep_dbg(ep, fmt, arg...) \
+        dev_dbg(ep->dev->dev, "%s:%s: " fmt, EPNAME(ep), __func__, ## arg)
+#define ep_vdbg(ep, fmt, arg...) \
+        dev_vdbg(ep->dev->dev, "%s:%s: " fmt, EPNAME(ep), __func__, ## arg)
+#define ep_err(ep, fmt, arg...) \
+        dev_err(ep->dev->dev, "%s:%s: " fmt, EPNAME(ep), __func__, ## arg)
+#define ep_info(ep, fmt, arg...) \
+        dev_info(ep->dev->dev, "%s:%s: " fmt, EPNAME(ep), __func__, ## arg)
+#define ep_warn(ep, fmt, arg...) \
+        dev_warn(ep->dev->dev, "%s:%s:" fmt, EPNAME(ep), __func__, ## arg)
+
+#endif /* __LINUX_USB_GADGET_PXA27X_H */
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index 8d158e5640e..54cdd6f9403 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -135,7 +135,10 @@ struct gs_port {
         int                     port_in_use;    /* open/close in progress */
         wait_queue_head_t       port_write_wait;/* waiting to write */
         struct gs_buf           *port_write_buf;
-        struct usb_cdc_line_coding      port_line_coding;
+        struct usb_cdc_line_coding port_line_coding;    /* 8-N-1 etc */
+        u16                     port_handshake_bits;
+#define RS232_RTS       (1 << 1)
+#define RS232_DTE       (1 << 0)
 };
 
 /* the device structure holds info for the USB device */
@@ -199,6 +202,8 @@ static int gs_setup_standard(struct usb_gadget *gadget,
 static int gs_setup_class(struct usb_gadget *gadget,
         const struct usb_ctrlrequest *ctrl);
 static void gs_setup_complete(struct usb_ep *ep, struct usb_request *req);
+static void gs_setup_complete_set_line_coding(struct usb_ep *ep,
+        struct usb_request *req);
 static void gs_disconnect(struct usb_gadget *gadget);
 static int gs_set_config(struct gs_dev *dev, unsigned config);
 static void gs_reset_config(struct gs_dev *dev);
@@ -406,7 +411,7 @@ static struct usb_cdc_acm_descriptor gs_acm_descriptor = {
         .bLength =              sizeof(gs_acm_descriptor),
         .bDescriptorType =      USB_DT_CS_INTERFACE,
         .bDescriptorSubType =   USB_CDC_ACM_TYPE,
-        .bmCapabilities =       0,
+        .bmCapabilities =       (1 << 1),
 };
 
 static const struct usb_cdc_union_desc gs_union_desc = {
@@ -1502,6 +1507,8 @@ static int gs_setup(struct usb_gadget *gadget,
         u16 wValue = le16_to_cpu(ctrl->wValue);
         u16 wLength = le16_to_cpu(ctrl->wLength);
 
+        req->complete = gs_setup_complete;
+
         switch (ctrl->bRequestType & USB_TYPE_MASK) {
         case USB_TYPE_STANDARD:
                 ret = gs_setup_standard(gadget,ctrl);
@@ -1679,18 +1686,14 @@ static int gs_setup_class(struct usb_gadget *gadget,
 
         switch (ctrl->bRequest) {
         case USB_CDC_REQ_SET_LINE_CODING:
-                /* FIXME Submit req to read the data; have its completion
-                 * handler copy that data to port->port_line_coding (iff
-                 * it's valid) and maybe pass it on.  Until then, fail.
-                 */
-                pr_warning("gs_setup: set_line_coding "
-                                "unuspported\n");
+                if (wLength != sizeof(struct usb_cdc_line_coding))
+                        break;
+                ret = wLength;
+                req->complete = gs_setup_complete_set_line_coding;
                 break;
 
         case USB_CDC_REQ_GET_LINE_CODING:
-                port = dev->dev_port[0];        /* ACM only has one port */
-                ret = min(wLength,
-                        (u16)sizeof(struct usb_cdc_line_coding));
+                ret = min_t(int, wLength, sizeof(struct usb_cdc_line_coding));
                 if (port) {
                         spin_lock(&port->port_lock);
                         memcpy(req->buf, &port->port_line_coding, ret);
@@ -1699,15 +1702,27 @@ static int gs_setup_class(struct usb_gadget *gadget,
                 break;
 
         case USB_CDC_REQ_SET_CONTROL_LINE_STATE:
-                /* FIXME Submit req to read the data; have its completion
-                 * handler use that to set the state (iff it's valid) and
-                 * maybe pass it on.  Until then, fail.
-                 */
-                pr_warning("gs_setup: set_control_line_state "
-                                "unuspported\n");
+                if (wLength != 0)
+                        break;
+                ret = 0;
+                if (port) {
+                        /* REVISIT:  we currently just remember this data.
+                         * If we change that, update whatever hardware needs
+                         * updating.
+                         */
+                        spin_lock(&port->port_lock);
+                        port->port_handshake_bits = wValue;
+                        spin_unlock(&port->port_lock);
+                }
                 break;
 
         default:
+                /* NOTE:  strictly speaking, we should accept AT-commands
+                 * using SEND_ENCPSULATED_COMMAND/GET_ENCAPSULATED_RESPONSE.
+                 * But our call management descriptor says we don't handle
+                 * call management, so we should be able to get by without
+                 * handling those "required" commands (except by stalling).
+                 */
                 pr_err("gs_setup: unknown class request, "
                                 "type=%02x, request=%02x, value=%04x, "
                                 "index=%04x, length=%d\n",
@@ -1719,6 +1734,42 @@ static int gs_setup_class(struct usb_gadget *gadget,
         return ret;
 }
 
+static void gs_setup_complete_set_line_coding(struct usb_ep *ep,
+                struct usb_request *req)
+{
+        struct gs_dev *dev = ep->driver_data;
+        struct gs_port *port = dev->dev_port[0]; /* ACM only has one port */
+
+        switch (req->status) {
+        case 0:
+                /* normal completion */
+                if (req->actual != sizeof(port->port_line_coding))
+                        usb_ep_set_halt(ep);
+                else if (port) {
+                        struct usb_cdc_line_coding      *value = req->buf;
+
+                        /* REVISIT:  we currently just remember this data.
+                         * If we change that, (a) validate it first, then
+                         * (b) update whatever hardware needs updating.
+                         */
+                        spin_lock(&port->port_lock);
+                        port->port_line_coding = *value;
+                        spin_unlock(&port->port_lock);
+                }
+                break;
+
+        case -ESHUTDOWN:
+                /* disconnect */
+                gs_free_req(ep, req);
+                break;
+
+        default:
+                /* unexpected */
+                break;
+        }
+        return;
+}
+
 /*
  * gs_setup_complete
  */
@@ -1906,6 +1957,11 @@ static int gs_set_config(struct gs_dev *dev, unsigned config)
                 }
         }
 
+        /* REVISIT the ACM mode should be able to actually *issue* some
+         * notifications, for at least serial state change events if
+         * not also for network connection; say so in bmCapabilities.
+         */
+
         pr_info("gs_set_config: %s configured, %s speed %s config\n",
                 GS_LONG_NAME,
                 gadget->speed == USB_SPEED_HIGH ? "high" : "full",
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index d3d4f4048e6..fce4924dbbe 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -23,9 +23,7 @@
 /*
  * Gadget Zero only needs two bulk endpoints, and is an example of how you
  * can write a hardware-agnostic gadget driver running inside a USB device.
- *
- * Hardware details are visible (see CONFIG_USB_ZERO_* below) but don't
- * affect most of the driver.
+ * Some hardware details are visible, but don't affect most of the driver.
  *
  * Use it with the Linux host/master side "usbtest" driver to get a basic
  * functional test of your device-side usb stack, or with "usb-skeleton".
@@ -37,6 +35,7 @@
  *   buflen=N           default N=4096, buffer size used
  *   qlen=N             default N=32, how many buffers in the loopback queue
  *   loopdefault        default false, list loopback config first
+ *   autoresume=N       default N=0, seconds before triggering remote wakeup
  *
  * Many drivers will only have one configuration, letting them be much
  * simpler if they also don't support high speed operation (like this
@@ -62,13 +61,13 @@
 
 /*-------------------------------------------------------------------------*/
 
-#define DRIVER_VERSION          "Lughnasadh, 2007"
+#define DRIVER_VERSION          "Earth Day 2008"
 
-static const char shortname [] = "zero";
-static const char longname [] = "Gadget Zero";
+static const char shortname[] = "zero";
+static const char longname[] = "Gadget Zero";
 
-static const char source_sink [] = "source and sink data";
-static const char loopback [] = "loop input to output";
+static const char source_sink[] = "source and sink data";
+static const char loopback[] = "loop input to output";
 
 /*-------------------------------------------------------------------------*/
 
@@ -120,16 +119,16 @@ static unsigned buflen = 4096;
 static unsigned qlen = 32;
 static unsigned pattern = 0;
 
-module_param (buflen, uint, S_IRUGO);
-module_param (qlen, uint, S_IRUGO);
-module_param (pattern, uint, S_IRUGO|S_IWUSR);
+module_param(buflen, uint, S_IRUGO);
+module_param(qlen, uint, S_IRUGO);
+module_param(pattern, uint, S_IRUGO|S_IWUSR);
 
 /*
  * if it's nonzero, autoresume says how many seconds to wait
  * before trying to wake up the host after suspend.
  */
 static unsigned autoresume = 0;
-module_param (autoresume, uint, 0);
+module_param(autoresume, uint, 0);
 
 /*
  * Normally the "loopback" configuration is second (index 1) so
@@ -138,8 +137,7 @@ module_param (autoresume, uint, 0);
  * Or controllers (like superh) that only support one config.
  */
 static int loopdefault = 0;
-
-module_param (loopdefault, bool, S_IRUGO|S_IWUSR);
+module_param(loopdefault, bool, S_IRUGO|S_IWUSR);
 
 /*-------------------------------------------------------------------------*/
 
@@ -176,24 +174,22 @@ module_param (loopdefault, bool, S_IRUGO|S_IWUSR);
 #define CONFIG_SOURCE_SINK      3
 #define CONFIG_LOOPBACK         2
 
-static struct usb_device_descriptor
-device_desc = {
+static struct usb_device_descriptor device_desc = {
         .bLength =              sizeof device_desc,
         .bDescriptorType =      USB_DT_DEVICE,
 
-        .bcdUSB =               __constant_cpu_to_le16 (0x0200),
+        .bcdUSB =               __constant_cpu_to_le16(0x0200),
         .bDeviceClass =         USB_CLASS_VENDOR_SPEC,
 
-        .idVendor =             __constant_cpu_to_le16 (DRIVER_VENDOR_NUM),
-        .idProduct =            __constant_cpu_to_le16 (DRIVER_PRODUCT_NUM),
+        .idVendor =             __constant_cpu_to_le16(DRIVER_VENDOR_NUM),
+        .idProduct =            __constant_cpu_to_le16(DRIVER_PRODUCT_NUM),
         .iManufacturer =        STRING_MANUFACTURER,
         .iProduct =             STRING_PRODUCT,
         .iSerialNumber =        STRING_SERIAL,
         .bNumConfigurations =   2,
 };
 
-static struct usb_config_descriptor
-source_sink_config = {
+static struct usb_config_descriptor source_sink_config = {
         .bLength =              sizeof source_sink_config,
         .bDescriptorType =      USB_DT_CONFIG,
 
@@ -205,8 +201,7 @@ source_sink_config = {
         .bMaxPower =            1,      /* self-powered */
 };
 
-static struct usb_config_descriptor
-loopback_config = {
+static struct usb_config_descriptor loopback_config = {
         .bLength =              sizeof loopback_config,
         .bDescriptorType =      USB_DT_CONFIG,
 
@@ -218,8 +213,7 @@ loopback_config = {
         .bMaxPower =            1,      /* self-powered */
 };
 
-static struct usb_otg_descriptor
-otg_descriptor = {
+static struct usb_otg_descriptor otg_descriptor = {
         .bLength =              sizeof otg_descriptor,
         .bDescriptorType =      USB_DT_OTG,
 
@@ -228,8 +222,7 @@ otg_descriptor = {
 
 /* one interface in each configuration */
 
-static const struct usb_interface_descriptor
-source_sink_intf = {
+static const struct usb_interface_descriptor source_sink_intf = {
         .bLength =              sizeof source_sink_intf,
         .bDescriptorType =      USB_DT_INTERFACE,
 
@@ -238,8 +231,7 @@ source_sink_intf = {
         .iInterface =           STRING_SOURCE_SINK,
 };
 
-static const struct usb_interface_descriptor
-loopback_intf = {
+static const struct usb_interface_descriptor loopback_intf = {
         .bLength =              sizeof loopback_intf,
         .bDescriptorType =      USB_DT_INTERFACE,
 
@@ -250,8 +242,7 @@ loopback_intf = {
 
 /* two full speed bulk endpoints; their use is config-dependent */
 
-static struct usb_endpoint_descriptor
-fs_source_desc = {
+static struct usb_endpoint_descriptor fs_source_desc = {
         .bLength =              USB_DT_ENDPOINT_SIZE,
         .bDescriptorType =      USB_DT_ENDPOINT,
 
@@ -259,8 +250,7 @@ fs_source_desc = {
         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
 };
 
-static struct usb_endpoint_descriptor
-fs_sink_desc = {
+static struct usb_endpoint_descriptor fs_sink_desc = {
         .bLength =              USB_DT_ENDPOINT_SIZE,
         .bDescriptorType =      USB_DT_ENDPOINT,
 
@@ -268,7 +258,7 @@ fs_sink_desc = {
         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
 };
 
-static const struct usb_descriptor_header *fs_source_sink_function [] = {
+static const struct usb_descriptor_header *fs_source_sink_function[] = {
         (struct usb_descriptor_header *) &otg_descriptor,
         (struct usb_descriptor_header *) &source_sink_intf,
         (struct usb_descriptor_header *) &fs_sink_desc,
@@ -276,7 +266,7 @@ static const struct usb_descriptor_header *fs_source_sink_function [] = {
         NULL,
 };
 
-static const struct usb_descriptor_header *fs_loopback_function [] = {
+static const struct usb_descriptor_header *fs_loopback_function[] = {
         (struct usb_descriptor_header *) &otg_descriptor,
         (struct usb_descriptor_header *) &loopback_intf,
         (struct usb_descriptor_header *) &fs_sink_desc,
@@ -293,36 +283,33 @@ static const struct usb_descriptor_header *fs_loopback_function [] = {
  * for the config descriptor.
  */
 
-static struct usb_endpoint_descriptor
-hs_source_desc = {
+static struct usb_endpoint_descriptor hs_source_desc = {
         .bLength =              USB_DT_ENDPOINT_SIZE,
         .bDescriptorType =      USB_DT_ENDPOINT,
 
         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-        .wMaxPacketSize =       __constant_cpu_to_le16 (512),
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
 };
 
-static struct usb_endpoint_descriptor
-hs_sink_desc = {
+static struct usb_endpoint_descriptor hs_sink_desc = {
         .bLength =              USB_DT_ENDPOINT_SIZE,
         .bDescriptorType =      USB_DT_ENDPOINT,
 
         .bmAttributes =         USB_ENDPOINT_XFER_BULK,
-        .wMaxPacketSize =       __constant_cpu_to_le16 (512),
+        .wMaxPacketSize =       __constant_cpu_to_le16(512),
 };
 
-static struct usb_qualifier_descriptor
-dev_qualifier = {
+static struct usb_qualifier_descriptor dev_qualifier = {
         .bLength =              sizeof dev_qualifier,
         .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
 
-        .bcdUSB =               __constant_cpu_to_le16 (0x0200),
+        .bcdUSB =               __constant_cpu_to_le16(0x0200),
         .bDeviceClass =         USB_CLASS_VENDOR_SPEC,
 
         .bNumConfigurations =   2,
 };
 
-static const struct usb_descriptor_header *hs_source_sink_function [] = {
+static const struct usb_descriptor_header *hs_source_sink_function[] = {
         (struct usb_descriptor_header *) &otg_descriptor,
         (struct usb_descriptor_header *) &source_sink_intf,
         (struct usb_descriptor_header *) &hs_source_desc,
@@ -330,7 +317,7 @@ static const struct usb_descriptor_header *hs_source_sink_function [] = {
         NULL,
 };
 
-static const struct usb_descriptor_header *hs_loopback_function [] = {
+static const struct usb_descriptor_header *hs_loopback_function[] = {
         (struct usb_descriptor_header *) &otg_descriptor,
         (struct usb_descriptor_header *) &loopback_intf,
         (struct usb_descriptor_header *) &hs_source_desc,
@@ -355,7 +342,7 @@ static char serial[] = "0123456789.0123456789.0123456789";
 
 
 /* static strings, in UTF-8 */
-static struct usb_string                strings [] = {
+static struct usb_string strings[] = {
         { STRING_MANUFACTURER, manufacturer, },
         { STRING_PRODUCT, longname, },
         { STRING_SERIAL, serial, },
@@ -364,7 +351,7 @@ static struct usb_string		strings [] = {
         {  }                    /* end of list */
 };
 
-static struct usb_gadget_strings        stringtab = {
+static struct usb_gadget_strings stringtab = {
         .language       = 0x0409,       /* en-us */
         .strings        = strings,
 };
@@ -387,8 +374,7 @@ static struct usb_gadget_strings	stringtab = {
  * high bandwidth modes at high speed.  (Maybe work like Intel's test
  * device?)
  */
-static int
-config_buf (struct usb_gadget *gadget,
+static int config_buf(struct usb_gadget *gadget,
                 u8 *buf, u8 type, unsigned index)
 {
         int                             is_source_sink;
@@ -419,7 +405,7 @@ config_buf (struct usb_gadget *gadget,
         if (!gadget_is_otg(gadget))
                 function++;
 
-        len = usb_gadget_config_buf (is_source_sink
+        len = usb_gadget_config_buf(is_source_sink
                                         ? &source_sink_config
                                         : &loopback_config,
                         buf, USB_BUFSIZ, function);
@@ -431,27 +417,26 @@ config_buf (struct usb_gadget *gadget,
 
 /*-------------------------------------------------------------------------*/
 
-static struct usb_request *
-alloc_ep_req (struct usb_ep *ep, unsigned length)
+static struct usb_request *alloc_ep_req(struct usb_ep *ep, unsigned length)
 {
         struct usb_request      *req;
 
-        req = usb_ep_alloc_request (ep, GFP_ATOMIC);
+        req = usb_ep_alloc_request(ep, GFP_ATOMIC);
         if (req) {
                 req->length = length;
                 req->buf = kmalloc(length, GFP_ATOMIC);
                 if (!req->buf) {
-                        usb_ep_free_request (ep, req);
+                        usb_ep_free_request(ep, req);
                         req = NULL;
                 }
         }
         return req;
 }
 
-static void free_ep_req (struct usb_ep *ep, struct usb_request *req)
+static void free_ep_req(struct usb_ep *ep, struct usb_request *req)
 {
         kfree(req->buf);
-        usb_ep_free_request (ep, req);
+        usb_ep_free_request(ep, req);
 }
 
 /*-------------------------------------------------------------------------*/
@@ -472,7 +457,7 @@ static void free_ep_req (struct usb_ep *ep, struct usb_request *req)
 /* optionally require specific source/sink data patterns  */
 
 static int
-check_read_data (
+check_read_data(
         struct zero_dev         *dev,
         struct usb_ep           *ep,
         struct usb_request      *req
@@ -498,8 +483,8 @@ check_read_data (
                                 continue;
                         break;
                 }
-                ERROR (dev, "bad OUT byte, buf [%d] = %d\n", i, *buf);
-                usb_ep_set_halt (ep);
+                ERROR(dev, "bad OUT byte, buf[%d] = %d\n", i, *buf);
+                usb_ep_set_halt(ep);
                 return -EINVAL;
         }
         return 0;
@@ -512,7 +497,7 @@ static void reinit_write_data(struct usb_ep *ep, struct usb_request *req)
 
         switch (pattern) {
         case 0:
-                memset (req->buf, 0, req->length);
+                memset(req->buf, 0, req->length);
                 break;
         case 1:
                 for  (i = 0; i < req->length; i++)
@@ -525,7 +510,7 @@ static void reinit_write_data(struct usb_ep *ep, struct usb_request *req)
  * irq delay between end of one request and start of the next.
  * that prevents using hardware dma queues.
  */
-static void source_sink_complete (struct usb_ep *ep, struct usb_request *req)
+static void source_sink_complete(struct usb_ep *ep, struct usb_request *req)
 {
         struct zero_dev *dev = ep->driver_data;
         int             status = req->status;
@@ -534,8 +519,8 @@ static void source_sink_complete (struct usb_ep *ep, struct usb_request *req)
 
         case 0:                         /* normal completion? */
                 if (ep == dev->out_ep) {
-                        check_read_data (dev, ep, req);
-                        memset (req->buf, 0x55, req->length);
+                        check_read_data(dev, ep, req);
+                        memset(req->buf, 0x55, req->length);
                 } else
                         reinit_write_data(ep, req);
                 break;
@@ -544,11 +529,11 @@ static void source_sink_complete (struct usb_ep *ep, struct usb_request *req)
         case -ECONNABORTED:             /* hardware forced ep reset */
         case -ECONNRESET:               /* request dequeued */
         case -ESHUTDOWN:                /* disconnect from host */
-                VDBG (dev, "%s gone (%d), %d/%d\n", ep->name, status,
+                VDBG(dev, "%s gone (%d), %d/%d\n", ep->name, status,
                                 req->actual, req->length);
                 if (ep == dev->out_ep)
-                        check_read_data (dev, ep, req);
-                free_ep_req (ep, req);
+                        check_read_data(dev, ep, req);
+                free_ep_req(ep, req);
                 return;
 
         case -EOVERFLOW:                /* buffer overrun on read means that
@@ -557,18 +542,18 @@ static void source_sink_complete (struct usb_ep *ep, struct usb_request *req)
                                          */
         default:
 #if 1
-                DBG (dev, "%s complete --> %d, %d/%d\n", ep->name,
+                DBG(dev, "%s complete --> %d, %d/%d\n", ep->name,
                                 status, req->actual, req->length);
 #endif
         case -EREMOTEIO:                /* short read */
                 break;
         }
 
-        status = usb_ep_queue (ep, req, GFP_ATOMIC);
+        status = usb_ep_queue(ep, req, GFP_ATOMIC);
         if (status) {
-                ERROR (dev, "kill %s:  resubmit %d bytes --> %d\n",
+                ERROR(dev, "kill %s:  resubmit %d bytes --> %d\n",
                                 ep->name, req->length, status);
-                usb_ep_set_halt (ep);
+                usb_ep_set_halt(ep);
                 /* FIXME recover later ... somehow */
         }
 }
@@ -578,24 +563,24 @@ static struct usb_request *source_sink_start_ep(struct usb_ep *ep)
         struct usb_request      *req;
         int                     status;
 
-        req = alloc_ep_req (ep, buflen);
+        req = alloc_ep_req(ep, buflen);
         if (!req)
                 return NULL;
 
-        memset (req->buf, 0, req->length);
+        memset(req->buf, 0, req->length);
         req->complete = source_sink_complete;
 
-        if (strcmp (ep->name, EP_IN_NAME) == 0)
+        if (strcmp(ep->name, EP_IN_NAME) == 0)
                 reinit_write_data(ep, req);
         else
-                memset (req->buf, 0x55, req->length);
+                memset(req->buf, 0x55, req->length);
 
         status = usb_ep_queue(ep, req, GFP_ATOMIC);
         if (status) {
                 struct zero_dev *dev = ep->driver_data;
 
-                ERROR (dev, "start %s --> %d\n", ep->name, status);
-                free_ep_req (ep, req);
+                ERROR(dev, "start %s --> %d\n", ep->name, status);
+                free_ep_req(ep, req);
                 req = NULL;
         }
 
@@ -608,34 +593,34 @@ static int set_source_sink_config(struct zero_dev *dev)
         struct usb_ep           *ep;
         struct usb_gadget       *gadget = dev->gadget;
 
-        gadget_for_each_ep (ep, gadget) {
+        gadget_for_each_ep(ep, gadget) {
                 const struct usb_endpoint_descriptor    *d;
 
                 /* one endpoint writes (sources) zeroes in (to the host) */
-                if (strcmp (ep->name, EP_IN_NAME) == 0) {
-                        d = ep_desc (gadget, &hs_source_desc, &fs_source_desc);
-                        result = usb_ep_enable (ep, d);
+                if (strcmp(ep->name, EP_IN_NAME) == 0) {
+                        d = ep_desc(gadget, &hs_source_desc, &fs_source_desc);
+                        result = usb_ep_enable(ep, d);
                         if (result == 0) {
                                 ep->driver_data = dev;
                                 if (source_sink_start_ep(ep) != NULL) {
                                         dev->in_ep = ep;
                                         continue;
                                 }
-                                usb_ep_disable (ep);
+                                usb_ep_disable(ep);
                                 result = -EIO;
                         }
 
                 /* one endpoint reads (sinks) anything out (from the host) */
-                } else if (strcmp (ep->name, EP_OUT_NAME) == 0) {
-                        d = ep_desc (gadget, &hs_sink_desc, &fs_sink_desc);
-                        result = usb_ep_enable (ep, d);
+                } else if (strcmp(ep->name, EP_OUT_NAME) == 0) {
+                        d = ep_desc(gadget, &hs_sink_desc, &fs_sink_desc);
+                        result = usb_ep_enable(ep, d);
                         if (result == 0) {
                                 ep->driver_data = dev;
                                 if (source_sink_start_ep(ep) != NULL) {
                                         dev->out_ep = ep;
                                         continue;
                                 }
-                                usb_ep_disable (ep);
+                                usb_ep_disable(ep);
                                 result = -EIO;
                         }
 
@@ -644,11 +629,11 @@ static int set_source_sink_config(struct zero_dev *dev)
                         continue;
 
                 /* stop on error */
-                ERROR (dev, "can't start %s, result %d\n", ep->name, result);
+                ERROR(dev, "can't start %s, result %d\n", ep->name, result);
                 break;
         }
         if (result == 0)
-                DBG (dev, "buflen %d\n", buflen);
+                DBG(dev, "buflen %d\n", buflen);
 
         /* caller is responsible for cleanup on error */
         return result;
@@ -656,7 +641,7 @@ static int set_source_sink_config(struct zero_dev *dev)
 
 /*-------------------------------------------------------------------------*/
 
-static void loopback_complete (struct usb_ep *ep, struct usb_request *req)
+static void loopback_complete(struct usb_ep *ep, struct usb_request *req)
 {
         struct zero_dev *dev = ep->driver_data;
         int             status = req->status;
@@ -668,19 +653,19 @@ static void loopback_complete (struct usb_ep *ep, struct usb_request *req)
                         /* loop this OUT packet back IN to the host */
                         req->zero = (req->actual < req->length);
                         req->length = req->actual;
-                        status = usb_ep_queue (dev->in_ep, req, GFP_ATOMIC);
+                        status = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
                         if (status == 0)
                                 return;
 
                         /* "should never get here" */
-                        ERROR (dev, "can't loop %s to %s: %d\n",
+                        ERROR(dev, "can't loop %s to %s: %d\n",
                                 ep->name, dev->in_ep->name,
                                 status);
                 }
 
                 /* queue the buffer for some later OUT packet */
                 req->length = buflen;
-                status = usb_ep_queue (dev->out_ep, req, GFP_ATOMIC);
+                status = usb_ep_queue(dev->out_ep, req, GFP_ATOMIC);
                 if (status == 0)
                         return;
 
@@ -688,7 +673,7 @@ static void loopback_complete (struct usb_ep *ep, struct usb_request *req)
                 /* FALLTHROUGH */
 
         default:
-                ERROR (dev, "%s loop complete --> %d, %d/%d\n", ep->name,
+                ERROR(dev, "%s loop complete --> %d, %d/%d\n", ep->name,
                                 status, req->actual, req->length);
                 /* FALLTHROUGH */
 
@@ -700,7 +685,7 @@ static void loopback_complete (struct usb_ep *ep, struct usb_request *req)
         case -ECONNABORTED:             /* hardware forced ep reset */
         case -ECONNRESET:               /* request dequeued */
         case -ESHUTDOWN:                /* disconnect from host */
-                free_ep_req (ep, req);
+                free_ep_req(ep, req);
                 return;
         }
 }
@@ -711,13 +696,13 @@ static int set_loopback_config(struct zero_dev *dev)
         struct usb_ep           *ep;
         struct usb_gadget       *gadget = dev->gadget;
 
-        gadget_for_each_ep (ep, gadget) {
+        gadget_for_each_ep(ep, gadget) {
                 const struct usb_endpoint_descriptor    *d;
 
                 /* one endpoint writes data back IN to the host */
-                if (strcmp (ep->name, EP_IN_NAME) == 0) {
-                        d = ep_desc (gadget, &hs_source_desc, &fs_source_desc);
-                        result = usb_ep_enable (ep, d);
+                if (strcmp(ep->name, EP_IN_NAME) == 0) {
+                        d = ep_desc(gadget, &hs_source_desc, &fs_source_desc);
+                        result = usb_ep_enable(ep, d);
                         if (result == 0) {
                                 ep->driver_data = dev;
                                 dev->in_ep = ep;
@@ -725,9 +710,9 @@ static int set_loopback_config(struct zero_dev *dev)
                         }
 
                 /* one endpoint just reads OUT packets */
-                } else if (strcmp (ep->name, EP_OUT_NAME) == 0) {
-                        d = ep_desc (gadget, &hs_sink_desc, &fs_sink_desc);
-                        result = usb_ep_enable (ep, d);
+                } else if (strcmp(ep->name, EP_OUT_NAME) == 0) {
+                        d = ep_desc(gadget, &hs_sink_desc, &fs_sink_desc);
+                        result = usb_ep_enable(ep, d);
                         if (result == 0) {
                                 ep->driver_data = dev;
                                 dev->out_ep = ep;
@@ -739,7 +724,7 @@ static int set_loopback_config(struct zero_dev *dev)
                         continue;
 
                 /* stop on error */
-                ERROR (dev, "can't enable %s, result %d\n", ep->name, result);
+                ERROR(dev, "can't enable %s, result %d\n", ep->name, result);
                 break;
         }
 
@@ -753,19 +738,19 @@ static int set_loopback_config(struct zero_dev *dev)
 
                 ep = dev->out_ep;
                 for (i = 0; i < qlen && result == 0; i++) {
-                        req = alloc_ep_req (ep, buflen);
+                        req = alloc_ep_req(ep, buflen);
                         if (req) {
                                 req->complete = loopback_complete;
-                                result = usb_ep_queue (ep, req, GFP_ATOMIC);
+                                result = usb_ep_queue(ep, req, GFP_ATOMIC);
                                 if (result)
-                                        DBG (dev, "%s queue req --> %d\n",
+                                        DBG(dev, "%s queue req --> %d\n",
                                                         ep->name, result);
                         } else
                                 result = -ENOMEM;
                 }
         }
         if (result == 0)
-                DBG (dev, "qlen %d, buflen %d\n", qlen, buflen);
+                DBG(dev, "qlen %d, buflen %d\n", qlen, buflen);
 
         /* caller is responsible for cleanup on error */
         return result;
@@ -773,26 +758,26 @@ static int set_loopback_config(struct zero_dev *dev)
 
 /*-------------------------------------------------------------------------*/
 
-static void zero_reset_config (struct zero_dev *dev)
+static void zero_reset_config(struct zero_dev *dev)
 {
         if (dev->config == 0)
                 return;
 
-        DBG (dev, "reset config\n");
+        DBG(dev, "reset config\n");
 
         /* just disable endpoints, forcing completion of pending i/o.
          * all our completion handlers free their requests in this case.
          */
         if (dev->in_ep) {
-                usb_ep_disable (dev->in_ep);
+                usb_ep_disable(dev->in_ep);
                 dev->in_ep = NULL;
         }
         if (dev->out_ep) {
-                usb_ep_disable (dev->out_ep);
+                usb_ep_disable(dev->out_ep);
                 dev->out_ep = NULL;
         }
         dev->config = 0;
-        del_timer (&dev->resume);
+        del_timer(&dev->resume);
 }
 
 /* change our operational config.  this code must agree with the code
@@ -813,12 +798,12 @@ static int zero_set_config(struct zero_dev *dev, unsigned number)
         if (number == dev->config)
                 return 0;
 
-        if (gadget_is_sa1100 (gadget) && dev->config) {
+        if (gadget_is_sa1100(gadget) && dev->config) {
                 /* tx fifo is full, but we can't clear it...*/
                 ERROR(dev, "can't change configurations\n");
                 return -ESPIPE;
         }
-        zero_reset_config (dev);
+        zero_reset_config(dev);
 
         switch (number) {
         case CONFIG_SOURCE_SINK:
@@ -837,7 +822,7 @@ static int zero_set_config(struct zero_dev *dev, unsigned number)
         if (!result && (!dev->in_ep || !dev->out_ep))
                 result = -ENODEV;
         if (result)
-                zero_reset_config (dev);
+                zero_reset_config(dev);
         else {
                 char *speed;
 
@@ -849,7 +834,7 @@ static int zero_set_config(struct zero_dev *dev, unsigned number)
                 }
 
                 dev->config = number;
-                INFO (dev, "%s speed config #%d: %s\n", speed, number,
+                INFO(dev, "%s speed config #%d: %s\n", speed, number,
                                 (number == CONFIG_SOURCE_SINK)
                                         ? source_sink : loopback);
         }
@@ -858,10 +843,10 @@ static int zero_set_config(struct zero_dev *dev, unsigned number)
 
 /*-------------------------------------------------------------------------*/
 
-static void zero_setup_complete (struct usb_ep *ep, struct usb_request *req)
+static void zero_setup_complete(struct usb_ep *ep, struct usb_request *req)
 {
         if (req->status || req->actual != req->length)
-                DBG ((struct zero_dev *) ep->driver_data,
+                DBG((struct zero_dev *) ep->driver_data,
                                 "setup complete --> %d, %d/%d\n",
                                 req->status, req->actual, req->length);
 }
@@ -874,9 +859,9 @@ static void zero_setup_complete (struct usb_ep *ep, struct usb_request *req)
  * the work is in config-specific setup.
  */
 static int
-zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+zero_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 {
-        struct zero_dev         *dev = get_gadget_data (gadget);
+        struct zero_dev         *dev = get_gadget_data(gadget);
         struct usb_request      *req = dev->req;
         int                     value = -EOPNOTSUPP;
         u16                     w_index = le16_to_cpu(ctrl->wIndex);
@@ -895,14 +880,14 @@ zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                 switch (w_value >> 8) {
 
                 case USB_DT_DEVICE:
-                        value = min (w_length, (u16) sizeof device_desc);
-                        memcpy (req->buf, &device_desc, value);
+                        value = min(w_length, (u16) sizeof device_desc);
+                        memcpy(req->buf, &device_desc, value);
                         break;
                 case USB_DT_DEVICE_QUALIFIER:
                         if (!gadget_is_dualspeed(gadget))
                                 break;
-                        value = min (w_length, (u16) sizeof dev_qualifier);
-                        memcpy (req->buf, &dev_qualifier, value);
+                        value = min(w_length, (u16) sizeof dev_qualifier);
+                        memcpy(req->buf, &dev_qualifier, value);
                         break;
 
                 case USB_DT_OTHER_SPEED_CONFIG:
@@ -910,11 +895,11 @@ zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                                 break;
                         // FALLTHROUGH
                 case USB_DT_CONFIG:
-                        value = config_buf (gadget, req->buf,
+                        value = config_buf(gadget, req->buf,
                                         w_value >> 8,
                                         w_value & 0xff);
                         if (value >= 0)
-                                value = min (w_length, (u16) value);
+                                value = min(w_length, (u16) value);
                         break;
 
                 case USB_DT_STRING:
@@ -923,10 +908,10 @@ zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                          * add string tables for other languages, using
                          * any UTF-8 characters
                          */
-                        value = usb_gadget_get_string (&stringtab,
+                        value = usb_gadget_get_string(&stringtab,
                                         w_value & 0xff, req->buf);
                         if (value >= 0)
-                                value = min (w_length, (u16) value);
+                                value = min(w_length, (u16) value);
                         break;
                 }
                 break;
@@ -936,20 +921,20 @@ zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                 if (ctrl->bRequestType != 0)
                         goto unknown;
                 if (gadget->a_hnp_support)
-                        DBG (dev, "HNP available\n");
+                        DBG(dev, "HNP available\n");
                 else if (gadget->a_alt_hnp_support)
-                        DBG (dev, "HNP needs a different root port\n");
+                        DBG(dev, "HNP needs a different root port\n");
                 else
-                        VDBG (dev, "HNP inactive\n");
-                spin_lock (&dev->lock);
+                        VDBG(dev, "HNP inactive\n");
+                spin_lock(&dev->lock);
                 value = zero_set_config(dev, w_value);
-                spin_unlock (&dev->lock);
+                spin_unlock(&dev->lock);
                 break;
         case USB_REQ_GET_CONFIGURATION:
                 if (ctrl->bRequestType != USB_DIR_IN)
                         goto unknown;
                 *(u8 *)req->buf = dev->config;
-                value = min (w_length, (u16) 1);
+                value = min(w_length, (u16) 1);
                 break;
 
         /* until we add altsetting support, or other interfaces,
@@ -959,7 +944,7 @@ zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
         case USB_REQ_SET_INTERFACE:
                 if (ctrl->bRequestType != USB_RECIP_INTERFACE)
                         goto unknown;
-                spin_lock (&dev->lock);
+                spin_lock(&dev->lock);
                 if (dev->config && w_index == 0 && w_value == 0) {
                         u8              config = dev->config;
 
@@ -970,11 +955,11 @@ zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                          * if we had more than one interface we couldn't
                          * use this "reset the config" shortcut.
                          */
-                        zero_reset_config (dev);
+                        zero_reset_config(dev);
                         zero_set_config(dev, config);
                         value = 0;
                 }
-                spin_unlock (&dev->lock);
+                spin_unlock(&dev->lock);
                 break;
         case USB_REQ_GET_INTERFACE:
                 if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
@@ -986,7 +971,7 @@ zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
                         break;
                 }
                 *(u8 *)req->buf = 0;
-                value = min (w_length, (u16) 1);
+                value = min(w_length, (u16) 1);
                 break;
 
         /*
@@ -1018,7 +1003,7 @@ zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 
         default:
 unknown:
-                VDBG (dev,
+                VDBG(dev,
                         "unknown control req%02x.%02x v%04x i%04x l%d\n",
                         ctrl->bRequestType, ctrl->bRequest,
                         w_value, w_index, w_length);
@@ -1028,11 +1013,11 @@ unknown:
         if (value >= 0) {
                 req->length = value;
                 req->zero = value < w_length;
-                value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
+                value = usb_ep_queue(gadget->ep0, req, GFP_ATOMIC);
                 if (value < 0) {
-                        DBG (dev, "ep_queue --> %d\n", value);
+                        DBG(dev, "ep_queue --> %d\n", value);
                         req->status = 0;
-                        zero_setup_complete (gadget->ep0, req);
+                        zero_setup_complete(gadget->ep0, req);
                 }
         }
 
@@ -1040,28 +1025,26 @@ unknown:
         return value;
 }
 
-static void
-zero_disconnect (struct usb_gadget *gadget)
+static void zero_disconnect(struct usb_gadget *gadget)
 {
-        struct zero_dev         *dev = get_gadget_data (gadget);
+        struct zero_dev         *dev = get_gadget_data(gadget);
         unsigned long           flags;
 
-        spin_lock_irqsave (&dev->lock, flags);
-        zero_reset_config (dev);
+        spin_lock_irqsave(&dev->lock, flags);
+        zero_reset_config(dev);
 
         /* a more significant application might have some non-usb
          * activities to quiesce here, saving resources like power
          * or pushing the notification up a network stack.
          */
-        spin_unlock_irqrestore (&dev->lock, flags);
+        spin_unlock_irqrestore(&dev->lock, flags);
 
         /* next we may get setup() calls to enumerate new connections;
          * or an unbind() during shutdown (including removing module).
          */
 }
 
-static void
-zero_autoresume (unsigned long _dev)
+static void zero_autoresume(unsigned long _dev)
 {
         struct zero_dev *dev = (struct zero_dev *) _dev;
         int             status;
@@ -1070,32 +1053,30 @@ zero_autoresume (unsigned long _dev)
          * more significant than just a timer firing...
          */
         if (dev->gadget->speed != USB_SPEED_UNKNOWN) {
-                status = usb_gadget_wakeup (dev->gadget);
-                DBG (dev, "wakeup --> %d\n", status);
+                status = usb_gadget_wakeup(dev->gadget);
+                DBG(dev, "wakeup --> %d\n", status);
         }
 }
 
 /*-------------------------------------------------------------------------*/
 
-static void /* __init_or_exit */
-zero_unbind (struct usb_gadget *gadget)
+static void zero_unbind(struct usb_gadget *gadget)
 {
-        struct zero_dev         *dev = get_gadget_data (gadget);
+        struct zero_dev         *dev = get_gadget_data(gadget);
 
-        DBG (dev, "unbind\n");
+        DBG(dev, "unbind\n");
 
         /* we've already been disconnected ... no i/o is active */
         if (dev->req) {
                 dev->req->length = USB_BUFSIZ;
-                free_ep_req (gadget->ep0, dev->req);
+                free_ep_req(gadget->ep0, dev->req);
         }
-        del_timer_sync (&dev->resume);
-        kfree (dev);
-        set_gadget_data (gadget, NULL);
+        del_timer_sync(&dev->resume);
+        kfree(dev);
+        set_gadget_data(gadget, NULL);
 }
 
-static int __init
-zero_bind (struct usb_gadget *gadget)
+static int __init zero_bind(struct usb_gadget *gadget)
 {
         struct zero_dev         *dev;
         struct usb_ep           *ep;
@@ -1111,8 +1092,8 @@ zero_bind (struct usb_gadget *gadget)
          * autoconfigure on any sane usb controller driver,
          * but there may also be important quirks to address.
          */
-        usb_ep_autoconfig_reset (gadget);
-        ep = usb_ep_autoconfig (gadget, &fs_source_desc);
+        usb_ep_autoconfig_reset(gadget);
+        ep = usb_ep_autoconfig(gadget, &fs_source_desc);
         if (!ep) {
 autoconf_fail:
                 pr_err("%s: can't autoconfigure on %s\n",
@@ -1122,15 +1103,15 @@ autoconf_fail:
         EP_IN_NAME = ep->name;
         ep->driver_data = ep;   /* claim */
 
-        ep = usb_ep_autoconfig (gadget, &fs_sink_desc);
+        ep = usb_ep_autoconfig(gadget, &fs_sink_desc);
         if (!ep)
                 goto autoconf_fail;
         EP_OUT_NAME = ep->name;
         ep->driver_data = ep;   /* claim */
 
-        gcnum = usb_gadget_controller_number (gadget);
+        gcnum = usb_gadget_controller_number(gadget);
         if (gcnum >= 0)
-                device_desc.bcdDevice = cpu_to_le16 (0x0200 + gcnum);
+                device_desc.bcdDevice = cpu_to_le16(0x0200 + gcnum);
         else {
                 /* gadget zero is so simple (for now, no altsettings) that
                  * it SHOULD NOT have problems with bulk-capable hardware.
@@ -1141,7 +1122,7 @@ autoconf_fail:
                  */
                 pr_warning("%s: controller '%s' not recognized\n",
                         shortname, gadget->name);
-                device_desc.bcdDevice = __constant_cpu_to_le16 (0x9999);
+                device_desc.bcdDevice = __constant_cpu_to_le16(0x9999);
         }
 
 
@@ -1149,12 +1130,16 @@ autoconf_fail:
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         if (!dev)
                 return -ENOMEM;
-        spin_lock_init (&dev->lock);
+        spin_lock_init(&dev->lock);
         dev->gadget = gadget;
-        set_gadget_data (gadget, dev);
+        set_gadget_data(gadget, dev);
+
+        init_timer(&dev->resume);
+        dev->resume.function = zero_autoresume;
+        dev->resume.data = (unsigned long) dev;
 
         /* preallocate control response and buffer */
-        dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
+        dev->req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL);
         if (!dev->req)
                 goto enomem;
         dev->req->buf = kmalloc(USB_BUFSIZ, GFP_KERNEL);
@@ -1182,11 +1167,8 @@ autoconf_fail:
                 loopback_config.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
         }
 
-        usb_gadget_set_selfpowered (gadget);
+        usb_gadget_set_selfpowered(gadget);
 
-        init_timer (&dev->resume);
-        dev->resume.function = zero_autoresume;
-        dev->resume.data = (unsigned long) dev;
         if (autoresume) {
                 source_sink_config.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
                 loopback_config.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
@@ -1194,45 +1176,43 @@ autoconf_fail:
 
         gadget->ep0->driver_data = dev;
 
-        INFO (dev, "%s, version: " DRIVER_VERSION "\n", longname);
-        INFO (dev, "using %s, OUT %s IN %s\n", gadget->name,
+        INFO(dev, "%s, version: " DRIVER_VERSION "\n", longname);
+        INFO(dev, "using %s, OUT %s IN %s\n", gadget->name,
                 EP_OUT_NAME, EP_IN_NAME);
 
-        snprintf (manufacturer, sizeof manufacturer, "%s %s with %s",
+        snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
                 init_utsname()->sysname, init_utsname()->release,
                 gadget->name);
 
         return 0;
 
 enomem:
-        zero_unbind (gadget);
+        zero_unbind(gadget);
         return -ENOMEM;
 }
 
 /*-------------------------------------------------------------------------*/
 
-static void
-zero_suspend (struct usb_gadget *gadget)
+static void zero_suspend(struct usb_gadget *gadget)
 {
-        struct zero_dev         *dev = get_gadget_data (gadget);
+        struct zero_dev         *dev = get_gadget_data(gadget);
 
         if (gadget->speed == USB_SPEED_UNKNOWN)
                 return;
 
         if (autoresume) {
-                mod_timer (&dev->resume, jiffies + (HZ * autoresume));
-                DBG (dev, "suspend, wakeup in %d seconds\n", autoresume);
+                mod_timer(&dev->resume, jiffies + (HZ * autoresume));
+                DBG(dev, "suspend, wakeup in %d seconds\n", autoresume);
         } else
-                DBG (dev, "suspend\n");
+                DBG(dev, "suspend\n");
 }
 
-static void
-zero_resume (struct usb_gadget *gadget)
+static void zero_resume(struct usb_gadget *gadget)
 {
-        struct zero_dev         *dev = get_gadget_data (gadget);
+        struct zero_dev         *dev = get_gadget_data(gadget);
 
-        DBG (dev, "resume\n");
-        del_timer (&dev->resume);
+        DBG(dev, "resume\n");
+        del_timer(&dev->resume);
 }
 
 
@@ -1264,15 +1244,15 @@ MODULE_AUTHOR("David Brownell");
 MODULE_LICENSE("GPL");
 
 
-static int __init init (void)
+static int __init init(void)
 {
-        return usb_gadget_register_driver (&zero_driver);
+        return usb_gadget_register_driver(&zero_driver);
 }
-module_init (init);
+module_init(init);
 
-static void __exit cleanup (void)
+static void __exit cleanup(void)
 {
-        usb_gadget_unregister_driver (&zero_driver);
+        usb_gadget_unregister_driver(&zero_driver);
 }
-module_exit (cleanup);
+module_exit(cleanup);
 
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 0b87480dd71..1ef6df395e0 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -4,6 +4,19 @@
 comment "USB Host Controller Drivers"
         depends on USB
 
+config USB_C67X00_HCD
+        tristate "Cypress C67x00 HCD support"
+        depends on USB
+        help
+          The Cypress C67x00 (EZ-Host/EZ-OTG) chips are dual-role
+          host/peripheral/OTG USB controllers.
+
+          Enable this option to support this chip in host controller mode.
+          If unsure, say N.
+
+          To compile this driver as a module, choose M here: the
+          module will be called c67x00.
+
 config USB_EHCI_HCD
         tristate "EHCI HCD (USB 2.0) support"
         depends on USB && USB_ARCH_HAS_EHCI
@@ -95,6 +108,32 @@ config USB_ISP116X_HCD
           To compile this driver as a module, choose M here: the
           module will be called isp116x-hcd.
 
+config USB_ISP1760_HCD
+        tristate "ISP 1760 HCD support"
+        depends on USB && EXPERIMENTAL
+        ---help---
+          The ISP1760 chip is a USB 2.0 host controller.
+
+          This driver does not support isochronous transfers or OTG.
+
+          To compile this driver as a module, choose M here: the
+          module will be called isp1760-hcd.
+
+config USB_ISP1760_PCI
+        bool "Support for the PCI bus"
+        depends on USB_ISP1760_HCD && PCI
+        ---help---
+          Enables support for the device present on the PCI bus.
+          This should only be required if you happen to have the eval kit from
+          NXP and you are going to test it.
+
+config USB_ISP1760_OF
+        bool "Support for the OF platform bus"
+        depends on USB_ISP1760_HCD && PPC_OF
+        ---help---
+          Enables support for the device present on the PowerPC
+          OpenFirmware platform bus.
+
 config USB_OHCI_HCD
         tristate "OHCI HCD support"
         depends on USB && USB_ARCH_HAS_OHCI
diff --git a/drivers/usb/host/Makefile b/drivers/usb/host/Makefile
index bb8e9d44f37..f1edda2dcfd 100644
--- a/drivers/usb/host/Makefile
+++ b/drivers/usb/host/Makefile
@@ -6,6 +6,8 @@ ifeq ($(CONFIG_USB_DEBUG),y)
         EXTRA_CFLAGS            += -DDEBUG
 endif
 
+isp1760-objs := isp1760-hcd.o isp1760-if.o
+
 obj-$(CONFIG_PCI)               += pci-quirks.o
 
 obj-$(CONFIG_USB_EHCI_HCD)      += ehci-hcd.o
@@ -16,4 +18,4 @@ obj-$(CONFIG_USB_SL811_HCD)	+= sl811-hcd.o
 obj-$(CONFIG_USB_SL811_CS)      += sl811_cs.o
 obj-$(CONFIG_USB_U132_HCD)      += u132-hcd.o
 obj-$(CONFIG_USB_R8A66597_HCD)  += r8a66597-hcd.o
-
+obj-$(CONFIG_USB_ISP1760_HCD)   += isp1760.o
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
new file mode 100644
index 00000000000..4ba96c1e060
--- /dev/null
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -0,0 +1,2231 @@
+/*
+ * Driver for the NXP ISP1760 chip
+ *
+ * However, the code might contain some bugs. What doesn't work for sure is:
+ * - ISO
+ * - OTG
+ e The interrupt line is configured as active low, level.
+ *
+ * (c) 2007 Sebastian Siewior <bigeasy@linutronix.de>
+ *
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/usb.h>
+#include <linux/debugfs.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
+#include <asm/unaligned.h>
+
+#include "../core/hcd.h"
+#include "isp1760-hcd.h"
+
+static struct kmem_cache *qtd_cachep;
+static struct kmem_cache *qh_cachep;
+
+struct isp1760_hcd {
+        u32 hcs_params;
+        spinlock_t              lock;
+        struct inter_packet_info atl_ints[32];
+        struct inter_packet_info int_ints[32];
+        struct memory_chunk memory_pool[BLOCKS];
+
+        /* periodic schedule support */
+#define DEFAULT_I_TDPS          1024
+        unsigned                periodic_size;
+        unsigned                i_thresh;
+        unsigned long           reset_done;
+        unsigned long           next_statechange;
+};
+
+static inline struct isp1760_hcd *hcd_to_priv(struct usb_hcd *hcd)
+{
+        return (struct isp1760_hcd *) (hcd->hcd_priv);
+}
+static inline struct usb_hcd *priv_to_hcd(struct isp1760_hcd *priv)
+{
+        return container_of((void *) priv, struct usb_hcd, hcd_priv);
+}
+
+/* Section 2.2 Host Controller Capability Registers */
+#define HC_LENGTH(p)            (((p)>>00)&0x00ff)      /* bits 7:0 */
+#define HC_VERSION(p)           (((p)>>16)&0xffff)      /* bits 31:16 */
+#define HCS_INDICATOR(p)        ((p)&(1 << 16)) /* true: has port indicators */
+#define HCS_PPC(p)              ((p)&(1 << 4))  /* true: port power control */
+#define HCS_N_PORTS(p)          (((p)>>0)&0xf)  /* bits 3:0, ports on HC */
+#define HCC_ISOC_CACHE(p)       ((p)&(1 << 7))  /* true: can cache isoc frame */
+#define HCC_ISOC_THRES(p)       (((p)>>4)&0x7)  /* bits 6:4, uframes cached */
+
+/* Section 2.3 Host Controller Operational Registers */
+#define CMD_LRESET      (1<<7)          /* partial reset (no ports, etc) */
+#define CMD_RESET       (1<<1)          /* reset HC not bus */
+#define CMD_RUN         (1<<0)          /* start/stop HC */
+#define STS_PCD         (1<<2)          /* port change detect */
+#define FLAG_CF         (1<<0)          /* true: we'll support "high speed" */
+
+#define PORT_OWNER      (1<<13)         /* true: companion hc owns this port */
+#define PORT_POWER      (1<<12)         /* true: has power (see PPC) */
+#define PORT_USB11(x) (((x) & (3 << 10)) == (1 << 10))  /* USB 1.1 device */
+#define PORT_RESET      (1<<8)          /* reset port */
+#define PORT_SUSPEND    (1<<7)          /* suspend port */
+#define PORT_RESUME     (1<<6)          /* resume it */
+#define PORT_PE         (1<<2)          /* port enable */
+#define PORT_CSC        (1<<1)          /* connect status change */
+#define PORT_CONNECT    (1<<0)          /* device connected */
+#define PORT_RWC_BITS   (PORT_CSC)
+
+struct isp1760_qtd {
+        struct isp1760_qtd *hw_next;
+        u8 packet_type;
+        u8 toggle;
+
+        void *data_buffer;
+        /* the rest is HCD-private */
+        struct list_head qtd_list;
+        struct urb *urb;
+        size_t length;
+
+        /* isp special*/
+        u32 status;
+#define URB_COMPLETE_NOTIFY     (1 << 0)
+#define URB_ENQUEUED            (1 << 1)
+#define URB_TYPE_ATL            (1 << 2)
+#define URB_TYPE_INT            (1 << 3)
+};
+
+struct isp1760_qh {
+        /* first part defined by EHCI spec */
+        struct list_head qtd_list;
+        struct isp1760_hcd *priv;
+
+        /* periodic schedule info */
+        unsigned short period;          /* polling interval */
+        struct usb_device *dev;
+
+        u32 toggle;
+        u32 ping;
+};
+
+#define ehci_port_speed(priv, portsc) (1 << USB_PORT_FEAT_HIGHSPEED)
+
+static unsigned int isp1760_readl(__u32 __iomem *regs)
+{
+        return readl(regs);
+}
+
+static void isp1760_writel(const unsigned int val, __u32 __iomem *regs)
+{
+        writel(val, regs);
+}
+
+/*
+ * The next two copy via MMIO data to/from the device. memcpy_{to|from}io()
+ * doesn't quite work because some people have to enforce 32-bit access
+ */
+static void priv_read_copy(struct isp1760_hcd *priv, u32 *src,
+                __u32 __iomem *dst, u32 offset, u32 len)
+{
+        struct usb_hcd *hcd = priv_to_hcd(priv);
+        u32 val;
+        u8 *buff8;
+
+        if (!src) {
+                printk(KERN_ERR "ERROR: buffer: %p len: %d\n", src, len);
+                return;
+        }
+        isp1760_writel(offset,  hcd->regs + HC_MEMORY_REG);
+        /* XXX
+         * 90nsec delay, the spec says something how this could be avoided.
+         */
+        mdelay(1);
+
+        while (len >= 4) {
+                *src = __raw_readl(dst);
+                len -= 4;
+                src++;
+                dst++;
+        }
+
+        if (!len)
+                return;
+
+        /* in case we have 3, 2 or 1 by left. The dst buffer may not be fully
+         * allocated.
+         */
+        val = isp1760_readl(dst);
+
+        buff8 = (u8 *)src;
+        while (len) {
+
+                *buff8 = val;
+                val >>= 8;
+                len--;
+                buff8++;
+        }
+}
+
+static void priv_write_copy(const struct isp1760_hcd *priv, const u32 *src,
+                __u32 __iomem *dst, u32 len)
+{
+        while (len >= 4) {
+                __raw_writel(*src, dst);
+                len -= 4;
+                src++;
+                dst++;
+        }
+
+        if (!len)
+                return;
+        /* in case we have 3, 2 or 1 by left. The buffer is allocated and the
+         * extra bytes should not be read by the HW
+         */
+
+        __raw_writel(*src, dst);
+}
+
+/* memory management of the 60kb on the chip from 0x1000 to 0xffff */
+static void init_memory(struct isp1760_hcd *priv)
+{
+        int i;
+        u32 payload;
+
+        payload = 0x1000;
+        for (i = 0; i < BLOCK_1_NUM; i++) {
+                priv->memory_pool[i].start = payload;
+                priv->memory_pool[i].size = BLOCK_1_SIZE;
+                priv->memory_pool[i].free = 1;
+                payload += priv->memory_pool[i].size;
+        }
+
+
+        for (i = BLOCK_1_NUM; i < BLOCK_1_NUM + BLOCK_2_NUM; i++) {
+                priv->memory_pool[i].start = payload;
+                priv->memory_pool[i].size = BLOCK_2_SIZE;
+                priv->memory_pool[i].free = 1;
+                payload += priv->memory_pool[i].size;
+        }
+
+
+        for (i = BLOCK_1_NUM + BLOCK_2_NUM; i < BLOCKS; i++) {
+                priv->memory_pool[i].start = payload;
+                priv->memory_pool[i].size = BLOCK_3_SIZE;
+                priv->memory_pool[i].free = 1;
+                payload += priv->memory_pool[i].size;
+        }
+
+        BUG_ON(payload - priv->memory_pool[i - 1].size > PAYLOAD_SIZE);
+}
+
+static u32 alloc_mem(struct isp1760_hcd *priv, u32 size)
+{
+        int i;
+
+        if (!size)
+                return ISP1760_NULL_POINTER;
+
+        for (i = 0; i < BLOCKS; i++) {
+                if (priv->memory_pool[i].size >= size &&
+                                priv->memory_pool[i].free) {
+
+                        priv->memory_pool[i].free = 0;
+                        return priv->memory_pool[i].start;
+                }
+        }
+
+        printk(KERN_ERR "ISP1760 MEM: can not allocate %d bytes of memory\n",
+                        size);
+        printk(KERN_ERR "Current memory map:\n");
+        for (i = 0; i < BLOCKS; i++) {
+                printk(KERN_ERR "Pool %2d size %4d status: %d\n",
+                                i, priv->memory_pool[i].size,
+                                priv->memory_pool[i].free);
+        }
+        /* XXX maybe -ENOMEM could be possible */
+        BUG();
+        return 0;
+}
+
+static void free_mem(struct isp1760_hcd *priv, u32 mem)
+{
+        int i;
+
+        if (mem == ISP1760_NULL_POINTER)
+                return;
+
+        for (i = 0; i < BLOCKS; i++) {
+                if (priv->memory_pool[i].start == mem) {
+
+                        BUG_ON(priv->memory_pool[i].free);
+
+                        priv->memory_pool[i].free = 1;
+                        return ;
+                }
+        }
+
+        printk(KERN_ERR "Trying to free not-here-allocated memory :%08x\n",
+                        mem);
+        BUG();
+}
+
+static void isp1760_init_regs(struct usb_hcd *hcd)
+{
+        isp1760_writel(0, hcd->regs + HC_BUFFER_STATUS_REG);
+        isp1760_writel(NO_TRANSFER_ACTIVE, hcd->regs +
+                        HC_ATL_PTD_SKIPMAP_REG);
+        isp1760_writel(NO_TRANSFER_ACTIVE, hcd->regs +
+                        HC_INT_PTD_SKIPMAP_REG);
+        isp1760_writel(NO_TRANSFER_ACTIVE, hcd->regs +
+                        HC_ISO_PTD_SKIPMAP_REG);
+
+        isp1760_writel(~NO_TRANSFER_ACTIVE, hcd->regs +
+                        HC_ATL_PTD_DONEMAP_REG);
+        isp1760_writel(~NO_TRANSFER_ACTIVE, hcd->regs +
+                        HC_INT_PTD_DONEMAP_REG);
+        isp1760_writel(~NO_TRANSFER_ACTIVE, hcd->regs +
+                        HC_ISO_PTD_DONEMAP_REG);
+}
+
+static int handshake(struct isp1760_hcd *priv, void __iomem *ptr,
+                      u32 mask, u32 done, int usec)
+{
+        u32 result;
+
+        do {
+                result = isp1760_readl(ptr);
+                if (result == ~0)
+                        return -ENODEV;
+                result &= mask;
+                if (result == done)
+                        return 0;
+                udelay(1);
+                usec--;
+        } while (usec > 0);
+        return -ETIMEDOUT;
+}
+
+/* reset a non-running (STS_HALT == 1) controller */
+static int ehci_reset(struct isp1760_hcd *priv)
+{
+        int retval;
+        struct usb_hcd *hcd = priv_to_hcd(priv);
+        u32 command = isp1760_readl(hcd->regs + HC_USBCMD);
+
+        command |= CMD_RESET;
+        isp1760_writel(command, hcd->regs + HC_USBCMD);
+        hcd->state = HC_STATE_HALT;
+        priv->next_statechange = jiffies;
+        retval = handshake(priv, hcd->regs + HC_USBCMD,
+                            CMD_RESET, 0, 250 * 1000);
+        return retval;
+}
+
+static void qh_destroy(struct isp1760_qh *qh)
+{
+        BUG_ON(!list_empty(&qh->qtd_list));
+        kmem_cache_free(qh_cachep, qh);
+}
+
+static struct isp1760_qh *isp1760_qh_alloc(struct isp1760_hcd *priv,
+                gfp_t flags)
+{
+        struct isp1760_qh *qh;
+
+        qh = kmem_cache_zalloc(qh_cachep, flags);
+        if (!qh)
+                return qh;
+
+        INIT_LIST_HEAD(&qh->qtd_list);
+        qh->priv = priv;
+        return qh;
+}
+
+/* magic numbers that can affect system performance */
+#define EHCI_TUNE_CERR          3       /* 0-3 qtd retries; 0 == don't stop */
+#define EHCI_TUNE_RL_HS         4       /* nak throttle; see 4.9 */
+#define EHCI_TUNE_RL_TT         0
+#define EHCI_TUNE_MULT_HS       1       /* 1-3 transactions/uframe; 4.10.3 */
+#define EHCI_TUNE_MULT_TT       1
+#define EHCI_TUNE_FLS           2       /* (small) 256 frame schedule */
+
+/* one-time init, only for memory state */
+static int priv_init(struct usb_hcd *hcd)
+{
+        struct isp1760_hcd              *priv = hcd_to_priv(hcd);
+        u32                     hcc_params;
+
+        spin_lock_init(&priv->lock);
+
+        /*
+         * hw default: 1K periodic list heads, one per frame.
+         * periodic_size can shrink by USBCMD update if hcc_params allows.
+         */
+        priv->periodic_size = DEFAULT_I_TDPS;
+
+        /* controllers may cache some of the periodic schedule ... */
+        hcc_params = isp1760_readl(hcd->regs + HC_HCCPARAMS);
+        /* full frame cache */
+        if (HCC_ISOC_CACHE(hcc_params))
+                priv->i_thresh = 8;
+        else /* N microframes cached */
+                priv->i_thresh = 2 + HCC_ISOC_THRES(hcc_params);
+
+        return 0;
+}
+
+static int isp1760_hc_setup(struct usb_hcd *hcd)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(hcd);
+        int result;
+        u32 scratch;
+
+        isp1760_writel(0xdeadbabe, hcd->regs + HC_SCRATCH_REG);
+        scratch = isp1760_readl(hcd->regs + HC_SCRATCH_REG);
+        if (scratch != 0xdeadbabe) {
+                printk(KERN_ERR "ISP1760: Scratch test failed.\n");
+                return -ENODEV;
+        }
+
+        /* pre reset */
+        isp1760_init_regs(hcd);
+
+        /* reset */
+        isp1760_writel(SW_RESET_RESET_ALL, hcd->regs + HC_RESET_REG);
+        mdelay(100);
+
+        isp1760_writel(SW_RESET_RESET_HC, hcd->regs + HC_RESET_REG);
+        mdelay(100);
+
+        result = ehci_reset(priv);
+        if (result)
+                return result;
+
+        /* Step 11 passed */
+
+        isp1760_writel(INTERRUPT_ENABLE_MASK, hcd->regs + HC_INTERRUPT_REG);
+        isp1760_writel(INTERRUPT_ENABLE_MASK, hcd->regs + HC_INTERRUPT_ENABLE);
+
+        /* ATL reset */
+        scratch = isp1760_readl(hcd->regs + HC_HW_MODE_CTRL);
+        isp1760_writel(scratch | ALL_ATX_RESET, hcd->regs + HC_HW_MODE_CTRL);
+        mdelay(10);
+        isp1760_writel(scratch, hcd->regs + HC_HW_MODE_CTRL);
+
+        isp1760_writel(PORT1_POWER | PORT1_INIT2, hcd->regs + HC_PORT1_CTRL);
+        mdelay(10);
+
+        priv->hcs_params = isp1760_readl(hcd->regs + HC_HCSPARAMS);
+
+        return priv_init(hcd);
+}
+
+static void isp1760_init_maps(struct usb_hcd *hcd)
+{
+        /*set last maps, for iso its only 1, else 32 tds bitmap*/
+        isp1760_writel(0x80000000, hcd->regs + HC_ATL_PTD_LASTPTD_REG);
+        isp1760_writel(0x80000000, hcd->regs + HC_INT_PTD_LASTPTD_REG);
+        isp1760_writel(0x00000001, hcd->regs + HC_ISO_PTD_LASTPTD_REG);
+}
+
+static void isp1760_enable_interrupts(struct usb_hcd *hcd)
+{
+        isp1760_writel(0, hcd->regs + HC_ATL_IRQ_MASK_AND_REG);
+        isp1760_writel(0, hcd->regs + HC_ATL_IRQ_MASK_OR_REG);
+        isp1760_writel(0, hcd->regs + HC_INT_IRQ_MASK_AND_REG);
+        isp1760_writel(0, hcd->regs + HC_INT_IRQ_MASK_OR_REG);
+        isp1760_writel(0, hcd->regs + HC_ISO_IRQ_MASK_AND_REG);
+        isp1760_writel(0xffffffff, hcd->regs + HC_ISO_IRQ_MASK_OR_REG);
+        /* step 23 passed */
+}
+
+static int isp1760_run(struct usb_hcd *hcd)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(hcd);
+        int retval;
+        u32 temp;
+        u32 command;
+        u32 chipid;
+
+        hcd->uses_new_polling = 1;
+        hcd->poll_rh = 0;
+
+        hcd->state = HC_STATE_RUNNING;
+        isp1760_enable_interrupts(hcd);
+        temp = isp1760_readl(hcd->regs + HC_HW_MODE_CTRL);
+        temp |= FINAL_HW_CONFIG;
+        isp1760_writel(temp, hcd->regs + HC_HW_MODE_CTRL);
+
+        command = isp1760_readl(hcd->regs + HC_USBCMD);
+        command &= ~(CMD_LRESET|CMD_RESET);
+        command |= CMD_RUN;
+        isp1760_writel(command, hcd->regs + HC_USBCMD);
+
+        retval = handshake(priv, hcd->regs + HC_USBCMD, CMD_RUN, CMD_RUN,
+                        250 * 1000);
+        if (retval)
+                return retval;
+
+        /*
+         * XXX
+         * Spec says to write FLAG_CF as last config action, priv code grabs
+         * the semaphore while doing so.
+         */
+        down_write(&ehci_cf_port_reset_rwsem);
+        isp1760_writel(FLAG_CF, hcd->regs + HC_CONFIGFLAG);
+
+        retval = handshake(priv, hcd->regs + HC_CONFIGFLAG, FLAG_CF, FLAG_CF,
+                        250 * 1000);
+        up_write(&ehci_cf_port_reset_rwsem);
+        if (retval)
+                return retval;
+
+        chipid = isp1760_readl(hcd->regs + HC_CHIP_ID_REG);
+        isp1760_info(priv, "USB ISP %04x HW rev. %d started\n", chipid & 0xffff,
+                        chipid >> 16);
+
+        /* PTD Register Init Part 2, Step 28 */
+        /* enable INTs */
+        isp1760_init_maps(hcd);
+
+        /* GRR this is run-once init(), being done every time the HC starts.
+         * So long as they're part of class devices, we can't do it init()
+         * since the class device isn't created that early.
+         */
+        return 0;
+}
+
+static u32 base_to_chip(u32 base)
+{
+        return ((base - 0x400) >> 3);
+}
+
+static void transform_into_atl(struct isp1760_hcd *priv, struct isp1760_qh *qh,
+                        struct isp1760_qtd *qtd, struct urb *urb,
+                        u32 payload, struct ptd *ptd)
+{
+        u32 dw0;
+        u32 dw1;
+        u32 dw2;
+        u32 dw3;
+        u32 maxpacket;
+        u32 multi;
+        u32 pid_code;
+        u32 rl = RL_COUNTER;
+        u32 nak = NAK_COUNTER;
+
+        /* according to 3.6.2, max packet len can not be > 0x400 */
+        maxpacket = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
+        multi =  1 + ((maxpacket >> 11) & 0x3);
+        maxpacket &= 0x7ff;
+
+        /* DW0 */
+        dw0 = PTD_VALID;
+        dw0 |= PTD_LENGTH(qtd->length);
+        dw0 |= PTD_MAXPACKET(maxpacket);
+        dw0 |= PTD_ENDPOINT(usb_pipeendpoint(urb->pipe));
+        dw1 = usb_pipeendpoint(urb->pipe) >> 1;
+
+        /* DW1 */
+        dw1 |= PTD_DEVICE_ADDR(usb_pipedevice(urb->pipe));
+
+        pid_code = qtd->packet_type;
+        dw1 |= PTD_PID_TOKEN(pid_code);
+
+        if (usb_pipebulk(urb->pipe))
+                dw1 |= PTD_TRANS_BULK;
+        else if  (usb_pipeint(urb->pipe))
+                dw1 |= PTD_TRANS_INT;
+
+        if (urb->dev->speed != USB_SPEED_HIGH) {
+                /* split transaction */
+
+                dw1 |= PTD_TRANS_SPLIT;
+                if (urb->dev->speed == USB_SPEED_LOW)
+                        dw1 |= PTD_SE_USB_LOSPEED;
+
+                dw1 |= PTD_PORT_NUM(urb->dev->ttport);
+                dw1 |= PTD_HUB_NUM(urb->dev->tt->hub->devnum);
+
+                /* SE bit for Split INT transfers */
+                if (usb_pipeint(urb->pipe) &&
+                                (urb->dev->speed == USB_SPEED_LOW))
+                        dw1 |= 2 << 16;
+
+                dw3 = 0;
+                rl = 0;
+                nak = 0;
+        } else {
+                dw0 |= PTD_MULTI(multi);
+                if (usb_pipecontrol(urb->pipe) || usb_pipebulk(urb->pipe))
+                        dw3 = qh->ping;
+                else
+                        dw3 = 0;
+        }
+        /* DW2 */
+        dw2 = 0;
+        dw2 |= PTD_DATA_START_ADDR(base_to_chip(payload));
+        dw2 |= PTD_RL_CNT(rl);
+        dw3 |= PTD_NAC_CNT(nak);
+
+        /* DW3 */
+        if (usb_pipecontrol(urb->pipe))
+                dw3 |= PTD_DATA_TOGGLE(qtd->toggle);
+        else
+                dw3 |= qh->toggle;
+
+
+        dw3 |= PTD_ACTIVE;
+        /* Cerr */
+        dw3 |= PTD_CERR(ERR_COUNTER);
+
+        memset(ptd, 0, sizeof(*ptd));
+
+        ptd->dw0 = cpu_to_le32(dw0);
+        ptd->dw1 = cpu_to_le32(dw1);
+        ptd->dw2 = cpu_to_le32(dw2);
+        ptd->dw3 = cpu_to_le32(dw3);
+}
+
+static void transform_add_int(struct isp1760_hcd *priv, struct isp1760_qh *qh,
+                        struct isp1760_qtd *qtd, struct urb *urb,
+                        u32 payload, struct ptd *ptd)
+{
+        u32 maxpacket;
+        u32 multi;
+        u32 numberofusofs;
+        u32 i;
+        u32 usofmask, usof;
+        u32 period;
+
+        maxpacket = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
+        multi =  1 + ((maxpacket >> 11) & 0x3);
+        maxpacket &= 0x7ff;
+        /* length of the data per uframe */
+        maxpacket = multi * maxpacket;
+
+        numberofusofs = urb->transfer_buffer_length / maxpacket;
+        if (urb->transfer_buffer_length % maxpacket)
+                numberofusofs += 1;
+
+        usofmask = 1;
+        usof = 0;
+        for (i = 0; i < numberofusofs; i++) {
+                usof |= usofmask;
+                usofmask <<= 1;
+        }
+
+        if (urb->dev->speed != USB_SPEED_HIGH) {
+                /* split */
+                ptd->dw5 = __constant_cpu_to_le32(0x1c);
+
+                if (qh->period >= 32)
+                        period = qh->period / 2;
+                else
+                        period = qh->period;
+
+        } else {
+
+                if (qh->period >= 8)
+                        period = qh->period/8;
+                else
+                        period = qh->period;
+
+                if (period >= 32)
+                        period  = 16;
+
+                if (qh->period >= 8) {
+                        /* millisecond period */
+                        period = (period << 3);
+                } else {
+                        /* usof based tranmsfers */
+                        /* minimum 4 usofs */
+                        usof = 0x11;
+                }
+        }
+
+        ptd->dw2 |= cpu_to_le32(period);
+        ptd->dw4 = cpu_to_le32(usof);
+}
+
+static void transform_into_int(struct isp1760_hcd *priv, struct isp1760_qh *qh,
+                        struct isp1760_qtd *qtd, struct urb *urb,
+                        u32 payload, struct ptd *ptd)
+{
+        transform_into_atl(priv, qh, qtd, urb, payload, ptd);
+        transform_add_int(priv, qh, qtd, urb,  payload, ptd);
+}
+
+static int qtd_fill(struct isp1760_qtd *qtd, void *databuffer, size_t len,
+                u32 token)
+{
+        int count;
+
+        qtd->data_buffer = databuffer;
+        qtd->packet_type = GET_QTD_TOKEN_TYPE(token);
+        qtd->toggle = GET_DATA_TOGGLE(token);
+
+        if (len > HC_ATL_PL_SIZE)
+                count = HC_ATL_PL_SIZE;
+        else
+                count = len;
+
+        qtd->length = count;
+        return count;
+}
+
+static int check_error(struct ptd *ptd)
+{
+        int error = 0;
+        u32 dw3;
+
+        dw3 = le32_to_cpu(ptd->dw3);
+        if (dw3 & DW3_HALT_BIT)
+                error = -EPIPE;
+
+        if (dw3 & DW3_ERROR_BIT) {
+                printk(KERN_ERR "error bit is set in DW3\n");
+                error = -EPIPE;
+        }
+
+        if (dw3 & DW3_QTD_ACTIVE) {
+                printk(KERN_ERR "transfer active bit is set DW3\n");
+                printk(KERN_ERR "nak counter: %d, rl: %d\n", (dw3 >> 19) & 0xf,
+                                (le32_to_cpu(ptd->dw2) >> 25) & 0xf);
+        }
+
+        return error;
+}
+
+static void check_int_err_status(u32 dw4)
+{
+        u32 i;
+
+        dw4 >>= 8;
+
+        for (i = 0; i < 8; i++) {
+                switch (dw4 & 0x7) {
+                case INT_UNDERRUN:
+                        printk(KERN_ERR "ERROR: under run , %d\n", i);
+                        break;
+
+                case INT_EXACT:
+                        printk(KERN_ERR "ERROR: transaction error, %d\n", i);
+                        break;
+
+                case INT_BABBLE:
+                        printk(KERN_ERR "ERROR: babble error, %d\n", i);
+                        break;
+                }
+                dw4 >>= 3;
+        }
+}
+
+static void enqueue_one_qtd(struct isp1760_qtd *qtd, struct isp1760_hcd *priv,
+                u32 payload)
+{
+        u32 token;
+        struct usb_hcd *hcd = priv_to_hcd(priv);
+
+        token = qtd->packet_type;
+
+        if (qtd->length && (qtd->length <= HC_ATL_PL_SIZE)) {
+                switch (token) {
+                case IN_PID:
+                        break;
+                case OUT_PID:
+                case SETUP_PID:
+                        priv_write_copy(priv, qtd->data_buffer,
+                                        hcd->regs + payload,
+                                        qtd->length);
+                }
+        }
+}
+
+static void enqueue_one_atl_qtd(u32 atl_regs, u32 payload,
+                struct isp1760_hcd *priv, struct isp1760_qh *qh,
+                struct urb *urb, u32 slot, struct isp1760_qtd *qtd)
+{
+        struct ptd ptd;
+        struct usb_hcd *hcd = priv_to_hcd(priv);
+
+        transform_into_atl(priv, qh, qtd, urb, payload, &ptd);
+        priv_write_copy(priv, (u32 *)&ptd, hcd->regs + atl_regs, sizeof(ptd));
+        enqueue_one_qtd(qtd, priv, payload);
+
+        priv->atl_ints[slot].urb = urb;
+        priv->atl_ints[slot].qh = qh;
+        priv->atl_ints[slot].qtd = qtd;
+        priv->atl_ints[slot].data_buffer = qtd->data_buffer;
+        priv->atl_ints[slot].payload = payload;
+        qtd->status |= URB_ENQUEUED | URB_TYPE_ATL;
+        qtd->status |= slot << 16;
+}
+
+static void enqueue_one_int_qtd(u32 int_regs, u32 payload,
+                struct isp1760_hcd *priv, struct isp1760_qh *qh,
+                struct urb *urb, u32 slot,  struct isp1760_qtd *qtd)
+{
+        struct ptd ptd;
+        struct usb_hcd *hcd = priv_to_hcd(priv);
+
+        transform_into_int(priv, qh, qtd, urb, payload, &ptd);
+        priv_write_copy(priv, (u32 *)&ptd, hcd->regs + int_regs, sizeof(ptd));
+        enqueue_one_qtd(qtd, priv, payload);
+
+        priv->int_ints[slot].urb = urb;
+        priv->int_ints[slot].qh = qh;
+        priv->int_ints[slot].qtd = qtd;
+        priv->int_ints[slot].data_buffer = qtd->data_buffer;
+        priv->int_ints[slot].payload = payload;
+        qtd->status |= URB_ENQUEUED | URB_TYPE_INT;
+        qtd->status |= slot << 16;
+}
+
+void enqueue_an_ATL_packet(struct usb_hcd *hcd, struct isp1760_qh *qh,
+                struct isp1760_qtd *qtd)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(hcd);
+        u32 skip_map, or_map;
+        u32 queue_entry;
+        u32 slot;
+        u32 atl_regs, payload;
+        u32 buffstatus;
+
+        skip_map = isp1760_readl(hcd->regs + HC_ATL_PTD_SKIPMAP_REG);
+
+        BUG_ON(!skip_map);
+        slot = __ffs(skip_map);
+        queue_entry = 1 << slot;
+
+        atl_regs = ATL_REGS_OFFSET + slot * sizeof(struct ptd);
+
+        payload = alloc_mem(priv, qtd->length);
+
+        enqueue_one_atl_qtd(atl_regs, payload, priv, qh, qtd->urb, slot, qtd);
+
+        or_map = isp1760_readl(hcd->regs + HC_ATL_IRQ_MASK_OR_REG);
+        or_map |= queue_entry;
+        isp1760_writel(or_map, hcd->regs + HC_ATL_IRQ_MASK_OR_REG);
+
+        skip_map &= ~queue_entry;
+        isp1760_writel(skip_map, hcd->regs + HC_ATL_PTD_SKIPMAP_REG);
+
+        buffstatus = isp1760_readl(hcd->regs + HC_BUFFER_STATUS_REG);
+        buffstatus |= ATL_BUFFER;
+        isp1760_writel(buffstatus, hcd->regs + HC_BUFFER_STATUS_REG);
+}
+
+void enqueue_an_INT_packet(struct usb_hcd *hcd, struct isp1760_qh *qh,
+                struct isp1760_qtd *qtd)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(hcd);
+        u32 skip_map, or_map;
+        u32 queue_entry;
+        u32 slot;
+        u32 int_regs, payload;
+        u32 buffstatus;
+
+        skip_map = isp1760_readl(hcd->regs + HC_INT_PTD_SKIPMAP_REG);
+
+        BUG_ON(!skip_map);
+        slot = __ffs(skip_map);
+        queue_entry = 1 << slot;
+
+        int_regs = INT_REGS_OFFSET + slot * sizeof(struct ptd);
+
+        payload = alloc_mem(priv, qtd->length);
+
+        enqueue_one_int_qtd(int_regs, payload, priv, qh, qtd->urb, slot, qtd);
+
+        or_map = isp1760_readl(hcd->regs + HC_INT_IRQ_MASK_OR_REG);
+        or_map |= queue_entry;
+        isp1760_writel(or_map, hcd->regs + HC_INT_IRQ_MASK_OR_REG);
+
+        skip_map &= ~queue_entry;
+        isp1760_writel(skip_map, hcd->regs + HC_INT_PTD_SKIPMAP_REG);
+
+        buffstatus = isp1760_readl(hcd->regs + HC_BUFFER_STATUS_REG);
+        buffstatus |= INT_BUFFER;
+        isp1760_writel(buffstatus, hcd->regs + HC_BUFFER_STATUS_REG);
+}
+
+static void isp1760_urb_done(struct isp1760_hcd *priv, struct urb *urb, int status)
+__releases(priv->lock)
+__acquires(priv->lock)
+{
+        if (!urb->unlinked) {
+                if (status == -EINPROGRESS)
+                        status = 0;
+        }
+
+        /* complete() can reenter this HCD */
+        usb_hcd_unlink_urb_from_ep(priv_to_hcd(priv), urb);
+        spin_unlock(&priv->lock);
+        usb_hcd_giveback_urb(priv_to_hcd(priv), urb, status);
+        spin_lock(&priv->lock);
+}
+
+static void isp1760_qtd_free(struct isp1760_qtd *qtd)
+{
+        kmem_cache_free(qtd_cachep, qtd);
+}
+
+static struct isp1760_qtd *clean_this_qtd(struct isp1760_qtd *qtd)
+{
+        struct isp1760_qtd *tmp_qtd;
+
+        tmp_qtd = qtd->hw_next;
+        list_del(&qtd->qtd_list);
+        isp1760_qtd_free(qtd);
+        return tmp_qtd;
+}
+
+/*
+ * Remove this QTD from the QH list and free its memory. If this QTD
+ * isn't the last one than remove also his successor(s).
+ * Returns the QTD which is part of an new URB and should be enqueued.
+ */
+static struct isp1760_qtd *clean_up_qtdlist(struct isp1760_qtd *qtd)
+{
+        struct isp1760_qtd *tmp_qtd;
+        int last_one;
+
+        do {
+                tmp_qtd = qtd->hw_next;
+                last_one = qtd->status & URB_COMPLETE_NOTIFY;
+                list_del(&qtd->qtd_list);
+                isp1760_qtd_free(qtd);
+                qtd = tmp_qtd;
+        } while (!last_one && qtd);
+
+        return qtd;
+}
+
+static void do_atl_int(struct usb_hcd *usb_hcd)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(usb_hcd);
+        u32 done_map, skip_map;
+        struct ptd ptd;
+        struct urb *urb = NULL;
+        u32 atl_regs_base;
+        u32 atl_regs;
+        u32 queue_entry;
+        u32 payload;
+        u32 length;
+        u32 or_map;
+        u32 status = -EINVAL;
+        int error;
+        struct isp1760_qtd *qtd;
+        struct isp1760_qh *qh;
+        u32 rl;
+        u32 nakcount;
+
+        done_map = isp1760_readl(usb_hcd->regs +
+                        HC_ATL_PTD_DONEMAP_REG);
+        skip_map = isp1760_readl(usb_hcd->regs +
+                        HC_ATL_PTD_SKIPMAP_REG);
+
+        or_map = isp1760_readl(usb_hcd->regs + HC_ATL_IRQ_MASK_OR_REG);
+        or_map &= ~done_map;
+        isp1760_writel(or_map, usb_hcd->regs + HC_ATL_IRQ_MASK_OR_REG);
+
+        atl_regs_base = ATL_REGS_OFFSET;
+        while (done_map) {
+                u32 dw1;
+                u32 dw2;
+                u32 dw3;
+
+                status = 0;
+
+                queue_entry = __ffs(done_map);
+                done_map &= ~(1 << queue_entry);
+                skip_map |= 1 << queue_entry;
+
+                atl_regs = atl_regs_base + queue_entry * sizeof(struct ptd);
+
+                urb = priv->atl_ints[queue_entry].urb;
+                qtd = priv->atl_ints[queue_entry].qtd;
+                qh = priv->atl_ints[queue_entry].qh;
+                payload = priv->atl_ints[queue_entry].payload;
+
+                if (!qh) {
+                        printk(KERN_ERR "qh is 0\n");
+                        continue;
+                }
+                priv_read_copy(priv, (u32 *)&ptd, usb_hcd->regs + atl_regs,
+                                atl_regs, sizeof(ptd));
+
+                dw1 = le32_to_cpu(ptd.dw1);
+                dw2 = le32_to_cpu(ptd.dw2);
+                dw3 = le32_to_cpu(ptd.dw3);
+                rl = (dw2 >> 25) & 0x0f;
+                nakcount = (dw3 >> 19) & 0xf;
+
+                /* Transfer Error, *but* active and no HALT -> reload */
+                if ((dw3 & DW3_ERROR_BIT) && (dw3 & DW3_QTD_ACTIVE) &&
+                                !(dw3 & DW3_HALT_BIT)) {
+
+                        /* according to ppriv code, we have to
+                         * reload this one if trasfered bytes != requested bytes
+                         * else act like everything went smooth..
+                         * XXX This just doesn't feel right and hasn't
+                         * triggered so far.
+                         */
+
+                        length = PTD_XFERRED_LENGTH(dw3);
+                        printk(KERN_ERR "Should reload now.... transfered %d "
+                                        "of %zu\n", length, qtd->length);
+                        BUG();
+                }
+
+                if (!nakcount && (dw3 & DW3_QTD_ACTIVE)) {
+                        u32 buffstatus;
+
+                        /* XXX
+                         * NAKs are handled in HW by the chip. Usually if the
+                         * device is not able to send data fast enough.
+                         * This did not trigger for a long time now.
+                         */
+                        printk(KERN_ERR "Reloading ptd %p/%p... qh %p readed: "
+                                        "%d of %d done: %08x cur: %08x\n", qtd,
+                                        urb, qh, PTD_XFERRED_LENGTH(dw3),
+                                        qtd->length, done_map,
+                                        (1 << queue_entry));
+
+                        /* RL counter = ERR counter */
+                        dw3 &= ~(0xf << 19);
+                        dw3 |= rl << 19;
+                        dw3 &= ~(3 << (55 - 32));
+                        dw3 |= ERR_COUNTER << (55 - 32);
+
+                        /*
+                         * It is not needed to write skip map back because it
+                         * is unchanged. Just make sure that this entry is
+                         * unskipped once it gets written to the HW.
+                         */
+                        skip_map &= ~(1 << queue_entry);
+                        or_map = isp1760_readl(usb_hcd->regs +
+                                        HC_ATL_IRQ_MASK_OR_REG);
+                        or_map |= 1 << queue_entry;
+                        isp1760_writel(or_map, usb_hcd->regs +
+                                        HC_ATL_IRQ_MASK_OR_REG);
+
+                        ptd.dw3 = cpu_to_le32(dw3);
+                        priv_write_copy(priv, (u32 *)&ptd, usb_hcd->regs +
+                                        atl_regs, sizeof(ptd));
+
+                        ptd.dw0 |= __constant_cpu_to_le32(PTD_VALID);
+                        priv_write_copy(priv, (u32 *)&ptd, usb_hcd->regs +
+                                        atl_regs, sizeof(ptd));
+
+                        buffstatus = isp1760_readl(usb_hcd->regs +
+                                        HC_BUFFER_STATUS_REG);
+                        buffstatus |= ATL_BUFFER;
+                        isp1760_writel(buffstatus, usb_hcd->regs +
+                                        HC_BUFFER_STATUS_REG);
+                        continue;
+                }
+
+                error = check_error(&ptd);
+                if (error) {
+                        status = error;
+                        priv->atl_ints[queue_entry].qh->toggle = 0;
+                        priv->atl_ints[queue_entry].qh->ping = 0;
+                        urb->status = -EPIPE;
+
+#if 0
+                        printk(KERN_ERR "Error in %s().\n", __func__);
+                        printk(KERN_ERR "IN dw0: %08x dw1: %08x dw2: %08x "
+                                        "dw3: %08x dw4: %08x dw5: %08x dw6: "
+                                        "%08x dw7: %08x\n",
+                                        ptd.dw0, ptd.dw1, ptd.dw2, ptd.dw3,
+                                        ptd.dw4, ptd.dw5, ptd.dw6, ptd.dw7);
+#endif
+                } else {
+                        if (usb_pipetype(urb->pipe) == PIPE_BULK) {
+                                priv->atl_ints[queue_entry].qh->toggle = dw3 &
+                                        (1 << 25);
+                                priv->atl_ints[queue_entry].qh->ping = dw3 &
+                                        (1 << 26);
+                        }
+                }
+
+                length = PTD_XFERRED_LENGTH(dw3);
+                if (length) {
+                        switch (DW1_GET_PID(dw1)) {
+                        case IN_PID:
+                                priv_read_copy(priv,
+                                        priv->atl_ints[queue_entry].data_buffer,
+                                        usb_hcd->regs + payload, payload,
+                                        length);
+
+                        case OUT_PID:
+
+                                urb->actual_length += length;
+
+                        case SETUP_PID:
+                                break;
+                        }
+                }
+
+                priv->atl_ints[queue_entry].data_buffer = NULL;
+                priv->atl_ints[queue_entry].urb = NULL;
+                priv->atl_ints[queue_entry].qtd = NULL;
+                priv->atl_ints[queue_entry].qh = NULL;
+
+                free_mem(priv, payload);
+
+                isp1760_writel(skip_map, usb_hcd->regs +
+                                HC_ATL_PTD_SKIPMAP_REG);
+
+                if (urb->status == -EPIPE) {
+                        /* HALT was received */
+
+                        qtd = clean_up_qtdlist(qtd);
+                        isp1760_urb_done(priv, urb, urb->status);
+
+                } else if (usb_pipebulk(urb->pipe) && (length < qtd->length)) {
+                        /* short BULK received */
+
+                        printk(KERN_ERR "short bulk, %d instead %d\n", length,
+                                        qtd->length);
+                        if (urb->transfer_flags & URB_SHORT_NOT_OK) {
+                                urb->status = -EREMOTEIO;
+                                printk(KERN_ERR "not okey\n");
+                        }
+
+                        if (urb->status == -EINPROGRESS)
+                                urb->status = 0;
+
+                        qtd = clean_up_qtdlist(qtd);
+
+                        isp1760_urb_done(priv, urb, urb->status);
+
+                } else if (qtd->status & URB_COMPLETE_NOTIFY) {
+                        /* that was the last qtd of that URB */
+
+                        if (urb->status == -EINPROGRESS)
+                                urb->status = 0;
+
+                        qtd = clean_this_qtd(qtd);
+                        isp1760_urb_done(priv, urb, urb->status);
+
+                } else {
+                        /* next QTD of this URB */
+
+                        qtd = clean_this_qtd(qtd);
+                        BUG_ON(!qtd);
+                }
+
+                if (qtd)
+                        enqueue_an_ATL_packet(usb_hcd, qh, qtd);
+
+                skip_map = isp1760_readl(usb_hcd->regs +
+                                HC_ATL_PTD_SKIPMAP_REG);
+        }
+}
+
+static void do_intl_int(struct usb_hcd *usb_hcd)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(usb_hcd);
+        u32 done_map, skip_map;
+        struct ptd ptd;
+        struct urb *urb = NULL;
+        u32 int_regs;
+        u32 int_regs_base;
+        u32 payload;
+        u32 length;
+        u32 or_map;
+        int error;
+        u32 queue_entry;
+        struct isp1760_qtd *qtd;
+        struct isp1760_qh *qh;
+
+        done_map = isp1760_readl(usb_hcd->regs +
+                        HC_INT_PTD_DONEMAP_REG);
+        skip_map = isp1760_readl(usb_hcd->regs +
+                        HC_INT_PTD_SKIPMAP_REG);
+
+        or_map = isp1760_readl(usb_hcd->regs + HC_INT_IRQ_MASK_OR_REG);
+        or_map &= ~done_map;
+        isp1760_writel(or_map, usb_hcd->regs + HC_INT_IRQ_MASK_OR_REG);
+
+        int_regs_base = INT_REGS_OFFSET;
+
+        while (done_map) {
+                u32 dw1;
+                u32 dw3;
+
+                queue_entry = __ffs(done_map);
+                done_map &= ~(1 << queue_entry);
+                skip_map |= 1 << queue_entry;
+
+                int_regs = int_regs_base + queue_entry * sizeof(struct ptd);
+                urb = priv->int_ints[queue_entry].urb;
+                qtd = priv->int_ints[queue_entry].qtd;
+                qh = priv->int_ints[queue_entry].qh;
+                payload = priv->int_ints[queue_entry].payload;
+
+                if (!qh) {
+                        printk(KERN_ERR "(INT) qh is 0\n");
+                        continue;
+                }
+
+                priv_read_copy(priv, (u32 *)&ptd, usb_hcd->regs + int_regs,
+                                int_regs, sizeof(ptd));
+                dw1 = le32_to_cpu(ptd.dw1);
+                dw3 = le32_to_cpu(ptd.dw3);
+                check_int_err_status(le32_to_cpu(ptd.dw4));
+
+                error = check_error(&ptd);
+                if (error) {
+#if 0
+                        printk(KERN_ERR "Error in %s().\n", __func__);
+                        printk(KERN_ERR "IN dw0: %08x dw1: %08x dw2: %08x "
+                                        "dw3: %08x dw4: %08x dw5: %08x dw6: "
+                                        "%08x dw7: %08x\n",
+                                        ptd.dw0, ptd.dw1, ptd.dw2, ptd.dw3,
+                                        ptd.dw4, ptd.dw5, ptd.dw6, ptd.dw7);
+#endif
+                        urb->status = -EPIPE;
+                        priv->int_ints[queue_entry].qh->toggle = 0;
+                        priv->int_ints[queue_entry].qh->ping = 0;
+
+                } else {
+                        priv->int_ints[queue_entry].qh->toggle =
+                                dw3 & (1 << 25);
+                        priv->int_ints[queue_entry].qh->ping = dw3 & (1 << 26);
+                }
+
+                if (urb->dev->speed != USB_SPEED_HIGH)
+                        length = PTD_XFERRED_LENGTH_LO(dw3);
+                else
+                        length = PTD_XFERRED_LENGTH(dw3);
+
+                if (length) {
+                        switch (DW1_GET_PID(dw1)) {
+                        case IN_PID:
+                                priv_read_copy(priv,
+                                        priv->int_ints[queue_entry].data_buffer,
+                                        usb_hcd->regs + payload , payload,
+                                        length);
+                        case OUT_PID:
+
+                                urb->actual_length += length;
+
+                        case SETUP_PID:
+                                break;
+                        }
+                }
+
+                priv->int_ints[queue_entry].data_buffer = NULL;
+                priv->int_ints[queue_entry].urb = NULL;
+                priv->int_ints[queue_entry].qtd = NULL;
+                priv->int_ints[queue_entry].qh = NULL;
+
+                isp1760_writel(skip_map, usb_hcd->regs +
+                                HC_INT_PTD_SKIPMAP_REG);
+                free_mem(priv, payload);
+
+                if (urb->status == -EPIPE) {
+                        /* HALT received */
+
+                         qtd = clean_up_qtdlist(qtd);
+                         isp1760_urb_done(priv, urb, urb->status);
+
+                } else if (qtd->status & URB_COMPLETE_NOTIFY) {
+
+                        if (urb->status == -EINPROGRESS)
+                                urb->status = 0;
+
+                        qtd = clean_this_qtd(qtd);
+                        isp1760_urb_done(priv, urb, urb->status);
+
+                } else {
+                        /* next QTD of this URB */
+
+                        qtd = clean_this_qtd(qtd);
+                        BUG_ON(!qtd);
+                }
+
+                if (qtd)
+                        enqueue_an_INT_packet(usb_hcd, qh, qtd);
+
+                skip_map = isp1760_readl(usb_hcd->regs +
+                                HC_INT_PTD_SKIPMAP_REG);
+        }
+}
+
+#define max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff)
+static struct isp1760_qh *qh_make(struct isp1760_hcd *priv, struct urb *urb,
+                gfp_t flags)
+{
+        struct isp1760_qh *qh;
+        int is_input, type;
+
+        qh = isp1760_qh_alloc(priv, flags);
+        if (!qh)
+                return qh;
+
+        /*
+         * init endpoint/device data for this QH
+         */
+        is_input = usb_pipein(urb->pipe);
+        type = usb_pipetype(urb->pipe);
+
+        if (type == PIPE_INTERRUPT) {
+
+                if (urb->dev->speed == USB_SPEED_HIGH) {
+
+                        qh->period = urb->interval >> 3;
+                        if (qh->period == 0 && urb->interval != 1) {
+                                /* NOTE interval 2 or 4 uframes could work.
+                                 * But interval 1 scheduling is simpler, and
+                                 * includes high bandwidth.
+                                 */
+                                printk(KERN_ERR "intr period %d uframes, NYET!",
+                                                urb->interval);
+                                qh_destroy(qh);
+                                return NULL;
+                        }
+                } else {
+                        qh->period = urb->interval;
+                }
+        }
+
+        /* support for tt scheduling, and access to toggles */
+        qh->dev = urb->dev;
+
+        if (!usb_pipecontrol(urb->pipe))
+                usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe), !is_input,
+                                1);
+        return qh;
+}
+
+/*
+ * For control/bulk/interrupt, return QH with these TDs appended.
+ * Allocates and initializes the QH if necessary.
+ * Returns null if it can't allocate a QH it needs to.
+ * If the QH has TDs (urbs) already, that's great.
+ */
+static struct isp1760_qh *qh_append_tds(struct isp1760_hcd *priv,
+                struct urb *urb, struct list_head *qtd_list, int epnum,
+                void **ptr)
+{
+        struct isp1760_qh *qh;
+        struct isp1760_qtd *qtd;
+        struct isp1760_qtd *prev_qtd;
+
+        qh = (struct isp1760_qh *)*ptr;
+        if (!qh) {
+                /* can't sleep here, we have priv->lock... */
+                qh = qh_make(priv, urb, GFP_ATOMIC);
+                if (!qh)
+                        return qh;
+                *ptr = qh;
+        }
+
+        qtd = list_entry(qtd_list->next, struct isp1760_qtd,
+                        qtd_list);
+        if (!list_empty(&qh->qtd_list))
+                prev_qtd = list_entry(qh->qtd_list.prev,
+                                struct isp1760_qtd, qtd_list);
+        else
+                prev_qtd = NULL;
+
+        list_splice(qtd_list, qh->qtd_list.prev);
+        if (prev_qtd) {
+                BUG_ON(prev_qtd->hw_next);
+                prev_qtd->hw_next = qtd;
+        }
+
+        urb->hcpriv = qh;
+        return qh;
+}
+
+static void qtd_list_free(struct isp1760_hcd *priv, struct urb *urb,
+                struct list_head *qtd_list)
+{
+        struct list_head *entry, *temp;
+
+        list_for_each_safe(entry, temp, qtd_list) {
+                struct isp1760_qtd      *qtd;
+
+                qtd = list_entry(entry, struct isp1760_qtd, qtd_list);
+                list_del(&qtd->qtd_list);
+                isp1760_qtd_free(qtd);
+        }
+}
+
+static int isp1760_prepare_enqueue(struct isp1760_hcd *priv, struct urb *urb,
+                struct list_head *qtd_list, gfp_t mem_flags, packet_enqueue *p)
+{
+        struct isp1760_qtd         *qtd;
+        int                     epnum;
+        unsigned long           flags;
+        struct isp1760_qh          *qh = NULL;
+        int                     rc;
+        int qh_busy;
+
+        qtd = list_entry(qtd_list->next, struct isp1760_qtd, qtd_list);
+        epnum = urb->ep->desc.bEndpointAddress;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &priv_to_hcd(priv)->flags)) {
+                rc = -ESHUTDOWN;
+                goto done;
+        }
+        rc = usb_hcd_link_urb_to_ep(priv_to_hcd(priv), urb);
+        if (rc)
+                goto done;
+
+        qh = urb->ep->hcpriv;
+        if (qh)
+                qh_busy = !list_empty(&qh->qtd_list);
+        else
+                qh_busy = 0;
+
+        qh = qh_append_tds(priv, urb, qtd_list, epnum, &urb->ep->hcpriv);
+        if (!qh) {
+                usb_hcd_unlink_urb_from_ep(priv_to_hcd(priv), urb);
+                rc = -ENOMEM;
+                goto done;
+        }
+
+        if (!qh_busy)
+                p(priv_to_hcd(priv), qh, qtd);
+
+done:
+        spin_unlock_irqrestore(&priv->lock, flags);
+        if (!qh)
+                qtd_list_free(priv, urb, qtd_list);
+        return rc;
+}
+
+static struct isp1760_qtd *isp1760_qtd_alloc(struct isp1760_hcd *priv,
+                gfp_t flags)
+{
+        struct isp1760_qtd *qtd;
+
+        qtd = kmem_cache_zalloc(qtd_cachep, flags);
+        if (qtd)
+                INIT_LIST_HEAD(&qtd->qtd_list);
+
+        return qtd;
+}
+
+/*
+ * create a list of filled qtds for this URB; won't link into qh.
+ */
+static struct list_head *qh_urb_transaction(struct isp1760_hcd *priv,
+                struct urb *urb, struct list_head *head, gfp_t flags)
+{
+        struct isp1760_qtd *qtd, *qtd_prev;
+        void *buf;
+        int len, maxpacket;
+        int is_input;
+        u32 token;
+
+        /*
+         * URBs map to sequences of QTDs:  one logical transaction
+         */
+        qtd = isp1760_qtd_alloc(priv, flags);
+        if (!qtd)
+                return NULL;
+
+        list_add_tail(&qtd->qtd_list, head);
+        qtd->urb = urb;
+        urb->status = -EINPROGRESS;
+
+        token = 0;
+        /* for split transactions, SplitXState initialized to zero */
+
+        len = urb->transfer_buffer_length;
+        is_input = usb_pipein(urb->pipe);
+        if (usb_pipecontrol(urb->pipe)) {
+                /* SETUP pid */
+                qtd_fill(qtd, urb->setup_packet,
+                                sizeof(struct usb_ctrlrequest),
+                                token | SETUP_PID);
+
+                /* ... and always at least one more pid */
+                token ^= DATA_TOGGLE;
+                qtd_prev = qtd;
+                qtd = isp1760_qtd_alloc(priv, flags);
+                if (!qtd)
+                        goto cleanup;
+                qtd->urb = urb;
+                qtd_prev->hw_next = qtd;
+                list_add_tail(&qtd->qtd_list, head);
+
+                /* for zero length DATA stages, STATUS is always IN */
+                if (len == 0)
+                        token |= IN_PID;
+        }
+
+        /*
+         * data transfer stage:  buffer setup
+         */
+        buf = urb->transfer_buffer;
+
+        if (is_input)
+                token |= IN_PID;
+        else
+                token |= OUT_PID;
+
+        maxpacket = max_packet(usb_maxpacket(urb->dev, urb->pipe, !is_input));
+
+        /*
+         * buffer gets wrapped in one or more qtds;
+         * last one may be "short" (including zero len)
+         * and may serve as a control status ack
+         */
+        for (;;) {
+                int this_qtd_len;
+
+                if (!buf && len) {
+                        /* XXX This looks like usb storage / SCSI bug */
+                        printk(KERN_ERR "buf is null, dma is %08lx len is %d\n",
+                                        (long unsigned)urb->transfer_dma, len);
+                        WARN_ON(1);
+                }
+
+                this_qtd_len = qtd_fill(qtd, buf, len, token);
+                len -= this_qtd_len;
+                buf += this_qtd_len;
+
+                /* qh makes control packets use qtd toggle; maybe switch it */
+                if ((maxpacket & (this_qtd_len + (maxpacket - 1))) == 0)
+                        token ^= DATA_TOGGLE;
+
+                if (len <= 0)
+                        break;
+
+                qtd_prev = qtd;
+                qtd = isp1760_qtd_alloc(priv, flags);
+                if (!qtd)
+                        goto cleanup;
+                qtd->urb = urb;
+                qtd_prev->hw_next = qtd;
+                list_add_tail(&qtd->qtd_list, head);
+        }
+
+        /*
+         * control requests may need a terminating data "status" ack;
+         * bulk ones may need a terminating short packet (zero length).
+         */
+        if (urb->transfer_buffer_length != 0) {
+                int one_more = 0;
+
+                if (usb_pipecontrol(urb->pipe)) {
+                        one_more = 1;
+                        /* "in" <--> "out"  */
+                        token ^= IN_PID;
+                        /* force DATA1 */
+                        token |= DATA_TOGGLE;
+                } else if (usb_pipebulk(urb->pipe)
+                                && (urb->transfer_flags & URB_ZERO_PACKET)
+                                && !(urb->transfer_buffer_length % maxpacket)) {
+                        one_more = 1;
+                }
+                if (one_more) {
+                        qtd_prev = qtd;
+                        qtd = isp1760_qtd_alloc(priv, flags);
+                        if (!qtd)
+                                goto cleanup;
+                        qtd->urb = urb;
+                        qtd_prev->hw_next = qtd;
+                        list_add_tail(&qtd->qtd_list, head);
+
+                        /* never any data in such packets */
+                        qtd_fill(qtd, NULL, 0, token);
+                }
+        }
+
+        qtd->status = URB_COMPLETE_NOTIFY;
+        return head;
+
+cleanup:
+        qtd_list_free(priv, urb, head);
+        return NULL;
+}
+
+static int isp1760_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
+                gfp_t mem_flags)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(hcd);
+        struct list_head qtd_list;
+        packet_enqueue *pe;
+
+        INIT_LIST_HEAD(&qtd_list);
+
+        switch (usb_pipetype(urb->pipe)) {
+        case PIPE_CONTROL:
+        case PIPE_BULK:
+
+                if (!qh_urb_transaction(priv, urb, &qtd_list, mem_flags))
+                        return -ENOMEM;
+                pe =  enqueue_an_ATL_packet;
+                break;
+
+        case PIPE_INTERRUPT:
+                if (!qh_urb_transaction(priv, urb, &qtd_list, mem_flags))
+                        return -ENOMEM;
+                pe = enqueue_an_INT_packet;
+                break;
+
+        case PIPE_ISOCHRONOUS:
+                printk(KERN_ERR "PIPE_ISOCHRONOUS ain't supported\n");
+        default:
+                return -EPIPE;
+        }
+
+        isp1760_prepare_enqueue(priv, urb, &qtd_list, mem_flags, pe);
+        return 0;
+}
+
+static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
+                int status)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(hcd);
+        struct inter_packet_info *ints;
+        u32 i;
+        u32 reg_base, or_reg, skip_reg;
+        int flags;
+        struct ptd ptd;
+
+        switch (usb_pipetype(urb->pipe)) {
+        case PIPE_ISOCHRONOUS:
+                return -EPIPE;
+                break;
+
+        case PIPE_INTERRUPT:
+                ints = priv->int_ints;
+                reg_base = INT_REGS_OFFSET;
+                or_reg = HC_INT_IRQ_MASK_OR_REG;
+                skip_reg = HC_INT_PTD_SKIPMAP_REG;
+                break;
+
+        default:
+                ints = priv->atl_ints;
+                reg_base = ATL_REGS_OFFSET;
+                or_reg = HC_ATL_IRQ_MASK_OR_REG;
+                skip_reg = HC_ATL_PTD_SKIPMAP_REG;
+                break;
+        }
+
+        memset(&ptd, 0, sizeof(ptd));
+        spin_lock_irqsave(&priv->lock, flags);
+
+        for (i = 0; i < 32; i++) {
+                if (ints->urb == urb) {
+                        u32 skip_map;
+                        u32 or_map;
+                        struct isp1760_qtd *qtd;
+
+                        skip_map = isp1760_readl(hcd->regs + skip_reg);
+                        skip_map |= 1 << i;
+                        isp1760_writel(skip_map, hcd->regs + skip_reg);
+
+                        or_map = isp1760_readl(hcd->regs + or_reg);
+                        or_map &= ~(1 << i);
+                        isp1760_writel(or_map, hcd->regs + or_reg);
+
+                        priv_write_copy(priv, (u32 *)&ptd, hcd->regs + reg_base
+                                        + i * sizeof(ptd), sizeof(ptd));
+                        qtd = ints->qtd;
+
+                        clean_up_qtdlist(qtd);
+
+                        free_mem(priv, ints->payload);
+
+                        ints->urb = NULL;
+                        ints->qh = NULL;
+                        ints->qtd = NULL;
+                        ints->data_buffer = NULL;
+                        ints->payload = 0;
+
+                        isp1760_urb_done(priv, urb, status);
+                        break;
+                }
+                ints++;
+        }
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return 0;
+}
+
+static irqreturn_t isp1760_irq(struct usb_hcd *usb_hcd)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(usb_hcd);
+        u32 imask;
+        irqreturn_t irqret = IRQ_NONE;
+
+        spin_lock(&priv->lock);
+
+        if (!(usb_hcd->state & HC_STATE_RUNNING))
+                goto leave;
+
+        imask = isp1760_readl(usb_hcd->regs + HC_INTERRUPT_REG);
+        if (unlikely(!imask))
+                goto leave;
+
+        isp1760_writel(imask, usb_hcd->regs + HC_INTERRUPT_REG);
+        if (imask & HC_ATL_INT)
+                do_atl_int(usb_hcd);
+
+        if (imask & HC_INTL_INT)
+                do_intl_int(usb_hcd);
+
+        irqret = IRQ_HANDLED;
+leave:
+        spin_unlock(&priv->lock);
+        return irqret;
+}
+
+static int isp1760_hub_status_data(struct usb_hcd *hcd, char *buf)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(hcd);
+        u32 temp, status = 0;
+        u32 mask;
+        int retval = 1;
+        unsigned long flags;
+
+        /* if !USB_SUSPEND, root hub timers won't get shut down ... */
+        if (!HC_IS_RUNNING(hcd->state))
+                return 0;
+
+        /* init status to no-changes */
+        buf[0] = 0;
+        mask = PORT_CSC;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        temp = isp1760_readl(hcd->regs + HC_PORTSC1);
+
+        if (temp & PORT_OWNER) {
+                if (temp & PORT_CSC) {
+                        temp &= ~PORT_CSC;
+                        isp1760_writel(temp, hcd->regs + HC_PORTSC1);
+                        goto done;
+                }
+        }
+
+        /*
+         * Return status information even for ports with OWNER set.
+         * Otherwise khubd wouldn't see the disconnect event when a
+         * high-speed device is switched over to the companion
+         * controller by the user.
+         */
+
+        if ((temp & mask) != 0
+                        || ((temp & PORT_RESUME) != 0
+                                && time_after_eq(jiffies,
+                                        priv->reset_done))) {
+                buf [0] |= 1 << (0 + 1);
+                status = STS_PCD;
+        }
+        /* FIXME autosuspend idle root hubs */
+done:
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return status ? retval : 0;
+}
+
+static void isp1760_hub_descriptor(struct isp1760_hcd *priv,
+                struct usb_hub_descriptor *desc)
+{
+        int ports = HCS_N_PORTS(priv->hcs_params);
+        u16 temp;
+
+        desc->bDescriptorType = 0x29;
+        /* priv 1.0, 2.3.9 says 20ms max */
+        desc->bPwrOn2PwrGood = 10;
+        desc->bHubContrCurrent = 0;
+
+        desc->bNbrPorts = ports;
+        temp = 1 + (ports / 8);
+        desc->bDescLength = 7 + 2 * temp;
+
+        /* two bitmaps:  ports removable, and usb 1.0 legacy PortPwrCtrlMask */
+        memset(&desc->bitmap[0], 0, temp);
+        memset(&desc->bitmap[temp], 0xff, temp);
+
+        /* per-port overcurrent reporting */
+        temp = 0x0008;
+        if (HCS_PPC(priv->hcs_params))
+                /* per-port power control */
+                temp |= 0x0001;
+        else
+                /* no power switching */
+                temp |= 0x0002;
+        desc->wHubCharacteristics = cpu_to_le16(temp);
+}
+
+#define PORT_WAKE_BITS  (PORT_WKOC_E|PORT_WKDISC_E|PORT_WKCONN_E)
+
+static int check_reset_complete(struct isp1760_hcd *priv, int index,
+                u32 __iomem *status_reg, int port_status)
+{
+        if (!(port_status & PORT_CONNECT))
+                return port_status;
+
+        /* if reset finished and it's still not enabled -- handoff */
+        if (!(port_status & PORT_PE)) {
+
+                printk(KERN_ERR "port %d full speed --> companion\n",
+                        index + 1);
+
+                port_status |= PORT_OWNER;
+                port_status &= ~PORT_RWC_BITS;
+                isp1760_writel(port_status, status_reg);
+
+        } else
+                printk(KERN_ERR "port %d high speed\n", index + 1);
+
+        return port_status;
+}
+
+static int isp1760_hub_control(struct usb_hcd *hcd, u16 typeReq,
+                u16 wValue, u16 wIndex, char *buf, u16 wLength)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(hcd);
+        int ports = HCS_N_PORTS(priv->hcs_params);
+        u32 __iomem *status_reg = hcd->regs + HC_PORTSC1;
+        u32 temp, status;
+        unsigned long flags;
+        int retval = 0;
+        unsigned selector;
+
+        /*
+         * FIXME:  support SetPortFeatures USB_PORT_FEAT_INDICATOR.
+         * HCS_INDICATOR may say we can change LEDs to off/amber/green.
+         * (track current state ourselves) ... blink for diagnostics,
+         * power, "this is the one", etc.  EHCI spec supports this.
+         */
+
+        spin_lock_irqsave(&priv->lock, flags);
+        switch (typeReq) {
+        case ClearHubFeature:
+                switch (wValue) {
+                case C_HUB_LOCAL_POWER:
+                case C_HUB_OVER_CURRENT:
+                        /* no hub-wide feature/status flags */
+                        break;
+                default:
+                        goto error;
+                }
+                break;
+        case ClearPortFeature:
+                if (!wIndex || wIndex > ports)
+                        goto error;
+                wIndex--;
+                temp = isp1760_readl(status_reg);
+
+                /*
+                 * Even if OWNER is set, so the port is owned by the
+                 * companion controller, khubd needs to be able to clear
+                 * the port-change status bits (especially
+                 * USB_PORT_FEAT_C_CONNECTION).
+                 */
+
+                switch (wValue) {
+                case USB_PORT_FEAT_ENABLE:
+                        isp1760_writel(temp & ~PORT_PE, status_reg);
+                        break;
+                case USB_PORT_FEAT_C_ENABLE:
+                        /* XXX error? */
+                        break;
+                case USB_PORT_FEAT_SUSPEND:
+                        if (temp & PORT_RESET)
+                                goto error;
+
+                        if (temp & PORT_SUSPEND) {
+                                if ((temp & PORT_PE) == 0)
+                                        goto error;
+                                /* resume signaling for 20 msec */
+                                temp &= ~(PORT_RWC_BITS);
+                                isp1760_writel(temp | PORT_RESUME,
+                                                status_reg);
+                                priv->reset_done = jiffies +
+                                        msecs_to_jiffies(20);
+                        }
+                        break;
+                case USB_PORT_FEAT_C_SUSPEND:
+                        /* we auto-clear this feature */
+                        break;
+                case USB_PORT_FEAT_POWER:
+                        if (HCS_PPC(priv->hcs_params))
+                                isp1760_writel(temp & ~PORT_POWER, status_reg);
+                        break;
+                case USB_PORT_FEAT_C_CONNECTION:
+                        isp1760_writel(temp | PORT_CSC,
+                                        status_reg);
+                        break;
+                case USB_PORT_FEAT_C_OVER_CURRENT:
+                        /* XXX error ?*/
+                        break;
+                case USB_PORT_FEAT_C_RESET:
+                        /* GetPortStatus clears reset */
+                        break;
+                default:
+                        goto error;
+                }
+                isp1760_readl(hcd->regs + HC_USBCMD);
+                break;
+        case GetHubDescriptor:
+                isp1760_hub_descriptor(priv, (struct usb_hub_descriptor *)
+                        buf);
+                break;
+        case GetHubStatus:
+                /* no hub-wide feature/status flags */
+                memset(buf, 0, 4);
+                break;
+        case GetPortStatus:
+                if (!wIndex || wIndex > ports)
+                        goto error;
+                wIndex--;
+                status = 0;
+                temp = isp1760_readl(status_reg);
+
+                /* wPortChange bits */
+                if (temp & PORT_CSC)
+                        status |= 1 << USB_PORT_FEAT_C_CONNECTION;
+
+
+                /* whoever resumes must GetPortStatus to complete it!! */
+                if (temp & PORT_RESUME) {
+                        printk(KERN_ERR "Port resume should be skipped.\n");
+
+                        /* Remote Wakeup received? */
+                        if (!priv->reset_done) {
+                                /* resume signaling for 20 msec */
+                                priv->reset_done = jiffies
+                                                + msecs_to_jiffies(20);
+                                /* check the port again */
+                                mod_timer(&priv_to_hcd(priv)->rh_timer,
+                                                priv->reset_done);
+                        }
+
+                        /* resume completed? */
+                        else if (time_after_eq(jiffies,
+                                        priv->reset_done)) {
+                                status |= 1 << USB_PORT_FEAT_C_SUSPEND;
+                                priv->reset_done = 0;
+
+                                /* stop resume signaling */
+                                temp = isp1760_readl(status_reg);
+                                isp1760_writel(
+                                        temp & ~(PORT_RWC_BITS | PORT_RESUME),
+                                        status_reg);
+                                retval = handshake(priv, status_reg,
+                                           PORT_RESUME, 0, 2000 /* 2msec */);
+                                if (retval != 0) {
+                                        isp1760_err(priv,
+                                                "port %d resume error %d\n",
+                                                wIndex + 1, retval);
+                                        goto error;
+                                }
+                                temp &= ~(PORT_SUSPEND|PORT_RESUME|(3<<10));
+                        }
+                }
+
+                /* whoever resets must GetPortStatus to complete it!! */
+                if ((temp & PORT_RESET)
+                                && time_after_eq(jiffies,
+                                        priv->reset_done)) {
+                        status |= 1 << USB_PORT_FEAT_C_RESET;
+                        priv->reset_done = 0;
+
+                        /* force reset to complete */
+                        isp1760_writel(temp & ~PORT_RESET,
+                                        status_reg);
+                        /* REVISIT:  some hardware needs 550+ usec to clear
+                         * this bit; seems too long to spin routinely...
+                         */
+                        retval = handshake(priv, status_reg,
+                                        PORT_RESET, 0, 750);
+                        if (retval != 0) {
+                                isp1760_err(priv, "port %d reset error %d\n",
+                                                wIndex + 1, retval);
+                                goto error;
+                        }
+
+                        /* see what we found out */
+                        temp = check_reset_complete(priv, wIndex, status_reg,
+                                        isp1760_readl(status_reg));
+                }
+                /*
+                 * Even if OWNER is set, there's no harm letting khubd
+                 * see the wPortStatus values (they should all be 0 except
+                 * for PORT_POWER anyway).
+                 */
+
+                if (temp & PORT_OWNER)
+                        printk(KERN_ERR "Warning: PORT_OWNER is set\n");
+
+                if (temp & PORT_CONNECT) {
+                        status |= 1 << USB_PORT_FEAT_CONNECTION;
+                        /* status may be from integrated TT */
+                        status |= ehci_port_speed(priv, temp);
+                }
+                if (temp & PORT_PE)
+                        status |= 1 << USB_PORT_FEAT_ENABLE;
+                if (temp & (PORT_SUSPEND|PORT_RESUME))
+                        status |= 1 << USB_PORT_FEAT_SUSPEND;
+                if (temp & PORT_RESET)
+                        status |= 1 << USB_PORT_FEAT_RESET;
+                if (temp & PORT_POWER)
+                        status |= 1 << USB_PORT_FEAT_POWER;
+
+                put_unaligned(cpu_to_le32(status), (__le32 *) buf);
+                break;
+        case SetHubFeature:
+                switch (wValue) {
+                case C_HUB_LOCAL_POWER:
+                case C_HUB_OVER_CURRENT:
+                        /* no hub-wide feature/status flags */
+                        break;
+                default:
+                        goto error;
+                }
+                break;
+        case SetPortFeature:
+                selector = wIndex >> 8;
+                wIndex &= 0xff;
+                if (!wIndex || wIndex > ports)
+                        goto error;
+                wIndex--;
+                temp = isp1760_readl(status_reg);
+                if (temp & PORT_OWNER)
+                        break;
+
+/*              temp &= ~PORT_RWC_BITS; */
+                switch (wValue) {
+                case USB_PORT_FEAT_ENABLE:
+                        isp1760_writel(temp | PORT_PE, status_reg);
+                        break;
+
+                case USB_PORT_FEAT_SUSPEND:
+                        if ((temp & PORT_PE) == 0
+                                        || (temp & PORT_RESET) != 0)
+                                goto error;
+
+                        isp1760_writel(temp | PORT_SUSPEND, status_reg);
+                        break;
+                case USB_PORT_FEAT_POWER:
+                        if (HCS_PPC(priv->hcs_params))
+                                isp1760_writel(temp | PORT_POWER,
+                                                status_reg);
+                        break;
+                case USB_PORT_FEAT_RESET:
+                        if (temp & PORT_RESUME)
+                                goto error;
+                        /* line status bits may report this as low speed,
+                         * which can be fine if this root hub has a
+                         * transaction translator built in.
+                         */
+                        if ((temp & (PORT_PE|PORT_CONNECT)) == PORT_CONNECT
+                                        && PORT_USB11(temp)) {
+                                temp |= PORT_OWNER;
+                        } else {
+                                temp |= PORT_RESET;
+                                temp &= ~PORT_PE;
+
+                                /*
+                                 * caller must wait, then call GetPortStatus
+                                 * usb 2.0 spec says 50 ms resets on root
+                                 */
+                                priv->reset_done = jiffies +
+                                        msecs_to_jiffies(50);
+                        }
+                        isp1760_writel(temp, status_reg);
+                        break;
+                default:
+                        goto error;
+                }
+                isp1760_readl(hcd->regs + HC_USBCMD);
+                break;
+
+        default:
+error:
+                /* "stall" on error */
+                retval = -EPIPE;
+        }
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return retval;
+}
+
+static void isp1760_endpoint_disable(struct usb_hcd *usb_hcd,
+                struct usb_host_endpoint *ep)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(usb_hcd);
+        struct isp1760_qh *qh;
+        struct isp1760_qtd *qtd;
+        u32 flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        qh = ep->hcpriv;
+        if (!qh)
+                goto out;
+
+        ep->hcpriv = NULL;
+        do {
+                /* more than entry might get removed */
+                if (list_empty(&qh->qtd_list))
+                        break;
+
+                qtd = list_first_entry(&qh->qtd_list, struct isp1760_qtd,
+                                qtd_list);
+
+                if (qtd->status & URB_ENQUEUED) {
+
+                        spin_unlock_irqrestore(&priv->lock, flags);
+                        isp1760_urb_dequeue(usb_hcd, qtd->urb, -ECONNRESET);
+                        spin_lock_irqsave(&priv->lock, flags);
+                } else {
+                        struct urb *urb;
+
+                        urb = qtd->urb;
+                        clean_up_qtdlist(qtd);
+                        isp1760_urb_done(priv, urb, -ECONNRESET);
+                }
+        } while (1);
+
+        qh_destroy(qh);
+        /* remove requests and leak them.
+         * ATL are pretty fast done, INT could take a while...
+         * The latter shoule be removed
+         */
+out:
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+static int isp1760_get_frame(struct usb_hcd *hcd)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(hcd);
+        u32 fr;
+
+        fr = isp1760_readl(hcd->regs + HC_FRINDEX);
+        return (fr >> 3) % priv->periodic_size;
+}
+
+static void isp1760_stop(struct usb_hcd *hcd)
+{
+        struct isp1760_hcd *priv = hcd_to_priv(hcd);
+
+        isp1760_hub_control(hcd, ClearPortFeature, USB_PORT_FEAT_POWER, 1,
+                        NULL, 0);
+        mdelay(20);
+
+        spin_lock_irq(&priv->lock);
+        ehci_reset(priv);
+        /* Disable IRQ */
+        isp1760_writel(HW_DATA_BUS_32BIT, hcd->regs + HC_HW_MODE_CTRL);
+        spin_unlock_irq(&priv->lock);
+
+        isp1760_writel(0, hcd->regs + HC_CONFIGFLAG);
+}
+
+static void isp1760_shutdown(struct usb_hcd *hcd)
+{
+        u32 command;
+
+        isp1760_stop(hcd);
+        isp1760_writel(HW_DATA_BUS_32BIT, hcd->regs + HC_HW_MODE_CTRL);
+
+        command = isp1760_readl(hcd->regs + HC_USBCMD);
+        command &= ~CMD_RUN;
+        isp1760_writel(command, hcd->regs + HC_USBCMD);
+}
+
+static const struct hc_driver isp1760_hc_driver = {
+        .description            = "isp1760-hcd",
+        .product_desc           = "NXP ISP1760 USB Host Controller",
+        .hcd_priv_size          = sizeof(struct isp1760_hcd),
+        .irq                    = isp1760_irq,
+        .flags                  = HCD_MEMORY | HCD_USB2,
+        .reset                  = isp1760_hc_setup,
+        .start                  = isp1760_run,
+        .stop                   = isp1760_stop,
+        .shutdown               = isp1760_shutdown,
+        .urb_enqueue            = isp1760_urb_enqueue,
+        .urb_dequeue            = isp1760_urb_dequeue,
+        .endpoint_disable       = isp1760_endpoint_disable,
+        .get_frame_number       = isp1760_get_frame,
+        .hub_status_data        = isp1760_hub_status_data,
+        .hub_control            = isp1760_hub_control,
+};
+
+int __init init_kmem_once(void)
+{
+        qtd_cachep = kmem_cache_create("isp1760_qtd",
+                        sizeof(struct isp1760_qtd), 0, SLAB_TEMPORARY |
+                        SLAB_MEM_SPREAD, NULL);
+
+        if (!qtd_cachep)
+                return -ENOMEM;
+
+        qh_cachep = kmem_cache_create("isp1760_qh", sizeof(struct isp1760_qh),
+                        0, SLAB_TEMPORARY | SLAB_MEM_SPREAD, NULL);
+
+        if (!qh_cachep) {
+                kmem_cache_destroy(qtd_cachep);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
+void deinit_kmem_cache(void)
+{
+        kmem_cache_destroy(qtd_cachep);
+        kmem_cache_destroy(qh_cachep);
+}
+
+struct usb_hcd *isp1760_register(u64 res_start, u64 res_len, int irq,
+                u64 irqflags, struct device *dev, const char *busname)
+{
+        struct usb_hcd *hcd;
+        struct isp1760_hcd *priv;
+        int ret;
+
+        if (usb_disabled())
+                return ERR_PTR(-ENODEV);
+
+        /* prevent usb-core allocating DMA pages */
+        dev->dma_mask = NULL;
+
+        hcd = usb_create_hcd(&isp1760_hc_driver, dev, dev->bus_id);
+        if (!hcd)
+                return ERR_PTR(-ENOMEM);
+
+        priv = hcd_to_priv(hcd);
+        init_memory(priv);
+        hcd->regs = ioremap(res_start, res_len);
+        if (!hcd->regs) {
+                ret = -EIO;
+                goto err_put;
+        }
+
+        ret = usb_add_hcd(hcd, irq, irqflags);
+        if (ret)
+                goto err_unmap;
+
+        hcd->irq = irq;
+        hcd->rsrc_start = res_start;
+        hcd->rsrc_len = res_len;
+
+        return hcd;
+
+err_unmap:
+         iounmap(hcd->regs);
+
+err_put:
+         usb_put_hcd(hcd);
+
+         return ERR_PTR(ret);
+}
+
+MODULE_DESCRIPTION("Driver for the ISP1760 USB-controller from NXP");
+MODULE_AUTHOR("Sebastian Siewior <bigeasy@linuxtronix.de>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/usb/host/isp1760-hcd.h b/drivers/usb/host/isp1760-hcd.h
new file mode 100644
index 00000000000..3d86d0f6b14
--- /dev/null
+++ b/drivers/usb/host/isp1760-hcd.h
@@ -0,0 +1,206 @@
+#ifndef _ISP1760_HCD_H_
+#define _ISP1760_HCD_H_
+
+/* exports for if */
+struct usb_hcd *isp1760_register(u64 res_start, u64 res_len, int irq,
+                u64 irqflags, struct device *dev, const char *busname);
+int init_kmem_once(void);
+void deinit_kmem_cache(void);
+
+/* EHCI capability registers */
+#define HC_CAPLENGTH            0x00
+#define HC_HCSPARAMS            0x04
+#define HC_HCCPARAMS            0x08
+
+/* EHCI operational registers */
+#define HC_USBCMD               0x20
+#define HC_USBSTS               0x24
+#define HC_FRINDEX              0x2c
+#define HC_CONFIGFLAG           0x60
+#define HC_PORTSC1              0x64
+#define HC_ISO_PTD_DONEMAP_REG  0x130
+#define HC_ISO_PTD_SKIPMAP_REG  0x134
+#define HC_ISO_PTD_LASTPTD_REG  0x138
+#define HC_INT_PTD_DONEMAP_REG  0x140
+#define HC_INT_PTD_SKIPMAP_REG  0x144
+#define HC_INT_PTD_LASTPTD_REG  0x148
+#define HC_ATL_PTD_DONEMAP_REG  0x150
+#define HC_ATL_PTD_SKIPMAP_REG  0x154
+#define HC_ATL_PTD_LASTPTD_REG  0x158
+
+/* Configuration Register */
+#define HC_HW_MODE_CTRL         0x300
+#define ALL_ATX_RESET           (1 << 31)
+#define HW_DATA_BUS_32BIT       (1 << 8)
+#define HW_DACK_POL_HIGH        (1 << 6)
+#define HW_DREQ_POL_HIGH        (1 << 5)
+#define HW_INTR_HIGH_ACT        (1 << 2)
+#define HW_INTR_EDGE_TRIG       (1 << 1)
+#define HW_GLOBAL_INTR_EN       (1 << 0)
+
+#define HC_CHIP_ID_REG          0x304
+#define HC_SCRATCH_REG          0x308
+
+#define HC_RESET_REG            0x30c
+#define SW_RESET_RESET_HC       (1 << 1)
+#define SW_RESET_RESET_ALL      (1 << 0)
+
+#define HC_BUFFER_STATUS_REG    0x334
+#define ATL_BUFFER              0x1
+#define INT_BUFFER              0x2
+#define ISO_BUFFER              0x4
+#define BUFFER_MAP              0x7
+
+#define HC_MEMORY_REG           0x33c
+#define HC_PORT1_CTRL           0x374
+#define PORT1_POWER             (3 << 3)
+#define PORT1_INIT1             (1 << 7)
+#define PORT1_INIT2             (1 << 23)
+
+/* Interrupt Register */
+#define HC_INTERRUPT_REG        0x310
+
+#define HC_INTERRUPT_ENABLE     0x314
+#define INTERRUPT_ENABLE_MASK   (HC_INTL_INT | HC_ATL_INT | HC_EOT_INT)
+#define FINAL_HW_CONFIG (HW_GLOBAL_INTR_EN | HW_DATA_BUS_32BIT)
+
+#define HC_ISO_INT              (1 << 9)
+#define HC_ATL_INT              (1 << 8)
+#define HC_INTL_INT             (1 << 7)
+#define HC_EOT_INT              (1 << 3)
+#define HC_SOT_INT              (1 << 1)
+
+#define HC_ISO_IRQ_MASK_OR_REG  0x318
+#define HC_INT_IRQ_MASK_OR_REG  0x31C
+#define HC_ATL_IRQ_MASK_OR_REG  0x320
+#define HC_ISO_IRQ_MASK_AND_REG 0x324
+#define HC_INT_IRQ_MASK_AND_REG 0x328
+#define HC_ATL_IRQ_MASK_AND_REG 0x32C
+
+/* Register sets */
+#define HC_BEGIN_OF_ATL         0x0c00
+#define HC_BEGIN_OF_INT         0x0800
+#define HC_BEGIN_OF_ISO         0x0400
+#define HC_BEGIN_OF_PAYLOAD     0x1000
+
+/* urb state*/
+#define DELETE_URB              (0x0008)
+#define NO_TRANSFER_ACTIVE      (0xffffffff)
+
+#define ATL_REGS_OFFSET         (0xc00)
+#define INT_REGS_OFFSET         (0x800)
+
+/* Philips Transfer Descriptor (PTD) */
+struct ptd {
+        __le32 dw0;
+        __le32 dw1;
+        __le32 dw2;
+        __le32 dw3;
+        __le32 dw4;
+        __le32 dw5;
+        __le32 dw6;
+        __le32 dw7;
+};
+
+struct inter_packet_info {
+        void *data_buffer;
+        u32 payload;
+#define PTD_FIRE_NEXT           (1 << 0)
+#define PTD_URB_FINISHED        (1 << 1)
+        struct urb *urb;
+        struct isp1760_qh *qh;
+        struct isp1760_qtd *qtd;
+};
+
+
+typedef void (packet_enqueue)(struct usb_hcd *hcd, struct isp1760_qh *qh,
+                struct isp1760_qtd *qtd);
+
+#define isp1760_info(priv, fmt, args...) \
+        dev_info(priv_to_hcd(priv)->self.controller, fmt, ##args)
+
+#define isp1760_err(priv, fmt, args...) \
+        dev_err(priv_to_hcd(priv)->self.controller, fmt, ##args)
+
+/* chip memory management */
+struct memory_chunk {
+        unsigned int start;
+        unsigned int size;
+        unsigned int free;
+};
+
+/*
+ * 60kb divided in:
+ * - 32 blocks @ 256  bytes
+ * - 20 blocks @ 1024 bytes
+ * -  4 blocks @ 8192 bytes
+ */
+
+#define BLOCK_1_NUM 32
+#define BLOCK_2_NUM 20
+#define BLOCK_3_NUM 4
+
+#define BLOCK_1_SIZE 256
+#define BLOCK_2_SIZE 1024
+#define BLOCK_3_SIZE 8192
+#define BLOCKS (BLOCK_1_NUM + BLOCK_2_NUM + BLOCK_3_NUM)
+#define PAYLOAD_SIZE 0xf000
+
+/* I saw if some reloads if the pointer was negative */
+#define ISP1760_NULL_POINTER    (0x400)
+
+/* ATL */
+/* DW0 */
+#define PTD_VALID                       1
+#define PTD_LENGTH(x)                   (((u32) x) << 3)
+#define PTD_MAXPACKET(x)                (((u32) x) << 18)
+#define PTD_MULTI(x)                    (((u32) x) << 29)
+#define PTD_ENDPOINT(x)                 (((u32) x) << 31)
+/* DW1 */
+#define PTD_DEVICE_ADDR(x)              (((u32) x) << 3)
+#define PTD_PID_TOKEN(x)                (((u32) x) << 10)
+#define PTD_TRANS_BULK                  ((u32) 2 << 12)
+#define PTD_TRANS_INT                   ((u32) 3 << 12)
+#define PTD_TRANS_SPLIT                 ((u32) 1 << 14)
+#define PTD_SE_USB_LOSPEED              ((u32) 2 << 16)
+#define PTD_PORT_NUM(x)                 (((u32) x) << 18)
+#define PTD_HUB_NUM(x)                  (((u32) x) << 25)
+#define PTD_PING(x)                     (((u32) x) << 26)
+/* DW2 */
+#define PTD_RL_CNT(x)                   (((u32) x) << 25)
+#define PTD_DATA_START_ADDR(x)          (((u32) x) << 8)
+#define BASE_ADDR                       0x1000
+/* DW3 */
+#define PTD_CERR(x)                     (((u32) x) << 23)
+#define PTD_NAC_CNT(x)                  (((u32) x) << 19)
+#define PTD_ACTIVE                      ((u32) 1 << 31)
+#define PTD_DATA_TOGGLE(x)              (((u32) x) << 25)
+
+#define DW3_HALT_BIT                    (1 << 30)
+#define DW3_ERROR_BIT                   (1 << 28)
+#define DW3_QTD_ACTIVE                  (1 << 31)
+
+#define INT_UNDERRUN                    (1 << 2)
+#define INT_BABBLE                      (1 << 1)
+#define INT_EXACT                       (1 << 0)
+
+#define DW1_GET_PID(x)                  (((x) >> 10) & 0x3)
+#define PTD_XFERRED_LENGTH(x)           ((x) & 0x7fff)
+#define PTD_XFERRED_LENGTH_LO(x)        ((x) & 0x7ff)
+
+#define SETUP_PID       (2)
+#define IN_PID          (1)
+#define OUT_PID         (0)
+#define GET_QTD_TOKEN_TYPE(x)   ((x) & 0x3)
+
+#define DATA_TOGGLE             (1 << 31)
+#define GET_DATA_TOGGLE(x)      ((x) >> 31)
+
+/* Errata 1 */
+#define RL_COUNTER      (0)
+#define NAK_COUNTER     (0)
+#define ERR_COUNTER     (2)
+
+#define HC_ATL_PL_SIZE  (8192)
+
+#endif
diff --git a/drivers/usb/host/isp1760-if.c b/drivers/usb/host/isp1760-if.c
new file mode 100644
index 00000000000..73fb2a38f1e
--- /dev/null
+++ b/drivers/usb/host/isp1760-if.c
@@ -0,0 +1,298 @@
+/*
+ * Glue code for the ISP1760 driver and bus
+ * Currently there is support for
+ * - OpenFirmware
+ * - PCI
+ *
+ * (c) 2007 Sebastian Siewior <bigeasy@linutronix.de>
+ *
+ */
+
+#include <linux/usb.h>
+#include <linux/io.h>
+
+#include "../core/hcd.h"
+#include "isp1760-hcd.h"
+
+#ifdef CONFIG_USB_ISP1760_OF
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#endif
+
+#ifdef CONFIG_USB_ISP1760_PCI
+#include <linux/pci.h>
+#endif
+
+#ifdef CONFIG_USB_ISP1760_OF
+static int of_isp1760_probe(struct of_device *dev,
+                const struct of_device_id *match)
+{
+        struct usb_hcd *hcd;
+        struct device_node *dp = dev->node;
+        struct resource *res;
+        struct resource memory;
+        struct of_irq oirq;
+        int virq;
+        u64 res_len;
+        int ret;
+
+        ret = of_address_to_resource(dp, 0, &memory);
+        if (ret)
+                return -ENXIO;
+
+        res = request_mem_region(memory.start, memory.end - memory.start + 1,
+                        dev->dev.bus_id);
+        if (!res)
+                return -EBUSY;
+
+        res_len = memory.end - memory.start + 1;
+
+        if (of_irq_map_one(dp, 0, &oirq)) {
+                ret = -ENODEV;
+                goto release_reg;
+        }
+
+        virq = irq_create_of_mapping(oirq.controller, oirq.specifier,
+                        oirq.size);
+
+        hcd = isp1760_register(memory.start, res_len, virq,
+                IRQF_SHARED | IRQF_DISABLED, &dev->dev, dev->dev.bus_id);
+        if (IS_ERR(hcd)) {
+                ret = PTR_ERR(hcd);
+                goto release_reg;
+        }
+
+        dev_set_drvdata(&dev->dev, hcd);
+        return ret;
+
+release_reg:
+        release_mem_region(memory.start, memory.end - memory.start + 1);
+        return ret;
+}
+
+static int of_isp1760_remove(struct of_device *dev)
+{
+        struct usb_hcd *hcd = dev_get_drvdata(&dev->dev);
+
+        dev_set_drvdata(&dev->dev, NULL);
+
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+        return 0;
+}
+
+static struct of_device_id of_isp1760_match[] = {
+        {
+                .compatible = "nxp,usb-isp1760",
+        },
+        { },
+};
+MODULE_DEVICE_TABLE(of, of_isp1760_match);
+
+static struct of_platform_driver isp1760_of_driver = {
+        .name           = "nxp-isp1760",
+        .match_table    = of_isp1760_match,
+        .probe          = of_isp1760_probe,
+        .remove         = of_isp1760_remove,
+};
+#endif
+
+#ifdef CONFIG_USB_ISP1760_PCI
+static u32 nxp_pci_io_base;
+static u32 iolength;
+static u32 pci_mem_phy0;
+static u32 length;
+static u8 *chip_addr;
+static u8 *iobase;
+
+static int __devinit isp1761_pci_probe(struct pci_dev *dev,
+                const struct pci_device_id *id)
+{
+        u8 latency, limit;
+        __u32 reg_data;
+        int retry_count;
+        int length;
+        int status = 1;
+        struct usb_hcd *hcd;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        if (pci_enable_device(dev) < 0)
+                return -ENODEV;
+
+        if (!dev->irq)
+                return -ENODEV;
+
+        /* Grab the PLX PCI mem maped port start address we need  */
+        nxp_pci_io_base = pci_resource_start(dev, 0);
+        iolength = pci_resource_len(dev, 0);
+
+        if (!request_mem_region(nxp_pci_io_base, iolength, "ISP1761 IO MEM")) {
+                printk(KERN_ERR "request region #1\n");
+                return -EBUSY;
+        }
+
+        iobase = ioremap_nocache(nxp_pci_io_base, iolength);
+        if (!iobase) {
+                printk(KERN_ERR "ioremap #1\n");
+                release_mem_region(nxp_pci_io_base, iolength);
+                return -ENOMEM;
+        }
+        /* Grab the PLX PCI shared memory of the ISP 1761 we need  */
+        pci_mem_phy0 = pci_resource_start(dev, 3);
+        length = pci_resource_len(dev, 3);
+
+        if (length < 0xffff) {
+                printk(KERN_ERR "memory length for this resource is less than "
+                                "required\n");
+                release_mem_region(nxp_pci_io_base, iolength);
+                iounmap(iobase);
+                return  -ENOMEM;
+        }
+
+        if (!request_mem_region(pci_mem_phy0, length, "ISP-PCI")) {
+                printk(KERN_ERR "host controller already in use\n");
+                release_mem_region(nxp_pci_io_base, iolength);
+                iounmap(iobase);
+                return -EBUSY;
+        }
+
+        /* bad pci latencies can contribute to overruns */
+        pci_read_config_byte(dev, PCI_LATENCY_TIMER, &latency);
+        if (latency) {
+                pci_read_config_byte(dev, PCI_MAX_LAT, &limit);
+                if (limit && limit < latency)
+                        pci_write_config_byte(dev, PCI_LATENCY_TIMER, limit);
+        }
+
+        /* Try to check whether we can access Scratch Register of
+         * Host Controller or not. The initial PCI access is retried until
+         * local init for the PCI bridge is completed
+         */
+        retry_count = 20;
+        reg_data = 0;
+        while ((reg_data != 0xFACE) && retry_count) {
+                /*by default host is in 16bit mode, so
+                 * io operations at this stage must be 16 bit
+                 * */
+                writel(0xface, chip_addr + HC_SCRATCH_REG);
+                udelay(100);
+                reg_data = readl(chip_addr + HC_SCRATCH_REG);
+                retry_count--;
+        }
+
+        /* Host Controller presence is detected by writing to scratch register
+         * and reading back and checking the contents are same or not
+         */
+        if (reg_data != 0xFACE) {
+                err("scratch register mismatch %x", reg_data);
+                goto clean;
+        }
+
+        pci_set_master(dev);
+
+        status = readl(iobase + 0x68);
+        status |= 0x900;
+        writel(status, iobase + 0x68);
+
+        dev->dev.dma_mask = NULL;
+        hcd = isp1760_register(pci_mem_phy0, length, dev->irq,
+                IRQF_SHARED | IRQF_DISABLED, &dev->dev, dev->dev.bus_id);
+        pci_set_drvdata(dev, hcd);
+        if (!hcd)
+                return 0;
+clean:
+        status = -ENODEV;
+        iounmap(iobase);
+        release_mem_region(pci_mem_phy0, length);
+        release_mem_region(nxp_pci_io_base, iolength);
+        return status;
+}
+static void isp1761_pci_remove(struct pci_dev *dev)
+{
+        struct usb_hcd *hcd;
+
+        hcd = pci_get_drvdata(dev);
+
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+
+        pci_disable_device(dev);
+
+        iounmap(iobase);
+        iounmap(chip_addr);
+
+        release_mem_region(nxp_pci_io_base, iolength);
+        release_mem_region(pci_mem_phy0, length);
+}
+
+static void isp1761_pci_shutdown(struct pci_dev *dev)
+{
+        printk(KERN_ERR "ips1761_pci_shutdown\n");
+}
+
+static const struct pci_device_id isp1760_plx [] = { {
+        /* handle any USB 2.0 EHCI controller */
+        PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_OTHER << 8) | (0x06 << 16)), ~0),
+                .driver_data = 0,
+},
+{ /* end: all zeroes */ }
+};
+MODULE_DEVICE_TABLE(pci, isp1760_plx);
+
+static struct pci_driver isp1761_pci_driver = {
+        .name =         "isp1760",
+        .id_table =     isp1760_plx,
+        .probe =        isp1761_pci_probe,
+        .remove =       isp1761_pci_remove,
+        .shutdown =     isp1761_pci_shutdown,
+};
+#endif
+
+static int __init isp1760_init(void)
+{
+        int ret;
+
+        init_kmem_once();
+
+#ifdef CONFIG_USB_ISP1760_OF
+        ret = of_register_platform_driver(&isp1760_of_driver);
+        if (ret) {
+                deinit_kmem_cache();
+                return ret;
+        }
+#endif
+#ifdef CONFIG_USB_ISP1760_PCI
+        ret = pci_register_driver(&isp1761_pci_driver);
+        if (ret)
+                goto unreg_of;
+#endif
+        return ret;
+
+#ifdef CONFIG_USB_ISP1760_PCI
+unreg_of:
+#endif
+#ifdef CONFIG_USB_ISP1760_OF
+        of_unregister_platform_driver(&isp1760_of_driver);
+#endif
+        deinit_kmem_cache();
+        return ret;
+}
+module_init(isp1760_init);
+
+static void __exit isp1760_exit(void)
+{
+#ifdef CONFIG_USB_ISP1760_OF
+        of_unregister_platform_driver(&isp1760_of_driver);
+#endif
+#ifdef CONFIG_USB_ISP1760_PCI
+        pci_unregister_driver(&isp1761_pci_driver);
+#endif
+        deinit_kmem_cache();
+}
+module_exit(isp1760_exit);
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 17dc2eccda8..79a78029f89 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -613,7 +613,7 @@ static void start_hnp(struct ohci_hcd *ohci);
 static inline int root_port_reset (struct ohci_hcd *ohci, unsigned port)
 {
         __hc32 __iomem *portstat = &ohci->regs->roothub.portstatus [port];
-        u32     temp;
+        u32     temp = 0;
         u16     now = ohci_readl(ohci, &ohci->regs->fmnumber);
         u16     reset_done = now + PORT_RESET_MSEC;
         int     limit_1 = DIV_ROUND_UP(PORT_RESET_MSEC, PORT_RESET_HW_MSEC);
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index d3e0d8aa398..3a7bfe7a887 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -234,7 +234,7 @@ static int resume_detect_interrupts_are_broken(struct uhci_hcd *uhci)
         return 0;
 }
 
-static int remote_wakeup_is_broken(struct uhci_hcd *uhci)
+static int global_suspend_mode_is_broken(struct uhci_hcd *uhci)
 {
         int port;
         const char *sys_info;
@@ -261,27 +261,60 @@ __releases(uhci->lock)
 __acquires(uhci->lock)
 {
         int auto_stop;
-        int int_enable, egsm_enable;
+        int int_enable, egsm_enable, wakeup_enable;
         struct usb_device *rhdev = uhci_to_hcd(uhci)->self.root_hub;
 
         auto_stop = (new_state == UHCI_RH_AUTO_STOPPED);
         dev_dbg(&rhdev->dev, "%s%s\n", __func__,
                         (auto_stop ? " (auto-stop)" : ""));
 
-        /* Enable resume-detect interrupts if they work.
-         * Then enter Global Suspend mode if _it_ works, still configured.
+        /* Start off by assuming Resume-Detect interrupts and EGSM work
+         * and that remote wakeups should be enabled.
          */
         egsm_enable = USBCMD_EGSM;
-        uhci->working_RD = 1;
+        uhci->RD_enable = 1;
         int_enable = USBINTR_RESUME;
-        if (remote_wakeup_is_broken(uhci))
-                egsm_enable = 0;
-        if (resume_detect_interrupts_are_broken(uhci) || !egsm_enable ||
+        wakeup_enable = 1;
+
+        /* In auto-stop mode wakeups must always be detected, but
+         * Resume-Detect interrupts may be prohibited.  (In the absence
+         * of CONFIG_PM, they are always disallowed.)
+         */
+        if (auto_stop) {
+                if (!device_may_wakeup(&rhdev->dev))
+                        int_enable = 0;
+
+        /* In bus-suspend mode wakeups may be disabled, but if they are
+         * allowed then so are Resume-Detect interrupts.
+         */
+        } else {
 #ifdef CONFIG_PM
-                        (!auto_stop && !rhdev->do_remote_wakeup) ||
+                if (!rhdev->do_remote_wakeup)
+                        wakeup_enable = 0;
 #endif
-                        (auto_stop && !device_may_wakeup(&rhdev->dev)))
-                uhci->working_RD = int_enable = 0;
+        }
+
+        /* EGSM causes the root hub to echo a 'K' signal (resume) out any
+         * port which requests a remote wakeup.  According to the USB spec,
+         * every hub is supposed to do this.  But if we are ignoring
+         * remote-wakeup requests anyway then there's no point to it.
+         * We also shouldn't enable EGSM if it's broken.
+         */
+        if (!wakeup_enable || global_suspend_mode_is_broken(uhci))
+                egsm_enable = 0;
+
+        /* If we're ignoring wakeup events then there's no reason to
+         * enable Resume-Detect interrupts.  We also shouldn't enable
+         * them if they are broken or disallowed.
+         *
+         * This logic may lead us to enabling RD but not EGSM.  The UHCI
+         * spec foolishly says that RD works only when EGSM is on, but
+         * there's no harm in enabling it anyway -- perhaps some chips
+         * will implement it!
+         */
+        if (!wakeup_enable || resume_detect_interrupts_are_broken(uhci) ||
+                        !int_enable)
+                uhci->RD_enable = int_enable = 0;
 
         outw(int_enable, uhci->io_addr + USBINTR);
         outw(egsm_enable | USBCMD_CF, uhci->io_addr + USBCMD);
@@ -308,7 +341,11 @@ __acquires(uhci->lock)
 
         uhci->rh_state = new_state;
         uhci->is_stopped = UHCI_IS_STOPPED;
-        uhci_to_hcd(uhci)->poll_rh = !int_enable;
+
+        /* If interrupts don't work and remote wakeup is enabled then
+         * the suspended root hub needs to be polled.
+         */
+        uhci_to_hcd(uhci)->poll_rh = (!int_enable && wakeup_enable);
 
         uhci_scan_schedule(uhci);
         uhci_fsbr_off(uhci);
@@ -344,9 +381,12 @@ __acquires(uhci->lock)
          * for 20 ms.
          */
         if (uhci->rh_state == UHCI_RH_SUSPENDED) {
+                unsigned egsm;
+
+                /* Keep EGSM on if it was set before */
+                egsm = inw(uhci->io_addr + USBCMD) & USBCMD_EGSM;
                 uhci->rh_state = UHCI_RH_RESUMING;
-                outw(USBCMD_FGR | USBCMD_EGSM | USBCMD_CF,
-                                uhci->io_addr + USBCMD);
+                outw(USBCMD_FGR | USBCMD_CF | egsm, uhci->io_addr + USBCMD);
                 spin_unlock_irq(&uhci->lock);
                 msleep(20);
                 spin_lock_irq(&uhci->lock);
@@ -801,8 +841,10 @@ static int uhci_pci_resume(struct usb_hcd *hcd)
 
         spin_unlock_irq(&uhci->lock);
 
-        if (!uhci->working_RD) {
-                /* Suspended root hub needs to be polled */
+        /* If interrupts don't work and remote wakeup is enabled then
+         * the suspended root hub needs to be polled.
+         */
+        if (!uhci->RD_enable && hcd->self.root_hub->do_remote_wakeup) {
                 hcd->poll_rh = 1;
                 usb_hcd_poll_rh_status(hcd);
         }
diff --git a/drivers/usb/host/uhci-hcd.h b/drivers/usb/host/uhci-hcd.h
index 340d6ed3e6e..7d01c5677f9 100644
--- a/drivers/usb/host/uhci-hcd.h
+++ b/drivers/usb/host/uhci-hcd.h
@@ -400,8 +400,9 @@ struct uhci_hcd {
         unsigned int scan_in_progress:1;        /* Schedule scan is running */
         unsigned int need_rescan:1;             /* Redo the schedule scan */
         unsigned int dead:1;                    /* Controller has died */
-        unsigned int working_RD:1;              /* Suspended root hub doesn't
-                                                   need to be polled */
+        unsigned int RD_enable:1;               /* Suspended root hub with
+                                                   Resume-Detect interrupts
+                                                   enabled */
         unsigned int is_initialized:1;          /* Data structure is usable */
         unsigned int fsbr_is_on:1;              /* FSBR is turned on */
         unsigned int fsbr_is_wanted:1;          /* Does any URB want FSBR? */
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index 11580e81e2c..7aafd53fbca 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -148,7 +148,7 @@ MODULE_PARM_DESC(min_interrupt_out_interval, "Minimum interrupt out interval in
 
 /* Structure to hold all of our device specific stuff */
 struct ld_usb {
-        struct semaphore        sem;            /* locks this structure */
+        struct mutex            mutex;          /* locks this structure */
         struct usb_interface*   intf;           /* save off the usb interface pointer */
 
         int                     open_count;     /* number of times this port has been opened */
@@ -319,7 +319,7 @@ static int ld_usb_open(struct inode *inode, struct file *file)
                 return -ENODEV;
 
         /* lock this device */
-        if (down_interruptible(&dev->sem))
+        if (mutex_lock_interruptible(&dev->mutex))
                 return -ERESTARTSYS;
 
         /* allow opening only once */
@@ -358,7 +358,7 @@ static int ld_usb_open(struct inode *inode, struct file *file)
         file->private_data = dev;
 
 unlock_exit:
-        up(&dev->sem);
+        mutex_unlock(&dev->mutex);
 
         return retval;
 }
@@ -378,7 +378,7 @@ static int ld_usb_release(struct inode *inode, struct file *file)
                 goto exit;
         }
 
-        if (down_interruptible(&dev->sem)) {
+        if (mutex_lock_interruptible(&dev->mutex)) {
                 retval = -ERESTARTSYS;
                 goto exit;
         }
@@ -389,7 +389,7 @@ static int ld_usb_release(struct inode *inode, struct file *file)
         }
         if (dev->intf == NULL) {
                 /* the device was unplugged before the file was released */
-                up(&dev->sem);
+                mutex_unlock(&dev->mutex);
                 /* unlock here as ld_usb_delete frees dev */
                 ld_usb_delete(dev);
                 goto exit;
@@ -402,7 +402,7 @@ static int ld_usb_release(struct inode *inode, struct file *file)
         dev->open_count = 0;
 
 unlock_exit:
-        up(&dev->sem);
+        mutex_unlock(&dev->mutex);
 
 exit:
         return retval;
@@ -448,7 +448,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
                 goto exit;
 
         /* lock this object */
-        if (down_interruptible(&dev->sem)) {
+        if (mutex_lock_interruptible(&dev->mutex)) {
                 retval = -ERESTARTSYS;
                 goto exit;
         }
@@ -505,7 +505,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
 
 unlock_exit:
         /* unlock the device */
-        up(&dev->sem);
+        mutex_unlock(&dev->mutex);
 
 exit:
         return retval;
@@ -528,7 +528,7 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer,
                 goto exit;
 
         /* lock this object */
-        if (down_interruptible(&dev->sem)) {
+        if (mutex_lock_interruptible(&dev->mutex)) {
                 retval = -ERESTARTSYS;
                 goto exit;
         }
@@ -602,7 +602,7 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer,
 
 unlock_exit:
         /* unlock the device */
-        up(&dev->sem);
+        mutex_unlock(&dev->mutex);
 
 exit:
         return retval;
@@ -651,7 +651,7 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
                 dev_err(&intf->dev, "Out of memory\n");
                 goto exit;
         }
-        init_MUTEX(&dev->sem);
+        mutex_init(&dev->mutex);
         spin_lock_init(&dev->rbsl);
         dev->intf = intf;
         init_waitqueue_head(&dev->read_wait);
@@ -765,15 +765,15 @@ static void ld_usb_disconnect(struct usb_interface *intf)
         /* give back our minor */
         usb_deregister_dev(intf, &ld_usb_class);
 
-        down(&dev->sem);
+        mutex_lock(&dev->mutex);
 
         /* if the device is not opened, then we clean up right now */
         if (!dev->open_count) {
-                up(&dev->sem);
+                mutex_unlock(&dev->mutex);
                 ld_usb_delete(dev);
         } else {
                 dev->intf = NULL;
-                up(&dev->sem);
+                mutex_unlock(&dev->mutex);
         }
 
         dev_info(&intf->dev, "LD USB Device #%d now disconnected\n",
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index a51983854ca..742be3c3594 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -79,30 +79,10 @@ static struct usb_device *testdev_to_usbdev (struct usbtest_dev *test)
 /* set up all urbs so they can be used with either bulk or interrupt */
 #define INTERRUPT_RATE          1       /* msec/transfer */
 
-#define xprintk(tdev,level,fmt,args...) \
-        dev_printk(level ,  &(tdev)->intf->dev ,  fmt ,  ## args)
-
-#ifdef DEBUG
-#define DBG(dev,fmt,args...) \
-        xprintk(dev , KERN_DEBUG , fmt , ## args)
-#else
-#define DBG(dev,fmt,args...) \
-        do { } while (0)
-#endif /* DEBUG */
-
-#ifdef VERBOSE
-#define VDBG DBG
-#else
-#define VDBG(dev,fmt,args...) \
-        do { } while (0)
-#endif  /* VERBOSE */
-
-#define ERROR(dev,fmt,args...) \
-        xprintk(dev , KERN_ERR , fmt , ## args)
-#define WARN(dev,fmt,args...) \
-        xprintk(dev , KERN_WARNING , fmt , ## args)
-#define INFO(dev,fmt,args...) \
-        xprintk(dev , KERN_INFO , fmt , ## args)
+#define ERROR(tdev, fmt, args...) \
+        dev_err(&(tdev)->intf->dev , fmt , ## args)
+#define WARN(tdev, fmt, args...) \
+        dev_warn(&(tdev)->intf->dev , fmt , ## args)
 
 /*-------------------------------------------------------------------------*/
 
@@ -236,7 +216,7 @@ static struct urb *simple_alloc_urb (
 
 static unsigned pattern = 0;
 module_param (pattern, uint, S_IRUGO);
-// MODULE_PARM_DESC (pattern, "i/o pattern (0 == zeroes)");
+MODULE_PARM_DESC(pattern, "i/o pattern (0 == zeroes)");
 
 static inline void simple_fill_buf (struct urb *urb)
 {
@@ -257,7 +237,7 @@ static inline void simple_fill_buf (struct urb *urb)
         }
 }
 
-static inline int simple_check_buf (struct urb *urb)
+static inline int simple_check_buf(struct usbtest_dev *tdev, struct urb *urb)
 {
         unsigned        i;
         u8              expected;
@@ -285,7 +265,7 @@ static inline int simple_check_buf (struct urb *urb)
                 }
                 if (*buf == expected)
                         continue;
-                dbg ("buf[%d] = %d (not %d)", i, *buf, expected);
+                ERROR(tdev, "buf[%d] = %d (not %d)\n", i, *buf, expected);
                 return -EINVAL;
         }
         return 0;
@@ -299,6 +279,7 @@ static void simple_free_urb (struct urb *urb)
 }
 
 static int simple_io (
+        struct usbtest_dev      *tdev,
         struct urb              *urb,
         int                     iterations,
         int                     vary,
@@ -324,7 +305,7 @@ static int simple_io (
                 retval = urb->status;
                 urb->dev = udev;
                 if (retval == 0 && usb_pipein (urb->pipe))
-                        retval = simple_check_buf (urb);
+                        retval = simple_check_buf(tdev, urb);
 
                 if (vary) {
                         int     len = urb->transfer_buffer_length;
@@ -341,7 +322,7 @@ static int simple_io (
         urb->transfer_buffer_length = max;
 
         if (expected != retval)
-                dev_dbg (&udev->dev,
+                dev_err(&udev->dev,
                         "%s failed, iterations left %d, status %d (not %d)\n",
                                 label, iterations, retval, expected);
         return retval;
@@ -357,7 +338,7 @@ static int simple_io (
 static void free_sglist (struct scatterlist *sg, int nents)
 {
         unsigned                i;
-        
+
         if (!sg)
                 return;
         for (i = 0; i < nents; i++) {
@@ -415,7 +396,7 @@ alloc_sglist (int nents, int max, int vary)
 }
 
 static int perform_sglist (
-        struct usb_device       *udev,
+        struct usbtest_dev      *tdev,
         unsigned                iterations,
         int                     pipe,
         struct usb_sg_request   *req,
@@ -423,6 +404,7 @@ static int perform_sglist (
         int                     nents
 )
 {
+        struct usb_device       *udev = testdev_to_usbdev(tdev);
         int                     retval = 0;
 
         while (retval == 0 && iterations-- > 0) {
@@ -431,7 +413,7 @@ static int perform_sglist (
                                         ? (INTERRUPT_RATE << 3)
                                         : INTERRUPT_RATE,
                                 sg, nents, 0, GFP_KERNEL);
-                
+
                 if (retval)
                         break;
                 usb_sg_wait (req);
@@ -446,7 +428,8 @@ static int perform_sglist (
         // failure if retval is as we expected ...
 
         if (retval)
-                dbg ("perform_sglist failed, iterations left %d, status %d",
+                ERROR(tdev, "perform_sglist failed, "
+                                "iterations left %d, status %d\n",
                                 iterations, retval);
         return retval;
 }
@@ -505,28 +488,28 @@ static int set_altsetting (struct usbtest_dev *dev, int alternate)
                         alternate);
 }
 
-static int is_good_config (char *buf, int len)
+static int is_good_config(struct usbtest_dev *tdev, int len)
 {
         struct usb_config_descriptor    *config;
-        
+
         if (len < sizeof *config)
                 return 0;
-        config = (struct usb_config_descriptor *) buf;
+        config = (struct usb_config_descriptor *) tdev->buf;
 
         switch (config->bDescriptorType) {
         case USB_DT_CONFIG:
         case USB_DT_OTHER_SPEED_CONFIG:
                 if (config->bLength != 9) {
-                        dbg ("bogus config descriptor length");
+                        ERROR(tdev, "bogus config descriptor length\n");
                         return 0;
                 }
                 /* this bit 'must be 1' but often isn't */
                 if (!realworld && !(config->bmAttributes & 0x80)) {
-                        dbg ("high bit of config attributes not set");
+                        ERROR(tdev, "high bit of config attributes not set\n");
                         return 0;
                 }
                 if (config->bmAttributes & 0x1f) {      /* reserved == 0 */
-                        dbg ("reserved config bits set");
+                        ERROR(tdev, "reserved config bits set\n");
                         return 0;
                 }
                 break;
@@ -538,7 +521,7 @@ static int is_good_config (char *buf, int len)
                 return 1;
         if (le16_to_cpu(config->wTotalLength) >= TBUF_SIZE)             /* max partial read */
                 return 1;
-        dbg ("bogus config descriptor read size");
+        ERROR(tdev, "bogus config descriptor read size\n");
         return 0;
 }
 
@@ -571,7 +554,7 @@ static int ch9_postconfig (struct usbtest_dev *dev)
                 /* 9.2.3 constrains the range here */
                 alt = iface->altsetting [i].desc.bAlternateSetting;
                 if (alt < 0 || alt >= iface->num_altsetting) {
-                        dev_dbg (&iface->dev,
+                        dev_err(&iface->dev,
                                         "invalid alt [%d].bAltSetting = %d\n",
                                         i, alt);
                 }
@@ -583,7 +566,7 @@ static int ch9_postconfig (struct usbtest_dev *dev)
                 /* [9.4.10] set_interface */
                 retval = set_altsetting (dev, alt);
                 if (retval) {
-                        dev_dbg (&iface->dev, "can't set_interface = %d, %d\n",
+                        dev_err(&iface->dev, "can't set_interface = %d, %d\n",
                                         alt, retval);
                         return retval;
                 }
@@ -591,7 +574,7 @@ static int ch9_postconfig (struct usbtest_dev *dev)
                 /* [9.4.4] get_interface always works */
                 retval = get_altsetting (dev);
                 if (retval != alt) {
-                        dev_dbg (&iface->dev, "get alt should be %d, was %d\n",
+                        dev_err(&iface->dev, "get alt should be %d, was %d\n",
                                         alt, retval);
                         return (retval < 0) ? retval : -EDOM;
                 }
@@ -611,7 +594,7 @@ static int ch9_postconfig (struct usbtest_dev *dev)
                                 USB_DIR_IN | USB_RECIP_DEVICE,
                                 0, 0, dev->buf, 1, USB_CTRL_GET_TIMEOUT);
                 if (retval != 1 || dev->buf [0] != expected) {
-                        dev_dbg (&iface->dev, "get config --> %d %d (1 %d)\n",
+                        dev_err(&iface->dev, "get config --> %d %d (1 %d)\n",
                                 retval, dev->buf[0], expected);
                         return (retval < 0) ? retval : -EDOM;
                 }
@@ -621,7 +604,7 @@ static int ch9_postconfig (struct usbtest_dev *dev)
         retval = usb_get_descriptor (udev, USB_DT_DEVICE, 0,
                         dev->buf, sizeof udev->descriptor);
         if (retval != sizeof udev->descriptor) {
-                dev_dbg (&iface->dev, "dev descriptor --> %d\n", retval);
+                dev_err(&iface->dev, "dev descriptor --> %d\n", retval);
                 return (retval < 0) ? retval : -EDOM;
         }
 
@@ -629,8 +612,8 @@ static int ch9_postconfig (struct usbtest_dev *dev)
         for (i = 0; i < udev->descriptor.bNumConfigurations; i++) {
                 retval = usb_get_descriptor (udev, USB_DT_CONFIG, i,
                                 dev->buf, TBUF_SIZE);
-                if (!is_good_config (dev->buf, retval)) {
-                        dev_dbg (&iface->dev,
+                if (!is_good_config(dev, retval)) {
+                        dev_err(&iface->dev,
                                         "config [%d] descriptor --> %d\n",
                                         i, retval);
                         return (retval < 0) ? retval : -EDOM;
@@ -650,14 +633,14 @@ static int ch9_postconfig (struct usbtest_dev *dev)
                                 sizeof (struct usb_qualifier_descriptor));
                 if (retval == -EPIPE) {
                         if (udev->speed == USB_SPEED_HIGH) {
-                                dev_dbg (&iface->dev,
+                                dev_err(&iface->dev,
                                                 "hs dev qualifier --> %d\n",
                                                 retval);
                                 return (retval < 0) ? retval : -EDOM;
                         }
                         /* usb2.0 but not high-speed capable; fine */
                 } else if (retval != sizeof (struct usb_qualifier_descriptor)) {
-                        dev_dbg (&iface->dev, "dev qualifier --> %d\n", retval);
+                        dev_err(&iface->dev, "dev qualifier --> %d\n", retval);
                         return (retval < 0) ? retval : -EDOM;
                 } else
                         d = (struct usb_qualifier_descriptor *) dev->buf;
@@ -669,8 +652,8 @@ static int ch9_postconfig (struct usbtest_dev *dev)
                                 retval = usb_get_descriptor (udev,
                                         USB_DT_OTHER_SPEED_CONFIG, i,
                                         dev->buf, TBUF_SIZE);
-                                if (!is_good_config (dev->buf, retval)) {
-                                        dev_dbg (&iface->dev,
+                                if (!is_good_config(dev, retval)) {
+                                        dev_err(&iface->dev,
                                                 "other speed config --> %d\n",
                                                 retval);
                                         return (retval < 0) ? retval : -EDOM;
@@ -683,7 +666,7 @@ static int ch9_postconfig (struct usbtest_dev *dev)
         /* [9.4.5] get_status always works */
         retval = usb_get_status (udev, USB_RECIP_DEVICE, 0, dev->buf);
         if (retval != 2) {
-                dev_dbg (&iface->dev, "get dev status --> %d\n", retval);
+                dev_err(&iface->dev, "get dev status --> %d\n", retval);
                 return (retval < 0) ? retval : -EDOM;
         }
 
@@ -693,11 +676,11 @@ static int ch9_postconfig (struct usbtest_dev *dev)
         retval = usb_get_status (udev, USB_RECIP_INTERFACE,
                         iface->altsetting [0].desc.bInterfaceNumber, dev->buf);
         if (retval != 2) {
-                dev_dbg (&iface->dev, "get interface status --> %d\n", retval);
+                dev_err(&iface->dev, "get interface status --> %d\n", retval);
                 return (retval < 0) ? retval : -EDOM;
         }
         // FIXME get status for each endpoint in the interface
-        
+
         return 0;
 }
 
@@ -752,8 +735,9 @@ static void ctrl_complete (struct urb *urb)
          */
         if (subcase->number > 0) {
                 if ((subcase->number - ctx->last) != 1) {
-                        dbg ("subcase %d completed out of order, last %d",
-                                        subcase->number, ctx->last);
+                        ERROR(ctx->dev,
+                                "subcase %d completed out of order, last %d\n",
+                                subcase->number, ctx->last);
                         status = -EDOM;
                         ctx->last = subcase->number;
                         goto error;
@@ -777,7 +761,7 @@ static void ctrl_complete (struct urb *urb)
                 else if (subcase->number == 12 && status == -EPIPE)
                         status = 0;
                 else
-                        dbg ("subtest %d error, status %d",
+                        ERROR(ctx->dev, "subtest %d error, status %d\n",
                                         subcase->number, status);
         }
 
@@ -788,9 +772,12 @@ error:
                         int             i;
 
                         ctx->status = status;
-                        info ("control queue %02x.%02x, err %d, %d left",
+                        ERROR(ctx->dev, "control queue %02x.%02x, err %d, "
+                                        "%d left, subcase %d, len %d/%d\n",
                                         reqp->bRequestType, reqp->bRequest,
-                                        status, ctx->count);
+                                        status, ctx->count, subcase->number,
+                                        urb->actual_length,
+                                        urb->transfer_buffer_length);
 
                         /* FIXME this "unlink everything" exit route should
                          * be a separate test case.
@@ -799,7 +786,8 @@ error:
                         /* unlink whatever's still pending */
                         for (i = 1; i < ctx->param->sglen; i++) {
                                 struct urb      *u = ctx->urb [
-        (i + subcase->number) % ctx->param->sglen];
+                                                (i + subcase->number)
+                                                % ctx->param->sglen];
 
                                 if (u == urb || !u->dev)
                                         continue;
@@ -812,7 +800,8 @@ error:
                                 case -EIDRM:
                                         continue;
                                 default:
-                                        dbg ("urb unlink --> %d", status);
+                                        ERROR(ctx->dev, "urb unlink --> %d\n",
+                                                        status);
                                 }
                         }
                         status = ctx->status;
@@ -822,14 +811,15 @@ error:
         /* resubmit if we need to, else mark this as done */
         if ((status == 0) && (ctx->pending < ctx->count)) {
                 if ((status = usb_submit_urb (urb, GFP_ATOMIC)) != 0) {
-                        dbg ("can't resubmit ctrl %02x.%02x, err %d",
+                        ERROR(ctx->dev,
+                                "can't resubmit ctrl %02x.%02x, err %d\n",
                                 reqp->bRequestType, reqp->bRequest, status);
                         urb->dev = NULL;
                 } else
                         ctx->pending++;
         } else
                 urb->dev = NULL;
-        
+
         /* signal completion when nothing's queued */
         if (ctx->pending == 0)
                 complete (&ctx->complete);
@@ -918,11 +908,11 @@ test_ctrl_queue (struct usbtest_dev *dev, struct usbtest_param *param)
                         req.wValue = cpu_to_le16 (USB_DT_INTERFACE << 8);
                         // interface == 0
                         len = sizeof (struct usb_interface_descriptor);
-                        expected = EPIPE;
+                        expected = -EPIPE;
                         break;
                 // NOTE: two consecutive stalls in the queue here.
                 // that tests fault recovery a bit more aggressively.
-                case 8:         // clear endpoint halt (USUALLY STALLS)
+                case 8:         // clear endpoint halt (MAY STALL)
                         req.bRequest = USB_REQ_CLEAR_FEATURE;
                         req.bRequestType = USB_RECIP_ENDPOINT;
                         // wValue 0 == ep halt
@@ -965,7 +955,7 @@ test_ctrl_queue (struct usbtest_dev *dev, struct usbtest_param *param)
                         break;
                 case 14:        // short read; try to fill the last packet
                         req.wValue = cpu_to_le16 ((USB_DT_DEVICE << 8) | 0);
-                        // device descriptor size == 18 bytes 
+                        /* device descriptor size == 18 bytes */
                         len = udev->descriptor.bMaxPacketSize0;
                         switch (len) {
                         case 8:         len = 24; break;
@@ -974,7 +964,7 @@ test_ctrl_queue (struct usbtest_dev *dev, struct usbtest_param *param)
                         expected = -EREMOTEIO;
                         break;
                 default:
-                        err ("bogus number of ctrl queue testcases!");
+                        ERROR(dev, "bogus number of ctrl queue testcases!\n");
                         context.status = -EINVAL;
                         goto cleanup;
                 }
@@ -1003,7 +993,7 @@ test_ctrl_queue (struct usbtest_dev *dev, struct usbtest_param *param)
         for (i = 0; i < param->sglen; i++) {
                 context.status = usb_submit_urb (urb [i], GFP_ATOMIC);
                 if (context.status != 0) {
-                        dbg ("can't submit urb[%d], status %d",
+                        ERROR(dev, "can't submit urb[%d], status %d\n",
                                         i, context.status);
                         context.count = context.pending;
                         break;
@@ -1070,7 +1060,7 @@ static int unlink1 (struct usbtest_dev *dev, int pipe, int size, int async)
          * due to errors, or is just NAKing requests.
          */
         if ((retval = usb_submit_urb (urb, GFP_KERNEL)) != 0) {
-                dev_dbg (&dev->intf->dev, "submit fail %d\n", retval);
+                dev_err(&dev->intf->dev, "submit fail %d\n", retval);
                 return retval;
         }
 
@@ -1087,13 +1077,13 @@ retry:
                          * "normal" drivers would prevent resubmission, but
                          * since we're testing unlink paths, we can't.
                          */
-                        dev_dbg (&dev->intf->dev, "unlink retry\n");
+                        ERROR(dev,  "unlink retry\n");
                         goto retry;
                 }
         } else
                 usb_kill_urb (urb);
         if (!(retval == 0 || retval == -EINPROGRESS)) {
-                dev_dbg (&dev->intf->dev, "unlink fail %d\n", retval);
+                dev_err(&dev->intf->dev, "unlink fail %d\n", retval);
                 return retval;
         }
 
@@ -1121,7 +1111,7 @@ static int unlink_simple (struct usbtest_dev *dev, int pipe, int len)
 
 /*-------------------------------------------------------------------------*/
 
-static int verify_not_halted (int ep, struct urb *urb)
+static int verify_not_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
 {
         int     retval;
         u16     status;
@@ -1129,20 +1119,21 @@ static int verify_not_halted (int ep, struct urb *urb)
         /* shouldn't look or act halted */
         retval = usb_get_status (urb->dev, USB_RECIP_ENDPOINT, ep, &status);
         if (retval < 0) {
-                dbg ("ep %02x couldn't get no-halt status, %d", ep, retval);
+                ERROR(tdev, "ep %02x couldn't get no-halt status, %d\n",
+                                ep, retval);
                 return retval;
         }
         if (status != 0) {
-                dbg ("ep %02x bogus status: %04x != 0", ep, status);
+                ERROR(tdev, "ep %02x bogus status: %04x != 0\n", ep, status);
                 return -EINVAL;
         }
-        retval = simple_io (urb, 1, 0, 0, __func__);
+        retval = simple_io(tdev, urb, 1, 0, 0, __func__);
         if (retval != 0)
                 return -EINVAL;
         return 0;
 }
 
-static int verify_halted (int ep, struct urb *urb)
+static int verify_halted(struct usbtest_dev *tdev, int ep, struct urb *urb)
 {
         int     retval;
         u16     status;
@@ -1150,29 +1141,30 @@ static int verify_halted (int ep, struct urb *urb)
         /* should look and act halted */
         retval = usb_get_status (urb->dev, USB_RECIP_ENDPOINT, ep, &status);
         if (retval < 0) {
-                dbg ("ep %02x couldn't get halt status, %d", ep, retval);
+                ERROR(tdev, "ep %02x couldn't get halt status, %d\n",
+                                ep, retval);
                 return retval;
         }
         le16_to_cpus(&status);
         if (status != 1) {
-                dbg ("ep %02x bogus status: %04x != 1", ep, status);
+                ERROR(tdev, "ep %02x bogus status: %04x != 1\n", ep, status);
                 return -EINVAL;
         }
-        retval = simple_io (urb, 1, 0, -EPIPE, __func__);
+        retval = simple_io(tdev, urb, 1, 0, -EPIPE, __func__);
         if (retval != -EPIPE)
                 return -EINVAL;
-        retval = simple_io (urb, 1, 0, -EPIPE, "verify_still_halted");
+        retval = simple_io(tdev, urb, 1, 0, -EPIPE, "verify_still_halted");
         if (retval != -EPIPE)
                 return -EINVAL;
         return 0;
 }
 
-static int test_halt (int ep, struct urb *urb)
+static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
 {
         int     retval;
 
         /* shouldn't look or act halted now */
-        retval = verify_not_halted (ep, urb);
+        retval = verify_not_halted(tdev, ep, urb);
         if (retval < 0)
                 return retval;
 
@@ -1182,20 +1174,20 @@ static int test_halt (int ep, struct urb *urb)
                         USB_ENDPOINT_HALT, ep,
                         NULL, 0, USB_CTRL_SET_TIMEOUT);
         if (retval < 0) {
-                dbg ("ep %02x couldn't set halt, %d", ep, retval);
+                ERROR(tdev, "ep %02x couldn't set halt, %d\n", ep, retval);
                 return retval;
         }
-        retval = verify_halted (ep, urb);
+        retval = verify_halted(tdev, ep, urb);
         if (retval < 0)
                 return retval;
 
         /* clear halt (tests API + protocol), verify it worked */
         retval = usb_clear_halt (urb->dev, urb->pipe);
         if (retval < 0) {
-                dbg ("ep %02x couldn't clear halt, %d", ep, retval);
+                ERROR(tdev, "ep %02x couldn't clear halt, %d\n", ep, retval);
                 return retval;
         }
-        retval = verify_not_halted (ep, urb);
+        retval = verify_not_halted(tdev, ep, urb);
         if (retval < 0)
                 return retval;
 
@@ -1217,7 +1209,7 @@ static int halt_simple (struct usbtest_dev *dev)
         if (dev->in_pipe) {
                 ep = usb_pipeendpoint (dev->in_pipe) | USB_DIR_IN;
                 urb->pipe = dev->in_pipe;
-                retval = test_halt (ep, urb);
+                retval = test_halt(dev, ep, urb);
                 if (retval < 0)
                         goto done;
         }
@@ -1225,7 +1217,7 @@ static int halt_simple (struct usbtest_dev *dev)
         if (dev->out_pipe) {
                 ep = usb_pipeendpoint (dev->out_pipe);
                 urb->pipe = dev->out_pipe;
-                retval = test_halt (ep, urb);
+                retval = test_halt(dev, ep, urb);
         }
 done:
         simple_free_urb (urb);
@@ -1275,7 +1267,7 @@ static int ctrl_out (struct usbtest_dev *dev,
                 if (retval != len) {
                         what = "write";
                         if (retval >= 0) {
-                                INFO(dev, "ctrl_out, wlen %d (expected %d)\n",
+                                ERROR(dev, "ctrl_out, wlen %d (expected %d)\n",
                                                 retval, len);
                                 retval = -EBADMSG;
                         }
@@ -1289,7 +1281,7 @@ static int ctrl_out (struct usbtest_dev *dev,
                 if (retval != len) {
                         what = "read";
                         if (retval >= 0) {
-                                INFO(dev, "ctrl_out, rlen %d (expected %d)\n",
+                                ERROR(dev, "ctrl_out, rlen %d (expected %d)\n",
                                                 retval, len);
                                 retval = -EBADMSG;
                         }
@@ -1299,7 +1291,7 @@ static int ctrl_out (struct usbtest_dev *dev,
                 /* fail if we can't verify */
                 for (j = 0; j < len; j++) {
                         if (buf [j] != (u8) (i + j)) {
-                                INFO (dev, "ctrl_out, byte %d is %d not %d\n",
+                                ERROR(dev, "ctrl_out, byte %d is %d not %d\n",
                                         j, buf [j], (u8) i + j);
                                 retval = -EBADMSG;
                                 break;
@@ -1321,7 +1313,7 @@ static int ctrl_out (struct usbtest_dev *dev,
         }
 
         if (retval < 0)
-                INFO (dev, "ctrl_out %s failed, code %d, count %d\n",
+                ERROR (dev, "ctrl_out %s failed, code %d, count %d\n",
                         what, retval, i);
 
         kfree (buf);
@@ -1366,7 +1358,7 @@ static void iso_callback (struct urb *urb)
                 case 0:
                         goto done;
                 default:
-                        dev_dbg (&ctx->dev->intf->dev,
+                        dev_err(&ctx->dev->intf->dev,
                                         "iso resubmit err %d\n",
                                         status);
                         /* FALLTHROUGH */
@@ -1381,7 +1373,7 @@ static void iso_callback (struct urb *urb)
         ctx->pending--;
         if (ctx->pending == 0) {
                 if (ctx->errors)
-                        dev_dbg (&ctx->dev->intf->dev,
+                        dev_err(&ctx->dev->intf->dev,
                                 "iso test, %lu errors out of %lu\n",
                                 ctx->errors, ctx->packet_count);
                 complete (&ctx->done);
@@ -1458,7 +1450,7 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
 
         memset (urbs, 0, sizeof urbs);
         udev = testdev_to_usbdev (dev);
-        dev_dbg (&dev->intf->dev,
+        dev_info(&dev->intf->dev,
                 "... iso period %d %sframes, wMaxPacket %04x\n",
                 1 << (desc->bInterval - 1),
                 (udev->speed == USB_SPEED_HIGH) ? "micro" : "",
@@ -1475,7 +1467,7 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
                 urbs [i]->context = &context;
         }
         packets *= param->iterations;
-        dev_dbg (&dev->intf->dev,
+        dev_info(&dev->intf->dev,
                 "... total %lu msec (%lu packets)\n",
                 (packets * (1 << (desc->bInterval - 1)))
                         / ((udev->speed == USB_SPEED_HIGH) ? 8 : 1),
@@ -1537,6 +1529,13 @@ fail:
  * except indirectly by consuming USB bandwidth and CPU resources for test
  * threads and request completion.  But the only way to know that for sure
  * is to test when HC queues are in use by many devices.
+ *
+ * WARNING:  Because usbfs grabs udev->dev.sem before calling this ioctl(),
+ * it locks out usbcore in certain code paths.  Notably, if you disconnect
+ * the device-under-test, khubd will wait block forever waiting for the
+ * ioctl to complete ... so that usb_disconnect() can abort the pending
+ * urbs and then call usbtest_disconnect().  To abort a test, you're best
+ * off just killing the userspace task and waiting for it to exit.
  */
 
 static int
@@ -1575,7 +1574,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
          * altsettings; force a default so most tests don't need to check.
          */
         if (dev->info->alt >= 0) {
-                int     res;
+                int     res;
 
                 if (intf->altsetting->desc.bInterfaceNumber) {
                         mutex_unlock(&dev->lock);
@@ -1604,7 +1603,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
         switch (param->test_num) {
 
         case 0:
-                dev_dbg (&intf->dev, "TEST 0:  NOP\n");
+                dev_info(&intf->dev, "TEST 0:  NOP\n");
                 retval = 0;
                 break;
 
@@ -1612,7 +1611,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
         case 1:
                 if (dev->out_pipe == 0)
                         break;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                                 "TEST 1:  write %d bytes %u times\n",
                                 param->length, param->iterations);
                 urb = simple_alloc_urb (udev, dev->out_pipe, param->length);
@@ -1621,13 +1620,13 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                         break;
                 }
                 // FIRMWARE:  bulk sink (maybe accepts short writes)
-                retval = simple_io (urb, param->iterations, 0, 0, "test1");
+                retval = simple_io(dev, urb, param->iterations, 0, 0, "test1");
                 simple_free_urb (urb);
                 break;
         case 2:
                 if (dev->in_pipe == 0)
                         break;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                                 "TEST 2:  read %d bytes %u times\n",
                                 param->length, param->iterations);
                 urb = simple_alloc_urb (udev, dev->in_pipe, param->length);
@@ -1636,13 +1635,13 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                         break;
                 }
                 // FIRMWARE:  bulk source (maybe generates short writes)
-                retval = simple_io (urb, param->iterations, 0, 0, "test2");
+                retval = simple_io(dev, urb, param->iterations, 0, 0, "test2");
                 simple_free_urb (urb);
                 break;
         case 3:
                 if (dev->out_pipe == 0 || param->vary == 0)
                         break;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                                 "TEST 3:  write/%d 0..%d bytes %u times\n",
                                 param->vary, param->length, param->iterations);
                 urb = simple_alloc_urb (udev, dev->out_pipe, param->length);
@@ -1651,14 +1650,14 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                         break;
                 }
                 // FIRMWARE:  bulk sink (maybe accepts short writes)
-                retval = simple_io (urb, param->iterations, param->vary,
+                retval = simple_io(dev, urb, param->iterations, param->vary,
                                         0, "test3");
                 simple_free_urb (urb);
                 break;
         case 4:
                 if (dev->in_pipe == 0 || param->vary == 0)
                         break;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                                 "TEST 4:  read/%d 0..%d bytes %u times\n",
                                 param->vary, param->length, param->iterations);
                 urb = simple_alloc_urb (udev, dev->in_pipe, param->length);
@@ -1667,7 +1666,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                         break;
                 }
                 // FIRMWARE:  bulk source (maybe generates short writes)
-                retval = simple_io (urb, param->iterations, param->vary,
+                retval = simple_io(dev, urb, param->iterations, param->vary,
                                         0, "test4");
                 simple_free_urb (urb);
                 break;
@@ -1676,7 +1675,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
         case 5:
                 if (dev->out_pipe == 0 || param->sglen == 0)
                         break;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                         "TEST 5:  write %d sglists %d entries of %d bytes\n",
                                 param->iterations,
                                 param->sglen, param->length);
@@ -1686,7 +1685,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                         break;
                 }
                 // FIRMWARE:  bulk sink (maybe accepts short writes)
-                retval = perform_sglist (udev, param->iterations, dev->out_pipe,
+                retval = perform_sglist(dev, param->iterations, dev->out_pipe,
                                 &req, sg, param->sglen);
                 free_sglist (sg, param->sglen);
                 break;
@@ -1694,7 +1693,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
         case 6:
                 if (dev->in_pipe == 0 || param->sglen == 0)
                         break;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                         "TEST 6:  read %d sglists %d entries of %d bytes\n",
                                 param->iterations,
                                 param->sglen, param->length);
@@ -1704,14 +1703,14 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                         break;
                 }
                 // FIRMWARE:  bulk source (maybe generates short writes)
-                retval = perform_sglist (udev, param->iterations, dev->in_pipe,
+                retval = perform_sglist(dev, param->iterations, dev->in_pipe,
                                 &req, sg, param->sglen);
                 free_sglist (sg, param->sglen);
                 break;
         case 7:
                 if (dev->out_pipe == 0 || param->sglen == 0 || param->vary == 0)
                         break;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                         "TEST 7:  write/%d %d sglists %d entries 0..%d bytes\n",
                                 param->vary, param->iterations,
                                 param->sglen, param->length);
@@ -1721,14 +1720,14 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                         break;
                 }
                 // FIRMWARE:  bulk sink (maybe accepts short writes)
-                retval = perform_sglist (udev, param->iterations, dev->out_pipe,
+                retval = perform_sglist(dev, param->iterations, dev->out_pipe,
                                 &req, sg, param->sglen);
                 free_sglist (sg, param->sglen);
                 break;
         case 8:
                 if (dev->in_pipe == 0 || param->sglen == 0 || param->vary == 0)
                         break;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                         "TEST 8:  read/%d %d sglists %d entries 0..%d bytes\n",
                                 param->vary, param->iterations,
                                 param->sglen, param->length);
@@ -1738,7 +1737,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                         break;
                 }
                 // FIRMWARE:  bulk source (maybe generates short writes)
-                retval = perform_sglist (udev, param->iterations, dev->in_pipe,
+                retval = perform_sglist(dev, param->iterations, dev->in_pipe,
                                 &req, sg, param->sglen);
                 free_sglist (sg, param->sglen);
                 break;
@@ -1746,13 +1745,14 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
         /* non-queued sanity tests for control (chapter 9 subset) */
         case 9:
                 retval = 0;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                         "TEST 9:  ch9 (subset) control tests, %d times\n",
                                 param->iterations);
                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
                         retval = ch9_postconfig (dev);
                 if (retval)
-                        dbg ("ch9 subset failed, iterations left %d", i);
+                        dev_err(&intf->dev, "ch9 subset failed, "
+                                        "iterations left %d\n", i);
                 break;
 
         /* queued control messaging */
@@ -1760,7 +1760,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                 if (param->sglen == 0)
                         break;
                 retval = 0;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                                 "TEST 10:  queue %d control calls, %d times\n",
                                 param->sglen,
                                 param->iterations);
@@ -1772,26 +1772,26 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                 if (dev->in_pipe == 0 || !param->length)
                         break;
                 retval = 0;
-                dev_dbg (&intf->dev, "TEST 11:  unlink %d reads of %d\n",
+                dev_info(&intf->dev, "TEST 11:  unlink %d reads of %d\n",
                                 param->iterations, param->length);
                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
                         retval = unlink_simple (dev, dev->in_pipe,
                                                 param->length);
                 if (retval)
-                        dev_dbg (&intf->dev, "unlink reads failed %d, "
+                        dev_err(&intf->dev, "unlink reads failed %d, "
                                 "iterations left %d\n", retval, i);
                 break;
         case 12:
                 if (dev->out_pipe == 0 || !param->length)
                         break;
                 retval = 0;
-                dev_dbg (&intf->dev, "TEST 12:  unlink %d writes of %d\n",
+                dev_info(&intf->dev, "TEST 12:  unlink %d writes of %d\n",
                                 param->iterations, param->length);
                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
                         retval = unlink_simple (dev, dev->out_pipe,
                                                 param->length);
                 if (retval)
-                        dev_dbg (&intf->dev, "unlink writes failed %d, "
+                        dev_err(&intf->dev, "unlink writes failed %d, "
                                 "iterations left %d\n", retval, i);
                 break;
 
@@ -1800,24 +1800,24 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
                 if (dev->out_pipe == 0 && dev->in_pipe == 0)
                         break;
                 retval = 0;
-                dev_dbg (&intf->dev, "TEST 13:  set/clear %d halts\n",
+                dev_info(&intf->dev, "TEST 13:  set/clear %d halts\n",
                                 param->iterations);
                 for (i = param->iterations; retval == 0 && i--; /* NOP */)
                         retval = halt_simple (dev);
-                
+
                 if (retval)
-                        DBG (dev, "halts failed, iterations left %d\n", i);
+                        ERROR(dev, "halts failed, iterations left %d\n", i);
                 break;
 
         /* control write tests */
         case 14:
                 if (!dev->info->ctrl_out)
                         break;
-                dev_dbg (&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
+                dev_info(&intf->dev, "TEST 14:  %d ep0out, %d..%d vary %d\n",
                                 param->iterations,
                                 realworld ? 1 : 0, param->length,
                                 param->vary);
-                retval = ctrl_out (dev, param->iterations, 
+                retval = ctrl_out(dev, param->iterations,
                                 param->length, param->vary);
                 break;
 
@@ -1825,7 +1825,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
         case 15:
                 if (dev->out_iso_pipe == 0 || param->sglen == 0)
                         break;
-                dev_dbg (&intf->dev, 
+                dev_info(&intf->dev,
                         "TEST 15:  write %d iso, %d entries of %d bytes\n",
                                 param->iterations,
                                 param->sglen, param->length);
@@ -1838,7 +1838,7 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
         case 16:
                 if (dev->in_iso_pipe == 0 || param->sglen == 0)
                         break;
-                dev_dbg (&intf->dev,
+                dev_info(&intf->dev,
                         "TEST 16:  read %d iso, %d entries of %d bytes\n",
                                 param->iterations,
                                 param->sglen, param->length);
@@ -1898,7 +1898,8 @@ usbtest_probe (struct usb_interface *intf, const struct usb_device_id *id)
                         return -ENODEV;
                 if (product && le16_to_cpu(udev->descriptor.idProduct) != (u16)product)
                         return -ENODEV;
-                dbg ("matched module params, vend=0x%04x prod=0x%04x",
+                dev_info(&intf->dev, "matched module params, "
+                                        "vend=0x%04x prod=0x%04x\n",
                                 le16_to_cpu(udev->descriptor.idVendor),
                                 le16_to_cpu(udev->descriptor.idProduct));
         }
@@ -1940,7 +1941,8 @@ usbtest_probe (struct usb_interface *intf, const struct usb_device_id *id)
 
                         status = get_endpoints (dev, intf);
                         if (status < 0) {
-                                dbg ("couldn't get endpoints, %d\n", status);
+                                WARN(dev, "couldn't get endpoints, %d\n",
+                                                status);
                                 return status;
                         }
                         /* may find bulk or ISO pipes */
@@ -2082,21 +2084,9 @@ static struct usbtest_info generic_info = {
 };
 #endif
 
-// FIXME remove this 
-static struct usbtest_info hact_info = {
-        .name           = "FX2/hact",
-        //.ep_in                = 6,
-        .ep_out         = 2,
-        .alt            = -1,
-};
-
 
 static struct usb_device_id id_table [] = {
 
-        { USB_DEVICE (0x0547, 0x1002),
-                .driver_info = (unsigned long) &hact_info,
-                },
-
         /*-------------------------------------------------------------*/
 
         /* EZ-USB devices which download firmware to replace (or in our
@@ -2185,7 +2175,7 @@ static int __init usbtest_init (void)
 {
 #ifdef GENERIC
         if (vendor)
-                dbg ("params: vend=0x%04x prod=0x%04x", vendor, product);
+                pr_debug("params: vend=0x%04x prod=0x%04x\n", vendor, product);
 #endif
         return usb_register (&usbtest_driver);
 }
diff --git a/drivers/usb/serial/aircable.c b/drivers/usb/serial/aircable.c
index 9b1bb347dc2..db6f97a93c0 100644
--- a/drivers/usb/serial/aircable.c
+++ b/drivers/usb/serial/aircable.c
@@ -147,7 +147,7 @@ static void serial_buf_free(struct circ_buf *cb)
  */
 static int serial_buf_data_avail(struct circ_buf *cb)
 {
-        return CIRC_CNT(cb->head,cb->tail,AIRCABLE_BUF_SIZE);
+        return CIRC_CNT(cb->head, cb->tail, AIRCABLE_BUF_SIZE);
 }
 
 /*
@@ -171,7 +171,7 @@ static int serial_buf_put(struct circ_buf *cb, const char *buf, int count)
                 cb->head = (cb->head + c) & (AIRCABLE_BUF_SIZE-1);
                 buf += c;
                 count -= c;
-                ret= c;
+                ret = c;
         }
         return ret;
 }
@@ -197,7 +197,7 @@ static int serial_buf_get(struct circ_buf *cb, char *buf, int count)
                 cb->tail = (cb->tail + c) & (AIRCABLE_BUF_SIZE-1);
                 buf += c;
                 count -= c;
-                ret= c;
+                ret = c;
         }
         return ret;
 }
@@ -208,7 +208,7 @@ static void aircable_send(struct usb_serial_port *port)
 {
         int count, result;
         struct aircable_private *priv = usb_get_serial_port_data(port);
-        unsigned char* buf;
+        unsigned char *buf;
         __le16 *dbuf;
         dbg("%s - port %d", __func__, port->number);
         if (port->write_urb_busy)
@@ -229,7 +229,8 @@ static void aircable_send(struct usb_serial_port *port)
         buf[1] = TX_HEADER_1;
         dbuf = (__le16 *)&buf[2];
         *dbuf = cpu_to_le16((u16)count);
-        serial_buf_get(priv->tx_buf,buf + HCI_HEADER_LENGTH, MAX_HCI_FRAMESIZE);
+        serial_buf_get(priv->tx_buf, buf + HCI_HEADER_LENGTH,
+                                                        MAX_HCI_FRAMESIZE);
 
         memcpy(port->write_urb->transfer_buffer, buf,
                count + HCI_HEADER_LENGTH);
@@ -261,7 +262,7 @@ static void aircable_read(struct work_struct *work)
         struct tty_struct *tty;
         unsigned char *data;
         int count;
-        if (priv->rx_flags & THROTTLED){
+        if (priv->rx_flags & THROTTLED) {
                 if (priv->rx_flags & ACTUALLY_THROTTLED)
                         schedule_work(&priv->rx_work);
                 return;
@@ -282,10 +283,10 @@ static void aircable_read(struct work_struct *work)
         count = min(64, serial_buf_data_avail(priv->rx_buf));
 
         if (count <= 0)
-                return; //We have finished sending everything.
+                return; /* We have finished sending everything. */
 
         tty_prepare_flip_string(tty, &data, count);
-        if (!data){
+        if (!data) {
                 err("%s- kzalloc(%d) failed.", __func__, count);
                 return;
         }
@@ -304,9 +305,10 @@ static void aircable_read(struct work_struct *work)
 static int aircable_probe(struct usb_serial *serial,
                           const struct usb_device_id *id)
 {
-        struct usb_host_interface *iface_desc = serial->interface->cur_altsetting;
+        struct usb_host_interface *iface_desc = serial->interface->
+                                                                cur_altsetting;
         struct usb_endpoint_descriptor *endpoint;
-        int num_bulk_out=0;
+        int num_bulk_out = 0;
         int i;
 
         for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
@@ -325,13 +327,13 @@ static int aircable_probe(struct usb_serial *serial,
         return 0;
 }
 
-static int aircable_attach (struct usb_serial *serial)
+static int aircable_attach(struct usb_serial *serial)
 {
         struct usb_serial_port *port = serial->port[0];
         struct aircable_private *priv;
 
         priv = kzalloc(sizeof(struct aircable_private), GFP_KERNEL);
-        if (!priv){
+        if (!priv) {
                 err("%s- kmalloc(%Zd) failed.", __func__,
                         sizeof(struct aircable_private));
                 return -ENOMEM;
@@ -392,7 +394,7 @@ static int aircable_write(struct usb_serial_port *port,
 
         usb_serial_debug_data(debug, &port->dev, __func__, count, source);
 
-        if (!count){
+        if (!count) {
                 dbg("%s - write request of 0 bytes", __func__);
                 return count;
         }
@@ -418,31 +420,31 @@ static void aircable_write_bulk_callback(struct urb *urb)
 
         /* This has been taken from cypress_m8.c cypress_write_int_callback */
         switch (status) {
-                case 0:
-                        /* success */
-                        break;
-                case -ECONNRESET:
-                case -ENOENT:
-                case -ESHUTDOWN:
-                        /* this urb is terminated, clean up */
-                        dbg("%s - urb shutting down with status: %d",
-                            __func__, status);
-                        port->write_urb_busy = 0;
+        case 0:
+                /* success */
+                break;
+        case -ECONNRESET:
+        case -ENOENT:
+        case -ESHUTDOWN:
+                /* this urb is terminated, clean up */
+                dbg("%s - urb shutting down with status: %d",
+                    __func__, status);
+                port->write_urb_busy = 0;
+                return;
+        default:
+                /* error in the urb, so we have to resubmit it */
+                dbg("%s - Overflow in write", __func__);
+                dbg("%s - nonzero write bulk status received: %d",
+                    __func__, status);
+                port->write_urb->transfer_buffer_length = 1;
+                port->write_urb->dev = port->serial->dev;
+                result = usb_submit_urb(port->write_urb, GFP_ATOMIC);
+                if (result)
+                        dev_err(&urb->dev->dev,
+                            "%s - failed resubmitting write urb, error %d\n",
+                                                        __func__, result);
+                else
                         return;
-                default:
-                        /* error in the urb, so we have to resubmit it */
-                        dbg("%s - Overflow in write", __func__);
-                        dbg("%s - nonzero write bulk status received: %d",
-                            __func__, status);
-                        port->write_urb->transfer_buffer_length = 1;
-                        port->write_urb->dev = port->serial->dev;
-                        result = usb_submit_urb(port->write_urb, GFP_ATOMIC);
-                        if (result)
-                                dev_err(&urb->dev->dev,
-                                        "%s - failed resubmitting write urb, error %d\n",
-                                        __func__, result);
-                        else
-                                return;
         }
 
         port->write_urb_busy = 0;
@@ -472,11 +474,11 @@ static void aircable_read_bulk_callback(struct urb *urb)
                         dbg("%s - caught -EPROTO, resubmitting the urb",
                             __func__);
                         usb_fill_bulk_urb(port->read_urb, port->serial->dev,
-                                          usb_rcvbulkpipe(port->serial->dev,
-                                                          port->bulk_in_endpointAddress),
-                                          port->read_urb->transfer_buffer,
-                                          port->read_urb->transfer_buffer_length,
-                                          aircable_read_bulk_callback, port);
+                                usb_rcvbulkpipe(port->serial->dev,
+                                        port->bulk_in_endpointAddress),
+                                port->read_urb->transfer_buffer,
+                                port->read_urb->transfer_buffer_length,
+                                aircable_read_bulk_callback, port);
 
                         result = usb_submit_urb(urb, GFP_ATOMIC);
                         if (result)
@@ -490,7 +492,7 @@ static void aircable_read_bulk_callback(struct urb *urb)
         }
 
         usb_serial_debug_data(debug, &port->dev, __func__,
-                                urb->actual_length,urb->transfer_buffer);
+                                urb->actual_length, urb->transfer_buffer);
 
         tty = port->tty;
         if (tty && urb->actual_length) {
@@ -507,9 +509,9 @@ static void aircable_read_bulk_callback(struct urb *urb)
                         no_packages = urb->actual_length / (HCI_COMPLETE_FRAME);
 
                         if (urb->actual_length % HCI_COMPLETE_FRAME != 0)
-                                no_packages+=1;
+                                no_packages++;
 
-                        for (i = 0; i < no_packages ;i++) {
+                        for (i = 0; i < no_packages; i++) {
                                 if (remaining > (HCI_COMPLETE_FRAME))
                                         package_length = HCI_COMPLETE_FRAME;
                                 else
@@ -529,7 +531,7 @@ static void aircable_read_bulk_callback(struct urb *urb)
         if (port->open_count) {
                 usb_fill_bulk_urb(port->read_urb, port->serial->dev,
                                   usb_rcvbulkpipe(port->serial->dev,
-                                                  port->bulk_in_endpointAddress),
+                                          port->bulk_in_endpointAddress),
                                   port->read_urb->transfer_buffer,
                                   port->read_urb->transfer_buffer_length,
                                   aircable_read_bulk_callback, port);
@@ -602,7 +604,7 @@ static struct usb_serial_driver aircable_device = {
         .unthrottle =           aircable_unthrottle,
 };
 
-static int __init aircable_init (void)
+static int __init aircable_init(void)
 {
         int retval;
         retval = usb_serial_register(&aircable_device);
@@ -619,7 +621,7 @@ failed_usb_register:
         return retval;
 }
 
-static void __exit aircable_exit (void)
+static void __exit aircable_exit(void)
 {
         usb_deregister(&aircable_driver);
         usb_serial_deregister(&aircable_device);
diff --git a/drivers/usb/serial/airprime.c b/drivers/usb/serial/airprime.c
index 725b6b94c27..0798c14ce78 100644
--- a/drivers/usb/serial/airprime.c
+++ b/drivers/usb/serial/airprime.c
@@ -68,8 +68,9 @@ static int airprime_send_setup(struct usb_serial_port *port)
                         val |= 0x02;
 
                 return usb_control_msg(serial->dev,
-                                usb_rcvctrlpipe(serial->dev, 0),
-                                0x22,0x21,val,0,NULL,0,USB_CTRL_SET_TIMEOUT);
+                                        usb_rcvctrlpipe(serial->dev, 0),
+                                        0x22, 0x21, val, 0, NULL, 0,
+                                        USB_CTRL_SET_TIMEOUT);
         }
 
         return 0;
@@ -90,17 +91,19 @@ static void airprime_read_bulk_callback(struct urb *urb)
                     __func__, status);
                 return;
         }
-        usb_serial_debug_data(debug, &port->dev, __func__, urb->actual_length, data);
+        usb_serial_debug_data(debug, &port->dev, __func__,
+                                                urb->actual_length, data);
 
         tty = port->tty;
         if (tty && urb->actual_length) {
-                tty_insert_flip_string (tty, data, urb->actual_length);
-                tty_flip_buffer_push (tty);
+                tty_insert_flip_string(tty, data, urb->actual_length);
+                tty_flip_buffer_push(tty);
         }
 
-        result = usb_submit_urb (urb, GFP_ATOMIC);
+        result = usb_submit_urb(urb, GFP_ATOMIC);
         if (result)
-                dev_err(&port->dev, "%s - failed resubmitting read urb, error %d\n",
+                dev_err(&port->dev,
+                        "%s - failed resubmitting read urb, error %d\n",
                         __func__, result);
         return;
 }
@@ -115,7 +118,7 @@ static void airprime_write_bulk_callback(struct urb *urb)
         dbg("%s - port %d", __func__, port->number);
 
         /* free up the transfer buffer, as usb_free_urb() does not do this */
-        kfree (urb->transfer_buffer);
+        kfree(urb->transfer_buffer);
 
         if (status)
                 dbg("%s - nonzero write bulk status received: %d",
@@ -171,7 +174,7 @@ static int airprime_open(struct usb_serial_port *port, struct file *filp)
                 }
                 usb_fill_bulk_urb(urb, serial->dev,
                                   usb_rcvbulkpipe(serial->dev,
-                                                  port->bulk_out_endpointAddress),
+                                          port->bulk_out_endpointAddress),
                                   buffer, buffer_size,
                                   airprime_read_bulk_callback, port);
                 result = usb_submit_urb(urb, GFP_KERNEL);
@@ -183,7 +186,8 @@ static int airprime_open(struct usb_serial_port *port, struct file *filp)
                                 __func__, i, port->number, result);
                         goto errout;
                 }
-                /* remember this urb so we can kill it when the port is closed */
+                /* remember this urb so we can kill it when the
+                   port is closed */
                 priv->read_urbp[i] = urb;
         }
 
@@ -192,22 +196,22 @@ static int airprime_open(struct usb_serial_port *port, struct file *filp)
         goto out;
 
  errout:
-        /* some error happened, cancel any submitted urbs and clean up anything that
-           got allocated successfully */
+        /* some error happened, cancel any submitted urbs and clean up
+           anything that got allocated successfully */
 
         while (i-- != 0) {
                 urb = priv->read_urbp[i];
                 buffer = urb->transfer_buffer;
-                usb_kill_urb (urb);
-                usb_free_urb (urb);
-                kfree (buffer);
+                usb_kill_urb(urb);
+                usb_free_urb(urb);
+                kfree(buffer);
         }
 
  out:
         return result;
 }
 
-static void airprime_close(struct usb_serial_port *port, struct file * filp)
+static void airprime_close(struct usb_serial_port *port, struct file *filp)
 {
         struct airprime_private *priv = usb_get_serial_port_data(port);
         int i;
@@ -220,16 +224,16 @@ static void airprime_close(struct usb_serial_port *port, struct file * filp)
         mutex_lock(&port->serial->disc_mutex);
         if (!port->serial->disconnected)
                 airprime_send_setup(port);
-        mutex_lock(&port->serial->disc_mutex);
+        mutex_unlock(&port->serial->disc_mutex);
 
         for (i = 0; i < NUM_READ_URBS; ++i) {
-                usb_kill_urb (priv->read_urbp[i]);
-                kfree (priv->read_urbp[i]->transfer_buffer);
-                usb_free_urb (priv->read_urbp[i]);
+                usb_kill_urb(priv->read_urbp[i]);
+                kfree(priv->read_urbp[i]->transfer_buffer);
+                usb_free_urb(priv->read_urbp[i]);
         }
 
         /* free up private structure */
-        kfree (priv);
+        kfree(priv);
         usb_set_serial_port_data(port, NULL);
 }
 
@@ -259,10 +263,10 @@ static int airprime_write(struct usb_serial_port *port,
         urb = usb_alloc_urb(0, GFP_ATOMIC);
         if (!urb) {
                 dev_err(&port->dev, "no more free urbs\n");
-                kfree (buffer);
+                kfree(buffer);
                 return -ENOMEM;
         }
-        memcpy (buffer, buf, count);
+        memcpy(buffer, buf, count);
 
         usb_serial_debug_data(debug, &port->dev, __func__, count, buffer);
 
@@ -279,7 +283,7 @@ static int airprime_write(struct usb_serial_port *port,
                         "%s - usb_submit_urb(write bulk) failed with status = %d\n",
                         __func__, status);
                 count = status;
-                kfree (buffer);
+                kfree(buffer);
         } else {
                 spin_lock_irqsave(&priv->lock, flags);
                 ++priv->outstanding_urbs;
@@ -287,7 +291,7 @@ static int airprime_write(struct usb_serial_port *port,
         }
         /* we are done with this urb, so let the host driver
          * really free it when it is finished with it */
-        usb_free_urb (urb);
+        usb_free_urb(urb);
         return count;
 }
 
@@ -315,8 +319,10 @@ static int __init airprime_init(void)
 {
         int retval;
 
-        airprime_device.num_ports =
-                (endpoints > 0 && endpoints <= MAX_BULK_EPS) ? endpoints : NUM_BULK_EPS;
+        airprime_device.num_ports = endpoints;
+        if (endpoints < 0 || endpoints >= MAX_BULK_EPS)
+                airprime_device.num_ports = NUM_BULK_EPS;
+
         retval = usb_serial_register(&airprime_device);
         if (retval)
                 return retval;
@@ -341,6 +347,7 @@ MODULE_LICENSE("GPL");
 module_param(debug, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Debug enabled");
 module_param(buffer_size, int, 0);
-MODULE_PARM_DESC(buffer_size, "Size of the transfer buffers in bytes (default 4096)");
+MODULE_PARM_DESC(buffer_size,
+                "Size of the transfer buffers in bytes (default 4096)");
 module_param(endpoints, int, 0);
 MODULE_PARM_DESC(endpoints, "Number of bulk EPs to configure (default 3)");
diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
index 599ab2e548a..77895c8f8f3 100644
--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -24,7 +24,7 @@
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
 #include <linux/serial.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 
 static int debug;
@@ -246,29 +246,29 @@ static void ark3116_set_termios(struct usb_serial_port *port,
         baud = tty_get_baud_rate(port->tty);
 
         switch (baud) {
-                case 75:
-                case 150:
-                case 300:
-                case 600:
-                case 1200:
-                case 1800:
-                case 2400:
-                case 4800:
-                case 9600:
-                case 19200:
-                case 38400:
-                case 57600:
-                case 115200:
-                case 230400:
-                case 460800:
-                        /* Report the resulting rate back to the caller */
-                        tty_encode_baud_rate(port->tty, baud, baud);
-                        break;
-                /* set 9600 as default (if given baudrate is invalid for example) */
-                default:
-                        tty_encode_baud_rate(port->tty, 9600, 9600);
-                case 0:
-                        baud = 9600;
+        case 75:
+        case 150:
+        case 300:
+        case 600:
+        case 1200:
+        case 1800:
+        case 2400:
+        case 4800:
+        case 9600:
+        case 19200:
+        case 38400:
+        case 57600:
+        case 115200:
+        case 230400:
+        case 460800:
+                /* Report the resulting rate back to the caller */
+                tty_encode_baud_rate(port->tty, baud, baud);
+                break;
+        /* set 9600 as default (if given baudrate is invalid for example) */
+        default:
+                tty_encode_baud_rate(port->tty, 9600, 9600);
+        case 0:
+                baud = 9600;
         }
 
         /*
@@ -380,19 +380,19 @@ static int ark3116_ioctl(struct usb_serial_port *port, struct file *file,
         switch (cmd) {
         case TIOCGSERIAL:
                 /* XXX: Some of these values are probably wrong. */
-                memset(&serstruct, 0, sizeof (serstruct));
+                memset(&serstruct, 0, sizeof(serstruct));
                 serstruct.type = PORT_16654;
                 serstruct.line = port->serial->minor;
                 serstruct.port = port->number;
                 serstruct.custom_divisor = 0;
                 serstruct.baud_base = 460800;
 
-                if (copy_to_user(user_arg, &serstruct, sizeof (serstruct)))
+                if (copy_to_user(user_arg, &serstruct, sizeof(serstruct)))
                         return -EFAULT;
 
                 return 0;
         case TIOCSSERIAL:
-                if (copy_from_user(&serstruct, user_arg, sizeof (serstruct)))
+                if (copy_from_user(&serstruct, user_arg, sizeof(serstruct)))
                         return -EFAULT;
                 return 0;
         default:
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index d947d955bce..ba28fdc9ccd 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -130,7 +130,7 @@ static int ch341_get_status(struct usb_device *dev)
                 return -ENOMEM;
 
         r = ch341_control_in(dev, 0x95, 0x0706, 0, buffer, size);
-        if ( r < 0)
+        if (r < 0)
                 goto out;
 
         /* Not having the datasheet for the CH341, we ignore the bytes returned
diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
index dc0ea08ed23..f5b57b196c5 100644
--- a/drivers/usb/serial/cp2101.c
+++ b/drivers/usb/serial/cp2101.c
@@ -73,6 +73,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
         { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
         { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */
+        { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
         { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
         { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
         { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index c7329f43d9c..5b349ece724 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -133,6 +133,14 @@ static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
 static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_1_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_2_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_3_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_4_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_5_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_6_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_7_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACTZWAVE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IRTRANS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IPLUS_PID) },
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 6da539ede0e..504edf8c3a3 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -40,6 +40,17 @@
 /* AlphaMicro Components AMC-232USB01 device */
 #define FTDI_AMC232_PID 0xFF00 /* Product Id */
 
+/* SCS HF Radio Modems PID's (http://www.scs-ptc.com) */
+/* the VID is the standard ftdi vid (FTDI_VID) */
+#define FTDI_SCS_DEVICE_0_PID 0xD010    /* SCS PTC-IIusb */
+#define FTDI_SCS_DEVICE_1_PID 0xD011    /* SCS Tracker / DSP TNC */
+#define FTDI_SCS_DEVICE_2_PID 0xD012
+#define FTDI_SCS_DEVICE_3_PID 0xD013
+#define FTDI_SCS_DEVICE_4_PID 0xD014
+#define FTDI_SCS_DEVICE_5_PID 0xD015
+#define FTDI_SCS_DEVICE_6_PID 0xD016
+#define FTDI_SCS_DEVICE_7_PID 0xD017
+
 /* ACT Solutions HomePro ZWave interface (http://www.act-solutions.com/HomePro.htm) */
 #define FTDI_ACTZWAVE_PID       0xF2D0
 
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 8a217648b25..a01e987c7d3 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -643,7 +643,7 @@ static void read_buf_callback(struct urb *urb)
 static int iuu_bulk_write(struct usb_serial_port *port)
 {
         struct iuu_private *priv = usb_get_serial_port_data(port);
-        unsigned int flags;
+        unsigned long flags;
         int result;
         int i;
         char *buf_ptr = port->write_urb->transfer_buffer;
@@ -694,7 +694,7 @@ static void iuu_uart_read_callback(struct urb *urb)
 {
         struct usb_serial_port *port = urb->context;
         struct iuu_private *priv = usb_get_serial_port_data(port);
-        unsigned int flags;
+        unsigned long flags;
         int status;
         int error = 0;
         int len = 0;
@@ -759,7 +759,7 @@ static int iuu_uart_write(struct usb_serial_port *port, const u8 *buf,
                           int count)
 {
         struct iuu_private *priv = usb_get_serial_port_data(port);
-        unsigned int flags;
+        unsigned long flags;
         dbg("%s - enter", __func__);
 
         if (count > 256)
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 6bcb82d3911..78f2f6db494 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1713,7 +1713,7 @@ static int mos7840_tiocmset(struct usb_serial_port *port, struct file *file,
 {
         struct moschip_port *mos7840_port;
         unsigned int mcr;
-        unsigned int status;
+        int status;
 
         dbg("%s - port %d", __func__, port->number);
 
@@ -1740,11 +1740,10 @@ static int mos7840_tiocmset(struct usb_serial_port *port, struct file *file,
 
         mos7840_port->shadowMCR = mcr;
 
-        status = 0;
         status = mos7840_set_uart_reg(port, MODEM_CONTROL_REGISTER, mcr);
         if (status < 0) {
                 dbg("setting MODEM_CONTROL_REGISTER Failed\n");
-                return -1;
+                return status;
         }
 
         return 0;
diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig
index 0f6d234d699..3d9249632ae 100644
--- a/drivers/usb/storage/Kconfig
+++ b/drivers/usb/storage/Kconfig
@@ -123,7 +123,8 @@ config USB_STORAGE_ALAUDA
 
 config USB_STORAGE_ONETOUCH
         bool "Support OneTouch Button on Maxtor Hard Drives"
-        depends on USB_STORAGE && INPUT_EVDEV
+        depends on USB_STORAGE
+        depends on INPUT=y || INPUT=USB_STORAGE
         help
           Say Y here to include additional code to support the Maxtor OneTouch
           USB hard drive's onetouch button.
diff --git a/drivers/usb/storage/cypress_atacb.c b/drivers/usb/storage/cypress_atacb.c
index d88824b3511..898e67d30e5 100644
--- a/drivers/usb/storage/cypress_atacb.c
+++ b/drivers/usb/storage/cypress_atacb.c
@@ -46,7 +46,7 @@ void cypress_atacb_passthrough(struct scsi_cmnd *srb, struct us_data *us)
         }
 
         memcpy(save_cmnd, srb->cmnd, sizeof(save_cmnd));
-        memset(srb->cmnd, 0, sizeof(srb->cmnd));
+        memset(srb->cmnd, 0, MAX_COMMAND_SIZE);
 
         /* check if we support the command */
         if (save_cmnd[1] >> 5) /* MULTIPLE_COUNT */
diff --git a/drivers/usb/storage/isd200.c b/drivers/usb/storage/isd200.c
index 971d13dd5e6..3addcd8f827 100644
--- a/drivers/usb/storage/isd200.c
+++ b/drivers/usb/storage/isd200.c
@@ -292,6 +292,7 @@ struct isd200_info {
 
         /* maximum number of LUNs supported */
         unsigned char MaxLUNs;
+        unsigned char cmnd[BLK_MAX_CDB];
         struct scsi_cmnd srb;
         struct scatterlist sg;
 };
@@ -450,6 +451,7 @@ static int isd200_action( struct us_data *us, int action,
 
         memset(&ata, 0, sizeof(ata));
         memset(&srb_dev, 0, sizeof(srb_dev));
+        srb->cmnd = info->cmnd;
         srb->device = &srb_dev;
         ++srb->serial_number;
 
diff --git a/drivers/usb/storage/libusual.c b/drivers/usb/storage/libusual.c
index a28d49122e7..d617e8ae6b0 100644
--- a/drivers/usb/storage/libusual.c
+++ b/drivers/usb/storage/libusual.c
@@ -135,7 +135,7 @@ static int usu_probe(struct usb_interface *intf,
         stat[type].fls |= USU_MOD_FL_THREAD;
         spin_unlock_irqrestore(&usu_lock, flags);
 
-        task = kthread_run(usu_probe_thread, (void*)type, "libusual_%d", type);
+        task = kthread_run(usu_probe_thread, (void*)type, "libusual_%ld", type);
         if (IS_ERR(task)) {
                 rc = PTR_ERR(task);
                 printk(KERN_WARNING "libusual: "
diff --git a/drivers/usb/storage/onetouch.c b/drivers/usb/storage/onetouch.c
index dfd42fe9e5f..98b89ea9e31 100644
--- a/drivers/usb/storage/onetouch.c
+++ b/drivers/usb/storage/onetouch.c
@@ -38,7 +38,7 @@
 #include "onetouch.h"
 #include "debug.h"
 
-void onetouch_release_input(void *onetouch_);
+static void onetouch_release_input(void *onetouch_);
 
 struct usb_onetouch {
         char name[128];
@@ -223,7 +223,7 @@ int onetouch_connect_input(struct us_data *ss)
         return error;
 }
 
-void onetouch_release_input(void *onetouch_)
+static void onetouch_release_input(void *onetouch_)
 {
         struct usb_onetouch *onetouch = (struct usb_onetouch *) onetouch_;
 
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 732bf52a775..a0ed889230a 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -44,7 +44,8 @@
  *        running with this patch.
  * Send your submission to either Phil Dibowitz <phil@ipom.com> or
  * Alan Stern <stern@rowland.harvard.edu>, and don't forget to CC: the
- * USB development list <linux-usb-devel@lists.sourceforge.net>.
+ * USB development list <linux-usb@vger.kernel.org> and the USB storage list
+ * <usb-storage@lists.one-eyed-alien.net>
  */
 
 /* patch submitted by Vivian Bregier <Vivian.Bregier@imag.fr>
@@ -557,6 +558,13 @@ UNUSUAL_DEV(  0x04e6, 0x1010, 0x0000, 0x9999,
                 US_FL_SINGLE_LUN),
 #endif
 
+/* Reported by Dmitry Khlystov <adminimus@gmail.com> */
+UNUSUAL_DEV(  0x04e8, 0x507c, 0x0220, 0x0220,
+                "Samsung",
+                "YP-U3",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64),
+
 /* Reported by Bob Sass <rls@vectordb.com> -- only rev 1.33 tested */
 UNUSUAL_DEV(  0x050d, 0x0115, 0x0133, 0x0133,
                 "Belkin",
@@ -1200,6 +1208,17 @@ UNUSUAL_DEV(  0x084d, 0x0011, 0x0110, 0x0110,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_BULK32),
 
+/* Andrew Lunn <andrew@lunn.ch>
+ * PanDigital Digital Picture Frame. Does not like ALLOW_MEDIUM_REMOVAL
+ * on LUN 4.
+ * Note: Vend:Prod clash with "Ltd Maxell WS30 Slim Digital Camera"
+*/
+UNUSUAL_DEV(  0x0851, 0x1543, 0x0200, 0x0200,
+                "PanDigital",
+                "Photo Frame",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_NOT_LOCKABLE),
+
 /* Submitted by Jan De Luyck <lkml@kcore.org> */
 UNUSUAL_DEV(  0x08bd, 0x1100, 0x0000, 0x0000,
                 "CITIZEN",
@@ -1342,6 +1361,13 @@ UNUSUAL_DEV( 0x0d96, 0x410a, 0x0001, 0xffff,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY),
 
+/* Reported by Rohan Hart <rohan.hart17@gmail.com> */
+UNUSUAL_DEV(  0x2770, 0x915d, 0x0010, 0x0010,
+                "INTOVA",
+                "Pixtreme",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY ),
+
 /*
  * Entry for Jenoptik JD 5200z3
  *
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index a856effad3b..e268aacb773 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -539,7 +539,8 @@ static int get_device_info(struct us_data *us, const struct usb_device_id *id)
                                 " has %s in unusual_devs.h (kernel"
                                 " %s)\n"
                                 "   Please send a copy of this message to "
-                                "<linux-usb-devel@lists.sourceforge.net>\n",
+                                "<linux-usb@vger.kernel.org> and "
+                                "<usb-storage@lists.one-eyed-alien.net>\n",
                                 le16_to_cpu(ddesc->idVendor),
                                 le16_to_cpu(ddesc->idProduct),
                                 le16_to_cpu(ddesc->bcdDevice),
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index bb1dadaa4a2..2cdaf1ff831 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -171,7 +171,6 @@ config FB_SYS_FOPS
 config FB_DEFERRED_IO
         bool
         depends on FB
-        default y
 
 config FB_METRONOME
         tristate
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 8ffdf357876..b004036d408 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -441,14 +441,15 @@ static int atmel_lcdfb_set_par(struct fb_info *info)
 
         value = DIV_ROUND_UP(clk_value_khz, PICOS2KHZ(info->var.pixclock));
 
-        value = (value / 2) - 1;
-        dev_dbg(info->device, "  * programming CLKVAL = 0x%08lx\n", value);
-
-        if (value <= 0) {
+        if (value < 2) {
                 dev_notice(info->device, "Bypassing pixel clock divider\n");
                 lcdc_writel(sinfo, ATMEL_LCDC_LCDCON1, ATMEL_LCDC_BYPASS);
         } else {
-                lcdc_writel(sinfo, ATMEL_LCDC_LCDCON1, value << ATMEL_LCDC_CLKVAL_OFFSET);
+                value = (value / 2) - 1;
+                dev_dbg(info->device, "  * programming CLKVAL = 0x%08lx\n",
+                                value);
+                lcdc_writel(sinfo, ATMEL_LCDC_LCDCON1,
+                                value << ATMEL_LCDC_CLKVAL_OFFSET);
                 info->var.pixclock = KHZ2PICOS(clk_value_khz / (2 * (value + 1)));
                 dev_dbg(info->device, "  updated pixclk:     %lu KHz\n",
                                         PICOS2KHZ(info->var.pixclock));
diff --git a/drivers/video/bw2.c b/drivers/video/bw2.c
index 275d9dab0c6..e721644bad7 100644
--- a/drivers/video/bw2.c
+++ b/drivers/video/bw2.c
@@ -17,11 +17,9 @@
 #include <linux/init.h>
 #include <linux/fb.h>
 #include <linux/mm.h>
+#include <linux/of_device.h>
 
 #include <asm/io.h>
-#include <asm/oplib.h>
-#include <asm/prom.h>
-#include <asm/of_device.h>
 #include <asm/fbio.h>
 
 #include "sbuslib.h"
@@ -299,7 +297,7 @@ static int __devinit bw2_probe(struct of_device *op, const struct of_device_id *
         par->physbase = op->resource[0].start;
         par->which_io = op->resource[0].flags & IORESOURCE_BITS;
 
-        sbusfb_fill_var(&info->var, dp->node, 1);
+        sbusfb_fill_var(&info->var, dp, 1);
         linebytes = of_getintprop_default(dp, "linebytes",
                                           info->var.xres);
 
@@ -329,7 +327,7 @@ static int __devinit bw2_probe(struct of_device *op, const struct of_device_id *
         if (!info->screen_base)
                 goto out_unmap_regs;
 
-        bw2_blank(0, info);
+        bw2_blank(FB_BLANK_UNBLANK, info);
 
         bw2_init_fix(info, linebytes);
 
diff --git a/drivers/video/cg14.c b/drivers/video/cg14.c
index 0db0fecba93..b17e7467177 100644
--- a/drivers/video/cg14.c
+++ b/drivers/video/cg14.c
@@ -17,10 +17,9 @@
 #include <linux/fb.h>
 #include <linux/mm.h>
 #include <linux/uaccess.h>
+#include <linux/of_device.h>
 
 #include <asm/io.h>
-#include <asm/prom.h>
-#include <asm/of_device.h>
 #include <asm/fbio.h>
 
 #include "sbuslib.h"
@@ -482,7 +481,7 @@ static int __devinit cg14_probe(struct of_device *op, const struct of_device_id
 
         spin_lock_init(&par->lock);
 
-        sbusfb_fill_var(&info->var, dp->node, 8);
+        sbusfb_fill_var(&info->var, dp, 8);
         info->var.red.length = 8;
         info->var.green.length = 8;
         info->var.blue.length = 8;
diff --git a/drivers/video/cg3.c b/drivers/video/cg3.c
index 010ea53978f..3aa7b6cb026 100644
--- a/drivers/video/cg3.c
+++ b/drivers/video/cg3.c
@@ -17,11 +17,9 @@
 #include <linux/init.h>
 #include <linux/fb.h>
 #include <linux/mm.h>
+#include <linux/of_device.h>
 
 #include <asm/io.h>
-#include <asm/oplib.h>
-#include <asm/prom.h>
-#include <asm/of_device.h>
 #include <asm/fbio.h>
 
 #include "sbuslib.h"
@@ -373,7 +371,7 @@ static int __devinit cg3_probe(struct of_device *op,
         par->physbase = op->resource[0].start;
         par->which_io = op->resource[0].flags & IORESOURCE_BITS;
 
-        sbusfb_fill_var(&info->var, dp->node, 8);
+        sbusfb_fill_var(&info->var, dp, 8);
         info->var.red.length = 8;
         info->var.green.length = 8;
         info->var.blue.length = 8;
@@ -398,7 +396,7 @@ static int __devinit cg3_probe(struct of_device *op,
         if (!info->screen_base)
                 goto out_unmap_regs;
 
-        cg3_blank(0, info);
+        cg3_blank(FB_BLANK_UNBLANK, info);
 
         if (!of_find_property(dp, "width", NULL)) {
                 err = cg3_do_default_mode(par);
diff --git a/drivers/video/cg6.c b/drivers/video/cg6.c
index fc90db6da65..2f64bb3bd25 100644
--- a/drivers/video/cg6.c
+++ b/drivers/video/cg6.c
@@ -17,9 +17,9 @@
 #include <linux/init.h>
 #include <linux/fb.h>
 #include <linux/mm.h>
+#include <linux/of_device.h>
 
 #include <asm/io.h>
-#include <asm/of_device.h>
 #include <asm/fbio.h>
 
 #include "sbuslib.h"
@@ -728,7 +728,7 @@ static int __devinit cg6_probe(struct of_device *op,
         par->physbase = op->resource[0].start;
         par->which_io = op->resource[0].flags & IORESOURCE_BITS;
 
-        sbusfb_fill_var(&info->var, dp->node, 8);
+        sbusfb_fill_var(&info->var, dp, 8);
         info->var.red.length = 8;
         info->var.green.length = 8;
         info->var.blue.length = 8;
@@ -767,7 +767,7 @@ static int __devinit cg6_probe(struct of_device *op,
 
         cg6_bt_init(par);
         cg6_chip_init(info);
-        cg6_blank(0, info);
+        cg6_blank(FB_BLANK_UNBLANK, info);
 
         if (fb_alloc_cmap(&info->cmap, 256, 0))
                 goto out_unmap_regs;
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index ad31983b43e..5fa8b76673c 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -1853,6 +1853,8 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
         struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
         struct display *p = &fb_display[vc->vc_num];
         int scroll_partial = info->flags & FBINFO_PARTIAL_PAN_OK;
+        unsigned short saved_ec;
+        int ret;
 
         if (fbcon_is_inactive(vc, info))
                 return -EINVAL;
@@ -1865,6 +1867,11 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
          *           whole screen (prevents flicker).
          */
 
+        saved_ec = vc->vc_video_erase_char;
+        vc->vc_video_erase_char = vc->vc_scrl_erase_char;
+
+        ret = 0;
+
         switch (dir) {
         case SM_UP:
                 if (count > vc->vc_rows)        /* Maximum realistic size */
@@ -1883,7 +1890,7 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
                                                         (b - count)),
                                     vc->vc_scrl_erase_char,
                                     vc->vc_size_row * count);
-                        return 1;
+                        ret = 1;
                         break;
 
                 case SCROLL_WRAP_MOVE:
@@ -1955,7 +1962,8 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
                                                         (b - count)),
                                     vc->vc_scrl_erase_char,
                                     vc->vc_size_row * count);
-                        return 1;
+                        ret = 1;
+                        break;
                 }
                 break;
 
@@ -1974,7 +1982,7 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
                                                         t),
                                     vc->vc_scrl_erase_char,
                                     vc->vc_size_row * count);
-                        return 1;
+                        ret = 1;
                         break;
 
                 case SCROLL_WRAP_MOVE:
@@ -2044,10 +2052,13 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
                                                         t),
                                     vc->vc_scrl_erase_char,
                                     vc->vc_size_row * count);
-                        return 1;
+                        ret = 1;
+                        break;
                 }
+                break;
         }
-        return 0;
+        vc->vc_video_erase_char = saved_ec;
+        return ret;
 }
 
 
@@ -2507,6 +2518,9 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
                         c = vc->vc_video_erase_char;
                         vc->vc_video_erase_char =
                             ((c & 0xfe00) >> 1) | (c & 0xff);
+                        c = vc->vc_def_color;
+                        vc->vc_scrl_erase_char =
+                            ((c & 0xFE00) >> 1) | (c & 0xFF);
                         vc->vc_attr >>= 1;
                 }
         } else if (!vc->vc_hi_font_mask && cnt == 512) {
@@ -2537,9 +2551,14 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
                         if (vc->vc_can_do_color) {
                                 vc->vc_video_erase_char =
                                     ((c & 0xff00) << 1) | (c & 0xff);
+                                c = vc->vc_def_color;
+                                vc->vc_scrl_erase_char =
+                                    ((c & 0xFF00) << 1) | (c & 0xFF);
                                 vc->vc_attr <<= 1;
-                        } else
+                        } else {
                                 vc->vc_video_erase_char = c & ~0x100;
+                                vc->vc_scrl_erase_char = c & ~0x100;
+                        }
                 }
 
         }
diff --git a/drivers/video/ffb.c b/drivers/video/ffb.c
index 93dca3e2aa5..7992b13ee68 100644
--- a/drivers/video/ffb.c
+++ b/drivers/video/ffb.c
@@ -16,11 +16,10 @@
 #include <linux/fb.h>
 #include <linux/mm.h>
 #include <linux/timer.h>
+#include <linux/of_device.h>
 
 #include <asm/io.h>
 #include <asm/upa.h>
-#include <asm/prom.h>
-#include <asm/of_device.h>
 #include <asm/fbio.h>
 
 #include "sbuslib.h"
@@ -941,7 +940,7 @@ static int __devinit ffb_probe(struct of_device *op,
         info->screen_base = (char *) par->physbase + FFB_DFB24_POFF;
         info->pseudo_palette = par->pseudo_palette;
 
-        sbusfb_fill_var(&info->var, dp->node, 32);
+        sbusfb_fill_var(&info->var, dp, 32);
         par->fbsize = PAGE_ALIGN(info->var.xres * info->var.yres * 4);
         ffb_fixup_var_rgb(&info->var);
 
@@ -987,7 +986,7 @@ static int __devinit ffb_probe(struct of_device *op,
          * chosen console, it will have video outputs off in
          * the DAC.
          */
-        ffb_blank(0, info);
+        ffb_blank(FB_BLANK_UNBLANK, info);
 
         if (fb_alloc_cmap(&info->cmap, 256, 0))
                 goto out_unmap_dac;
diff --git a/drivers/video/leo.c b/drivers/video/leo.c
index f3160fc2979..8bc46e93034 100644
--- a/drivers/video/leo.c
+++ b/drivers/video/leo.c
@@ -16,10 +16,9 @@
 #include <linux/init.h>
 #include <linux/fb.h>
 #include <linux/mm.h>
+#include <linux/of_device.h>
 
 #include <asm/io.h>
-#include <asm/prom.h>
-#include <asm/of_device.h>
 #include <asm/fbio.h>
 
 #include "sbuslib.h"
@@ -562,7 +561,7 @@ static int __devinit leo_probe(struct of_device *op, const struct of_device_id *
         par->physbase = op->resource[0].start;
         par->which_io = op->resource[0].flags & IORESOURCE_BITS;
 
-        sbusfb_fill_var(&info->var, dp->node, 32);
+        sbusfb_fill_var(&info->var, dp, 32);
         leo_fixup_var_rgb(&info->var);
 
         linebytes = of_getintprop_default(dp, "linebytes",
@@ -601,7 +600,7 @@ static int __devinit leo_probe(struct of_device *op, const struct of_device_id *
         leo_init_wids(info);
         leo_init_hw(info);
 
-        leo_blank(0, info);
+        leo_blank(FB_BLANK_UNBLANK, info);
 
         if (fb_alloc_cmap(&info->cmap, 256, 0))
                 goto out_unmap_regs;
diff --git a/drivers/video/p9100.c b/drivers/video/p9100.c
index c95874fe907..9e903454ffc 100644
--- a/drivers/video/p9100.c
+++ b/drivers/video/p9100.c
@@ -15,10 +15,9 @@
 #include <linux/init.h>
 #include <linux/fb.h>
 #include <linux/mm.h>
+#include <linux/of_device.h>
 
 #include <asm/io.h>
-#include <asm/prom.h>
-#include <asm/of_device.h>
 #include <asm/fbio.h>
 
 #include "sbuslib.h"
@@ -275,7 +274,7 @@ static int __devinit p9100_probe(struct of_device *op, const struct of_device_id
         par->physbase = op->resource[2].start;
         par->which_io = op->resource[2].flags & IORESOURCE_BITS;
 
-        sbusfb_fill_var(&info->var, dp->node, 8);
+        sbusfb_fill_var(&info->var, dp, 8);
         info->var.red.length = 8;
         info->var.green.length = 8;
         info->var.blue.length = 8;
@@ -295,7 +294,7 @@ static int __devinit p9100_probe(struct of_device *op, const struct of_device_id
         if (!info->screen_base)
                 goto out_unmap_regs;
 
-        p9100_blank(0, info);
+        p9100_blank(FB_BLANK_UNBLANK, info);
 
         if (fb_alloc_cmap(&info->cmap, 256, 0))
                 goto out_unmap_screen;
diff --git a/drivers/video/pnx4008/pnxrgbfb.c b/drivers/video/pnx4008/pnxrgbfb.c
index 685761a0732..4db6b48a871 100644
--- a/drivers/video/pnx4008/pnxrgbfb.c
+++ b/drivers/video/pnx4008/pnxrgbfb.c
@@ -100,7 +100,6 @@ static int rgbfb_remove(struct platform_device *pdev)
                 fb_dealloc_cmap(&info->cmap);
                 framebuffer_release(info);
                 platform_set_drvdata(pdev, NULL);
-                kfree(info);
         }
 
         pnx4008_free_dum_channel(channel_owned, pdev->id);
@@ -168,23 +167,21 @@ static int __devinit rgbfb_probe(struct platform_device *pdev)
 
         ret = fb_alloc_cmap(&info->cmap, 256, 0);
         if (ret < 0)
-                goto err2;
+                goto err1;
 
         ret = register_framebuffer(info);
         if (ret < 0)
-                goto err3;
+                goto err2;
         platform_set_drvdata(pdev, info);
 
         return 0;
 
-err3:
-        fb_dealloc_cmap(&info->cmap);
 err2:
-        framebuffer_release(info);
+        fb_dealloc_cmap(&info->cmap);
 err1:
         pnx4008_free_dum_channel(channel_owned, pdev->id);
 err0:
-        kfree(info);
+        framebuffer_release(info);
 err:
         return ret;
 }
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 3ab6e3d973a..48aea39c35a 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -1301,8 +1301,8 @@ static void pxafb_decode_mode_info(struct pxafb_info *fbi,
         }
 }
 
-static int pxafb_decode_mach_info(struct pxafb_info *fbi,
-                                  struct pxafb_mach_info *inf)
+static void pxafb_decode_mach_info(struct pxafb_info *fbi,
+                                   struct pxafb_mach_info *inf)
 {
         unsigned int lcd_conn = inf->lcd_conn;
 
@@ -1333,7 +1333,7 @@ static int pxafb_decode_mach_info(struct pxafb_info *fbi,
                 fbi->lccr0 = inf->lccr0;
                 fbi->lccr3 = inf->lccr3;
                 fbi->lccr4 = inf->lccr4;
-                return -EINVAL;
+                goto decode_mode;
         }
 
         if (lcd_conn == LCD_MONO_STN_8BPP)
@@ -1343,8 +1343,8 @@ static int pxafb_decode_mach_info(struct pxafb_info *fbi,
         fbi->lccr3 |= (lcd_conn & LCD_BIAS_ACTIVE_LOW) ? LCCR3_OEP : 0;
         fbi->lccr3 |= (lcd_conn & LCD_PCLK_EDGE_FALL)  ? LCCR3_PCP : 0;
 
+decode_mode:
         pxafb_decode_mode_info(fbi, inf->modes, inf->num_modes);
-        return 0;
 }
 
 static struct pxafb_info * __init pxafb_init_fbinfo(struct device *dev)
diff --git a/drivers/video/sbuslib.c b/drivers/video/sbuslib.c
index 4deaac05b93..37d764ad56b 100644
--- a/drivers/video/sbuslib.c
+++ b/drivers/video/sbuslib.c
@@ -10,18 +10,19 @@
 #include <linux/fb.h>
 #include <linux/mm.h>
 #include <linux/uaccess.h>
+#include <linux/of_device.h>
 
-#include <asm/oplib.h>
 #include <asm/fbio.h>
 
 #include "sbuslib.h"
 
-void sbusfb_fill_var(struct fb_var_screeninfo *var, int prom_node, int bpp)
+void sbusfb_fill_var(struct fb_var_screeninfo *var, struct device_node *dp,
+                     int bpp)
 {
         memset(var, 0, sizeof(*var));
 
-        var->xres = prom_getintdefault(prom_node, "width", 1152);
-        var->yres = prom_getintdefault(prom_node, "height", 900);
+        var->xres = of_getintprop_default(dp, "width", 1152);
+        var->yres = of_getintprop_default(dp, "height", 900);
         var->xres_virtual = var->xres;
         var->yres_virtual = var->yres;
         var->bits_per_pixel = bpp;
diff --git a/drivers/video/sbuslib.h b/drivers/video/sbuslib.h
index 492828c3fe8..7ba3250236b 100644
--- a/drivers/video/sbuslib.h
+++ b/drivers/video/sbuslib.h
@@ -11,7 +11,8 @@ struct sbus_mmap_map {
 #define SBUS_MMAP_FBSIZE(n) (-n)
 #define SBUS_MMAP_EMPTY 0x80000000
 
-extern void sbusfb_fill_var(struct fb_var_screeninfo *var, int prom_node, int bpp);
+extern void sbusfb_fill_var(struct fb_var_screeninfo *var,
+                            struct device_node *dp, int bpp);
 struct vm_area_struct;
 extern int sbusfb_mmap_helper(struct sbus_mmap_map *map,
                               unsigned long physbase, unsigned long fbsize,
@@ -21,6 +22,6 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
                         struct fb_info *info,
                         int type, int fb_depth, unsigned long fb_size);
 int sbusfb_compat_ioctl(struct fb_info *info, unsigned int cmd,
-                unsigned long arg);
+                        unsigned long arg);
 
 #endif /* _SBUSLIB_H */
diff --git a/drivers/video/sunxvr2500.c b/drivers/video/sunxvr2500.c
index c3869a96ab5..b1dde09e701 100644
--- a/drivers/video/sunxvr2500.c
+++ b/drivers/video/sunxvr2500.c
@@ -9,10 +9,9 @@
 #include <linux/fb.h>
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/of_device.h>
 
 #include <asm/io.h>
-#include <asm/prom.h>
-#include <asm/of_device.h>
 
 struct s3d_info {
         struct fb_info          *info;
diff --git a/drivers/video/sunxvr500.c b/drivers/video/sunxvr500.c
index 71bf3f1f00b..c2ba51b7ea1 100644
--- a/drivers/video/sunxvr500.c
+++ b/drivers/video/sunxvr500.c
@@ -9,10 +9,9 @@
 #include <linux/fb.h>
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/of_device.h>
 
 #include <asm/io.h>
-#include <asm/prom.h>
-#include <asm/of_device.h>
 
 /* XXX This device has a 'dev-comm' property which aparently is
  * XXX a pointer into the openfirmware's address space which is
diff --git a/drivers/video/tcx.c b/drivers/video/tcx.c
index a7177430577..2a03f78bbb0 100644
--- a/drivers/video/tcx.c
+++ b/drivers/video/tcx.c
@@ -17,10 +17,9 @@
 #include <linux/init.h>
 #include <linux/fb.h>
 #include <linux/mm.h>
+#include <linux/of_device.h>
 
 #include <asm/io.h>
-#include <asm/prom.h>
-#include <asm/of_device.h>
 #include <asm/fbio.h>
 
 #include "sbuslib.h"
@@ -84,7 +83,7 @@ struct tcx_tec {
 
 struct tcx_thc {
         u32 thc_rev;
-        u32 thc_pad0[511];
+        u32 thc_pad0[511];
         u32 thc_hs;             /* hsync timing */
         u32 thc_hsdvs;
         u32 thc_hd;
@@ -126,10 +125,10 @@ struct tcx_par {
 };
 
 /* Reset control plane so that WID is 8-bit plane. */
-static void __tcx_set_control_plane (struct tcx_par *par)
+static void __tcx_set_control_plane(struct tcx_par *par)
 {
         u32 __iomem *p, *pend;
-        
+
         if (par->lowdepth)
                 return;
 
@@ -143,8 +142,8 @@ static void __tcx_set_control_plane (struct tcx_par *par)
                 sbus_writel(tmp, p);
         }
 }
-                                                
-static void tcx_reset (struct fb_info *info)
+
+static void tcx_reset(struct fb_info *info)
 {
         struct tcx_par *par = (struct tcx_par *) info->par;
         unsigned long flags;
@@ -365,7 +364,8 @@ static void tcx_unmap_regs(struct of_device *op, struct fb_info *info,
                            info->screen_base, par->fbsize);
 }
 
-static int __devinit tcx_init_one(struct of_device *op)
+static int __devinit tcx_probe(struct of_device *op,
+                               const struct of_device_id *match)
 {
         struct device_node *dp = op->node;
         struct fb_info *info;
@@ -384,7 +384,7 @@ static int __devinit tcx_init_one(struct of_device *op)
         par->lowdepth =
                 (of_find_property(dp, "tcx-8-bit", NULL) != NULL);
 
-        sbusfb_fill_var(&info->var, dp->node, 8);
+        sbusfb_fill_var(&info->var, dp, 8);
         info->var.red.length = 8;
         info->var.green.length = 8;
         info->var.blue.length = 8;
@@ -488,13 +488,6 @@ out_err:
         return err;
 }
 
-static int __devinit tcx_probe(struct of_device *dev, const struct of_device_id *match)
-{
-        struct of_device *op = to_of_device(&dev->dev);
-
-        return tcx_init_one(op);
-}
-
 static int __devexit tcx_remove(struct of_device *op)
 {
         struct fb_info *info = dev_get_drvdata(&op->dev);
diff --git a/drivers/video/tridentfb.c b/drivers/video/tridentfb.c
index bd54cd0de39..beefab2992c 100644
--- a/drivers/video/tridentfb.c
+++ b/drivers/video/tridentfb.c
@@ -27,7 +27,6 @@
 #define VERSION         "0.7.8-NEWAPI"
 
 struct tridentfb_par {
-        int vclk;               /* in MHz */
         void __iomem *io_virt;  /* iospace virtual memory address */
 };
 
@@ -669,27 +668,26 @@ static void set_screen_start(int base)
                  (read3X4(CRTHiOrd) & 0xF8) | ((base & 0xE0000) >> 17));
 }
 
-/* Use 20.12 fixed-point for NTSC value and frequency calculation */
-#define calc_freq(n, m, k)  ( ((unsigned long)0xE517 * (n + 8) / ((m + 2) * (1 << k))) >> 12 )
-
 /* Set dotclock frequency */
-static void set_vclk(int freq)
+static void set_vclk(unsigned long freq)
 {
         int m, n, k;
-        int f, fi, d, di;
+        unsigned long f, fi, d, di;
         unsigned char lo = 0, hi = 0;
 
-        d = 20;
+        d = 20000;
         for (k = 2; k >= 0; k--)
                 for (m = 0; m < 63; m++)
                         for (n = 0; n < 128; n++) {
-                                fi = calc_freq(n, m, k);
+                                fi = ((14318l * (n + 8)) / (m + 2)) >> k;
                                 if ((di = abs(fi - freq)) < d) {
                                         d = di;
                                         f = fi;
                                         lo = n;
                                         hi = (k << 6) | m;
                                 }
+                                if (fi > freq)
+                                        break;
                         }
         if (chip3D) {
                 write3C4(ClockHigh, hi);
@@ -888,6 +886,8 @@ static int tridentfb_set_par(struct fb_info *info)
         struct fb_var_screeninfo *var = &info->var;
         int bpp = var->bits_per_pixel;
         unsigned char tmp;
+        unsigned long vclk;
+
         debug("enter\n");
         hdispend = var->xres / 8 - 1;
         hsyncstart = (var->xres + var->right_margin) / 8;
@@ -905,7 +905,6 @@ static int tridentfb_set_par(struct fb_info *info)
         vblankstart = var->yres;
         vblankend = vtotal + 2;
 
-        enable_mmio();
         crtc_unlock();
         write3CE(CyberControl, 8);
 
@@ -1015,11 +1014,11 @@ static int tridentfb_set_par(struct fb_info *info)
         write3X4(Performance, 0x92);
         write3X4(PCIReg, 0x07);         /* MMIO & PCI read and write burst enable */
 
-        /* convert from picoseconds to MHz */
-        par->vclk = 1000000 / info->var.pixclock;
+        /* convert from picoseconds to kHz */
+        vclk = PICOS2KHZ(info->var.pixclock);
         if (bpp == 32)
-                par->vclk *= 2;
-        set_vclk(par->vclk);
+                vclk *= 2;
+        set_vclk(vclk);
 
         write3C4(0, 3);
         write3C4(1, 1);         /* set char clock 8 dots wide */
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index b535483bc55..13866789b35 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -80,19 +80,51 @@ static void add_status(struct virtio_device *dev, unsigned status)
         dev->config->set_status(dev, dev->config->get_status(dev) | status);
 }
 
+void virtio_check_driver_offered_feature(const struct virtio_device *vdev,
+                                         unsigned int fbit)
+{
+        unsigned int i;
+        struct virtio_driver *drv = container_of(vdev->dev.driver,
+                                                 struct virtio_driver, driver);
+
+        for (i = 0; i < drv->feature_table_size; i++)
+                if (drv->feature_table[i] == fbit)
+                        return;
+        BUG();
+}
+EXPORT_SYMBOL_GPL(virtio_check_driver_offered_feature);
+
 static int virtio_dev_probe(struct device *_d)
 {
-        int err;
+        int err, i;
         struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
         struct virtio_driver *drv = container_of(dev->dev.driver,
                                                  struct virtio_driver, driver);
+        u32 device_features;
 
+        /* We have a driver! */
         add_status(dev, VIRTIO_CONFIG_S_DRIVER);
+
+        /* Figure out what features the device supports. */
+        device_features = dev->config->get_features(dev);
+
+        /* Features supported by both device and driver into dev->features. */
+        memset(dev->features, 0, sizeof(dev->features));
+        for (i = 0; i < drv->feature_table_size; i++) {
+                unsigned int f = drv->feature_table[i];
+                BUG_ON(f >= 32);
+                if (device_features & (1 << f))
+                        set_bit(f, dev->features);
+        }
+
         err = drv->probe(dev);
         if (err)
                 add_status(dev, VIRTIO_CONFIG_S_FAILED);
-        else
+        else {
                 add_status(dev, VIRTIO_CONFIG_S_DRIVER_OK);
+                /* They should never have set feature bits beyond 32 */
+                dev->config->set_features(dev, dev->features[0]);
+        }
         return err;
 }
 
@@ -114,6 +146,8 @@ static int virtio_dev_remove(struct device *_d)
 
 int register_virtio_driver(struct virtio_driver *driver)
 {
+        /* Catch this early. */
+        BUG_ON(driver->feature_table_size && !driver->feature_table);
         driver->driver.bus = &virtio_bus;
         driver->driver.probe = virtio_dev_probe;
         driver->driver.remove = virtio_dev_remove;
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 0b3efc31ee6..bfef604160d 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -155,9 +155,9 @@ static void virtballoon_changed(struct virtio_device *vdev)
 static inline s64 towards_target(struct virtio_balloon *vb)
 {
         u32 v;
-        __virtio_config_val(vb->vdev,
-                            offsetof(struct virtio_balloon_config, num_pages),
-                            &v);
+        vb->vdev->config->get(vb->vdev,
+                              offsetof(struct virtio_balloon_config, num_pages),
+                              &v, sizeof(v));
         return v - vb->num_pages;
 }
 
@@ -227,7 +227,7 @@ static int virtballoon_probe(struct virtio_device *vdev)
         }
 
         vb->tell_host_first
-                = vdev->config->feature(vdev, VIRTIO_BALLOON_F_MUST_TELL_HOST);
+                = virtio_has_feature(vdev, VIRTIO_BALLOON_F_MUST_TELL_HOST);
 
         return 0;
 
@@ -259,7 +259,11 @@ static void virtballoon_remove(struct virtio_device *vdev)
         kfree(vb);
 }
 
+static unsigned int features[] = { VIRTIO_BALLOON_F_MUST_TELL_HOST };
+
 static struct virtio_driver virtio_balloon = {
+        .feature_table = features,
+        .feature_table_size = ARRAY_SIZE(features),
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index c0df924766a..27e9fc9117c 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -87,23 +87,22 @@ static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
         return container_of(vdev, struct virtio_pci_device, vdev);
 }
 
-/* virtio config->feature() implementation */
-static bool vp_feature(struct virtio_device *vdev, unsigned bit)
+/* virtio config->get_features() implementation */
+static u32 vp_get_features(struct virtio_device *vdev)
+{
+        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+
+        /* When someone needs more than 32 feature bits, we'll need to
+         * steal a bit to indicate that the rest are somewhere else. */
+        return ioread32(vp_dev->ioaddr + VIRTIO_PCI_HOST_FEATURES);
+}
+
+/* virtio config->set_features() implementation */
+static void vp_set_features(struct virtio_device *vdev, u32 features)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        u32 mask;
-
-        /* Since this function is supposed to have the side effect of
-         * enabling a queried feature, we simulate that by doing a read
-         * from the host feature bitmask and then writing to the guest
-         * feature bitmask */
-        mask = ioread32(vp_dev->ioaddr + VIRTIO_PCI_HOST_FEATURES);
-        if (mask & (1 << bit)) {
-                mask |= (1 << bit);
-                iowrite32(mask, vp_dev->ioaddr + VIRTIO_PCI_GUEST_FEATURES);
-        }
 
-        return !!(mask & (1 << bit));
+        iowrite32(features, vp_dev->ioaddr + VIRTIO_PCI_GUEST_FEATURES);
 }
 
 /* virtio config->get() implementation */
@@ -145,14 +144,14 @@ static void vp_set_status(struct virtio_device *vdev, u8 status)
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         /* We should never be setting status to 0. */
         BUG_ON(status == 0);
-        return iowrite8(status, vp_dev->ioaddr + VIRTIO_PCI_STATUS);
+        iowrite8(status, vp_dev->ioaddr + VIRTIO_PCI_STATUS);
 }
 
 static void vp_reset(struct virtio_device *vdev)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         /* 0 status means a reset. */
-        return iowrite8(0, vp_dev->ioaddr + VIRTIO_PCI_STATUS);
+        iowrite8(0, vp_dev->ioaddr + VIRTIO_PCI_STATUS);
 }
 
 /* the notify function used when creating a virt queue */
@@ -293,7 +292,6 @@ static void vp_del_vq(struct virtqueue *vq)
 }
 
 static struct virtio_config_ops virtio_pci_config_ops = {
-        .feature        = vp_feature,
         .get            = vp_get,
         .set            = vp_set,
         .get_status     = vp_get_status,
@@ -301,6 +299,8 @@ static struct virtio_config_ops virtio_pci_config_ops = {
         .reset          = vp_reset,
         .find_vq        = vp_find_vq,
         .del_vq         = vp_del_vq,
+        .get_features   = vp_get_features,
+        .set_features   = vp_set_features,
 };
 
 /* the PCI probing function */
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index c2fa5c63081..937a49d6772 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -184,6 +184,11 @@ static void *vring_get_buf(struct virtqueue *_vq, unsigned int *len)
 
         START_USE(vq);
 
+        if (unlikely(vq->broken)) {
+                END_USE(vq);
+                return NULL;
+        }
+
         if (!more_used(vq)) {
                 pr_debug("No more buffers in queue\n");
                 END_USE(vq);