Merge branch 'master'

1288 files changed, 42858 insertions, 15602 deletions

diff --git a/CREDITS b/CREDITS
index f553f8cfaa62..a347520bef2d 100644
--- a/CREDITS
+++ b/CREDITS
@@ -2211,6 +2211,15 @@ D: OV511 driver
 S: (address available on request)
 S: USA
 
+N: Ian McDonald
+E: iam4@cs.waikato.ac.nz
+E: imcdnzl@gmail.com
+W: http://wand.net.nz/~iam4
+W: http://imcdnzl.blogspot.com
+D: DCCP, CCID3
+S: Hamilton
+S: New Zealand
+
 N: Patrick McHardy
 E: kaber@trash.net
 P: 1024D/12155E80 B128 7DE6 FF0A C2B2 48BE  AB4C C9D4 964E 1215 5E80
@@ -2246,19 +2255,12 @@ S: D-90453 Nuernberg
 S: Germany
 
 N: Arnaldo Carvalho de Melo
-E: acme@conectiva.com.br
-E: acme@kernel.org
-E: acme@gnu.org
-W: http://bazar2.conectiva.com.br/~acme
-W: http://advogato.org/person/acme
+E: acme@mandriva.com
+E: acme@ghostprotocols.net
+W: http://oops.ghostprotocols.net:81/blog/
 P: 1024D/9224DF01 D5DF E3BB E3C8 BCBB F8AD  841A B6AB 4681 9224 DF01
-D: wanrouter hacking
-D: misc Makefile, Config.in, drivers and network stacks fixes
-D: IPX & LLC network stacks maintainer
-D: Cyclom 2X synchronous card driver
-D: wl3501 PCMCIA wireless card driver
-D: i18n for minicom, net-tools, util-linux, fetchmail, etc
-S: Conectiva S.A.
+D: IPX, LLC, DCCP, cyc2x, wl3501_cs, net/ hacks
+S: Mandriva
 S: R. Tocantins, 89 - Cristo Rei
 S: 80050-430 - Curitiba - Paraná
 S: Brazil
diff --git a/Documentation/Changes b/Documentation/Changes
index 5eaab0441d76..27232be26e1a 100644
--- a/Documentation/Changes
+++ b/Documentation/Changes
@@ -237,6 +237,12 @@ udev
 udev is a userspace application for populating /dev dynamically with
 only entries for devices actually present. udev replaces devfs.
 
+FUSE
+----
+
+Needs libfuse 2.4.0 or later.  Absolute minimum is 2.3.0 but mount
+options 'direct_io' and 'kernel_cache' won't work.
+
 Networking
 ==========
 
@@ -390,6 +396,10 @@ udev
 ----
 o <http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html>
 
+FUSE
+----
+o <http://sourceforge.net/projects/fuse>
+
 Networking
 **********
 
diff --git a/Documentation/CodingStyle b/Documentation/CodingStyle
index 22e5f9036f3c..eb7db3c19227 100644
--- a/Documentation/CodingStyle
+++ b/Documentation/CodingStyle
@@ -410,7 +410,26 @@ Kernel messages do not have to be terminated with a period.
 Printing numbers in parentheses (%d) adds no value and should be avoided.
 
 
-                Chapter 13: References
+                Chapter 13: Allocating memory
+
+The kernel provides the following general purpose memory allocators:
+kmalloc(), kzalloc(), kcalloc(), and vmalloc().  Please refer to the API
+documentation for further information about them.
+
+The preferred form for passing a size of a struct is the following:
+
+        p = kmalloc(sizeof(*p), ...);
+
+The alternative form where struct name is spelled out hurts readability and
+introduces an opportunity for a bug when the pointer variable type is changed
+but the corresponding sizeof that is passed to a memory allocator is not.
+
+Casting the return value which is a void pointer is redundant. The conversion
+from void pointer to any other pointer type is guaranteed by the C programming
+language.
+
+
+                Chapter 14: References
 
 The C Programming Language, Second Edition
 by Brian W. Kernighan and Dennis M. Ritchie.
diff --git a/Documentation/DocBook/kernel-hacking.tmpl b/Documentation/DocBook/kernel-hacking.tmpl
index 6367bba32d22..582032eea872 100644
--- a/Documentation/DocBook/kernel-hacking.tmpl
+++ b/Documentation/DocBook/kernel-hacking.tmpl
@@ -1105,7 +1105,7 @@ static struct block_device_operations opt_fops = {
     </listitem>
     <listitem>
      <para>
-      Function names as strings (__func__).
+      Function names as strings (__FUNCTION__).
      </para>
     </listitem>
     <listitem>
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 7f43b040311e..237d54c44bc5 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -301,8 +301,84 @@ now, but you can do this to mark internal company procedures or just
 point out some special detail about the sign-off. 
 
 
+12) The canonical patch format
 
-12) More references for submitting patches
+The canonical patch subject line is:
+
+    Subject: [PATCH 001/123] subsystem: summary phrase
+
+The canonical patch message body contains the following:
+
+  - A "from" line specifying the patch author.
+
+  - An empty line.
+
+  - The body of the explanation, which will be copied to the
+    permanent changelog to describe this patch.
+
+  - The "Signed-off-by:" lines, described above, which will
+    also go in the changelog.
+
+  - A marker line containing simply "---".
+
+  - Any additional comments not suitable for the changelog.
+
+  - The actual patch (diff output).
+
+The Subject line format makes it very easy to sort the emails
+alphabetically by subject line - pretty much any email reader will
+support that - since because the sequence number is zero-padded,
+the numerical and alphabetic sort is the same.
+
+The "subsystem" in the email's Subject should identify which
+area or subsystem of the kernel is being patched.
+
+The "summary phrase" in the email's Subject should concisely
+describe the patch which that email contains.  The "summary
+phrase" should not be a filename.  Do not use the same "summary
+phrase" for every patch in a whole patch series.
+
+Bear in mind that the "summary phrase" of your email becomes
+a globally-unique identifier for that patch.  It propagates
+all the way into the git changelog.  The "summary phrase" may
+later be used in developer discussions which refer to the patch.
+People will want to google for the "summary phrase" to read
+discussion regarding that patch.
+
+A couple of example Subjects:
+
+    Subject: [patch 2/5] ext2: improve scalability of bitmap searching
+    Subject: [PATCHv2 001/207] x86: fix eflags tracking
+
+The "from" line must be the very first line in the message body,
+and has the form:
+
+        From: Original Author <author@example.com>
+
+The "from" line specifies who will be credited as the author of the
+patch in the permanent changelog.  If the "from" line is missing,
+then the "From:" line from the email header will be used to determine
+the patch author in the changelog.
+
+The explanation body will be committed to the permanent source
+changelog, so should make sense to a competent reader who has long
+since forgotten the immediate details of the discussion that might
+have led to this patch.
+
+The "---" marker line serves the essential purpose of marking for patch
+handling tools where the changelog message ends.
+
+One good use for the additional comments after the "---" marker is for
+a diffstat, to show what files have changed, and the number of inserted
+and deleted lines per file.  A diffstat is especially useful on bigger
+patches.  Other comments relevant only to the moment or the maintainer,
+not suitable for the permanent changelog, should also go here.
+
+See more details on the proper patch format in the following
+references.
+
+
+13) More references for submitting patches
 
 Andrew Morton, "The perfect patch" (tpp).
   <http://www.zip.com.au/~akpm/linux/patches/stuff/tpp.txt>
@@ -310,6 +386,14 @@ Andrew Morton, "The perfect patch" (tpp).
 Jeff Garzik, "Linux kernel patch submission format."
   <http://linux.yyz.us/patch-format.html>
 
+Greg KH, "How to piss off a kernel subsystem maintainer"
+  <http://www.kroah.com/log/2005/03/31/>
+
+Kernel Documentation/CodingStyle
+  <http://sosdg.org/~coywolf/lxr/source/Documentation/CodingStyle>
+
+Linus Torvald's mail on the canonical patch format:
+  <http://lkml.org/lkml/2005/4/7/183>
 
 
 -----------------------------------
diff --git a/Documentation/cciss.txt b/Documentation/cciss.txt
index c8f9a73111da..68a711fb82cf 100644
--- a/Documentation/cciss.txt
+++ b/Documentation/cciss.txt
@@ -17,7 +17,9 @@ This driver is known to work with the following cards:
         * SA P600
         * SA P800
         * SA E400
-        * SA E300
+        * SA P400i
+        * SA E200
+        * SA E200i
 
 If nodes are not already created in the /dev/cciss directory, run as root:
 
diff --git a/Documentation/dell_rbu.txt b/Documentation/dell_rbu.txt
index bcfa5c35036b..95d7f62e4dbc 100644
--- a/Documentation/dell_rbu.txt
+++ b/Documentation/dell_rbu.txt
@@ -13,6 +13,8 @@ the BIOS on Dell servers (starting from servers sold since 1999), desktops
 and notebooks (starting from those sold in 2005).
 Please go to  http://support.dell.com register and you can find info on
 OpenManage and Dell Update packages (DUP).
+Libsmbios can also be used to update BIOS on Dell systems go to
+http://linux.dell.com/libsmbios/ for details.
 
 Dell_RBU driver supports BIOS update using the monilothic image and packetized
 image methods. In case of moniolithic the driver allocates a contiguous chunk
@@ -22,8 +24,8 @@ would place each packet in contiguous physical memory. The driver also
 maintains a link list of packets for reading them back.
 If the dell_rbu driver is unloaded all the allocated memory is freed.
 
-The rbu driver needs to have an application which will inform the BIOS to
-enable the update in the next system reboot.
+The rbu driver needs to have an application (as mentioned above)which will
+inform the BIOS to enable the update in the next system reboot.
 
 The user should not unload the rbu driver after downloading the BIOS image
 or updating.
@@ -42,9 +44,11 @@ In case of packet mechanism the single memory can be broken in smaller chuks
 of contiguous memory and the BIOS image is scattered in these packets.
 
 By default the driver uses monolithic memory for the update type. This can be
-changed to contiguous during the driver load time by specifying the load
+changed to packets during the driver load time by specifying the load
 parameter image_type=packet.  This can also be changed later as below
 echo packet > /sys/devices/platform/dell_rbu/image_type
+Also echoing either mono ,packet or init in to image_type will free up the
+memory allocated by the driver.
 
 Do the steps below to download the BIOS image.
 1) echo 1 > /sys/class/firmware/dell_rbu/loading
@@ -53,9 +57,13 @@ Do the steps below to download the BIOS image.
 
 The /sys/class/firmware/dell_rbu/ entries will remain till the following is
 done.
-echo -1 > /sys/class/firmware/dell_rbu/loading
-
+echo -1 > /sys/class/firmware/dell_rbu/loading.
 Until this step is completed the drivr cannot be unloaded.
+If an user by accident executes steps 1 and 3 above without executing step 2;
+it will make the /sys/class/firmware/dell_rbu/ entries to disappear.
+The entries can be recreated by doing the following
+echo init > /sys/devices/platform/dell_rbu/image_type
+NOTE: echoing init in image_type does not change it original value.
 
 Also the driver provides /sys/devices/platform/dell_rbu/data readonly file to
 read back the image downloaded. This is useful in case of packet update
diff --git a/Documentation/device-mapper/snapshot.txt b/Documentation/device-mapper/snapshot.txt
new file mode 100644
index 000000000000..dca274ff4005
--- /dev/null
+++ b/Documentation/device-mapper/snapshot.txt
@@ -0,0 +1,73 @@
+Device-mapper snapshot support
+==============================
+
+Device-mapper allows you, without massive data copying:
+
+*) To create snapshots of any block device i.e. mountable, saved states of
+the block device which are also writable without interfering with the
+original content;
+*) To create device "forks", i.e. multiple different versions of the
+same data stream.
+
+
+In both cases, dm copies only the chunks of data that get changed and
+uses a separate copy-on-write (COW) block device for storage.
+
+
+There are two dm targets available: snapshot and snapshot-origin.
+
+*) snapshot-origin <origin>
+
+which will normally have one or more snapshots based on it.
+You must create the snapshot-origin device before you can create snapshots.
+Reads will be mapped directly to the backing device. For each write, the
+original data will be saved in the <COW device> of each snapshot to keep
+its visible content unchanged, at least until the <COW device> fills up.
+
+
+*) snapshot <origin> <COW device> <persistent?> <chunksize>
+
+A snapshot is created of the <origin> block device. Changed chunks of
+<chunksize> sectors will be stored on the <COW device>.  Writes will
+only go to the <COW device>.  Reads will come from the <COW device> or
+from <origin> for unchanged data.  <COW device> will often be
+smaller than the origin and if it fills up the snapshot will become
+useless and be disabled, returning errors.  So it is important to monitor
+the amount of free space and expand the <COW device> before it fills up.
+
+<persistent?> is P (Persistent) or N (Not persistent - will not survive
+after reboot).
+
+
+How this is used by LVM2
+========================
+When you create the first LVM2 snapshot of a volume, four dm devices are used:
+
+1) a device containing the original mapping table of the source volume;
+2) a device used as the <COW device>;
+3) a "snapshot" device, combining #1 and #2, which is the visible snapshot
+   volume;
+4) the "original" volume (which uses the device number used by the original
+   source volume), whose table is replaced by a "snapshot-origin" mapping
+   from device #1.
+
+A fixed naming scheme is used, so with the following commands:
+
+lvcreate -L 1G -n base volumeGroup
+lvcreate -L 100M --snapshot -n snap volumeGroup/base
+
+we'll have this situation (with volumes in above order):
+
+# dmsetup table|grep volumeGroup
+
+volumeGroup-base-real: 0 2097152 linear 8:19 384
+volumeGroup-snap-cow: 0 204800 linear 8:19 2097536
+volumeGroup-snap: 0 2097152 snapshot 254:11 254:12 P 16
+volumeGroup-base: 0 2097152 snapshot-origin 254:11
+
+# ls -lL /dev/mapper/volumeGroup-*
+brw-------  1 root root 254, 11 29 ago 18:15 /dev/mapper/volumeGroup-base-real
+brw-------  1 root root 254, 12 29 ago 18:15 /dev/mapper/volumeGroup-snap-cow
+brw-------  1 root root 254, 13 29 ago 18:15 /dev/mapper/volumeGroup-snap
+brw-------  1 root root 254, 10 29 ago 18:14 /dev/mapper/volumeGroup-base
+
diff --git a/Documentation/dontdiff b/Documentation/dontdiff
index 96bea278bbf6..24adfe9af3ca 100644
--- a/Documentation/dontdiff
+++ b/Documentation/dontdiff
@@ -55,6 +55,7 @@ aic7*seq.h*
 aicasm
 aicdb.h*
 asm
+asm-offsets.*
 asm_offsets.*
 autoconf.h*
 bbootsect
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 784e08c1c80a..b67189a8d8d4 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -17,15 +17,6 @@ Who:	Greg Kroah-Hartman <greg@kroah.com>
 
 ---------------------------
 
-What:   io_remap_page_range() (macro or function)
-When:   September 2005
-Why:    Replaced by io_remap_pfn_range() which allows more memory space
-        addressabilty (by using a pfn) and supports sparc & sparc64
-        iospace as part of the pfn.
-Who:    Randy Dunlap <rddunlap@osdl.org>
-
----------------------------
-
 What:   RAW driver (CONFIG_RAW_DRIVER)
 When:   December 2005
 Why:    declared obsolete since kernel 2.6.3
diff --git a/Documentation/filesystems/relayfs.txt b/Documentation/filesystems/relayfs.txt
index d24e1b0d4f39..d803abed29f0 100644
--- a/Documentation/filesystems/relayfs.txt
+++ b/Documentation/filesystems/relayfs.txt
@@ -15,7 +15,7 @@ retrieve the data as it becomes available.
 
 The format of the data logged into the channel buffers is completely
 up to the relayfs client; relayfs does however provide hooks which
-allow clients to impose some stucture on the buffer data.  Nor does
+allow clients to impose some structure on the buffer data.  Nor does
 relayfs implement any form of data filtering - this also is left to
 the client.  The purpose is to keep relayfs as simple as possible.
 
diff --git a/Documentation/ia64/mca.txt b/Documentation/ia64/mca.txt
new file mode 100644
index 000000000000..a71cc6a67ef7
--- /dev/null
+++ b/Documentation/ia64/mca.txt
@@ -0,0 +1,194 @@
+An ad-hoc collection of notes on IA64 MCA and INIT processing.  Feel
+free to update it with notes about any area that is not clear.
+
+---
+
+MCA/INIT are completely asynchronous.  They can occur at any time, when
+the OS is in any state.  Including when one of the cpus is already
+holding a spinlock.  Trying to get any lock from MCA/INIT state is
+asking for deadlock.  Also the state of structures that are protected
+by locks is indeterminate, including linked lists.
+
+---
+
+The complicated ia64 MCA process.  All of this is mandated by Intel's
+specification for ia64 SAL, error recovery and and unwind, it is not as
+if we have a choice here.
+
+* MCA occurs on one cpu, usually due to a double bit memory error.
+  This is the monarch cpu.
+
+* SAL sends an MCA rendezvous interrupt (which is a normal interrupt)
+  to all the other cpus, the slaves.
+
+* Slave cpus that receive the MCA interrupt call down into SAL, they
+  end up spinning disabled while the MCA is being serviced.
+
+* If any slave cpu was already spinning disabled when the MCA occurred
+  then it cannot service the MCA interrupt.  SAL waits ~20 seconds then
+  sends an unmaskable INIT event to the slave cpus that have not
+  already rendezvoused.
+
+* Because MCA/INIT can be delivered at any time, including when the cpu
+  is down in PAL in physical mode, the registers at the time of the
+  event are _completely_ undefined.  In particular the MCA/INIT
+  handlers cannot rely on the thread pointer, PAL physical mode can
+  (and does) modify TP.  It is allowed to do that as long as it resets
+  TP on return.  However MCA/INIT events expose us to these PAL
+  internal TP changes.  Hence curr_task().
+
+* If an MCA/INIT event occurs while the kernel was running (not user
+  space) and the kernel has called PAL then the MCA/INIT handler cannot
+  assume that the kernel stack is in a fit state to be used.  Mainly
+  because PAL may or may not maintain the stack pointer internally.
+  Because the MCA/INIT handlers cannot trust the kernel stack, they
+  have to use their own, per-cpu stacks.  The MCA/INIT stacks are
+  preformatted with just enough task state to let the relevant handlers
+  do their job.
+
+* Unlike most other architectures, the ia64 struct task is embedded in
+  the kernel stack[1].  So switching to a new kernel stack means that
+  we switch to a new task as well.  Because various bits of the kernel
+  assume that current points into the struct task, switching to a new
+  stack also means a new value for current.
+
+* Once all slaves have rendezvoused and are spinning disabled, the
+  monarch is entered.  The monarch now tries to diagnose the problem
+  and decide if it can recover or not.
+
+* Part of the monarch's job is to look at the state of all the other
+  tasks.  The only way to do that on ia64 is to call the unwinder,
+  as mandated by Intel.
+
+* The starting point for the unwind depends on whether a task is
+  running or not.  That is, whether it is on a cpu or is blocked.  The
+  monarch has to determine whether or not a task is on a cpu before it
+  knows how to start unwinding it.  The tasks that received an MCA or
+  INIT event are no longer running, they have been converted to blocked
+  tasks.  But (and its a big but), the cpus that received the MCA
+  rendezvous interrupt are still running on their normal kernel stacks!
+
+* To distinguish between these two cases, the monarch must know which
+  tasks are on a cpu and which are not.  Hence each slave cpu that
+  switches to an MCA/INIT stack, registers its new stack using
+  set_curr_task(), so the monarch can tell that the _original_ task is
+  no longer running on that cpu.  That gives us a decent chance of
+  getting a valid backtrace of the _original_ task.
+
+* MCA/INIT can be nested, to a depth of 2 on any cpu.  In the case of a
+  nested error, we want diagnostics on the MCA/INIT handler that
+  failed, not on the task that was originally running.  Again this
+  requires set_curr_task() so the MCA/INIT handlers can register their
+  own stack as running on that cpu.  Then a recursive error gets a
+  trace of the failing handler's "task".
+
+[1] My (Keith Owens) original design called for ia64 to separate its
+    struct task and the kernel stacks.  Then the MCA/INIT data would be
+    chained stacks like i386 interrupt stacks.  But that required
+    radical surgery on the rest of ia64, plus extra hard wired TLB
+    entries with its associated performance degradation.  David
+    Mosberger vetoed that approach.  Which meant that separate kernel
+    stacks meant separate "tasks" for the MCA/INIT handlers.
+
+---
+
+INIT is less complicated than MCA.  Pressing the nmi button or using
+the equivalent command on the management console sends INIT to all
+cpus.  SAL picks one one of the cpus as the monarch and the rest are
+slaves.  All the OS INIT handlers are entered at approximately the same
+time.  The OS monarch prints the state of all tasks and returns, after
+which the slaves return and the system resumes.
+
+At least that is what is supposed to happen.  Alas there are broken
+versions of SAL out there.  Some drive all the cpus as monarchs.  Some
+drive them all as slaves.  Some drive one cpu as monarch, wait for that
+cpu to return from the OS then drive the rest as slaves.  Some versions
+of SAL cannot even cope with returning from the OS, they spin inside
+SAL on resume.  The OS INIT code has workarounds for some of these
+broken SAL symptoms, but some simply cannot be fixed from the OS side.
+
+---
+
+The scheduler hooks used by ia64 (curr_task, set_curr_task) are layer
+violations.  Unfortunately MCA/INIT start off as massive layer
+violations (can occur at _any_ time) and they build from there.
+
+At least ia64 makes an attempt at recovering from hardware errors, but
+it is a difficult problem because of the asynchronous nature of these
+errors.  When processing an unmaskable interrupt we sometimes need
+special code to cope with our inability to take any locks.
+
+---
+
+How is ia64 MCA/INIT different from x86 NMI?
+
+* x86 NMI typically gets delivered to one cpu.  MCA/INIT gets sent to
+  all cpus.
+
+* x86 NMI cannot be nested.  MCA/INIT can be nested, to a depth of 2
+  per cpu.
+
+* x86 has a separate struct task which points to one of multiple kernel
+  stacks.  ia64 has the struct task embedded in the single kernel
+  stack, so switching stack means switching task.
+
+* x86 does not call the BIOS so the NMI handler does not have to worry
+  about any registers having changed.  MCA/INIT can occur while the cpu
+  is in PAL in physical mode, with undefined registers and an undefined
+  kernel stack.
+
+* i386 backtrace is not very sensitive to whether a process is running
+  or not.  ia64 unwind is very, very sensitive to whether a process is
+  running or not.
+
+---
+
+What happens when MCA/INIT is delivered what a cpu is running user
+space code?
+
+The user mode registers are stored in the RSE area of the MCA/INIT on
+entry to the OS and are restored from there on return to SAL, so user
+mode registers are preserved across a recoverable MCA/INIT.  Since the
+OS has no idea what unwind data is available for the user space stack,
+MCA/INIT never tries to backtrace user space.  Which means that the OS
+does not bother making the user space process look like a blocked task,
+i.e. the OS does not copy pt_regs and switch_stack to the user space
+stack.  Also the OS has no idea how big the user space RSE and memory
+stacks are, which makes it too risky to copy the saved state to a user
+mode stack.
+
+---
+
+How do we get a backtrace on the tasks that were running when MCA/INIT
+was delivered?
+
+mca.c:::ia64_mca_modify_original_stack().  That identifies and
+verifies the original kernel stack, copies the dirty registers from
+the MCA/INIT stack's RSE to the original stack's RSE, copies the
+skeleton struct pt_regs and switch_stack to the original stack, fills
+in the skeleton structures from the PAL minstate area and updates the
+original stack's thread.ksp.  That makes the original stack look
+exactly like any other blocked task, i.e. it now appears to be
+sleeping.  To get a backtrace, just start with thread.ksp for the
+original task and unwind like any other sleeping task.
+
+---
+
+How do we identify the tasks that were running when MCA/INIT was
+delivered?
+
+If the previous task has been verified and converted to a blocked
+state, then sos->prev_task on the MCA/INIT stack is updated to point to
+the previous task.  You can look at that field in dumps or debuggers.
+To help distinguish between the handler and the original tasks,
+handlers have _TIF_MCA_INIT set in thread_info.flags.
+
+The sos data is always in the MCA/INIT handler stack, at offset
+MCA_SOS_OFFSET.  You can get that value from mca_asm.h or calculate it
+as KERNEL_STACK_SIZE - sizeof(struct pt_regs) - sizeof(struct
+ia64_sal_os_state), with 16 byte alignment for all structures.
+
+Also the comm field of the MCA/INIT task is modified to include the pid
+of the original task, for humans to use.  For example, a comm field of
+'MCA 12159' means that pid 12159 was running when the MCA was
+delivered.
diff --git a/Documentation/kdump/kdump.txt b/Documentation/kdump/kdump.txt
index 1f5f7d28c9e6..5f08f9ce6046 100644
--- a/Documentation/kdump/kdump.txt
+++ b/Documentation/kdump/kdump.txt
@@ -66,11 +66,11 @@ SETUP
    c) Enable "/proc/vmcore support" (Optional, in Pseudo filesystems).
         CONFIG_PROC_VMCORE=y
    d) Disable SMP support and build a UP kernel (Until it is fixed).
-        CONFIG_SMP=n
+        CONFIG_SMP=n
    e) Enable "Local APIC support on uniprocessors".
-        CONFIG_X86_UP_APIC=y
+        CONFIG_X86_UP_APIC=y
    f) Enable "IO-APIC support on uniprocessors"
-        CONFIG_X86_UP_IOAPIC=y
+        CONFIG_X86_UP_IOAPIC=y
 
   Note:   i) Options a) and b) depend upon "Configure standard kernel features
              (for small systems)" (under General setup).
@@ -95,6 +95,11 @@ SETUP
             hence have memory less than 4GB.
        iii) Specify "irqpoll" as command line parameter. This reduces driver
             initialization failures in second kernel due to shared interrupts.
+        iv) <root-dev> needs to be specified in a format corresponding to
+            the root device name in the output of mount command.
+         v) If you have built the drivers required to mount root file
+            system as modules in <second-kernel>, then, specify
+            --initrd=<initrd-for-second-kernel>.
 
 5) System reboots into the second kernel when a panic occurs. A module can be
    written to force the panic or "ALT-SysRq-c" can be used initiate a crash
diff --git a/Documentation/keys.txt b/Documentation/keys.txt
index 0321ded4b9ae..b22e7c8d059a 100644
--- a/Documentation/keys.txt
+++ b/Documentation/keys.txt
@@ -195,8 +195,8 @@ KEY ACCESS PERMISSIONS
 ======================
 
 Keys have an owner user ID, a group access ID, and a permissions mask. The mask
-has up to eight bits each for user, group and other access. Only five of each
-set of eight bits are defined. These permissions granted are:
+has up to eight bits each for possessor, user, group and other access. Only
+five of each set of eight bits are defined. These permissions granted are:
 
  (*) View
 
@@ -241,16 +241,16 @@ about the status of the key service:
      type, description and permissions. The payload of the key is not available
      this way:
 
-        SERIAL   FLAGS  USAGE EXPY PERM   UID   GID   TYPE      DESCRIPTION: SUMMARY
-        00000001 I-----    39 perm 1f0000     0     0 keyring   _uid_ses.0: 1/4
-        00000002 I-----     2 perm 1f0000     0     0 keyring   _uid.0: empty
-        00000007 I-----     1 perm 1f0000     0     0 keyring   _pid.1: empty
-        0000018d I-----     1 perm 1f0000     0     0 keyring   _pid.412: empty
-        000004d2 I--Q--     1 perm 1f0000    32    -1 keyring   _uid.32: 1/4
-        000004d3 I--Q--     3 perm 1f0000    32    -1 keyring   _uid_ses.32: empty
-        00000892 I--QU-     1 perm 1f0000     0     0 user      metal:copper: 0
-        00000893 I--Q-N     1  35s 1f0000     0     0 user      metal:silver: 0
-        00000894 I--Q--     1  10h 1f0000     0     0 user      metal:gold: 0
+        SERIAL   FLAGS  USAGE EXPY PERM     UID   GID   TYPE      DESCRIPTION: SUMMARY
+        00000001 I-----    39 perm 1f1f0000     0     0 keyring   _uid_ses.0: 1/4
+        00000002 I-----     2 perm 1f1f0000     0     0 keyring   _uid.0: empty
+        00000007 I-----     1 perm 1f1f0000     0     0 keyring   _pid.1: empty
+        0000018d I-----     1 perm 1f1f0000     0     0 keyring   _pid.412: empty
+        000004d2 I--Q--     1 perm 1f1f0000    32    -1 keyring   _uid.32: 1/4
+        000004d3 I--Q--     3 perm 1f1f0000    32    -1 keyring   _uid_ses.32: empty
+        00000892 I--QU-     1 perm 1f000000     0     0 user      metal:copper: 0
+        00000893 I--Q-N     1  35s 1f1f0000     0     0 user      metal:silver: 0
+        00000894 I--Q--     1  10h 001f0000     0     0 user      metal:gold: 0
 
      The flags are:
 
@@ -637,6 +637,34 @@ call, and the key released upon close. How to deal with conflicting keys due to
 two different users opening the same file is left to the filesystem author to
 solve.
 
+Note that there are two different types of pointers to keys that may be
+encountered:
+
+ (*) struct key *
+
+     This simply points to the key structure itself. Key structures will be at
+     least four-byte aligned.
+
+ (*) key_ref_t
+
+     This is equivalent to a struct key *, but the least significant bit is set
+     if the caller "possesses" the key. By "possession" it is meant that the
+     calling processes has a searchable link to the key from one of its
+     keyrings. There are three functions for dealing with these:
+
+        key_ref_t make_key_ref(const struct key *key,
+                               unsigned long possession);
+
+        struct key *key_ref_to_ptr(const key_ref_t key_ref);
+
+        unsigned long is_key_possessed(const key_ref_t key_ref);
+
+     The first function constructs a key reference from a key pointer and
+     possession information (which must be 0 or 1 and not any other value).
+
+     The second function retrieves the key pointer from a reference and the
+     third retrieves the possession flag.
+
 When accessing a key's payload contents, certain precautions must be taken to
 prevent access vs modification races. See the section "Notes on accessing
 payload contents" for more information.
@@ -665,7 +693,11 @@ payload contents" for more information.
 
         void key_put(struct key *key);
 
-    This can be called from interrupt context. If CONFIG_KEYS is not set then
+    Or:
+
+        void key_ref_put(key_ref_t key_ref);
+
+    These can be called from interrupt context. If CONFIG_KEYS is not set then
     the argument will not be parsed.
 
 
@@ -689,13 +721,17 @@ payload contents" for more information.
 
 (*) If a keyring was found in the search, this can be further searched by:
 
-        struct key *keyring_search(struct key *keyring,
-                                   const struct key_type *type,
-                                   const char *description)
+        key_ref_t keyring_search(key_ref_t keyring_ref,
+                                 const struct key_type *type,
+                                 const char *description)
 
     This searches the keyring tree specified for a matching key. Error ENOKEY
-    is returned upon failure. If successful, the returned key will need to be
-    released.
+    is returned upon failure (use IS_ERR/PTR_ERR to determine). If successful,
+    the returned key will need to be released.
+
+    The possession attribute from the keyring reference is used to control
+    access through the permissions mask and is propagated to the returned key
+    reference pointer if successful.
 
 
 (*) To check the validity of a key, this function can be called:
@@ -732,7 +768,7 @@ More complex payload contents must be allocated and a pointer to them set in
 key->payload.data. One of the following ways must be selected to access the
 data:
 
- (1) Unmodifyable key type.
+ (1) Unmodifiable key type.
 
      If the key type does not have a modify method, then the key's payload can
      be accessed without any form of locking, provided that it's known to be
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index ab65714d95fc..b433c8a27e2d 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -355,10 +355,14 @@ ip_dynaddr - BOOLEAN
         Default: 0
 
 icmp_echo_ignore_all - BOOLEAN
+        If set non-zero, then the kernel will ignore all ICMP ECHO
+        requests sent to it.
+        Default: 0
+
 icmp_echo_ignore_broadcasts - BOOLEAN
-        If either is set to true, then the kernel will ignore either all
-        ICMP ECHO requests sent to it or just those to broadcast/multicast
-        addresses, respectively.
+        If set non-zero, then the kernel will ignore all ICMP ECHO and
+        TIMESTAMP requests sent to it via broadcast/multicast.
+        Default: 1
 
 icmp_ratelimit - INTEGER
         Limit the maximal rates for sending ICMP packets whose type matches
diff --git a/Documentation/oops-tracing.txt b/Documentation/oops-tracing.txt
index da711028e5f7..66eaaab7773d 100644
--- a/Documentation/oops-tracing.txt
+++ b/Documentation/oops-tracing.txt
@@ -205,8 +205,8 @@ Phone: 701-234-7556
 Tainted kernels:
 
 Some oops reports contain the string 'Tainted: ' after the program
-counter, this indicates that the kernel has been tainted by some
-mechanism.  The string is followed by a series of position sensitive
+counter. This indicates that the kernel has been tainted by some
+mechanism.  The string is followed by a series of position-sensitive
 characters, each representing a particular tainted value.
 
   1: 'G' if all modules loaded have a GPL or compatible license, 'P' if
@@ -214,16 +214,25 @@ characters, each representing a particular tainted value.
      MODULE_LICENSE or with a MODULE_LICENSE that is not recognised by
      insmod as GPL compatible are assumed to be proprietary.
 
-  2: 'F' if any module was force loaded by insmod -f, ' ' if all
+  2: 'F' if any module was force loaded by "insmod -f", ' ' if all
      modules were loaded normally.
 
   3: 'S' if the oops occurred on an SMP kernel running on hardware that
-      hasn't been certified as safe to run multiprocessor.
-          Currently this occurs only on various Athlons that are not
-          SMP capable.
+     hasn't been certified as safe to run multiprocessor.
+     Currently this occurs only on various Athlons that are not
+     SMP capable.
+
+  4: 'R' if a module was force unloaded by "rmmod -f", ' ' if all
+     modules were unloaded normally.
+
+  5: 'M' if any processor has reported a Machine Check Exception,
+     ' ' if no Machine Check Exceptions have occurred.
+
+  6: 'B' if a page-release function has found a bad page reference or
+     some unexpected page flags.
 
 The primary reason for the 'Tainted: ' string is to tell kernel
 debuggers if this is a clean kernel or if anything unusual has
-occurred.  Tainting is permanent, even if an offending module is
-unloading the tainted value remains to indicate that the kernel is not
+occurred.  Tainting is permanent: even if an offending module is
+unloaded, the tainted value remains to indicate that the kernel is not
 trustworthy.
diff --git a/Documentation/pm.txt b/Documentation/pm.txt
index cc63ae18d147..2ea1149bf6b0 100644
--- a/Documentation/pm.txt
+++ b/Documentation/pm.txt
@@ -38,6 +38,12 @@ system the associated daemon will exit gracefully.
 
 Driver Interface -- OBSOLETE, DO NOT USE!
 ----------------*************************
+
+Note: pm_register(), pm_access(), pm_dev_idle() and friends are
+obsolete. Please do not use them. Instead you should properly hook
+your driver into the driver model, and use its suspend()/resume()
+callbacks to do this kind of stuff.
+
 If you are writing a new driver or maintaining an old driver, it
 should include power management support.  Without power management
 support, a single driver may prevent a system with power management
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index ebfcdf28485f..13cba955cb5a 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -75,7 +75,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     adsp_map    - PCM device number maps assigned to the 2st OSS device.
                 - Default: 1
     nonblock_open
-                - Don't block opening busy PCM devices.
+                - Don't block opening busy PCM devices.  Default: 1
 
     For example, when dsp_map=2, /dev/dsp will be mapped to PCM #2 of
     the card #0.  Similarly, when adsp_map=0, /dev/adsp will be mapped
@@ -148,6 +148,16 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     Module supports up to 8 cards. This module does not support autoprobe
     thus main port must be specified!!! Other ports are optional.
     
+  Module snd-ad1889
+  -----------------
+
+    Module for Analog Devices AD1889 chips.
+
+    ac97_quirk  - AC'97 workaround for strange hardware
+                  See the description of intel8x0 module for details.
+
+    This module supports up to 8 cards.
+
   Module snd-ali5451
   ------------------
 
@@ -189,15 +199,20 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
   Module snd-atiixp
   -----------------
 
-    Module for ATI IXP 150/200/250 AC97 controllers.
+    Module for ATI IXP 150/200/250/400 AC97 controllers.
 
-    ac97_clock          - AC'97 clock (defalut = 48000)
+    ac97_clock          - AC'97 clock (default = 48000)
     ac97_quirk          - AC'97 workaround for strange hardware
-                          See the description of intel8x0 module for details.
+                          See "AC97 Quirk Option" section below.
     spdif_aclink        - S/PDIF transfer over AC-link (default = 1)
 
     This module supports up to 8 cards and autoprobe.
 
+    ATI IXP has two different methods to control SPDIF output.  One is
+    over AC-link and another is over the "direct" SPDIF output.  The
+    implementation depends on the motherboard, and you'll need to
+    choose the correct one via spdif_aclink module option.
+
   Module snd-atiixp-modem
   -----------------------
 
@@ -230,7 +245,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     The hardware EQ hardware and SPDIF is only present in the Vortex2 and 
     Advantage.
 
-    Note: Some ALSA mixer applicactions don't handle the SPDIF samplerate 
+    Note: Some ALSA mixer applications don't handle the SPDIF sample rate 
            control correctly. If you have problems regarding this, try
            another ALSA compliant mixer (alsamixer works).
 
@@ -302,7 +317,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
 
     mpu_port    - 0x300,0x310,0x320,0x330, 0 = disable (default)
     fm_port     - 0x388 (default), 0 = disable (default)
-    soft_ac3    - Sofware-conversion of raw SPDIF packets (model 033 only)
+    soft_ac3    - Software-conversion of raw SPDIF packets (model 033 only)
                   (default = 1)
     joystick_port - Joystick port address (0 = disable, 1 = auto-detect)
 
@@ -384,7 +399,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     Module for PCI sound cards based on CS4610/CS4612/CS4614/CS4615/CS4622/
                                        CS4624/CS4630/CS4280 PCI chips.
 
-    external_amp     - Force to enable external amplifer.
+    external_amp     - Force to enable external amplifier.
     thinkpad         - Force to enable Thinkpad's CLKRUN control.
     mmap_valid       - Support OSS mmap mode (default = 0).
 
@@ -620,7 +635,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
                VIA VT8251/VT8237A
 
     model       - force the model name
-    position_fix - Fix DMA pointer (0 = FIFO size, 1 = none, 2 = POSBUF)
+    position_fix - Fix DMA pointer (0 = auto, 1 = none, 2 = POSBUF, 3 = FIFO size)
 
     Module supports up to 8 cards.
 
@@ -656,6 +671,11 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
           allout        5-jack in back, 2-jack in front, SPDIF out
           auto          auto-config reading BIOS (default)
 
+    If the default configuration doesn't work and one of the above
+    matches with your device, report it together with the PCI
+    subsystem ID (output of "lspci -nv") to ALSA BTS or alsa-devel
+    ML (see the section "Links and Addresses").
+
     Note 2: If you get click noises on output, try the module option
             position_fix=1 or 2.  position_fix=1 will use the SD_LPIB
             register value without FIFO size correction as the current
@@ -783,20 +803,13 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
 
     ac97_clock    - AC'97 codec clock base (0 = auto-detect)
     ac97_quirk    - AC'97 workaround for strange hardware
-                    The following strings are accepted:
-                      default = don't override the default setting
-                      disable = disable the quirk
-                      hp_only = use headphone control as master
-                      swap_hp = swap headphone and master controls
-                      swap_surround = swap master and surround controls
-                      ad_sharing = for AD1985, turn on OMS bit and use headphone
-                      alc_jack = for ALC65x, turn on the jack sense mode
-                      inv_eapd = inverted EAPD implementation
-                      mute_led = bind EAPD bit for turning on/off mute LED
-                    For backward compatibility, the corresponding integer
-                    value -1, 0, ... are accepted, too.
+                    See "AC97 Quirk Option" section below.
     buggy_irq     - Enable workaround for buggy interrupts on some
-                    motherboards (default off)
+                    motherboards (default yes on nForce chips,
+                    otherwise off)
+    buggy_semaphore - Enable workaround for hardwares with buggy
+                    semaphores (e.g. on some ASUS laptops)
+                    (default off)
 
     Module supports autoprobe and multiple bus-master chips (max 8).
 
@@ -808,13 +821,6 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     motherboard has these devices, use the ns558 or snd-mpu401
     modules, respectively.
 
-    The ac97_quirk option is used to enable/override the workaround
-    for specific devices.  Some hardware have swapped output pins
-    between Master and Headphone, or Surround.  The driver provides
-    the auto-detection of known problematic devices, but some might
-    be unknown or wrongly detected.  In such a case, pass the proper
-    value with this option.
-
     The power-management is supported.
     
   Module snd-intel8x0m
@@ -966,7 +972,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     with machines with other (most likely CS423x or OPL3SAx) chips,
     even though the device is detected in lspci.  In such a case, try
     other drivers, e.g. snd-cs4232 or snd-opl3sa2.  Some has ISA-PnP
-    but some doesn't have ISA PnP.  You'll need to speicfy isapnp=0
+    but some doesn't have ISA PnP.  You'll need to specify isapnp=0
     and proper hardware parameters in the case without ISA PnP.
 
     Note: some laptops need a workaround for AC97 RESET.  For the
@@ -1302,7 +1308,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
                   channels
                   [VIA8233/C, 8235, 8237 only]
     ac97_quirk  - AC'97 workaround for strange hardware
-                  See the description of intel8x0 module for details.
+                  See "AC97 Quirk Option" section below.
 
     Module supports autoprobe and multiple bus-master chips (max 8).
 
@@ -1327,16 +1333,17 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
           "lspci -nv").
           If dxs_support=5 does not work, try dxs_support=4; if it
           doesn't work too, try dxs_support=1.  (dxs_support=1 is
-          usually for old motherboards.  The correct implementated
+          usually for old motherboards.  The correct implemented
           board should work with 4 or 5.)  If it still doesn't
           work and the default setting is ok, dxs_support=3 is the
           right choice.  If the default setting doesn't work at all,
           try dxs_support=2 to disable the DXS channels.
           In any cases, please let us know the result and the
-          subsystem vendor/device ids.
+          subsystem vendor/device ids.  See "Links and Addresses"
+          below.
 
     Note: for the MPU401 on VIA823x, use snd-mpu401 driver
-          additonally.  The mpu_port option is for VIA686 chips only.
+          additionally.  The mpu_port option is for VIA686 chips only.
 
   Module snd-via82xx-modem
   ------------------------
@@ -1398,8 +1405,10 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     Module supports up to 8 cards.  The module is compiled only when
     PCMCIA is supported on kernel.
 
-    To activate the driver via the card manager, you'll need to set
-    up /etc/pcmcia/vxpocket.conf.  See the sound/pcmcia/vx/vxpocket.c.
+    With the older 2.6.x kernel, to activate the driver via the card
+    manager, you'll need to set up /etc/pcmcia/vxpocket.conf.  See the
+    sound/pcmcia/vx/vxpocket.c.  2.6.13 or later kernel requires no
+    longer require a config file.
 
     When the driver is compiled as a module and the hotplug firmware
     is supported, the firmware data is loaded via hotplug automatically.
@@ -1411,6 +1420,9 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
 
     Note: the driver is build only when CONFIG_ISA is set.
     
+    Note2: snd-vxp440 driver is merged to snd-vxpocket driver since
+           ALSA 1.0.10.
+
   Module snd-ymfpci
   -----------------
 
@@ -1436,6 +1448,37 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     Note: the driver is build only when CONFIG_ISA is set.
 
 
+AC97 Quirk Option
+=================
+
+The ac97_quirk option is used to enable/override the workaround for
+specific devices on drivers for on-board AC'97 controllers like
+snd-intel8x0.  Some hardware have swapped output pins between Master
+and Headphone, or Surround (thanks to confusion of AC'97
+specifications from version to version :-)
+
+The driver provides the auto-detection of known problematic devices,
+but some might be unknown or wrongly detected.  In such a case, pass
+the proper value with this option.
+
+The following strings are accepted:
+    - default   Don't override the default setting
+    - disable   Disable the quirk
+    - hp_only   Bind Master and Headphone controls as a single control
+    - swap_hp   Swap headphone and master controls
+    - swap_surround  Swap master and surround controls
+    - ad_sharing  For AD1985, turn on OMS bit and use headphone
+    - alc_jack  For ALC65x, turn on the jack sense mode
+    - inv_eapd  Inverted EAPD implementation
+    - mute_led  Bind EAPD bit for turning on/off mute LED
+
+For backward compatibility, the corresponding integer value -1, 0,
+... are  accepted, too.
+
+For example, if "Master" volume control has no effect on your device
+but only "Headphone" does, pass ac97_quirk=hp_only module option.
+
+
 Configuring Non-ISAPNP Cards
 ============================
 
@@ -1553,6 +1596,8 @@ Proc interfaces (/proc/asound)
           - whole-frag  write only whole fragments (optimization affecting
                         playback only)
           - no-silence  do not fill silence ahead to avoid clicks
+          - buggy-ptr   Returns the whitespace blocks in GETOPTR ioctl
+                        instead of filled blocks
 
   Example: echo "x11amp 128 16384" > /proc/asound/card0/pcm0p/oss
            echo "squake 0 0 disable" > /proc/asound/card0/pcm0c/oss
@@ -1589,9 +1634,14 @@ commands to the snd-page-alloc driver:
     use.
 
 
-Links
-=====
+Links and Addresses
+===================
 
   ALSA project homepage
        http://www.alsa-project.org
 
+  ALSA Bug Tracking System
+       https://bugtrack.alsa-project.org/bugs/
+
+  ALSA Developers ML
+       mailto:alsa-devel@lists.sourceforge.net
diff --git a/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl b/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl
index 0475478c2484..24e85520890b 100644
--- a/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl
+++ b/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl
@@ -447,7 +447,7 @@
           ....
 
           /* allocate a chip-specific data with zero filled */
-          chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+          chip = kzalloc(sizeof(*chip), GFP_KERNEL);
           if (chip == NULL)
                   return -ENOMEM;
 
@@ -949,7 +949,7 @@
           After allocating a card instance via
           <function>snd_card_new()</function> (with
           <constant>NULL</constant> on the 4th arg), call
-          <function>kcalloc()</function>. 
+          <function>kzalloc()</function>. 
 
           <informalexample>
             <programlisting>
@@ -958,7 +958,7 @@
   mychip_t *chip;
   card = snd_card_new(index[dev], id[dev], THIS_MODULE, NULL);
   .....
-  chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+  chip = kzalloc(sizeof(*chip), GFP_KERNEL);
 ]]>
             </programlisting>
           </informalexample>
@@ -1136,7 +1136,7 @@
                   return -ENXIO;
           }
 
-          chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+          chip = kzalloc(sizeof(*chip), GFP_KERNEL);
           if (chip == NULL) {
                   pci_disable_device(pci);
                   return -ENOMEM;
@@ -1292,7 +1292,7 @@
       need to initialize this number as -1 before actual allocation,
       since irq 0 is valid. The port address and its resource pointer
       can be initialized as null by
-      <function>kcalloc()</function> automatically, so you
+      <function>kzalloc()</function> automatically, so you
       don't have to take care of resetting them. 
       </para>
 
diff --git a/Documentation/sparse.txt b/Documentation/sparse.txt
index 5df44dc894e5..1829009db771 100644
--- a/Documentation/sparse.txt
+++ b/Documentation/sparse.txt
@@ -51,9 +51,9 @@ or you don't get any checking at all.
 Where to get sparse
 ~~~~~~~~~~~~~~~~~~~
 
-With BK, you can just get it from
+With git, you can just get it from
 
-        bk://sparse.bkbits.net/sparse
+        rsync://rsync.kernel.org/pub/scm/devel/sparse/sparse.git
 
 and DaveJ has tar-balls at
 
diff --git a/Documentation/usb/URB.txt b/Documentation/usb/URB.txt
index d59b95cc6f1b..a49e5f2c2b46 100644
--- a/Documentation/usb/URB.txt
+++ b/Documentation/usb/URB.txt
@@ -1,5 +1,6 @@
 Revised: 2000-Dec-05.
 Again:   2002-Jul-06
+Again:   2005-Sep-19
 
     NOTE:
 
@@ -18,8 +19,8 @@ called USB Request Block, or URB for short.
   and deliver the data and status back. 
 
 - Execution of an URB is inherently an asynchronous operation, i.e. the 
-  usb_submit_urb(urb) call returns immediately after it has successfully queued 
-  the requested action. 
+  usb_submit_urb(urb) call returns immediately after it has successfully
+  queued the requested action.
 
 - Transfers for one URB can be canceled with usb_unlink_urb(urb) at any time. 
 
@@ -94,8 +95,9 @@ To free an URB, use
 
         void usb_free_urb(struct urb *urb)
 
-You may not free an urb that you've submitted, but which hasn't yet been
-returned to you in a completion callback.
+You may free an urb that you've submitted, but which hasn't yet been
+returned to you in a completion callback.  It will automatically be
+deallocated when it is no longer in use.
 
 
 1.4. What has to be filled in?
@@ -145,30 +147,36 @@ to get seamless ISO streaming.
 
 1.6. How to cancel an already running URB?
 
-For an URB which you've submitted, but which hasn't been returned to
-your driver by the host controller, call
+There are two ways to cancel an URB you've submitted but which hasn't
+been returned to your driver yet.  For an asynchronous cancel, call
 
         int usb_unlink_urb(struct urb *urb)
 
 It removes the urb from the internal list and frees all allocated
-HW descriptors. The status is changed to reflect unlinking. After 
-usb_unlink_urb() returns with that status code, you can free the URB
-with usb_free_urb().
+HW descriptors. The status is changed to reflect unlinking.  Note
+that the URB will not normally have finished when usb_unlink_urb()
+returns; you must still wait for the completion handler to be called.
 
-There is also an asynchronous unlink mode.  To use this, set the
-the URB_ASYNC_UNLINK flag in urb->transfer flags before calling
-usb_unlink_urb().  When using async unlinking, the URB will not
-normally be unlinked when usb_unlink_urb() returns.  Instead, wait
-for the completion handler to be called.
+To cancel an URB synchronously, call
+
+        void usb_kill_urb(struct urb *urb)
+
+It does everything usb_unlink_urb does, and in addition it waits
+until after the URB has been returned and the completion handler
+has finished.  It also marks the URB as temporarily unusable, so
+that if the completion handler or anyone else tries to resubmit it
+they will get a -EPERM error.  Thus you can be sure that when
+usb_kill_urb() returns, the URB is totally idle.
 
 
 1.7. What about the completion handler?
 
 The handler is of the following type:
 
-        typedef void (*usb_complete_t)(struct urb *);
+        typedef void (*usb_complete_t)(struct urb *, struct pt_regs *)
 
-i.e. it gets just the URB that caused the completion call.
+I.e., it gets the URB that caused the completion call, plus the
+register values at the time of the corresponding interrupt (if any).
 In the completion handler, you should have a look at urb->status to
 detect any USB errors. Since the context parameter is included in the URB,
 you can pass information to the completion handler. 
@@ -176,17 +184,11 @@ you can pass information to the completion handler.
 Note that even when an error (or unlink) is reported, data may have been
 transferred.  That's because USB transfers are packetized; it might take
 sixteen packets to transfer your 1KByte buffer, and ten of them might
-have transferred succesfully before the completion is called.
+have transferred succesfully before the completion was called.
 
 
 NOTE:  ***** WARNING *****
-Don't use urb->dev field in your completion handler; it's cleared
-as part of giving urbs back to drivers.  (Addressing an issue with
-ownership of periodic URBs, which was otherwise ambiguous.) Instead,
-use urb->context to hold all the data your driver needs.
-
-NOTE:  ***** WARNING *****
-Also, NEVER SLEEP IN A COMPLETION HANDLER.  These are normally called
+NEVER SLEEP IN A COMPLETION HANDLER.  These are normally called
 during hardware interrupt processing.  If you can, defer substantial
 work to a tasklet (bottom half) to keep system latencies low.  You'll
 probably need to use spinlocks to protect data structures you manipulate
@@ -229,24 +231,10 @@ ISO data with some other event stream.
 Interrupt transfers, like isochronous transfers, are periodic, and happen
 in intervals that are powers of two (1, 2, 4 etc) units.  Units are frames
 for full and low speed devices, and microframes for high speed ones.
-
-Currently, after you submit one interrupt URB, that urb is owned by the
-host controller driver until you cancel it with usb_unlink_urb().  You
-may unlink interrupt urbs in their completion handlers, if you need to.
-
-After a transfer completion is called, the URB is automagically resubmitted.
-THIS BEHAVIOR IS EXPECTED TO BE REMOVED!!
-
-Interrupt transfers may only send (or receive) the "maxpacket" value for
-the given interrupt endpoint; if you need more data, you will need to
-copy that data out of (or into) another buffer.  Similarly, you can't
-queue interrupt transfers.
-THESE RESTRICTIONS ARE EXPECTED TO BE REMOVED!!
-
-Note that this automagic resubmission model does make it awkward to use
-interrupt OUT transfers.  The portable solution involves unlinking those
-OUT urbs after the data is transferred, and perhaps submitting a final
-URB for a short packet.
-
 The usb_submit_urb() call modifies urb->interval to the implemented interval
 value that is less than or equal to the requested interval value.
+
+In Linux 2.6, unlike earlier versions, interrupt URBs are not automagically
+restarted when they complete.  They end when the completion handler is
+called, just like other URBs.  If you want an interrupt URB to be restarted,
+your completion handler must resubmit it.
diff --git a/MAINTAINERS b/MAINTAINERS
index a67bf7d315d7..abf7f7a17ae0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -370,7 +370,10 @@ W:	http://atmelwlandriver.sourceforge.net/
 S:      Maintained
 
 AUDIT SUBSYSTEM
-L:      linux-audit@redhat.com (subscribers-only)
+P:      David Woodhouse
+M:      dwmw2@infradead.org
+L:      linux-audit@redhat.com
+W:      http://people.redhat.com/sgrubb/audit/
 S:      Maintained
 
 AX.25 NETWORK LAYER
@@ -601,6 +604,15 @@ P:	H. Peter Anvin
 M:      hpa@zytor.com
 S:      Maintained
 
+CPUSETS
+P:      Paul Jackson
+P:      Simon Derr
+M:      pj@sgi.com
+M:      simon.derr@bull.net
+L:      linux-kernel@vger.kernel.org
+W:      http://www.bullopensource.org/cpuset/
+S:      Supported
+
 CRAMFS FILESYSTEM
 W:     http://sourceforge.net/projects/cramfs/
 S:     Orphan
@@ -683,6 +695,13 @@ P:	Guennadi Liakhovetski
 M:      g.liakhovetski@gmx.de
 S:      Maintained
 
+DCCP PROTOCOL
+P:      Arnaldo Carvalho de Melo
+M:      acme@mandriva.com
+L:      dccp@vger.kernel.org
+W:      http://www.wlug.org.nz/DCCP
+S:      Maintained
+
 DECnet NETWORK LAYER
 P:      Patrick Caulfield
 M:      patrick@tykepenguin.com
@@ -1053,8 +1072,6 @@ M:	wli@holomorphy.com
 S:      Maintained
 
 I2C SUBSYSTEM
-P:      Greg Kroah-Hartman
-M:      greg@kroah.com
 P:      Jean Delvare
 M:      khali@linux-fr.org
 L:      lm-sensors@lm-sensors.org
@@ -1151,11 +1168,6 @@ L:	linux1394-devel@lists.sourceforge.net
 W:      http://www.linux1394.org/
 S:      Orphan
 
-IEEE 1394 SBP2
-L:      linux1394-devel@lists.sourceforge.net
-W:      http://www.linux1394.org/
-S:      Orphan
-
 IEEE 1394 SUBSYSTEM
 P:      Ben Collins
 M:      bcollins@debian.org
@@ -1190,6 +1202,15 @@ L:	linux1394-devel@lists.sourceforge.net
 W:      http://www.linux1394.org/
 S:      Maintained
 
+IEEE 1394 SBP2
+P:      Ben Collins
+M:      bcollins@debian.org
+P:      Stefan Richter
+M:      stefanr@s5r6.in-berlin.de
+L:      linux1394-devel@lists.sourceforge.net
+W:      http://www.linux1394.org/
+S:      Maintained
+
 IMS TWINTURBO FRAMEBUFFER DRIVER
 P:      Paul Mundt
 M:      lethal@chaoticdreams.org
@@ -1394,6 +1415,18 @@ L:	linux-kernel@vger.kernel.org
 L:      fastboot@osdl.org
 S:      Maintained
 
+KPROBES
+P:      Prasanna S Panchamukhi
+M:      prasanna@in.ibm.com
+P:      Ananth N Mavinakayanahalli
+M:      ananth@in.ibm.com
+P:      Anil S Keshavamurthy
+M:      anil.s.keshavamurthy@intel.com
+P:      David S. Miller
+M:      davem@davemloft.net
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+
 LANMEDIA WAN CARD DRIVER
 P:      Andrew Stanley-Jones
 M:      asj@lanmedia.com
@@ -1714,8 +1747,11 @@ S:	Maintained
 IPVS
 P:      Wensong Zhang
 M:      wensong@linux-vs.org
+P:      Simon Horman
+M:      horms@verge.net.au
 P:      Julian Anastasov
 M:      ja@ssi.bg
+L:      netdev@vger.kernel.org
 S:      Maintained
 
 NFS CLIENT
@@ -1886,6 +1922,13 @@ M:	joern@wh.fh-wedel.de
 L:      linux-mtd@lists.infradead.org
 S:      Maintained
 
+PKTCDVD DRIVER
+P:      Peter Osterlund
+M:      petero2@telia.com
+L:      linux-kernel@vger.kernel.org
+L:      packet-writing@suse.com
+S:      Maintained
+
 POSIX CLOCKS and TIMERS
 P:      George Anzinger
 M:      george@mvista.com
@@ -2256,6 +2299,12 @@ M:	kristen.c.accardi@intel.com
 L:      pcihpd-discuss@lists.sourceforge.net
 S:      Maintained
 
+SKGE, SKY2 10/100/1000 GIGABIT ETHERNET DRIVERS
+P:      Stephen Hemminger
+M:      shemminger@osdl.org
+L:      netdev@vger.kernel.org
+S:      Maintained
+
 SPARC (sparc32):
 P:      William L. Irwin
 M:      wli@holomorphy.com
@@ -2268,12 +2317,6 @@ M:	R.E.Wolff@BitWizard.nl
 L:      linux-kernel@vger.kernel.org ?
 S:      Supported
 
-SPX NETWORK LAYER
-P:      Jay Schulist
-M:      jschlst@samba.org
-L:      netdev@vger.kernel.org
-S:      Supported
-
 SRM (Alpha) environment access
 P:      Jan-Benedict Glaw
 M:      jbglaw@lug-owl.de
diff --git a/Makefile b/Makefile
index 4e0d7c68d223..fdb96bc85080 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 14
-EXTRAVERSION =-rc1
+EXTRAVERSION =-rc3
 NAME=Affluent Albatross
 
 # *DOCUMENTATION*
diff --git a/README b/README
index 76dd780d88ed..d1edcc7adabe 100644
--- a/README
+++ b/README
@@ -149,6 +149,9 @@ CONFIGURING the kernel:
         "make gconfig"     X windows (Gtk) based configuration tool.
         "make oldconfig"   Default all questions based on the contents of
                            your existing ./.config file.
+        "make silentoldconfig"
+                           Like above, but avoids cluttering the screen
+                           with questions already answered.
    
         NOTES on "make config":
         - having unnecessary drivers will make the kernel bigger, and can
@@ -169,9 +172,6 @@ CONFIGURING the kernel:
           should probably answer 'n' to the questions for
           "development", "experimental", or "debugging" features.
 
- - Check the top Makefile for further site-dependent configuration
-   (default SVGA mode etc). 
-
 COMPILING the kernel:
 
  - Make sure you have gcc 2.95.3 available.
@@ -199,6 +199,9 @@ COMPILING the kernel:
    are installing a new kernel with the same version number as your
    working kernel, make a backup of your modules directory before you
    do a "make modules_install".
+   Alternatively, before compiling, use the kernel config option
+   "LOCALVERSION" to append a unique suffix to the regular kernel version.
+   LOCALVERSION can be set in the "General Setup" menu.
 
  - In order to boot your new kernel, you'll need to copy the kernel
    image (e.g. .../linux/arch/i386/boot/bzImage after compilation)
diff --git a/arch/alpha/kernel/entry.S b/arch/alpha/kernel/entry.S
index 76cc0cb5fc2e..e38671c922bc 100644
--- a/arch/alpha/kernel/entry.S
+++ b/arch/alpha/kernel/entry.S
@@ -196,6 +196,7 @@ entUna:
         stq     $26, 208($sp)
         stq     $27, 216($sp)
         stq     $28, 224($sp)
+        mov     $sp, $19
         stq     $gp, 232($sp)
         lda     $8, 0x3fff
         stq     $31, 248($sp)
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 0636116210d2..01fe990d3e54 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -37,6 +37,7 @@
 #include <linux/namei.h>
 #include <linux/uio.h>
 #include <linux/vfs.h>
+#include <linux/rcupdate.h>
 
 #include <asm/fpu.h>
 #include <asm/io.h>
@@ -975,6 +976,7 @@ osf_select(int n, fd_set __user *inp, fd_set __user *outp, fd_set __user *exp,
         long timeout;
         int ret = -EINVAL;
         struct fdtable *fdt;
+        int max_fdset;
 
         timeout = MAX_SCHEDULE_TIMEOUT;
         if (tvp) {
@@ -996,8 +998,11 @@ osf_select(int n, fd_set __user *inp, fd_set __user *outp, fd_set __user *exp,
                 }
         }
 
+        rcu_read_lock();
         fdt = files_fdtable(current->files);
-        if (n < 0 || n > fdt->max_fdset)
+        max_fdset = fdt->max_fdset;
+        rcu_read_unlock();
+        if (n < 0 || n > max_fdset)
                 goto out_nofds;
 
         /*
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index fa98dae3cd98..eb20c3afff58 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -127,6 +127,10 @@ common_shutdown_1(void *generic_ptr)
         /* If booted from SRM, reset some of the original environment. */
         if (alpha_using_srm) {
 #ifdef CONFIG_DUMMY_CONSOLE
+                /* If we've gotten here after SysRq-b, leave interrupt
+                   context before taking over the console. */
+                if (in_interrupt())
+                        irq_exit();
                 /* This has the effect of resetting the VGA video origin.  */
                 take_over_console(&dummy_con, 0, MAX_NR_CONSOLES-1, 1);
 #endif
diff --git a/arch/alpha/kernel/sys_dp264.c b/arch/alpha/kernel/sys_dp264.c
index 9e36b07fa940..d5da6b1b28ee 100644
--- a/arch/alpha/kernel/sys_dp264.c
+++ b/arch/alpha/kernel/sys_dp264.c
@@ -395,6 +395,22 @@ clipper_init_irq(void)
  */
 
 static int __init
+isa_irq_fixup(struct pci_dev *dev, int irq)
+{
+        u8 irq8;
+
+        if (irq > 0)
+                return irq;
+
+        /* This interrupt is routed via ISA bridge, so we'll
+           just have to trust whatever value the console might
+           have assigned.  */
+        pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &irq8);
+
+        return irq8 & 0xf;
+}
+
+static int __init
 dp264_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
 {
         static char irq_tab[6][5] __initdata = {
@@ -407,25 +423,13 @@ dp264_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
                 { 16+ 3, 16+ 3, 16+ 2, 16+ 1, 16+ 0}  /* IdSel 10 slot 3 */
         };
         const long min_idsel = 5, max_idsel = 10, irqs_per_slot = 5;
-
         struct pci_controller *hose = dev->sysdata;
         int irq = COMMON_TABLE_LOOKUP;
 
-        if (irq > 0) {
+        if (irq > 0)
                 irq += 16 * hose->index;
-        } else {
-                /* ??? The Contaq IDE controller on the ISA bridge uses
-                   "legacy" interrupts 14 and 15.  I don't know if anything
-                   can wind up at the same slot+pin on hose1, so we'll
-                   just have to trust whatever value the console might
-                   have assigned.  */
-
-                u8 irq8;
-                pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &irq8);
-                irq = irq8;
-        }
 
-        return irq;
+        return isa_irq_fixup(dev, irq);
 }
 
 static int __init
@@ -453,7 +457,8 @@ monet_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
                 {    24,    24,    25,    26,    27}  /* IdSel 15 slot 5 PCI2*/
         };
         const long min_idsel = 3, max_idsel = 15, irqs_per_slot = 5;
-        return COMMON_TABLE_LOOKUP;
+
+        return isa_irq_fixup(dev, COMMON_TABLE_LOOKUP);
 }
 
 static u8 __init
@@ -507,7 +512,8 @@ webbrick_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
                 {    47,    47,    46,    45,    44}, /* IdSel 17 slot 3 */
         };
         const long min_idsel = 7, max_idsel = 17, irqs_per_slot = 5;
-        return COMMON_TABLE_LOOKUP;
+
+        return isa_irq_fixup(dev, COMMON_TABLE_LOOKUP);
 }
 
 static int __init
@@ -524,14 +530,13 @@ clipper_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
                 {    -1,    -1,    -1,    -1,    -1}  /* IdSel 7 ISA Bridge */
         };
         const long min_idsel = 1, max_idsel = 7, irqs_per_slot = 5;
-
         struct pci_controller *hose = dev->sysdata;
         int irq = COMMON_TABLE_LOOKUP;
 
         if (irq > 0)
                 irq += 16 * hose->index;
 
-        return irq;
+        return isa_irq_fixup(dev, irq);
 }
 
 static void __init
diff --git a/arch/alpha/kernel/traps.c b/arch/alpha/kernel/traps.c
index 6f509a644bdd..f9d12319e0fb 100644
--- a/arch/alpha/kernel/traps.c
+++ b/arch/alpha/kernel/traps.c
@@ -446,16 +446,15 @@ struct unaligned_stat {
 
 
 /* Macro for exception fixup code to access integer registers.  */
-#define una_reg(r)  (regs.regs[(r) >= 16 && (r) <= 18 ? (r)+19 : (r)])
+#define una_reg(r)  (regs->regs[(r) >= 16 && (r) <= 18 ? (r)+19 : (r)])
 
 
 asmlinkage void
 do_entUna(void * va, unsigned long opcode, unsigned long reg,
-          unsigned long a3, unsigned long a4, unsigned long a5,
-          struct allregs regs)
+          struct allregs *regs)
 {
         long error, tmp1, tmp2, tmp3, tmp4;
-        unsigned long pc = regs.pc - 4;
+        unsigned long pc = regs->pc - 4;
         const struct exception_table_entry *fixup;
 
         unaligned[0].count++;
@@ -636,7 +635,7 @@ got_exception:
                 printk("Forwarding unaligned exception at %lx (%lx)\n",
                        pc, newpc);
 
-                (&regs)->pc = newpc;
+                regs->pc = newpc;
                 return;
         }
 
@@ -650,7 +649,7 @@ got_exception:
                current->comm, current->pid);
 
         printk("pc = [<%016lx>]  ra = [<%016lx>]  ps = %04lx\n",
-               pc, una_reg(26), regs.ps);
+               pc, una_reg(26), regs->ps);
         printk("r0 = %016lx  r1 = %016lx  r2 = %016lx\n",
                una_reg(0), una_reg(1), una_reg(2));
         printk("r3 = %016lx  r4 = %016lx  r5 = %016lx\n",
@@ -670,10 +669,10 @@ got_exception:
                una_reg(22), una_reg(23), una_reg(24));
         printk("r25= %016lx  r27= %016lx  r28= %016lx\n",
                una_reg(25), una_reg(27), una_reg(28));
-        printk("gp = %016lx  sp = %p\n", regs.gp, &regs+1);
+        printk("gp = %016lx  sp = %p\n", regs->gp, regs+1);
 
         dik_show_code((unsigned int *)pc);
-        dik_show_trace((unsigned long *)(&regs+1));
+        dik_show_trace((unsigned long *)(regs+1));
 
         if (test_and_set_thread_flag (TIF_DIE_IF_KERNEL)) {
                 printk("die_if_kernel recursion detected.\n");
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 130e6228b587..7779f2d1acad 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -175,10 +175,10 @@ else
 endif
         @touch $@
 
-archprepare: maketools include/asm-arm/.arch
+archprepare: maketools
 
 .PHONY: maketools FORCE
-maketools: include/linux/version.h FORCE
+maketools: include/linux/version.h include/asm-arm/.arch FORCE
         $(Q)$(MAKE) $(build)=arch/arm/tools include/asm-arm/mach-types.h
 
 # Convert bzImage to zImage
diff --git a/arch/arm/boot/compressed/ofw-shark.c b/arch/arm/boot/compressed/ofw-shark.c
index 7f6f5db0d060..465c54b6b128 100644
--- a/arch/arm/boot/compressed/ofw-shark.c
+++ b/arch/arm/boot/compressed/ofw-shark.c
@@ -256,5 +256,5 @@ asmlinkage void ofw_init(ofw_handle_t o, int *nomr, int *pointer)
         temp[11]='\0';
         mem_len = OF_getproplen(o,phandle, temp);
         OF_getprop(o,phandle, temp, buffer, mem_len);
-        (unsigned char) pointer[32] = ((unsigned char *) buffer)[mem_len-2];
+        * ((unsigned char *) &pointer[32]) = ((unsigned char *) buffer)[mem_len-2];
 }
diff --git a/arch/arm/common/gic.c b/arch/arm/common/gic.c
index d74990717559..c02dc8116a18 100644
--- a/arch/arm/common/gic.c
+++ b/arch/arm/common/gic.c
@@ -68,6 +68,7 @@ static void gic_unmask_irq(unsigned int irq)
         writel(mask, gic_dist_base + GIC_DIST_ENABLE_SET + (irq / 32) * 4);
 }
 
+#ifdef CONFIG_SMP
 static void gic_set_cpu(struct irqdesc *desc, unsigned int irq, unsigned int cpu)
 {
         void __iomem *reg = gic_dist_base + GIC_DIST_TARGET + (irq & ~3);
@@ -78,6 +79,7 @@ static void gic_set_cpu(struct irqdesc *desc, unsigned int irq, unsigned int cpu
         val |= 1 << (cpu + shift);
         writel(val, reg);
 }
+#endif
 
 static struct irqchip gic_chip = {
         .ack            = gic_ack_irq,
diff --git a/arch/arm/common/locomo.c b/arch/arm/common/locomo.c
index 2786f7c34b3f..e8053d16829b 100644
--- a/arch/arm/common/locomo.c
+++ b/arch/arm/common/locomo.c
@@ -27,7 +27,6 @@
 #include <linux/spinlock.h>
 
 #include <asm/hardware.h>
-#include <asm/mach-types.h>
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/mach/irq.h>
@@ -551,7 +550,7 @@ struct locomo_save_data {
         u16     LCM_SPIMD;
 };
 
-static int locomo_suspend(struct device *dev, u32 pm_message_t, u32 level)
+static int locomo_suspend(struct device *dev, pm_message_t state, u32 level)
 {
         struct locomo *lchip = dev_get_drvdata(dev);
         struct locomo_save_data *save;
diff --git a/arch/arm/configs/enp2611_defconfig b/arch/arm/configs/enp2611_defconfig
index f67ca01b4982..30e6444f9aaa 100644
--- a/arch/arm/configs/enp2611_defconfig
+++ b/arch/arm/configs/enp2611_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc2
-# Thu Jul  7 16:41:21 2005
+# Linux kernel version: 2.6.13
+# Wed Sep 14 10:51:52 2005
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
@@ -135,7 +135,6 @@ CONFIG_PCI_NAMES=y
 #
 # Kernel Features
 #
-# CONFIG_SMP is not set
 # CONFIG_PREEMPT is not set
 # CONFIG_NO_IDLE_HZ is not set
 # CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
@@ -179,6 +178,68 @@ CONFIG_BINFMT_ELF=y
 # CONFIG_PM is not set
 
 #
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+CONFIG_PACKET_MMAP=y
+CONFIG_UNIX=y
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+# CONFIG_IP_MULTICAST is not set
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_TUNNEL is not set
+# CONFIG_IP_TCPDIAG is not set
+# CONFIG_IP_TCPDIAG_IPV6 is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_BIC=y
+# CONFIG_IPV6 is not set
+# CONFIG_NETFILTER is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_NET_DIVERT is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+# CONFIG_NET_SCHED is not set
+# CONFIG_NET_CLS_ROUTE is not set
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+
+#
 # Device Drivers
 #
 
@@ -248,6 +309,7 @@ CONFIG_MTD_COMPLEX_MAPPINGS=y
 CONFIG_MTD_IXP2000=y
 # CONFIG_MTD_EDB7312 is not set
 # CONFIG_MTD_PCI is not set
+# CONFIG_MTD_PLATRAM is not set
 
 #
 # Self-contained MTD device drivers
@@ -334,72 +396,8 @@ CONFIG_IOSCHED_CFQ=y
 # CONFIG_I2O is not set
 
 #
-# Networking support
-#
-CONFIG_NET=y
-
-#
-# Networking options
-#
-CONFIG_PACKET=y
-CONFIG_PACKET_MMAP=y
-CONFIG_UNIX=y
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-# CONFIG_IP_MULTICAST is not set
-# CONFIG_IP_ADVANCED_ROUTER is not set
-CONFIG_IP_FIB_HASH=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IP_PNP_RARP is not set
-# CONFIG_NET_IPIP is not set
-# CONFIG_NET_IPGRE is not set
-# CONFIG_ARPD is not set
-CONFIG_SYN_COOKIES=y
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-# CONFIG_INET_TUNNEL is not set
-# CONFIG_IP_TCPDIAG is not set
-# CONFIG_IP_TCPDIAG_IPV6 is not set
-# CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
-# CONFIG_IPV6 is not set
-# CONFIG_NETFILTER is not set
-
-#
-# SCTP Configuration (EXPERIMENTAL)
-#
-# CONFIG_IP_SCTP is not set
-# CONFIG_ATM is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_VLAN_8021Q is not set
-# CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
-# CONFIG_ATALK is not set
-# CONFIG_X25 is not set
-# CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
-# CONFIG_ECONET is not set
-# CONFIG_WAN_ROUTER is not set
-
-#
-# QoS and/or fair queueing
-#
-# CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
-
-#
-# Network testing
+# Network device support
 #
-# CONFIG_NET_PKTGEN is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=y
 # CONFIG_BONDING is not set
@@ -509,6 +507,8 @@ CONFIG_DLCI_MAX=8
 # CONFIG_SLIP is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
 
 #
 # ISDN subsystem
@@ -635,7 +635,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_ISA is not set
-# CONFIG_I2C_IXP2000 is not set
+CONFIG_I2C_IXP2000=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -649,11 +649,28 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_VIAPRO is not set
 # CONFIG_I2C_VOODOO3 is not set
 # CONFIG_I2C_PCA_ISA is not set
+CONFIG_I2C_SENSOR=y
 
 #
-# Hardware Sensors Chip support
+# Miscellaneous I2C Chip support
 #
-CONFIG_I2C_SENSOR=y
+# CONFIG_SENSORS_DS1337 is not set
+# CONFIG_SENSORS_DS1374 is not set
+CONFIG_SENSORS_EEPROM=y
+# CONFIG_SENSORS_PCF8574 is not set
+# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_RTC8564 is not set
+# CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
+
+#
+# Hardware Monitoring support
+#
+CONFIG_HWMON=y
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
@@ -679,30 +696,15 @@ CONFIG_I2C_SENSOR=y
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_PC87360 is not set
-# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83L785TS is not set
 # CONFIG_SENSORS_W83627HF is not set
 # CONFIG_SENSORS_W83627EHF is not set
-
-#
-# Other I2C Chip support
-#
-# CONFIG_SENSORS_DS1337 is not set
-# CONFIG_SENSORS_DS1374 is not set
-CONFIG_SENSORS_EEPROM=y
-# CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCA9539 is not set
-# CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
-# CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_I2C_DEBUG_CORE is not set
-# CONFIG_I2C_DEBUG_ALGO is not set
-# CONFIG_I2C_DEBUG_BUS is not set
-# CONFIG_I2C_DEBUG_CHIP is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
 # Misc devices
@@ -770,6 +772,7 @@ CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
@@ -812,8 +815,7 @@ CONFIG_RAMFS=y
 # CONFIG_JFFS_FS is not set
 CONFIG_JFFS2_FS=y
 CONFIG_JFFS2_FS_DEBUG=0
-# CONFIG_JFFS2_FS_NAND is not set
-# CONFIG_JFFS2_FS_NOR_ECC is not set
+CONFIG_JFFS2_FS_WRITEBUFFER=y
 # CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
diff --git a/arch/arm/configs/ixdp2400_defconfig b/arch/arm/configs/ixdp2400_defconfig
index 5c6c928215d0..678720fa2e2e 100644
--- a/arch/arm/configs/ixdp2400_defconfig
+++ b/arch/arm/configs/ixdp2400_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc2
-# Thu Jul  7 16:49:01 2005
+# Linux kernel version: 2.6.13
+# Wed Sep 14 10:52:01 2005
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
@@ -136,7 +136,6 @@ CONFIG_PCI_NAMES=y
 #
 # Kernel Features
 #
-# CONFIG_SMP is not set
 # CONFIG_PREEMPT is not set
 # CONFIG_NO_IDLE_HZ is not set
 # CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
@@ -180,6 +179,68 @@ CONFIG_BINFMT_ELF=y
 # CONFIG_PM is not set
 
 #
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+CONFIG_PACKET_MMAP=y
+CONFIG_UNIX=y
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+# CONFIG_IP_MULTICAST is not set
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_TUNNEL is not set
+# CONFIG_IP_TCPDIAG is not set
+# CONFIG_IP_TCPDIAG_IPV6 is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_BIC=y
+# CONFIG_IPV6 is not set
+# CONFIG_NETFILTER is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_NET_DIVERT is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+# CONFIG_NET_SCHED is not set
+# CONFIG_NET_CLS_ROUTE is not set
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+
+#
 # Device Drivers
 #
 
@@ -249,6 +310,7 @@ CONFIG_MTD_COMPLEX_MAPPINGS=y
 CONFIG_MTD_IXP2000=y
 # CONFIG_MTD_EDB7312 is not set
 # CONFIG_MTD_PCI is not set
+# CONFIG_MTD_PLATRAM is not set
 
 #
 # Self-contained MTD device drivers
@@ -335,72 +397,8 @@ CONFIG_IOSCHED_CFQ=y
 # CONFIG_I2O is not set
 
 #
-# Networking support
-#
-CONFIG_NET=y
-
-#
-# Networking options
-#
-CONFIG_PACKET=y
-CONFIG_PACKET_MMAP=y
-CONFIG_UNIX=y
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-# CONFIG_IP_MULTICAST is not set
-# CONFIG_IP_ADVANCED_ROUTER is not set
-CONFIG_IP_FIB_HASH=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IP_PNP_RARP is not set
-# CONFIG_NET_IPIP is not set
-# CONFIG_NET_IPGRE is not set
-# CONFIG_ARPD is not set
-CONFIG_SYN_COOKIES=y
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-# CONFIG_INET_TUNNEL is not set
-# CONFIG_IP_TCPDIAG is not set
-# CONFIG_IP_TCPDIAG_IPV6 is not set
-# CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
-# CONFIG_IPV6 is not set
-# CONFIG_NETFILTER is not set
-
-#
-# SCTP Configuration (EXPERIMENTAL)
-#
-# CONFIG_IP_SCTP is not set
-# CONFIG_ATM is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_VLAN_8021Q is not set
-# CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
-# CONFIG_ATALK is not set
-# CONFIG_X25 is not set
-# CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
-# CONFIG_ECONET is not set
-# CONFIG_WAN_ROUTER is not set
-
-#
-# QoS and/or fair queueing
-#
-# CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
-
-#
-# Network testing
+# Network device support
 #
-# CONFIG_NET_PKTGEN is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=y
 # CONFIG_BONDING is not set
@@ -510,6 +508,8 @@ CONFIG_DLCI_MAX=8
 # CONFIG_SLIP is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
 
 #
 # ISDN subsystem
@@ -636,7 +636,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_ISA is not set
-# CONFIG_I2C_IXP2000 is not set
+CONFIG_I2C_IXP2000=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -650,11 +650,28 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_VIAPRO is not set
 # CONFIG_I2C_VOODOO3 is not set
 # CONFIG_I2C_PCA_ISA is not set
+CONFIG_I2C_SENSOR=y
 
 #
-# Hardware Sensors Chip support
+# Miscellaneous I2C Chip support
 #
-CONFIG_I2C_SENSOR=y
+# CONFIG_SENSORS_DS1337 is not set
+# CONFIG_SENSORS_DS1374 is not set
+CONFIG_SENSORS_EEPROM=y
+# CONFIG_SENSORS_PCF8574 is not set
+# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_RTC8564 is not set
+# CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
+
+#
+# Hardware Monitoring support
+#
+CONFIG_HWMON=y
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
@@ -680,30 +697,15 @@ CONFIG_I2C_SENSOR=y
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_PC87360 is not set
-# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83L785TS is not set
 # CONFIG_SENSORS_W83627HF is not set
 # CONFIG_SENSORS_W83627EHF is not set
-
-#
-# Other I2C Chip support
-#
-# CONFIG_SENSORS_DS1337 is not set
-# CONFIG_SENSORS_DS1374 is not set
-CONFIG_SENSORS_EEPROM=y
-# CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCA9539 is not set
-# CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
-# CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_I2C_DEBUG_CORE is not set
-# CONFIG_I2C_DEBUG_ALGO is not set
-# CONFIG_I2C_DEBUG_BUS is not set
-# CONFIG_I2C_DEBUG_CHIP is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
 # Misc devices
@@ -771,6 +773,7 @@ CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
@@ -813,8 +816,7 @@ CONFIG_RAMFS=y
 # CONFIG_JFFS_FS is not set
 CONFIG_JFFS2_FS=y
 CONFIG_JFFS2_FS_DEBUG=0
-# CONFIG_JFFS2_FS_NAND is not set
-# CONFIG_JFFS2_FS_NOR_ECC is not set
+CONFIG_JFFS2_FS_WRITEBUFFER=y
 # CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
diff --git a/arch/arm/configs/ixdp2401_defconfig b/arch/arm/configs/ixdp2401_defconfig
index 6dc40f6be0ef..38c9a721d5c9 100644
--- a/arch/arm/configs/ixdp2401_defconfig
+++ b/arch/arm/configs/ixdp2401_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc2
-# Thu Jul  7 16:49:08 2005
+# Linux kernel version: 2.6.13
+# Wed Sep 14 10:52:10 2005
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
@@ -136,7 +136,6 @@ CONFIG_PCI_NAMES=y
 #
 # Kernel Features
 #
-# CONFIG_SMP is not set
 # CONFIG_PREEMPT is not set
 # CONFIG_NO_IDLE_HZ is not set
 # CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
@@ -180,6 +179,68 @@ CONFIG_BINFMT_ELF=y
 # CONFIG_PM is not set
 
 #
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+CONFIG_PACKET_MMAP=y
+CONFIG_UNIX=y
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+# CONFIG_IP_MULTICAST is not set
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_TUNNEL is not set
+CONFIG_IP_TCPDIAG=y
+# CONFIG_IP_TCPDIAG_IPV6 is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_BIC=y
+# CONFIG_IPV6 is not set
+# CONFIG_NETFILTER is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_NET_DIVERT is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+# CONFIG_NET_SCHED is not set
+# CONFIG_NET_CLS_ROUTE is not set
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+
+#
 # Device Drivers
 #
 
@@ -249,6 +310,7 @@ CONFIG_MTD_COMPLEX_MAPPINGS=y
 CONFIG_MTD_IXP2000=y
 # CONFIG_MTD_EDB7312 is not set
 # CONFIG_MTD_PCI is not set
+# CONFIG_MTD_PLATRAM is not set
 
 #
 # Self-contained MTD device drivers
@@ -335,72 +397,8 @@ CONFIG_IOSCHED_CFQ=y
 # CONFIG_I2O is not set
 
 #
-# Networking support
-#
-CONFIG_NET=y
-
-#
-# Networking options
-#
-CONFIG_PACKET=y
-CONFIG_PACKET_MMAP=y
-CONFIG_UNIX=y
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-# CONFIG_IP_MULTICAST is not set
-# CONFIG_IP_ADVANCED_ROUTER is not set
-CONFIG_IP_FIB_HASH=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IP_PNP_RARP is not set
-# CONFIG_NET_IPIP is not set
-# CONFIG_NET_IPGRE is not set
-# CONFIG_ARPD is not set
-CONFIG_SYN_COOKIES=y
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-# CONFIG_INET_TUNNEL is not set
-CONFIG_IP_TCPDIAG=y
-# CONFIG_IP_TCPDIAG_IPV6 is not set
-# CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
-# CONFIG_IPV6 is not set
-# CONFIG_NETFILTER is not set
-
-#
-# SCTP Configuration (EXPERIMENTAL)
-#
-# CONFIG_IP_SCTP is not set
-# CONFIG_ATM is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_VLAN_8021Q is not set
-# CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
-# CONFIG_ATALK is not set
-# CONFIG_X25 is not set
-# CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
-# CONFIG_ECONET is not set
-# CONFIG_WAN_ROUTER is not set
-
-#
-# QoS and/or fair queueing
-#
-# CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
-
-#
-# Network testing
+# Network device support
 #
-# CONFIG_NET_PKTGEN is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=y
 # CONFIG_BONDING is not set
@@ -511,6 +509,8 @@ CONFIG_DLCI_MAX=8
 # CONFIG_SLIP is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
 
 #
 # ISDN subsystem
@@ -637,7 +637,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_ISA is not set
-# CONFIG_I2C_IXP2000 is not set
+CONFIG_I2C_IXP2000=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -651,11 +651,28 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_VIAPRO is not set
 # CONFIG_I2C_VOODOO3 is not set
 # CONFIG_I2C_PCA_ISA is not set
+CONFIG_I2C_SENSOR=y
 
 #
-# Hardware Sensors Chip support
+# Miscellaneous I2C Chip support
 #
-CONFIG_I2C_SENSOR=y
+# CONFIG_SENSORS_DS1337 is not set
+# CONFIG_SENSORS_DS1374 is not set
+CONFIG_SENSORS_EEPROM=y
+# CONFIG_SENSORS_PCF8574 is not set
+# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_RTC8564 is not set
+# CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
+
+#
+# Hardware Monitoring support
+#
+CONFIG_HWMON=y
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
@@ -681,30 +698,15 @@ CONFIG_I2C_SENSOR=y
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_PC87360 is not set
-# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83L785TS is not set
 # CONFIG_SENSORS_W83627HF is not set
 # CONFIG_SENSORS_W83627EHF is not set
-
-#
-# Other I2C Chip support
-#
-# CONFIG_SENSORS_DS1337 is not set
-# CONFIG_SENSORS_DS1374 is not set
-CONFIG_SENSORS_EEPROM=y
-# CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCA9539 is not set
-# CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
-# CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_I2C_DEBUG_CORE is not set
-# CONFIG_I2C_DEBUG_ALGO is not set
-# CONFIG_I2C_DEBUG_BUS is not set
-# CONFIG_I2C_DEBUG_CHIP is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
 # Misc devices
@@ -772,6 +774,7 @@ CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
@@ -814,8 +817,7 @@ CONFIG_RAMFS=y
 # CONFIG_JFFS_FS is not set
 CONFIG_JFFS2_FS=y
 CONFIG_JFFS2_FS_DEBUG=0
-# CONFIG_JFFS2_FS_NAND is not set
-# CONFIG_JFFS2_FS_NOR_ECC is not set
+CONFIG_JFFS2_FS_WRITEBUFFER=y
 # CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
diff --git a/arch/arm/configs/ixdp2800_defconfig b/arch/arm/configs/ixdp2800_defconfig
index d2bb0b7153fe..261e2343903b 100644
--- a/arch/arm/configs/ixdp2800_defconfig
+++ b/arch/arm/configs/ixdp2800_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc2
-# Thu Jul  7 16:49:20 2005
+# Linux kernel version: 2.6.13
+# Wed Sep 14 10:52:23 2005
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
@@ -136,7 +136,6 @@ CONFIG_PCI_NAMES=y
 #
 # Kernel Features
 #
-# CONFIG_SMP is not set
 # CONFIG_PREEMPT is not set
 # CONFIG_NO_IDLE_HZ is not set
 # CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
@@ -180,6 +179,68 @@ CONFIG_BINFMT_ELF=y
 # CONFIG_PM is not set
 
 #
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+CONFIG_PACKET_MMAP=y
+CONFIG_UNIX=y
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+# CONFIG_IP_MULTICAST is not set
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_TUNNEL is not set
+# CONFIG_IP_TCPDIAG is not set
+# CONFIG_IP_TCPDIAG_IPV6 is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_BIC=y
+# CONFIG_IPV6 is not set
+# CONFIG_NETFILTER is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_NET_DIVERT is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+# CONFIG_NET_SCHED is not set
+# CONFIG_NET_CLS_ROUTE is not set
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+
+#
 # Device Drivers
 #
 
@@ -249,6 +310,7 @@ CONFIG_MTD_COMPLEX_MAPPINGS=y
 CONFIG_MTD_IXP2000=y
 # CONFIG_MTD_EDB7312 is not set
 # CONFIG_MTD_PCI is not set
+# CONFIG_MTD_PLATRAM is not set
 
 #
 # Self-contained MTD device drivers
@@ -335,72 +397,8 @@ CONFIG_IOSCHED_CFQ=y
 # CONFIG_I2O is not set
 
 #
-# Networking support
-#
-CONFIG_NET=y
-
-#
-# Networking options
-#
-CONFIG_PACKET=y
-CONFIG_PACKET_MMAP=y
-CONFIG_UNIX=y
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-# CONFIG_IP_MULTICAST is not set
-# CONFIG_IP_ADVANCED_ROUTER is not set
-CONFIG_IP_FIB_HASH=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IP_PNP_RARP is not set
-# CONFIG_NET_IPIP is not set
-# CONFIG_NET_IPGRE is not set
-# CONFIG_ARPD is not set
-CONFIG_SYN_COOKIES=y
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-# CONFIG_INET_TUNNEL is not set
-# CONFIG_IP_TCPDIAG is not set
-# CONFIG_IP_TCPDIAG_IPV6 is not set
-# CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
-# CONFIG_IPV6 is not set
-# CONFIG_NETFILTER is not set
-
-#
-# SCTP Configuration (EXPERIMENTAL)
-#
-# CONFIG_IP_SCTP is not set
-# CONFIG_ATM is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_VLAN_8021Q is not set
-# CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
-# CONFIG_ATALK is not set
-# CONFIG_X25 is not set
-# CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
-# CONFIG_ECONET is not set
-# CONFIG_WAN_ROUTER is not set
-
-#
-# QoS and/or fair queueing
-#
-# CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
-
-#
-# Network testing
+# Network device support
 #
-# CONFIG_NET_PKTGEN is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=y
 # CONFIG_BONDING is not set
@@ -510,6 +508,8 @@ CONFIG_DLCI_MAX=8
 # CONFIG_SLIP is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
 
 #
 # ISDN subsystem
@@ -636,7 +636,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_ISA is not set
-# CONFIG_I2C_IXP2000 is not set
+CONFIG_I2C_IXP2000=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -650,11 +650,28 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_VIAPRO is not set
 # CONFIG_I2C_VOODOO3 is not set
 # CONFIG_I2C_PCA_ISA is not set
+CONFIG_I2C_SENSOR=y
 
 #
-# Hardware Sensors Chip support
+# Miscellaneous I2C Chip support
 #
-CONFIG_I2C_SENSOR=y
+# CONFIG_SENSORS_DS1337 is not set
+# CONFIG_SENSORS_DS1374 is not set
+CONFIG_SENSORS_EEPROM=y
+# CONFIG_SENSORS_PCF8574 is not set
+# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_RTC8564 is not set
+# CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
+
+#
+# Hardware Monitoring support
+#
+CONFIG_HWMON=y
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
@@ -680,30 +697,15 @@ CONFIG_I2C_SENSOR=y
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_PC87360 is not set
-# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83L785TS is not set
 # CONFIG_SENSORS_W83627HF is not set
 # CONFIG_SENSORS_W83627EHF is not set
-
-#
-# Other I2C Chip support
-#
-# CONFIG_SENSORS_DS1337 is not set
-# CONFIG_SENSORS_DS1374 is not set
-CONFIG_SENSORS_EEPROM=y
-# CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCA9539 is not set
-# CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
-# CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_I2C_DEBUG_CORE is not set
-# CONFIG_I2C_DEBUG_ALGO is not set
-# CONFIG_I2C_DEBUG_BUS is not set
-# CONFIG_I2C_DEBUG_CHIP is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
 # Misc devices
@@ -771,6 +773,7 @@ CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
@@ -813,8 +816,7 @@ CONFIG_RAMFS=y
 # CONFIG_JFFS_FS is not set
 CONFIG_JFFS2_FS=y
 CONFIG_JFFS2_FS_DEBUG=0
-# CONFIG_JFFS2_FS_NAND is not set
-# CONFIG_JFFS2_FS_NOR_ECC is not set
+CONFIG_JFFS2_FS_WRITEBUFFER=y
 # CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
diff --git a/arch/arm/configs/ixdp2801_defconfig b/arch/arm/configs/ixdp2801_defconfig
index 2d6f960e3395..12ef23d1c016 100644
--- a/arch/arm/configs/ixdp2801_defconfig
+++ b/arch/arm/configs/ixdp2801_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc2
-# Thu Jul  7 16:49:13 2005
+# Linux kernel version: 2.6.13
+# Wed Sep 14 10:52:16 2005
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
@@ -136,7 +136,6 @@ CONFIG_PCI_NAMES=y
 #
 # Kernel Features
 #
-# CONFIG_SMP is not set
 # CONFIG_PREEMPT is not set
 # CONFIG_NO_IDLE_HZ is not set
 # CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
@@ -180,6 +179,68 @@ CONFIG_BINFMT_ELF=y
 # CONFIG_PM is not set
 
 #
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+CONFIG_PACKET_MMAP=y
+CONFIG_UNIX=y
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+# CONFIG_IP_MULTICAST is not set
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_TUNNEL is not set
+# CONFIG_IP_TCPDIAG is not set
+# CONFIG_IP_TCPDIAG_IPV6 is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_BIC=y
+# CONFIG_IPV6 is not set
+# CONFIG_NETFILTER is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_NET_DIVERT is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+# CONFIG_NET_SCHED is not set
+# CONFIG_NET_CLS_ROUTE is not set
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+
+#
 # Device Drivers
 #
 
@@ -249,6 +310,7 @@ CONFIG_MTD_COMPLEX_MAPPINGS=y
 CONFIG_MTD_IXP2000=y
 # CONFIG_MTD_EDB7312 is not set
 # CONFIG_MTD_PCI is not set
+# CONFIG_MTD_PLATRAM is not set
 
 #
 # Self-contained MTD device drivers
@@ -335,72 +397,8 @@ CONFIG_IOSCHED_CFQ=y
 # CONFIG_I2O is not set
 
 #
-# Networking support
-#
-CONFIG_NET=y
-
-#
-# Networking options
-#
-CONFIG_PACKET=y
-CONFIG_PACKET_MMAP=y
-CONFIG_UNIX=y
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-# CONFIG_IP_MULTICAST is not set
-# CONFIG_IP_ADVANCED_ROUTER is not set
-CONFIG_IP_FIB_HASH=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IP_PNP_RARP is not set
-# CONFIG_NET_IPIP is not set
-# CONFIG_NET_IPGRE is not set
-# CONFIG_ARPD is not set
-CONFIG_SYN_COOKIES=y
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-# CONFIG_INET_TUNNEL is not set
-# CONFIG_IP_TCPDIAG is not set
-# CONFIG_IP_TCPDIAG_IPV6 is not set
-# CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
-# CONFIG_IPV6 is not set
-# CONFIG_NETFILTER is not set
-
-#
-# SCTP Configuration (EXPERIMENTAL)
-#
-# CONFIG_IP_SCTP is not set
-# CONFIG_ATM is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_VLAN_8021Q is not set
-# CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
-# CONFIG_ATALK is not set
-# CONFIG_X25 is not set
-# CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
-# CONFIG_ECONET is not set
-# CONFIG_WAN_ROUTER is not set
-
-#
-# QoS and/or fair queueing
-#
-# CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
-
-#
-# Network testing
+# Network device support
 #
-# CONFIG_NET_PKTGEN is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=y
 # CONFIG_BONDING is not set
@@ -511,6 +509,8 @@ CONFIG_DLCI_MAX=8
 # CONFIG_SLIP is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
 
 #
 # ISDN subsystem
@@ -637,7 +637,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_ISA is not set
-# CONFIG_I2C_IXP2000 is not set
+CONFIG_I2C_IXP2000=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -651,11 +651,28 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_VIAPRO is not set
 # CONFIG_I2C_VOODOO3 is not set
 # CONFIG_I2C_PCA_ISA is not set
+CONFIG_I2C_SENSOR=y
 
 #
-# Hardware Sensors Chip support
+# Miscellaneous I2C Chip support
 #
-CONFIG_I2C_SENSOR=y
+# CONFIG_SENSORS_DS1337 is not set
+# CONFIG_SENSORS_DS1374 is not set
+CONFIG_SENSORS_EEPROM=y
+# CONFIG_SENSORS_PCF8574 is not set
+# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_RTC8564 is not set
+# CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
+
+#
+# Hardware Monitoring support
+#
+CONFIG_HWMON=y
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
@@ -681,30 +698,15 @@ CONFIG_I2C_SENSOR=y
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_PC87360 is not set
-# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83L785TS is not set
 # CONFIG_SENSORS_W83627HF is not set
 # CONFIG_SENSORS_W83627EHF is not set
-
-#
-# Other I2C Chip support
-#
-# CONFIG_SENSORS_DS1337 is not set
-# CONFIG_SENSORS_DS1374 is not set
-CONFIG_SENSORS_EEPROM=y
-# CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCA9539 is not set
-# CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
-# CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_I2C_DEBUG_CORE is not set
-# CONFIG_I2C_DEBUG_ALGO is not set
-# CONFIG_I2C_DEBUG_BUS is not set
-# CONFIG_I2C_DEBUG_CHIP is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
 # Misc devices
@@ -772,6 +774,7 @@ CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
@@ -814,8 +817,7 @@ CONFIG_RAMFS=y
 # CONFIG_JFFS_FS is not set
 CONFIG_JFFS2_FS=y
 CONFIG_JFFS2_FS_DEBUG=0
-# CONFIG_JFFS2_FS_NAND is not set
-# CONFIG_JFFS2_FS_NOR_ECC is not set
+CONFIG_JFFS2_FS_WRITEBUFFER=y
 # CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
diff --git a/arch/arm/configs/ixp4xx_defconfig b/arch/arm/configs/ixp4xx_defconfig
index 94aafec5fb46..c279e41ed10e 100644
--- a/arch/arm/configs/ixp4xx_defconfig
+++ b/arch/arm/configs/ixp4xx_defconfig
@@ -1,14 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.12-rc1-bk2
-# Sun Mar 27 22:53:40 2005
+# Linux kernel version: 2.6.14-rc1-git5
+# Tue Sep 20 17:26:28 2005
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
 CONFIG_UID16=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
-CONFIG_GENERIC_IOMAP=y
 
 #
 # Code maturity level options
@@ -16,11 +15,13 @@ CONFIG_GENERIC_IOMAP=y
 CONFIG_EXPERIMENTAL=y
 CONFIG_CLEAN_COMPILE=y
 CONFIG_BROKEN_ON_SMP=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
 
 #
 # General setup
 #
 CONFIG_LOCALVERSION=""
+CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 # CONFIG_POSIX_MQUEUE is not set
@@ -31,10 +32,13 @@ CONFIG_SYSCTL=y
 # CONFIG_HOTPLUG is not set
 CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
+CONFIG_INITRAMFS_SOURCE=""
 CONFIG_EMBEDDED=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_PRINTK=y
+CONFIG_BUG=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -81,6 +85,7 @@ CONFIG_ARCH_IXP4XX=y
 # CONFIG_ARCH_VERSATILE is not set
 # CONFIG_ARCH_IMX is not set
 # CONFIG_ARCH_H720X is not set
+# CONFIG_ARCH_AAEC2000 is not set
 CONFIG_ARCH_SUPPORTS_BIG_ENDIAN=y
 
 #
@@ -90,15 +95,16 @@ CONFIG_ARCH_SUPPORTS_BIG_ENDIAN=y
 #
 # IXP4xx Platforms
 #
-# CONFIG_ARCH_AVILA is not set
+CONFIG_ARCH_AVILA=y
 CONFIG_ARCH_ADI_COYOTE=y
 CONFIG_ARCH_IXDP425=y
-# CONFIG_MACH_IXDPG425 is not set
-# CONFIG_MACH_IXDP465 is not set
+CONFIG_MACH_IXDPG425=y
+CONFIG_MACH_IXDP465=y
 CONFIG_ARCH_IXCDP1100=y
 CONFIG_ARCH_PRPMC1100=y
 CONFIG_ARCH_IXDP4XX=y
-# CONFIG_MACH_GTWX5715 is not set
+CONFIG_CPU_IXP46X=y
+CONFIG_MACH_GTWX5715=y
 
 #
 # IXP4xx Options
@@ -114,7 +120,6 @@ CONFIG_CPU_32v5=y
 CONFIG_CPU_ABRT_EV5T=y
 CONFIG_CPU_CACHE_VIVT=y
 CONFIG_CPU_TLB_V4WBI=y
-CONFIG_CPU_MINICACHE=y
 
 #
 # Processor Features
@@ -127,9 +132,10 @@ CONFIG_DMABOUNCE=y
 #
 # Bus support
 #
+CONFIG_ISA_DMA_API=y
 CONFIG_PCI=y
 CONFIG_PCI_LEGACY_PROC=y
-CONFIG_PCI_NAMES=y
+# CONFIG_PCI_DEBUG is not set
 
 #
 # PCCARD (PCMCIA/CardBus) support
@@ -140,6 +146,15 @@ CONFIG_PCI_NAMES=y
 # Kernel Features
 #
 # CONFIG_PREEMPT is not set
+# CONFIG_NO_IDLE_HZ is not set
+# CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_FLATMEM_MANUAL=y
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_FLATMEM=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+# CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_ALIGNMENT_TRAP=y
 
 #
@@ -175,6 +190,241 @@ CONFIG_PM=y
 CONFIG_APM=y
 
 #
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=m
+CONFIG_PACKET_MMAP=y
+CONFIG_UNIX=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_USER is not set
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_ASK_IP_FIB_HASH=y
+# CONFIG_IP_FIB_TRIE is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_FWMARK=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+# CONFIG_IP_ROUTE_MULTIPATH_CACHED is not set
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+CONFIG_INET_TUNNEL=m
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_BIC=y
+
+#
+# IP: Virtual Server Configuration
+#
+CONFIG_IP_VS=m
+CONFIG_IP_VS_DEBUG=y
+CONFIG_IP_VS_TAB_BITS=12
+
+#
+# IPVS transport protocol load balancing support
+#
+# CONFIG_IP_VS_PROTO_TCP is not set
+# CONFIG_IP_VS_PROTO_UDP is not set
+# CONFIG_IP_VS_PROTO_ESP is not set
+# CONFIG_IP_VS_PROTO_AH is not set
+
+#
+# IPVS scheduler
+#
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+# CONFIG_IP_VS_SED is not set
+# CONFIG_IP_VS_NQ is not set
+
+#
+# IPVS application helper
+#
+# CONFIG_IPV6 is not set
+CONFIG_NETFILTER=y
+# CONFIG_NETFILTER_DEBUG is not set
+CONFIG_BRIDGE_NETFILTER=y
+# CONFIG_NETFILTER_NETLINK is not set
+
+#
+# IP: Netfilter Configuration
+#
+CONFIG_IP_NF_CONNTRACK=m
+# CONFIG_IP_NF_CT_ACCT is not set
+# CONFIG_IP_NF_CONNTRACK_MARK is not set
+# CONFIG_IP_NF_CONNTRACK_EVENTS is not set
+# CONFIG_IP_NF_CT_PROTO_SCTP is not set
+CONFIG_IP_NF_FTP=m
+CONFIG_IP_NF_IRC=m
+# CONFIG_IP_NF_NETBIOS_NS is not set
+# CONFIG_IP_NF_TFTP is not set
+# CONFIG_IP_NF_AMANDA is not set
+CONFIG_IP_NF_QUEUE=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_LIMIT=m
+# CONFIG_IP_NF_MATCH_IPRANGE is not set
+CONFIG_IP_NF_MATCH_MAC=m
+# CONFIG_IP_NF_MATCH_PKTTYPE is not set
+CONFIG_IP_NF_MATCH_MARK=m
+CONFIG_IP_NF_MATCH_MULTIPORT=m
+CONFIG_IP_NF_MATCH_TOS=m
+# CONFIG_IP_NF_MATCH_RECENT is not set
+# CONFIG_IP_NF_MATCH_ECN is not set
+# CONFIG_IP_NF_MATCH_DSCP is not set
+CONFIG_IP_NF_MATCH_AH_ESP=m
+CONFIG_IP_NF_MATCH_LENGTH=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_MATCH_TCPMSS=m
+# CONFIG_IP_NF_MATCH_HELPER is not set
+CONFIG_IP_NF_MATCH_STATE=m
+# CONFIG_IP_NF_MATCH_CONNTRACK is not set
+CONFIG_IP_NF_MATCH_OWNER=m
+# CONFIG_IP_NF_MATCH_PHYSDEV is not set
+# CONFIG_IP_NF_MATCH_ADDRTYPE is not set
+# CONFIG_IP_NF_MATCH_REALM is not set
+# CONFIG_IP_NF_MATCH_SCTP is not set
+# CONFIG_IP_NF_MATCH_DCCP is not set
+# CONFIG_IP_NF_MATCH_COMMENT is not set
+# CONFIG_IP_NF_MATCH_HASHLIMIT is not set
+# CONFIG_IP_NF_MATCH_STRING is not set
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_LOG=m
+CONFIG_IP_NF_TARGET_ULOG=m
+CONFIG_IP_NF_TARGET_TCPMSS=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_NAT_NEEDED=y
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+# CONFIG_IP_NF_TARGET_NETMAP is not set
+# CONFIG_IP_NF_TARGET_SAME is not set
+CONFIG_IP_NF_NAT_SNMP_BASIC=m
+CONFIG_IP_NF_NAT_IRC=m
+CONFIG_IP_NF_NAT_FTP=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_TOS=m
+# CONFIG_IP_NF_TARGET_ECN is not set
+# CONFIG_IP_NF_TARGET_DSCP is not set
+CONFIG_IP_NF_TARGET_MARK=m
+# CONFIG_IP_NF_TARGET_CLASSIFY is not set
+# CONFIG_IP_NF_TARGET_TTL is not set
+# CONFIG_IP_NF_RAW is not set
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+# CONFIG_IP_NF_ARP_MANGLE is not set
+
+#
+# Bridge: Netfilter Configuration
+#
+# CONFIG_BRIDGE_NF_EBTABLES is not set
+
+#
+# DCCP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_DCCP is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+CONFIG_ATM=y
+CONFIG_ATM_CLIP=y
+# CONFIG_ATM_CLIP_NO_ICMP is not set
+CONFIG_ATM_LANE=m
+CONFIG_ATM_MPOA=m
+CONFIG_ATM_BR2684=m
+# CONFIG_ATM_BR2684_IPFILTER is not set
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+# CONFIG_DECNET is not set
+CONFIG_LLC=m
+# CONFIG_LLC2 is not set
+CONFIG_IPX=m
+# CONFIG_IPX_INTERN is not set
+CONFIG_ATALK=m
+CONFIG_DEV_APPLETALK=y
+CONFIG_IPDDP=m
+CONFIG_IPDDP_ENCAP=y
+CONFIG_IPDDP_DECAP=y
+CONFIG_X25=m
+CONFIG_LAPB=m
+# CONFIG_NET_DIVERT is not set
+CONFIG_ECONET=m
+CONFIG_ECONET_AUNUDP=y
+CONFIG_ECONET_NATIVE=y
+CONFIG_WAN_ROUTER=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CLK_JIFFIES=y
+# CONFIG_NET_SCH_CLK_GETTIMEOFDAY is not set
+# CONFIG_NET_SCH_CLK_CPU is not set
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+# CONFIG_NET_SCH_HFSC is not set
+# CONFIG_NET_SCH_ATM is not set
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_DSMARK=m
+# CONFIG_NET_SCH_NETEM is not set
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_QOS=y
+CONFIG_NET_ESTIMATOR=y
+CONFIG_NET_CLS=y
+# CONFIG_NET_CLS_BASIC is not set
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_ROUTE=y
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+# CONFIG_CLS_U32_PERF is not set
+# CONFIG_NET_CLS_IND is not set
+# CONFIG_CLS_U32_MARK is not set
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+# CONFIG_NET_EMATCH is not set
+# CONFIG_NET_CLS_ACT is not set
+CONFIG_NET_CLS_POLICE=y
+
+#
+# Network testing
+#
+CONFIG_NET_PKTGEN=m
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+# CONFIG_IEEE80211 is not set
+
+#
 # Device Drivers
 #
 
@@ -244,6 +494,7 @@ CONFIG_MTD_COMPLEX_MAPPINGS=y
 CONFIG_MTD_IXP4XX=y
 # CONFIG_MTD_EDB7312 is not set
 # CONFIG_MTD_PCI is not set
+# CONFIG_MTD_PLATRAM is not set
 
 #
 # Self-contained MTD device drivers
@@ -283,7 +534,6 @@ CONFIG_MTD_NAND_IDS=m
 #
 # Block devices
 #
-# CONFIG_BLK_DEV_FD is not set
 # CONFIG_BLK_CPQ_DA is not set
 # CONFIG_BLK_CPQ_CISS_DA is not set
 # CONFIG_BLK_DEV_DAC960 is not set
@@ -297,7 +547,6 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=8192
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_CDROM_PKTCDVD is not set
 
 #
@@ -351,6 +600,7 @@ CONFIG_BLK_DEV_CMD64X=y
 CONFIG_BLK_DEV_HPT366=y
 # CONFIG_BLK_DEV_SC1200 is not set
 # CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT821X is not set
 # CONFIG_BLK_DEV_NS87415 is not set
 # CONFIG_BLK_DEV_PDC202XX_OLD is not set
 CONFIG_BLK_DEV_PDC202XX_NEW=y
@@ -369,6 +619,7 @@ CONFIG_BLK_DEV_IDEDMA=y
 #
 # SCSI device support
 #
+# CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
 
 #
@@ -379,6 +630,7 @@ CONFIG_BLK_DEV_IDEDMA=y
 #
 # Fusion MPT device support
 #
+# CONFIG_FUSION is not set
 
 #
 # IEEE 1394 (FireWire) support
@@ -391,235 +643,13 @@ CONFIG_BLK_DEV_IDEDMA=y
 # CONFIG_I2O is not set
 
 #
-# Networking support
-#
-CONFIG_NET=y
-
-#
-# Networking options
-#
-CONFIG_PACKET=m
-CONFIG_PACKET_MMAP=y
-CONFIG_NETLINK_DEV=m
-CONFIG_UNIX=y
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-CONFIG_IP_MULTICAST=y
-CONFIG_IP_ADVANCED_ROUTER=y
-CONFIG_IP_MULTIPLE_TABLES=y
-CONFIG_IP_ROUTE_FWMARK=y
-CONFIG_IP_ROUTE_MULTIPATH=y
-# CONFIG_IP_ROUTE_MULTIPATH_CACHED is not set
-CONFIG_IP_ROUTE_VERBOSE=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IP_PNP_RARP is not set
-# CONFIG_NET_IPIP is not set
-CONFIG_NET_IPGRE=m
-CONFIG_NET_IPGRE_BROADCAST=y
-CONFIG_IP_MROUTE=y
-CONFIG_IP_PIMSM_V1=y
-CONFIG_IP_PIMSM_V2=y
-# CONFIG_ARPD is not set
-CONFIG_SYN_COOKIES=y
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-CONFIG_INET_TUNNEL=m
-# CONFIG_IP_TCPDIAG is not set
-# CONFIG_IP_TCPDIAG_IPV6 is not set
-
-#
-# IP: Virtual Server Configuration
-#
-CONFIG_IP_VS=m
-CONFIG_IP_VS_DEBUG=y
-CONFIG_IP_VS_TAB_BITS=12
-
-#
-# IPVS transport protocol load balancing support
-#
-# CONFIG_IP_VS_PROTO_TCP is not set
-# CONFIG_IP_VS_PROTO_UDP is not set
-# CONFIG_IP_VS_PROTO_ESP is not set
-# CONFIG_IP_VS_PROTO_AH is not set
-
-#
-# IPVS scheduler
-#
-CONFIG_IP_VS_RR=m
-CONFIG_IP_VS_WRR=m
-CONFIG_IP_VS_LC=m
-CONFIG_IP_VS_WLC=m
-CONFIG_IP_VS_LBLC=m
-CONFIG_IP_VS_LBLCR=m
-CONFIG_IP_VS_DH=m
-CONFIG_IP_VS_SH=m
-# CONFIG_IP_VS_SED is not set
-# CONFIG_IP_VS_NQ is not set
-
-#
-# IPVS application helper
-#
-# CONFIG_IPV6 is not set
-CONFIG_NETFILTER=y
-# CONFIG_NETFILTER_DEBUG is not set
-CONFIG_BRIDGE_NETFILTER=y
-
-#
-# IP: Netfilter Configuration
+# Network device support
 #
-CONFIG_IP_NF_CONNTRACK=m
-# CONFIG_IP_NF_CT_ACCT is not set
-# CONFIG_IP_NF_CONNTRACK_MARK is not set
-# CONFIG_IP_NF_CT_PROTO_SCTP is not set
-CONFIG_IP_NF_FTP=m
-CONFIG_IP_NF_IRC=m
-# CONFIG_IP_NF_TFTP is not set
-# CONFIG_IP_NF_AMANDA is not set
-CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-# CONFIG_IP_NF_MATCH_IPRANGE is not set
-CONFIG_IP_NF_MATCH_MAC=m
-# CONFIG_IP_NF_MATCH_PKTTYPE is not set
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-# CONFIG_IP_NF_MATCH_RECENT is not set
-# CONFIG_IP_NF_MATCH_ECN is not set
-# CONFIG_IP_NF_MATCH_DSCP is not set
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-# CONFIG_IP_NF_MATCH_HELPER is not set
-CONFIG_IP_NF_MATCH_STATE=m
-# CONFIG_IP_NF_MATCH_CONNTRACK is not set
-CONFIG_IP_NF_MATCH_OWNER=m
-# CONFIG_IP_NF_MATCH_PHYSDEV is not set
-# CONFIG_IP_NF_MATCH_ADDRTYPE is not set
-# CONFIG_IP_NF_MATCH_REALM is not set
-# CONFIG_IP_NF_MATCH_SCTP is not set
-# CONFIG_IP_NF_MATCH_COMMENT is not set
-# CONFIG_IP_NF_MATCH_HASHLIMIT is not set
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-# CONFIG_IP_NF_TARGET_NETMAP is not set
-# CONFIG_IP_NF_TARGET_SAME is not set
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-# CONFIG_IP_NF_TARGET_ECN is not set
-# CONFIG_IP_NF_TARGET_DSCP is not set
-CONFIG_IP_NF_TARGET_MARK=m
-# CONFIG_IP_NF_TARGET_CLASSIFY is not set
-# CONFIG_IP_NF_RAW is not set
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-# CONFIG_IP_NF_ARP_MANGLE is not set
-
-#
-# Bridge: Netfilter Configuration
-#
-# CONFIG_BRIDGE_NF_EBTABLES is not set
-CONFIG_XFRM=y
-# CONFIG_XFRM_USER is not set
-
-#
-# SCTP Configuration (EXPERIMENTAL)
-#
-# CONFIG_IP_SCTP is not set
-CONFIG_ATM=y
-CONFIG_ATM_CLIP=y
-# CONFIG_ATM_CLIP_NO_ICMP is not set
-CONFIG_ATM_LANE=m
-CONFIG_ATM_MPOA=m
-CONFIG_ATM_BR2684=m
-# CONFIG_ATM_BR2684_IPFILTER is not set
-CONFIG_BRIDGE=m
-CONFIG_VLAN_8021Q=m
-# CONFIG_DECNET is not set
-CONFIG_LLC=m
-# CONFIG_LLC2 is not set
-CONFIG_IPX=m
-# CONFIG_IPX_INTERN is not set
-CONFIG_ATALK=m
-CONFIG_DEV_APPLETALK=y
-CONFIG_IPDDP=m
-CONFIG_IPDDP_ENCAP=y
-CONFIG_IPDDP_DECAP=y
-CONFIG_X25=m
-CONFIG_LAPB=m
-# CONFIG_NET_DIVERT is not set
-CONFIG_ECONET=m
-CONFIG_ECONET_AUNUDP=y
-CONFIG_ECONET_NATIVE=y
-CONFIG_WAN_ROUTER=m
-
-#
-# QoS and/or fair queueing
-#
-CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CLK_JIFFIES=y
-# CONFIG_NET_SCH_CLK_GETTIMEOFDAY is not set
-# CONFIG_NET_SCH_CLK_CPU is not set
-CONFIG_NET_SCH_CBQ=m
-CONFIG_NET_SCH_HTB=m
-# CONFIG_NET_SCH_HFSC is not set
-# CONFIG_NET_SCH_ATM is not set
-CONFIG_NET_SCH_PRIO=m
-CONFIG_NET_SCH_RED=m
-CONFIG_NET_SCH_SFQ=m
-CONFIG_NET_SCH_TEQL=m
-CONFIG_NET_SCH_TBF=m
-CONFIG_NET_SCH_GRED=m
-CONFIG_NET_SCH_DSMARK=m
-# CONFIG_NET_SCH_NETEM is not set
-CONFIG_NET_SCH_INGRESS=m
-CONFIG_NET_QOS=y
-CONFIG_NET_ESTIMATOR=y
-CONFIG_NET_CLS=y
-# CONFIG_NET_CLS_BASIC is not set
-CONFIG_NET_CLS_TCINDEX=m
-CONFIG_NET_CLS_ROUTE4=m
-CONFIG_NET_CLS_ROUTE=y
-CONFIG_NET_CLS_FW=m
-CONFIG_NET_CLS_U32=m
-# CONFIG_CLS_U32_PERF is not set
-# CONFIG_NET_CLS_IND is not set
-# CONFIG_CLS_U32_MARK is not set
-CONFIG_NET_CLS_RSVP=m
-CONFIG_NET_CLS_RSVP6=m
-# CONFIG_NET_EMATCH is not set
-# CONFIG_NET_CLS_ACT is not set
-CONFIG_NET_CLS_POLICE=y
-
-#
-# Network testing
-#
-CONFIG_NET_PKTGEN=m
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=y
 # CONFIG_BONDING is not set
 # CONFIG_EQUALIZER is not set
 # CONFIG_TUN is not set
-# CONFIG_ETHERTAP is not set
 
 #
 # ARCnet devices
@@ -627,6 +657,11 @@ CONFIG_DUMMY=y
 # CONFIG_ARCNET is not set
 
 #
+# PHY device support
+#
+# CONFIG_PHYLIB is not set
+
+#
 # Ethernet (10 or 100Mbit)
 #
 CONFIG_NET_ETHERNET=y
@@ -635,6 +670,7 @@ CONFIG_MII=y
 # CONFIG_SUNGEM is not set
 # CONFIG_NET_VENDOR_3COM is not set
 # CONFIG_SMC91X is not set
+# CONFIG_DM9000 is not set
 
 #
 # Tulip family network device support
@@ -671,13 +707,17 @@ CONFIG_EEPRO100=y
 # CONFIG_HAMACHI is not set
 # CONFIG_YELLOWFIN is not set
 # CONFIG_R8169 is not set
+# CONFIG_SIS190 is not set
+# CONFIG_SKGE is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 # CONFIG_TIGON3 is not set
+# CONFIG_BNX2 is not set
 
 #
 # Ethernet (10000 Mbit)
 #
+# CONFIG_CHELSIO_T1 is not set
 # CONFIG_IXGB is not set
 # CONFIG_S2IO is not set
 
@@ -702,6 +742,7 @@ CONFIG_NET_RADIO=y
 CONFIG_HERMES=y
 # CONFIG_PLX_HERMES is not set
 # CONFIG_TMD_HERMES is not set
+# CONFIG_NORTEL_HERMES is not set
 CONFIG_PCI_HERMES=y
 # CONFIG_ATMEL is not set
 
@@ -709,6 +750,7 @@ CONFIG_PCI_HERMES=y
 # Prism GT/Duette 802.11(a/b/g) PCI/Cardbus support
 #
 # CONFIG_PRISM54 is not set
+# CONFIG_HOSTAP is not set
 CONFIG_NET_WIRELESS=y
 
 #
@@ -758,6 +800,8 @@ CONFIG_ATM_TCP=m
 # CONFIG_SLIP is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
 
 #
 # ISDN subsystem
@@ -795,7 +839,6 @@ CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
 #
 # CONFIG_SERIO is not set
 # CONFIG_GAMEPORT is not set
-CONFIG_SOUND_GAMEPORT=y
 
 #
 # Character devices
@@ -816,6 +859,7 @@ CONFIG_SERIAL_8250_NR_UARTS=2
 #
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -882,12 +926,11 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_AMD8111 is not set
 # CONFIG_I2C_I801 is not set
 # CONFIG_I2C_I810 is not set
+# CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_IOP3XX is not set
-# CONFIG_I2C_ISA is not set
 CONFIG_I2C_IXP4XX=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
-# CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
 # CONFIG_SCx200_ACB is not set
@@ -901,14 +944,33 @@ CONFIG_I2C_IXP4XX=y
 # CONFIG_I2C_PCA_ISA is not set
 
 #
-# Hardware Sensors Chip support
+# Miscellaneous I2C Chip support
 #
-CONFIG_I2C_SENSOR=y
+# CONFIG_SENSORS_DS1337 is not set
+# CONFIG_SENSORS_DS1374 is not set
+CONFIG_SENSORS_EEPROM=y
+# CONFIG_SENSORS_PCF8574 is not set
+# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_RTC8564 is not set
+# CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
+
+#
+# Hardware Monitoring support
+#
+CONFIG_HWMON=y
+# CONFIG_HWMON_VID is not set
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
 # CONFIG_SENSORS_ADM1031 is not set
+# CONFIG_SENSORS_ADM9240 is not set
 # CONFIG_SENSORS_ASB100 is not set
+# CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_DS1621 is not set
 # CONFIG_SENSORS_FSCHER is not set
 # CONFIG_SENSORS_FSCPOS is not set
@@ -924,30 +986,26 @@ CONFIG_I2C_SENSOR=y
 # CONFIG_SENSORS_LM85 is not set
 # CONFIG_SENSORS_LM87 is not set
 # CONFIG_SENSORS_LM90 is not set
+# CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_PC87360 is not set
-# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_W83781D is not set
+# CONFIG_SENSORS_W83792D is not set
 # CONFIG_SENSORS_W83L785TS is not set
 # CONFIG_SENSORS_W83627HF is not set
+# CONFIG_SENSORS_W83627EHF is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
-# Other I2C Chip support
+# Misc devices
 #
-CONFIG_SENSORS_EEPROM=y
-# CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
-# CONFIG_I2C_DEBUG_CORE is not set
-# CONFIG_I2C_DEBUG_ALGO is not set
-# CONFIG_I2C_DEBUG_BUS is not set
-# CONFIG_I2C_DEBUG_CHIP is not set
 
 #
-# Misc devices
+# Multimedia Capabilities Port drivers
 #
 
 #
@@ -994,6 +1052,7 @@ CONFIG_EXT2_FS=y
 CONFIG_EXT2_FS_XATTR=y
 CONFIG_EXT2_FS_POSIX_ACL=y
 # CONFIG_EXT2_FS_SECURITY is not set
+# CONFIG_EXT2_FS_XIP is not set
 CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 CONFIG_EXT3_FS_POSIX_ACL=y
@@ -1004,17 +1063,15 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
-
-#
-# XFS support
-#
 # CONFIG_XFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
+# CONFIG_FUSE_FS is not set
 
 #
 # CD-ROM/DVD Filesystems
@@ -1034,12 +1091,10 @@ CONFIG_DNOTIFY=y
 #
 CONFIG_PROC_FS=y
 CONFIG_SYSFS=y
-# CONFIG_DEVFS_FS is not set
-# CONFIG_DEVPTS_FS_XATTR is not set
 CONFIG_TMPFS=y
-# CONFIG_TMPFS_XATTR is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
+# CONFIG_RELAYFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1054,8 +1109,7 @@ CONFIG_RAMFS=y
 # CONFIG_JFFS_FS is not set
 CONFIG_JFFS2_FS=y
 CONFIG_JFFS2_FS_DEBUG=0
-# CONFIG_JFFS2_FS_NAND is not set
-# CONFIG_JFFS2_FS_NOR_ECC is not set
+CONFIG_JFFS2_FS_WRITEBUFFER=y
 # CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
@@ -1072,12 +1126,14 @@ CONFIG_JFFS2_RTIME=y
 #
 CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
+# CONFIG_NFS_V3_ACL is not set
 # CONFIG_NFS_V4 is not set
 # CONFIG_NFS_DIRECTIO is not set
 # CONFIG_NFSD is not set
 CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
+CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_KRB5 is not set
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
@@ -1086,6 +1142,7 @@ CONFIG_SUNRPC=y
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
+# CONFIG_9P_FS is not set
 
 #
 # Partition Types
@@ -1124,6 +1181,7 @@ CONFIG_MSDOS_PARTITION=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_LOG_BUF_SHIFT=14
+CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
 # CONFIG_DEBUG_SPINLOCK is not set
@@ -1158,6 +1216,7 @@ CONFIG_DEBUG_LL=y
 # Library routines
 #
 # CONFIG_CRC_CCITT is not set
+# CONFIG_CRC16 is not set
 CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
 CONFIG_ZLIB_INFLATE=y
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 949ec4427f21..2ad4aa2a1536 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -131,7 +131,7 @@ __syscall_start:
                 .long   sys_wait4
 /* 115 */       .long   sys_swapoff
                 .long   sys_sysinfo
-                .long   sys_ipc
+                .long   sys_ipc_wrapper
                 .long   sys_fsync
                 .long   sys_sigreturn_wrapper
 /* 120 */       .long   sys_clone_wrapper
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 7152bfbee581..93b5e8e5292e 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -537,7 +537,7 @@ ENTRY(__switch_to)
 #ifdef CONFIG_CPU_MPCORE
         clrex
 #else
-        strex   r3, r4, [ip]                    @ Clear exclusive monitor
+        strex   r5, r4, [ip]                    @ Clear exclusive monitor
 #endif
 #endif
 #if defined(CONFIG_CPU_XSCALE) && !defined(CONFIG_IWMMXT)
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index db302c6e5343..81d450ac3fab 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -273,6 +273,10 @@ sys_mbind_wrapper:
                 str     r5, [sp, #4]
                 b       sys_mbind
 
+sys_ipc_wrapper:
+                str     r5, [sp, #4]            @ push sixth arg
+                b       sys_ipc
+
 /*
  * Note: off_4k (r5) is always units of 4K.  If we can't do the requested
  * offset, we return EINVAL.
diff --git a/arch/arm/kernel/io.c b/arch/arm/kernel/io.c
index 6c20c1188b60..1f6822dfae74 100644
--- a/arch/arm/kernel/io.c
+++ b/arch/arm/kernel/io.c
@@ -7,7 +7,7 @@
  * Copy data from IO memory space to "real" memory space.
  * This needs to be optimized.
  */
-void _memcpy_fromio(void *to, void __iomem *from, size_t count)
+void _memcpy_fromio(void *to, const volatile void __iomem *from, size_t count)
 {
         unsigned char *t = to;
         while (count) {
@@ -22,7 +22,7 @@ void _memcpy_fromio(void *to, void __iomem *from, size_t count)
  * Copy data from "real" memory space to IO memory space.
  * This needs to be optimized.
  */
-void _memcpy_toio(void __iomem *to, const void *from, size_t count)
+void _memcpy_toio(volatile void __iomem *to, const void *from, size_t count)
 {
         const unsigned char *f = from;
         while (count) {
@@ -37,7 +37,7 @@ void _memcpy_toio(void __iomem *to, const void *from, size_t count)
  * "memset" on IO memory space.
  * This needs to be optimized.
  */
-void _memset_io(void __iomem *dst, int c, size_t count)
+void _memset_io(volatile void __iomem *dst, int c, size_t count)
 {
         while (count) {
                 count--;
diff --git a/arch/arm/kernel/semaphore.c b/arch/arm/kernel/semaphore.c
index ac423e3e224b..4c31f2923055 100644
--- a/arch/arm/kernel/semaphore.c
+++ b/arch/arm/kernel/semaphore.c
@@ -178,7 +178,7 @@ int __down_trylock(struct semaphore * sem)
  * registers (r0 to r3 and lr), but not ip, as we use it as a return
  * value in some cases..
  */
-asm("   .section .sched.text,\"ax\"             \n\
+asm("   .section .sched.text,\"ax\",%progbits   \n\
         .align  5                               \n\
         .globl  __down_failed                   \n\
 __down_failed:                                  \n\
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 4554c961251c..e7d22dbcb691 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -624,6 +624,9 @@ void __attribute__((noreturn)) __bug(const char *file, int line, void *data)
                 printk(" - extra data = %p", data);
         printk("\n");
         *(int *)0 = 0;
+
+        /* Avoid "noreturn function does return" */
+        for (;;);
 }
 EXPORT_SYMBOL(__bug);
 
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index ad2d66c93a5c..08e58ecd44be 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -23,20 +23,20 @@ SECTIONS
                         *(.init.text)
                         _einittext = .;
                 __proc_info_begin = .;
-                        *(.proc.info)
+                        *(.proc.info.init)
                 __proc_info_end = .;
                 __arch_info_begin = .;
-                        *(.arch.info)
+                        *(.arch.info.init)
                 __arch_info_end = .;
                 __tagtable_begin = .;
-                        *(.taglist)
+                        *(.taglist.init)
                 __tagtable_end = .;
                 . = ALIGN(16);
                 __setup_start = .;
                         *(.init.setup)
                 __setup_end = .;
                 __early_begin = .;
-                        *(__early_param)
+                        *(.early_param.init)
                 __early_end = .;
                 __initcall_start = .;
                         *(.initcall1.init)
diff --git a/arch/arm/mach-clps711x/fortunet.c b/arch/arm/mach-clps711x/fortunet.c
index f83a59761e02..3d88da0c287b 100644
--- a/arch/arm/mach-clps711x/fortunet.c
+++ b/arch/arm/mach-clps711x/fortunet.c
@@ -31,6 +31,8 @@
 
 #include <asm/mach/arch.h>
 
+#include <asm/memory.h>
+
 #include "common.h"
 
 struct meminfo memmap = {
diff --git a/arch/arm/mach-imx/leds-mx1ads.c b/arch/arm/mach-imx/leds-mx1ads.c
index e6399b06e4a4..79236404aec2 100644
--- a/arch/arm/mach-imx/leds-mx1ads.c
+++ b/arch/arm/mach-imx/leds-mx1ads.c
@@ -17,7 +17,6 @@
 #include <asm/system.h>
 #include <asm/io.h>
 #include <asm/leds.h>
-#include <asm/mach-types.h>
 #include "leds.h"
 
 /*
diff --git a/arch/arm/mach-iop3xx/common.c b/arch/arm/mach-iop3xx/common.c
index bda7394ec06c..fdeeef489a73 100644
--- a/arch/arm/mach-iop3xx/common.c
+++ b/arch/arm/mach-iop3xx/common.c
@@ -27,7 +27,6 @@ unsigned long iop3xx_pcibios_min_mem = 0;
 /*
  * Default power-off for EP80219
  */
-#include <asm/mach-types.h>
 
 static inline void ep80219_send_to_pic(__u8 c) {
 }
diff --git a/arch/arm/mach-iop3xx/iop321-time.c b/arch/arm/mach-iop3xx/iop321-time.c
index 0039793b694a..d67ac0e5d438 100644
--- a/arch/arm/mach-iop3xx/iop321-time.c
+++ b/arch/arm/mach-iop3xx/iop321-time.c
@@ -23,7 +23,6 @@
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
-#include <asm/mach-types.h>
 #include <asm/mach/irq.h>
 #include <asm/mach/time.h>
 
diff --git a/arch/arm/mach-iop3xx/iop331-time.c b/arch/arm/mach-iop3xx/iop331-time.c
index 8eddfac7e2b0..3c1f0ebbd636 100644
--- a/arch/arm/mach-iop3xx/iop331-time.c
+++ b/arch/arm/mach-iop3xx/iop331-time.c
@@ -23,7 +23,6 @@
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
-#include <asm/mach-types.h>
 #include <asm/mach/irq.h>
 #include <asm/mach/time.h>
 
diff --git a/arch/arm/mach-iop3xx/iq31244-mm.c b/arch/arm/mach-iop3xx/iq31244-mm.c
index b01042f7de71..55992ab586ba 100644
--- a/arch/arm/mach-iop3xx/iq31244-mm.c
+++ b/arch/arm/mach-iop3xx/iq31244-mm.c
@@ -21,7 +21,6 @@
 #include <asm/page.h>
 
 #include <asm/mach/map.h>
-#include <asm/mach-types.h>
 
 
 /*
diff --git a/arch/arm/mach-iop3xx/iq80321-mm.c b/arch/arm/mach-iop3xx/iq80321-mm.c
index 1580c7ed2b9d..bb3e9e5a9aff 100644
--- a/arch/arm/mach-iop3xx/iq80321-mm.c
+++ b/arch/arm/mach-iop3xx/iq80321-mm.c
@@ -21,7 +21,6 @@
 #include <asm/page.h>
 
 #include <asm/mach/map.h>
-#include <asm/mach-types.h>
 
 
 /*
diff --git a/arch/arm/mach-iop3xx/iq80331-mm.c b/arch/arm/mach-iop3xx/iq80331-mm.c
index ee8c333e115f..129eb49b0670 100644
--- a/arch/arm/mach-iop3xx/iq80331-mm.c
+++ b/arch/arm/mach-iop3xx/iq80331-mm.c
@@ -21,7 +21,6 @@
 #include <asm/page.h>
 
 #include <asm/mach/map.h>
-#include <asm/mach-types.h>
 
 
 /*
diff --git a/arch/arm/mach-iop3xx/iq80332-mm.c b/arch/arm/mach-iop3xx/iq80332-mm.c
index 084afcdfb1eb..2feaf7591f53 100644
--- a/arch/arm/mach-iop3xx/iq80332-mm.c
+++ b/arch/arm/mach-iop3xx/iq80332-mm.c
@@ -21,7 +21,6 @@
 #include <asm/page.h>
 
 #include <asm/mach/map.h>
-#include <asm/mach-types.h>
 
 
 /*
diff --git a/arch/arm/mach-ixp2000/core.c b/arch/arm/mach-ixp2000/core.c
index 74bd2fd602d4..f4d7f1f6ef85 100644
--- a/arch/arm/mach-ixp2000/core.c
+++ b/arch/arm/mach-ixp2000/core.c
@@ -30,7 +30,6 @@
 #include <asm/setup.h>
 #include <asm/memory.h>
 #include <asm/hardware.h>
-#include <asm/mach-types.h>
 #include <asm/irq.h>
 #include <asm/system.h>
 #include <asm/tlbflush.h>
@@ -168,7 +167,7 @@ static struct plat_serial8250_port ixp2000_serial_port[] = {
 
 static struct resource ixp2000_uart_resource = {
         .start          = IXP2000_UART_PHYS_BASE,
-        .end            = IXP2000_UART_PHYS_BASE + 0xffff,
+        .end            = IXP2000_UART_PHYS_BASE + 0x1f,
         .flags          = IORESOURCE_MEM,
 };
 
diff --git a/arch/arm/mach-ixp2000/pci.c b/arch/arm/mach-ixp2000/pci.c
index 0788fb2b5c10..522205acb316 100644
--- a/arch/arm/mach-ixp2000/pci.c
+++ b/arch/arm/mach-ixp2000/pci.c
@@ -28,7 +28,6 @@
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/system.h>
-#include <asm/mach-types.h>
 #include <asm/hardware.h>
 
 #include <asm/mach/pci.h>
diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c
index 52ad11328e96..36b6045213ee 100644
--- a/arch/arm/mach-ixp4xx/common.c
+++ b/arch/arm/mach-ixp4xx/common.c
@@ -125,7 +125,8 @@ static int ixp4xx_set_irq_type(unsigned int irq, unsigned int type)
         } else if (type & IRQT_LOW) {
                 int_style = IXP4XX_GPIO_STYLE_ACTIVE_LOW;
                 irq_type = IXP4XX_IRQ_LEVEL;
-        }
+        } else
+                return -EINVAL;
 
         ixp4xx_config_irq(irq, irq_type);
 
@@ -142,6 +143,8 @@ static int ixp4xx_set_irq_type(unsigned int irq, unsigned int type)
 
         /* Set the new style */
         *int_reg |= (int_style << (line * IXP4XX_GPIO_STYLE_SIZE));
+
+        return 0;
 }
 
 static void ixp4xx_irq_mask(unsigned int irq)
diff --git a/arch/arm/mach-ixp4xx/ixdp425-setup.c b/arch/arm/mach-ixp4xx/ixdp425-setup.c
index ae1fa099d5fa..0a41080d2266 100644
--- a/arch/arm/mach-ixp4xx/ixdp425-setup.c
+++ b/arch/arm/mach-ixp4xx/ixdp425-setup.c
@@ -123,6 +123,7 @@ static void __init ixdp425_init(void)
         platform_add_devices(ixdp425_devices, ARRAY_SIZE(ixdp425_devices));
 }
 
+#ifdef CONFIG_ARCH_IXDP425
 MACHINE_START(IXDP425, "Intel IXDP425 Development Platform")
         /* Maintainer: MontaVista Software, Inc. */
         .phys_ram       = PHYS_OFFSET,
@@ -134,7 +135,9 @@ MACHINE_START(IXDP425, "Intel IXDP425 Development Platform")
         .boot_params    = 0x0100,
         .init_machine   = ixdp425_init,
 MACHINE_END
+#endif
 
+#ifdef CONFIG_MACH_IXDP465
 MACHINE_START(IXDP465, "Intel IXDP465 Development Platform")
         /* Maintainer: MontaVista Software, Inc. */
         .phys_ram       = PHYS_OFFSET,
@@ -146,7 +149,9 @@ MACHINE_START(IXDP465, "Intel IXDP465 Development Platform")
         .boot_params    = 0x0100,
         .init_machine   = ixdp425_init,
 MACHINE_END
+#endif
 
+#ifdef CONFIG_ARCH_PRPMC1100
 MACHINE_START(IXCDP1100, "Intel IXCDP1100 Development Platform")
         /* Maintainer: MontaVista Software, Inc. */
         .phys_ram       = PHYS_OFFSET,
@@ -158,6 +163,7 @@ MACHINE_START(IXCDP1100, "Intel IXCDP1100 Development Platform")
         .boot_params    = 0x0100,
         .init_machine   = ixdp425_init,
 MACHINE_END
+#endif
 
 /*
  * Avila is functionally equivalent to IXDP425 except that it adds
diff --git a/arch/arm/mach-l7200/core.c b/arch/arm/mach-l7200/core.c
index 2a7fee2a7635..5fd8c9f97f9a 100644
--- a/arch/arm/mach-l7200/core.c
+++ b/arch/arm/mach-l7200/core.c
@@ -12,7 +12,6 @@
 #include <asm/page.h>
 
 #include <asm/mach/map.h>
-#include <asm/arch/hardware.h>
 
 /*
  * IRQ base register
diff --git a/arch/arm/mach-pxa/Kconfig b/arch/arm/mach-pxa/Kconfig
index 405a55f2287c..3e5f69bb5ac4 100644
--- a/arch/arm/mach-pxa/Kconfig
+++ b/arch/arm/mach-pxa/Kconfig
@@ -20,40 +20,66 @@ config ARCH_PXA_IDP
         select PXA25x
 
 config PXA_SHARPSL
-        bool "SHARP SL-5600 and SL-C7xx Models"
-        select PXA25x
+        bool "SHARP Zaurus SL-5600, SL-C7xx and SL-Cxx00 Models"
         select SHARP_SCOOP
         select SHARP_PARAM
         help
           Say Y here if you intend to run this kernel on a
-          Sharp SL-5600 (Poodle), Sharp SL-C700 (Corgi),
-          SL-C750 (Shepherd) or a Sharp SL-C760 (Husky)
-          handheld computer.
+          Sharp Zaurus SL-5600 (Poodle), SL-C700 (Corgi),
+          SL-C750 (Shepherd), SL-C760 (Husky), SL-C1000 (Akita),
+          SL-C3000 (Spitz) or SL-C3100 (Borzoi) handheld computer.
 
 endchoice
 
+if PXA_SHARPSL
+
+choice
+        prompt "Select target Sharp Zaurus device range"
+
+config PXA_SHARPSL_25x
+        bool "Sharp PXA25x models (SL-5600 and SL-C7xx)"
+        select PXA25x
+
+config PXA_SHARPSL_27x
+        bool "Sharp PXA270 models (SL-Cxx00)"
+        select PXA27x
+
+endchoice
+
+endif
+
 endmenu
 
 config MACH_POODLE
         bool "Enable Sharp SL-5600 (Poodle) Support"
-        depends PXA_SHARPSL
+        depends PXA_SHARPSL_25x
         select SHARP_LOCOMO
 
 config MACH_CORGI
         bool "Enable Sharp SL-C700 (Corgi) Support"
-        depends PXA_SHARPSL
+        depends PXA_SHARPSL_25x
         select PXA_SHARP_C7xx
 
 config MACH_SHEPHERD
         bool "Enable Sharp SL-C750 (Shepherd) Support"
-        depends PXA_SHARPSL
+        depends PXA_SHARPSL_25x
         select PXA_SHARP_C7xx
 
 config MACH_HUSKY
         bool "Enable Sharp SL-C760 (Husky) Support"
-        depends PXA_SHARPSL
+        depends PXA_SHARPSL_25x
         select PXA_SHARP_C7xx
 
+config MACH_SPITZ
+        bool "Enable Sharp Zaurus SL-3000 (Spitz) Support"
+        depends PXA_SHARPSL_27x
+        select PXA_SHARP_Cxx00
+
+config MACH_BORZOI
+        bool "Enable Sharp Zaurus SL-3100 (Borzoi) Support"
+        depends PXA_SHARPSL_27x
+        select PXA_SHARP_Cxx00
+
 config PXA25x
         bool
         help
@@ -74,4 +100,9 @@ config PXA_SHARP_C7xx
         help
           Enable support for all Sharp C7xx models
 
+config PXA_SHARP_Cxx00
+        bool
+        help
+          Enable common support for Sharp Cxx00 models
+
 endif
diff --git a/arch/arm/mach-pxa/Makefile b/arch/arm/mach-pxa/Makefile
index 33dae99ec2d8..f609a0f232cb 100644
--- a/arch/arm/mach-pxa/Makefile
+++ b/arch/arm/mach-pxa/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_ARCH_LUBBOCK) += lubbock.o
 obj-$(CONFIG_MACH_MAINSTONE) += mainstone.o
 obj-$(CONFIG_ARCH_PXA_IDP) += idp.o
 obj-$(CONFIG_PXA_SHARP_C7xx)    += corgi.o corgi_ssp.o corgi_lcd.o ssp.o
+obj-$(CONFIG_PXA_SHARP_Cxx00)   += spitz.o corgi_ssp.o corgi_lcd.o ssp.o
 obj-$(CONFIG_MACH_POODLE)       += poodle.o
 
 # Support for blinky lights
diff --git a/arch/arm/mach-pxa/corgi.c b/arch/arm/mach-pxa/corgi.c
index 07b5dd453565..be37586cb1b0 100644
--- a/arch/arm/mach-pxa/corgi.c
+++ b/arch/arm/mach-pxa/corgi.c
@@ -41,6 +41,7 @@
 #include <asm/hardware/scoop.h>
 
 #include "generic.h"
+#include "sharpsl.h"
 
 
 /*
@@ -94,14 +95,30 @@ struct platform_device corgissp_device = {
         .id             = -1,
 };
 
+struct corgissp_machinfo corgi_ssp_machinfo = {
+        .port           = 1,
+        .cs_lcdcon      = CORGI_GPIO_LCDCON_CS,
+        .cs_ads7846     = CORGI_GPIO_ADS7846_CS,
+        .cs_max1111     = CORGI_GPIO_MAX1111_CS,
+        .clk_lcdcon     = 76,
+        .clk_ads7846    = 2,
+        .clk_max1111    = 8,
+};
+
 
 /*
  * Corgi Backlight Device
  */
+static struct corgibl_machinfo corgi_bl_machinfo = {
+        .max_intensity = 0x2f,
+        .set_bl_intensity = corgi_bl_set_intensity,
+};
+
 static struct platform_device corgibl_device = {
         .name           = "corgi-bl",
         .dev            = {
                 .parent = &corgifb_device.dev,
+                .platform_data  = &corgi_bl_machinfo,
         },
         .id             = -1,
 };
@@ -119,12 +136,29 @@ static struct platform_device corgikbd_device = {
 /*
  * Corgi Touch Screen Device
  */
+static struct resource corgits_resources[] = {
+        [0] = {
+                .start          = CORGI_IRQ_GPIO_TP_INT,
+                .end            = CORGI_IRQ_GPIO_TP_INT,
+                .flags          = IORESOURCE_IRQ,
+        },
+};
+
+static struct corgits_machinfo  corgi_ts_machinfo = {
+        .get_hsync_len   = corgi_get_hsync_len,
+        .put_hsync       = corgi_put_hsync,
+        .wait_hsync      = corgi_wait_hsync,
+};
+
 static struct platform_device corgits_device = {
         .name           = "corgi-ts",
         .dev            = {
                 .parent = &corgissp_device.dev,
+                .platform_data  = &corgi_ts_machinfo,
         },
         .id             = -1,
+        .num_resources  = ARRAY_SIZE(corgits_resources),
+        .resource       = corgits_resources,
 };
 
 
@@ -164,13 +198,10 @@ static void corgi_mci_setpower(struct device *dev, unsigned int vdd)
 {
         struct pxamci_platform_data* p_d = dev->platform_data;
 
-        if (( 1 << vdd) & p_d->ocr_mask) {
-                printk(KERN_DEBUG "%s: on\n", __FUNCTION__);
+        if (( 1 << vdd) & p_d->ocr_mask)
                 GPSR1 = GPIO_bit(CORGI_GPIO_SD_PWR);
-        } else {
-                printk(KERN_DEBUG "%s: off\n", __FUNCTION__);
+        else
                 GPCR1 = GPIO_bit(CORGI_GPIO_SD_PWR);
-        }
 }
 
 static int corgi_mci_get_ro(struct device *dev)
@@ -225,7 +256,20 @@ static struct platform_device *devices[] __initdata = {
 
 static void __init corgi_init(void)
 {
+        /* setup sleep mode values */
+        PWER  = 0x00000002;
+        PFER  = 0x00000000;
+        PRER  = 0x00000002;
+        PGSR0 = 0x0158C000;
+        PGSR1 = 0x00FF0080;
+        PGSR2 = 0x0001C004;
+        /* Stop 3.6MHz and drive HIGH to PCMCIA and CS */
+        PCFR |= PCFR_OPDE;
+
+        corgi_ssp_set_machinfo(&corgi_ssp_machinfo);
+
         pxa_gpio_mode(CORGI_GPIO_USB_PULLUP | GPIO_OUT);
+        pxa_gpio_mode(CORGI_GPIO_HSYNC | GPIO_IN);
         pxa_set_udc_info(&udc_info);
         pxa_set_mci_info(&corgi_mci_platform_data);
 
@@ -248,42 +292,14 @@ static void __init fixup_corgi(struct machine_desc *desc,
                 mi->bank[0].size = (64*1024*1024);
 }
 
-static void __init corgi_init_irq(void)
-{
-        pxa_init_irq();
-}
-
-static struct map_desc corgi_io_desc[] __initdata = {
-/*    virtual     physical    length      */
-/*      { 0xf1000000, 0x08000000, 0x01000000, MT_DEVICE },*/ /* LCDC (readable for Qt driver) */
-/*      { 0xef700000, 0x10800000, 0x00001000, MT_DEVICE },*/  /* SCOOP */
-        { 0xef800000, 0x00000000, 0x00800000, MT_DEVICE }, /* Boot Flash */
-};
-
-static void __init corgi_map_io(void)
-{
-        pxa_map_io();
-        iotable_init(corgi_io_desc,ARRAY_SIZE(corgi_io_desc));
-
-        /* setup sleep mode values */
-        PWER  = 0x00000002;
-        PFER  = 0x00000000;
-        PRER  = 0x00000002;
-        PGSR0 = 0x0158C000;
-        PGSR1 = 0x00FF0080;
-        PGSR2 = 0x0001C004;
-        /* Stop 3.6MHz and drive HIGH to PCMCIA and CS */
-        PCFR |= PCFR_OPDE;
-}
-
 #ifdef CONFIG_MACH_CORGI
 MACHINE_START(CORGI, "SHARP Corgi")
         .phys_ram       = 0xa0000000,
         .phys_io        = 0x40000000,
         .io_pg_offst    = (io_p2v(0x40000000) >> 18) & 0xfffc,
         .fixup          = fixup_corgi,
-        .map_io         = corgi_map_io,
-        .init_irq       = corgi_init_irq,
+        .map_io         = pxa_map_io,
+        .init_irq       = pxa_init_irq,
         .init_machine   = corgi_init,
         .timer          = &pxa_timer,
 MACHINE_END
@@ -295,8 +311,8 @@ MACHINE_START(SHEPHERD, "SHARP Shepherd")
         .phys_io        = 0x40000000,
         .io_pg_offst    = (io_p2v(0x40000000) >> 18) & 0xfffc,
         .fixup          = fixup_corgi,
-        .map_io         = corgi_map_io,
-        .init_irq       = corgi_init_irq,
+        .map_io         = pxa_map_io,
+        .init_irq       = pxa_init_irq,
         .init_machine   = corgi_init,
         .timer          = &pxa_timer,
 MACHINE_END
@@ -308,8 +324,8 @@ MACHINE_START(HUSKY, "SHARP Husky")
         .phys_io        = 0x40000000,
         .io_pg_offst    = (io_p2v(0x40000000) >> 18) & 0xfffc,
         .fixup          = fixup_corgi,
-        .map_io         = corgi_map_io,
-        .init_irq       = corgi_init_irq,
+        .map_io         = pxa_map_io,
+        .init_irq       = pxa_init_irq,
         .init_machine   = corgi_init,
         .timer          = &pxa_timer,
 MACHINE_END
diff --git a/arch/arm/mach-pxa/corgi_lcd.c b/arch/arm/mach-pxa/corgi_lcd.c
index deac29c00290..c02ef7c0f7ef 100644
--- a/arch/arm/mach-pxa/corgi_lcd.c
+++ b/arch/arm/mach-pxa/corgi_lcd.c
@@ -1,10 +1,14 @@
 /*
  * linux/drivers/video/w100fb.c
  *
- * Corgi LCD Specific Code for ATI Imageon w100 (Wallaby)
+ * Corgi/Spitz LCD Specific Code
  *
  * Copyright (C) 2005 Richard Purdie
  *
+ * Connectivity:
+ *   Corgi - LCD to ATI Imageon w100 (Wallaby)
+ *   Spitz - LCD to PXA Framebuffer
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
@@ -14,9 +18,16 @@
 #include <linux/delay.h>
 #include <linux/kernel.h>
 #include <linux/device.h>
+#include <linux/module.h>
+#include <asm/arch/akita.h>
 #include <asm/arch/corgi.h>
+#include <asm/arch/hardware.h>
+#include <asm/arch/pxa-regs.h>
+#include <asm/arch/sharpsl.h>
+#include <asm/arch/spitz.h>
+#include <asm/hardware/scoop.h>
 #include <asm/mach/sharpsl_param.h>
-#include <video/w100fb.h>
+#include "generic.h"
 
 /* Register Addresses */
 #define RESCTL_ADRS     0x00
@@ -134,10 +145,10 @@ static void lcdtg_set_common_voltage(u8 base_data, u8 data)
 }
 
 /* Set Phase Adjuct */
-static void lcdtg_set_phadadj(struct w100fb_par *par)
+static void lcdtg_set_phadadj(int mode)
 {
         int adj;
-        switch(par->xres) {
+        switch(mode) {
                 case 480:
                 case 640:
                         /* Setting for VGA */
@@ -161,7 +172,7 @@ static void lcdtg_set_phadadj(struct w100fb_par *par)
 
 static int lcd_inited;
 
-static void lcdtg_hw_init(struct w100fb_par *par)
+static void lcdtg_hw_init(int mode)
 {
         if (!lcd_inited) {
                 int comadj;
@@ -215,7 +226,7 @@ static void lcdtg_hw_init(struct w100fb_par *par)
                 corgi_ssp_lcdtg_send(PICTRL_ADRS, 0);
 
                 /* Set Phase Adjuct */
-                lcdtg_set_phadadj(par);
+                lcdtg_set_phadadj(mode);
 
                 /* Initialize for Input Signals from ATI */
                 corgi_ssp_lcdtg_send(POLCTRL_ADRS, POLCTRL_SYNC_POL_RISE | POLCTRL_EN_POL_RISE
@@ -224,10 +235,10 @@ static void lcdtg_hw_init(struct w100fb_par *par)
 
                 lcd_inited=1;
         } else {
-                lcdtg_set_phadadj(par);
+                lcdtg_set_phadadj(mode);
         }
 
-        switch(par->xres) {
+        switch(mode) {
                 case 480:
                 case 640:
                         /* Set Lcd Resolution (VGA) */
@@ -242,7 +253,7 @@ static void lcdtg_hw_init(struct w100fb_par *par)
         }
 }
 
-static void lcdtg_suspend(struct w100fb_par *par)
+static void lcdtg_suspend(void)
 {
         /* 60Hz x 2 frame = 16.7msec x 2 = 33.4 msec */
         mdelay(34);
@@ -276,15 +287,30 @@ static void lcdtg_suspend(struct w100fb_par *par)
         lcd_inited = 0;
 }
 
-static struct w100_tg_info corgi_lcdtg_info = {
-        .change=lcdtg_hw_init,
-        .suspend=lcdtg_suspend,
-        .resume=lcdtg_hw_init,
-};
 
 /*
  * Corgi w100 Frame Buffer Device
  */
+#ifdef CONFIG_PXA_SHARP_C7xx
+
+#include <video/w100fb.h>
+
+static void w100_lcdtg_suspend(struct w100fb_par *par)
+{
+        lcdtg_suspend();
+}
+
+static void w100_lcdtg_init(struct w100fb_par *par)
+{
+        lcdtg_hw_init(par->xres);
+}
+
+
+static struct w100_tg_info corgi_lcdtg_info = {
+        .change  = w100_lcdtg_init,
+        .suspend = w100_lcdtg_suspend,
+        .resume  = w100_lcdtg_init,
+};
 
 static struct w100_mem_info corgi_fb_mem = {
         .ext_cntl          = 0x00040003,
@@ -394,3 +420,145 @@ struct platform_device corgifb_device = {
         },
 
 };
+#endif
+
+
+/*
+ * Spitz PXA Frame Buffer Device
+ */
+#ifdef CONFIG_PXA_SHARP_Cxx00
+
+#include <asm/arch/pxafb.h>
+
+void spitz_lcd_power(int on)
+{
+        if (on)
+                lcdtg_hw_init(480);
+        else
+                lcdtg_suspend();
+}
+
+#endif
+
+
+/*
+ * Corgi/Spitz Touchscreen to LCD interface
+ */
+static unsigned long (*get_hsync_time)(struct device *dev);
+
+static void inline sharpsl_wait_sync(int gpio)
+{
+        while((GPLR(gpio) & GPIO_bit(gpio)) == 0);
+        while((GPLR(gpio) & GPIO_bit(gpio)) != 0);
+}
+
+#ifdef CONFIG_PXA_SHARP_C7xx
+unsigned long corgi_get_hsync_len(void)
+{
+        if (!get_hsync_time)
+                get_hsync_time = symbol_get(w100fb_get_hsynclen);
+        if (!get_hsync_time)
+                return 0;
+
+        return get_hsync_time(&corgifb_device.dev);
+}
+
+void corgi_put_hsync(void)
+{
+        if (get_hsync_time)
+                symbol_put(w100fb_get_hsynclen);
+}
+
+void corgi_wait_hsync(void)
+{
+        sharpsl_wait_sync(CORGI_GPIO_HSYNC);
+}
+#endif
+
+#ifdef CONFIG_PXA_SHARP_Cxx00
+unsigned long spitz_get_hsync_len(void)
+{
+        if (!get_hsync_time)
+                get_hsync_time = symbol_get(pxafb_get_hsync_time);
+        if (!get_hsync_time)
+                return 0;
+
+        return pxafb_get_hsync_time(&pxafb_device.dev);
+}
+
+void spitz_put_hsync(void)
+{
+        if (get_hsync_time)
+                symbol_put(pxafb_get_hsync_time);
+}
+
+void spitz_wait_hsync(void)
+{
+        sharpsl_wait_sync(SPITZ_GPIO_HSYNC);
+}
+#endif
+
+/*
+ * Corgi/Spitz Backlight Power
+ */
+#ifdef CONFIG_PXA_SHARP_C7xx
+void corgi_bl_set_intensity(int intensity)
+{
+        if (intensity > 0x10)
+                intensity += 0x10;
+
+        /* Bits 0-4 are accessed via the SSP interface */
+        corgi_ssp_blduty_set(intensity & 0x1f);
+
+        /* Bit 5 is via SCOOP */
+        if (intensity & 0x0020)
+                set_scoop_gpio(&corgiscoop_device.dev, CORGI_SCP_BACKLIGHT_CONT);
+        else
+                reset_scoop_gpio(&corgiscoop_device.dev, CORGI_SCP_BACKLIGHT_CONT);
+}
+#endif
+
+
+#if defined(CONFIG_MACH_SPITZ) || defined(CONFIG_MACH_BORZOI)
+void spitz_bl_set_intensity(int intensity)
+{
+        if (intensity > 0x10)
+                intensity += 0x10;
+
+        /* Bits 0-4 are accessed via the SSP interface */
+        corgi_ssp_blduty_set(intensity & 0x1f);
+
+        /* Bit 5 is via SCOOP */
+        if (intensity & 0x0020)
+                reset_scoop_gpio(&spitzscoop2_device.dev, SPITZ_SCP2_BACKLIGHT_CONT);
+        else
+                set_scoop_gpio(&spitzscoop2_device.dev, SPITZ_SCP2_BACKLIGHT_CONT);
+
+        if (intensity)
+                set_scoop_gpio(&spitzscoop2_device.dev, SPITZ_SCP2_BACKLIGHT_ON);
+        else
+                reset_scoop_gpio(&spitzscoop2_device.dev, SPITZ_SCP2_BACKLIGHT_ON);
+}
+#endif
+
+#ifdef CONFIG_MACH_AKITA
+void akita_bl_set_intensity(int intensity)
+{
+        if (intensity > 0x10)
+                intensity += 0x10;
+
+        /* Bits 0-4 are accessed via the SSP interface */
+        corgi_ssp_blduty_set(intensity & 0x1f);
+
+        /* Bit 5 is via IO-Expander */
+        if (intensity & 0x0020)
+                akita_reset_ioexp(&akitaioexp_device.dev, AKITA_IOEXP_BACKLIGHT_CONT);
+        else
+                akita_set_ioexp(&akitaioexp_device.dev, AKITA_IOEXP_BACKLIGHT_CONT);
+
+        if (intensity)
+                akita_set_ioexp(&akitaioexp_device.dev, AKITA_IOEXP_BACKLIGHT_ON);
+        else
+                akita_reset_ioexp(&akitaioexp_device.dev, AKITA_IOEXP_BACKLIGHT_ON);
+}
+#endif
diff --git a/arch/arm/mach-pxa/corgi_ssp.c b/arch/arm/mach-pxa/corgi_ssp.c
index 366a9bde3d8b..0ef428287055 100644
--- a/arch/arm/mach-pxa/corgi_ssp.c
+++ b/arch/arm/mach-pxa/corgi_ssp.c
@@ -1,7 +1,7 @@
 /*
  *  SSP control code for Sharp Corgi devices
  *
- *  Copyright (c) 2004 Richard Purdie
+ *  Copyright (c) 2004-2005 Richard Purdie
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2 as
@@ -17,14 +17,16 @@
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <asm/hardware.h>
+#include <asm/mach-types.h>
 
 #include <asm/arch/ssp.h>
-#include <asm/arch/corgi.h>
 #include <asm/arch/pxa-regs.h>
+#include "sharpsl.h"
 
 static DEFINE_SPINLOCK(corgi_ssp_lock);
 static struct ssp_dev corgi_ssp_dev;
 static struct ssp_state corgi_ssp_state;
+static struct corgissp_machinfo *ssp_machinfo;
 
 /*
  * There are three devices connected to the SSP interface:
@@ -48,12 +50,12 @@ unsigned long corgi_ssp_ads7846_putget(ulong data)
         unsigned long ret,flag;
 
         spin_lock_irqsave(&corgi_ssp_lock, flag);
-        GPCR0 = GPIO_bit(CORGI_GPIO_ADS7846_CS);
+        GPCR(ssp_machinfo->cs_ads7846) = GPIO_bit(ssp_machinfo->cs_ads7846);
 
         ssp_write_word(&corgi_ssp_dev,data);
         ret = ssp_read_word(&corgi_ssp_dev);
 
-        GPSR0 = GPIO_bit(CORGI_GPIO_ADS7846_CS);
+        GPSR(ssp_machinfo->cs_ads7846) = GPIO_bit(ssp_machinfo->cs_ads7846);
         spin_unlock_irqrestore(&corgi_ssp_lock, flag);
 
         return ret;
@@ -66,12 +68,12 @@ unsigned long corgi_ssp_ads7846_putget(ulong data)
 void corgi_ssp_ads7846_lock(void)
 {
         spin_lock(&corgi_ssp_lock);
-        GPCR0 = GPIO_bit(CORGI_GPIO_ADS7846_CS);
+        GPCR(ssp_machinfo->cs_ads7846) = GPIO_bit(ssp_machinfo->cs_ads7846);
 }
 
 void corgi_ssp_ads7846_unlock(void)
 {
-        GPSR0 = GPIO_bit(CORGI_GPIO_ADS7846_CS);
+        GPSR(ssp_machinfo->cs_ads7846) = GPIO_bit(ssp_machinfo->cs_ads7846);
         spin_unlock(&corgi_ssp_lock);
 }
 
@@ -97,23 +99,27 @@ EXPORT_SYMBOL(corgi_ssp_ads7846_get);
  */
 unsigned long corgi_ssp_dac_put(ulong data)
 {
-        unsigned long flag;
+        unsigned long flag, sscr1 = SSCR1_SPH;
 
         spin_lock_irqsave(&corgi_ssp_lock, flag);
-        GPCR0 = GPIO_bit(CORGI_GPIO_LCDCON_CS);
+
+        if (machine_is_spitz() || machine_is_akita() || machine_is_borzoi())
+                sscr1 = 0;
 
         ssp_disable(&corgi_ssp_dev);
-        ssp_config(&corgi_ssp_dev, (SSCR0_Motorola | (SSCR0_DSS & 0x07 )), SSCR1_SPH, 0, SSCR0_SerClkDiv(76));
+        ssp_config(&corgi_ssp_dev, (SSCR0_Motorola | (SSCR0_DSS & 0x07 )), sscr1, 0, SSCR0_SerClkDiv(ssp_machinfo->clk_lcdcon));
         ssp_enable(&corgi_ssp_dev);
 
+        GPCR(ssp_machinfo->cs_lcdcon) = GPIO_bit(ssp_machinfo->cs_lcdcon);
         ssp_write_word(&corgi_ssp_dev,data);
         /* Read null data back from device to prevent SSP overflow */
         ssp_read_word(&corgi_ssp_dev);
+        GPSR(ssp_machinfo->cs_lcdcon) = GPIO_bit(ssp_machinfo->cs_lcdcon);
 
         ssp_disable(&corgi_ssp_dev);
-        ssp_config(&corgi_ssp_dev, (SSCR0_National | (SSCR0_DSS & 0x0b )), 0, 0, SSCR0_SerClkDiv(2));
+        ssp_config(&corgi_ssp_dev, (SSCR0_National | (SSCR0_DSS & 0x0b )), 0, 0, SSCR0_SerClkDiv(ssp_machinfo->clk_ads7846));
         ssp_enable(&corgi_ssp_dev);
-        GPSR0 = GPIO_bit(CORGI_GPIO_LCDCON_CS);
+
         spin_unlock_irqrestore(&corgi_ssp_lock, flag);
 
         return 0;
@@ -141,9 +147,9 @@ int corgi_ssp_max1111_get(ulong data)
         int voltage,voltage1,voltage2;
 
         spin_lock_irqsave(&corgi_ssp_lock, flag);
-        GPCR0 = GPIO_bit(CORGI_GPIO_MAX1111_CS);
+        GPCR(ssp_machinfo->cs_max1111) = GPIO_bit(ssp_machinfo->cs_max1111);
         ssp_disable(&corgi_ssp_dev);
-        ssp_config(&corgi_ssp_dev, (SSCR0_Motorola | (SSCR0_DSS & 0x07 )), 0, 0, SSCR0_SerClkDiv(8));
+        ssp_config(&corgi_ssp_dev, (SSCR0_Motorola | (SSCR0_DSS & 0x07 )), 0, 0, SSCR0_SerClkDiv(ssp_machinfo->clk_max1111));
         ssp_enable(&corgi_ssp_dev);
 
         udelay(1);
@@ -161,9 +167,9 @@ int corgi_ssp_max1111_get(ulong data)
         voltage2=ssp_read_word(&corgi_ssp_dev);
 
         ssp_disable(&corgi_ssp_dev);
-        ssp_config(&corgi_ssp_dev, (SSCR0_National | (SSCR0_DSS & 0x0b )), 0, 0, SSCR0_SerClkDiv(2));
+        ssp_config(&corgi_ssp_dev, (SSCR0_National | (SSCR0_DSS & 0x0b )), 0, 0, SSCR0_SerClkDiv(ssp_machinfo->clk_ads7846));
         ssp_enable(&corgi_ssp_dev);
-        GPSR0 = GPIO_bit(CORGI_GPIO_MAX1111_CS);
+        GPSR(ssp_machinfo->cs_max1111) = GPIO_bit(ssp_machinfo->cs_max1111);
         spin_unlock_irqrestore(&corgi_ssp_lock, flag);
 
         if (voltage1 & 0xc0 || voltage2 & 0x3f)
@@ -179,25 +185,31 @@ EXPORT_SYMBOL(corgi_ssp_max1111_get);
 /*
  *  Support Routines
  */
-int __init corgi_ssp_probe(struct device *dev)
+
+void __init corgi_ssp_set_machinfo(struct corgissp_machinfo *machinfo)
+{
+        ssp_machinfo = machinfo;
+}
+
+static int __init corgi_ssp_probe(struct device *dev)
 {
         int ret;
 
         /* Chip Select - Disable All */
-        GPDR0 |= GPIO_bit(CORGI_GPIO_LCDCON_CS); /* output */
-        GPSR0 = GPIO_bit(CORGI_GPIO_LCDCON_CS);  /* High - Disable LCD Control/Timing Gen */
-        GPDR0 |= GPIO_bit(CORGI_GPIO_MAX1111_CS); /* output */
-        GPSR0 = GPIO_bit(CORGI_GPIO_MAX1111_CS);  /* High - Disable MAX1111*/
-        GPDR0 |= GPIO_bit(CORGI_GPIO_ADS7846_CS);  /* output */
-        GPSR0 = GPIO_bit(CORGI_GPIO_ADS7846_CS);   /* High - Disable ADS7846*/
+        GPDR(ssp_machinfo->cs_lcdcon) |= GPIO_bit(ssp_machinfo->cs_lcdcon); /* output */
+        GPSR(ssp_machinfo->cs_lcdcon) = GPIO_bit(ssp_machinfo->cs_lcdcon);  /* High - Disable LCD Control/Timing Gen */
+        GPDR(ssp_machinfo->cs_max1111) |= GPIO_bit(ssp_machinfo->cs_max1111); /* output */
+        GPSR(ssp_machinfo->cs_max1111) = GPIO_bit(ssp_machinfo->cs_max1111);  /* High - Disable MAX1111*/
+        GPDR(ssp_machinfo->cs_ads7846) |= GPIO_bit(ssp_machinfo->cs_ads7846);  /* output */
+        GPSR(ssp_machinfo->cs_ads7846) = GPIO_bit(ssp_machinfo->cs_ads7846);   /* High - Disable ADS7846*/
 
-        ret=ssp_init(&corgi_ssp_dev,1);
+        ret = ssp_init(&corgi_ssp_dev,ssp_machinfo->port);
 
         if (ret)
                 printk(KERN_ERR "Unable to register SSP handler!\n");
         else {
                 ssp_disable(&corgi_ssp_dev);
-                ssp_config(&corgi_ssp_dev, (SSCR0_National | (SSCR0_DSS & 0x0b )), 0, 0, SSCR0_SerClkDiv(2));
+                ssp_config(&corgi_ssp_dev, (SSCR0_National | (SSCR0_DSS & 0x0b )), 0, 0, SSCR0_SerClkDiv(ssp_machinfo->clk_ads7846));
                 ssp_enable(&corgi_ssp_dev);
         }
 
@@ -222,9 +234,9 @@ static int corgi_ssp_suspend(struct device *dev, pm_message_t state, u32 level)
 static int corgi_ssp_resume(struct device *dev, u32 level)
 {
         if (level == RESUME_POWER_ON) {
-                GPSR0 = GPIO_bit(CORGI_GPIO_LCDCON_CS);  /* High - Disable LCD Control/Timing Gen */
-                GPSR0 = GPIO_bit(CORGI_GPIO_MAX1111_CS); /* High - Disable MAX1111*/
-                GPSR0 = GPIO_bit(CORGI_GPIO_ADS7846_CS); /* High - Disable ADS7846*/
+                GPSR(ssp_machinfo->cs_lcdcon) = GPIO_bit(ssp_machinfo->cs_lcdcon);  /* High - Disable LCD Control/Timing Gen */
+                GPSR(ssp_machinfo->cs_max1111) = GPIO_bit(ssp_machinfo->cs_max1111); /* High - Disable MAX1111*/
+                GPSR(ssp_machinfo->cs_ads7846) = GPIO_bit(ssp_machinfo->cs_ads7846); /* High - Disable ADS7846*/
                 ssp_restore_state(&corgi_ssp_dev,&corgi_ssp_state);
                 ssp_enable(&corgi_ssp_dev);
         }
diff --git a/arch/arm/mach-pxa/generic.c b/arch/arm/mach-pxa/generic.c
index a45aaa115a76..d0660a8c4b70 100644
--- a/arch/arm/mach-pxa/generic.c
+++ b/arch/arm/mach-pxa/generic.c
@@ -34,6 +34,7 @@
 #include <asm/arch/udc.h>
 #include <asm/arch/pxafb.h>
 #include <asm/arch/mmc.h>
+#include <asm/arch/i2c.h>
 
 #include "generic.h"
 
diff --git a/arch/arm/mach-pxa/lubbock.c b/arch/arm/mach-pxa/lubbock.c
index 923f6eb774c0..1f38033921e9 100644
--- a/arch/arm/mach-pxa/lubbock.c
+++ b/arch/arm/mach-pxa/lubbock.c
@@ -146,6 +146,11 @@ static struct pxa2xx_udc_mach_info udc_info __initdata = {
         // no D+ pullup; lubbock can't connect/disconnect in software
 };
 
+static struct platform_device lub_audio_device = {
+        .name           = "pxa2xx-ac97",
+        .id             = -1,
+};
+
 static struct resource sa1111_resources[] = {
         [0] = {
                 .start  = 0x10000000,
@@ -195,6 +200,7 @@ static struct platform_device smc91x_device = {
 
 static struct platform_device *devices[] __initdata = {
         &sa1111_device,
+        &lub_audio_device,
         &smc91x_device,
 };
 
diff --git a/arch/arm/mach-pxa/poodle.c b/arch/arm/mach-pxa/poodle.c
index 47cfb8bb8318..f25638810017 100644
--- a/arch/arm/mach-pxa/poodle.c
+++ b/arch/arm/mach-pxa/poodle.c
@@ -30,6 +30,8 @@
 
 #include <asm/arch/pxa-regs.h>
 #include <asm/arch/irq.h>
+#include <asm/arch/mmc.h>
+#include <asm/arch/udc.h>
 #include <asm/arch/poodle.h>
 #include <asm/arch/pxafb.h>
 
@@ -93,6 +95,83 @@ static struct platform_device locomo_device = {
         .resource       = locomo_resources,
 };
 
+
+/*
+ * MMC/SD Device
+ *
+ * The card detect interrupt isn't debounced so we delay it by 250ms
+ * to give the card a chance to fully insert/eject.
+ */
+static struct pxamci_platform_data poodle_mci_platform_data;
+
+static int poodle_mci_init(struct device *dev, irqreturn_t (*poodle_detect_int)(int, void *, struct pt_regs *), void *data)
+{
+        int err;
+
+        /* setup GPIO for PXA25x MMC controller */
+        pxa_gpio_mode(GPIO6_MMCCLK_MD);
+        pxa_gpio_mode(GPIO8_MMCCS0_MD);
+        pxa_gpio_mode(POODLE_GPIO_nSD_DETECT | GPIO_IN);
+        pxa_gpio_mode(POODLE_GPIO_SD_PWR | GPIO_OUT);
+
+        poodle_mci_platform_data.detect_delay = msecs_to_jiffies(250);
+
+        err = request_irq(POODLE_IRQ_GPIO_nSD_DETECT, poodle_detect_int, SA_INTERRUPT,
+                             "MMC card detect", data);
+        if (err) {
+                printk(KERN_ERR "poodle_mci_init: MMC/SD: can't request MMC card detect IRQ\n");
+                return -1;
+        }
+
+        set_irq_type(POODLE_IRQ_GPIO_nSD_DETECT, IRQT_BOTHEDGE);
+
+        return 0;
+}
+
+static void poodle_mci_setpower(struct device *dev, unsigned int vdd)
+{
+        struct pxamci_platform_data* p_d = dev->platform_data;
+
+        if (( 1 << vdd) & p_d->ocr_mask)
+                GPSR1 = GPIO_bit(POODLE_GPIO_SD_PWR);
+        else
+                GPCR1 = GPIO_bit(POODLE_GPIO_SD_PWR);
+}
+
+static void poodle_mci_exit(struct device *dev, void *data)
+{
+        free_irq(POODLE_IRQ_GPIO_nSD_DETECT, data);
+}
+
+static struct pxamci_platform_data poodle_mci_platform_data = {
+        .ocr_mask       = MMC_VDD_32_33|MMC_VDD_33_34,
+        .init           = poodle_mci_init,
+        .setpower       = poodle_mci_setpower,
+        .exit           = poodle_mci_exit,
+};
+
+
+/*
+ * USB Device Controller
+ */
+static void poodle_udc_command(int cmd)
+{
+        switch(cmd)     {
+        case PXA2XX_UDC_CMD_CONNECT:
+                GPSR(POODLE_GPIO_USB_PULLUP) = GPIO_bit(POODLE_GPIO_USB_PULLUP);
+                break;
+        case PXA2XX_UDC_CMD_DISCONNECT:
+                GPCR(POODLE_GPIO_USB_PULLUP) = GPIO_bit(POODLE_GPIO_USB_PULLUP);
+                break;
+        }
+}
+
+static struct pxa2xx_udc_mach_info udc_info __initdata = {
+        /* no connect GPIO; poodle can't tell connection status */
+        .udc_command            = poodle_udc_command,
+};
+
+
 /* PXAFB device */
 static struct pxafb_mach_info poodle_fb_info __initdata = {
         .pixclock       = 144700,
@@ -126,6 +205,15 @@ static void __init poodle_init(void)
 {
         int ret = 0;
 
+        /* setup sleep mode values */
+        PWER  = 0x00000002;
+        PFER  = 0x00000000;
+        PRER  = 0x00000002;
+        PGSR0 = 0x00008000;
+        PGSR1 = 0x003F0202;
+        PGSR2 = 0x0001C000;
+        PCFR |= PCFR_OPDE;
+
         /* cpu initialize */
         /* Pgsr Register */
         PGSR0 = 0x0146dd80;
@@ -155,6 +243,9 @@ static void __init poodle_init(void)
         GPSR2 = 0x00000000;
 
         set_pxa_fb_info(&poodle_fb_info);
+        pxa_gpio_mode(POODLE_GPIO_USB_PULLUP | GPIO_OUT);
+        pxa_set_udc_info(&udc_info);
+        pxa_set_mci_info(&poodle_mci_platform_data);
 
         scoop_num = 1;
         scoop_devs = &poodle_pcmcia_scoop[0];
@@ -171,32 +262,12 @@ static void __init fixup_poodle(struct machine_desc *desc,
         sharpsl_save_param();
 }
 
-static struct map_desc poodle_io_desc[] __initdata = {
- /* virtual     physical    length                   */
-  { 0xef800000, 0x00000000, 0x00800000, MT_DEVICE }, /* Boot Flash */
-};
-
-static void __init poodle_map_io(void)
-{
-        pxa_map_io();
-        iotable_init(poodle_io_desc, ARRAY_SIZE(poodle_io_desc));
-
-        /* setup sleep mode values */
-        PWER  = 0x00000002;
-        PFER  = 0x00000000;
-        PRER  = 0x00000002;
-        PGSR0 = 0x00008000;
-        PGSR1 = 0x003F0202;
-        PGSR2 = 0x0001C000;
-        PCFR |= PCFR_OPDE;
-}
-
 MACHINE_START(POODLE, "SHARP Poodle")
         .phys_ram       = 0xa0000000,
         .phys_io        = 0x40000000,
         .io_pg_offst    = (io_p2v(0x40000000) >> 18) & 0xfffc,
         .fixup          = fixup_poodle,
-        .map_io         = poodle_map_io,
+        .map_io         = pxa_map_io,
         .init_irq       = pxa_init_irq,
         .timer          = &pxa_timer,
         .init_machine   = poodle_init,
diff --git a/arch/arm/mach-pxa/sharpsl.h b/arch/arm/mach-pxa/sharpsl.h
new file mode 100644
index 000000000000..3977a77aacdd
--- /dev/null
+++ b/arch/arm/mach-pxa/sharpsl.h
@@ -0,0 +1,34 @@
+/*
+ * SharpSL SSP Driver
+ */
+
+struct corgissp_machinfo {
+        int port;
+        int cs_lcdcon;
+        int cs_ads7846;
+        int cs_max1111;
+        int clk_lcdcon;
+        int clk_ads7846;
+        int clk_max1111;
+};
+
+void corgi_ssp_set_machinfo(struct corgissp_machinfo *machinfo);
+
+/*
+ * SharpSL Backlight
+ */
+
+void corgi_bl_set_intensity(int intensity);
+void spitz_bl_set_intensity(int intensity);
+void akita_bl_set_intensity(int intensity);
+
+/*
+ * SharpSL Touchscreen Driver
+ */
+
+unsigned long corgi_get_hsync_len(void);
+unsigned long spitz_get_hsync_len(void);
+void corgi_put_hsync(void);
+void spitz_put_hsync(void);
+void corgi_wait_hsync(void);
+void spitz_wait_hsync(void);
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
new file mode 100644
index 000000000000..568afe3d6e1a
--- /dev/null
+++ b/arch/arm/mach-pxa/spitz.c
@@ -0,0 +1,380 @@
+/*
+ * Support for Sharp SL-Cxx00 Series of PDAs
+ * Models: SL-C3000 (Spitz), SL-C1000 (Akita) and SL-C3100 (Borzoi)
+ *
+ * Copyright (c) 2005 Richard Purdie
+ *
+ * Based on Sharp's 2.4 kernel patches/lubbock.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/major.h>
+#include <linux/fs.h>
+#include <linux/interrupt.h>
+#include <linux/mmc/host.h>
+
+#include <asm/setup.h>
+#include <asm/memory.h>
+#include <asm/mach-types.h>
+#include <asm/hardware.h>
+#include <asm/irq.h>
+#include <asm/io.h>
+
+#include <asm/mach/arch.h>
+#include <asm/mach/map.h>
+#include <asm/mach/irq.h>
+
+#include <asm/arch/pxa-regs.h>
+#include <asm/arch/irq.h>
+#include <asm/arch/mmc.h>
+#include <asm/arch/udc.h>
+#include <asm/arch/ohci.h>
+#include <asm/arch/pxafb.h>
+#include <asm/arch/akita.h>
+#include <asm/arch/spitz.h>
+#include <asm/arch/sharpsl.h>
+
+#include <asm/mach/sharpsl_param.h>
+#include <asm/hardware/scoop.h>
+
+#include "generic.h"
+#include "sharpsl.h"
+
+/*
+ * Spitz SCOOP Device #1
+ */
+static struct resource spitz_scoop_resources[] = {
+        [0] = {
+                .start          = 0x10800000,
+                .end            = 0x10800fff,
+                .flags          = IORESOURCE_MEM,
+        },
+};
+
+static struct scoop_config spitz_scoop_setup = {
+        .io_dir         = SPITZ_SCP_IO_DIR,
+        .io_out         = SPITZ_SCP_IO_OUT,
+        .suspend_clr = SPITZ_SCP_SUS_CLR,
+        .suspend_set = SPITZ_SCP_SUS_SET,
+};
+
+struct platform_device spitzscoop_device = {
+        .name           = "sharp-scoop",
+        .id             = 0,
+        .dev            = {
+                .platform_data  = &spitz_scoop_setup,
+        },
+        .num_resources  = ARRAY_SIZE(spitz_scoop_resources),
+        .resource       = spitz_scoop_resources,
+};
+
+/*
+ * Spitz SCOOP Device #2
+ */
+static struct resource spitz_scoop2_resources[] = {
+        [0] = {
+                .start          = 0x08800040,
+                .end            = 0x08800fff,
+                .flags          = IORESOURCE_MEM,
+        },
+};
+
+static struct scoop_config spitz_scoop2_setup = {
+        .io_dir         = SPITZ_SCP2_IO_DIR,
+        .io_out         = SPITZ_SCP2_IO_OUT,
+        .suspend_clr = SPITZ_SCP2_SUS_CLR,
+        .suspend_set = SPITZ_SCP2_SUS_SET,
+};
+
+struct platform_device spitzscoop2_device = {
+        .name           = "sharp-scoop",
+        .id             = 1,
+        .dev            = {
+                .platform_data  = &spitz_scoop2_setup,
+        },
+        .num_resources  = ARRAY_SIZE(spitz_scoop2_resources),
+        .resource       = spitz_scoop2_resources,
+};
+
+static struct scoop_pcmcia_dev spitz_pcmcia_scoop[] = {
+{
+        .dev        = &spitzscoop_device.dev,
+        .irq        = SPITZ_IRQ_GPIO_CF_IRQ,
+        .cd_irq     = SPITZ_IRQ_GPIO_CF_CD,
+        .cd_irq_str = "PCMCIA0 CD",
+},{
+        .dev        = &spitzscoop2_device.dev,
+        .irq        = SPITZ_IRQ_GPIO_CF2_IRQ,
+        .cd_irq     = -1,
+},
+};
+
+
+/*
+ * Spitz SSP Device
+ *
+ * Set the parent as the scoop device because a lot of SSP devices
+ * also use scoop functions and this makes the power up/down order
+ * work correctly.
+ */
+struct platform_device spitzssp_device = {
+        .name           = "corgi-ssp",
+        .dev            = {
+                .parent = &spitzscoop_device.dev,
+        },
+        .id             = -1,
+};
+
+struct corgissp_machinfo spitz_ssp_machinfo = {
+        .port           = 2,
+        .cs_lcdcon      = SPITZ_GPIO_LCDCON_CS,
+        .cs_ads7846     = SPITZ_GPIO_ADS7846_CS,
+        .cs_max1111     = SPITZ_GPIO_MAX1111_CS,
+        .clk_lcdcon     = 520,
+        .clk_ads7846    = 14,
+        .clk_max1111    = 56,
+};
+
+
+/*
+ * Spitz Backlight Device
+ */
+static struct corgibl_machinfo spitz_bl_machinfo = {
+        .max_intensity = 0x2f,
+};
+
+static struct platform_device spitzbl_device = {
+        .name           = "corgi-bl",
+        .dev            = {
+                .platform_data  = &spitz_bl_machinfo,
+        },
+        .id             = -1,
+};
+
+
+/*
+ * Spitz Keyboard Device
+ */
+static struct platform_device spitzkbd_device = {
+        .name           = "spitz-keyboard",
+        .id             = -1,
+};
+
+
+/*
+ * Spitz Touch Screen Device
+ */
+static struct resource spitzts_resources[] = {
+        [0] = {
+                .start          = SPITZ_IRQ_GPIO_TP_INT,
+                .end            = SPITZ_IRQ_GPIO_TP_INT,
+                .flags          = IORESOURCE_IRQ,
+        },
+};
+
+static struct corgits_machinfo  spitz_ts_machinfo = {
+        .get_hsync_len   = spitz_get_hsync_len,
+        .put_hsync       = spitz_put_hsync,
+        .wait_hsync      = spitz_wait_hsync,
+};
+
+static struct platform_device spitzts_device = {
+        .name           = "corgi-ts",
+        .dev            = {
+                .parent = &spitzssp_device.dev,
+                .platform_data  = &spitz_ts_machinfo,
+        },
+        .id             = -1,
+        .num_resources  = ARRAY_SIZE(spitzts_resources),
+        .resource       = spitzts_resources,
+};
+
+
+/*
+ * MMC/SD Device
+ *
+ * The card detect interrupt isn't debounced so we delay it by 250ms
+ * to give the card a chance to fully insert/eject.
+ */
+
+static struct pxamci_platform_data spitz_mci_platform_data;
+
+static int spitz_mci_init(struct device *dev, irqreturn_t (*spitz_detect_int)(int, void *, struct pt_regs *), void *data)
+{
+        int err;
+
+        /* setup GPIO for PXA27x MMC controller */
+        pxa_gpio_mode(GPIO32_MMCCLK_MD);
+        pxa_gpio_mode(GPIO112_MMCCMD_MD);
+        pxa_gpio_mode(GPIO92_MMCDAT0_MD);
+        pxa_gpio_mode(GPIO109_MMCDAT1_MD);
+        pxa_gpio_mode(GPIO110_MMCDAT2_MD);
+        pxa_gpio_mode(GPIO111_MMCDAT3_MD);
+        pxa_gpio_mode(SPITZ_GPIO_nSD_DETECT | GPIO_IN);
+        pxa_gpio_mode(SPITZ_GPIO_nSD_WP | GPIO_IN);
+
+        spitz_mci_platform_data.detect_delay = msecs_to_jiffies(250);
+
+        err = request_irq(SPITZ_IRQ_GPIO_nSD_DETECT, spitz_detect_int, SA_INTERRUPT,
+                             "MMC card detect", data);
+        if (err) {
+                printk(KERN_ERR "spitz_mci_init: MMC/SD: can't request MMC card detect IRQ\n");
+                return -1;
+        }
+
+        set_irq_type(SPITZ_IRQ_GPIO_nSD_DETECT, IRQT_BOTHEDGE);
+
+        return 0;
+}
+
+/* Power control is shared with one of the CF slots so we have a mess */
+static void spitz_mci_setpower(struct device *dev, unsigned int vdd)
+{
+        struct pxamci_platform_data* p_d = dev->platform_data;
+
+        unsigned short cpr = read_scoop_reg(&spitzscoop_device.dev, SCOOP_CPR);
+
+        if (( 1 << vdd) & p_d->ocr_mask) {
+                /* printk(KERN_DEBUG "%s: on\n", __FUNCTION__); */
+                set_scoop_gpio(&spitzscoop_device.dev, SPITZ_SCP_CF_POWER);
+                mdelay(2);
+                write_scoop_reg(&spitzscoop_device.dev, SCOOP_CPR, cpr | 0x04);
+        } else {
+                /* printk(KERN_DEBUG "%s: off\n", __FUNCTION__); */
+                write_scoop_reg(&spitzscoop_device.dev, SCOOP_CPR, cpr & ~0x04);
+
+                if (!(cpr | 0x02)) {
+                        mdelay(1);
+                        reset_scoop_gpio(&spitzscoop_device.dev, SPITZ_SCP_CF_POWER);
+                }
+        }
+}
+
+static int spitz_mci_get_ro(struct device *dev)
+{
+        return GPLR(SPITZ_GPIO_nSD_WP) & GPIO_bit(SPITZ_GPIO_nSD_WP);
+}
+
+static void spitz_mci_exit(struct device *dev, void *data)
+{
+        free_irq(SPITZ_IRQ_GPIO_nSD_DETECT, data);
+}
+
+static struct pxamci_platform_data spitz_mci_platform_data = {
+        .ocr_mask       = MMC_VDD_32_33|MMC_VDD_33_34,
+        .init           = spitz_mci_init,
+        .get_ro         = spitz_mci_get_ro,
+        .setpower       = spitz_mci_setpower,
+        .exit           = spitz_mci_exit,
+};
+
+
+/*
+ * Spitz PXA Framebuffer
+ */
+static struct pxafb_mach_info spitz_pxafb_info __initdata = {
+        .pixclock       = 19231,
+        .xres           = 480,
+        .yres           = 640,
+        .bpp            = 16,
+        .hsync_len      = 40,
+        .left_margin    = 46,
+        .right_margin   = 125,
+        .vsync_len      = 3,
+        .upper_margin   = 1,
+        .lower_margin   = 0,
+        .sync           = 0,
+        .lccr0          = LCCR0_Color | LCCR0_Sngl | LCCR0_Act | LCCR0_LDDALT | LCCR0_OUC | LCCR0_CMDIM | LCCR0_RDSTM,
+        .lccr3          = LCCR3_PixRsEdg | LCCR3_OutEnH,
+        .pxafb_lcd_power = spitz_lcd_power,
+};
+
+
+static struct platform_device *devices[] __initdata = {
+        &spitzscoop_device,
+        &spitzssp_device,
+        &spitzkbd_device,
+        &spitzts_device,
+        &spitzbl_device,
+        &spitzbattery_device,
+};
+
+static void __init common_init(void)
+{
+        PMCR = 0x00;
+
+        /* setup sleep mode values */
+        PWER  = 0x00000002;
+        PFER  = 0x00000000;
+        PRER  = 0x00000002;
+        PGSR0 = 0x0158C000;
+        PGSR1 = 0x00FF0080;
+        PGSR2 = 0x0001C004;
+
+        /* Stop 3.6MHz and drive HIGH to PCMCIA and CS */
+        PCFR |= PCFR_OPDE;
+
+        corgi_ssp_set_machinfo(&spitz_ssp_machinfo);
+
+        pxa_gpio_mode(SPITZ_GPIO_HSYNC | GPIO_IN);
+
+        platform_add_devices(devices, ARRAY_SIZE(devices));
+        pxa_set_mci_info(&spitz_mci_platform_data);
+        pxafb_device.dev.parent = &spitzssp_device.dev;
+        set_pxa_fb_info(&spitz_pxafb_info);
+}
+
+static void __init spitz_init(void)
+{
+        scoop_num = 2;
+        scoop_devs = &spitz_pcmcia_scoop[0];
+        spitz_bl_machinfo.set_bl_intensity = spitz_bl_set_intensity;
+
+        common_init();
+
+        platform_device_register(&spitzscoop2_device);
+}
+
+static void __init fixup_spitz(struct machine_desc *desc,
+                struct tag *tags, char **cmdline, struct meminfo *mi)
+{
+        sharpsl_save_param();
+        mi->nr_banks = 1;
+        mi->bank[0].start = 0xa0000000;
+        mi->bank[0].node = 0;
+        mi->bank[0].size = (64*1024*1024);
+}
+
+#ifdef CONFIG_MACH_SPITZ
+MACHINE_START(SPITZ, "SHARP Spitz")
+        .phys_ram       = 0xa0000000,
+        .phys_io        = 0x40000000,
+        .io_pg_offst    = (io_p2v(0x40000000) >> 18) & 0xfffc,
+        .fixup          = fixup_spitz,
+        .map_io         = pxa_map_io,
+        .init_irq       = pxa_init_irq,
+        .init_machine   = spitz_init,
+        .timer          = &pxa_timer,
+MACHINE_END
+#endif
+
+#ifdef CONFIG_MACH_BORZOI
+MACHINE_START(BORZOI, "SHARP Borzoi")
+        .phys_ram       = 0xa0000000,
+        .phys_io        = 0x40000000,
+        .io_pg_offst    = (io_p2v(0x40000000) >> 18) & 0xfffc,
+        .fixup          = fixup_spitz,
+        .map_io         = pxa_map_io,
+        .init_irq       = pxa_init_irq,
+        .init_machine   = spitz_init,
+        .timer          = &pxa_timer,
+MACHINE_END
+#endif
diff --git a/arch/arm/mach-s3c2410/mach-anubis.c b/arch/arm/mach-s3c2410/mach-anubis.c
index f87aa0b669ad..7c05f27fe1d6 100644
--- a/arch/arm/mach-s3c2410/mach-anubis.c
+++ b/arch/arm/mach-s3c2410/mach-anubis.c
@@ -12,6 +12,7 @@
  *
  * Modifications:
  *      02-May-2005 BJD  Copied from mach-bast.c
+ *      20-Sep-2005 BJD  Added static to non-exported items
 */
 
 #include <linux/kernel.h>
@@ -232,7 +233,7 @@ static struct s3c24xx_board anubis_board __initdata = {
         .clocks_count  = ARRAY_SIZE(anubis_clocks)
 };
 
-void __init anubis_map_io(void)
+static void __init anubis_map_io(void)
 {
         /* initialise the clocks */
 
diff --git a/arch/arm/mach-s3c2410/mach-bast.c b/arch/arm/mach-s3c2410/mach-bast.c
index 1a3367da6408..ed1f07d7252f 100644
--- a/arch/arm/mach-s3c2410/mach-bast.c
+++ b/arch/arm/mach-s3c2410/mach-bast.c
@@ -31,6 +31,7 @@
  *     17-Jul-2005 BJD  Changed to platform device for SuperIO 16550s
  *     25-Jul-2005 BJD  Removed ASIX static mappings
  *     27-Jul-2005 BJD  Ensure maximum frequency of i2c bus
+ *     20-Sep-2005 BJD  Added static to non-exported items
 */
 
 #include <linux/kernel.h>
@@ -428,7 +429,7 @@ static struct s3c24xx_board bast_board __initdata = {
         .clocks_count  = ARRAY_SIZE(bast_clocks)
 };
 
-void __init bast_map_io(void)
+static void __init bast_map_io(void)
 {
         /* initialise the clocks */
 
diff --git a/arch/arm/mach-s3c2410/mach-h1940.c b/arch/arm/mach-s3c2410/mach-h1940.c
index 6ff1889fbd21..fb3cb01266e5 100644
--- a/arch/arm/mach-s3c2410/mach-h1940.c
+++ b/arch/arm/mach-s3c2410/mach-h1940.c
@@ -24,6 +24,7 @@
  *     10-Jan-2005 BJD  Removed include of s3c2410.h
  *     14-Jan-2005 BJD  Added clock init
  *     10-Mar-2005 LCVR Changed S3C2410_VA to S3C24XX_VA
+ *     20-Sep-2005 BJD  Added static to non-exported items
 */
 
 #include <linux/kernel.h>
@@ -147,7 +148,7 @@ static struct s3c24xx_board h1940_board __initdata = {
         .devices_count = ARRAY_SIZE(h1940_devices)
 };
 
-void __init h1940_map_io(void)
+static void __init h1940_map_io(void)
 {
         s3c24xx_init_io(h1940_iodesc, ARRAY_SIZE(h1940_iodesc));
         s3c24xx_init_clocks(0);
@@ -155,13 +156,13 @@ void __init h1940_map_io(void)
         s3c24xx_set_board(&h1940_board);
 }
 
-void __init h1940_init_irq(void)
+static void __init h1940_init_irq(void)
 {
         s3c24xx_init_irq();
 
 }
 
-void __init h1940_init(void)
+static void __init h1940_init(void)
 {
         set_s3c2410fb_info(&h1940_lcdcfg);
 }
diff --git a/arch/arm/mach-s3c2410/mach-n30.c b/arch/arm/mach-s3c2410/mach-n30.c
index 66bf5bb2b3db..5c0f2b091f95 100644
--- a/arch/arm/mach-s3c2410/mach-n30.c
+++ b/arch/arm/mach-s3c2410/mach-n30.c
@@ -97,7 +97,7 @@ static struct s3c24xx_board n30_board __initdata = {
         .devices_count = ARRAY_SIZE(n30_devices)
 };
 
-void __init n30_map_io(void)
+static void __init n30_map_io(void)
 {
         s3c24xx_init_io(n30_iodesc, ARRAY_SIZE(n30_iodesc));
         s3c24xx_init_clocks(0);
@@ -105,14 +105,14 @@ void __init n30_map_io(void)
         s3c24xx_set_board(&n30_board);
 }
 
-void __init n30_init_irq(void)
+static void __init n30_init_irq(void)
 {
         s3c24xx_init_irq();
 }
 
 /* GPB3 is the line that controls the pull-up for the USB D+ line */
 
-void __init n30_init(void)
+static void __init n30_init(void)
 {
         s3c_device_i2c.dev.platform_data = &n30_i2ccfg;
 
diff --git a/arch/arm/mach-s3c2410/mach-nexcoder.c b/arch/arm/mach-s3c2410/mach-nexcoder.c
index d24c242414ca..c22f8216032d 100644
--- a/arch/arm/mach-s3c2410/mach-nexcoder.c
+++ b/arch/arm/mach-s3c2410/mach-nexcoder.c
@@ -136,7 +136,7 @@ static void __init nexcoder_sensorboard_init(void)
         s3c2410_gpio_cfgpin(S3C2410_GPF2, S3C2410_GPF2_OUTP); // CAM_GPIO6 => CAM_PWRDN
 }
 
-void __init nexcoder_map_io(void)
+static void __init nexcoder_map_io(void)
 {
         s3c24xx_init_io(nexcoder_iodesc, ARRAY_SIZE(nexcoder_iodesc));
         s3c24xx_init_clocks(0);
diff --git a/arch/arm/mach-s3c2410/mach-otom.c b/arch/arm/mach-s3c2410/mach-otom.c
index d901ed492ff5..ad1459e402e2 100644
--- a/arch/arm/mach-s3c2410/mach-otom.c
+++ b/arch/arm/mach-s3c2410/mach-otom.c
@@ -105,7 +105,7 @@ static struct s3c24xx_board otom11_board __initdata = {
 };
 
 
-void __init otom11_map_io(void)
+static void __init otom11_map_io(void)
 {
         s3c24xx_init_io(otom11_iodesc, ARRAY_SIZE(otom11_iodesc));
         s3c24xx_init_clocks(0);
diff --git a/arch/arm/mach-s3c2410/mach-rx3715.c b/arch/arm/mach-s3c2410/mach-rx3715.c
index a73d61c1de46..22d9e070fd68 100644
--- a/arch/arm/mach-s3c2410/mach-rx3715.c
+++ b/arch/arm/mach-s3c2410/mach-rx3715.c
@@ -16,6 +16,7 @@
  *      14-Jan-2005 BJD  Added new clock init
  *      10-Mar-2005 LCVR Changed S3C2410_VA to S3C24XX_VA
  *      14-Mar-2005 BJD  Fixed __iomem warnings
+ *      20-Sep-2005 BJD  Added static to non-exported items
 */
 
 #include <linux/kernel.h>
@@ -108,7 +109,7 @@ static struct s3c24xx_board rx3715_board __initdata = {
         .devices_count = ARRAY_SIZE(rx3715_devices)
 };
 
-void __init rx3715_map_io(void)
+static void __init rx3715_map_io(void)
 {
         s3c24xx_init_io(rx3715_iodesc, ARRAY_SIZE(rx3715_iodesc));
         s3c24xx_init_clocks(16934000);
@@ -116,7 +117,7 @@ void __init rx3715_map_io(void)
         s3c24xx_set_board(&rx3715_board);
 }
 
-void __init rx3715_init_irq(void)
+static void __init rx3715_init_irq(void)
 {
         s3c24xx_init_irq();
 }
diff --git a/arch/arm/mach-s3c2410/mach-smdk2410.c b/arch/arm/mach-s3c2410/mach-smdk2410.c
index 67e903a700d3..2eda55a6b678 100644
--- a/arch/arm/mach-s3c2410/mach-smdk2410.c
+++ b/arch/arm/mach-s3c2410/mach-smdk2410.c
@@ -28,6 +28,7 @@
  * Ben Dooks <ben@simtec.co.uk>
  *
  * 10-Mar-2005 LCVR  Changed S3C2410_VA to S3C24XX_VA
+ * 20-Sep-2005 BJD  Added static to non-exported items
  *
  ***********************************************************************/
 
@@ -97,7 +98,7 @@ static struct s3c24xx_board smdk2410_board __initdata = {
         .devices_count = ARRAY_SIZE(smdk2410_devices)
 };
 
-void __init smdk2410_map_io(void)
+static void __init smdk2410_map_io(void)
 {
         s3c24xx_init_io(smdk2410_iodesc, ARRAY_SIZE(smdk2410_iodesc));
         s3c24xx_init_clocks(0);
@@ -105,7 +106,7 @@ void __init smdk2410_map_io(void)
         s3c24xx_set_board(&smdk2410_board);
 }
 
-void __init smdk2410_init_irq(void)
+static void __init smdk2410_init_irq(void)
 {
         s3c24xx_init_irq();
 }
diff --git a/arch/arm/mach-s3c2410/mach-smdk2440.c b/arch/arm/mach-s3c2410/mach-smdk2440.c
index 357522106f68..722ef46b630a 100644
--- a/arch/arm/mach-s3c2410/mach-smdk2440.c
+++ b/arch/arm/mach-s3c2410/mach-smdk2440.c
@@ -18,6 +18,7 @@
  *      22-Feb-2005 BJD   Updated for 2.6.11-rc5 relesa
  *      10-Mar-2005 LCVR  Replaced S3C2410_VA by S3C24XX_VA
  *      14-Mar-2005 BJD   void __iomem fixes
+ *      20-Sep-2005 BJD   Added static to non-exported items
 */
 
 #include <linux/kernel.h>
@@ -98,7 +99,7 @@ static struct s3c24xx_board smdk2440_board __initdata = {
         .devices_count = ARRAY_SIZE(smdk2440_devices)
 };
 
-void __init smdk2440_map_io(void)
+static void __init smdk2440_map_io(void)
 {
         s3c24xx_init_io(smdk2440_iodesc, ARRAY_SIZE(smdk2440_iodesc));
         s3c24xx_init_clocks(16934400);
@@ -106,7 +107,7 @@ void __init smdk2440_map_io(void)
         s3c24xx_set_board(&smdk2440_board);
 }
 
-void __init smdk2440_machine_init(void)
+static void __init smdk2440_machine_init(void)
 {
         /* Configure the LEDs (even if we have no LED support)*/
 
diff --git a/arch/arm/mach-s3c2410/mach-vr1000.c b/arch/arm/mach-s3c2410/mach-vr1000.c
index 8f9ab2893df4..663a7f98fc0b 100644
--- a/arch/arm/mach-s3c2410/mach-vr1000.c
+++ b/arch/arm/mach-s3c2410/mach-vr1000.c
@@ -28,6 +28,7 @@
  *     10-Mar-2005 LCVR Changed S3C2410_VA to S3C24XX_VA
  *     14-Mar-2006 BJD  void __iomem fixes
  *     22-Jun-2006 BJD  Added DM9000 platform information
+ *     20-Sep-2005 BJD  Added static to non-exported items
 */
 
 #include <linux/kernel.h>
@@ -347,7 +348,7 @@ static void vr1000_power_off(void)
         s3c2410_gpio_setpin(S3C2410_GPB9, 1);
 }
 
-void __init vr1000_map_io(void)
+static void __init vr1000_map_io(void)
 {
         /* initialise clock sources */
 
diff --git a/arch/arm/mach-s3c2410/usb-simtec.c b/arch/arm/mach-s3c2410/usb-simtec.c
index f021fd82be52..5098b50158a3 100644
--- a/arch/arm/mach-s3c2410/usb-simtec.c
+++ b/arch/arm/mach-s3c2410/usb-simtec.c
@@ -40,7 +40,6 @@
 #include <asm/hardware.h>
 #include <asm/io.h>
 #include <asm/irq.h>
-#include <asm/mach-types.h>
 
 #include "devs.h"
 #include "usb-simtec.h"
diff --git a/arch/arm/mach-sa1100/collie.c b/arch/arm/mach-sa1100/collie.c
index 8cb69113a57c..25d6a4e27533 100644
--- a/arch/arm/mach-sa1100/collie.c
+++ b/arch/arm/mach-sa1100/collie.c
@@ -111,12 +111,11 @@ static struct mtd_partition collie_partitions[] = {
 
 static void collie_set_vpp(int vpp)
 {
-        write_scoop_reg(SCOOP_GPCR, read_scoop_reg(SCOOP_GPCR) | COLLIE_SCP_VPEN);
-        if (vpp) {
-                write_scoop_reg(SCOOP_GPWR, read_scoop_reg(SCOOP_GPWR) | COLLIE_SCP_VPEN);
-        } else {
-                write_scoop_reg(SCOOP_GPWR, read_scoop_reg(SCOOP_GPWR) & ~COLLIE_SCP_VPEN);
-        }
+        write_scoop_reg(&colliescoop_device.dev, SCOOP_GPCR, read_scoop_reg(SCOOP_GPCR) | COLLIE_SCP_VPEN);
+        if (vpp)
+                write_scoop_reg(&colliescoop_device.dev, SCOOP_GPWR, read_scoop_reg(SCOOP_GPWR) | COLLIE_SCP_VPEN);
+        else
+                write_scoop_reg(&colliescoop_device.dev, SCOOP_GPWR, read_scoop_reg(SCOOP_GPWR) & ~COLLIE_SCP_VPEN);
 }
 
 static struct flash_platform_data collie_flash_data = {
diff --git a/arch/arm/mach-sa1100/generic.h b/arch/arm/mach-sa1100/generic.h
index 279e3afa3c39..f085d68e568e 100644
--- a/arch/arm/mach-sa1100/generic.h
+++ b/arch/arm/mach-sa1100/generic.h
@@ -39,3 +39,6 @@ extern void sa11x0_set_ssp_data(struct sa11x0_ssp_plat_ops *ops);
 
 struct irda_platform_data;
 void sa11x0_set_irda_data(struct irda_platform_data *irda);
+
+struct mcp_plat_data;
+void sa11x0_set_mcp_data(struct mcp_plat_data *data);
diff --git a/arch/arm/mach-versatile/core.c b/arch/arm/mach-versatile/core.c
index 3c8862fde51a..a30e0451df72 100644
--- a/arch/arm/mach-versatile/core.c
+++ b/arch/arm/mach-versatile/core.c
@@ -30,7 +30,6 @@
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/leds.h>
-#include <asm/mach-types.h>
 #include <asm/hardware/amba.h>
 #include <asm/hardware/amba_clcd.h>
 #include <asm/hardware/arm_timer.h>
@@ -52,8 +51,9 @@
  *
  * Setup a VA for the Versatile Vectored Interrupt Controller.
  */
-#define VA_VIC_BASE              IO_ADDRESS(VERSATILE_VIC_BASE)
-#define VA_SIC_BASE              IO_ADDRESS(VERSATILE_SIC_BASE)
+#define __io_address(n)         __io(IO_ADDRESS(n))
+#define VA_VIC_BASE             __io_address(VERSATILE_VIC_BASE)
+#define VA_SIC_BASE             __io_address(VERSATILE_SIC_BASE)
 
 static void vic_mask_irq(unsigned int irq)
 {
@@ -214,7 +214,7 @@ void __init versatile_map_io(void)
         iotable_init(versatile_io_desc, ARRAY_SIZE(versatile_io_desc));
 }
 
-#define VERSATILE_REFCOUNTER    (IO_ADDRESS(VERSATILE_SYS_BASE) + VERSATILE_SYS_24MHz_OFFSET)
+#define VERSATILE_REFCOUNTER    (__io_address(VERSATILE_SYS_BASE) + VERSATILE_SYS_24MHz_OFFSET)
 
 /*
  * This is the Versatile sched_clock implementation.  This has
@@ -231,7 +231,7 @@ unsigned long long sched_clock(void)
 }
 
 
-#define VERSATILE_FLASHCTRL    (IO_ADDRESS(VERSATILE_SYS_BASE) + VERSATILE_SYS_FLASH_OFFSET)
+#define VERSATILE_FLASHCTRL    (__io_address(VERSATILE_SYS_BASE) + VERSATILE_SYS_FLASH_OFFSET)
 
 static int versatile_flash_init(void)
 {
@@ -309,7 +309,7 @@ static struct platform_device smc91x_device = {
         .resource       = smc91x_resources,
 };
 
-#define VERSATILE_SYSMCI        (IO_ADDRESS(VERSATILE_SYS_BASE) + VERSATILE_SYS_MCI_OFFSET)
+#define VERSATILE_SYSMCI        (__io_address(VERSATILE_SYS_BASE) + VERSATILE_SYS_MCI_OFFSET)
 
 unsigned int mmc_status(struct device *dev)
 {
@@ -343,11 +343,11 @@ static const struct icst307_params versatile_oscvco_params = {
 
 static void versatile_oscvco_set(struct clk *clk, struct icst307_vco vco)
 {
-        unsigned long sys_lock = IO_ADDRESS(VERSATILE_SYS_BASE) + VERSATILE_SYS_LOCK_OFFSET;
+        void __iomem *sys_lock = __io_address(VERSATILE_SYS_BASE) + VERSATILE_SYS_LOCK_OFFSET;
 #if defined(CONFIG_ARCH_VERSATILE_PB)
-        unsigned long sys_osc = IO_ADDRESS(VERSATILE_SYS_BASE) + VERSATILE_SYS_OSC4_OFFSET;
+        void __iomem *sys_osc = __io_address(VERSATILE_SYS_BASE) + VERSATILE_SYS_OSC4_OFFSET;
 #elif defined(CONFIG_MACH_VERSATILE_AB)
-        unsigned long sys_osc = IO_ADDRESS(VERSATILE_SYS_BASE) + VERSATILE_SYS_OSC1_OFFSET;
+        void __iomem *sys_osc = __io_address(VERSATILE_SYS_BASE) + VERSATILE_SYS_OSC1_OFFSET;
 #endif
         u32 val;
 
@@ -483,7 +483,7 @@ static struct clcd_panel epson_2_2_in = {
  */
 static struct clcd_panel *versatile_clcd_panel(void)
 {
-        unsigned long sys_clcd = IO_ADDRESS(VERSATILE_SYS_BASE) + VERSATILE_SYS_CLCD_OFFSET;
+        void __iomem *sys_clcd = __io_address(VERSATILE_SYS_BASE) + VERSATILE_SYS_CLCD_OFFSET;
         struct clcd_panel *panel = &vga;
         u32 val;
 
@@ -510,7 +510,7 @@ static struct clcd_panel *versatile_clcd_panel(void)
  */
 static void versatile_clcd_disable(struct clcd_fb *fb)
 {
-        unsigned long sys_clcd = IO_ADDRESS(VERSATILE_SYS_BASE) + VERSATILE_SYS_CLCD_OFFSET;
+        void __iomem *sys_clcd = __io_address(VERSATILE_SYS_BASE) + VERSATILE_SYS_CLCD_OFFSET;
         u32 val;
 
         val = readl(sys_clcd);
@@ -522,7 +522,7 @@ static void versatile_clcd_disable(struct clcd_fb *fb)
          * If the LCD is Sanyo 2x5 in on the IB2 board, turn the back-light off
          */
         if (fb->panel == &sanyo_2_5_in) {
-                unsigned long versatile_ib2_ctrl = IO_ADDRESS(VERSATILE_IB2_CTRL);
+                void __iomem *versatile_ib2_ctrl = __io_address(VERSATILE_IB2_CTRL);
                 unsigned long ctrl;
 
                 ctrl = readl(versatile_ib2_ctrl);
@@ -537,7 +537,7 @@ static void versatile_clcd_disable(struct clcd_fb *fb)
  */
 static void versatile_clcd_enable(struct clcd_fb *fb)
 {
-        unsigned long sys_clcd = IO_ADDRESS(VERSATILE_SYS_BASE) + VERSATILE_SYS_CLCD_OFFSET;
+        void __iomem *sys_clcd = __io_address(VERSATILE_SYS_BASE) + VERSATILE_SYS_CLCD_OFFSET;
         u32 val;
 
         val = readl(sys_clcd);
@@ -571,7 +571,7 @@ static void versatile_clcd_enable(struct clcd_fb *fb)
          * If the LCD is Sanyo 2x5 in on the IB2 board, turn the back-light on
          */
         if (fb->panel == &sanyo_2_5_in) {
-                unsigned long versatile_ib2_ctrl = IO_ADDRESS(VERSATILE_IB2_CTRL);
+                void __iomem *versatile_ib2_ctrl = __io_address(VERSATILE_IB2_CTRL);
                 unsigned long ctrl;
 
                 ctrl = readl(versatile_ib2_ctrl);
@@ -720,7 +720,7 @@ static struct amba_device *amba_devs[] __initdata = {
 };
 
 #ifdef CONFIG_LEDS
-#define VA_LEDS_BASE (IO_ADDRESS(VERSATILE_SYS_BASE) + VERSATILE_SYS_LED_OFFSET)
+#define VA_LEDS_BASE (__io_address(VERSATILE_SYS_BASE) + VERSATILE_SYS_LED_OFFSET)
 
 static void versatile_leds_event(led_event_t ledevt)
 {
@@ -778,11 +778,11 @@ void __init versatile_init(void)
 /*
  * Where is the timer (VA)?
  */
-#define TIMER0_VA_BASE           IO_ADDRESS(VERSATILE_TIMER0_1_BASE)
-#define TIMER1_VA_BASE          (IO_ADDRESS(VERSATILE_TIMER0_1_BASE) + 0x20)
-#define TIMER2_VA_BASE           IO_ADDRESS(VERSATILE_TIMER2_3_BASE)
-#define TIMER3_VA_BASE          (IO_ADDRESS(VERSATILE_TIMER2_3_BASE) + 0x20)
-#define VA_IC_BASE               IO_ADDRESS(VERSATILE_VIC_BASE) 
+#define TIMER0_VA_BASE           __io_address(VERSATILE_TIMER0_1_BASE)
+#define TIMER1_VA_BASE          (__io_address(VERSATILE_TIMER0_1_BASE) + 0x20)
+#define TIMER2_VA_BASE           __io_address(VERSATILE_TIMER2_3_BASE)
+#define TIMER3_VA_BASE          (__io_address(VERSATILE_TIMER2_3_BASE) + 0x20)
+#define VA_IC_BASE               __io_address(VERSATILE_VIC_BASE) 
 
 /*
  * How long is the timer interval?
@@ -877,12 +877,12 @@ static void __init versatile_timer_init(void)
          *      VERSATILE_REFCLK is 32KHz
          *      VERSATILE_TIMCLK is 1MHz
          */
-        val = readl(IO_ADDRESS(VERSATILE_SCTL_BASE));
+        val = readl(__io_address(VERSATILE_SCTL_BASE));
         writel((VERSATILE_TIMCLK << VERSATILE_TIMER1_EnSel) |
                (VERSATILE_TIMCLK << VERSATILE_TIMER2_EnSel) | 
                (VERSATILE_TIMCLK << VERSATILE_TIMER3_EnSel) |
                (VERSATILE_TIMCLK << VERSATILE_TIMER4_EnSel) | val,
-               IO_ADDRESS(VERSATILE_SCTL_BASE));
+               __io_address(VERSATILE_SCTL_BASE));
 
         /*
          * Initialise to a known state (all timers off)
diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
index d1565e851f0e..b80d57d51699 100644
--- a/arch/arm/mach-versatile/pci.c
+++ b/arch/arm/mach-versatile/pci.c
@@ -29,7 +29,6 @@
 #include <asm/irq.h>
 #include <asm/system.h>
 #include <asm/mach/pci.h>
-#include <asm/mach-types.h>
 
 /*
  * these spaces are mapped using the following base registers:
diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
index 8f76f3df7b4c..dbd346033122 100644
--- a/arch/arm/mm/abort-ev6.S
+++ b/arch/arm/mm/abort-ev6.S
@@ -20,6 +20,11 @@
  */
         .align  5
 ENTRY(v6_early_abort)
+#ifdef CONFIG_CPU_MPCORE
+        clrex
+#else
+        strex   r0, r1, [sp]                    @ Clear the exclusive monitor
+#endif
         mrc     p15, 0, r1, c5, c0, 0           @ get FSR
         mrc     p15, 0, r0, c6, c0, 0           @ get FAR
 /*
diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index 85c10a71e7c6..72966d90e956 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -18,6 +18,7 @@
 #define HARVARD_CACHE
 #define CACHE_LINE_SIZE         32
 #define D_CACHE_LINE_SIZE       32
+#define BTB_FLUSH_SIZE          8
 
 /*
  *      v6_flush_cache_all()
@@ -98,7 +99,13 @@ ENTRY(v6_coherent_user_range)
         mcr     p15, 0, r0, c7, c5, 1           @ invalidate I line
 #endif
         mcr     p15, 0, r0, c7, c5, 7           @ invalidate BTB entry
-        add     r0, r0, #CACHE_LINE_SIZE
+        add     r0, r0, #BTB_FLUSH_SIZE
+        mcr     p15, 0, r0, c7, c5, 7           @ invalidate BTB entry
+        add     r0, r0, #BTB_FLUSH_SIZE
+        mcr     p15, 0, r0, c7, c5, 7           @ invalidate BTB entry
+        add     r0, r0, #BTB_FLUSH_SIZE
+        mcr     p15, 0, r0, c7, c5, 7           @ invalidate BTB entry
+        add     r0, r0, #BTB_FLUSH_SIZE
         cmp     r0, r1
         blo     1b
 #ifdef HARVARD_CACHE
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index 0b6c4db44e08..4a884baf3b9c 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -233,7 +233,17 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
         if (in_interrupt() || !mm)
                 goto no_context;
 
-        down_read(&mm->mmap_sem);
+        /*
+         * As per x86, we may deadlock here.  However, since the kernel only
+         * validly references user space from well defined areas of the code,
+         * we can bug out early if this is from code which shouldn't.
+         */
+        if (!down_read_trylock(&mm->mmap_sem)) {
+                if (!user_mode(regs) && !search_exception_tables(regs->ARM_pc))
+                        goto no_context;
+                down_read(&mm->mmap_sem);
+        }
+
         fault = __do_page_fault(mm, addr, fsr, tsk);
         up_read(&mm->mmap_sem);
 
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index b0208c992576..c9a03981b785 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -17,6 +17,24 @@
 
 #ifdef CONFIG_CPU_CACHE_VIPT
 
+#define ALIAS_FLUSH_START       0xffff4000
+
+#define TOP_PTE(x)      pte_offset_kernel(top_pmd, x)
+
+static void flush_pfn_alias(unsigned long pfn, unsigned long vaddr)
+{
+        unsigned long to = ALIAS_FLUSH_START + (CACHE_COLOUR(vaddr) << PAGE_SHIFT);
+
+        set_pte(TOP_PTE(to), pfn_pte(pfn, PAGE_KERNEL));
+        flush_tlb_kernel_page(to);
+
+        asm(    "mcrr   p15, 0, %1, %0, c14\n"
+        "       mcrr    p15, 0, %1, %0, c5\n"
+            :
+            : "r" (to), "r" (to + PAGE_SIZE - L1_CACHE_BYTES)
+            : "cc");
+}
+
 void flush_cache_mm(struct mm_struct *mm)
 {
         if (cache_is_vivt()) {
@@ -67,24 +85,6 @@ void flush_cache_page(struct vm_area_struct *vma, unsigned long user_addr, unsig
         if (cache_is_vipt_aliasing())
                 flush_pfn_alias(pfn, user_addr);
 }
-
-#define ALIAS_FLUSH_START       0xffff4000
-
-#define TOP_PTE(x)      pte_offset_kernel(top_pmd, x)
-
-static void flush_pfn_alias(unsigned long pfn, unsigned long vaddr)
-{
-        unsigned long to = ALIAS_FLUSH_START + (CACHE_COLOUR(vaddr) << PAGE_SHIFT);
-
-        set_pte(TOP_PTE(to), pfn_pte(pfn, PAGE_KERNEL));
-        flush_tlb_kernel_page(to);
-
-        asm(    "mcrr   p15, 0, %1, %0, c14\n"
-        "       mcrr    p15, 0, %1, %0, c5\n"
-            :
-            : "r" (to), "r" (to + PAGE_SIZE - L1_CACHE_BYTES)
-            : "cc");
-}
 #else
 #define flush_pfn_alias(pfn,vaddr)      do { } while (0)
 #endif
diff --git a/arch/arm/mm/proc-arm1020.S b/arch/arm/mm/proc-arm1020.S
index 1d739d282a45..82ec954e45b6 100644
--- a/arch/arm/mm/proc-arm1020.S
+++ b/arch/arm/mm/proc-arm1020.S
@@ -509,7 +509,7 @@ cpu_arm1020_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __arm1020_proc_info,#object
 __arm1020_proc_info:
diff --git a/arch/arm/mm/proc-arm1020e.S b/arch/arm/mm/proc-arm1020e.S
index 9b725665b5c7..7375fe930f72 100644
--- a/arch/arm/mm/proc-arm1020e.S
+++ b/arch/arm/mm/proc-arm1020e.S
@@ -491,7 +491,7 @@ cpu_arm1020e_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __arm1020e_proc_info,#object
 __arm1020e_proc_info:
diff --git a/arch/arm/mm/proc-arm1022.S b/arch/arm/mm/proc-arm1022.S
index 37b70fa21c76..6ca639094d6f 100644
--- a/arch/arm/mm/proc-arm1022.S
+++ b/arch/arm/mm/proc-arm1022.S
@@ -473,7 +473,7 @@ cpu_arm1022_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __arm1022_proc_info,#object
 __arm1022_proc_info:
diff --git a/arch/arm/mm/proc-arm1026.S b/arch/arm/mm/proc-arm1026.S
index 931b690d1be2..10317e4f55d2 100644
--- a/arch/arm/mm/proc-arm1026.S
+++ b/arch/arm/mm/proc-arm1026.S
@@ -469,7 +469,7 @@ cpu_arm1026_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __arm1026_proc_info,#object
 __arm1026_proc_info:
diff --git a/arch/arm/mm/proc-arm6_7.S b/arch/arm/mm/proc-arm6_7.S
index d0f1bbb48f6c..8e7e1e70ab05 100644
--- a/arch/arm/mm/proc-arm6_7.S
+++ b/arch/arm/mm/proc-arm6_7.S
@@ -332,7 +332,7 @@ cpu_arm710_name:
 
                 .align
 
-                .section ".proc.info", #alloc, #execinstr
+                .section ".proc.info.init", #alloc, #execinstr
 
                 .type   __arm6_proc_info, #object
 __arm6_proc_info:
diff --git a/arch/arm/mm/proc-arm720.S b/arch/arm/mm/proc-arm720.S
index c69c9de32391..a13e0184d343 100644
--- a/arch/arm/mm/proc-arm720.S
+++ b/arch/arm/mm/proc-arm720.S
@@ -222,7 +222,7 @@ cpu_arm720_name:
  * See linux/include/asm-arm/procinfo.h for a definition of this structure.
  */
         
-                .section ".proc.info", #alloc, #execinstr
+                .section ".proc.info.init", #alloc, #execinstr
 
                 .type   __arm710_proc_info, #object
 __arm710_proc_info:
diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
index 0f490a0fcb71..d16513899999 100644
--- a/arch/arm/mm/proc-arm920.S
+++ b/arch/arm/mm/proc-arm920.S
@@ -452,7 +452,7 @@ cpu_arm920_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __arm920_proc_info,#object
 __arm920_proc_info:
diff --git a/arch/arm/mm/proc-arm922.S b/arch/arm/mm/proc-arm922.S
index 62bc34a139ee..23b8ed97f4e3 100644
--- a/arch/arm/mm/proc-arm922.S
+++ b/arch/arm/mm/proc-arm922.S
@@ -456,7 +456,7 @@ cpu_arm922_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __arm922_proc_info,#object
 __arm922_proc_info:
diff --git a/arch/arm/mm/proc-arm925.S b/arch/arm/mm/proc-arm925.S
index ee49aa2ca781..ee95c52db513 100644
--- a/arch/arm/mm/proc-arm925.S
+++ b/arch/arm/mm/proc-arm925.S
@@ -521,7 +521,7 @@ cpu_arm925_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __arm925_proc_info,#object
 __arm925_proc_info:
diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
index bb95cc9fed03..7d042dc20c47 100644
--- a/arch/arm/mm/proc-arm926.S
+++ b/arch/arm/mm/proc-arm926.S
@@ -471,7 +471,7 @@ cpu_arm926_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __arm926_proc_info,#object
 __arm926_proc_info:
diff --git a/arch/arm/mm/proc-sa110.S b/arch/arm/mm/proc-sa110.S
index 34f7e7d3f419..bd330c4075a1 100644
--- a/arch/arm/mm/proc-sa110.S
+++ b/arch/arm/mm/proc-sa110.S
@@ -249,7 +249,7 @@ cpu_sa110_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __sa110_proc_info,#object
 __sa110_proc_info:
diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
index ca14f80d5ab4..91b89124c0d7 100644
--- a/arch/arm/mm/proc-sa1100.S
+++ b/arch/arm/mm/proc-sa1100.S
@@ -280,7 +280,7 @@ cpu_sa1110_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __sa1100_proc_info,#object
 __sa1100_proc_info:
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index eb34823c9dbf..caf3b19b167f 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -240,7 +240,7 @@ cpu_elf_name:
         .size   cpu_elf_name, . - cpu_elf_name
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         /*
          * Match any ARMv6 processor core.
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index b88de2700146..861b35947280 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -578,7 +578,7 @@ cpu_pxa270_name:
 
         .align
 
-        .section ".proc.info", #alloc, #execinstr
+        .section ".proc.info.init", #alloc, #execinstr
 
         .type   __80200_proc_info,#object
 __80200_proc_info:
diff --git a/arch/arm/plat-omap/common.c b/arch/arm/plat-omap/common.c
index 6cb20aea7f51..02bcc6c1cd1b 100644
--- a/arch/arm/plat-omap/common.c
+++ b/arch/arm/plat-omap/common.c
@@ -25,7 +25,6 @@
 #include <asm/mach/map.h>
 #include <asm/hardware/clock.h>
 #include <asm/io.h>
-#include <asm/mach-types.h>
 #include <asm/setup.h>
 
 #include <asm/arch/board.h>
diff --git a/arch/arm/plat-omap/cpu-omap.c b/arch/arm/plat-omap/cpu-omap.c
index 409aac2c4b9d..fd894bb00107 100644
--- a/arch/arm/plat-omap/cpu-omap.c
+++ b/arch/arm/plat-omap/cpu-omap.c
@@ -21,7 +21,6 @@
 #include <linux/err.h>
 
 #include <asm/hardware.h>
-#include <asm/mach-types.h>
 #include <asm/io.h>
 #include <asm/system.h>
 
diff --git a/arch/arm/plat-omap/usb.c b/arch/arm/plat-omap/usb.c
index 98f1c76f8660..14a836d7ac25 100644
--- a/arch/arm/plat-omap/usb.c
+++ b/arch/arm/plat-omap/usb.c
@@ -33,7 +33,6 @@
 #include <asm/irq.h>
 #include <asm/system.h>
 #include <asm/hardware.h>
-#include <asm/mach-types.h>
 
 #include <asm/arch/mux.h>
 #include <asm/arch/usb.h>
diff --git a/arch/arm26/boot/compressed/hw-bse.c b/arch/arm26/boot/compressed/hw-bse.c
deleted file mode 100644
index 3e8f07f8e08a..000000000000
--- a/arch/arm26/boot/compressed/hw-bse.c
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Bright Star Engineering Inc.
- *
- * code for readng parameters from the
- * parameter blocks of the boot block
- * flash memory
- *
- */
-
-static int strcmp(const char *s1, const char *s2)
-{
-  while (*s1 != '\0' && *s1 == *s2)
-    {
-      s1++;
-      s2++;
-    }
-
-  return (*(unsigned char *) s1) - (*(unsigned char *) s2);
-}
-
-struct pblk_t {
-  char type;
-  unsigned short size;
-};
-
-static char *bse_getflashparam(char *name) {
-  unsigned int esize;
-  char *q,*r;
-  unsigned char *p,*e;
-  struct pblk_t *thepb = (struct pblk_t *) 0x00004000;
-  struct pblk_t *altpb = (struct pblk_t *) 0x00006000;  
-  if (thepb->type&1) {
-    if (altpb->type&1) {
-      /* no valid param block */ 
-      return (char*)0;
-    } else {
-      /* altpb is valid */
-      struct pblk_t *tmp;
-      tmp = thepb;
-      thepb = altpb;
-      altpb = tmp;
-    }
-  }
-  p = (char*)thepb + sizeof(struct pblk_t);
-  e = p + thepb->size; 
-  while (p < e) {
-    q = p;
-    esize = *p;
-    if (esize == 0xFF) break;
-    if (esize == 0) break;
-    if (esize > 127) {
-      esize = (esize&0x7F)<<8 | p[1];
-      q++;
-    }
-    q++;
-    r=q;
-    if (*r && ((name == 0) || (!strcmp(name,r)))) {
-      while (*q++) ;
-      return q;
-    }
-    p+=esize;
-  }
-  return (char*)0;
-}
-
-void bse_setup(void) {
-  /* extract the linux cmdline from flash */
-  char *name=bse_getflashparam("linuxboot");
-  char *x = (char *)0xc0000100;
-  if (name) { 
-    while (*name) *x++=*name++;
-  }
-  *x=0;
-}
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index b22f003eaa6d..d2703cda61ea 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -908,11 +908,6 @@ config IRQBALANCE
           The default yes will allow the kernel to do irq load balancing.
           Saying no will keep the kernel from doing irq load balancing.
 
-config HAVE_DEC_LOCK
-        bool
-        depends on (SMP || PREEMPT) && X86_CMPXCHG
-        default y
-
 # turning this on wastes a bunch of space.
 # Summit needs it only when NUMA is on
 config BOOT_IOREMAP
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index a63351c085c6..b66c13c0cc0f 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -27,15 +27,14 @@
 #include <linux/config.h>
 #include <linux/acpi.h>
 #include <linux/efi.h>
-#include <linux/irq.h>
 #include <linux/module.h>
 #include <linux/dmi.h>
+#include <linux/irq.h>
 
 #include <asm/pgtable.h>
 #include <asm/io_apic.h>
 #include <asm/apic.h>
 #include <asm/io.h>
-#include <asm/irq.h>
 #include <asm/mpspec.h>
 
 #ifdef  CONFIG_X86_64
diff --git a/arch/i386/kernel/acpi/earlyquirk.c b/arch/i386/kernel/acpi/earlyquirk.c
index 1ae2aeeda18b..f1b9d2a46dab 100644
--- a/arch/i386/kernel/acpi/earlyquirk.c
+++ b/arch/i386/kernel/acpi/earlyquirk.c
@@ -7,7 +7,6 @@
 #include <linux/pci.h>
 #include <asm/pci-direct.h>
 #include <asm/acpi.h>
-#include <asm/apic.h>
 
 static int __init check_bridge(int vendor, int device)
 {
@@ -16,15 +15,6 @@ static int __init check_bridge(int vendor, int device)
         if (vendor == PCI_VENDOR_ID_NVIDIA) {
                 acpi_skip_timer_override = 1;
         }
-#ifdef CONFIG_X86_LOCAL_APIC
-        /*
-         * ATI IXP chipsets get double timer interrupts.
-         * For now just do this for all ATI chipsets.
-         * FIXME: this needs to be checked for the non ACPI case too.
-         */
-        if (vendor == PCI_VENDOR_ID_ATI)
-                disable_timer_pin_1 = 1;
-#endif
         return 0;
 }
 
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index a22a866de8f9..5546ddebec33 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -18,7 +18,6 @@
 #include <linux/init.h>
 
 #include <linux/mm.h>
-#include <linux/irq.h>
 #include <linux/delay.h>
 #include <linux/bootmem.h>
 #include <linux/smp_lock.h>
diff --git a/arch/i386/kernel/cpu/amd.c b/arch/i386/kernel/cpu/amd.c
index 73aeaf5a9d4e..4c1ddf2b57cc 100644
--- a/arch/i386/kernel/cpu/amd.c
+++ b/arch/i386/kernel/cpu/amd.c
@@ -28,6 +28,22 @@ static void __init init_amd(struct cpuinfo_x86 *c)
         int mbytes = num_physpages >> (20-PAGE_SHIFT);
         int r;
 
+#ifdef CONFIG_SMP
+        unsigned long value;
+
+        /* Disable TLB flush filter by setting HWCR.FFDIS on K8
+         * bit 6 of msr C001_0015
+         *
+         * Errata 63 for SH-B3 steppings
+         * Errata 122 for all steppings (F+ have it disabled by default)
+         */
+        if (c->x86 == 15) {
+                rdmsrl(MSR_K7_HWCR, value);
+                value |= 1 << 6;
+                wrmsrl(MSR_K7_HWCR, value);
+        }
+#endif
+
         /*
          *      FIXME: We should handle the K5 here. Set up the write
          *      range and also turn on MSR 83 bits 4 and 31 (write alloc,
diff --git a/arch/i386/kernel/cpu/mcheck/k7.c b/arch/i386/kernel/cpu/mcheck/k7.c
index c4abe7657397..7c6b9c73522f 100644
--- a/arch/i386/kernel/cpu/mcheck/k7.c
+++ b/arch/i386/kernel/cpu/mcheck/k7.c
@@ -7,7 +7,6 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/config.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <linux/smp.h>
 
diff --git a/arch/i386/kernel/cpu/mcheck/non-fatal.c b/arch/i386/kernel/cpu/mcheck/non-fatal.c
index 7864ddfccf07..82dffe0d4954 100644
--- a/arch/i386/kernel/cpu/mcheck/non-fatal.c
+++ b/arch/i386/kernel/cpu/mcheck/non-fatal.c
@@ -12,7 +12,6 @@
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
 #include <linux/config.h>
-#include <linux/irq.h>
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
 #include <linux/smp.h>
diff --git a/arch/i386/kernel/cpu/mcheck/p4.c b/arch/i386/kernel/cpu/mcheck/p4.c
index 0abccb6fdf9e..1d1e885f500a 100644
--- a/arch/i386/kernel/cpu/mcheck/p4.c
+++ b/arch/i386/kernel/cpu/mcheck/p4.c
@@ -6,7 +6,6 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/config.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <linux/smp.h>
 
diff --git a/arch/i386/kernel/cpu/mcheck/p5.c b/arch/i386/kernel/cpu/mcheck/p5.c
index ec0614cd2925..3a2e24baddc7 100644
--- a/arch/i386/kernel/cpu/mcheck/p5.c
+++ b/arch/i386/kernel/cpu/mcheck/p5.c
@@ -6,7 +6,6 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <linux/smp.h>
 
diff --git a/arch/i386/kernel/cpu/mcheck/p6.c b/arch/i386/kernel/cpu/mcheck/p6.c
index f01b73f947e1..3c035b8fa3d9 100644
--- a/arch/i386/kernel/cpu/mcheck/p6.c
+++ b/arch/i386/kernel/cpu/mcheck/p6.c
@@ -6,7 +6,6 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <linux/smp.h>
 
diff --git a/arch/i386/kernel/cpu/mcheck/winchip.c b/arch/i386/kernel/cpu/mcheck/winchip.c
index 7bae68fa168f..5b9d2dd411d3 100644
--- a/arch/i386/kernel/cpu/mcheck/winchip.c
+++ b/arch/i386/kernel/cpu/mcheck/winchip.c
@@ -6,7 +6,6 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 
 #include <asm/processor.h> 
diff --git a/arch/i386/kernel/crash.c b/arch/i386/kernel/crash.c
index 913be77bb844..0248e084017c 100644
--- a/arch/i386/kernel/crash.c
+++ b/arch/i386/kernel/crash.c
@@ -11,10 +11,8 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/smp.h>
-#include <linux/irq.h>
 #include <linux/reboot.h>
 #include <linux/kexec.h>
-#include <linux/irq.h>
 #include <linux/delay.h>
 #include <linux/elf.h>
 #include <linux/elfcore.h>
diff --git a/arch/i386/kernel/i8259.c b/arch/i386/kernel/i8259.c
index 178f4e9bac9d..323ef8ab3244 100644
--- a/arch/i386/kernel/i8259.c
+++ b/arch/i386/kernel/i8259.c
@@ -16,7 +16,6 @@
 #include <asm/atomic.h>
 #include <asm/system.h>
 #include <asm/io.h>
-#include <asm/irq.h>
 #include <asm/timer.h>
 #include <asm/pgtable.h>
 #include <asm/delay.h>
@@ -25,8 +24,6 @@
 #include <asm/arch_hooks.h>
 #include <asm/i8259.h>
 
-#include <linux/irq.h>
-
 #include <io_ports.h>
 
 /*
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index 378313b0cce9..fb3991e8229e 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -21,7 +21,6 @@
  */
 
 #include <linux/mm.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
 #include <linux/delay.h>
diff --git a/arch/i386/kernel/mpparse.c b/arch/i386/kernel/mpparse.c
index 15949fd08109..27aabfceb67e 100644
--- a/arch/i386/kernel/mpparse.c
+++ b/arch/i386/kernel/mpparse.c
@@ -14,7 +14,6 @@
  */
 
 #include <linux/mm.h>
-#include <linux/irq.h>
 #include <linux/init.h>
 #include <linux/acpi.h>
 #include <linux/delay.h>
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index 0178457db721..72515b8a1b12 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -15,7 +15,6 @@
 
 #include <linux/config.h>
 #include <linux/mm.h>
-#include <linux/irq.h>
 #include <linux/delay.h>
 #include <linux/bootmem.h>
 #include <linux/smp_lock.h>
diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
index b45cbf93d439..7a14fdfd3af9 100644
--- a/arch/i386/kernel/process.c
+++ b/arch/i386/kernel/process.c
@@ -47,13 +47,11 @@
 #include <asm/ldt.h>
 #include <asm/processor.h>
 #include <asm/i387.h>
-#include <asm/irq.h>
 #include <asm/desc.h>
 #ifdef CONFIG_MATH_EMULATION
 #include <asm/math_emu.h>
 #endif
 
-#include <linux/irq.h>
 #include <linux/err.h>
 
 #include <asm/tlbflush.h>
diff --git a/arch/i386/kernel/reboot.c b/arch/i386/kernel/reboot.c
index 1cbb9c0f4704..350ea6680f63 100644
--- a/arch/i386/kernel/reboot.c
+++ b/arch/i386/kernel/reboot.c
@@ -11,6 +11,7 @@
 #include <linux/mc146818rtc.h>
 #include <linux/efi.h>
 #include <linux/dmi.h>
+#include <linux/ctype.h>
 #include <asm/uaccess.h>
 #include <asm/apic.h>
 #include <asm/desc.h>
@@ -28,8 +29,6 @@ static int reboot_thru_bios;
 
 #ifdef CONFIG_SMP
 static int reboot_cpu = -1;
-/* shamelessly grabbed from lib/vsprintf.c for readability */
-#define is_digit(c)     ((c) >= '0' && (c) <= '9')
 #endif
 static int __init reboot_setup(char *str)
 {
@@ -49,9 +48,9 @@ static int __init reboot_setup(char *str)
                         break;
 #ifdef CONFIG_SMP
                 case 's': /* "smp" reboot by executing reset on BSP or other CPU*/
-                        if (is_digit(*(str+1))) {
+                        if (isdigit(*(str+1))) {
                                 reboot_cpu = (int) (*(str+1) - '0');
-                                if (is_digit(*(str+2))) 
+                                if (isdigit(*(str+2)))
                                         reboot_cpu = reboot_cpu*10 + (int)(*(str+2) - '0');
                         }
                                 /* we will leave sorting out the final value 
diff --git a/arch/i386/kernel/setup.c b/arch/i386/kernel/setup.c
index dc39ca6a7eca..9b8c8a19824d 100644
--- a/arch/i386/kernel/setup.c
+++ b/arch/i386/kernel/setup.c
@@ -848,9 +848,7 @@ static void __init parse_cmdline_early (char ** cmdline_p)
 #ifdef CONFIG_X86_IO_APIC
                 else if (!memcmp(from, "acpi_skip_timer_override", 24))
                         acpi_skip_timer_override = 1;
-#endif
 
-#ifdef CONFIG_X86_LOCAL_APIC
                 if (!memcmp(from, "disable_timer_pin_1", 19))
                         disable_timer_pin_1 = 1;
                 if (!memcmp(from, "enable_timer_pin_1", 18))
@@ -859,7 +857,7 @@ static void __init parse_cmdline_early (char ** cmdline_p)
                 /* disable IO-APIC */
                 else if (!memcmp(from, "noapic", 6))
                         disable_ioapic_setup();
-#endif /* CONFIG_X86_LOCAL_APIC */
+#endif /* CONFIG_X86_IO_APIC */
 #endif /* CONFIG_ACPI */
 
 #ifdef CONFIG_X86_LOCAL_APIC
diff --git a/arch/i386/kernel/smp.c b/arch/i386/kernel/smp.c
index 48b55db3680f..218d725a5a1e 100644
--- a/arch/i386/kernel/smp.c
+++ b/arch/i386/kernel/smp.c
@@ -11,7 +11,6 @@
 #include <linux/init.h>
 
 #include <linux/mm.h>
-#include <linux/irq.h>
 #include <linux/delay.h>
 #include <linux/spinlock.h>
 #include <linux/smp_lock.h>
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index c70cd2a08304..1fb26d0e30b6 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -42,7 +42,6 @@
 #include <linux/sched.h>
 #include <linux/kernel_stat.h>
 #include <linux/smp_lock.h>
-#include <linux/irq.h>
 #include <linux/bootmem.h>
 #include <linux/notifier.h>
 #include <linux/cpu.h>
@@ -202,7 +201,7 @@ static void __devinit smp_store_cpu_info(int id)
                                 goto valid_k7;
 
                 /* If we get here, it's not a certified SMP capable AMD system. */
-                tainted |= TAINT_UNSAFE_SMP;
+                add_taint(TAINT_UNSAFE_SMP);
         }
 
 valid_k7:
diff --git a/arch/i386/kernel/timers/timer_pit.c b/arch/i386/kernel/timers/timer_pit.c
index eddb64038234..e42e46d35159 100644
--- a/arch/i386/kernel/timers/timer_pit.c
+++ b/arch/i386/kernel/timers/timer_pit.c
@@ -6,7 +6,6 @@
 #include <linux/spinlock.h>
 #include <linux/module.h>
 #include <linux/device.h>
-#include <linux/irq.h>
 #include <linux/sysdev.h>
 #include <linux/timex.h>
 #include <asm/delay.h>
diff --git a/arch/i386/kernel/traps.c b/arch/i386/kernel/traps.c
index 09a58cb6daa7..19e90bdd84ea 100644
--- a/arch/i386/kernel/traps.c
+++ b/arch/i386/kernel/traps.c
@@ -52,7 +52,6 @@
 #include <asm/arch_hooks.h>
 #include <asm/kdebug.h>
 
-#include <linux/irq.h>
 #include <linux/module.h>
 
 #include "mach_traps.h"
@@ -807,8 +806,9 @@ void math_error(void __user *eip)
         cwd = get_fpu_cwd(task);
         swd = get_fpu_swd(task);
         switch (swd & ~cwd & 0x3f) {
-                case 0x000:
-                default:
+                case 0x000: /* No unmasked exception */
+                        return;
+                default:    /* Multiple exceptions */
                         break;
                 case 0x001: /* Invalid Op */
                         /*
diff --git a/arch/i386/lib/Makefile b/arch/i386/lib/Makefile
index 7b1932d20f96..914933e9ec3d 100644
--- a/arch/i386/lib/Makefile
+++ b/arch/i386/lib/Makefile
@@ -7,4 +7,3 @@ lib-y = checksum.o delay.o usercopy.o getuser.o putuser.o memcpy.o strstr.o \
         bitops.o
 
 lib-$(CONFIG_X86_USE_3DNOW) += mmx.o
-lib-$(CONFIG_HAVE_DEC_LOCK) += dec_and_lock.o
diff --git a/arch/i386/lib/dec_and_lock.c b/arch/i386/lib/dec_and_lock.c
deleted file mode 100644
index 8b81b2524fa6..000000000000
--- a/arch/i386/lib/dec_and_lock.c
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * x86 version of "atomic_dec_and_lock()" using
- * the atomic "cmpxchg" instruction.
- *
- * (For CPU's lacking cmpxchg, we use the slow
- * generic version, and this one never even gets
- * compiled).
- */
-
-#include <linux/spinlock.h>
-#include <linux/module.h>
-#include <asm/atomic.h>
-
-int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock)
-{
-        int counter;
-        int newcount;
-
-repeat:
-        counter = atomic_read(atomic);
-        newcount = counter-1;
-
-        if (!newcount)
-                goto slow_path;
-
-        asm volatile("lock; cmpxchgl %1,%2"
-                :"=a" (newcount)
-                :"r" (newcount), "m" (atomic->counter), "0" (counter));
-
-        /* If the above failed, "eax" will have changed */
-        if (newcount != counter)
-                goto repeat;
-        return 0;
-
-slow_path:
-        spin_lock(lock);
-        if (atomic_dec_and_test(atomic))
-                return 1;
-        spin_unlock(lock);
-        return 0;
-}
-EXPORT_SYMBOL(_atomic_dec_and_lock);
diff --git a/arch/i386/mach-default/setup.c b/arch/i386/mach-default/setup.c
index e5a1a83d09ef..b4a7455c6993 100644
--- a/arch/i386/mach-default/setup.c
+++ b/arch/i386/mach-default/setup.c
@@ -5,7 +5,6 @@
 #include <linux/config.h>
 #include <linux/smp.h>
 #include <linux/init.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <asm/acpi.h>
 #include <asm/arch_hooks.h>
diff --git a/arch/i386/mach-visws/setup.c b/arch/i386/mach-visws/setup.c
index 26ada6fc0d77..07fac7e749c7 100644
--- a/arch/i386/mach-visws/setup.c
+++ b/arch/i386/mach-visws/setup.c
@@ -5,7 +5,6 @@
 
 #include <linux/smp.h>
 #include <linux/init.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 
 #include <asm/fixmap.h>
diff --git a/arch/i386/mach-visws/visws_apic.c b/arch/i386/mach-visws/visws_apic.c
index 04e6585849a2..3e64fb721291 100644
--- a/arch/i386/mach-visws/visws_apic.c
+++ b/arch/i386/mach-visws/visws_apic.c
@@ -19,7 +19,6 @@
 #include <linux/config.h>
 #include <linux/kernel_stat.h>
 #include <linux/interrupt.h>
-#include <linux/irq.h>
 #include <linux/smp_lock.h>
 #include <linux/init.h>
 
diff --git a/arch/i386/mach-voyager/setup.c b/arch/i386/mach-voyager/setup.c
index df123fc487bb..7d8a3acb9441 100644
--- a/arch/i386/mach-voyager/setup.c
+++ b/arch/i386/mach-voyager/setup.c
@@ -4,7 +4,6 @@
 
 #include <linux/config.h>
 #include <linux/init.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <asm/acpi.h>
 #include <asm/arch_hooks.h>
diff --git a/arch/i386/mach-voyager/voyager_basic.c b/arch/i386/mach-voyager/voyager_basic.c
index cc69875d979b..aa49a33a572c 100644
--- a/arch/i386/mach-voyager/voyager_basic.c
+++ b/arch/i386/mach-voyager/voyager_basic.c
@@ -27,7 +27,6 @@
 #include <asm/voyager.h>
 #include <asm/vic.h>
 #include <linux/pm.h>
-#include <linux/irq.h>
 #include <asm/tlbflush.h>
 #include <asm/arch_hooks.h>
 #include <asm/i8253.h>
diff --git a/arch/i386/mach-voyager/voyager_smp.c b/arch/i386/mach-voyager/voyager_smp.c
index 46b0cf4a31e0..72a1b9cae2e4 100644
--- a/arch/i386/mach-voyager/voyager_smp.c
+++ b/arch/i386/mach-voyager/voyager_smp.c
@@ -30,8 +30,6 @@
 #include <asm/tlbflush.h>
 #include <asm/arch_hooks.h>
 
-#include <linux/irq.h>
-
 /* TLB state -- visible externally, indexed physically */
 DEFINE_PER_CPU(struct tlb_state, cpu_tlbstate) ____cacheline_aligned = { &init_mm, 0 };
 
diff --git a/arch/i386/mach-voyager/voyager_thread.c b/arch/i386/mach-voyager/voyager_thread.c
index a9341b0eebff..2b03884fdb2a 100644
--- a/arch/i386/mach-voyager/voyager_thread.c
+++ b/arch/i386/mach-voyager/voyager_thread.c
@@ -31,8 +31,6 @@
 #include <asm/mtrr.h>
 #include <asm/msr.h>
 
-#include <linux/irq.h>
-
 #define THREAD_NAME "kvoyagerd"
 
 /* external variables */
diff --git a/arch/i386/oprofile/nmi_timer_int.c b/arch/i386/oprofile/nmi_timer_int.c
index ad93cdd55d63..930a1127bb30 100644
--- a/arch/i386/oprofile/nmi_timer_int.c
+++ b/arch/i386/oprofile/nmi_timer_int.c
@@ -9,7 +9,7 @@
 
 #include <linux/init.h>
 #include <linux/smp.h>
-#include <linux/irq.h>
+#include <linux/errno.h>
 #include <linux/oprofile.h>
 #include <linux/rcupdate.h>
 
diff --git a/arch/i386/pci/acpi.c b/arch/i386/pci/acpi.c
index 2941674f35eb..4c4522b43be5 100644
--- a/arch/i386/pci/acpi.c
+++ b/arch/i386/pci/acpi.c
@@ -2,7 +2,6 @@
 #include <linux/acpi.h>
 #include <linux/init.h>
 #include <linux/irq.h>
-#include <asm/hw_irq.h>
 #include <asm/numa.h>
 #include "pci.h"
 
diff --git a/arch/i386/pci/irq.c b/arch/i386/pci/irq.c
index 326a2edc3834..cddafe33ff7c 100644
--- a/arch/i386/pci/irq.c
+++ b/arch/i386/pci/irq.c
@@ -11,12 +11,11 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/interrupt.h>
-#include <linux/irq.h>
 #include <linux/dmi.h>
 #include <asm/io.h>
 #include <asm/smp.h>
 #include <asm/io_apic.h>
-#include <asm/hw_irq.h>
+#include <linux/irq.h>
 #include <linux/acpi.h>
 
 #include "pci.h"
diff --git a/arch/i386/power/cpu.c b/arch/i386/power/cpu.c
index 7b0b9ad848e5..b27c5acc79d0 100644
--- a/arch/i386/power/cpu.c
+++ b/arch/i386/power/cpu.c
@@ -8,25 +8,8 @@
  */
 
 #include <linux/config.h>
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
-#include <linux/types.h>
-#include <linux/spinlock.h>
-#include <linux/poll.h>
-#include <linux/delay.h>
-#include <linux/sysrq.h>
-#include <linux/proc_fs.h>
-#include <linux/irq.h>
-#include <linux/pm.h>
-#include <linux/device.h>
 #include <linux/suspend.h>
-#include <linux/acpi.h>
-
-#include <asm/uaccess.h>
-#include <asm/acpi.h>
-#include <asm/tlbflush.h>
-#include <asm/processor.h>
 
 static struct saved_context saved_context;
 
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index ed25d66c8d50..945c15a0722b 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -298,11 +298,6 @@ config PREEMPT
 
 source "mm/Kconfig"
 
-config HAVE_DEC_LOCK
-        bool
-        depends on (SMP || PREEMPT)
-        default y
-
 config IA32_SUPPORT
         bool "Support for Linux/x86 binaries"
         help
diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
index 70f8ed2748d1..67932ad53082 100644
--- a/arch/ia64/Makefile
+++ b/arch/ia64/Makefile
@@ -82,17 +82,7 @@ unwcheck: vmlinux
 archclean:
         $(Q)$(MAKE) $(clean)=$(boot)
 
-archprepare:  include/asm-ia64/.offsets.h.stamp
-
-include/asm-ia64/.offsets.h.stamp:
-        mkdir -p include/asm-ia64
-        [ -s include/asm-ia64/asm-offsets.h ] \
-        || echo "#define IA64_TASK_SIZE 0" > include/asm-ia64/asm-offsets.h
-        touch $@
-
-
-
-CLEAN_FILES += vmlinux.gz bootloader include/asm-ia64/.offsets.h.stamp
+CLEAN_FILES += vmlinux.gz bootloader
 
 boot:   lib/lib.a vmlinux
         $(Q)$(MAKE) $(build)=$(boot) $@
diff --git a/arch/ia64/hp/sim/simscsi.c b/arch/ia64/hp/sim/simscsi.c
index 56405dbfd739..a18983a3c934 100644
--- a/arch/ia64/hp/sim/simscsi.c
+++ b/arch/ia64/hp/sim/simscsi.c
@@ -233,6 +233,23 @@ simscsi_readwrite10 (struct scsi_cmnd *sc, int mode)
                 simscsi_readwrite(sc, mode, offset, ((sc->cmnd[7] << 8) | sc->cmnd[8])*512);
 }
 
+static void simscsi_fillresult(struct scsi_cmnd *sc, char *buf, unsigned len)
+{
+
+        int scatterlen = sc->use_sg;
+        struct scatterlist *slp;
+
+        if (scatterlen == 0)
+                memcpy(sc->request_buffer, buf, len);
+        else for (slp = (struct scatterlist *)sc->buffer; scatterlen-- > 0 && len > 0; slp++) {
+                unsigned thislen = min(len, slp->length);
+
+                memcpy(page_address(slp->page) + slp->offset, buf, thislen);
+                slp++;
+                len -= thislen;
+        }
+}
+
 static int
 simscsi_queuecommand (struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
 {
@@ -240,6 +257,7 @@ simscsi_queuecommand (struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
         char fname[MAX_ROOT_LEN+16];
         size_t disk_size;
         char *buf;
+        char localbuf[36];
 #if DEBUG_SIMSCSI
         register long sp asm ("sp");
 
@@ -263,7 +281,7 @@ simscsi_queuecommand (struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
                                 /* disk doesn't exist... */
                                 break;
                         }
-                        buf = sc->request_buffer;
+                        buf = localbuf;
                         buf[0] = 0;     /* magnetic disk */
                         buf[1] = 0;     /* not a removable medium */
                         buf[2] = 2;     /* SCSI-2 compliant device */
@@ -273,6 +291,7 @@ simscsi_queuecommand (struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
                         buf[6] = 0;     /* reserved */
                         buf[7] = 0;     /* various flags */
                         memcpy(buf + 8, "HP      SIMULATED DISK  0.00",  28);
+                        simscsi_fillresult(sc, buf, 36);
                         sc->result = GOOD;
                         break;
 
@@ -304,16 +323,13 @@ simscsi_queuecommand (struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
                         simscsi_readwrite10(sc, SSC_WRITE);
                         break;
 
-
                       case READ_CAPACITY:
                         if (desc[target_id] < 0 || sc->request_bufflen < 8) {
                                 break;
                         }
-                        buf = sc->request_buffer;
-
+                        buf = localbuf;
                         disk_size = simscsi_get_disk_size(desc[target_id]);
 
-                        /* pretend to be a 1GB disk (partition table contains real stuff): */
                         buf[0] = (disk_size >> 24) & 0xff;
                         buf[1] = (disk_size >> 16) & 0xff;
                         buf[2] = (disk_size >>  8) & 0xff;
@@ -323,13 +339,14 @@ simscsi_queuecommand (struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
                         buf[5] = 0;
                         buf[6] = 2;
                         buf[7] = 0;
+                        simscsi_fillresult(sc, buf, 8);
                         sc->result = GOOD;
                         break;
 
                       case MODE_SENSE:
                       case MODE_SENSE_10:
                         /* sd.c uses this to determine whether disk does write-caching. */
-                        memset(sc->request_buffer, 0, 128);
+                        simscsi_fillresult(sc, (char *)empty_zero_page, sc->request_bufflen);
                         sc->result = GOOD;
                         break;
 
diff --git a/arch/ia64/ia32/binfmt_elf32.c b/arch/ia64/ia32/binfmt_elf32.c
index 31de70b7c67f..a7280d9f6c16 100644
--- a/arch/ia64/ia32/binfmt_elf32.c
+++ b/arch/ia64/ia32/binfmt_elf32.c
@@ -216,12 +216,6 @@ ia32_setup_arg_pages (struct linux_binprm *bprm, int executable_stack)
         if (!mpnt)
                 return -ENOMEM;
 
-        if (security_vm_enough_memory((IA32_STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p))
-                                      >> PAGE_SHIFT)) {
-                kmem_cache_free(vm_area_cachep, mpnt);
-                return -ENOMEM;
-        }
-
         memset(mpnt, 0, sizeof(*mpnt));
 
         down_write(&current->mm->mmap_sem);
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 28a4529fdd60..7e926471e4ec 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -899,7 +899,7 @@ int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base)
         if ((err = iosapic_init(phys_addr, gsi_base)))
                 return err;
 
-#if CONFIG_ACPI_NUMA
+#ifdef CONFIG_ACPI_NUMA
         acpi_map_iosapic(handle, 0, NULL, NULL);
 #endif                          /* CONFIG_ACPI_NUMA */
 
diff --git a/arch/ia64/kernel/asm-offsets.c b/arch/ia64/kernel/asm-offsets.c
index f6a234289341..77225659e968 100644
--- a/arch/ia64/kernel/asm-offsets.c
+++ b/arch/ia64/kernel/asm-offsets.c
@@ -4,6 +4,7 @@
  * to extract and format the required data.
  */
 
+#define ASM_OFFSETS_C 1
 #include <linux/config.h>
 
 #include <linux/sched.h>
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index ba0b6a1f429f..0741b066b98f 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -491,7 +491,7 @@ GLOBAL_ENTRY(prefetch_stack)
         ;;
         lfetch.fault [r16], 128
         br.ret.sptk.many rp
-END(prefetch_switch_stack)
+END(prefetch_stack)
 
 GLOBAL_ENTRY(execve)
         mov r15=__NR_execve                     // put syscall number in place
diff --git a/arch/ia64/kernel/mca_asm.S b/arch/ia64/kernel/mca_asm.S
index 499a065f4e60..db32fc1d3935 100644
--- a/arch/ia64/kernel/mca_asm.S
+++ b/arch/ia64/kernel/mca_asm.S
@@ -489,24 +489,27 @@ ia64_state_save:
         ;;
         st8 [temp1]=r17,16      // pal_min_state
         st8 [temp2]=r6,16       // prev_IA64_KR_CURRENT
+        mov r6=IA64_KR(CURRENT_STACK)
+        ;;
+        st8 [temp1]=r6,16       // prev_IA64_KR_CURRENT_STACK
+        st8 [temp2]=r0,16       // prev_task, starts off as NULL
         mov r6=cr.ifa
         ;;
-        st8 [temp1]=r0,16       // prev_task, starts off as NULL
-        st8 [temp2]=r12,16      // cr.isr
+        st8 [temp1]=r12,16      // cr.isr
+        st8 [temp2]=r6,16       // cr.ifa
         mov r12=cr.itir
         ;;
-        st8 [temp1]=r6,16       // cr.ifa
-        st8 [temp2]=r12,16      // cr.itir
+        st8 [temp1]=r12,16      // cr.itir
+        st8 [temp2]=r11,16      // cr.iipa
         mov r12=cr.iim
         ;;
-        st8 [temp1]=r11,16      // cr.iipa
-        st8 [temp2]=r12,16      // cr.iim
-        mov r6=cr.iha
+        st8 [temp1]=r12,16      // cr.iim
 (p1)    mov r12=IA64_MCA_COLD_BOOT
 (p2)    mov r12=IA64_INIT_WARM_BOOT
+        mov r6=cr.iha
         ;;
-        st8 [temp1]=r6,16       // cr.iha
-        st8 [temp2]=r12         // os_status, default is cold boot
+        st8 [temp2]=r6,16       // cr.iha
+        st8 [temp1]=r12         // os_status, default is cold boot
         mov r6=IA64_MCA_SAME_CONTEXT
         ;;
         st8 [temp1]=r6          // context, default is same context
@@ -823,9 +826,12 @@ ia64_state_restore:
         ld8 r12=[temp1],16      // sal_ra
         ld8 r9=[temp2],16       // sal_gp
         ;;
-        ld8 r22=[temp1],24      // pal_min_state, virtual.  skip prev_task
+        ld8 r22=[temp1],16      // pal_min_state, virtual
         ld8 r21=[temp2],16      // prev_IA64_KR_CURRENT
         ;;
+        ld8 r16=[temp1],16      // prev_IA64_KR_CURRENT_STACK
+        ld8 r20=[temp2],16      // prev_task
+        ;;
         ld8 temp3=[temp1],16    // cr.isr
         ld8 temp4=[temp2],16    // cr.ifa
         ;;
@@ -846,6 +852,45 @@ ia64_state_restore:
         ld8 r8=[temp1]          // os_status
         ld8 r10=[temp2]         // context
 
+        /* Wire IA64_TR_CURRENT_STACK to the stack that we are resuming to.  To
+         * avoid any dependencies on the algorithm in ia64_switch_to(), just
+         * purge any existing CURRENT_STACK mapping and insert the new one.
+         *
+         * r16 contains prev_IA64_KR_CURRENT_STACK, r21 contains
+         * prev_IA64_KR_CURRENT, these values may have been changed by the C
+         * code.  Do not use r8, r9, r10, r22, they contain values ready for
+         * the return to SAL.
+         */
+
+        mov r15=IA64_KR(CURRENT_STACK)          // physical granule mapped by IA64_TR_CURRENT_STACK
+        ;;
+        shl r15=r15,IA64_GRANULE_SHIFT
+        ;;
+        dep r15=-1,r15,61,3                     // virtual granule
+        mov r18=IA64_GRANULE_SHIFT<<2           // for cr.itir.ps
+        ;;
+        ptr.d r15,r18
+        ;;
+        srlz.d
+
+        extr.u r19=r21,61,3                     // r21 = prev_IA64_KR_CURRENT
+        shl r20=r16,IA64_GRANULE_SHIFT          // r16 = prev_IA64_KR_CURRENT_STACK
+        movl r21=PAGE_KERNEL                    // page properties
+        ;;
+        mov IA64_KR(CURRENT_STACK)=r16
+        cmp.ne p6,p0=RGN_KERNEL,r19             // new stack is in the kernel region?
+        or r21=r20,r21                          // construct PA | page properties
+(p6)    br.spnt 1f                              // the dreaded cpu 0 idle task in region 5:(
+        ;;
+        mov cr.itir=r18
+        mov cr.ifa=r21
+        mov r20=IA64_TR_CURRENT_STACK
+        ;;
+        itr.d dtr[r20]=r21
+        ;;
+        srlz.d
+1:
+
         br.sptk b0
 
 //EndStub//////////////////////////////////////////////////////////////////////
@@ -982,6 +1027,7 @@ ia64_set_kernel_registers:
         add temp4=temp4, temp1  // &struct ia64_sal_os_state.os_gp
         add r12=temp1, temp3    // kernel stack pointer on MCA/INIT stack
         add r13=temp1, r3       // set current to start of MCA/INIT stack
+        add r20=temp1, r3       // physical start of MCA/INIT stack
         ;;
         ld8 r1=[temp4]          // OS GP from SAL OS state
         ;;
@@ -991,7 +1037,35 @@ ia64_set_kernel_registers:
         ;;
         mov IA64_KR(CURRENT)=r13
 
-        // FIXME: do I need to wire IA64_KR_CURRENT_STACK and IA64_TR_CURRENT_STACK?
+        /* Wire IA64_TR_CURRENT_STACK to the MCA/INIT handler stack.  To avoid
+         * any dependencies on the algorithm in ia64_switch_to(), just purge
+         * any existing CURRENT_STACK mapping and insert the new one.
+         */
+
+        mov r16=IA64_KR(CURRENT_STACK)          // physical granule mapped by IA64_TR_CURRENT_STACK
+        ;;
+        shl r16=r16,IA64_GRANULE_SHIFT
+        ;;
+        dep r16=-1,r16,61,3                     // virtual granule
+        mov r18=IA64_GRANULE_SHIFT<<2           // for cr.itir.ps
+        ;;
+        ptr.d r16,r18
+        ;;
+        srlz.d
+
+        shr.u r16=r20,IA64_GRANULE_SHIFT        // r20 = physical start of MCA/INIT stack
+        movl r21=PAGE_KERNEL                    // page properties
+        ;;
+        mov IA64_KR(CURRENT_STACK)=r16
+        or r21=r20,r21                          // construct PA | page properties
+        ;;
+        mov cr.itir=r18
+        mov cr.ifa=r13
+        mov r20=IA64_TR_CURRENT_STACK
+        ;;
+        itr.d dtr[r20]=r21
+        ;;
+        srlz.d
 
         br.sptk b0
 
diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c
index 6e683745af49..f081c60ab206 100644
--- a/arch/ia64/kernel/mca_drv.c
+++ b/arch/ia64/kernel/mca_drv.c
@@ -56,8 +56,9 @@ static struct page *page_isolate[MAX_PAGE_ISOLATE];
 static int num_page_isolate = 0;
 
 typedef enum {
-        ISOLATE_NG = 0,
-        ISOLATE_OK = 1
+        ISOLATE_NG,
+        ISOLATE_OK,
+        ISOLATE_NONE
 } isolate_status_t;
 
 /*
@@ -74,7 +75,7 @@ static struct {
  * @paddr:      poisoned memory location
  *
  * Return value:
- *      ISOLATE_OK / ISOLATE_NG
+ *      one of isolate_status_t, ISOLATE_OK/NG/NONE.
  */
 
 static isolate_status_t
@@ -84,23 +85,26 @@ mca_page_isolate(unsigned long paddr)
         struct page *p;
 
         /* whether physical address is valid or not */
-        if ( !ia64_phys_addr_valid(paddr) ) 
-                return ISOLATE_NG;
+        if (!ia64_phys_addr_valid(paddr))
+                return ISOLATE_NONE;
+
+        if (!pfn_valid(paddr))
+                return ISOLATE_NONE;
 
         /* convert physical address to physical page number */
         p = pfn_to_page(paddr>>PAGE_SHIFT);
 
         /* check whether a page number have been already registered or not */
-        for( i = 0; i < num_page_isolate; i++ )
-                if( page_isolate[i] == p )
+        for (i = 0; i < num_page_isolate; i++)
+                if (page_isolate[i] == p)
                         return ISOLATE_OK; /* already listed */
 
         /* limitation check */
-        if( num_page_isolate == MAX_PAGE_ISOLATE ) 
+        if (num_page_isolate == MAX_PAGE_ISOLATE)
                 return ISOLATE_NG;
 
         /* kick pages having attribute 'SLAB' or 'Reserved' */
-        if( PageSlab(p) || PageReserved(p) ) 
+        if (PageSlab(p) || PageReserved(p))
                 return ISOLATE_NG;
 
         /* add attribute 'Reserved' and register the page */
@@ -122,10 +126,15 @@ mca_handler_bh(unsigned long paddr)
                 current->pid, current->comm);
 
         spin_lock(&mca_bh_lock);
-        if (mca_page_isolate(paddr) == ISOLATE_OK) {
+        switch (mca_page_isolate(paddr)) {
+        case ISOLATE_OK:
                 printk(KERN_DEBUG "Page isolation: ( %lx ) success.\n", paddr);
-        } else {
+                break;
+        case ISOLATE_NG:
                 printk(KERN_DEBUG "Page isolation: ( %lx ) failure.\n", paddr);
+                break;
+        default:
+                break;
         }
         spin_unlock(&mca_bh_lock);
 
@@ -139,10 +148,10 @@ mca_handler_bh(unsigned long paddr)
  * @peidx:      pointer to index of processor error section
  */
 
-static void 
+static void
 mca_make_peidx(sal_log_processor_info_t *slpi, peidx_table_t *peidx)
 {
-        /* 
+        /*
          * calculate the start address of
          *   "struct cpuid_info" and "sal_processor_static_info_t".
          */
@@ -164,7 +173,7 @@ mca_make_peidx(sal_log_processor_info_t *slpi, peidx_table_t *peidx)
 }
 
 /**
- * mca_make_slidx -  Make index of SAL error record 
+ * mca_make_slidx -  Make index of SAL error record
  * @buffer:     pointer to SAL error record
  * @slidx:      pointer to index of SAL error record
  *
@@ -172,12 +181,12 @@ mca_make_peidx(sal_log_processor_info_t *slpi, peidx_table_t *peidx)
  *      1 if record has platform error / 0 if not
  */
 #define LOG_INDEX_ADD_SECT_PTR(sect, ptr) \
-        { slidx_list_t *hl = &slidx_pool.buffer[slidx_pool.cur_idx]; \
-          hl->hdr = ptr; \
-          list_add(&hl->list, &(sect)); \
-          slidx_pool.cur_idx = (slidx_pool.cur_idx + 1)%slidx_pool.max_idx; }
+        {slidx_list_t *hl = &slidx_pool.buffer[slidx_pool.cur_idx]; \
+        hl->hdr = ptr; \
+        list_add(&hl->list, &(sect)); \
+        slidx_pool.cur_idx = (slidx_pool.cur_idx + 1)%slidx_pool.max_idx; }
 
-static int 
+static int
 mca_make_slidx(void *buffer, slidx_table_t *slidx)
 {
         int platform_err = 0;
@@ -214,28 +223,36 @@ mca_make_slidx(void *buffer, slidx_table_t *slidx)
                 sp = (sal_log_section_hdr_t *)((char*)buffer + ercd_pos);
                 if (!efi_guidcmp(sp->guid, SAL_PROC_DEV_ERR_SECT_GUID)) {
                         LOG_INDEX_ADD_SECT_PTR(slidx->proc_err, sp);
-                } else if (!efi_guidcmp(sp->guid, SAL_PLAT_MEM_DEV_ERR_SECT_GUID)) {
+                } else if (!efi_guidcmp(sp->guid,
+                                SAL_PLAT_MEM_DEV_ERR_SECT_GUID)) {
                         platform_err = 1;
                         LOG_INDEX_ADD_SECT_PTR(slidx->mem_dev_err, sp);
-                } else if (!efi_guidcmp(sp->guid, SAL_PLAT_SEL_DEV_ERR_SECT_GUID)) {
+                } else if (!efi_guidcmp(sp->guid,
+                                SAL_PLAT_SEL_DEV_ERR_SECT_GUID)) {
                         platform_err = 1;
                         LOG_INDEX_ADD_SECT_PTR(slidx->sel_dev_err, sp);
-                } else if (!efi_guidcmp(sp->guid, SAL_PLAT_PCI_BUS_ERR_SECT_GUID)) {
+                } else if (!efi_guidcmp(sp->guid,
+                                SAL_PLAT_PCI_BUS_ERR_SECT_GUID)) {
                         platform_err = 1;
                         LOG_INDEX_ADD_SECT_PTR(slidx->pci_bus_err, sp);
-                } else if (!efi_guidcmp(sp->guid, SAL_PLAT_SMBIOS_DEV_ERR_SECT_GUID)) {
+                } else if (!efi_guidcmp(sp->guid,
+                                SAL_PLAT_SMBIOS_DEV_ERR_SECT_GUID)) {
                         platform_err = 1;
                         LOG_INDEX_ADD_SECT_PTR(slidx->smbios_dev_err, sp);
-                } else if (!efi_guidcmp(sp->guid, SAL_PLAT_PCI_COMP_ERR_SECT_GUID)) {
+                } else if (!efi_guidcmp(sp->guid,
+                                SAL_PLAT_PCI_COMP_ERR_SECT_GUID)) {
                         platform_err = 1;
                         LOG_INDEX_ADD_SECT_PTR(slidx->pci_comp_err, sp);
-                } else if (!efi_guidcmp(sp->guid, SAL_PLAT_SPECIFIC_ERR_SECT_GUID)) {
+                } else if (!efi_guidcmp(sp->guid,
+                                SAL_PLAT_SPECIFIC_ERR_SECT_GUID)) {
                         platform_err = 1;
                         LOG_INDEX_ADD_SECT_PTR(slidx->plat_specific_err, sp);
-                } else if (!efi_guidcmp(sp->guid, SAL_PLAT_HOST_CTLR_ERR_SECT_GUID)) {
+                } else if (!efi_guidcmp(sp->guid,
+                                SAL_PLAT_HOST_CTLR_ERR_SECT_GUID)) {
                         platform_err = 1;
                         LOG_INDEX_ADD_SECT_PTR(slidx->host_ctlr_err, sp);
-                } else if (!efi_guidcmp(sp->guid, SAL_PLAT_BUS_ERR_SECT_GUID)) {
+                } else if (!efi_guidcmp(sp->guid,
+                                SAL_PLAT_BUS_ERR_SECT_GUID)) {
                         platform_err = 1;
                         LOG_INDEX_ADD_SECT_PTR(slidx->plat_bus_err, sp);
                 } else {
@@ -253,15 +270,16 @@ mca_make_slidx(void *buffer, slidx_table_t *slidx)
  * Return value:
  *      0 on Success / -ENOMEM on Failure
  */
-static int 
+static int
 init_record_index_pools(void)
 {
         int i;
         int rec_max_size;  /* Maximum size of SAL error records */
         int sect_min_size; /* Minimum size of SAL error sections */
         /* minimum size table of each section */
-        static int sal_log_sect_min_sizes[] = { 
-                sizeof(sal_log_processor_info_t) + sizeof(sal_processor_static_info_t),
+        static int sal_log_sect_min_sizes[] = {
+                sizeof(sal_log_processor_info_t)
+                + sizeof(sal_processor_static_info_t),
                 sizeof(sal_log_mem_dev_err_info_t),
                 sizeof(sal_log_sel_dev_err_info_t),
                 sizeof(sal_log_pci_bus_err_info_t),
@@ -294,7 +312,8 @@ init_record_index_pools(void)
 
         /* - 3 - */
         slidx_pool.max_idx = (rec_max_size/sect_min_size) * 2 + 1;
-        slidx_pool.buffer = (slidx_list_t *) kmalloc(slidx_pool.max_idx * sizeof(slidx_list_t), GFP_KERNEL);
+        slidx_pool.buffer = (slidx_list_t *)
+                kmalloc(slidx_pool.max_idx * sizeof(slidx_list_t), GFP_KERNEL);
 
         return slidx_pool.buffer ? 0 : -ENOMEM;
 }
@@ -308,6 +327,7 @@ init_record_index_pools(void)
  * is_mca_global - Check whether this MCA is global or not
  * @peidx:      pointer of index of processor error section
  * @pbci:       pointer to pal_bus_check_info_t
+ * @sos:        pointer to hand off struct between SAL and OS
  *
  * Return value:
  *      MCA_IS_LOCAL / MCA_IS_GLOBAL
@@ -317,11 +337,12 @@ static mca_type_t
 is_mca_global(peidx_table_t *peidx, pal_bus_check_info_t *pbci,
               struct ia64_sal_os_state *sos)
 {
-        pal_processor_state_info_t *psp = (pal_processor_state_info_t*)peidx_psp(peidx);
+        pal_processor_state_info_t *psp =
+                (pal_processor_state_info_t*)peidx_psp(peidx);
 
-        /* 
+        /*
          * PAL can request a rendezvous, if the MCA has a global scope.
-         * If "rz_always" flag is set, SAL requests MCA rendezvous 
+         * If "rz_always" flag is set, SAL requests MCA rendezvous
          * in spite of global MCA.
          * Therefore it is local MCA when rendezvous has not been requested.
          * Failed to rendezvous, the system must be down.
@@ -381,13 +402,15 @@ is_mca_global(peidx_table_t *peidx, pal_bus_check_info_t *pbci,
  * @slidx:      pointer of index of SAL error record
  * @peidx:      pointer of index of processor error section
  * @pbci:       pointer of pal_bus_check_info
+ * @sos:        pointer to hand off struct between SAL and OS
  *
  * Return value:
  *      1 on Success / 0 on Failure
  */
 
 static int
-recover_from_read_error(slidx_table_t *slidx, peidx_table_t *peidx, pal_bus_check_info_t *pbci,
+recover_from_read_error(slidx_table_t *slidx,
+                        peidx_table_t *peidx, pal_bus_check_info_t *pbci,
                         struct ia64_sal_os_state *sos)
 {
         sal_log_mod_error_info_t *smei;
@@ -453,24 +476,28 @@ recover_from_read_error(slidx_table_t *slidx, peidx_table_t *peidx, pal_bus_chec
  * @slidx:      pointer of index of SAL error record
  * @peidx:      pointer of index of processor error section
  * @pbci:       pointer of pal_bus_check_info
+ * @sos:        pointer to hand off struct between SAL and OS
  *
  * Return value:
  *      1 on Success / 0 on Failure
  */
 
 static int
-recover_from_platform_error(slidx_table_t *slidx, peidx_table_t *peidx, pal_bus_check_info_t *pbci,
+recover_from_platform_error(slidx_table_t *slidx, peidx_table_t *peidx,
+                            pal_bus_check_info_t *pbci,
                             struct ia64_sal_os_state *sos)
 {
         int status = 0;
-        pal_processor_state_info_t *psp = (pal_processor_state_info_t*)peidx_psp(peidx);
+        pal_processor_state_info_t *psp =
+                (pal_processor_state_info_t*)peidx_psp(peidx);
 
         if (psp->bc && pbci->eb && pbci->bsi == 0) {
                 switch(pbci->type) {
                 case 1: /* partial read */
                 case 3: /* full line(cpu) read */
                 case 9: /* I/O space read */
-                        status = recover_from_read_error(slidx, peidx, pbci, sos);
+                        status = recover_from_read_error(slidx, peidx, pbci,
+                                                         sos);
                         break;
                 case 0: /* unknown */
                 case 2: /* partial write */
@@ -481,7 +508,8 @@ recover_from_platform_error(slidx_table_t *slidx, peidx_table_t *peidx, pal_bus_
                 case 8: /* write coalescing transactions */
                 case 10: /* I/O space write */
                 case 11: /* inter-processor interrupt message(IPI) */
-                case 12: /* interrupt acknowledge or external task priority cycle */
+                case 12: /* interrupt acknowledge or
+                                external task priority cycle */
                 default:
                         break;
                 }
@@ -496,6 +524,7 @@ recover_from_platform_error(slidx_table_t *slidx, peidx_table_t *peidx, pal_bus_
  * @slidx:      pointer of index of SAL error record
  * @peidx:      pointer of index of processor error section
  * @pbci:       pointer of pal_bus_check_info
+ * @sos:        pointer to hand off struct between SAL and OS
  *
  * Return value:
  *      1 on Success / 0 on Failure
@@ -509,15 +538,17 @@ recover_from_platform_error(slidx_table_t *slidx, peidx_table_t *peidx, pal_bus_
  */
 
 static int
-recover_from_processor_error(int platform, slidx_table_t *slidx, peidx_table_t *peidx, pal_bus_check_info_t *pbci,
+recover_from_processor_error(int platform, slidx_table_t *slidx,
+                             peidx_table_t *peidx, pal_bus_check_info_t *pbci,
                              struct ia64_sal_os_state *sos)
 {
-        pal_processor_state_info_t *psp = (pal_processor_state_info_t*)peidx_psp(peidx);
+        pal_processor_state_info_t *psp =
+                (pal_processor_state_info_t*)peidx_psp(peidx);
 
-        /* 
+        /*
          * We cannot recover errors with other than bus_check.
          */
-        if (psp->cc || psp->rc || psp->uc) 
+        if (psp->cc || psp->rc || psp->uc)
                 return 0;
 
         /*
@@ -546,10 +577,10 @@ recover_from_processor_error(int platform, slidx_table_t *slidx, peidx_table_t *
          * (e.g. a load from poisoned memory)
          * This means "there are some platform errors".
          */
-        if (platform) 
+        if (platform)
                 return recover_from_platform_error(slidx, peidx, pbci, sos);
-        /* 
-         * On account of strange SAL error record, we cannot recover. 
+        /*
+         * On account of strange SAL error record, we cannot recover.
          */
         return 0;
 }
@@ -557,14 +588,14 @@ recover_from_processor_error(int platform, slidx_table_t *slidx, peidx_table_t *
 /**
  * mca_try_to_recover - Try to recover from MCA
  * @rec:        pointer to a SAL error record
+ * @sos:        pointer to hand off struct between SAL and OS
  *
  * Return value:
  *      1 on Success / 0 on Failure
  */
 
 static int
-mca_try_to_recover(void *rec, 
-        struct ia64_sal_os_state *sos)
+mca_try_to_recover(void *rec, struct ia64_sal_os_state *sos)
 {
         int platform_err;
         int n_proc_err;
@@ -588,7 +619,8 @@ mca_try_to_recover(void *rec,
         }
 
         /* Make index of processor error section */
-        mca_make_peidx((sal_log_processor_info_t*)slidx_first_entry(&slidx.proc_err)->hdr, &peidx);
+        mca_make_peidx((sal_log_processor_info_t*)
+                slidx_first_entry(&slidx.proc_err)->hdr, &peidx);
 
         /* Extract Processor BUS_CHECK[0] */
         *((u64*)&pbci) = peidx_check_info(&peidx, bus_check, 0);
@@ -598,7 +630,8 @@ mca_try_to_recover(void *rec,
                 return 0;
         
         /* Try to recover a processor error */
-        return recover_from_processor_error(platform_err, &slidx, &peidx, &pbci, sos);
+        return recover_from_processor_error(platform_err, &slidx, &peidx,
+                                            &pbci, sos);
 }
 
 /*
@@ -611,7 +644,7 @@ int __init mca_external_handler_init(void)
                 return -ENOMEM;
 
         /* register external mca handlers */
-        if (ia64_reg_MCA_extension(mca_try_to_recover)){        
+        if (ia64_reg_MCA_extension(mca_try_to_recover)) {       
                 printk(KERN_ERR "ia64_reg_MCA_extension failed.\n");
                 kfree(slidx_pool.buffer);
                 return -EFAULT;
diff --git a/arch/ia64/kernel/mca_drv.h b/arch/ia64/kernel/mca_drv.h
index 0227b761f2c4..e2f6fa1e0ef6 100644
--- a/arch/ia64/kernel/mca_drv.h
+++ b/arch/ia64/kernel/mca_drv.h
@@ -6,7 +6,7 @@
  * Copyright (C) Hidetoshi Seto (seto.hidetoshi@jp.fujitsu.com)
  */
 /*
- * Processor error section: 
+ * Processor error section:
  *
  *  +-sal_log_processor_info_t *info-------------+
  *  | sal_log_section_hdr_t header;              |
diff --git a/arch/ia64/kernel/mca_drv_asm.S b/arch/ia64/kernel/mca_drv_asm.S
index 2d7e0217638d..3f298ee4d00c 100644
--- a/arch/ia64/kernel/mca_drv_asm.S
+++ b/arch/ia64/kernel/mca_drv_asm.S
@@ -13,45 +13,45 @@
 #include <asm/ptrace.h>
 
 GLOBAL_ENTRY(mca_handler_bhhook)
-        invala                                          // clear RSE ?
-        ;;                                              //
-        cover                                           // 
-        ;;                                              //
-        clrrrb                                          //
+        invala                          // clear RSE ?
+        ;;
+        cover
+        ;;
+        clrrrb
         ;;                                              
-        alloc           r16=ar.pfs,0,2,1,0              // make a new frame
+        alloc   r16=ar.pfs,0,2,1,0      // make a new frame
         ;;
-        mov             ar.rsc=0
+        mov     ar.rsc=0
         ;;
-        mov             r13=IA64_KR(CURRENT)            // current task pointer
+        mov     r13=IA64_KR(CURRENT)    // current task pointer
         ;;
-        mov             r2=r13
+        mov     r2=r13
         ;;
-        addl            r22=IA64_RBS_OFFSET,r2
+        addl    r22=IA64_RBS_OFFSET,r2
         ;;
-        mov             ar.bspstore=r22
+        mov     ar.bspstore=r22
         ;;
-        addl            sp=IA64_STK_OFFSET-IA64_PT_REGS_SIZE,r2
+        addl    sp=IA64_STK_OFFSET-IA64_PT_REGS_SIZE,r2
         ;;
-        adds            r2=IA64_TASK_THREAD_ON_USTACK_OFFSET,r13
+        adds    r2=IA64_TASK_THREAD_ON_USTACK_OFFSET,r13
         ;;
-        st1             [r2]=r0                         // clear current->thread.on_ustack flag
-        mov             loc0=r16
-        movl            loc1=mca_handler_bh             // recovery C function
+        st1     [r2]=r0         // clear current->thread.on_ustack flag
+        mov     loc0=r16
+        movl    loc1=mca_handler_bh     // recovery C function
         ;;
-        mov             out0=r8                         // poisoned address
-        mov             b6=loc1
+        mov     out0=r8                 // poisoned address
+        mov     b6=loc1
         ;;
-        mov             loc1=rp
+        mov     loc1=rp
         ;;
-        ssm             psr.i
+        ssm     psr.i
         ;;
-        br.call.sptk.many    rp=b6                      // does not return ...
+        br.call.sptk.many rp=b6         // does not return ...
         ;;
-        mov             ar.pfs=loc0
-        mov             rp=loc1
+        mov     ar.pfs=loc0
+        mov     rp=loc1
         ;;
-        mov             r8=r0
+        mov     r8=r0
         br.ret.sptk.many rp
         ;;
 END(mca_handler_bhhook)
diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
index 1650353e3f77..d71731ee5b61 100644
--- a/arch/ia64/kernel/perfmon.c
+++ b/arch/ia64/kernel/perfmon.c
@@ -574,7 +574,7 @@ pfm_protect_ctx_ctxsw(pfm_context_t *x)
         return 0UL;
 }
 
-static inline unsigned long
+static inline void
 pfm_unprotect_ctx_ctxsw(pfm_context_t *x, unsigned long f)
 {
         spin_unlock(&(x)->ctx_lock);
@@ -2218,12 +2218,13 @@ static void
 pfm_free_fd(int fd, struct file *file)
 {
         struct files_struct *files = current->files;
-        struct fdtable *fdt = files_fdtable(files);
+        struct fdtable *fdt;
 
         /* 
          * there ie no fd_uninstall(), so we do it here
          */
         spin_lock(&files->file_lock);
+        fdt = files_fdtable(files);
         rcu_assign_pointer(fdt->fd[fd], NULL);
         spin_unlock(&files->file_lock);
 
diff --git a/arch/ia64/lib/Makefile b/arch/ia64/lib/Makefile
index 799407e7726f..cb1af597370b 100644
--- a/arch/ia64/lib/Makefile
+++ b/arch/ia64/lib/Makefile
@@ -15,7 +15,6 @@ lib-$(CONFIG_ITANIUM)	+= copy_page.o copy_user.o memcpy.o
 lib-$(CONFIG_MCKINLEY)  += copy_page_mck.o memcpy_mck.o
 lib-$(CONFIG_PERFMON)   += carta_random.o
 lib-$(CONFIG_MD_RAID5)  += xor.o
-lib-$(CONFIG_HAVE_DEC_LOCK) += dec_and_lock.o
 
 AFLAGS___divdi3.o       =
 AFLAGS___udivdi3.o      = -DUNSIGNED
diff --git a/arch/ia64/lib/dec_and_lock.c b/arch/ia64/lib/dec_and_lock.c
deleted file mode 100644
index c7ce92f968f1..000000000000
--- a/arch/ia64/lib/dec_and_lock.c
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2003 Jerome Marchand, Bull S.A.
- *      Cleaned up by David Mosberger-Tang <davidm@hpl.hp.com>
- *
- * This file is released under the GPLv2, or at your option any later version.
- *
- * ia64 version of "atomic_dec_and_lock()" using the atomic "cmpxchg" instruction.  This
- * code is an adaptation of the x86 version of "atomic_dec_and_lock()".
- */
-
-#include <linux/compiler.h>
-#include <linux/module.h>
-#include <linux/spinlock.h>
-#include <asm/atomic.h>
-
-/*
- * Decrement REFCOUNT and if the count reaches zero, acquire the spinlock.  Both of these
- * operations have to be done atomically, so that the count doesn't drop to zero without
- * acquiring the spinlock first.
- */
-int
-_atomic_dec_and_lock (atomic_t *refcount, spinlock_t *lock)
-{
-        int old, new;
-
-        do {
-                old = atomic_read(refcount);
-                new = old - 1;
-
-                if (unlikely (old == 1)) {
-                        /* oops, we may be decrementing to zero, do it the slow way... */
-                        spin_lock(lock);
-                        if (atomic_dec_and_test(refcount))
-                                return 1;
-                        spin_unlock(lock);
-                        return 0;
-                }
-        } while (cmpxchg(&refcount->counter, old, new) != old);
-        return 0;
-}
-
-EXPORT_SYMBOL(_atomic_dec_and_lock);
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index 1ef3987ebc6a..4d100f3886e1 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -220,11 +220,6 @@ config PREEMPT
           Say Y here if you are building a kernel for a desktop, embedded
           or real-time system.  Say N if you are unsure.
 
-config HAVE_DEC_LOCK
-        bool
-        depends on (SMP || PREEMPT)
-        default n
-
 config SMP
         bool "Symmetric multi-processing support"
         ---help---
diff --git a/arch/m32r/Makefile b/arch/m32r/Makefile
index dd4418d846e9..983d438b14b6 100644
--- a/arch/m32r/Makefile
+++ b/arch/m32r/Makefile
@@ -24,7 +24,7 @@ aflags-$(CONFIG_ISA_M32R)	+= -DNO_FPU -Wa,-no-bitinst
 CFLAGS += $(cflags-y)
 AFLAGS += $(aflags-y)
 
-CHECKFLAGS      := $(CHECK) -D__m32r__
+CHECKFLAGS      += -D__m32r__ -D__BIG_ENDIAN__=1
 
 head-y  := arch/m32r/kernel/head.o arch/m32r/kernel/init_task.o
 
diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
index 6c6855f1aa05..ce16bbe26a52 100644
--- a/arch/m32r/lib/usercopy.c
+++ b/arch/m32r/lib/usercopy.c
@@ -13,7 +13,7 @@
 #include <asm/uaccess.h>
 
 unsigned long
-__generic_copy_to_user(void *to, const void *from, unsigned long n)
+__generic_copy_to_user(void __user *to, const void *from, unsigned long n)
 {
         prefetch(from);
         if (access_ok(VERIFY_WRITE, to, n))
@@ -22,7 +22,7 @@ __generic_copy_to_user(void *to, const void *from, unsigned long n)
 }
 
 unsigned long
-__generic_copy_from_user(void *to, const void *from, unsigned long n)
+__generic_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
         prefetchw(to);
         if (access_ok(VERIFY_READ, from, n))
@@ -111,7 +111,7 @@ do {									\
 #endif /* CONFIG_ISA_DUAL_ISSUE */
 
 long
-__strncpy_from_user(char *dst, const char *src, long count)
+__strncpy_from_user(char *dst, const char __user *src, long count)
 {
         long res;
         __do_strncpy_from_user(dst, src, count, res);
@@ -119,7 +119,7 @@ __strncpy_from_user(char *dst, const char *src, long count)
 }
 
 long
-strncpy_from_user(char *dst, const char *src, long count)
+strncpy_from_user(char *dst, const char __user *src, long count)
 {
         long res = -EFAULT;
         if (access_ok(VERIFY_READ, src, 1))
@@ -222,7 +222,7 @@ do {									\
 #endif /* not CONFIG_ISA_DUAL_ISSUE */
 
 unsigned long
-clear_user(void *to, unsigned long n)
+clear_user(void __user *to, unsigned long n)
 {
         if (access_ok(VERIFY_WRITE, to, n))
                 __do_clear_user(to, n);
@@ -230,7 +230,7 @@ clear_user(void *to, unsigned long n)
 }
 
 unsigned long
-__clear_user(void *to, unsigned long n)
+__clear_user(void __user *to, unsigned long n)
 {
         __do_clear_user(to, n);
         return n;
@@ -244,7 +244,7 @@ __clear_user(void *to, unsigned long n)
 
 #ifdef CONFIG_ISA_DUAL_ISSUE
 
-long strnlen_user(const char *s, long n)
+long strnlen_user(const char __user *s, long n)
 {
         unsigned long mask = -__addr_ok(s);
         unsigned long res;
@@ -313,7 +313,7 @@ long strnlen_user(const char *s, long n)
 
 #else /* not CONFIG_ISA_DUAL_ISSUE */
 
-long strnlen_user(const char *s, long n)
+long strnlen_user(const char __user *s, long n)
 {
         unsigned long mask = -__addr_ok(s);
         unsigned long res;
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 0eb71ac303af..4cd724c05700 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1009,10 +1009,6 @@ config GENERIC_CALIBRATE_DELAY
         bool
         default y
 
-config HAVE_DEC_LOCK
-        bool
-        default y
-
 #
 # Select some configuration options automatically based on user selections.
 #
diff --git a/arch/mips/kernel/sysirix.c b/arch/mips/kernel/sysirix.c
index 4de155699c4f..7ae4af476974 100644
--- a/arch/mips/kernel/sysirix.c
+++ b/arch/mips/kernel/sysirix.c
@@ -581,18 +581,13 @@ asmlinkage int irix_brk(unsigned long brk)
         }
 
         /*
-         * Check if we have enough memory..
+         * Ok, looks good - let it rip.
          */
-        if (security_vm_enough_memory((newbrk-oldbrk) >> PAGE_SHIFT)) {
+        if (do_brk(oldbrk, newbrk-oldbrk) != oldbrk) {
                 ret = -ENOMEM;
                 goto out;
         }
-
-        /*
-         * Ok, looks good - let it rip.
-         */
         mm->brk = brk;
-        do_brk(oldbrk, newbrk-oldbrk);
         ret = 0;
 
 out:
diff --git a/arch/mips/lib/Makefile b/arch/mips/lib/Makefile
index 21b92b9dd013..037303412909 100644
--- a/arch/mips/lib/Makefile
+++ b/arch/mips/lib/Makefile
@@ -2,7 +2,7 @@
 # Makefile for MIPS-specific library files..
 #
 
-lib-y   += csum_partial_copy.o dec_and_lock.o memcpy.o promlib.o \
+lib-y   += csum_partial_copy.o memcpy.o promlib.o \
            strlen_user.o strncpy_user.o strnlen_user.o
 
 obj-y   += iomap.o
diff --git a/arch/mips/lib/dec_and_lock.c b/arch/mips/lib/dec_and_lock.c
deleted file mode 100644
index fd82c84a93b7..000000000000
--- a/arch/mips/lib/dec_and_lock.c
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * MIPS version of atomic_dec_and_lock() using cmpxchg
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#include <linux/module.h>
-#include <linux/spinlock.h>
-#include <asm/atomic.h>
-#include <asm/system.h>
-
-/*
- * This is an implementation of the notion of "decrement a
- * reference count, and return locked if it decremented to zero".
- *
- * This implementation can be used on any architecture that
- * has a cmpxchg, and where atomic->value is an int holding
- * the value of the atomic (i.e. the high bits aren't used
- * for a lock or anything like that).
- */
-int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock)
-{
-        int counter;
-        int newcount;
-
-        for (;;) {
-                counter = atomic_read(atomic);
-                newcount = counter - 1;
-                if (!newcount)
-                        break;          /* do it the slow way */
-
-                newcount = cmpxchg(&atomic->counter, counter, newcount);
-                if (newcount == counter)
-                        return 0;
-        }
-
-        spin_lock(lock);
-        if (atomic_dec_and_test(atomic))
-                return 1;
-        spin_unlock(lock);
-        return 0;
-}
-
-EXPORT_SYMBOL(_atomic_dec_and_lock);
diff --git a/arch/ppc/Kconfig b/arch/ppc/Kconfig
index 347ea284140b..776941c75672 100644
--- a/arch/ppc/Kconfig
+++ b/arch/ppc/Kconfig
@@ -26,10 +26,6 @@ config GENERIC_CALIBRATE_DELAY
         bool
         default y
 
-config HAVE_DEC_LOCK
-        bool
-        default y
-
 config PPC
         bool
         default y
diff --git a/arch/ppc/boot/ld.script b/arch/ppc/boot/ld.script
index 9362193742ac..d4dd8f15395e 100644
--- a/arch/ppc/boot/ld.script
+++ b/arch/ppc/boot/ld.script
@@ -1,4 +1,4 @@
-OUTPUT_ARCH(powerpc)
+OUTPUT_ARCH(powerpc:common)
 SECTIONS
 {
   /* Read-only sections, merged into text segment: */
diff --git a/arch/ppc/kernel/Makefile b/arch/ppc/kernel/Makefile
index 1fb92f16acd6..b1457a8a9c0f 100644
--- a/arch/ppc/kernel/Makefile
+++ b/arch/ppc/kernel/Makefile
@@ -15,9 +15,8 @@ extra-y				+= vmlinux.lds
 obj-y                           := entry.o traps.o irq.o idle.o time.o misc.o \
                                         process.o signal.o ptrace.o align.o \
                                         semaphore.o syscalls.o setup.o \
-                                        cputable.o ppc_htab.o
+                                        cputable.o ppc_htab.o perfmon.o
 obj-$(CONFIG_6xx)               += l2cr.o cpu_setup_6xx.o
-obj-$(CONFIG_E500)              += perfmon.o
 obj-$(CONFIG_SOFTWARE_SUSPEND)  += swsusp.o
 obj-$(CONFIG_POWER4)            += cpu_setup_power4.o
 obj-$(CONFIG_MODULES)           += module.o ppc_ksyms.o
diff --git a/arch/ppc/kernel/perfmon.c b/arch/ppc/kernel/perfmon.c
index fa1dad96b830..22df9a596a0f 100644
--- a/arch/ppc/kernel/perfmon.c
+++ b/arch/ppc/kernel/perfmon.c
@@ -45,9 +45,8 @@ static void dummy_perf(struct pt_regs *regs)
         mtpmr(PMRN_PMGC0, pmgc0);
 }
 
-#else
+#elif defined(CONFIG_6xx)
 /* Ensure exceptions are disabled */
-
 static void dummy_perf(struct pt_regs *regs)
 {
         unsigned int mmcr0 = mfspr(SPRN_MMCR0);
@@ -55,6 +54,10 @@ static void dummy_perf(struct pt_regs *regs)
         mmcr0 &= ~MMCR0_PMXE;
         mtspr(SPRN_MMCR0, mmcr0);
 }
+#else
+static void dummy_perf(struct pt_regs *regs)
+{
+}
 #endif
 
 void (*perf_irq)(struct pt_regs *) = dummy_perf;
diff --git a/arch/ppc/kernel/temp.c b/arch/ppc/kernel/temp.c
index fe8bb634ead0..26bd8ea35a4e 100644
--- a/arch/ppc/kernel/temp.c
+++ b/arch/ppc/kernel/temp.c
@@ -21,7 +21,6 @@
 #include <linux/interrupt.h>
 #include <linux/init.h>
 
-#include <asm/segment.h>
 #include <asm/io.h>
 #include <asm/reg.h>
 #include <asm/nvram.h>
diff --git a/arch/ppc/kernel/time.c b/arch/ppc/kernel/time.c
index a3c5281a5d2d..22d7fd1e0aea 100644
--- a/arch/ppc/kernel/time.c
+++ b/arch/ppc/kernel/time.c
@@ -58,7 +58,6 @@
 #include <linux/init.h>
 #include <linux/profile.h>
 
-#include <asm/segment.h>
 #include <asm/io.h>
 #include <asm/nvram.h>
 #include <asm/cache.h>
diff --git a/arch/ppc/kernel/vmlinux.lds.S b/arch/ppc/kernel/vmlinux.lds.S
index 9353584fb710..17d2db7e537d 100644
--- a/arch/ppc/kernel/vmlinux.lds.S
+++ b/arch/ppc/kernel/vmlinux.lds.S
@@ -96,6 +96,9 @@ SECTIONS
         *(.init.text)
         _einittext = .;
   }
+  /* .exit.text is discarded at runtime, not link time,
+     to deal with references from __bug_table */
+  .exit.text : { *(.exit.text) }
   .init.data : {
     *(.init.data);
     __vtop_table_begin = .;
@@ -190,5 +193,6 @@ SECTIONS
   /* Sections to be discarded. */
   /DISCARD/ : {
     *(.exitcall.exit)
+    *(.exit.data)
   }
 }
diff --git a/arch/ppc/lib/Makefile b/arch/ppc/lib/Makefile
index f1e1fb4144f0..50358e4ea159 100644
--- a/arch/ppc/lib/Makefile
+++ b/arch/ppc/lib/Makefile
@@ -2,7 +2,7 @@
 # Makefile for ppc-specific library files..
 #
 
-obj-y                   := checksum.o string.o strcase.o dec_and_lock.o div64.o
+obj-y                   := checksum.o string.o strcase.o div64.o
 
 obj-$(CONFIG_8xx)       += rheap.o
 obj-$(CONFIG_CPM2)      += rheap.o
diff --git a/arch/ppc/lib/dec_and_lock.c b/arch/ppc/lib/dec_and_lock.c
deleted file mode 100644
index b18f0d9a00fc..000000000000
--- a/arch/ppc/lib/dec_and_lock.c
+++ /dev/null
@@ -1,38 +0,0 @@
-#include <linux/module.h>
-#include <linux/spinlock.h>
-#include <asm/atomic.h>
-#include <asm/system.h>
-
-/*
- * This is an implementation of the notion of "decrement a
- * reference count, and return locked if it decremented to zero".
- *
- * This implementation can be used on any architecture that
- * has a cmpxchg, and where atomic->value is an int holding
- * the value of the atomic (i.e. the high bits aren't used
- * for a lock or anything like that).
- */
-int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock)
-{
-        int counter;
-        int newcount;
-
-        for (;;) {
-                counter = atomic_read(atomic);
-                newcount = counter - 1;
-                if (!newcount)
-                        break;          /* do it the slow way */
-
-                newcount = cmpxchg(&atomic->counter, counter, newcount);
-                if (newcount == counter)
-                        return 0;
-        }
-
-        spin_lock(lock);
-        if (atomic_dec_and_test(atomic))
-                return 1;
-        spin_unlock(lock);
-        return 0;
-}
-
-EXPORT_SYMBOL(_atomic_dec_and_lock);
diff --git a/arch/ppc/platforms/4xx/bamboo.c b/arch/ppc/platforms/4xx/bamboo.c
index ac391d463d78..78a403b48dba 100644
--- a/arch/ppc/platforms/4xx/bamboo.c
+++ b/arch/ppc/platforms/4xx/bamboo.c
@@ -27,7 +27,6 @@
 #include <linux/delay.h>
 #include <linux/ide.h>
 #include <linux/initrd.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/tty.h>
diff --git a/arch/ppc/platforms/4xx/ebony.c b/arch/ppc/platforms/4xx/ebony.c
index d6b2b1965dcb..27b778ab903b 100644
--- a/arch/ppc/platforms/4xx/ebony.c
+++ b/arch/ppc/platforms/4xx/ebony.c
@@ -30,7 +30,6 @@
 #include <linux/delay.h>
 #include <linux/ide.h>
 #include <linux/initrd.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/tty.h>
diff --git a/arch/ppc/platforms/4xx/luan.c b/arch/ppc/platforms/4xx/luan.c
index a38e6f9ef858..16d953bda22c 100644
--- a/arch/ppc/platforms/4xx/luan.c
+++ b/arch/ppc/platforms/4xx/luan.c
@@ -28,7 +28,6 @@
 #include <linux/delay.h>
 #include <linux/ide.h>
 #include <linux/initrd.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/tty.h>
diff --git a/arch/ppc/platforms/4xx/ocotea.c b/arch/ppc/platforms/4xx/ocotea.c
index 80028df1b445..506949c5dd29 100644
--- a/arch/ppc/platforms/4xx/ocotea.c
+++ b/arch/ppc/platforms/4xx/ocotea.c
@@ -28,7 +28,6 @@
 #include <linux/delay.h>
 #include <linux/ide.h>
 #include <linux/initrd.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/tty.h>
diff --git a/arch/ppc/platforms/83xx/mpc834x_sys.c b/arch/ppc/platforms/83xx/mpc834x_sys.c
index b38a851a64ec..79b3f533d0a3 100644
--- a/arch/ppc/platforms/83xx/mpc834x_sys.c
+++ b/arch/ppc/platforms/83xx/mpc834x_sys.c
@@ -24,7 +24,6 @@
 #include <linux/major.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/serial.h>
diff --git a/arch/ppc/platforms/85xx/mpc8540_ads.c b/arch/ppc/platforms/85xx/mpc8540_ads.c
index f761fdf160db..7dc8a68acfd0 100644
--- a/arch/ppc/platforms/85xx/mpc8540_ads.c
+++ b/arch/ppc/platforms/85xx/mpc8540_ads.c
@@ -24,7 +24,6 @@
 #include <linux/major.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/serial.h>
diff --git a/arch/ppc/platforms/85xx/mpc8560_ads.c b/arch/ppc/platforms/85xx/mpc8560_ads.c
index f2748c88665a..8841fd7da6ee 100644
--- a/arch/ppc/platforms/85xx/mpc8560_ads.c
+++ b/arch/ppc/platforms/85xx/mpc8560_ads.c
@@ -24,7 +24,6 @@
 #include <linux/major.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/serial.h>
diff --git a/arch/ppc/platforms/85xx/mpc85xx_ads_common.c b/arch/ppc/platforms/85xx/mpc85xx_ads_common.c
index 18e952d1767c..bd3ac0136756 100644
--- a/arch/ppc/platforms/85xx/mpc85xx_ads_common.c
+++ b/arch/ppc/platforms/85xx/mpc85xx_ads_common.c
@@ -24,7 +24,6 @@
 #include <linux/major.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/serial.h>
 #include <linux/module.h>
diff --git a/arch/ppc/platforms/85xx/mpc85xx_cds_common.c b/arch/ppc/platforms/85xx/mpc85xx_cds_common.c
index 6267b294f704..9f9039498ae5 100644
--- a/arch/ppc/platforms/85xx/mpc85xx_cds_common.c
+++ b/arch/ppc/platforms/85xx/mpc85xx_cds_common.c
@@ -24,7 +24,6 @@
 #include <linux/major.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/serial.h>
 #include <linux/module.h>
diff --git a/arch/ppc/platforms/85xx/sbc8560.c b/arch/ppc/platforms/85xx/sbc8560.c
index 165df94d4aa6..c76760a781c1 100644
--- a/arch/ppc/platforms/85xx/sbc8560.c
+++ b/arch/ppc/platforms/85xx/sbc8560.c
@@ -24,7 +24,6 @@
 #include <linux/major.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/serial.h>
diff --git a/arch/ppc/platforms/85xx/sbc85xx.c b/arch/ppc/platforms/85xx/sbc85xx.c
index 4f6d1ddd6fb8..c02f110219f5 100644
--- a/arch/ppc/platforms/85xx/sbc85xx.c
+++ b/arch/ppc/platforms/85xx/sbc85xx.c
@@ -23,7 +23,6 @@
 #include <linux/major.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/serial.h>
 #include <linux/module.h>
diff --git a/arch/ppc/platforms/85xx/stx_gp3.c b/arch/ppc/platforms/85xx/stx_gp3.c
index c99b365d6110..20940f4044f4 100644
--- a/arch/ppc/platforms/85xx/stx_gp3.c
+++ b/arch/ppc/platforms/85xx/stx_gp3.c
@@ -30,7 +30,6 @@
 #include <linux/blkdev.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/root_dev.h>
 #include <linux/seq_file.h>
 #include <linux/serial.h>
diff --git a/arch/ppc/platforms/chestnut.c b/arch/ppc/platforms/chestnut.c
index 7786818bd9d0..df6ff98c023a 100644
--- a/arch/ppc/platforms/chestnut.c
+++ b/arch/ppc/platforms/chestnut.c
@@ -35,7 +35,6 @@
 #include <asm/time.h>
 #include <asm/dma.h>
 #include <asm/io.h>
-#include <linux/irq.h>
 #include <asm/hw_irq.h>
 #include <asm/machdep.h>
 #include <asm/kgdb.h>
diff --git a/arch/ppc/platforms/chrp_setup.c b/arch/ppc/platforms/chrp_setup.c
index 57f29ab29bda..66346f0de7ec 100644
--- a/arch/ppc/platforms/chrp_setup.c
+++ b/arch/ppc/platforms/chrp_setup.c
@@ -32,7 +32,6 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/ide.h>
-#include <linux/irq.h>
 #include <linux/console.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
diff --git a/arch/ppc/platforms/chrp_time.c b/arch/ppc/platforms/chrp_time.c
index 4864a7de3daa..6037ce7796f5 100644
--- a/arch/ppc/platforms/chrp_time.c
+++ b/arch/ppc/platforms/chrp_time.c
@@ -22,7 +22,6 @@
 #include <linux/init.h>
 #include <linux/bcd.h>
 
-#include <asm/segment.h>
 #include <asm/io.h>
 #include <asm/nvram.h>
 #include <asm/prom.h>
diff --git a/arch/ppc/platforms/gemini_setup.c b/arch/ppc/platforms/gemini_setup.c
index e391e52383c7..3a5ff9fb71d6 100644
--- a/arch/ppc/platforms/gemini_setup.c
+++ b/arch/ppc/platforms/gemini_setup.c
@@ -21,7 +21,6 @@
 #include <linux/major.h>
 #include <linux/initrd.h>
 #include <linux/console.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/bcd.h>
diff --git a/arch/ppc/platforms/mvme5100.c b/arch/ppc/platforms/mvme5100.c
index b292b44b760c..ce2ce88c8033 100644
--- a/arch/ppc/platforms/mvme5100.c
+++ b/arch/ppc/platforms/mvme5100.c
@@ -20,7 +20,6 @@
 #include <linux/initrd.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/ide.h>
 #include <linux/seq_file.h>
 #include <linux/kdev_t.h>
diff --git a/arch/ppc/platforms/pmac_cpufreq.c b/arch/ppc/platforms/pmac_cpufreq.c
index c0605244edda..d4bc5f67ec53 100644
--- a/arch/ppc/platforms/pmac_cpufreq.c
+++ b/arch/ppc/platforms/pmac_cpufreq.c
@@ -695,6 +695,13 @@ static int __init pmac_cpufreq_setup(void)
                 set_speed_proc = pmu_set_cpu_speed;
                 is_pmu_based = 1;
         }
+        /* Else check for TiPb 550 */
+        else if (machine_is_compatible("PowerBook3,3") && cur_freq == 550000) {
+                hi_freq = cur_freq;
+                low_freq = 500000;
+                set_speed_proc = pmu_set_cpu_speed;
+                is_pmu_based = 1;
+        }
         /* Else check for TiPb 400 & 500 */
         else if (machine_is_compatible("PowerBook3,2")) {
                 /* We only know about the 400 MHz and the 500Mhz model
diff --git a/arch/ppc/platforms/pmac_feature.c b/arch/ppc/platforms/pmac_feature.c
index 867336ad5d36..dd6d45ae0501 100644
--- a/arch/ppc/platforms/pmac_feature.c
+++ b/arch/ppc/platforms/pmac_feature.c
@@ -2337,6 +2337,10 @@ static struct pmac_mb_def pmac_mb_defs[] __pmacdata = {
                 PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
                 PMAC_MB_MAY_SLEEP | PMAC_MB_HAS_FW_POWER | PMAC_MB_MOBILE,
         },
+        {       "PowerBook6,7",                 "iBook G4",
+                PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
+                PMAC_MB_MAY_SLEEP | PMAC_MB_HAS_FW_POWER | PMAC_MB_MOBILE,
+        },
         {       "PowerBook6,8",                 "PowerBook G4 12\"",
                 PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
                 PMAC_MB_MAY_SLEEP | PMAC_MB_HAS_FW_POWER | PMAC_MB_MOBILE,
diff --git a/arch/ppc/platforms/pmac_setup.c b/arch/ppc/platforms/pmac_setup.c
index b392b9a15987..d6356f480d90 100644
--- a/arch/ppc/platforms/pmac_setup.c
+++ b/arch/ppc/platforms/pmac_setup.c
@@ -48,7 +48,6 @@
 #include <linux/adb.h>
 #include <linux/cuda.h>
 #include <linux/pmu.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
 #include <linux/bitops.h>
@@ -719,7 +718,8 @@ pmac_declare_of_platform_devices(void)
         if (np) {
                 for (np = np->child; np != NULL; np = np->sibling)
                         if (strncmp(np->name, "i2c", 3) == 0) {
-                                of_platform_device_create(np, "uni-n-i2c");
+                                of_platform_device_create(np, "uni-n-i2c",
+                                                          NULL);
                                 break;
                         }
         }
@@ -727,17 +727,18 @@ pmac_declare_of_platform_devices(void)
         if (np) {
                 for (np = np->child; np != NULL; np = np->sibling)
                         if (strncmp(np->name, "i2c", 3) == 0) {
-                                of_platform_device_create(np, "u3-i2c");
+                                of_platform_device_create(np, "u3-i2c",
+                                                          NULL);
                                 break;
                         }
         }
 
         np = find_devices("valkyrie");
         if (np)
-                of_platform_device_create(np, "valkyrie");
+                of_platform_device_create(np, "valkyrie", NULL);
         np = find_devices("platinum");
         if (np)
-                of_platform_device_create(np, "platinum");
+                of_platform_device_create(np, "platinum", NULL);
 
         return 0;
 }
diff --git a/arch/ppc/platforms/powerpmc250.c b/arch/ppc/platforms/powerpmc250.c
index 0abe15159e6c..e6b520e6e13f 100644
--- a/arch/ppc/platforms/powerpmc250.c
+++ b/arch/ppc/platforms/powerpmc250.c
@@ -26,7 +26,6 @@
 #include <linux/initrd.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/slab.h>
 #include <linux/seq_file.h>
 #include <linux/ide.h>
diff --git a/arch/ppc/platforms/pplus.c b/arch/ppc/platforms/pplus.c
index 65705c911795..e70aae20d6f9 100644
--- a/arch/ppc/platforms/pplus.c
+++ b/arch/ppc/platforms/pplus.c
@@ -22,7 +22,6 @@
 #include <linux/ioport.h>
 #include <linux/console.h>
 #include <linux/pci.h>
-#include <linux/irq.h>
 #include <linux/ide.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
diff --git a/arch/ppc/platforms/prpmc750.c b/arch/ppc/platforms/prpmc750.c
index 24ae1caafc61..0bb14a5e824c 100644
--- a/arch/ppc/platforms/prpmc750.c
+++ b/arch/ppc/platforms/prpmc750.c
@@ -24,7 +24,6 @@
 #include <linux/initrd.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/ide.h>
 #include <linux/root_dev.h>
diff --git a/arch/ppc/platforms/prpmc800.c b/arch/ppc/platforms/prpmc800.c
index 8b09fa69b35b..de7baefacd3a 100644
--- a/arch/ppc/platforms/prpmc800.c
+++ b/arch/ppc/platforms/prpmc800.c
@@ -22,7 +22,6 @@
 #include <linux/initrd.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/ide.h>
 #include <linux/root_dev.h>
diff --git a/arch/ppc/platforms/radstone_ppc7d.c b/arch/ppc/platforms/radstone_ppc7d.c
index c30607a972d8..0376c8cff5d1 100644
--- a/arch/ppc/platforms/radstone_ppc7d.c
+++ b/arch/ppc/platforms/radstone_ppc7d.c
@@ -32,7 +32,6 @@
 #include <linux/initrd.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/ide.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
@@ -59,7 +58,6 @@
 #include <asm/mpc10x.h>
 #include <asm/pci-bridge.h>
 #include <asm/mv64x60.h>
-#include <asm/i8259.h>
 
 #include "radstone_ppc7d.h"
 
diff --git a/arch/ppc/platforms/sandpoint.c b/arch/ppc/platforms/sandpoint.c
index 21e31346b12b..5232283c1974 100644
--- a/arch/ppc/platforms/sandpoint.c
+++ b/arch/ppc/platforms/sandpoint.c
@@ -74,7 +74,6 @@
 #include <linux/initrd.h>
 #include <linux/console.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/ide.h>
 #include <linux/seq_file.h>
 #include <linux/root_dev.h>
diff --git a/arch/ppc/syslib/Makefile b/arch/ppc/syslib/Makefile
index 8b9b226005d1..b8d08f33f7ee 100644
--- a/arch/ppc/syslib/Makefile
+++ b/arch/ppc/syslib/Makefile
@@ -34,7 +34,8 @@ ifeq ($(CONFIG_40x),y)
 obj-$(CONFIG_PCI)               += indirect_pci.o pci_auto.o ppc405_pci.o
 endif
 endif
-obj-$(CONFIG_8xx)               += m8xx_setup.o ppc8xx_pic.o $(wdt-mpc8xx-y)
+obj-$(CONFIG_8xx)               += m8xx_setup.o ppc8xx_pic.o $(wdt-mpc8xx-y) \
+                                   ppc_sys.o mpc8xx_devices.o mpc8xx_sys.o
 ifeq ($(CONFIG_8xx),y)
 obj-$(CONFIG_PCI)               += qspan_pci.o i8259.o
 endif
diff --git a/arch/ppc/syslib/mpc8xx_devices.c b/arch/ppc/syslib/mpc8xx_devices.c
new file mode 100644
index 000000000000..2b5f0e701687
--- /dev/null
+++ b/arch/ppc/syslib/mpc8xx_devices.c
@@ -0,0 +1,224 @@
+/*
+ * arch/ppc/syslib/mpc8xx_devices.c
+ *
+ * MPC8xx Device descriptions
+ *
+ * Maintainer: Kumar Gala <kumar.gala@freescale.com>
+ *
+ * Copyright 2005 MontaVista Software, Inc. by Vitaly Bordug<vbordug@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/serial_8250.h>
+#include <linux/mii.h>
+#include <asm/commproc.h>
+#include <asm/mpc8xx.h>
+#include <asm/irq.h>
+#include <asm/ppc_sys.h>
+
+/* We use offsets for IORESOURCE_MEM to do not set dependences at compile time.
+ * They will get fixed up by mach_mpc8xx_fixup
+ */
+
+struct platform_device ppc_sys_platform_devices[] = {
+        [MPC8xx_CPM_FEC1] =     {
+                .name = "fsl-cpm-fec",
+                .id     = 1,
+                .num_resources = 2,
+                .resource = (struct resource[]) {
+                        {
+                                .name   = "regs",
+                                .start  = 0xe00,
+                                .end    = 0xe88,
+                                .flags  = IORESOURCE_MEM,
+                        },
+                        {
+                                .name   = "interrupt",
+                                .start  = MPC8xx_INT_FEC1,
+                                .end    = MPC8xx_INT_FEC1,
+                                .flags  = IORESOURCE_IRQ,
+                        },
+                },
+        },
+        [MPC8xx_CPM_FEC2] =     {
+                .name = "fsl-cpm-fec",
+                .id     = 2,
+                .num_resources = 2,
+                .resource = (struct resource[]) {
+                        {
+                                .name   = "regs",
+                                .start  = 0x1e00,
+                                .end    = 0x1e88,
+                                .flags  = IORESOURCE_MEM,
+                        },
+                        {
+                                .name   = "interrupt",
+                                .start  = MPC8xx_INT_FEC2,
+                                .end    = MPC8xx_INT_FEC2,
+                                .flags  = IORESOURCE_IRQ,
+                        },
+                },
+        },
+        [MPC8xx_CPM_SCC1] = {
+                .name = "fsl-cpm-scc",
+                .id     = 1,
+                .num_resources = 3,
+                .resource = (struct resource[]) {
+                        {
+                                .name   = "regs",
+                                .start  = 0xa00,
+                                .end    = 0xa18,
+                                .flags  = IORESOURCE_MEM,
+                        },
+                        {
+                                .name   = "pram",
+                                .start  = 0x3c00,
+                                .end    = 0x3c80,
+                                .flags  = IORESOURCE_MEM,
+                        },
+                        {
+                                .name   = "interrupt",
+                                .start  = MPC8xx_INT_SCC1,
+                                .end    = MPC8xx_INT_SCC1,
+                                .flags  = IORESOURCE_IRQ,
+                        },
+                },
+        },
+        [MPC8xx_CPM_SCC2] = {
+                .name = "fsl-cpm-scc",
+                .id     = 2,
+                .num_resources  = 3,
+                .resource = (struct resource[]) {
+                        {
+                                .name   = "regs",
+                                .start  = 0xa20,
+                                .end    = 0xa38,
+                                .flags  = IORESOURCE_MEM,
+                        },
+                        {
+                                .name   = "pram",
+                                .start  = 0x3d00,
+                                .end    = 0x3d80,
+                                .flags  = IORESOURCE_MEM,
+                        },
+
+                        {
+                                .name   = "interrupt",
+                                .start  = MPC8xx_INT_SCC2,
+                                .end    = MPC8xx_INT_SCC2,
+                                .flags  = IORESOURCE_IRQ,
+                        },
+                },
+        },
+        [MPC8xx_CPM_SCC3] = {
+                .name = "fsl-cpm-scc",
+                .id     = 3,
+                .num_resources  = 3,
+                .resource = (struct resource[]) {
+                        {
+                                .name   = "regs",
+                                .start  = 0xa40,
+                                .end    = 0xa58,
+                                .flags  = IORESOURCE_MEM,
+                        },
+                        {
+                                .name   = "pram",
+                                .start  = 0x3e00,
+                                .end    = 0x3e80,
+                                .flags  = IORESOURCE_MEM,
+                        },
+
+                        {
+                                .name   = "interrupt",
+                                .start  = MPC8xx_INT_SCC3,
+                                .end    = MPC8xx_INT_SCC3,
+                                .flags  = IORESOURCE_IRQ,
+                        },
+                },
+        },
+        [MPC8xx_CPM_SCC4] = {
+                .name = "fsl-cpm-scc",
+                .id     = 4,
+                .num_resources  = 3,
+                .resource = (struct resource[]) {
+                        {
+                                .name   = "regs",
+                                .start  = 0xa60,
+                                .end    = 0xa78,
+                                .flags  = IORESOURCE_MEM,
+                        },
+                        {
+                                .name   = "pram",
+                                .start  = 0x3f00,
+                                .end    = 0x3f80,
+                                .flags  = IORESOURCE_MEM,
+                        },
+
+                        {
+                                .name   = "interrupt",
+                                .start  = MPC8xx_INT_SCC4,
+                                .end    = MPC8xx_INT_SCC4,
+                                .flags  = IORESOURCE_IRQ,
+                        },
+                },
+        },
+        [MPC8xx_CPM_SMC1] = {
+                .name = "fsl-cpm-smc",
+                .id     = 1,
+                .num_resources  = 2,
+                .resource = (struct resource[]) {
+                        {
+                                .name   = "regs",
+                                .start  = 0xa82,
+                                .end    = 0xa91,
+                                .flags  = IORESOURCE_MEM,
+                        },
+                        {
+                                .name   = "interrupt",
+                                .start  = MPC8xx_INT_SMC1,
+                                .end    = MPC8xx_INT_SMC1,
+                                .flags  = IORESOURCE_IRQ,
+                        },
+                },
+        },
+        [MPC8xx_CPM_SMC2] = {
+                .name = "fsl-cpm-smc",
+                .id     = 2,
+                .num_resources  = 2,
+                .resource = (struct resource[]) {
+                        {
+                                .name   = "regs",
+                                .start  = 0xa92,
+                                .end    = 0xaa1,
+                                .flags  = IORESOURCE_MEM,
+                        },
+                        {
+                                .name   = "interrupt",
+                                .start  = MPC8xx_INT_SMC2,
+                                .end    = MPC8xx_INT_SMC2,
+                                .flags  = IORESOURCE_IRQ,
+                        },
+                },
+        },
+};
+
+static int __init mach_mpc8xx_fixup(struct platform_device *pdev)
+{
+        ppc_sys_fixup_mem_resource (pdev, IMAP_ADDR);
+        return 0;
+}
+
+static int __init mach_mpc8xx_init(void)
+{
+        ppc_sys_device_fixup = mach_mpc8xx_fixup;
+        return 0;
+}
+
+postcore_initcall(mach_mpc8xx_init);
diff --git a/arch/ppc/syslib/mpc8xx_sys.c b/arch/ppc/syslib/mpc8xx_sys.c
new file mode 100644
index 000000000000..a532ccc861c0
--- /dev/null
+++ b/arch/ppc/syslib/mpc8xx_sys.c
@@ -0,0 +1,61 @@
+/*
+ * arch/ppc/platforms/mpc8xx_sys.c
+ *
+ * MPC8xx System descriptions
+ *
+ * Maintainer: Kumar Gala <kumar.gala@freescale.com>
+ *
+ * Copyright 2005 MontaVista Software, Inc. by Vitaly Bordug <vbordug@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <asm/ppc_sys.h>
+
+struct ppc_sys_spec *cur_ppc_sys_spec; 
+struct ppc_sys_spec ppc_sys_specs[] = {
+        {
+                .ppc_sys_name   = "MPC86X",
+                .mask           = 0xFFFFFFFF,
+                .value          = 0x00000000,
+                .num_devices    = 2,
+                .device_list    = (enum ppc_sys_devices[])
+                {
+                        MPC8xx_CPM_FEC1,
+                        MPC8xx_CPM_SCC1,
+                        MPC8xx_CPM_SCC2,
+                        MPC8xx_CPM_SCC3,
+                        MPC8xx_CPM_SCC4,
+                        MPC8xx_CPM_SMC1,
+                        MPC8xx_CPM_SMC2,
+                },
+        },
+        {
+                .ppc_sys_name   = "MPC885",
+                .mask           = 0xFFFFFFFF,
+                .value          = 0x00000000,
+                .num_devices    = 3,
+                .device_list    = (enum ppc_sys_devices[])
+                {
+                        MPC8xx_CPM_FEC1,
+                        MPC8xx_CPM_FEC2,
+                        MPC8xx_CPM_SCC1,
+                        MPC8xx_CPM_SCC2,
+                        MPC8xx_CPM_SCC3,
+                        MPC8xx_CPM_SCC4,
+                        MPC8xx_CPM_SMC1,
+                        MPC8xx_CPM_SMC2,
+                },
+        },
+        {       /* default match */
+                .ppc_sys_name   = "",
+                .mask           = 0x00000000,
+                .value          = 0x00000000,
+        },
+};
diff --git a/arch/ppc/syslib/mv64x60.c b/arch/ppc/syslib/mv64x60.c
index 839f8872826f..4849850a59ed 100644
--- a/arch/ppc/syslib/mv64x60.c
+++ b/arch/ppc/syslib/mv64x60.c
@@ -34,7 +34,7 @@ u8 mv64x60_pci_exclude_bridge = 1;
 DEFINE_SPINLOCK(mv64x60_lock);
 
 static phys_addr_t      mv64x60_bridge_pbase;
-static void             *mv64x60_bridge_vbase;
+static void             __iomem *mv64x60_bridge_vbase;
 static u32              mv64x60_bridge_type = MV64x60_TYPE_INVALID;
 static u32              mv64x60_bridge_rev;
 #if defined(CONFIG_SYSFS) && !defined(CONFIG_GT64260)
@@ -938,7 +938,7 @@ mv64x60_setup_for_chip(struct mv64x60_handle *bh)
  *
  * Return the virtual address of the bridge's registers.
  */
-void *
+void __iomem *
 mv64x60_get_bridge_vbase(void)
 {
         return mv64x60_bridge_vbase;
diff --git a/arch/ppc/syslib/of_device.c b/arch/ppc/syslib/of_device.c
index da8a0f2128dc..93c7231ea709 100644
--- a/arch/ppc/syslib/of_device.c
+++ b/arch/ppc/syslib/of_device.c
@@ -234,7 +234,9 @@ void of_device_unregister(struct of_device *ofdev)
         device_unregister(&ofdev->dev);
 }
 
-struct of_device* of_platform_device_create(struct device_node *np, const char *bus_id)
+struct of_device* of_platform_device_create(struct device_node *np,
+                                            const char *bus_id,
+                                            struct device *parent)
 {
         struct of_device *dev;
         u32 *reg;
@@ -247,7 +249,7 @@ struct of_device* of_platform_device_create(struct device_node *np, const char *
         dev->node = of_node_get(np);
         dev->dma_mask = 0xffffffffUL;
         dev->dev.dma_mask = &dev->dma_mask;
-        dev->dev.parent = NULL;
+        dev->dev.parent = parent;
         dev->dev.bus = &of_platform_bus_type;
         dev->dev.release = of_release_dev;
 
diff --git a/arch/ppc/syslib/open_pic.c b/arch/ppc/syslib/open_pic.c
index 53da58523e39..1cf5de21a3fd 100644
--- a/arch/ppc/syslib/open_pic.c
+++ b/arch/ppc/syslib/open_pic.c
@@ -13,7 +13,6 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/init.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <linux/sysdev.h>
 #include <linux/errno.h>
diff --git a/arch/ppc/syslib/open_pic2.c b/arch/ppc/syslib/open_pic2.c
index 2e0ea92144f6..16cff91d9f41 100644
--- a/arch/ppc/syslib/open_pic2.c
+++ b/arch/ppc/syslib/open_pic2.c
@@ -17,7 +17,6 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/init.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
 #include <linux/sysdev.h>
 #include <linux/errno.h>
@@ -575,7 +574,7 @@ static void openpic2_cached_disable_irq(u_int irq)
  * we need something better to deal with that... Maybe switch to S1 for
  * cpufreq changes
  */
-int openpic2_suspend(struct sys_device *sysdev, u32 state)
+int openpic2_suspend(struct sys_device *sysdev, pm_message_t state)
 {
         int     i;
         unsigned long flags;
diff --git a/arch/ppc/syslib/ppc4xx_setup.c b/arch/ppc/syslib/ppc4xx_setup.c
index b843c4fef25e..bf83240689dc 100644
--- a/arch/ppc/syslib/ppc4xx_setup.c
+++ b/arch/ppc/syslib/ppc4xx_setup.c
@@ -18,7 +18,6 @@
 #include <linux/smp.h>
 #include <linux/threads.h>
 #include <linux/spinlock.h>
-#include <linux/irq.h>
 #include <linux/reboot.h>
 #include <linux/param.h>
 #include <linux/string.h>
diff --git a/arch/ppc/syslib/ppc85xx_setup.c b/arch/ppc/syslib/ppc85xx_setup.c
index b7242f1bd931..832b8bf99ae7 100644
--- a/arch/ppc/syslib/ppc85xx_setup.c
+++ b/arch/ppc/syslib/ppc85xx_setup.c
@@ -184,8 +184,8 @@ mpc85xx_setup_pci1(struct pci_controller *hose)
         pci->powar1 = 0x80044000 |
            (__ilog2(MPC85XX_PCI1_UPPER_MEM - MPC85XX_PCI1_LOWER_MEM + 1) - 1);
 
-        /* Setup outboud IO windows @ MPC85XX_PCI1_IO_BASE */
-        pci->potar2 = 0x00000000;
+        /* Setup outbound IO windows @ MPC85XX_PCI1_IO_BASE */
+        pci->potar2 = (MPC85XX_PCI1_LOWER_IO >> 12) & 0x000fffff;
         pci->potear2 = 0x00000000;
         pci->powbar2 = (MPC85XX_PCI1_IO_BASE >> 12) & 0x000fffff;
         /* Enable, IO R/W */
@@ -235,8 +235,8 @@ mpc85xx_setup_pci2(struct pci_controller *hose)
         pci->powar1 = 0x80044000 |
            (__ilog2(MPC85XX_PCI2_UPPER_MEM - MPC85XX_PCI2_LOWER_MEM + 1) - 1);
 
-        /* Setup outboud IO windows @ MPC85XX_PCI2_IO_BASE */
-        pci->potar2 = 0x00000000;
+        /* Setup outbound IO windows @ MPC85XX_PCI2_IO_BASE */
+        pci->potar2 = (MPC85XX_PCI2_LOWER_IO >> 12) & 0x000fffff;;
         pci->potear2 = 0x00000000;
         pci->powbar2 = (MPC85XX_PCI2_IO_BASE >> 12) & 0x000fffff;
         /* Enable, IO R/W */
diff --git a/arch/ppc/syslib/prep_nvram.c b/arch/ppc/syslib/prep_nvram.c
index 2bcf8a16d1c9..8599850ca772 100644
--- a/arch/ppc/syslib/prep_nvram.c
+++ b/arch/ppc/syslib/prep_nvram.c
@@ -15,7 +15,6 @@
 #include <linux/ioport.h>
 
 #include <asm/sections.h>
-#include <asm/segment.h>
 #include <asm/io.h>
 #include <asm/machdep.h>
 #include <asm/prep_nvram.h>
diff --git a/arch/ppc64/Kconfig b/arch/ppc64/Kconfig
index deca68ad644a..c658650af429 100644
--- a/arch/ppc64/Kconfig
+++ b/arch/ppc64/Kconfig
@@ -28,10 +28,6 @@ config GENERIC_ISA_DMA
         bool
         default y
 
-config HAVE_DEC_LOCK
-        bool
-        default y
-
 config EARLY_PRINTK
         bool
         default y
diff --git a/arch/ppc64/Makefile b/arch/ppc64/Makefile
index 17d2c1eac3b8..521c2a5a2862 100644
--- a/arch/ppc64/Makefile
+++ b/arch/ppc64/Makefile
@@ -107,7 +107,7 @@ install: vmlinux
         $(Q)$(MAKE) $(build)=$(boot) BOOTIMAGE=$(BOOTIMAGE) $@
 
 defaultimage-$(CONFIG_PPC_PSERIES) := zImage
-defaultimage-$(CONFIG_PPC_PMAC) := vmlinux
+defaultimage-$(CONFIG_PPC_PMAC) := zImage.vmode
 defaultimage-$(CONFIG_PPC_MAPLE) := zImage
 defaultimage-$(CONFIG_PPC_ISERIES) := vmlinux
 KBUILD_IMAGE := $(defaultimage-y)
diff --git a/arch/ppc64/kernel/asm-offsets.c b/arch/ppc64/kernel/asm-offsets.c
index 17e35d0fed09..1ff4fa05a973 100644
--- a/arch/ppc64/kernel/asm-offsets.c
+++ b/arch/ppc64/kernel/asm-offsets.c
@@ -68,6 +68,7 @@ int main(void)
         DEFINE(THREAD_USED_VR, offsetof(struct thread_struct, used_vr));
 #endif /* CONFIG_ALTIVEC */
         DEFINE(MM, offsetof(struct task_struct, mm));
+        DEFINE(AUDITCONTEXT, offsetof(struct task_struct, audit_context));
 
         DEFINE(DCACHEL1LINESIZE, offsetof(struct ppc64_caches, dline_size));
         DEFINE(DCACHEL1LOGLINESIZE, offsetof(struct ppc64_caches, log_dline_size));
diff --git a/arch/ppc64/kernel/bpa_iommu.c b/arch/ppc64/kernel/bpa_iommu.c
index f33a7bccb0d7..507eb9d0223f 100644
--- a/arch/ppc64/kernel/bpa_iommu.c
+++ b/arch/ppc64/kernel/bpa_iommu.c
@@ -99,7 +99,11 @@ get_iost_entry(unsigned long iopt_base, unsigned long io_address, unsigned page_
                 break;
 
         default: /* not a known compile time constant */
-                BUILD_BUG_ON(1);
+                {
+                        /* BUILD_BUG_ON() is not usable here */
+                        extern void __get_iost_entry_bad_page_size(void);
+                        __get_iost_entry_bad_page_size();
+                }
                 break;
         }
 
diff --git a/arch/ppc64/kernel/entry.S b/arch/ppc64/kernel/entry.S
index d133a49cdf89..e8c0bbf4d000 100644
--- a/arch/ppc64/kernel/entry.S
+++ b/arch/ppc64/kernel/entry.S
@@ -276,12 +276,22 @@ _GLOBAL(ppc64_rt_sigsuspend)
 _GLOBAL(ppc32_rt_sigsuspend)
         bl      .save_nvgprs
         bl      .sys32_rt_sigsuspend
-        /* If sigsuspend() returns zero, we are going into a signal handler */
 70:     cmpdi   0,r3,0
-        beq     .ret_from_except
-        /* If it returned -EINTR, we need to return via syscall_exit to set
+        /* If it returned an error, we need to return via syscall_exit to set
            the SO bit in cr0 and potentially stop for ptrace. */
-        b       syscall_exit
+        bne     syscall_exit
+        /* If sigsuspend() returns zero, we are going into a signal handler. We
+           may need to call audit_syscall_exit() to mark the exit from sigsuspend() */
+#ifdef CONFIG_AUDIT
+        ld      r3,PACACURRENT(r13)
+        ld      r4,AUDITCONTEXT(r3)
+        cmpdi   0,r4,0
+        beq     .ret_from_except        /* No audit_context: Leave immediately. */
+        li      r4, 2                   /* AUDITSC_FAILURE */
+        li      r5,-4                   /* It's always -EINTR */
+        bl      .audit_syscall_exit
+#endif
+        b       .ret_from_except
 
 _GLOBAL(ppc_fork)
         bl      .save_nvgprs
diff --git a/arch/ppc64/kernel/head.S b/arch/ppc64/kernel/head.S
index 58c314738c99..72c61041151a 100644
--- a/arch/ppc64/kernel/head.S
+++ b/arch/ppc64/kernel/head.S
@@ -1649,7 +1649,7 @@ _GLOBAL(__secondary_start)
         ld      r3,0(r3)
         lwz     r3,PLATFORM(r3)         /* r3 = platform flags           */
         andi.   r3,r3,PLATFORM_LPAR     /* Test if bit 0 is set (LPAR bit) */
-        bne     98f
+        beq     98f                     /* branch if result is 0  */
         mfspr   r3,PVR
         srwi    r3,r3,16
         cmpwi   r3,0x37                 /* SStar  */
@@ -1813,7 +1813,7 @@ _STATIC(start_here_multiplatform)
         ld      r3,0(r3)
         lwz     r3,PLATFORM(r3)         /* r3 = platform flags */
         andi.   r3,r3,PLATFORM_LPAR     /* Test if bit 0 is set (LPAR bit) */
-        bne     98f
+        beq     98f                     /* branch if result is 0  */
         mfspr   r3,PVR
         srwi    r3,r3,16
         cmpwi   r3,0x37                 /* SStar */
@@ -1834,7 +1834,7 @@ _STATIC(start_here_multiplatform)
         lwz     r3,PLATFORM(r3)         /* r3 = platform flags */
         /* Test if bit 0 is set (LPAR bit) */
         andi.   r3,r3,PLATFORM_LPAR
-        bne     98f
+        bne     98f                     /* branch if result is !0  */
         LOADADDR(r6,_SDR1)              /* Only if NOT LPAR */
         sub     r6,r6,r26
         ld      r6,0(r6)                /* get the value of _SDR1 */
diff --git a/arch/ppc64/kernel/kprobes.c b/arch/ppc64/kernel/kprobes.c
index 7e80d49c589a..9c6facc24f70 100644
--- a/arch/ppc64/kernel/kprobes.c
+++ b/arch/ppc64/kernel/kprobes.c
@@ -59,9 +59,9 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
 
         /* insn must be on a special executable page on ppc64 */
         if (!ret) {
-                up(&kprobe_mutex);
-                p->ainsn.insn = get_insn_slot();
                 down(&kprobe_mutex);
+                p->ainsn.insn = get_insn_slot();
+                up(&kprobe_mutex);
                 if (!p->ainsn.insn)
                         ret = -ENOMEM;
         }
@@ -90,9 +90,9 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p)
 
 void __kprobes arch_remove_kprobe(struct kprobe *p)
 {
-        up(&kprobe_mutex);
-        free_insn_slot(p->ainsn.insn);
         down(&kprobe_mutex);
+        free_insn_slot(p->ainsn.insn);
+        up(&kprobe_mutex);
 }
 
 static inline void prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
diff --git a/arch/ppc64/kernel/machine_kexec.c b/arch/ppc64/kernel/machine_kexec.c
index 4775f12a013c..bf7cc4f8210f 100644
--- a/arch/ppc64/kernel/machine_kexec.c
+++ b/arch/ppc64/kernel/machine_kexec.c
@@ -205,6 +205,7 @@ static void kexec_prepare_cpus(void)
                         continue;
 
                 while (paca[i].hw_cpu_id != -1) {
+                        barrier();
                         if (!cpu_possible(i)) {
                                 printk("kexec: cpu %d hw_cpu_id %d is not"
                                                 " possible, ignoring\n",
diff --git a/arch/ppc64/kernel/of_device.c b/arch/ppc64/kernel/of_device.c
index da580812ddfe..9f200f0f2ad5 100644
--- a/arch/ppc64/kernel/of_device.c
+++ b/arch/ppc64/kernel/of_device.c
@@ -233,7 +233,9 @@ void of_device_unregister(struct of_device *ofdev)
         device_unregister(&ofdev->dev);
 }
 
-struct of_device* of_platform_device_create(struct device_node *np, const char *bus_id)
+struct of_device* of_platform_device_create(struct device_node *np,
+                                            const char *bus_id,
+                                            struct device *parent)
 {
         struct of_device *dev;
 
@@ -245,7 +247,7 @@ struct of_device* of_platform_device_create(struct device_node *np, const char *
         dev->node = np;
         dev->dma_mask = 0xffffffffUL;
         dev->dev.dma_mask = &dev->dma_mask;
-        dev->dev.parent = NULL;
+        dev->dev.parent = parent;
         dev->dev.bus = &of_platform_bus_type;
         dev->dev.release = of_release_dev;
 
@@ -259,6 +261,7 @@ struct of_device* of_platform_device_create(struct device_node *np, const char *
         return dev;
 }
 
+
 EXPORT_SYMBOL(of_match_device);
 EXPORT_SYMBOL(of_platform_bus_type);
 EXPORT_SYMBOL(of_register_driver);
diff --git a/arch/ppc64/kernel/pSeries_iommu.c b/arch/ppc64/kernel/pSeries_iommu.c
index f0fd7fbd6531..d17f0108a032 100644
--- a/arch/ppc64/kernel/pSeries_iommu.c
+++ b/arch/ppc64/kernel/pSeries_iommu.c
@@ -265,8 +265,10 @@ static void iommu_table_setparms(struct pci_controller *phb,
         tbl->it_offset = phb->dma_window_base_cur >> PAGE_SHIFT;
         
         /* Test if we are going over 2GB of DMA space */
-        if (phb->dma_window_base_cur + phb->dma_window_size > (1L << 31))
+        if (phb->dma_window_base_cur + phb->dma_window_size > 0x80000000ul) {
+                udbg_printf("PCI_DMA: Unexpected number of IOAs under this PHB.\n");
                 panic("PCI_DMA: Unexpected number of IOAs under this PHB.\n"); 
+        }
         
         phb->dma_window_base_cur += phb->dma_window_size;
 
@@ -310,92 +312,85 @@ static void iommu_table_setparms_lpar(struct pci_controller *phb,
 
 static void iommu_bus_setup_pSeries(struct pci_bus *bus)
 {
-        struct device_node *dn, *pdn;
-        struct pci_dn *pci;
+        struct device_node *dn;
         struct iommu_table *tbl;
+        struct device_node *isa_dn, *isa_dn_orig;
+        struct device_node *tmp;
+        struct pci_dn *pci;
+        int children;
 
         DBG("iommu_bus_setup_pSeries, bus %p, bus->self %p\n", bus, bus->self);
 
-        /* For each (root) bus, we carve up the available DMA space in 256MB
-         * pieces. Since each piece is used by one (sub) bus/device, that would
-         * give a maximum of 7 devices per PHB. In most cases, this is plenty.
-         *
-         * The exception is on Python PHBs (pre-POWER4). Here we don't have EADS
-         * bridges below the PHB to allocate the sectioned tables to, so instead
-         * we allocate a 1GB table at the PHB level.
+        dn = pci_bus_to_OF_node(bus);
+        pci = PCI_DN(dn);
+
+        if (bus->self) {
+                /* This is not a root bus, any setup will be done for the
+                 * device-side of the bridge in iommu_dev_setup_pSeries().
+                 */
+                return;
+        }
+
+        /* Check if the ISA bus on the system is under
+         * this PHB.
          */
+        isa_dn = isa_dn_orig = of_find_node_by_type(NULL, "isa");
 
-        dn = pci_bus_to_OF_node(bus);
-        pci = dn->data;
-
-        if (!bus->self) {
-                /* Root bus */
-                if (is_python(dn)) {
-                        unsigned int *iohole;
-
-                        DBG("Python root bus %s\n", bus->name);
-
-                        iohole = (unsigned int *)get_property(dn, "io-hole", 0);
-
-                        if (iohole) {
-                                /* On first bus we need to leave room for the
-                                 * ISA address space. Just skip the first 256MB
-                                 * alltogether. This leaves 768MB for the window.
-                                 */
-                                DBG("PHB has io-hole, reserving 256MB\n");
-                                pci->phb->dma_window_size = 3 << 28;
-                                pci->phb->dma_window_base_cur = 1 << 28;
-                        } else {
-                                /* 1GB window by default */
-                                pci->phb->dma_window_size = 1 << 30;
-                                pci->phb->dma_window_base_cur = 0;
-                        }
-
-                        tbl = kmalloc(sizeof(struct iommu_table), GFP_KERNEL);
-
-                        iommu_table_setparms(pci->phb, dn, tbl);
-                        pci->iommu_table = iommu_init_table(tbl);
-                } else {
-                        /* Do a 128MB table at root. This is used for the IDE
-                         * controller on some SMP-mode POWER4 machines. It
-                         * doesn't hurt to allocate it on other machines
-                         * -- it'll just be unused since new tables are
-                         * allocated on the EADS level.
-                         *
-                         * Allocate at offset 128MB to avoid having to deal
-                         * with ISA holes; 128MB table for IDE is plenty.
-                         */
-                        pci->phb->dma_window_size = 1 << 27;
-                        pci->phb->dma_window_base_cur = 1 << 27;
-
-                        tbl = kmalloc(sizeof(struct iommu_table), GFP_KERNEL);
-
-                        iommu_table_setparms(pci->phb, dn, tbl);
-                        pci->iommu_table = iommu_init_table(tbl);
-
-                        /* All child buses have 256MB tables */
-                        pci->phb->dma_window_size = 1 << 28;
-                }
-        } else {
-                pdn = pci_bus_to_OF_node(bus->parent);
+        while (isa_dn && isa_dn != dn)
+                isa_dn = isa_dn->parent;
+
+        if (isa_dn_orig)
+                of_node_put(isa_dn_orig);
 
-                if (!bus->parent->self && !is_python(pdn)) {
-                        struct iommu_table *tbl;
-                        /* First child and not python means this is the EADS
-                         * level. Allocate new table for this slot with 256MB
-                         * window.
-                         */
+        /* Count number of direct PCI children of the PHB.
+         * All PCI device nodes have class-code property, so it's
+         * an easy way to find them.
+         */
+        for (children = 0, tmp = dn->child; tmp; tmp = tmp->sibling)
+                if (get_property(tmp, "class-code", NULL))
+                        children++;
 
-                        tbl = kmalloc(sizeof(struct iommu_table), GFP_KERNEL);
+        DBG("Children: %d\n", children);
 
-                        iommu_table_setparms(pci->phb, dn, tbl);
+        /* Calculate amount of DMA window per slot. Each window must be
+         * a power of two (due to pci_alloc_consistent requirements).
+         *
+         * Keep 256MB aside for PHBs with ISA.
+         */
 
-                        pci->iommu_table = iommu_init_table(tbl);
-                } else {
-                        /* Lower than first child or under python, use parent table */
-                        pci->iommu_table = PCI_DN(pdn)->iommu_table;
-                }
+        if (!isa_dn) {
+                /* No ISA/IDE - just set window size and return */
+                pci->phb->dma_window_size = 0x80000000ul; /* To be divided */
+
+                while (pci->phb->dma_window_size * children > 0x80000000ul)
+                        pci->phb->dma_window_size >>= 1;
+                DBG("No ISA/IDE, window size is 0x%lx\n",
+                        pci->phb->dma_window_size);
+                pci->phb->dma_window_base_cur = 0;
+
+                return;
         }
+
+        /* If we have ISA, then we probably have an IDE
+         * controller too. Allocate a 128MB table but
+         * skip the first 128MB to avoid stepping on ISA
+         * space.
+         */
+        pci->phb->dma_window_size = 0x8000000ul;
+        pci->phb->dma_window_base_cur = 0x8000000ul;
+
+        tbl = kmalloc(sizeof(struct iommu_table), GFP_KERNEL);
+
+        iommu_table_setparms(pci->phb, dn, tbl);
+        pci->iommu_table = iommu_init_table(tbl);
+
+        /* Divide the rest (1.75GB) among the children */
+        pci->phb->dma_window_size = 0x80000000ul;
+        while (pci->phb->dma_window_size * children > 0x70000000ul)
+                pci->phb->dma_window_size >>= 1;
+
+        DBG("ISA/IDE, window size is 0x%lx\n", pci->phb->dma_window_size);
+
 }
 
 
@@ -446,21 +441,36 @@ static void iommu_bus_setup_pSeriesLP(struct pci_bus *bus)
 static void iommu_dev_setup_pSeries(struct pci_dev *dev)
 {
         struct device_node *dn, *mydn;
+        struct iommu_table *tbl;
+
+        DBG("iommu_dev_setup_pSeries, dev %p (%s)\n", dev, pci_name(dev));
 
-        DBG("iommu_dev_setup_pSeries, dev %p (%s)\n", dev, dev->pretty_name);
-        /* Now copy the iommu_table ptr from the bus device down to the
-         * pci device_node.  This means get_iommu_table() won't need to search
-         * up the device tree to find it.
-         */
         mydn = dn = pci_device_to_OF_node(dev);
 
+        /* If we're the direct child of a root bus, then we need to allocate
+         * an iommu table ourselves. The bus setup code should have setup
+         * the window sizes already.
+         */
+        if (!dev->bus->self) {
+                DBG(" --> first child, no bridge. Allocating iommu table.\n");
+                tbl = kmalloc(sizeof(struct iommu_table), GFP_KERNEL);
+                iommu_table_setparms(PCI_DN(dn)->phb, dn, tbl);
+                PCI_DN(mydn)->iommu_table = iommu_init_table(tbl);
+
+                return;
+        }
+
+        /* If this device is further down the bus tree, search upwards until
+         * an already allocated iommu table is found and use that.
+         */
+
         while (dn && dn->data && PCI_DN(dn)->iommu_table == NULL)
                 dn = dn->parent;
 
         if (dn && dn->data) {
                 PCI_DN(mydn)->iommu_table = PCI_DN(dn)->iommu_table;
         } else {
-                DBG("iommu_dev_setup_pSeries, dev %p (%s) has no iommu table\n", dev, dev->pretty_name);
+                DBG("iommu_dev_setup_pSeries, dev %p (%s) has no iommu table\n", dev, pci_name(dev));
         }
 }
 
@@ -494,7 +504,7 @@ static void iommu_dev_setup_pSeriesLP(struct pci_dev *dev)
         int *dma_window = NULL;
         struct pci_dn *pci;
 
-        DBG("iommu_dev_setup_pSeriesLP, dev %p (%s)\n", dev, dev->pretty_name);
+        DBG("iommu_dev_setup_pSeriesLP, dev %p (%s)\n", dev, pci_name(dev));
 
         /* dev setup for LPAR is a little tricky, since the device tree might
          * contain the dma-window properties per-device and not neccesarily
@@ -516,9 +526,8 @@ static void iommu_dev_setup_pSeriesLP(struct pci_dev *dev)
          * slots on POWER4 machines.
          */
         if (dma_window == NULL || pdn->parent == NULL) {
-                /* Fall back to regular (non-LPAR) dev setup */
-                DBG("No dma window for device, falling back to regular setup\n");
-                iommu_dev_setup_pSeries(dev);
+                DBG("No dma window for device, linking to parent\n");
+                PCI_DN(dn)->iommu_table = PCI_DN(pdn)->iommu_table;
                 return;
         } else {
                 DBG("Found DMA window, allocating table\n");
diff --git a/arch/ppc64/kernel/pSeries_setup.c b/arch/ppc64/kernel/pSeries_setup.c
index bfadccc7b8be..3009701eb90d 100644
--- a/arch/ppc64/kernel/pSeries_setup.c
+++ b/arch/ppc64/kernel/pSeries_setup.c
@@ -238,8 +238,8 @@ static void __init pSeries_setup_arch(void)
 
         /* Find and initialize PCI host bridges */
         init_pci_config_tokens();
-        eeh_init();
         find_and_init_phbs();
+        eeh_init();
 
 #ifdef CONFIG_DUMMY_CONSOLE
         conswitchp = &dummy_con;
diff --git a/arch/ppc64/kernel/pci.c b/arch/ppc64/kernel/pci.c
index 861138ad092c..ff4be1da69d5 100644
--- a/arch/ppc64/kernel/pci.c
+++ b/arch/ppc64/kernel/pci.c
@@ -246,11 +246,14 @@ static unsigned int pci_parse_of_flags(u32 addr0)
         unsigned int flags = 0;
 
         if (addr0 & 0x02000000) {
-                flags |= IORESOURCE_MEM;
+                flags = IORESOURCE_MEM | PCI_BASE_ADDRESS_SPACE_MEMORY;
+                flags |= (addr0 >> 22) & PCI_BASE_ADDRESS_MEM_TYPE_64;
+                flags |= (addr0 >> 28) & PCI_BASE_ADDRESS_MEM_TYPE_1M;
                 if (addr0 & 0x40000000)
-                        flags |= IORESOURCE_PREFETCH;
+                        flags |= IORESOURCE_PREFETCH
+                                 | PCI_BASE_ADDRESS_MEM_PREFETCH;
         } else if (addr0 & 0x01000000)
-                flags |= IORESOURCE_IO;
+                flags = IORESOURCE_IO | PCI_BASE_ADDRESS_SPACE_IO;
         return flags;
 }
 
diff --git a/arch/ppc64/kernel/pmac_setup.c b/arch/ppc64/kernel/pmac_setup.c
index 325426c7bed0..25755252067a 100644
--- a/arch/ppc64/kernel/pmac_setup.c
+++ b/arch/ppc64/kernel/pmac_setup.c
@@ -434,15 +434,23 @@ static int pmac_check_legacy_ioport(unsigned int baseport)
 
 static int __init pmac_declare_of_platform_devices(void)
 {
-        struct device_node *np;
+        struct device_node *np, *npp;
 
-        np = find_devices("u3");
-        if (np) {
-                for (np = np->child; np != NULL; np = np->sibling)
+        npp = of_find_node_by_name(NULL, "u3");
+        if (npp) {
+                for (np = NULL; (np = of_get_next_child(npp, np)) != NULL;) {
                         if (strncmp(np->name, "i2c", 3) == 0) {
-                                of_platform_device_create(np, "u3-i2c");
+                                of_platform_device_create(np, "u3-i2c", NULL);
+                                of_node_put(np);
                                 break;
                         }
+                }
+                of_node_put(npp);
+        }
+        npp = of_find_node_by_type(NULL, "smu");
+        if (npp) {
+                of_platform_device_create(npp, "smu", NULL);
+                of_node_put(npp);
         }
 
         return 0;
diff --git a/arch/ppc64/kernel/pmac_time.c b/arch/ppc64/kernel/pmac_time.c
index 3059edb09cc8..41bbb8c59697 100644
--- a/arch/ppc64/kernel/pmac_time.c
+++ b/arch/ppc64/kernel/pmac_time.c
@@ -84,7 +84,7 @@ void __pmac pmac_get_rtc_time(struct rtc_time *tm)
 
 #ifdef CONFIG_PMAC_SMU
         case SYS_CTRLER_SMU:
-                smu_get_rtc_time(tm);
+                smu_get_rtc_time(tm, 1);
                 break;
 #endif /* CONFIG_PMAC_SMU */
         default:
@@ -128,7 +128,7 @@ int __pmac pmac_set_rtc_time(struct rtc_time *tm)
 
 #ifdef CONFIG_PMAC_SMU
         case SYS_CTRLER_SMU:
-                return smu_set_rtc_time(tm);
+                return smu_set_rtc_time(tm, 1);
 #endif /* CONFIG_PMAC_SMU */
         default:
                 return -ENODEV;
diff --git a/arch/ppc64/kernel/prom_init.c b/arch/ppc64/kernel/prom_init.c
index 9979919cdf92..f252670874a4 100644
--- a/arch/ppc64/kernel/prom_init.c
+++ b/arch/ppc64/kernel/prom_init.c
@@ -1711,6 +1711,7 @@ static void __init flatten_device_tree(void)
         unsigned long offset = reloc_offset();
         unsigned long mem_start, mem_end, room;
         struct boot_param_header *hdr;
+        struct prom_t *_prom = PTRRELOC(&prom);
         char *namep;
         u64 *rsvmap;
 
@@ -1765,6 +1766,7 @@ static void __init flatten_device_tree(void)
         RELOC(dt_struct_end) = PAGE_ALIGN(mem_start);
 
         /* Finish header */
+        hdr->boot_cpuid_phys = _prom->cpu;
         hdr->magic = OF_DT_HEADER;
         hdr->totalsize = RELOC(dt_struct_end) - RELOC(dt_header_start);
         hdr->off_dt_struct = RELOC(dt_struct_start) - RELOC(dt_header_start);
@@ -1854,7 +1856,6 @@ static void __init prom_find_boot_cpu(void)
 
         cpu_pkg = call_prom("instance-to-package", 1, 1, prom_cpu);
 
-        prom_setprop(cpu_pkg, "linux,boot-cpu", NULL, 0);
         prom_getprop(cpu_pkg, "reg", &getprop_rval, sizeof(getprop_rval));
         _prom->cpu = getprop_rval;
 
diff --git a/arch/ppc64/kernel/ptrace.c b/arch/ppc64/kernel/ptrace.c
index 85ed3188a91d..b1c044ca5756 100644
--- a/arch/ppc64/kernel/ptrace.c
+++ b/arch/ppc64/kernel/ptrace.c
@@ -219,6 +219,7 @@ int sys_ptrace(long request, long pid, long addr, long data)
 
         case PTRACE_SET_DEBUGREG:
                 ret = ptrace_set_debugreg(child, addr, data);
+                break;
 
         case PTRACE_DETACH:
                 ret = ptrace_detach(child, data);
diff --git a/arch/ppc64/kernel/vdso.c b/arch/ppc64/kernel/vdso.c
index 4777676365fe..efa985f05aca 100644
--- a/arch/ppc64/kernel/vdso.c
+++ b/arch/ppc64/kernel/vdso.c
@@ -224,10 +224,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int executable_stack)
         vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
         if (vma == NULL)
                 return -ENOMEM;
-        if (security_vm_enough_memory(vdso_pages)) {
-                kmem_cache_free(vm_area_cachep, vma);
-                return -ENOMEM;
-        }
+
         memset(vma, 0, sizeof(*vma));
 
         /*
@@ -237,8 +234,10 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int executable_stack)
          */
         vdso_base = get_unmapped_area(NULL, vdso_base,
                                       vdso_pages << PAGE_SHIFT, 0, 0);
-        if (vdso_base & ~PAGE_MASK)
+        if (vdso_base & ~PAGE_MASK) {
+                kmem_cache_free(vm_area_cachep, vma);
                 return (int)vdso_base;
+        }
 
         current->thread.vdso_base = vdso_base;
 
@@ -266,7 +265,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int executable_stack)
         vma->vm_ops = &vdso_vmops;
 
         down_write(&mm->mmap_sem);
-        insert_vm_struct(mm, vma);
+        if (insert_vm_struct(mm, vma)) {
+                up_write(&mm->mmap_sem);
+                kmem_cache_free(vm_area_cachep, vma);
+                return -ENOMEM;
+        }
         mm->total_vm += (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
         up_write(&mm->mmap_sem);
 
diff --git a/arch/ppc64/lib/Makefile b/arch/ppc64/lib/Makefile
index 76fbfa9f706f..0b6e967de948 100644
--- a/arch/ppc64/lib/Makefile
+++ b/arch/ppc64/lib/Makefile
@@ -2,7 +2,7 @@
 # Makefile for ppc64-specific library files..
 #
 
-lib-y := checksum.o dec_and_lock.o string.o strcase.o
+lib-y := checksum.o string.o strcase.o
 lib-y += copypage.o memcpy.o copyuser.o usercopy.o
 
 # Lock primitives are defined as no-ops in include/linux/spinlock.h
diff --git a/arch/ppc64/lib/dec_and_lock.c b/arch/ppc64/lib/dec_and_lock.c
deleted file mode 100644
index 7b9d4da5cf92..000000000000
--- a/arch/ppc64/lib/dec_and_lock.c
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * ppc64 version of atomic_dec_and_lock() using cmpxchg
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#include <linux/module.h>
-#include <linux/spinlock.h>
-#include <asm/atomic.h>
-#include <asm/system.h>
-
-/*
- * This is an implementation of the notion of "decrement a
- * reference count, and return locked if it decremented to zero".
- *
- * This implementation can be used on any architecture that
- * has a cmpxchg, and where atomic->value is an int holding
- * the value of the atomic (i.e. the high bits aren't used
- * for a lock or anything like that).
- */
-int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock)
-{
-        int counter;
-        int newcount;
-
-        for (;;) {
-                counter = atomic_read(atomic);
-                newcount = counter - 1;
-                if (!newcount)
-                        break;          /* do it the slow way */
-
-                newcount = cmpxchg(&atomic->counter, counter, newcount);
-                if (newcount == counter)
-                        return 0;
-        }
-
-        spin_lock(lock);
-        if (atomic_dec_and_test(atomic))
-                return 1;
-        spin_unlock(lock);
-        return 0;
-}
-
-EXPORT_SYMBOL(_atomic_dec_and_lock);
diff --git a/arch/ppc64/mm/fault.c b/arch/ppc64/mm/fault.c
index 7fbc68bbb739..be3f25cf3e9f 100644
--- a/arch/ppc64/mm/fault.c
+++ b/arch/ppc64/mm/fault.c
@@ -38,6 +38,7 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 #include <asm/kdebug.h>
+#include <asm/siginfo.h>
 
 /*
  * Check whether the instruction at regs->nip is a store using
diff --git a/arch/ppc64/mm/hash_native.c b/arch/ppc64/mm/hash_native.c
index 7626bb59954d..bfd385b7713c 100644
--- a/arch/ppc64/mm/hash_native.c
+++ b/arch/ppc64/mm/hash_native.c
@@ -343,9 +343,7 @@ static void native_flush_hash_range(unsigned long context,
         hpte_t *hptep;
         unsigned long hpte_v;
         struct ppc64_tlb_batch *batch = &__get_cpu_var(ppc64_tlb_batch);
-
-        /* XXX fix for large ptes */
-        unsigned long large = 0;
+        unsigned long large = batch->large;
 
         local_irq_save(flags);
 
@@ -407,7 +405,7 @@ static void native_flush_hash_range(unsigned long context,
                 asm volatile("ptesync":::"memory");
 
                 for (i = 0; i < j; i++)
-                        __tlbie(batch->vaddr[i], 0);
+                        __tlbie(batch->vaddr[i], large);
 
                 asm volatile("eieio; tlbsync; ptesync":::"memory");
 
diff --git a/arch/ppc64/mm/hugetlbpage.c b/arch/ppc64/mm/hugetlbpage.c
index 338771ec70d7..0ea0994ed974 100644
--- a/arch/ppc64/mm/hugetlbpage.c
+++ b/arch/ppc64/mm/hugetlbpage.c
@@ -710,10 +710,13 @@ repeat:
                         hpte_group = ((~hash & htab_hash_mask) *
                                       HPTES_PER_GROUP) & ~0x7UL; 
                         slot = ppc_md.hpte_insert(hpte_group, va, prpn,
-                                                  HPTE_V_LARGE, rflags);
+                                                  HPTE_V_LARGE |
+                                                  HPTE_V_SECONDARY,
+                                                  rflags);
                         if (slot == -1) {
                                 if (mftb() & 0x1)
-                                        hpte_group = ((hash & htab_hash_mask) * HPTES_PER_GROUP) & ~0x7UL;
+                                        hpte_group = ((hash & htab_hash_mask) *
+                                                      HPTES_PER_GROUP)&~0x7UL;
 
                                 ppc_md.hpte_remove(hpte_group);
                                 goto repeat;
diff --git a/arch/ppc64/mm/tlb.c b/arch/ppc64/mm/tlb.c
index d8a6593a13f0..21fbffb23a43 100644
--- a/arch/ppc64/mm/tlb.c
+++ b/arch/ppc64/mm/tlb.c
@@ -143,7 +143,8 @@ void hpte_update(struct mm_struct *mm, unsigned long addr,
          * up scanning and resetting referenced bits then our batch context
          * will change mid stream.
          */
-        if (unlikely(i != 0 && context != batch->context)) {
+        if (i != 0 && (context != batch->context ||
+                       batch->large != pte_huge(pte))) {
                 flush_tlb_pending();
                 i = 0;
         }
@@ -151,6 +152,7 @@ void hpte_update(struct mm_struct *mm, unsigned long addr,
         if (i == 0) {
                 batch->context = context;
                 batch->mm = mm;
+                batch->large = pte_huge(pte);
         }
         batch->pte[i] = __pte(pte);
         batch->addr[i] = addr;
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 0865251a3f44..45d44c6bb39d 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc4
-# Fri Jul 29 14:49:30 2005
+# Linux kernel version: 2.6.14-rc1
+# Wed Sep 14 16:46:19 2005
 #
 CONFIG_MMU=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
@@ -21,6 +21,7 @@ CONFIG_INIT_ENV_ARG_LIMIT=32
 # General setup
 #
 CONFIG_LOCALVERSION=""
+CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -33,6 +34,7 @@ CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
+CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
@@ -94,6 +96,7 @@ CONFIG_FLATMEM_MANUAL=y
 # CONFIG_SPARSEMEM_MANUAL is not set
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
+# CONFIG_SPARSEMEM_STATIC is not set
 
 #
 # I/O subsystem configuration
@@ -151,8 +154,8 @@ CONFIG_IP_FIB_HASH=y
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
 # CONFIG_INET_TUNNEL is not set
-CONFIG_IP_TCPDIAG=y
-CONFIG_IP_TCPDIAG_IPV6=y
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
 CONFIG_TCP_CONG_BIC=y
 CONFIG_IPV6=y
@@ -165,6 +168,11 @@ CONFIG_IPV6=y
 # CONFIG_NETFILTER is not set
 
 #
+# DCCP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_DCCP is not set
+
+#
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
@@ -217,9 +225,11 @@ CONFIG_NET_CLS_POLICE=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
+# CONFIG_NETFILTER_NETLINK is not set
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
+# CONFIG_IEEE80211 is not set
 # CONFIG_PCMCIA is not set
 
 #
@@ -233,6 +243,7 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 #
 # SCSI device support
 #
+# CONFIG_RAID_ATTRS is not set
 CONFIG_SCSI=y
 CONFIG_SCSI_PROC_FS=y
 
@@ -260,6 +271,7 @@ CONFIG_SCSI_LOGGING=y
 # CONFIG_SCSI_SPI_ATTRS is not set
 CONFIG_SCSI_FC_ATTRS=y
 # CONFIG_SCSI_ISCSI_ATTRS is not set
+# CONFIG_SCSI_SAS_ATTRS is not set
 
 #
 # SCSI low-level drivers
@@ -280,7 +292,6 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_LBD is not set
 # CONFIG_CDROM_PKTCDVD is not set
 
@@ -384,6 +395,10 @@ CONFIG_EQUALIZER=m
 CONFIG_TUN=m
 
 #
+# PHY device support
+#
+
+#
 # Ethernet (10 or 100Mbit)
 #
 CONFIG_NET_ETHERNET=y
@@ -453,10 +468,6 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
-
-#
-# XFS support
-#
 # CONFIG_XFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -465,6 +476,7 @@ CONFIG_INOTIFY=y
 CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
+# CONFIG_FUSE_FS is not set
 
 #
 # CD-ROM/DVD Filesystems
@@ -485,11 +497,10 @@ CONFIG_DNOTIFY=y
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_SYSFS=y
-# CONFIG_DEVPTS_FS_XATTR is not set
 CONFIG_TMPFS=y
-# CONFIG_TMPFS_XATTR is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
+# CONFIG_RELAYFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -533,6 +544,7 @@ CONFIG_SUNRPC=y
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
+# CONFIG_9P_FS is not set
 
 #
 # Partition Types
@@ -572,6 +584,7 @@ CONFIG_MSDOS_PARTITION=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_LOG_BUF_SHIFT=17
+CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
 CONFIG_DEBUG_PREEMPT=y
@@ -626,5 +639,6 @@ CONFIG_CRYPTO=y
 # Library routines
 #
 # CONFIG_CRC_CCITT is not set
+# CONFIG_CRC16 is not set
 CONFIG_CRC32=m
 # CONFIG_LIBCRC32C is not set
diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
index ab1e49d2e518..8584dd823218 100644
--- a/arch/s390/kernel/Makefile
+++ b/arch/s390/kernel/Makefile
@@ -6,7 +6,7 @@ EXTRA_AFLAGS	:= -traditional
 
 obj-y   :=  bitmap.o traps.o time.o process.o \
             setup.o sys_s390.o ptrace.o signal.o cpcmd.o ebcdic.o \
-            semaphore.o s390_ext.o debug.o profile.o irq.o
+            semaphore.o s390_ext.o debug.o profile.o irq.o reipl_diag.o
 
 extra-$(CONFIG_ARCH_S390_31)    += head.o 
 extra-$(CONFIG_ARCH_S390X)      += head64.o 
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index 7358cdb8441f..4ff6808456ea 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -143,7 +143,7 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
                         break;
                 case __SI_FAULT >> 16:
                         err |= __get_user(tmp, &from->si_addr);
-                        to->si_addr = (void *)(u64) (tmp & PSW32_ADDR_INSN);
+                        to->si_addr = (void __user *)(u64) (tmp & PSW32_ADDR_INSN);
                         break;
                 case __SI_POLL >> 16:
                         err |= __get_user(to->si_band, &from->si_band);
@@ -338,7 +338,7 @@ sys32_sigaltstack(const stack_t32 __user *uss, stack_t32 __user *uoss,
                 err |= __get_user(kss.ss_flags, &uss->ss_flags);
                 if (err)
                         return -EFAULT;
-                kss.ss_sp = (void *) ss_sp;
+                kss.ss_sp = (void __user *) ss_sp;
         }
 
         set_fs (KERNEL_DS);
@@ -461,7 +461,7 @@ asmlinkage long sys32_rt_sigreturn(struct pt_regs *regs)
                 goto badframe;
 
         err = __get_user(ss_sp, &frame->uc.uc_stack.ss_sp);
-        st.ss_sp = (void *) A((unsigned long)ss_sp);
+        st.ss_sp = compat_ptr(ss_sp);
         err |= __get_user(st.ss_size, &frame->uc.uc_stack.ss_size);
         err |= __get_user(st.ss_flags, &frame->uc.uc_stack.ss_flags);
         if (err)
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 58fc7fbcb40e..9b30f4cf32c4 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -108,7 +108,7 @@ STACK_SIZE  = 1 << STACK_SHIFT
         bl      BASED(0f)
         l       %r14,BASED(.Lcleanup_critical)
         basr    %r14,%r14
-        tm      0(%r12),0x01            # retest problem state after cleanup
+        tm      1(%r12),0x01            # retest problem state after cleanup
         bnz     BASED(1f)
 0:      l       %r14,__LC_ASYNC_STACK   # are we already on the async stack ?
         slr     %r14,%r15
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index d0c9ffaa25db..7b9b4a2ba1d7 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -101,7 +101,7 @@ _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_NEED_RESCHED | _TIF_MCCK_PENDING)
         clc     \psworg+8(8),BASED(.Lcritical_start)
         jl      0f
         brasl   %r14,cleanup_critical
-        tm      0(%r12),0x01            # retest problem state after cleanup
+        tm      1(%r12),0x01            # retest problem state after cleanup
         jnz     1f
 0:      lg      %r14,__LC_ASYNC_STACK   # are we already on the async. stack ?
         slgr    %r14,%r15
diff --git a/arch/s390/kernel/reipl_diag.c b/arch/s390/kernel/reipl_diag.c
new file mode 100644
index 000000000000..83cb42bc0b76
--- /dev/null
+++ b/arch/s390/kernel/reipl_diag.c
@@ -0,0 +1,39 @@
+/*
+ * This file contains the implementation of the
+ * Linux re-IPL support
+ *
+ * (C) Copyright IBM Corp. 2005
+ *
+ * Author(s): Volker Sameske (sameske@de.ibm.com)
+ *
+ */
+
+#include <linux/kernel.h>
+
+static unsigned int reipl_diag_rc1;
+static unsigned int reipl_diag_rc2;
+
+/*
+ * re-IPL the system using the last used IPL parameters
+ */
+void reipl_diag(void)
+{
+        asm volatile (
+                "   la   %%r4,0\n"
+                "   la   %%r5,0\n"
+                "   diag %%r4,%2,0x308\n"
+                "0:\n"
+                "   st   %%r4,%0\n"
+                "   st   %%r5,%1\n"
+                ".section __ex_table,\"a\"\n"
+#ifdef __s390x__
+                "   .align 8\n"
+                "   .quad 0b, 0b\n"
+#else
+                "   .align 4\n"
+                "   .long 0b, 0b\n"
+#endif
+                ".previous\n"
+                : "=m" (reipl_diag_rc1), "=m" (reipl_diag_rc2)
+                : "d" (3) : "cc", "4", "5" );
+}
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 5ba5a5485da9..5204778b8e5e 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -261,8 +261,11 @@ void (*_machine_power_off)(void) = machine_power_off_smp;
  * Reboot, halt and power_off routines for non SMP.
  */
 extern void reipl(unsigned long devno);
+extern void reipl_diag(void);
 static void do_machine_restart_nonsmp(char * __unused)
 {
+        reipl_diag();
+
         if (MACHINE_IS_VM)
                 cpcmd ("IPL", NULL, 0);
         else
@@ -634,6 +637,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)
         struct cpuinfo_S390 *cpuinfo;
         unsigned long n = (unsigned long) v - 1;
 
+        preempt_disable();
         if (!n) {
                 seq_printf(m, "vendor_id       : IBM/S390\n"
                                "# processors    : %i\n"
@@ -658,6 +662,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                                cpuinfo->cpu_id.ident,
                                cpuinfo->cpu_id.machine);
         }
+        preempt_enable();
         return 0;
 }
 
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index 6a3f5b7473a9..6e0110d71191 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -376,8 +376,8 @@ static void setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
 
         /* Create the ucontext.  */
         err |= __put_user(0, &frame->uc.uc_flags);
-        err |= __put_user(0, &frame->uc.uc_link);
-        err |= __put_user((void *)current->sas_ss_sp, &frame->uc.uc_stack.ss_sp);
+        err |= __put_user(NULL, &frame->uc.uc_link);
+        err |= __put_user((void __user *)current->sas_ss_sp, &frame->uc.uc_stack.ss_sp);
         err |= __put_user(sas_ss_flags(regs->gprs[15]),
                           &frame->uc.uc_stack.ss_flags);
         err |= __put_user(current->sas_ss_size, &frame->uc.uc_stack.ss_size);
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 85222fee4361..e13c87b446b2 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -65,6 +65,7 @@ extern char vmhalt_cmd[];
 extern char vmpoff_cmd[];
 
 extern void reipl(unsigned long devno);
+extern void reipl_diag(void);
 
 static void smp_ext_bitcall(int, ec_bit_sig);
 static void smp_ext_bitcall_others(ec_bit_sig);
@@ -283,6 +284,8 @@ static void do_machine_restart(void * __unused)
          * interrupted by an external interrupt and s390irq
          * locks are always held disabled).
          */
+        reipl_diag();
+
         if (MACHINE_IS_VM)
                 cpcmd ("IPL", NULL, 0, NULL);
         else
diff --git a/arch/sparc/kernel/setup.c b/arch/sparc/kernel/setup.c
index 53c192a4982f..3509e4305532 100644
--- a/arch/sparc/kernel/setup.c
+++ b/arch/sparc/kernel/setup.c
@@ -249,8 +249,6 @@ struct tt_entry *sparc_ttable;
 
 struct pt_regs fake_swapper_regs;
 
-extern void paging_init(void);
-
 void __init setup_arch(char **cmdline_p)
 {
         int i;
diff --git a/arch/sparc64/Kconfig.debug b/arch/sparc64/Kconfig.debug
index cd8d39fb954d..fa06ea04837b 100644
--- a/arch/sparc64/Kconfig.debug
+++ b/arch/sparc64/Kconfig.debug
@@ -33,13 +33,13 @@ config DEBUG_BOOTMEM
         depends on DEBUG_KERNEL
         bool "Debug BOOTMEM initialization"
 
-# We have a custom atomic_dec_and_lock() implementation but it's not
-# compatible with spinlock debugging so we need to fall back on
-# the generic version in that case.
-config HAVE_DEC_LOCK
-        bool
-        depends on SMP && !DEBUG_SPINLOCK
-        default y
+config DEBUG_PAGEALLOC
+        bool "Page alloc debugging"
+        depends on DEBUG_KERNEL && !SOFTWARE_SUSPEND
+        help
+          Unmap pages from the kernel linear mapping after free_pages().
+          This results in a large slowdown, but helps to find certain types
+          of memory corruptions.
 
 config MCOUNT
         bool
diff --git a/arch/sparc64/kernel/cpu.c b/arch/sparc64/kernel/cpu.c
index 48756958116b..77ef5df4e5a7 100644
--- a/arch/sparc64/kernel/cpu.c
+++ b/arch/sparc64/kernel/cpu.c
@@ -39,6 +39,8 @@ struct cpu_fp_info linux_sparc_fpu[] = {
   { 0x3e, 0x15, 0, "UltraSparc III+ integrated FPU"},
   { 0x3e, 0x16, 0, "UltraSparc IIIi integrated FPU"},
   { 0x3e, 0x18, 0, "UltraSparc IV integrated FPU"},
+  { 0x3e, 0x19, 0, "UltraSparc IV+ integrated FPU"},
+  { 0x3e, 0x22, 0, "UltraSparc IIIi+ integrated FPU"},
 };
 
 #define NSPARCFPU  (sizeof(linux_sparc_fpu)/sizeof(struct cpu_fp_info))
@@ -53,6 +55,8 @@ struct cpu_iu_info linux_sparc_chips[] = {
   { 0x3e, 0x15, "TI UltraSparc III+ (Cheetah+)"},
   { 0x3e, 0x16, "TI UltraSparc IIIi (Jalapeno)"},
   { 0x3e, 0x18, "TI UltraSparc IV (Jaguar)"},
+  { 0x3e, 0x19, "TI UltraSparc IV+ (Panther)"},
+  { 0x3e, 0x22, "TI UltraSparc IIIi+ (Serrano)"},
 };
 
 #define NSPARCCHIPS  (sizeof(linux_sparc_chips)/sizeof(struct cpu_iu_info))
diff --git a/arch/sparc64/kernel/devices.c b/arch/sparc64/kernel/devices.c
index d710274e516b..df9a1ca8fd77 100644
--- a/arch/sparc64/kernel/devices.c
+++ b/arch/sparc64/kernel/devices.c
@@ -135,6 +135,28 @@ void __init device_scan(void)
                 cpu_data(0).clock_tick = prom_getintdefault(cpu_node,
                                                             "clock-frequency",
                                                             0);
+                cpu_data(0).dcache_size = prom_getintdefault(cpu_node,
+                                                             "dcache-size",
+                                                             16 * 1024);
+                cpu_data(0).dcache_line_size =
+                        prom_getintdefault(cpu_node, "dcache-line-size", 32);
+                cpu_data(0).icache_size = prom_getintdefault(cpu_node,
+                                                             "icache-size",
+                                                             16 * 1024);
+                cpu_data(0).icache_line_size =
+                        prom_getintdefault(cpu_node, "icache-line-size", 32);
+                cpu_data(0).ecache_size = prom_getintdefault(cpu_node,
+                                                             "ecache-size",
+                                                             4 * 1024 * 1024);
+                cpu_data(0).ecache_line_size =
+                        prom_getintdefault(cpu_node, "ecache-line-size", 64);
+                printk("CPU[0]: Caches "
+                       "D[sz(%d):line_sz(%d)] "
+                       "I[sz(%d):line_sz(%d)] "
+                       "E[sz(%d):line_sz(%d)]\n",
+                       cpu_data(0).dcache_size, cpu_data(0).dcache_line_size,
+                       cpu_data(0).icache_size, cpu_data(0).icache_line_size,
+                       cpu_data(0).ecache_size, cpu_data(0).ecache_line_size);
         }
 #endif
 
diff --git a/arch/sparc64/kernel/dtlb_backend.S b/arch/sparc64/kernel/dtlb_backend.S
index 538522848ad4..acc889a7f9c1 100644
--- a/arch/sparc64/kernel/dtlb_backend.S
+++ b/arch/sparc64/kernel/dtlb_backend.S
@@ -9,17 +9,7 @@
 #include <asm/pgtable.h>
 #include <asm/mmu.h>
 
-#if PAGE_SHIFT == 13
-#define SZ_BITS         _PAGE_SZ8K
-#elif PAGE_SHIFT == 16
-#define SZ_BITS         _PAGE_SZ64K
-#elif PAGE_SHIFT == 19
-#define SZ_BITS         _PAGE_SZ512K
-#elif PAGE_SHIFT == 22
-#define SZ_BITS         _PAGE_SZ4MB
-#endif
-
-#define VALID_SZ_BITS   (_PAGE_VALID | SZ_BITS)
+#define VALID_SZ_BITS   (_PAGE_VALID | _PAGE_SZBITS)
 
 #define VPTE_BITS               (_PAGE_CP | _PAGE_CV | _PAGE_P )
 #define VPTE_SHIFT              (PAGE_SHIFT - 3)
@@ -163,7 +153,6 @@ sparc64_vpte_continue:
         stxa            %g4, [%g1 + %g1] ASI_DMMU       ! Restore previous TAG_ACCESS
         retry                                           ! Load PTE once again
 
-#undef SZ_BITS
 #undef VALID_SZ_BITS
 #undef VPTE_SHIFT
 #undef VPTE_BITS
diff --git a/arch/sparc64/kernel/dtlb_base.S b/arch/sparc64/kernel/dtlb_base.S
index ded2fed23fcc..702d349c1e88 100644
--- a/arch/sparc64/kernel/dtlb_base.S
+++ b/arch/sparc64/kernel/dtlb_base.S
@@ -71,7 +71,7 @@
 from_tl1_trap:
         rdpr            %tl, %g5                        ! For TL==3 test
         CREATE_VPTE_OFFSET1(%g4, %g6)                   ! Create VPTE offset
-        be,pn           %xcc, 3f                        ! Yep, special processing
+        be,pn           %xcc, kvmap                     ! Yep, special processing
          CREATE_VPTE_OFFSET2(%g4, %g6)                  ! Create VPTE offset
         cmp             %g5, 4                          ! Last trap level?
         be,pn           %xcc, longpath                  ! Yep, cannot risk VPTE miss
@@ -83,9 +83,9 @@ from_tl1_trap:
          nop                                            ! Delay-slot
 9:      stxa            %g5, [%g0] ASI_DTLB_DATA_IN     ! Reload TLB
         retry                                           ! Trap return
-3:      brlz,pt         %g4, 9b                         ! Kernel virtual map?
-         xor            %g2, %g4, %g5                   ! Finish bit twiddles
-        ba,a,pt         %xcc, kvmap                     ! Yep, go check for obp/vmalloc
+        nop
+        nop
+        nop
 
 /* DTLB ** ICACHE line 3: winfixups+real_faults         */
 longpath:
diff --git a/arch/sparc64/kernel/entry.S b/arch/sparc64/kernel/entry.S
index 3e0badb820c5..2879b1072921 100644
--- a/arch/sparc64/kernel/entry.S
+++ b/arch/sparc64/kernel/entry.S
@@ -30,160 +30,6 @@
         .text
         .align          32
 
-        .globl          sparc64_vpte_patchme1
-        .globl          sparc64_vpte_patchme2
-/*
- * On a second level vpte miss, check whether the original fault is to the OBP 
- * range (note that this is only possible for instruction miss, data misses to
- * obp range do not use vpte). If so, go back directly to the faulting address.
- * This is because we want to read the tpc, otherwise we have no way of knowing
- * the 8k aligned faulting address if we are using >8k kernel pagesize. This
- * also ensures no vpte range addresses are dropped into tlb while obp is
- * executing (see inherit_locked_prom_mappings() rant).
- */
-sparc64_vpte_nucleus:
-        /* Load 0xf0000000, which is LOW_OBP_ADDRESS.  */
-        mov             0xf, %g5
-        sllx            %g5, 28, %g5
-
-        /* Is addr >= LOW_OBP_ADDRESS?  */
-        cmp             %g4, %g5
-        blu,pn          %xcc, sparc64_vpte_patchme1
-         mov            0x1, %g5
-
-        /* Load 0x100000000, which is HI_OBP_ADDRESS.  */
-        sllx            %g5, 32, %g5
-
-        /* Is addr < HI_OBP_ADDRESS?  */
-        cmp             %g4, %g5
-        blu,pn          %xcc, obp_iaddr_patch
-         nop
-
-        /* These two instructions are patched by paginig_init().  */
-sparc64_vpte_patchme1:
-        sethi           %hi(0), %g5
-sparc64_vpte_patchme2:
-        or              %g5, %lo(0), %g5
-
-        /* With kernel PGD in %g5, branch back into dtlb_backend.  */
-        ba,pt           %xcc, sparc64_kpte_continue
-         andn           %g1, 0x3, %g1   /* Finish PMD offset adjustment.  */
-
-vpte_noent:
-        /* Restore previous TAG_ACCESS, %g5 is zero, and we will
-         * skip over the trap instruction so that the top level
-         * TLB miss handler will thing this %g5 value is just an
-         * invalid PTE, thus branching to full fault processing.
-         */
-        mov             TLB_SFSR, %g1
-        stxa            %g4, [%g1 + %g1] ASI_DMMU
-        done
-
-        .globl          obp_iaddr_patch
-obp_iaddr_patch:
-        /* These two instructions patched by inherit_prom_mappings().  */
-        sethi           %hi(0), %g5
-        or              %g5, %lo(0), %g5
-
-        /* Behave as if we are at TL0.  */
-        wrpr            %g0, 1, %tl
-        rdpr            %tpc, %g4       /* Find original faulting iaddr */
-        srlx            %g4, 13, %g4    /* Throw out context bits */
-        sllx            %g4, 13, %g4    /* g4 has vpn + ctx0 now */
-
-        /* Restore previous TAG_ACCESS.  */
-        mov             TLB_SFSR, %g1
-        stxa            %g4, [%g1 + %g1] ASI_IMMU
-
-        /* Get PMD offset.  */
-        srlx            %g4, 23, %g6
-        and             %g6, 0x7ff, %g6
-        sllx            %g6, 2, %g6
-
-        /* Load PMD, is it valid?  */
-        lduwa           [%g5 + %g6] ASI_PHYS_USE_EC, %g5
-        brz,pn          %g5, longpath
-         sllx           %g5, 11, %g5
-
-        /* Get PTE offset.  */
-        srlx            %g4, 13, %g6
-        and             %g6, 0x3ff, %g6
-        sllx            %g6, 3, %g6
-
-        /* Load PTE.  */
-        ldxa            [%g5 + %g6] ASI_PHYS_USE_EC, %g5
-        brgez,pn        %g5, longpath
-         nop
-
-        /* TLB load and return from trap.  */
-        stxa            %g5, [%g0] ASI_ITLB_DATA_IN
-        retry
-
-        .globl          obp_daddr_patch
-obp_daddr_patch:
-        /* These two instructions patched by inherit_prom_mappings().  */
-        sethi           %hi(0), %g5
-        or              %g5, %lo(0), %g5
-
-        /* Get PMD offset.  */
-        srlx            %g4, 23, %g6
-        and             %g6, 0x7ff, %g6
-        sllx            %g6, 2, %g6
-
-        /* Load PMD, is it valid?  */
-        lduwa           [%g5 + %g6] ASI_PHYS_USE_EC, %g5
-        brz,pn          %g5, longpath
-         sllx           %g5, 11, %g5
-
-        /* Get PTE offset.  */
-        srlx            %g4, 13, %g6
-        and             %g6, 0x3ff, %g6
-        sllx            %g6, 3, %g6
-
-        /* Load PTE.  */
-        ldxa            [%g5 + %g6] ASI_PHYS_USE_EC, %g5
-        brgez,pn        %g5, longpath
-         nop
-
-        /* TLB load and return from trap.  */
-        stxa            %g5, [%g0] ASI_DTLB_DATA_IN
-        retry
-
-/*
- * On a first level data miss, check whether this is to the OBP range (note
- * that such accesses can be made by prom, as well as by kernel using
- * prom_getproperty on "address"), and if so, do not use vpte access ...
- * rather, use information saved during inherit_prom_mappings() using 8k
- * pagesize.
- */
-kvmap:
-        /* Load 0xf0000000, which is LOW_OBP_ADDRESS.  */
-        mov             0xf, %g5
-        sllx            %g5, 28, %g5
-
-        /* Is addr >= LOW_OBP_ADDRESS?  */
-        cmp             %g4, %g5
-        blu,pn          %xcc, vmalloc_addr
-         mov            0x1, %g5
-
-        /* Load 0x100000000, which is HI_OBP_ADDRESS.  */
-        sllx            %g5, 32, %g5
-
-        /* Is addr < HI_OBP_ADDRESS?  */
-        cmp             %g4, %g5
-        blu,pn          %xcc, obp_daddr_patch
-         nop
-
-vmalloc_addr:
-        /* If we get here, a vmalloc addr accessed, load kernel VPTE.  */
-        ldxa            [%g3 + %g6] ASI_N, %g5
-        brgez,pn        %g5, longpath
-         nop
-
-        /* PTE is valid, load into TLB and return from trap.  */
-        stxa            %g5, [%g0] ASI_DTLB_DATA_IN     ! Reload TLB
-        retry
-
         /* This is trivial with the new code... */
         .globl          do_fpdis
 do_fpdis:
@@ -526,14 +372,13 @@ cheetah_plus_patch_fpdis:
          *
          * DATA 0: [low 32-bits]  Address of function to call, jmp to this
          *         [high 32-bits] MMU Context Argument 0, place in %g5
-         * DATA 1: Address Argument 1, place in %g6
+         * DATA 1: Address Argument 1, place in %g1
          * DATA 2: Address Argument 2, place in %g7
          *
          * With this method we can do most of the cross-call tlb/cache
          * flushing very quickly.
          *
-         * Current CPU's IRQ worklist table is locked into %g1,
-         * don't touch.
+         * Current CPU's IRQ worklist table is locked into %g6, don't touch.
          */
         .text
         .align          32
@@ -1007,13 +852,14 @@ cheetah_plus_dcpe_trap_vector:
         nop
 
 do_cheetah_plus_data_parity:
-        ba,pt           %xcc, etrap
+        rdpr            %pil, %g2
+        wrpr            %g0, 15, %pil
+        ba,pt           %xcc, etrap_irq
          rd             %pc, %g7
         mov             0x0, %o0
         call            cheetah_plus_parity_error
          add            %sp, PTREGS_OFF, %o1
-        ba,pt           %xcc, rtrap
-         clr            %l6
+        ba,a,pt         %xcc, rtrap_irq
 
 cheetah_plus_dcpe_trap_vector_tl1:
         membar          #Sync
@@ -1037,13 +883,14 @@ cheetah_plus_icpe_trap_vector:
         nop
 
 do_cheetah_plus_insn_parity:
-        ba,pt           %xcc, etrap
+        rdpr            %pil, %g2
+        wrpr            %g0, 15, %pil
+        ba,pt           %xcc, etrap_irq
          rd             %pc, %g7
         mov             0x1, %o0
         call            cheetah_plus_parity_error
          add            %sp, PTREGS_OFF, %o1
-        ba,pt           %xcc, rtrap
-         clr            %l6
+        ba,a,pt         %xcc, rtrap_irq
 
 cheetah_plus_icpe_trap_vector_tl1:
         membar          #Sync
@@ -1076,6 +923,10 @@ do_dcpe_tl1:
          nop
         wrpr            %g1, %tl                ! Restore original trap level
 do_dcpe_tl1_nonfatal:   /* Ok we may use interrupt globals safely. */
+        sethi           %hi(dcache_parity_tl1_occurred), %g2
+        lduw            [%g2 + %lo(dcache_parity_tl1_occurred)], %g1
+        add             %g1, 1, %g1
+        stw             %g1, [%g2 + %lo(dcache_parity_tl1_occurred)]
         /* Reset D-cache parity */
         sethi           %hi(1 << 16), %g1       ! D-cache size
         mov             (1 << 5), %g2           ! D-cache line size
@@ -1122,6 +973,10 @@ do_icpe_tl1:
          nop
         wrpr            %g1, %tl                ! Restore original trap level
 do_icpe_tl1_nonfatal:   /* Ok we may use interrupt globals safely. */
+        sethi           %hi(icache_parity_tl1_occurred), %g2
+        lduw            [%g2 + %lo(icache_parity_tl1_occurred)], %g1
+        add             %g1, 1, %g1
+        stw             %g1, [%g2 + %lo(icache_parity_tl1_occurred)]
         /* Flush I-cache */
         sethi           %hi(1 << 15), %g1       ! I-cache size
         mov             (1 << 5), %g2           ! I-cache line size
diff --git a/arch/sparc64/kernel/head.S b/arch/sparc64/kernel/head.S
index 1fa06c4e3bdb..89406f9649a9 100644
--- a/arch/sparc64/kernel/head.S
+++ b/arch/sparc64/kernel/head.S
@@ -80,15 +80,165 @@ sparc_ramdisk_image64:
         .xword  0
         .word   _end
 
-        /* We must be careful, 32-bit OpenBOOT will get confused if it
-         * tries to save away a register window to a 64-bit kernel
-         * stack address.  Flush all windows, disable interrupts,
-         * remap if necessary, jump onto kernel trap table, then kernel
-         * stack, or else we die.
+        /* PROM cif handler code address is in %o4.  */
+sparc64_boot:
+1:      rd      %pc, %g7
+        set     1b, %g1
+        cmp     %g1, %g7
+        be,pn   %xcc, sparc64_boot_after_remap
+         mov    %o4, %l7
+
+        /* We need to remap the kernel.  Use position independant
+         * code to remap us to KERNBASE.
          *
-         * PROM entry point is on %o4
+         * SILO can invoke us with 32-bit address masking enabled,
+         * so make sure that's clear.
          */
-sparc64_boot:
+        rdpr    %pstate, %g1
+        andn    %g1, PSTATE_AM, %g1
+        wrpr    %g1, 0x0, %pstate
+        ba,a,pt %xcc, 1f
+
+        .globl  prom_finddev_name, prom_chosen_path
+        .globl  prom_getprop_name, prom_mmu_name
+        .globl  prom_callmethod_name, prom_translate_name
+        .globl  prom_map_name, prom_unmap_name, prom_mmu_ihandle_cache
+        .globl  prom_boot_mapped_pc, prom_boot_mapping_mode
+        .globl  prom_boot_mapping_phys_high, prom_boot_mapping_phys_low
+prom_finddev_name:
+        .asciz  "finddevice"
+prom_chosen_path:
+        .asciz  "/chosen"
+prom_getprop_name:
+        .asciz  "getprop"
+prom_mmu_name:
+        .asciz  "mmu"
+prom_callmethod_name:
+        .asciz  "call-method"
+prom_translate_name:
+        .asciz  "translate"
+prom_map_name:
+        .asciz  "map"
+prom_unmap_name:
+        .asciz  "unmap"
+        .align  4
+prom_mmu_ihandle_cache:
+        .word   0
+prom_boot_mapped_pc:
+        .word   0
+prom_boot_mapping_mode:
+        .word   0
+        .align  8
+prom_boot_mapping_phys_high:
+        .xword  0
+prom_boot_mapping_phys_low:
+        .xword  0
+1:
+        rd      %pc, %l0
+        mov     (1b - prom_finddev_name), %l1
+        mov     (1b - prom_chosen_path), %l2
+        mov     (1b - prom_boot_mapped_pc), %l3
+        sub     %l0, %l1, %l1
+        sub     %l0, %l2, %l2
+        sub     %l0, %l3, %l3
+        stw     %l0, [%l3]
+        sub     %sp, (192 + 128), %sp
+
+        /* chosen_node = prom_finddevice("/chosen") */
+        stx     %l1, [%sp + 2047 + 128 + 0x00]  ! service, "finddevice"
+        mov     1, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x08]  ! num_args, 1
+        stx     %l3, [%sp + 2047 + 128 + 0x10]  ! num_rets, 1
+        stx     %l2, [%sp + 2047 + 128 + 0x18]  ! arg1, "/chosen"
+        stx     %g0, [%sp + 2047 + 128 + 0x20]  ! ret1
+        call    %l7
+         add    %sp, (2047 + 128), %o0          ! argument array
+
+        ldx     [%sp + 2047 + 128 + 0x20], %l4  ! chosen device node
+
+        mov     (1b - prom_getprop_name), %l1
+        mov     (1b - prom_mmu_name), %l2
+        mov     (1b - prom_mmu_ihandle_cache), %l5
+        sub     %l0, %l1, %l1
+        sub     %l0, %l2, %l2
+        sub     %l0, %l5, %l5
+
+        /* prom_mmu_ihandle_cache = prom_getint(chosen_node, "mmu") */
+        stx     %l1, [%sp + 2047 + 128 + 0x00]  ! service, "getprop"
+        mov     4, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x08]  ! num_args, 4
+        mov     1, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x10]  ! num_rets, 1
+        stx     %l4, [%sp + 2047 + 128 + 0x18]  ! arg1, chosen_node
+        stx     %l2, [%sp + 2047 + 128 + 0x20]  ! arg2, "mmu"
+        stx     %l5, [%sp + 2047 + 128 + 0x28]  ! arg3, &prom_mmu_ihandle_cache
+        mov     4, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x30]  ! arg4, sizeof(arg3)
+        stx     %g0, [%sp + 2047 + 128 + 0x38]  ! ret1
+        call    %l7
+         add    %sp, (2047 + 128), %o0          ! argument array
+
+        mov     (1b - prom_callmethod_name), %l1
+        mov     (1b - prom_translate_name), %l2
+        sub     %l0, %l1, %l1
+        sub     %l0, %l2, %l2
+        lduw    [%l5], %l5                      ! prom_mmu_ihandle_cache
+
+        stx     %l1, [%sp + 2047 + 128 + 0x00]  ! service, "call-method"
+        mov     3, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x08]  ! num_args, 3
+        mov     5, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x10]  ! num_rets, 5
+        stx     %l2, [%sp + 2047 + 128 + 0x18]  ! arg1: "translate"
+        stx     %l5, [%sp + 2047 + 128 + 0x20]  ! arg2: prom_mmu_ihandle_cache
+        srlx    %l0, 22, %l3
+        sllx    %l3, 22, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x28]  ! arg3: vaddr, our PC
+        stx     %g0, [%sp + 2047 + 128 + 0x30]  ! res1
+        stx     %g0, [%sp + 2047 + 128 + 0x38]  ! res2
+        stx     %g0, [%sp + 2047 + 128 + 0x40]  ! res3
+        stx     %g0, [%sp + 2047 + 128 + 0x48]  ! res4
+        stx     %g0, [%sp + 2047 + 128 + 0x50]  ! res5
+        call    %l7
+         add    %sp, (2047 + 128), %o0          ! argument array
+
+        ldx     [%sp + 2047 + 128 + 0x40], %l1  ! translation mode
+        mov     (1b - prom_boot_mapping_mode), %l4
+        sub     %l0, %l4, %l4
+        stw     %l1, [%l4]
+        mov     (1b - prom_boot_mapping_phys_high), %l4
+        sub     %l0, %l4, %l4
+        ldx     [%sp + 2047 + 128 + 0x48], %l2  ! physaddr high
+        stx     %l2, [%l4 + 0x0]
+        ldx     [%sp + 2047 + 128 + 0x50], %l3  ! physaddr low
+        stx     %l3, [%l4 + 0x8]
+
+        /* Leave service as-is, "call-method" */
+        mov     7, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x08]  ! num_args, 7
+        mov     1, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x10]  ! num_rets, 1
+        mov     (1b - prom_map_name), %l3
+        sub     %l0, %l3, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x18]  ! arg1: "map"
+        /* Leave arg2 as-is, prom_mmu_ihandle_cache */
+        mov     -1, %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x28]  ! arg3: mode (-1 default)
+        sethi   %hi(8 * 1024 * 1024), %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x30]  ! arg4: size (8MB)
+        sethi   %hi(KERNBASE), %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x38]  ! arg5: vaddr (KERNBASE)
+        stx     %g0, [%sp + 2047 + 128 + 0x40]  ! arg6: empty
+        mov     (1b - prom_boot_mapping_phys_low), %l3
+        sub     %l0, %l3, %l3
+        ldx     [%l3], %l3
+        stx     %l3, [%sp + 2047 + 128 + 0x48]  ! arg7: phys addr
+        call    %l7
+         add    %sp, (2047 + 128), %o0          ! argument array
+
+        add     %sp, (192 + 128), %sp
+
+sparc64_boot_after_remap:
         BRANCH_IF_CHEETAH_BASE(g1,g7,cheetah_boot)
         BRANCH_IF_CHEETAH_PLUS_OR_FOLLOWON(g1,g7,cheetah_plus_boot)
         ba,pt   %xcc, spitfire_boot
@@ -125,185 +275,7 @@ cheetah_generic_boot:
         stxa    %g0, [%g3] ASI_IMMU
         membar  #Sync
 
-        wrpr    %g0, (PSTATE_PRIV|PSTATE_PEF|PSTATE_IE), %pstate
-        wr      %g0, 0, %fprs
-
-        /* Just like for Spitfire, we probe itlb-2 for a mapping which
-         * matches our current %pc.  We take the physical address in
-         * that mapping and use it to make our own.
-         */
-
-        /* %g5 holds the tlb data */
-        sethi   %uhi(_PAGE_VALID | _PAGE_SZ4MB), %g5
-        sllx    %g5, 32, %g5
-        or      %g5, (_PAGE_CP | _PAGE_CV | _PAGE_P | _PAGE_L | _PAGE_W | _PAGE_G), %g5
-
-        /* Put PADDR tlb data mask into %g3. */
-        sethi   %uhi(_PAGE_PADDR), %g3
-        or      %g3, %ulo(_PAGE_PADDR), %g3
-        sllx    %g3, 32, %g3
-        sethi   %hi(_PAGE_PADDR), %g7
-        or      %g7, %lo(_PAGE_PADDR), %g7
-        or      %g3, %g7, %g3
-
-        set     2 << 16, %l0            /* TLB entry walker. */
-        set     0x1fff, %l2             /* Page mask. */
-        rd      %pc, %l3
-        andn    %l3, %l2, %g2           /* vaddr comparator */
-
-1:      ldxa    [%l0] ASI_ITLB_TAG_READ, %g1
-        membar  #Sync
-        andn    %g1, %l2, %g1
-        cmp     %g1, %g2
-        be,pn   %xcc, cheetah_got_tlbentry
-         nop
-        and     %l0, (127 << 3), %g1
-        cmp     %g1, (127 << 3)
-        blu,pt  %xcc, 1b
-         add    %l0, (1 << 3), %l0
-
-        /* Search the small TLB.  OBP never maps us like that but
-         * newer SILO can.
-         */
-        clr     %l0
-
-1:      ldxa    [%l0] ASI_ITLB_TAG_READ, %g1
-        membar  #Sync
-        andn    %g1, %l2, %g1
-        cmp     %g1, %g2
-        be,pn   %xcc, cheetah_got_tlbentry
-         nop
-        cmp     %l0, (15 << 3)
-        blu,pt  %xcc, 1b
-         add    %l0, (1 << 3), %l0
-
-        /* BUG() if we get here... */
-        ta      0x5
-
-cheetah_got_tlbentry:
-        ldxa    [%l0] ASI_ITLB_DATA_ACCESS, %g0
-        ldxa    [%l0] ASI_ITLB_DATA_ACCESS, %g1
-        membar  #Sync
-        and     %g1, %g3, %g1
-        set     0x5fff, %l0
-        andn    %g1, %l0, %g1
-        or      %g5, %g1, %g5
-
-        /* Clear out any KERNBASE area entries. */
-        set     2 << 16, %l0
-        sethi   %hi(KERNBASE), %g3
-        sethi   %hi(KERNBASE<<1), %g7
-        mov     TLB_TAG_ACCESS, %l7
-
-        /* First, check ITLB */
-1:      ldxa    [%l0] ASI_ITLB_TAG_READ, %g1
-        membar  #Sync
-        andn    %g1, %l2, %g1
-        cmp     %g1, %g3
-        blu,pn  %xcc, 2f
-         cmp    %g1, %g7
-        bgeu,pn %xcc, 2f
-         nop
-        stxa    %g0, [%l7] ASI_IMMU
-        membar  #Sync
-        stxa    %g0, [%l0] ASI_ITLB_DATA_ACCESS
-        membar  #Sync
-
-2:      and     %l0, (127 << 3), %g1
-        cmp     %g1, (127 << 3)
-        blu,pt  %xcc, 1b
-         add    %l0, (1 << 3), %l0
-
-        /* Next, check DTLB */
-        set     2 << 16, %l0
-1:      ldxa    [%l0] ASI_DTLB_TAG_READ, %g1
-        membar  #Sync
-        andn    %g1, %l2, %g1
-        cmp     %g1, %g3
-        blu,pn  %xcc, 2f
-         cmp    %g1, %g7
-        bgeu,pn %xcc, 2f
-         nop
-        stxa    %g0, [%l7] ASI_DMMU
-        membar  #Sync
-        stxa    %g0, [%l0] ASI_DTLB_DATA_ACCESS
-        membar  #Sync
-        
-2:      and     %l0, (511 << 3), %g1
-        cmp     %g1, (511 << 3)
-        blu,pt  %xcc, 1b
-         add    %l0, (1 << 3), %l0
-
-        /* On Cheetah+, have to check second DTLB.  */
-        BRANCH_IF_CHEETAH_PLUS_OR_FOLLOWON(g1,l0,2f)
-        ba,pt   %xcc, 9f
-         nop
-
-2:      set     3 << 16, %l0
-1:      ldxa    [%l0] ASI_DTLB_TAG_READ, %g1
-        membar  #Sync
-        andn    %g1, %l2, %g1
-        cmp     %g1, %g3
-        blu,pn  %xcc, 2f
-         cmp    %g1, %g7
-        bgeu,pn %xcc, 2f
-         nop
-        stxa    %g0, [%l7] ASI_DMMU
-        membar  #Sync
-        stxa    %g0, [%l0] ASI_DTLB_DATA_ACCESS
-        membar  #Sync
-        
-2:      and     %l0, (511 << 3), %g1
-        cmp     %g1, (511 << 3)
-        blu,pt  %xcc, 1b
-         add    %l0, (1 << 3), %l0
-
-9:
-
-        /* Now lock the TTE we created into ITLB-0 and DTLB-0,
-         * entry 15 (and maybe 14 too).
-         */
-        sethi   %hi(KERNBASE), %g3
-        set     (0 << 16) | (15 << 3), %g7
-        stxa    %g3, [%l7] ASI_DMMU
-        membar  #Sync
-        stxa    %g5, [%g7] ASI_DTLB_DATA_ACCESS
-        membar  #Sync
-        stxa    %g3, [%l7] ASI_IMMU
-        membar  #Sync
-        stxa    %g5, [%g7] ASI_ITLB_DATA_ACCESS
-        membar  #Sync
-        flush   %g3
-        membar  #Sync
-        sethi   %hi(_end), %g3                  /* Check for bigkernel case */
-        or      %g3, %lo(_end), %g3
-        srl     %g3, 23, %g3                    /* Check if _end > 8M */
-        brz,pt  %g3, 1f
-         sethi  %hi(KERNBASE), %g3              /* Restore for fixup code below */
-        sethi   %hi(0x400000), %g3
-        or      %g3, %lo(0x400000), %g3
-        add     %g5, %g3, %g5                   /* New tte data */
-        andn    %g5, (_PAGE_G), %g5
-        sethi   %hi(KERNBASE+0x400000), %g3
-        or      %g3, %lo(KERNBASE+0x400000), %g3
-        set     (0 << 16) | (14 << 3), %g7
-        stxa    %g3, [%l7] ASI_DMMU
-        membar  #Sync
-        stxa    %g5, [%g7] ASI_DTLB_DATA_ACCESS
-        membar  #Sync
-        stxa    %g3, [%l7] ASI_IMMU
-        membar  #Sync
-        stxa    %g5, [%g7] ASI_ITLB_DATA_ACCESS
-        membar  #Sync
-        flush   %g3
-        membar  #Sync
-        sethi   %hi(KERNBASE), %g3              /* Restore for fixup code below */
-        ba,pt   %xcc, 1f
-         nop
-
-1:      set     sun4u_init, %g2
-        jmpl    %g2 + %g0, %g0
-         nop
+        ba,a,pt %xcc, jump_to_sun4u_init
 
 spitfire_boot:
         /* Typically PROM has already enabled both MMU's and both on-chip
@@ -313,6 +285,7 @@ spitfire_boot:
         stxa    %g1, [%g0] ASI_LSU_CONTROL
         membar  #Sync
 
+jump_to_sun4u_init:
         /*
          * Make sure we are in privileged mode, have address masking,
          * using the ordinary globals and have enabled floating
@@ -324,151 +297,6 @@ spitfire_boot:
         wrpr    %g0, (PSTATE_PRIV|PSTATE_PEF|PSTATE_IE), %pstate
         wr      %g0, 0, %fprs
 
-spitfire_create_mappings:
-        /* %g5 holds the tlb data */
-        sethi   %uhi(_PAGE_VALID | _PAGE_SZ4MB), %g5
-        sllx    %g5, 32, %g5
-        or      %g5, (_PAGE_CP | _PAGE_CV | _PAGE_P | _PAGE_L | _PAGE_W | _PAGE_G), %g5
-
-        /* Base of physical memory cannot reliably be assumed to be
-         * at 0x0!  Figure out where it happens to be. -DaveM
-         */
-
-        /* Put PADDR tlb data mask into %g3. */
-        sethi   %uhi(_PAGE_PADDR_SF), %g3
-        or      %g3, %ulo(_PAGE_PADDR_SF), %g3
-        sllx    %g3, 32, %g3
-        sethi   %hi(_PAGE_PADDR_SF), %g7
-        or      %g7, %lo(_PAGE_PADDR_SF), %g7
-        or      %g3, %g7, %g3
-
-        /* Walk through entire ITLB, looking for entry which maps
-         * our %pc currently, stick PADDR from there into %g5 tlb data.
-         */
-        clr     %l0                     /* TLB entry walker. */
-        set     0x1fff, %l2             /* Page mask. */
-        rd      %pc, %l3
-        andn    %l3, %l2, %g2           /* vaddr comparator */
-1:
-        /* Yes, the nops seem to be necessary for now, don't ask me why. -DaveM */
-        ldxa    [%l0] ASI_ITLB_TAG_READ, %g1
-        nop
-        nop
-        nop
-        andn    %g1, %l2, %g1           /* Get vaddr */
-        cmp     %g1, %g2
-        be,a,pn %xcc, spitfire_got_tlbentry
-         ldxa   [%l0] ASI_ITLB_DATA_ACCESS, %g1
-        cmp     %l0, (63 << 3)
-        blu,pt  %xcc, 1b
-         add    %l0, (1 << 3), %l0
-
-        /* BUG() if we get here... */
-        ta      0x5
-
-spitfire_got_tlbentry:
-        /* Nops here again, perhaps Cheetah/Blackbird are better behaved... */
-        nop
-        nop
-        nop
-        and     %g1, %g3, %g1           /* Mask to just get paddr bits.       */
-        set     0x5fff, %l3             /* Mask offset to get phys base.      */
-        andn    %g1, %l3, %g1
-
-        /* NOTE: We hold on to %g1 paddr base as we need it below to lock
-         * NOTE: the PROM cif code into the TLB.
-         */
-
-        or      %g5, %g1, %g5           /* Or it into TAG being built.        */
-
-        clr     %l0                     /* TLB entry walker. */
-        sethi   %hi(KERNBASE), %g3      /* 4M lower limit */
-        sethi   %hi(KERNBASE<<1), %g7   /* 8M upper limit */
-        mov     TLB_TAG_ACCESS, %l7
-1:
-        /* Yes, the nops seem to be necessary for now, don't ask me why. -DaveM */
-        ldxa    [%l0] ASI_ITLB_TAG_READ, %g1
-        nop
-        nop
-        nop
-        andn    %g1, %l2, %g1           /* Get vaddr */
-        cmp     %g1, %g3
-        blu,pn  %xcc, 2f
-         cmp    %g1, %g7
-        bgeu,pn %xcc, 2f
-         nop
-        stxa    %g0, [%l7] ASI_IMMU
-        stxa    %g0, [%l0] ASI_ITLB_DATA_ACCESS
-        membar  #Sync
-2:
-        cmp     %l0, (63 << 3)
-        blu,pt  %xcc, 1b
-         add    %l0, (1 << 3), %l0
-
-        nop; nop; nop
-
-        clr     %l0                     /* TLB entry walker. */
-1:
-        /* Yes, the nops seem to be necessary for now, don't ask me why. -DaveM */
-        ldxa    [%l0] ASI_DTLB_TAG_READ, %g1
-        nop
-        nop
-        nop
-        andn    %g1, %l2, %g1           /* Get vaddr */
-        cmp     %g1, %g3
-        blu,pn  %xcc, 2f
-         cmp    %g1, %g7
-        bgeu,pn %xcc, 2f
-         nop
-        stxa    %g0, [%l7] ASI_DMMU
-        stxa    %g0, [%l0] ASI_DTLB_DATA_ACCESS
-        membar  #Sync
-2:
-        cmp     %l0, (63 << 3)
-        blu,pt  %xcc, 1b
-         add    %l0, (1 << 3), %l0
-
-        nop; nop; nop
-
-
-        /* PROM never puts any TLB entries into the MMU with the lock bit
-         * set.  So we gladly use tlb entry 63 for KERNBASE. And maybe 62 too.
-         */
-
-        sethi   %hi(KERNBASE), %g3
-        mov     (63 << 3), %g7
-        stxa    %g3, [%l7] ASI_DMMU             /* KERNBASE into TLB TAG        */
-        stxa    %g5, [%g7] ASI_DTLB_DATA_ACCESS /* TTE into TLB DATA            */
-        membar  #Sync
-        stxa    %g3, [%l7] ASI_IMMU             /* KERNBASE into TLB TAG        */
-        stxa    %g5, [%g7] ASI_ITLB_DATA_ACCESS /* TTE into TLB DATA            */
-        membar  #Sync
-        flush   %g3
-        membar  #Sync
-        sethi   %hi(_end), %g3                  /* Check for bigkernel case */
-        or      %g3, %lo(_end), %g3
-        srl     %g3, 23, %g3                    /* Check if _end > 8M */
-        brz,pt  %g3, 2f
-         sethi  %hi(KERNBASE), %g3              /* Restore for fixup code below */
-        sethi   %hi(0x400000), %g3
-        or      %g3, %lo(0x400000), %g3
-        add     %g5, %g3, %g5                   /* New tte data */
-        andn    %g5, (_PAGE_G), %g5
-        sethi   %hi(KERNBASE+0x400000), %g3
-        or      %g3, %lo(KERNBASE+0x400000), %g3
-        mov     (62 << 3), %g7
-        stxa    %g3, [%l7] ASI_DMMU
-        stxa    %g5, [%g7] ASI_DTLB_DATA_ACCESS
-        membar  #Sync
-        stxa    %g3, [%l7] ASI_IMMU
-        stxa    %g5, [%g7] ASI_ITLB_DATA_ACCESS
-        membar  #Sync
-        flush   %g3
-        membar  #Sync
-        sethi   %hi(KERNBASE), %g3              /* Restore for fixup code below */
-2:      ba,pt   %xcc, 1f
-         nop
-1:
         set     sun4u_init, %g2
         jmpl    %g2 + %g0, %g0
          nop
@@ -483,38 +311,12 @@ sun4u_init:
         stxa    %g0, [%g7] ASI_DMMU
         membar  #Sync
 
-        /* We are now safely (we hope) in Nucleus context (0), rewrite
-         * the KERNBASE TTE's so they no longer have the global bit set.
-         * Don't forget to setup TAG_ACCESS first 8-)
-         */
-        mov     TLB_TAG_ACCESS, %g2
-        stxa    %g3, [%g2] ASI_IMMU
-        stxa    %g3, [%g2] ASI_DMMU
-        membar  #Sync
-
         BRANCH_IF_ANY_CHEETAH(g1,g7,cheetah_tlb_fixup)
 
         ba,pt   %xcc, spitfire_tlb_fixup
          nop
 
 cheetah_tlb_fixup:
-        set     (0 << 16) | (15 << 3), %g7
-        ldxa    [%g7] ASI_ITLB_DATA_ACCESS, %g0
-        ldxa    [%g7] ASI_ITLB_DATA_ACCESS, %g1
-        andn    %g1, (_PAGE_G), %g1
-        stxa    %g1, [%g7] ASI_ITLB_DATA_ACCESS
-        membar  #Sync
-
-        ldxa    [%g7] ASI_DTLB_DATA_ACCESS, %g0
-        ldxa    [%g7] ASI_DTLB_DATA_ACCESS, %g1
-        andn    %g1, (_PAGE_G), %g1
-        stxa    %g1, [%g7] ASI_DTLB_DATA_ACCESS
-        membar  #Sync
-
-        /* Kill instruction prefetch queues. */
-        flush   %g3
-        membar  #Sync
-
         mov     2, %g2          /* Set TLB type to cheetah+. */
         BRANCH_IF_CHEETAH_PLUS_OR_FOLLOWON(g1,g7,1f)
 
@@ -551,21 +353,6 @@ cheetah_tlb_fixup:
          nop
 
 spitfire_tlb_fixup:
-        mov     (63 << 3), %g7
-        ldxa    [%g7] ASI_ITLB_DATA_ACCESS, %g1
-        andn    %g1, (_PAGE_G), %g1
-        stxa    %g1, [%g7] ASI_ITLB_DATA_ACCESS
-        membar  #Sync
-
-        ldxa    [%g7] ASI_DTLB_DATA_ACCESS, %g1
-        andn    %g1, (_PAGE_G), %g1
-        stxa    %g1, [%g7] ASI_DTLB_DATA_ACCESS
-        membar  #Sync
-
-        /* Kill instruction prefetch queues. */
-        flush   %g3
-        membar  #Sync
-
         /* Set TLB type to spitfire. */
         mov     0, %g2
         sethi   %hi(tlb_type), %g1
@@ -578,24 +365,6 @@ tlb_fixup_done:
         mov     %sp, %l6
         mov     %o4, %l7
 
-#if 0   /* We don't do it like this anymore, but for historical hack value
-         * I leave this snippet here to show how crazy we can be sometimes. 8-)
-         */
-
-        /* Setup "Linux Current Register", thanks Sun 8-) */
-        wr      %g0, 0x1, %pcr
-
-        /* Blackbird errata workaround.  See commentary in
-         * smp.c:smp_percpu_timer_interrupt() for more
-         * information.
-         */
-        ba,pt   %xcc, 99f
-         nop
-        .align  64
-99:     wr      %g6, %g0, %pic
-        rd      %pic, %g0
-#endif
-
         wr      %g0, ASI_P, %asi
         mov     1, %g1
         sllx    %g1, THREAD_SHIFT, %g1
@@ -756,12 +525,7 @@ bootup_user_stack_end:
 
 #include "ttable.S"
 #include "systbls.S"
-
-        .align  1024
-        .globl  swapper_pg_dir
-swapper_pg_dir:
-        .word   0
-
+#include "ktlb.S"
 #include "etrap.S"
 #include "rtrap.S"
 #include "winfixup.S"
@@ -776,8 +540,11 @@ swapper_pg_dir:
 prom_tba:       .xword  0
 tlb_type:       .word   0       /* Must NOT end up in BSS */
         .section        ".fixup",#alloc,#execinstr
-        .globl  __ret_efault
+
+        .globl  __ret_efault, __retl_efault
 __ret_efault:
         ret
          restore %g0, -EFAULT, %o0
-
+__retl_efault:
+        retl
+         mov    -EFAULT, %o0
diff --git a/arch/sparc64/kernel/ktlb.S b/arch/sparc64/kernel/ktlb.S
new file mode 100644
index 000000000000..7796b37f478c
--- /dev/null
+++ b/arch/sparc64/kernel/ktlb.S
@@ -0,0 +1,198 @@
+/* arch/sparc64/kernel/ktlb.S: Kernel mapping TLB miss handling.
+ *
+ * Copyright (C) 1995, 1997, 2005 David S. Miller <davem@davemloft.net>
+ * Copyright (C) 1996 Eddie C. Dost        (ecd@brainaid.de)
+ * Copyright (C) 1996 Miguel de Icaza      (miguel@nuclecu.unam.mx)
+ * Copyright (C) 1996,98,99 Jakub Jelinek  (jj@sunsite.mff.cuni.cz)
+*/
+
+#include <linux/config.h>
+#include <asm/head.h>
+#include <asm/asi.h>
+#include <asm/page.h>
+#include <asm/pgtable.h>
+
+        .text
+        .align          32
+
+/*
+ * On a second level vpte miss, check whether the original fault is to the OBP 
+ * range (note that this is only possible for instruction miss, data misses to
+ * obp range do not use vpte). If so, go back directly to the faulting address.
+ * This is because we want to read the tpc, otherwise we have no way of knowing
+ * the 8k aligned faulting address if we are using >8k kernel pagesize. This
+ * also ensures no vpte range addresses are dropped into tlb while obp is
+ * executing (see inherit_locked_prom_mappings() rant).
+ */
+sparc64_vpte_nucleus:
+        /* Note that kvmap below has verified that the address is
+         * in the range MODULES_VADDR --> VMALLOC_END already.  So
+         * here we need only check if it is an OBP address or not.
+         */
+        sethi           %hi(LOW_OBP_ADDRESS), %g5
+        cmp             %g4, %g5
+        blu,pn          %xcc, kern_vpte
+         mov            0x1, %g5
+        sllx            %g5, 32, %g5
+        cmp             %g4, %g5
+        blu,pn          %xcc, vpte_insn_obp
+         nop
+
+        /* These two instructions are patched by paginig_init().  */
+kern_vpte:
+        sethi           %hi(swapper_pgd_zero), %g5
+        lduw            [%g5 + %lo(swapper_pgd_zero)], %g5
+
+        /* With kernel PGD in %g5, branch back into dtlb_backend.  */
+        ba,pt           %xcc, sparc64_kpte_continue
+         andn           %g1, 0x3, %g1   /* Finish PMD offset adjustment.  */
+
+vpte_noent:
+        /* Restore previous TAG_ACCESS, %g5 is zero, and we will
+         * skip over the trap instruction so that the top level
+         * TLB miss handler will thing this %g5 value is just an
+         * invalid PTE, thus branching to full fault processing.
+         */
+        mov             TLB_SFSR, %g1
+        stxa            %g4, [%g1 + %g1] ASI_DMMU
+        done
+
+vpte_insn_obp:
+        sethi           %hi(prom_pmd_phys), %g5
+        ldx             [%g5 + %lo(prom_pmd_phys)], %g5
+
+        /* Behave as if we are at TL0.  */
+        wrpr            %g0, 1, %tl
+        rdpr            %tpc, %g4       /* Find original faulting iaddr */
+        srlx            %g4, 13, %g4    /* Throw out context bits */
+        sllx            %g4, 13, %g4    /* g4 has vpn + ctx0 now */
+
+        /* Restore previous TAG_ACCESS.  */
+        mov             TLB_SFSR, %g1
+        stxa            %g4, [%g1 + %g1] ASI_IMMU
+
+        /* Get PMD offset.  */
+        srlx            %g4, 23, %g6
+        and             %g6, 0x7ff, %g6
+        sllx            %g6, 2, %g6
+
+        /* Load PMD, is it valid?  */
+        lduwa           [%g5 + %g6] ASI_PHYS_USE_EC, %g5
+        brz,pn          %g5, longpath
+         sllx           %g5, 11, %g5
+
+        /* Get PTE offset.  */
+        srlx            %g4, 13, %g6
+        and             %g6, 0x3ff, %g6
+        sllx            %g6, 3, %g6
+
+        /* Load PTE.  */
+        ldxa            [%g5 + %g6] ASI_PHYS_USE_EC, %g5
+        brgez,pn        %g5, longpath
+         nop
+
+        /* TLB load and return from trap.  */
+        stxa            %g5, [%g0] ASI_ITLB_DATA_IN
+        retry
+
+kvmap_do_obp:
+        sethi           %hi(prom_pmd_phys), %g5
+        ldx             [%g5 + %lo(prom_pmd_phys)], %g5
+
+        /* Get PMD offset.  */
+        srlx            %g4, 23, %g6
+        and             %g6, 0x7ff, %g6
+        sllx            %g6, 2, %g6
+
+        /* Load PMD, is it valid?  */
+        lduwa           [%g5 + %g6] ASI_PHYS_USE_EC, %g5
+        brz,pn          %g5, longpath
+         sllx           %g5, 11, %g5
+
+        /* Get PTE offset.  */
+        srlx            %g4, 13, %g6
+        and             %g6, 0x3ff, %g6
+        sllx            %g6, 3, %g6
+
+        /* Load PTE.  */
+        ldxa            [%g5 + %g6] ASI_PHYS_USE_EC, %g5
+        brgez,pn        %g5, longpath
+         nop
+
+        /* TLB load and return from trap.  */
+        stxa            %g5, [%g0] ASI_DTLB_DATA_IN
+        retry
+
+/*
+ * On a first level data miss, check whether this is to the OBP range (note
+ * that such accesses can be made by prom, as well as by kernel using
+ * prom_getproperty on "address"), and if so, do not use vpte access ...
+ * rather, use information saved during inherit_prom_mappings() using 8k
+ * pagesize.
+ */
+        .align          32
+kvmap:
+        brgez,pn        %g4, kvmap_nonlinear
+         nop
+
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        .globl          kvmap_linear_patch
+kvmap_linear_patch:
+#endif
+        ba,pt           %xcc, kvmap_load
+         xor            %g2, %g4, %g5
+
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        sethi           %hi(swapper_pg_dir), %g5
+        or              %g5, %lo(swapper_pg_dir), %g5
+        sllx            %g4, 64 - (PGDIR_SHIFT + PGDIR_BITS), %g6
+        srlx            %g6, 64 - PAGE_SHIFT, %g6
+        andn            %g6, 0x3, %g6
+        lduw            [%g5 + %g6], %g5
+        brz,pn          %g5, longpath
+         sllx           %g4, 64 - (PMD_SHIFT + PMD_BITS), %g6
+        srlx            %g6, 64 - PAGE_SHIFT, %g6
+        sllx            %g5, 11, %g5
+        andn            %g6, 0x3, %g6
+        lduwa           [%g5 + %g6] ASI_PHYS_USE_EC, %g5
+        brz,pn          %g5, longpath
+         sllx           %g4, 64 - PMD_SHIFT, %g6
+        srlx            %g6, 64 - PAGE_SHIFT, %g6
+        sllx            %g5, 11, %g5
+        andn            %g6, 0x7, %g6
+        ldxa            [%g5 + %g6] ASI_PHYS_USE_EC, %g5
+        brz,pn          %g5, longpath
+         nop
+        ba,a,pt         %xcc, kvmap_load
+#endif
+
+kvmap_nonlinear:
+        sethi           %hi(MODULES_VADDR), %g5
+        cmp             %g4, %g5
+        blu,pn          %xcc, longpath
+         mov            (VMALLOC_END >> 24), %g5
+        sllx            %g5, 24, %g5
+        cmp             %g4, %g5
+        bgeu,pn         %xcc, longpath
+         nop
+
+kvmap_check_obp:
+        sethi           %hi(LOW_OBP_ADDRESS), %g5
+        cmp             %g4, %g5
+        blu,pn          %xcc, kvmap_vmalloc_addr
+         mov            0x1, %g5
+        sllx            %g5, 32, %g5
+        cmp             %g4, %g5
+        blu,pn          %xcc, kvmap_do_obp
+         nop
+
+kvmap_vmalloc_addr:
+        /* If we get here, a vmalloc addr was accessed, load kernel VPTE.  */
+        ldxa            [%g3 + %g6] ASI_N, %g5
+        brgez,pn        %g5, longpath
+         nop
+
+kvmap_load:
+        /* PTE is valid, load into TLB and return from trap.  */
+        stxa            %g5, [%g0] ASI_DTLB_DATA_IN     ! Reload TLB
+        retry
diff --git a/arch/sparc64/kernel/pci_schizo.c b/arch/sparc64/kernel/pci_schizo.c
index 331382e1a75d..cae5b61fe2f0 100644
--- a/arch/sparc64/kernel/pci_schizo.c
+++ b/arch/sparc64/kernel/pci_schizo.c
@@ -330,7 +330,7 @@ static int schizo_ino_to_pil(struct pci_dev *pdev, unsigned int ino)
 static void tomatillo_wsync_handler(struct ino_bucket *bucket, void *_arg1, void *_arg2)
 {
         unsigned long sync_reg = (unsigned long) _arg2;
-        u64 mask = 1 << (__irq_ino(__irq(bucket)) & IMAP_INO);
+        u64 mask = 1UL << (__irq_ino(__irq(bucket)) & IMAP_INO);
         u64 val;
         int limit;
 
diff --git a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c
index 23ad839d113f..774ecbb8a031 100644
--- a/arch/sparc64/kernel/ptrace.c
+++ b/arch/sparc64/kernel/ptrace.c
@@ -30,6 +30,8 @@
 #include <asm/psrcompat.h>
 #include <asm/visasm.h>
 #include <asm/spitfire.h>
+#include <asm/page.h>
+#include <asm/cpudata.h>
 
 /* Returning from ptrace is a bit tricky because the syscall return
  * low level code assumes any value returned which is negative and
@@ -128,20 +130,24 @@ void flush_ptrace_access(struct vm_area_struct *vma, struct page *page,
          * is mapped to in the user's address space, we can skip the
          * D-cache flush.
          */
-        if ((uaddr ^ kaddr) & (1UL << 13)) {
+        if ((uaddr ^ (unsigned long) kaddr) & (1UL << 13)) {
                 unsigned long start = __pa(kaddr);
                 unsigned long end = start + len;
+                unsigned long dcache_line_size;
+
+                dcache_line_size = local_cpu_data().dcache_line_size;
 
                 if (tlb_type == spitfire) {
-                        for (; start < end; start += 32)
-                                spitfire_put_dcache_tag(va & 0x3fe0, 0x0);
+                        for (; start < end; start += dcache_line_size)
+                                spitfire_put_dcache_tag(start & 0x3fe0, 0x0);
                 } else {
-                        for (; start < end; start += 32)
+                        start &= ~(dcache_line_size - 1);
+                        for (; start < end; start += dcache_line_size)
                                 __asm__ __volatile__(
                                         "stxa %%g0, [%0] %1\n\t"
                                         "membar #Sync"
                                         : /* no outputs */
-                                        : "r" (va),
+                                        : "r" (start),
                                         "i" (ASI_DCACHE_INVALIDATE));
                 }
         }
@@ -149,8 +155,11 @@ void flush_ptrace_access(struct vm_area_struct *vma, struct page *page,
         if (write && tlb_type == spitfire) {
                 unsigned long start = (unsigned long) kaddr;
                 unsigned long end = start + len;
+                unsigned long icache_line_size;
+
+                icache_line_size = local_cpu_data().icache_line_size;
 
-                for (; start < end; start += 32)
+                for (; start < end; start += icache_line_size)
                         flushi(start);
         }
 }
diff --git a/arch/sparc64/kernel/setup.c b/arch/sparc64/kernel/setup.c
index ddbed3341a23..4c9c8f241748 100644
--- a/arch/sparc64/kernel/setup.c
+++ b/arch/sparc64/kernel/setup.c
@@ -464,8 +464,6 @@ static void __init boot_flags_init(char *commands)
         }
 }
 
-extern int prom_probe_memory(void);
-extern unsigned long start, end;
 extern void panic_setup(char *, int *);
 
 extern unsigned short root_flags;
@@ -492,13 +490,8 @@ void register_prom_callbacks(void)
                    "' linux-.soft2 to .soft2");
 }
 
-extern void paging_init(void);
-
 void __init setup_arch(char **cmdline_p)
 {
-        unsigned long highest_paddr;
-        int i;
-
         /* Initialize PROM console and command line. */
         *cmdline_p = prom_getbootargs();
         strcpy(saved_command_line, *cmdline_p);
@@ -517,40 +510,6 @@ void __init setup_arch(char **cmdline_p)
         boot_flags_init(*cmdline_p);
 
         idprom_init();
-        (void) prom_probe_memory();
-
-        /* In paging_init() we tip off this value to see if we need
-         * to change init_mm.pgd to point to the real alias mapping.
-         */
-        phys_base = 0xffffffffffffffffUL;
-        highest_paddr = 0UL;
-        for (i = 0; sp_banks[i].num_bytes != 0; i++) {
-                unsigned long top;
-
-                if (sp_banks[i].base_addr < phys_base)
-                        phys_base = sp_banks[i].base_addr;
-                top = sp_banks[i].base_addr +
-                        sp_banks[i].num_bytes;
-                if (highest_paddr < top)
-                        highest_paddr = top;
-        }
-        pfn_base = phys_base >> PAGE_SHIFT;
-
-        switch (tlb_type) {
-        default:
-        case spitfire:
-                kern_base = spitfire_get_itlb_data(sparc64_highest_locked_tlbent());
-                kern_base &= _PAGE_PADDR_SF;
-                break;
-
-        case cheetah:
-        case cheetah_plus:
-                kern_base = cheetah_get_litlb_data(sparc64_highest_locked_tlbent());
-                kern_base &= _PAGE_PADDR;
-                break;
-        };
-
-        kern_size = (unsigned long)&_end - (unsigned long)KERNBASE;
 
         if (!root_flags)
                 root_mountflags &= ~MS_RDONLY;
@@ -625,6 +584,9 @@ extern void smp_info(struct seq_file *);
 extern void smp_bogo(struct seq_file *);
 extern void mmu_info(struct seq_file *);
 
+unsigned int dcache_parity_tl1_occurred;
+unsigned int icache_parity_tl1_occurred;
+
 static int show_cpuinfo(struct seq_file *m, void *__unused)
 {
         seq_printf(m, 
@@ -635,6 +597,8 @@ static int show_cpuinfo(struct seq_file *m, void *__unused)
                    "type\t\t: sun4u\n"
                    "ncpus probed\t: %ld\n"
                    "ncpus active\t: %ld\n"
+                   "D$ parity tl1\t: %u\n"
+                   "I$ parity tl1\t: %u\n"
 #ifndef CONFIG_SMP
                    "Cpu0Bogo\t: %lu.%02lu\n"
                    "Cpu0ClkTck\t: %016lx\n"
@@ -647,7 +611,9 @@ static int show_cpuinfo(struct seq_file *m, void *__unused)
                    (prom_prev >> 8) & 0xff,
                    prom_prev & 0xff,
                    (long)num_possible_cpus(),
-                   (long)num_online_cpus()
+                   (long)num_online_cpus(),
+                   dcache_parity_tl1_occurred,
+                   icache_parity_tl1_occurred
 #ifndef CONFIG_SMP
                    , cpu_data(0).udelay_val/(500000/HZ),
                    (cpu_data(0).udelay_val/(5000/HZ)) % 100,
diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
index b4fc6a5462b2..590df5a16f5a 100644
--- a/arch/sparc64/kernel/smp.c
+++ b/arch/sparc64/kernel/smp.c
@@ -93,6 +93,27 @@ void __init smp_store_cpu_info(int id)
         cpu_data(id).pte_cache[1]               = NULL;
         cpu_data(id).pgd_cache                  = NULL;
         cpu_data(id).idle_volume                = 1;
+
+        cpu_data(id).dcache_size = prom_getintdefault(cpu_node, "dcache-size",
+                                                      16 * 1024);
+        cpu_data(id).dcache_line_size =
+                prom_getintdefault(cpu_node, "dcache-line-size", 32);
+        cpu_data(id).icache_size = prom_getintdefault(cpu_node, "icache-size",
+                                                      16 * 1024);
+        cpu_data(id).icache_line_size =
+                prom_getintdefault(cpu_node, "icache-line-size", 32);
+        cpu_data(id).ecache_size = prom_getintdefault(cpu_node, "ecache-size",
+                                                      4 * 1024 * 1024);
+        cpu_data(id).ecache_line_size =
+                prom_getintdefault(cpu_node, "ecache-line-size", 64);
+        printk("CPU[%d]: Caches "
+               "D[sz(%d):line_sz(%d)] "
+               "I[sz(%d):line_sz(%d)] "
+               "E[sz(%d):line_sz(%d)]\n",
+               id,
+               cpu_data(id).dcache_size, cpu_data(id).dcache_line_size,
+               cpu_data(id).icache_size, cpu_data(id).icache_line_size,
+               cpu_data(id).ecache_size, cpu_data(id).ecache_line_size);
 }
 
 static void smp_setup_percpu_timer(void);
diff --git a/arch/sparc64/kernel/sparc64_ksyms.c b/arch/sparc64/kernel/sparc64_ksyms.c
index cbb5e59824e5..fb7a5370dbfc 100644
--- a/arch/sparc64/kernel/sparc64_ksyms.c
+++ b/arch/sparc64/kernel/sparc64_ksyms.c
@@ -163,9 +163,6 @@ EXPORT_SYMBOL(atomic64_add);
 EXPORT_SYMBOL(atomic64_add_ret);
 EXPORT_SYMBOL(atomic64_sub);
 EXPORT_SYMBOL(atomic64_sub_ret);
-#ifdef CONFIG_SMP
-EXPORT_SYMBOL(_atomic_dec_and_lock);
-#endif
 
 /* Atomic bit operations. */
 EXPORT_SYMBOL(test_and_set_bit);
diff --git a/arch/sparc64/kernel/sys32.S b/arch/sparc64/kernel/sys32.S
index 5f9e4fae612e..9cd272ac3ac1 100644
--- a/arch/sparc64/kernel/sys32.S
+++ b/arch/sparc64/kernel/sys32.S
@@ -157,173 +157,199 @@ sys32_socketcall:	/* %o0=call, %o1=args */
         or              %g2, %lo(__socketcall_table_begin), %g2
         jmpl            %g2 + %o0, %g0
          nop
+do_einval:
+        retl
+         mov            -EINVAL, %o0
 
-        /* Each entry is exactly 32 bytes. */
         .align          32
 __socketcall_table_begin:
+
+        /* Each entry is exactly 32 bytes. */
 do_sys_socket: /* sys_socket(int, int, int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+1:      ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_socket), %g1
-        ldswa           [%o1 + 0x8] %asi, %o2
+2:      ldswa           [%o1 + 0x8] %asi, %o2
         jmpl            %g1 + %lo(sys_socket), %g0
-         ldswa          [%o1 + 0x4] %asi, %o1
+3:       ldswa          [%o1 + 0x4] %asi, %o1
         nop
         nop
         nop
 do_sys_bind: /* sys_bind(int fd, struct sockaddr *, int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+4:      ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_bind), %g1
-        ldswa           [%o1 + 0x8] %asi, %o2
+5:      ldswa           [%o1 + 0x8] %asi, %o2
         jmpl            %g1 + %lo(sys_bind), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+6:       lduwa          [%o1 + 0x4] %asi, %o1
         nop
         nop
         nop
 do_sys_connect: /* sys_connect(int, struct sockaddr *, int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+7:      ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_connect), %g1
-        ldswa           [%o1 + 0x8] %asi, %o2
+8:      ldswa           [%o1 + 0x8] %asi, %o2
         jmpl            %g1 + %lo(sys_connect), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+9:       lduwa          [%o1 + 0x4] %asi, %o1
         nop
         nop
         nop
 do_sys_listen: /* sys_listen(int, int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+10:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_listen), %g1
         jmpl            %g1 + %lo(sys_listen), %g0
-         ldswa          [%o1 + 0x4] %asi, %o1
+11:      ldswa          [%o1 + 0x4] %asi, %o1
         nop
         nop
         nop
         nop
 do_sys_accept: /* sys_accept(int, struct sockaddr *, int *) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+12:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_accept), %g1
-        lduwa           [%o1 + 0x8] %asi, %o2
+13:     lduwa           [%o1 + 0x8] %asi, %o2
         jmpl            %g1 + %lo(sys_accept), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+14:      lduwa          [%o1 + 0x4] %asi, %o1
         nop
         nop
         nop
 do_sys_getsockname: /* sys_getsockname(int, struct sockaddr *, int *) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+15:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_getsockname), %g1
-        lduwa           [%o1 + 0x8] %asi, %o2
+16:     lduwa           [%o1 + 0x8] %asi, %o2
         jmpl            %g1 + %lo(sys_getsockname), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+17:      lduwa          [%o1 + 0x4] %asi, %o1
         nop
         nop
         nop
 do_sys_getpeername: /* sys_getpeername(int, struct sockaddr *, int *) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+18:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_getpeername), %g1
-        lduwa           [%o1 + 0x8] %asi, %o2
+19:     lduwa           [%o1 + 0x8] %asi, %o2
         jmpl            %g1 + %lo(sys_getpeername), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+20:      lduwa          [%o1 + 0x4] %asi, %o1
         nop
         nop
         nop
 do_sys_socketpair: /* sys_socketpair(int, int, int, int *) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+21:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_socketpair), %g1
-        ldswa           [%o1 + 0x8] %asi, %o2
-        lduwa           [%o1 + 0xc] %asi, %o3
+22:     ldswa           [%o1 + 0x8] %asi, %o2
+23:     lduwa           [%o1 + 0xc] %asi, %o3
         jmpl            %g1 + %lo(sys_socketpair), %g0
-         ldswa          [%o1 + 0x4] %asi, %o1
+24:      ldswa          [%o1 + 0x4] %asi, %o1
         nop
         nop
 do_sys_send: /* sys_send(int, void *, size_t, unsigned int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+25:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_send), %g1
-        lduwa           [%o1 + 0x8] %asi, %o2
-        lduwa           [%o1 + 0xc] %asi, %o3
+26:     lduwa           [%o1 + 0x8] %asi, %o2
+27:     lduwa           [%o1 + 0xc] %asi, %o3
         jmpl            %g1 + %lo(sys_send), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+28:      lduwa          [%o1 + 0x4] %asi, %o1
         nop
         nop
 do_sys_recv: /* sys_recv(int, void *, size_t, unsigned int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+29:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_recv), %g1
-        lduwa           [%o1 + 0x8] %asi, %o2
-        lduwa           [%o1 + 0xc] %asi, %o3
+30:     lduwa           [%o1 + 0x8] %asi, %o2
+31:     lduwa           [%o1 + 0xc] %asi, %o3
         jmpl            %g1 + %lo(sys_recv), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+32:      lduwa          [%o1 + 0x4] %asi, %o1
         nop
         nop
 do_sys_sendto: /* sys_sendto(int, u32, compat_size_t, unsigned int, u32, int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+33:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_sendto), %g1
-        lduwa           [%o1 + 0x8] %asi, %o2
-        lduwa           [%o1 + 0xc] %asi, %o3
-        lduwa           [%o1 + 0x10] %asi, %o4
-        ldswa           [%o1 + 0x14] %asi, %o5
+34:     lduwa           [%o1 + 0x8] %asi, %o2
+35:     lduwa           [%o1 + 0xc] %asi, %o3
+36:     lduwa           [%o1 + 0x10] %asi, %o4
+37:     ldswa           [%o1 + 0x14] %asi, %o5
         jmpl            %g1 + %lo(sys_sendto), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+38:      lduwa          [%o1 + 0x4] %asi, %o1
 do_sys_recvfrom: /* sys_recvfrom(int, u32, compat_size_t, unsigned int, u32, u32) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+39:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_recvfrom), %g1
-        lduwa           [%o1 + 0x8] %asi, %o2
-        lduwa           [%o1 + 0xc] %asi, %o3
-        lduwa           [%o1 + 0x10] %asi, %o4
-        lduwa           [%o1 + 0x14] %asi, %o5
+40:     lduwa           [%o1 + 0x8] %asi, %o2
+41:     lduwa           [%o1 + 0xc] %asi, %o3
+42:     lduwa           [%o1 + 0x10] %asi, %o4
+43:     lduwa           [%o1 + 0x14] %asi, %o5
         jmpl            %g1 + %lo(sys_recvfrom), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+44:      lduwa          [%o1 + 0x4] %asi, %o1
 do_sys_shutdown: /* sys_shutdown(int, int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+45:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(sys_shutdown), %g1
         jmpl            %g1 + %lo(sys_shutdown), %g0
-         ldswa          [%o1 + 0x4] %asi, %o1
+46:      ldswa          [%o1 + 0x4] %asi, %o1
         nop
         nop
         nop
         nop
 do_sys_setsockopt: /* compat_sys_setsockopt(int, int, int, char *, int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+47:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(compat_sys_setsockopt), %g1
-        ldswa           [%o1 + 0x8] %asi, %o2
-        lduwa           [%o1 + 0xc] %asi, %o3
-        ldswa           [%o1 + 0x10] %asi, %o4
+48:     ldswa           [%o1 + 0x8] %asi, %o2
+49:     lduwa           [%o1 + 0xc] %asi, %o3
+50:     ldswa           [%o1 + 0x10] %asi, %o4
         jmpl            %g1 + %lo(compat_sys_setsockopt), %g0
-         ldswa          [%o1 + 0x4] %asi, %o1
+51:      ldswa          [%o1 + 0x4] %asi, %o1
         nop
 do_sys_getsockopt: /* compat_sys_getsockopt(int, int, int, u32, u32) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+52:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(compat_sys_getsockopt), %g1
-        ldswa           [%o1 + 0x8] %asi, %o2
-        lduwa           [%o1 + 0xc] %asi, %o3
-        lduwa           [%o1 + 0x10] %asi, %o4
+53:     ldswa           [%o1 + 0x8] %asi, %o2
+54:     lduwa           [%o1 + 0xc] %asi, %o3
+55:     lduwa           [%o1 + 0x10] %asi, %o4
         jmpl            %g1 + %lo(compat_sys_getsockopt), %g0
-         ldswa          [%o1 + 0x4] %asi, %o1
+56:      ldswa          [%o1 + 0x4] %asi, %o1
         nop
 do_sys_sendmsg: /* compat_sys_sendmsg(int, struct compat_msghdr *, unsigned int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+57:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(compat_sys_sendmsg), %g1
-        lduwa           [%o1 + 0x8] %asi, %o2
+58:     lduwa           [%o1 + 0x8] %asi, %o2
         jmpl            %g1 + %lo(compat_sys_sendmsg), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+59:      lduwa          [%o1 + 0x4] %asi, %o1
         nop
         nop
         nop
 do_sys_recvmsg: /* compat_sys_recvmsg(int, struct compat_msghdr *, unsigned int) */
-        ldswa           [%o1 + 0x0] %asi, %o0
+60:     ldswa           [%o1 + 0x0] %asi, %o0
         sethi           %hi(compat_sys_recvmsg), %g1
-        lduwa           [%o1 + 0x8] %asi, %o2
+61:     lduwa           [%o1 + 0x8] %asi, %o2
         jmpl            %g1 + %lo(compat_sys_recvmsg), %g0
-         lduwa          [%o1 + 0x4] %asi, %o1
+62:      lduwa          [%o1 + 0x4] %asi, %o1
         nop
         nop
         nop
-__socketcall_table_end:
-
-do_einval:
-        retl
-         mov            -EINVAL, %o0
-do_efault:
-        retl
-         mov            -EFAULT, %o0
 
         .section        __ex_table
         .align          4
-        .word           __socketcall_table_begin, 0, __socketcall_table_end, do_efault
+        .word           1b, __retl_efault, 2b, __retl_efault
+        .word           3b, __retl_efault, 4b, __retl_efault
+        .word           5b, __retl_efault, 6b, __retl_efault
+        .word           7b, __retl_efault, 8b, __retl_efault
+        .word           9b, __retl_efault, 10b, __retl_efault
+        .word           11b, __retl_efault, 12b, __retl_efault
+        .word           13b, __retl_efault, 14b, __retl_efault
+        .word           15b, __retl_efault, 16b, __retl_efault
+        .word           17b, __retl_efault, 18b, __retl_efault
+        .word           19b, __retl_efault, 20b, __retl_efault
+        .word           21b, __retl_efault, 22b, __retl_efault
+        .word           23b, __retl_efault, 24b, __retl_efault
+        .word           25b, __retl_efault, 26b, __retl_efault
+        .word           27b, __retl_efault, 28b, __retl_efault
+        .word           29b, __retl_efault, 30b, __retl_efault
+        .word           31b, __retl_efault, 32b, __retl_efault
+        .word           33b, __retl_efault, 34b, __retl_efault
+        .word           35b, __retl_efault, 36b, __retl_efault
+        .word           37b, __retl_efault, 38b, __retl_efault
+        .word           39b, __retl_efault, 40b, __retl_efault
+        .word           41b, __retl_efault, 42b, __retl_efault
+        .word           43b, __retl_efault, 44b, __retl_efault
+        .word           45b, __retl_efault, 46b, __retl_efault
+        .word           47b, __retl_efault, 48b, __retl_efault
+        .word           49b, __retl_efault, 50b, __retl_efault
+        .word           51b, __retl_efault, 52b, __retl_efault
+        .word           53b, __retl_efault, 54b, __retl_efault
+        .word           55b, __retl_efault, 56b, __retl_efault
+        .word           57b, __retl_efault, 58b, __retl_efault
+        .word           59b, __retl_efault, 60b, __retl_efault
+        .word           61b, __retl_efault, 62b, __retl_efault
         .previous
diff --git a/arch/sparc64/kernel/trampoline.S b/arch/sparc64/kernel/trampoline.S
index 3a145fc39cf2..89f2fcfcd662 100644
--- a/arch/sparc64/kernel/trampoline.S
+++ b/arch/sparc64/kernel/trampoline.S
@@ -119,8 +119,8 @@ startup_continue:
         sethi           %hi(itlb_load), %g2
         or              %g2, %lo(itlb_load), %g2
         stx             %g2, [%sp + 2047 + 128 + 0x18]
-        sethi           %hi(mmu_ihandle_cache), %g2
-        lduw            [%g2 + %lo(mmu_ihandle_cache)], %g2
+        sethi           %hi(prom_mmu_ihandle_cache), %g2
+        lduw            [%g2 + %lo(prom_mmu_ihandle_cache)], %g2
         stx             %g2, [%sp + 2047 + 128 + 0x20]
         sethi           %hi(KERNBASE), %g2
         stx             %g2, [%sp + 2047 + 128 + 0x28]
@@ -156,8 +156,8 @@ startup_continue:
         sethi           %hi(itlb_load), %g2
         or              %g2, %lo(itlb_load), %g2
         stx             %g2, [%sp + 2047 + 128 + 0x18]
-        sethi           %hi(mmu_ihandle_cache), %g2
-        lduw            [%g2 + %lo(mmu_ihandle_cache)], %g2
+        sethi           %hi(prom_mmu_ihandle_cache), %g2
+        lduw            [%g2 + %lo(prom_mmu_ihandle_cache)], %g2
         stx             %g2, [%sp + 2047 + 128 + 0x20]
         sethi           %hi(KERNBASE + 0x400000), %g2
         stx             %g2, [%sp + 2047 + 128 + 0x28]
@@ -190,8 +190,8 @@ do_dtlb:
         sethi           %hi(dtlb_load), %g2
         or              %g2, %lo(dtlb_load), %g2
         stx             %g2, [%sp + 2047 + 128 + 0x18]
-        sethi           %hi(mmu_ihandle_cache), %g2
-        lduw            [%g2 + %lo(mmu_ihandle_cache)], %g2
+        sethi           %hi(prom_mmu_ihandle_cache), %g2
+        lduw            [%g2 + %lo(prom_mmu_ihandle_cache)], %g2
         stx             %g2, [%sp + 2047 + 128 + 0x20]
         sethi           %hi(KERNBASE), %g2
         stx             %g2, [%sp + 2047 + 128 + 0x28]
@@ -228,8 +228,8 @@ do_dtlb:
         sethi           %hi(dtlb_load), %g2
         or              %g2, %lo(dtlb_load), %g2
         stx             %g2, [%sp + 2047 + 128 + 0x18]
-        sethi           %hi(mmu_ihandle_cache), %g2
-        lduw            [%g2 + %lo(mmu_ihandle_cache)], %g2
+        sethi           %hi(prom_mmu_ihandle_cache), %g2
+        lduw            [%g2 + %lo(prom_mmu_ihandle_cache)], %g2
         stx             %g2, [%sp + 2047 + 128 + 0x20]
         sethi           %hi(KERNBASE + 0x400000), %g2
         stx             %g2, [%sp + 2047 + 128 + 0x28]
diff --git a/arch/sparc64/kernel/traps.c b/arch/sparc64/kernel/traps.c
index b280b2ef674f..5570e7bb22bb 100644
--- a/arch/sparc64/kernel/traps.c
+++ b/arch/sparc64/kernel/traps.c
@@ -189,19 +189,18 @@ void spitfire_data_access_exception(struct pt_regs *regs, unsigned long sfsr, un
 
         if (regs->tstate & TSTATE_PRIV) {
                 /* Test if this comes from uaccess places. */
-                unsigned long fixup;
-                unsigned long g2 = regs->u_regs[UREG_G2];
+                const struct exception_table_entry *entry;
 
-                if ((fixup = search_extables_range(regs->tpc, &g2))) {
-                        /* Ouch, somebody is trying ugly VM hole tricks on us... */
+                entry = search_exception_tables(regs->tpc);
+                if (entry) {
+                        /* Ouch, somebody is trying VM hole tricks on us... */
 #ifdef DEBUG_EXCEPTIONS
                         printk("Exception: PC<%016lx> faddr<UNKNOWN>\n", regs->tpc);
-                        printk("EX_TABLE: insn<%016lx> fixup<%016lx> "
-                               "g2<%016lx>\n", regs->tpc, fixup, g2);
+                        printk("EX_TABLE: insn<%016lx> fixup<%016lx>\n",
+                               regs->tpc, entry->fixup);
 #endif
-                        regs->tpc = fixup;
+                        regs->tpc = entry->fixup;
                         regs->tnpc = regs->tpc + 4;
-                        regs->u_regs[UREG_G2] = g2;
                         return;
                 }
                 /* Shit... */
@@ -758,26 +757,12 @@ void __init cheetah_ecache_flush_init(void)
         ecache_flush_size = (2 * largest_size);
         ecache_flush_linesize = smallest_linesize;
 
-        /* Discover a physically contiguous chunk of physical
-         * memory in 'sp_banks' of size ecache_flush_size calculated
-         * above.  Store the physical base of this area at
-         * ecache_flush_physbase.
-         */
-        for (node = 0; ; node++) {
-                if (sp_banks[node].num_bytes == 0)
-                        break;
-                if (sp_banks[node].num_bytes >= ecache_flush_size) {
-                        ecache_flush_physbase = sp_banks[node].base_addr;
-                        break;
-                }
-        }
+        ecache_flush_physbase = find_ecache_flush_span(ecache_flush_size);
 
-        /* Note: Zero would be a valid value of ecache_flush_physbase so
-         * don't use that as the success test. :-)
-         */
-        if (sp_banks[node].num_bytes == 0) {
+        if (ecache_flush_physbase == ~0UL) {
                 prom_printf("cheetah_ecache_flush_init: Cannot find %d byte "
-                            "contiguous physical memory.\n", ecache_flush_size);
+                            "contiguous physical memory.\n",
+                            ecache_flush_size);
                 prom_halt();
         }
 
@@ -869,14 +854,19 @@ static void cheetah_flush_ecache_line(unsigned long physaddr)
  */
 static void __cheetah_flush_icache(void)
 {
-        unsigned long i;
+        unsigned int icache_size, icache_line_size;
+        unsigned long addr;
+
+        icache_size = local_cpu_data().icache_size;
+        icache_line_size = local_cpu_data().icache_line_size;
 
         /* Clear the valid bits in all the tags. */
-        for (i = 0; i < (1 << 15); i += (1 << 5)) {
+        for (addr = 0; addr < icache_size; addr += icache_line_size) {
                 __asm__ __volatile__("stxa %%g0, [%0] %1\n\t"
                                      "membar #Sync"
                                      : /* no outputs */
-                                     : "r" (i | (2 << 3)), "i" (ASI_IC_TAG));
+                                     : "r" (addr | (2 << 3)),
+                                       "i" (ASI_IC_TAG));
         }
 }
 
@@ -904,13 +894,17 @@ static void cheetah_flush_icache(void)
 
 static void cheetah_flush_dcache(void)
 {
-        unsigned long i;
+        unsigned int dcache_size, dcache_line_size;
+        unsigned long addr;
 
-        for (i = 0; i < (1 << 16); i += (1 << 5)) {
+        dcache_size = local_cpu_data().dcache_size;
+        dcache_line_size = local_cpu_data().dcache_line_size;
+
+        for (addr = 0; addr < dcache_size; addr += dcache_line_size) {
                 __asm__ __volatile__("stxa %%g0, [%0] %1\n\t"
                                      "membar #Sync"
                                      : /* no outputs */
-                                     : "r" (i), "i" (ASI_DCACHE_TAG));
+                                     : "r" (addr), "i" (ASI_DCACHE_TAG));
         }
 }
 
@@ -921,24 +915,29 @@ static void cheetah_flush_dcache(void)
  */
 static void cheetah_plus_zap_dcache_parity(void)
 {
-        unsigned long i;
+        unsigned int dcache_size, dcache_line_size;
+        unsigned long addr;
+
+        dcache_size = local_cpu_data().dcache_size;
+        dcache_line_size = local_cpu_data().dcache_line_size;
 
-        for (i = 0; i < (1 << 16); i += (1 << 5)) {
-                unsigned long tag = (i >> 14);
-                unsigned long j;
+        for (addr = 0; addr < dcache_size; addr += dcache_line_size) {
+                unsigned long tag = (addr >> 14);
+                unsigned long line;
 
                 __asm__ __volatile__("membar    #Sync\n\t"
                                      "stxa      %0, [%1] %2\n\t"
                                      "membar    #Sync"
                                      : /* no outputs */
-                                     : "r" (tag), "r" (i),
+                                     : "r" (tag), "r" (addr),
                                        "i" (ASI_DCACHE_UTAG));
-                for (j = i; j < i + (1 << 5); j += (1 << 3))
+                for (line = addr; line < addr + dcache_line_size; line += 8)
                         __asm__ __volatile__("membar    #Sync\n\t"
                                              "stxa      %%g0, [%0] %1\n\t"
                                              "membar    #Sync"
                                              : /* no outputs */
-                                             : "r" (j), "i" (ASI_DCACHE_DATA));
+                                             : "r" (line),
+                                               "i" (ASI_DCACHE_DATA));
         }
 }
 
@@ -1332,16 +1331,12 @@ static int cheetah_fix_ce(unsigned long physaddr)
 /* Return non-zero if PADDR is a valid physical memory address. */
 static int cheetah_check_main_memory(unsigned long paddr)
 {
-        int i;
+        unsigned long vaddr = PAGE_OFFSET + paddr;
 
-        for (i = 0; ; i++) {
-                if (sp_banks[i].num_bytes == 0)
-                        break;
-                if (paddr >= sp_banks[i].base_addr &&
-                    paddr < (sp_banks[i].base_addr + sp_banks[i].num_bytes))
-                        return 1;
-        }
-        return 0;
+        if (vaddr > (unsigned long) high_memory)
+                return 0;
+
+        return kern_addr_valid(vaddr);
 }
 
 void cheetah_cee_handler(struct pt_regs *regs, unsigned long afsr, unsigned long afar)
@@ -1596,10 +1591,10 @@ void cheetah_deferred_handler(struct pt_regs *regs, unsigned long afsr, unsigned
                         /* OK, usermode access. */
                         recoverable = 1;
                 } else {
-                        unsigned long g2 = regs->u_regs[UREG_G2];
-                        unsigned long fixup = search_extables_range(regs->tpc, &g2);
+                        const struct exception_table_entry *entry;
 
-                        if (fixup != 0UL) {
+                        entry = search_exception_tables(regs->tpc);
+                        if (entry) {
                                 /* OK, kernel access to userspace. */
                                 recoverable = 1;
 
@@ -1618,9 +1613,8 @@ void cheetah_deferred_handler(struct pt_regs *regs, unsigned long afsr, unsigned
                                  * recoverable condition.
                                  */
                                 if (recoverable) {
-                                        regs->tpc = fixup;
+                                        regs->tpc = entry->fixup;
                                         regs->tnpc = regs->tpc + 4;
-                                        regs->u_regs[UREG_G2] = g2;
                                 }
                         }
                 }
diff --git a/arch/sparc64/kernel/una_asm.S b/arch/sparc64/kernel/una_asm.S
index cbb40585253c..1f5b5b708ce7 100644
--- a/arch/sparc64/kernel/una_asm.S
+++ b/arch/sparc64/kernel/una_asm.S
@@ -6,18 +6,11 @@
 
         .text
 
-kernel_unaligned_trap_fault:
-        call    kernel_mna_trap_fault
-         nop
-        retl
-         nop
-        .size   kern_unaligned_trap_fault, .-kern_unaligned_trap_fault
-
         .globl  __do_int_store
 __do_int_store:
         rd      %asi, %o4
         wr      %o3, 0, %asi
-        ldx     [%o2], %g3
+        mov     %o2, %g3
         cmp     %o1, 2
         be,pn   %icc, 2f
          cmp    %o1, 4
@@ -51,24 +44,24 @@ __do_int_store:
 0:
         wr      %o4, 0x0, %asi
         retl
-         nop
+         mov    0, %o0
         .size   __do_int_store, .-__do_int_store
 
         .section        __ex_table
-        .word           4b, kernel_unaligned_trap_fault
-        .word           5b, kernel_unaligned_trap_fault
-        .word           6b, kernel_unaligned_trap_fault
-        .word           7b, kernel_unaligned_trap_fault
-        .word           8b, kernel_unaligned_trap_fault
-        .word           9b, kernel_unaligned_trap_fault
-        .word           10b, kernel_unaligned_trap_fault
-        .word           11b, kernel_unaligned_trap_fault
-        .word           12b, kernel_unaligned_trap_fault
-        .word           13b, kernel_unaligned_trap_fault
-        .word           14b, kernel_unaligned_trap_fault
-        .word           15b, kernel_unaligned_trap_fault
-        .word           16b, kernel_unaligned_trap_fault
-        .word           17b, kernel_unaligned_trap_fault
+        .word           4b, __retl_efault
+        .word           5b, __retl_efault
+        .word           6b, __retl_efault
+        .word           7b, __retl_efault
+        .word           8b, __retl_efault
+        .word           9b, __retl_efault
+        .word           10b, __retl_efault
+        .word           11b, __retl_efault
+        .word           12b, __retl_efault
+        .word           13b, __retl_efault
+        .word           14b, __retl_efault
+        .word           15b, __retl_efault
+        .word           16b, __retl_efault
+        .word           17b, __retl_efault
         .previous
 
         .globl  do_int_load
@@ -133,21 +126,21 @@ do_int_load:
 0:
         wr      %o5, 0x0, %asi
         retl
-         nop
+         mov    0, %o0
         .size   __do_int_load, .-__do_int_load
 
         .section        __ex_table
-        .word           4b, kernel_unaligned_trap_fault
-        .word           5b, kernel_unaligned_trap_fault
-        .word           6b, kernel_unaligned_trap_fault
-        .word           7b, kernel_unaligned_trap_fault
-        .word           8b, kernel_unaligned_trap_fault
-        .word           9b, kernel_unaligned_trap_fault
-        .word           10b, kernel_unaligned_trap_fault
-        .word           11b, kernel_unaligned_trap_fault
-        .word           12b, kernel_unaligned_trap_fault
-        .word           13b, kernel_unaligned_trap_fault
-        .word           14b, kernel_unaligned_trap_fault
-        .word           15b, kernel_unaligned_trap_fault
-        .word           16b, kernel_unaligned_trap_fault
+        .word           4b, __retl_efault
+        .word           5b, __retl_efault
+        .word           6b, __retl_efault
+        .word           7b, __retl_efault
+        .word           8b, __retl_efault
+        .word           9b, __retl_efault
+        .word           10b, __retl_efault
+        .word           11b, __retl_efault
+        .word           12b, __retl_efault
+        .word           13b, __retl_efault
+        .word           14b, __retl_efault
+        .word           15b, __retl_efault
+        .word           16b, __retl_efault
         .previous
diff --git a/arch/sparc64/kernel/unaligned.c b/arch/sparc64/kernel/unaligned.c
index da9739f0d437..70faf630603b 100644
--- a/arch/sparc64/kernel/unaligned.c
+++ b/arch/sparc64/kernel/unaligned.c
@@ -180,17 +180,18 @@ static void __attribute_used__ unaligned_panic(char *str, struct pt_regs *regs)
         die_if_kernel(str, regs);
 }
 
-extern void do_int_load(unsigned long *dest_reg, int size,
-                        unsigned long *saddr, int is_signed, int asi);
+extern int do_int_load(unsigned long *dest_reg, int size,
+                       unsigned long *saddr, int is_signed, int asi);
         
-extern void __do_int_store(unsigned long *dst_addr, int size,
-                           unsigned long *src_val, int asi);
+extern int __do_int_store(unsigned long *dst_addr, int size,
+                          unsigned long src_val, int asi);
 
-static inline void do_int_store(int reg_num, int size, unsigned long *dst_addr,
-                                struct pt_regs *regs, int asi)
+static inline int do_int_store(int reg_num, int size, unsigned long *dst_addr,
+                               struct pt_regs *regs, int asi, int orig_asi)
 {
         unsigned long zero = 0;
-        unsigned long *src_val = &zero;
+        unsigned long *src_val_p = &zero;
+        unsigned long src_val;
 
         if (size == 16) {
                 size = 8;
@@ -198,9 +199,27 @@ static inline void do_int_store(int reg_num, int size, unsigned long *dst_addr,
                         (unsigned)fetch_reg(reg_num, regs) : 0)) << 32) |
                         (unsigned)fetch_reg(reg_num + 1, regs);
         } else if (reg_num) {
-                src_val = fetch_reg_addr(reg_num, regs);
+                src_val_p = fetch_reg_addr(reg_num, regs);
         }
-        __do_int_store(dst_addr, size, src_val, asi);
+        src_val = *src_val_p;
+        if (unlikely(asi != orig_asi)) {
+                switch (size) {
+                case 2:
+                        src_val = swab16(src_val);
+                        break;
+                case 4:
+                        src_val = swab32(src_val);
+                        break;
+                case 8:
+                        src_val = swab64(src_val);
+                        break;
+                case 16:
+                default:
+                        BUG();
+                        break;
+                };
+        }
+        return __do_int_store(dst_addr, size, src_val, asi);
 }
 
 static inline void advance(struct pt_regs *regs)
@@ -223,14 +242,14 @@ static inline int ok_for_kernel(unsigned int insn)
         return !floating_point_load_or_store_p(insn);
 }
 
-void kernel_mna_trap_fault(void)
+static void kernel_mna_trap_fault(void)
 {
         struct pt_regs *regs = current_thread_info()->kern_una_regs;
         unsigned int insn = current_thread_info()->kern_una_insn;
-        unsigned long g2 = regs->u_regs[UREG_G2];
-        unsigned long fixup = search_extables_range(regs->tpc, &g2);
+        const struct exception_table_entry *entry;
 
-        if (!fixup) {
+        entry = search_exception_tables(regs->tpc);
+        if (!entry) {
                 unsigned long address;
 
                 address = compute_effective_address(regs, insn,
@@ -251,9 +270,8 @@ void kernel_mna_trap_fault(void)
                 die_if_kernel("Oops", regs);
                 /* Not reached */
         }
-        regs->tpc = fixup;
+        regs->tpc = entry->fixup;
         regs->tnpc = regs->tpc + 4;
-        regs->u_regs [UREG_G2] = g2;
 
         regs->tstate &= ~TSTATE_ASI;
         regs->tstate |= (ASI_AIUS << 24UL);
@@ -275,7 +293,8 @@ asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn, u
 
                 kernel_mna_trap_fault();
         } else {
-                unsigned long addr;
+                unsigned long addr, *reg_addr;
+                int orig_asi, asi, err;
 
                 addr = compute_effective_address(regs, insn,
                                                  ((insn >> 25) & 0x1f));
@@ -285,25 +304,59 @@ asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn, u
                        regs->tpc, dirstrings[dir], addr, size,
                        regs->u_regs[UREG_RETPC]);
 #endif
+                orig_asi = asi = decode_asi(insn, regs);
+                switch (asi) {
+                case ASI_NL:
+                case ASI_AIUPL:
+                case ASI_AIUSL:
+                case ASI_PL:
+                case ASI_SL:
+                case ASI_PNFL:
+                case ASI_SNFL:
+                        asi &= ~0x08;
+                        break;
+                };
                 switch (dir) {
                 case load:
-                        do_int_load(fetch_reg_addr(((insn>>25)&0x1f), regs),
-                                    size, (unsigned long *) addr,
-                                    decode_signedness(insn),
-                                    decode_asi(insn, regs));
+                        reg_addr = fetch_reg_addr(((insn>>25)&0x1f), regs);
+                        err = do_int_load(reg_addr, size,
+                                          (unsigned long *) addr,
+                                          decode_signedness(insn), asi);
+                        if (likely(!err) && unlikely(asi != orig_asi)) {
+                                unsigned long val_in = *reg_addr;
+                                switch (size) {
+                                case 2:
+                                        val_in = swab16(val_in);
+                                        break;
+                                case 4:
+                                        val_in = swab32(val_in);
+                                        break;
+                                case 8:
+                                        val_in = swab64(val_in);
+                                        break;
+                                case 16:
+                                default:
+                                        BUG();
+                                        break;
+                                };
+                                *reg_addr = val_in;
+                        }
                         break;
 
                 case store:
-                        do_int_store(((insn>>25)&0x1f), size,
-                                     (unsigned long *) addr, regs,
-                                     decode_asi(insn, regs));
+                        err = do_int_store(((insn>>25)&0x1f), size,
+                                           (unsigned long *) addr, regs,
+                                           asi, orig_asi);
                         break;
 
                 default:
                         panic("Impossible kernel unaligned trap.");
                         /* Not reached... */
                 }
-                advance(regs);
+                if (unlikely(err))
+                        kernel_mna_trap_fault();
+                else
+                        advance(regs);
         }
 }
 
diff --git a/arch/sparc64/kernel/us3_cpufreq.c b/arch/sparc64/kernel/us3_cpufreq.c
index 9080e7cd4bb0..0340041f6143 100644
--- a/arch/sparc64/kernel/us3_cpufreq.c
+++ b/arch/sparc64/kernel/us3_cpufreq.c
@@ -208,7 +208,10 @@ static int __init us3_freq_init(void)
         impl  = ((ver >> 32) & 0xffff);
 
         if (manuf == CHEETAH_MANUF &&
-            (impl == CHEETAH_IMPL || impl == CHEETAH_PLUS_IMPL)) {
+            (impl == CHEETAH_IMPL ||
+             impl == CHEETAH_PLUS_IMPL ||
+             impl == JAGUAR_IMPL ||
+             impl == PANTHER_IMPL)) {
                 struct cpufreq_driver *driver;
 
                 ret = -ENOMEM;
diff --git a/arch/sparc64/kernel/vmlinux.lds.S b/arch/sparc64/kernel/vmlinux.lds.S
index f47d0be39378..2af0cf0a8640 100644
--- a/arch/sparc64/kernel/vmlinux.lds.S
+++ b/arch/sparc64/kernel/vmlinux.lds.S
@@ -9,8 +9,7 @@ ENTRY(_start)
 jiffies = jiffies_64;
 SECTIONS
 {
-  swapper_pmd_dir = 0x0000000000402000;
-  empty_pg_dir = 0x0000000000403000;
+  swapper_low_pmd_dir = 0x0000000000402000;
   . = 0x4000;
   .text 0x0000000000404000 :
   {
diff --git a/arch/sparc64/lib/Makefile b/arch/sparc64/lib/Makefile
index d968aebe83b2..c295806500f7 100644
--- a/arch/sparc64/lib/Makefile
+++ b/arch/sparc64/lib/Makefile
@@ -14,6 +14,4 @@ lib-y := PeeCeeI.o copy_page.o clear_page.o strlen.o strncmp.o \
          copy_in_user.o user_fixup.o memmove.o \
          mcount.o ipcsum.o rwsem.o xor.o find_bit.o delay.o
 
-lib-$(CONFIG_HAVE_DEC_LOCK) += dec_and_lock.o
-
 obj-y += iomap.o
diff --git a/arch/sparc64/lib/dec_and_lock.S b/arch/sparc64/lib/dec_and_lock.S
deleted file mode 100644
index 8ee288dd0afc..000000000000
--- a/arch/sparc64/lib/dec_and_lock.S
+++ /dev/null
@@ -1,80 +0,0 @@
-/* $Id: dec_and_lock.S,v 1.5 2001/11/18 00:12:56 davem Exp $
- * dec_and_lock.S: Sparc64 version of "atomic_dec_and_lock()"
- *                 using cas and ldstub instructions.
- *
- * Copyright (C) 2000 David S. Miller (davem@redhat.com)
- */
-#include <linux/config.h>
-#include <asm/thread_info.h>
-
-        .text
-        .align  64
-
-        /* CAS basically works like this:
-         *
-         * void CAS(MEM, REG1, REG2)
-         * {
-         *   START_ATOMIC();
-         *   if (*(MEM) == REG1) {
-         *     TMP = *(MEM);
-         *     *(MEM) = REG2;
-         *     REG2 = TMP;
-         *   } else
-         *     REG2 = *(MEM);
-         *   END_ATOMIC();
-         * }
-         */
-
-        .globl  _atomic_dec_and_lock
-_atomic_dec_and_lock:   /* %o0 = counter, %o1 = lock */
-loop1:  lduw    [%o0], %g2
-        subcc   %g2, 1, %g7
-        be,pn   %icc, start_to_zero
-         nop
-nzero:  cas     [%o0], %g2, %g7
-        cmp     %g2, %g7
-        bne,pn  %icc, loop1
-         mov    0, %g1
-
-out:
-        membar  #StoreLoad | #StoreStore
-        retl
-         mov    %g1, %o0
-start_to_zero:
-#ifdef CONFIG_PREEMPT
-        ldsw    [%g6 + TI_PRE_COUNT], %g3
-        add     %g3, 1, %g3
-        stw     %g3, [%g6 + TI_PRE_COUNT]
-#endif
-to_zero:
-        ldstub  [%o1], %g3
-        membar  #StoreLoad | #StoreStore
-        brnz,pn %g3, spin_on_lock
-         nop
-loop2:  cas     [%o0], %g2, %g7         /* ASSERT(g7 == 0) */
-        cmp     %g2, %g7
-
-        be,pt   %icc, out
-         mov    1, %g1
-        lduw    [%o0], %g2
-        subcc   %g2, 1, %g7
-        be,pn   %icc, loop2
-         nop
-        membar  #StoreStore | #LoadStore
-        stb     %g0, [%o1]
-#ifdef CONFIG_PREEMPT
-        ldsw    [%g6 + TI_PRE_COUNT], %g3
-        sub     %g3, 1, %g3
-        stw     %g3, [%g6 + TI_PRE_COUNT]
-#endif
-
-        b,pt    %xcc, nzero
-         nop
-spin_on_lock:
-        ldub    [%o1], %g3
-        membar  #LoadLoad
-        brnz,pt %g3, spin_on_lock
-         nop
-        ba,pt   %xcc, to_zero
-         nop
-        nop
diff --git a/arch/sparc64/lib/strncpy_from_user.S b/arch/sparc64/lib/strncpy_from_user.S
index 09cbbaa0ebf4..e1264650ca7a 100644
--- a/arch/sparc64/lib/strncpy_from_user.S
+++ b/arch/sparc64/lib/strncpy_from_user.S
@@ -125,15 +125,11 @@ __strncpy_from_user:
          add    %o2, %o3, %o0
         .size   __strncpy_from_user, .-__strncpy_from_user
 
-        .section .fixup,#alloc,#execinstr
-        .align  4
-4:      retl
-         mov    -EFAULT, %o0
-
         .section __ex_table,#alloc
         .align  4
-        .word   60b, 4b
-        .word   61b, 4b
-        .word   62b, 4b
-        .word   63b, 4b
-        .word   64b, 4b
+        .word   60b, __retl_efault
+        .word   61b, __retl_efault
+        .word   62b, __retl_efault
+        .word   63b, __retl_efault
+        .word   64b, __retl_efault
+        .previous
diff --git a/arch/sparc64/lib/user_fixup.c b/arch/sparc64/lib/user_fixup.c
index 0278e34125db..19d1fdb17d0e 100644
--- a/arch/sparc64/lib/user_fixup.c
+++ b/arch/sparc64/lib/user_fixup.c
@@ -11,61 +11,56 @@
 
 /* Calculating the exact fault address when using
  * block loads and stores can be very complicated.
+ *
  * Instead of trying to be clever and handling all
  * of the cases, just fix things up simply here.
  */
 
-unsigned long copy_from_user_fixup(void *to, const void __user *from, unsigned long size)
+static unsigned long compute_size(unsigned long start, unsigned long size, unsigned long *offset)
 {
-        char *dst = to;
-        const char __user *src = from;
+        unsigned long fault_addr = current_thread_info()->fault_address;
+        unsigned long end = start + size;
 
-        while (size) {
-                if (__get_user(*dst, src))
-                        break;
-                dst++;
-                src++;
-                size--;
+        if (fault_addr < start || fault_addr >= end) {
+                *offset = 0;
+        } else {
+                *offset = start - fault_addr;
+                size = end - fault_addr;
         }
+        return size;
+}
 
-        if (size)
-                memset(dst, 0, size);
+unsigned long copy_from_user_fixup(void *to, const void __user *from, unsigned long size)
+{
+        unsigned long offset;
+
+        size = compute_size((unsigned long) from, size, &offset);
+        if (likely(size))
+                memset(to + offset, 0, size);
 
         return size;
 }
 
 unsigned long copy_to_user_fixup(void __user *to, const void *from, unsigned long size)
 {
-        char __user *dst = to;
-        const char *src = from;
-
-        while (size) {
-                if (__put_user(*src, dst))
-                        break;
-                dst++;
-                src++;
-                size--;
-        }
+        unsigned long offset;
 
-        return size;
+        return compute_size((unsigned long) to, size, &offset);
 }
 
 unsigned long copy_in_user_fixup(void __user *to, void __user *from, unsigned long size)
 {
-        char __user *dst = to;
-        char __user *src = from;
+        unsigned long fault_addr = current_thread_info()->fault_address;
+        unsigned long start = (unsigned long) to;
+        unsigned long end = start + size;
 
-        while (size) {
-                char tmp;
+        if (fault_addr >= start && fault_addr < end)
+                return end - fault_addr;
 
-                if (__get_user(tmp, src))
-                        break;
-                if (__put_user(tmp, dst))
-                        break;
-                dst++;
-                src++;
-                size--;
-        }
+        start = (unsigned long) from;
+        end = start + size;
+        if (fault_addr >= start && fault_addr < end)
+                return end - fault_addr;
 
         return size;
 }
diff --git a/arch/sparc64/mm/Makefile b/arch/sparc64/mm/Makefile
index cda87333a77b..9d0960e69f48 100644
--- a/arch/sparc64/mm/Makefile
+++ b/arch/sparc64/mm/Makefile
@@ -5,6 +5,6 @@
 EXTRA_AFLAGS := -ansi
 EXTRA_CFLAGS := -Werror
 
-obj-y    := ultra.o tlb.o fault.o init.o generic.o extable.o
+obj-y    := ultra.o tlb.o fault.o init.o generic.o
 
 obj-$(CONFIG_HUGETLB_PAGE) += hugetlbpage.o
diff --git a/arch/sparc64/mm/extable.c b/arch/sparc64/mm/extable.c
deleted file mode 100644
index ec334297ff4f..000000000000
--- a/arch/sparc64/mm/extable.c
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * linux/arch/sparc64/mm/extable.c
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <asm/uaccess.h>
-
-extern const struct exception_table_entry __start___ex_table[];
-extern const struct exception_table_entry __stop___ex_table[];
-
-void sort_extable(struct exception_table_entry *start,
-                  struct exception_table_entry *finish)
-{
-}
-
-/* Caller knows they are in a range if ret->fixup == 0 */
-const struct exception_table_entry *
-search_extable(const struct exception_table_entry *start,
-               const struct exception_table_entry *last,
-               unsigned long value)
-{
-        const struct exception_table_entry *walk;
-
-        /* Single insn entries are encoded as:
-         *      word 1: insn address
-         *      word 2: fixup code address
-         *
-         * Range entries are encoded as:
-         *      word 1: first insn address
-         *      word 2: 0
-         *      word 3: last insn address + 4 bytes
-         *      word 4: fixup code address
-         *
-         * See asm/uaccess.h for more details.
-         */
-
-        /* 1. Try to find an exact match. */
-        for (walk = start; walk <= last; walk++) {
-                if (walk->fixup == 0) {
-                        /* A range entry, skip both parts. */
-                        walk++;
-                        continue;
-                }
-
-                if (walk->insn == value)
-                        return walk;
-        }
-
-        /* 2. Try to find a range match. */
-        for (walk = start; walk <= (last - 1); walk++) {
-                if (walk->fixup)
-                        continue;
-
-                if (walk[0].insn <= value && walk[1].insn > value)
-                        return walk;
-
-                walk++;
-        }
-
-        return NULL;
-}
-
-/* Special extable search, which handles ranges.  Returns fixup */
-unsigned long search_extables_range(unsigned long addr, unsigned long *g2)
-{
-        const struct exception_table_entry *entry;
-
-        entry = search_exception_tables(addr);
-        if (!entry)
-                return 0;
-
-        /* Inside range?  Fix g2 and return correct fixup */
-        if (!entry->fixup) {
-                *g2 = (addr - entry->insn) / 4;
-                return (entry + 1)->fixup;
-        }
-
-        return entry->fixup;
-}
diff --git a/arch/sparc64/mm/fault.c b/arch/sparc64/mm/fault.c
index db1e3310e907..31fbc67719a1 100644
--- a/arch/sparc64/mm/fault.c
+++ b/arch/sparc64/mm/fault.c
@@ -32,8 +32,6 @@
 
 #define ELEMENTS(arr) (sizeof (arr)/sizeof (arr[0]))
 
-extern struct sparc_phys_banks sp_banks[SPARC_PHYS_BANKS];
-
 /*
  * To debug kernel to catch accesses to certain virtual/physical addresses.
  * Mode = 0 selects physical watchpoints, mode = 1 selects virtual watchpoints.
@@ -71,53 +69,6 @@ void set_brkpt(unsigned long addr, unsigned char mask, int flags, int mode)
                              : "memory");
 }
 
-/* Nice, simple, prom library does all the sweating for us. ;) */
-unsigned long __init prom_probe_memory (void)
-{
-        register struct linux_mlist_p1275 *mlist;
-        register unsigned long bytes, base_paddr, tally;
-        register int i;
-
-        i = 0;
-        mlist = *prom_meminfo()->p1275_available;
-        bytes = tally = mlist->num_bytes;
-        base_paddr = mlist->start_adr;
-  
-        sp_banks[0].base_addr = base_paddr;
-        sp_banks[0].num_bytes = bytes;
-
-        while (mlist->theres_more != (void *) 0) {
-                i++;
-                mlist = mlist->theres_more;
-                bytes = mlist->num_bytes;
-                tally += bytes;
-                if (i >= SPARC_PHYS_BANKS-1) {
-                        printk ("The machine has more banks than "
-                                "this kernel can support\n"
-                                "Increase the SPARC_PHYS_BANKS "
-                                "setting (currently %d)\n",
-                                SPARC_PHYS_BANKS);
-                        i = SPARC_PHYS_BANKS-1;
-                        break;
-                }
-    
-                sp_banks[i].base_addr = mlist->start_adr;
-                sp_banks[i].num_bytes = mlist->num_bytes;
-        }
-
-        i++;
-        sp_banks[i].base_addr = 0xdeadbeefbeefdeadUL;
-        sp_banks[i].num_bytes = 0;
-
-        /* Now mask all bank sizes on a page boundary, it is all we can
-         * use anyways.
-         */
-        for (i = 0; sp_banks[i].num_bytes != 0; i++)
-                sp_banks[i].num_bytes &= PAGE_MASK;
-
-        return tally;
-}
-
 static void __kprobes unhandled_fault(unsigned long address,
                                       struct task_struct *tsk,
                                       struct pt_regs *regs)
@@ -242,7 +193,6 @@ static unsigned int get_fault_insn(struct pt_regs *regs, unsigned int insn)
 static void do_kernel_fault(struct pt_regs *regs, int si_code, int fault_code,
                             unsigned int insn, unsigned long address)
 {
-        unsigned long g2;
         unsigned char asi = ASI_P;
  
         if ((!insn) && (regs->tstate & TSTATE_PRIV))
@@ -273,11 +223,9 @@ static void do_kernel_fault(struct pt_regs *regs, int si_code, int fault_code,
                 }
         }
                 
-        g2 = regs->u_regs[UREG_G2];
-
         /* Is this in ex_table? */
         if (regs->tstate & TSTATE_PRIV) {
-                unsigned long fixup;
+                const struct exception_table_entry *entry;
 
                 if (asi == ASI_P && (insn & 0xc0800000) == 0xc0800000) {
                         if (insn & 0x2000)
@@ -288,10 +236,9 @@ static void do_kernel_fault(struct pt_regs *regs, int si_code, int fault_code,
         
                 /* Look in asi.h: All _S asis have LS bit set */
                 if ((asi & 0x1) &&
-                    (fixup = search_extables_range(regs->tpc, &g2))) {
-                        regs->tpc = fixup;
+                    (entry = search_exception_tables(regs->tpc))) {
+                        regs->tpc = entry->fixup;
                         regs->tnpc = regs->tpc + 4;
-                        regs->u_regs[UREG_G2] = g2;
                         return;
                 }
         } else {
@@ -461,7 +408,7 @@ good_area:
         }
 
         up_read(&mm->mmap_sem);
-        goto fault_done;
+        return;
 
         /*
          * Something tried to access memory that isn't in our memory map..
@@ -473,8 +420,7 @@ bad_area:
 
 handle_kernel_fault:
         do_kernel_fault(regs, si_code, fault_code, insn, address);
-
-        goto fault_done;
+        return;
 
 /*
  * We ran out of memory, or some other thing happened to us that made
@@ -505,9 +451,4 @@ do_sigbus:
         /* Kernel mode? Handle exceptions or die */
         if (regs->tstate & TSTATE_PRIV)
                 goto handle_kernel_fault;
-
-fault_done:
-        /* These values are no longer needed, clear them. */
-        set_thread_fault_code(0);
-        current_thread_info()->fault_address = 0;
 }
diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
index fdb1ebb308c9..5db50524f20d 100644
--- a/arch/sparc64/mm/init.c
+++ b/arch/sparc64/mm/init.c
@@ -20,6 +20,8 @@
 #include <linux/fs.h>
 #include <linux/seq_file.h>
 #include <linux/kprobes.h>
+#include <linux/cache.h>
+#include <linux/sort.h>
 
 #include <asm/head.h>
 #include <asm/system.h>
@@ -40,24 +42,80 @@
 
 extern void device_scan(void);
 
-struct sparc_phys_banks sp_banks[SPARC_PHYS_BANKS];
+#define MAX_BANKS       32
 
-unsigned long *sparc64_valid_addr_bitmap;
+static struct linux_prom64_registers pavail[MAX_BANKS] __initdata;
+static struct linux_prom64_registers pavail_rescan[MAX_BANKS] __initdata;
+static int pavail_ents __initdata;
+static int pavail_rescan_ents __initdata;
+
+static int cmp_p64(const void *a, const void *b)
+{
+        const struct linux_prom64_registers *x = a, *y = b;
+
+        if (x->phys_addr > y->phys_addr)
+                return 1;
+        if (x->phys_addr < y->phys_addr)
+                return -1;
+        return 0;
+}
+
+static void __init read_obp_memory(const char *property,
+                                   struct linux_prom64_registers *regs,
+                                   int *num_ents)
+{
+        int node = prom_finddevice("/memory");
+        int prop_size = prom_getproplen(node, property);
+        int ents, ret, i;
+
+        ents = prop_size / sizeof(struct linux_prom64_registers);
+        if (ents > MAX_BANKS) {
+                prom_printf("The machine has more %s property entries than "
+                            "this kernel can support (%d).\n",
+                            property, MAX_BANKS);
+                prom_halt();
+        }
+
+        ret = prom_getproperty(node, property, (char *) regs, prop_size);
+        if (ret == -1) {
+                prom_printf("Couldn't get %s property from /memory.\n");
+                prom_halt();
+        }
+
+        *num_ents = ents;
+
+        /* Sanitize what we got from the firmware, by page aligning
+         * everything.
+         */
+        for (i = 0; i < ents; i++) {
+                unsigned long base, size;
+
+                base = regs[i].phys_addr;
+                size = regs[i].reg_size;
+
+                size &= PAGE_MASK;
+                if (base & ~PAGE_MASK) {
+                        unsigned long new_base = PAGE_ALIGN(base);
+
+                        size -= new_base - base;
+                        if ((long) size < 0L)
+                                size = 0UL;
+                        base = new_base;
+                }
+                regs[i].phys_addr = base;
+                regs[i].reg_size = size;
+        }
+        sort(regs, ents, sizeof(struct  linux_prom64_registers),
+             cmp_p64, NULL);
+}
+
+unsigned long *sparc64_valid_addr_bitmap __read_mostly;
 
 /* Ugly, but necessary... -DaveM */
-unsigned long phys_base;
-unsigned long kern_base;
-unsigned long kern_size;
-unsigned long pfn_base;
-
-/* This is even uglier. We have a problem where the kernel may not be
- * located at phys_base. However, initial __alloc_bootmem() calls need to
- * be adjusted to be within the 4-8Megs that the kernel is mapped to, else
- * those page mappings wont work. Things are ok after inherit_prom_mappings
- * is called though. Dave says he'll clean this up some other time.
- * -- BenC
- */
-static unsigned long bootmap_base;
+unsigned long phys_base __read_mostly;
+unsigned long kern_base __read_mostly;
+unsigned long kern_size __read_mostly;
+unsigned long pfn_base __read_mostly;
 
 /* get_new_mmu_context() uses "cache + 1".  */
 DEFINE_SPINLOCK(ctx_alloc_lock);
@@ -73,7 +131,7 @@ extern unsigned long sparc_ramdisk_image64;
 extern unsigned int sparc_ramdisk_image;
 extern unsigned int sparc_ramdisk_size;
 
-struct page *mem_map_zero;
+struct page *mem_map_zero __read_mostly;
 
 int bigkernel = 0;
 
@@ -179,8 +237,6 @@ static __inline__ void clear_dcache_dirty_cpu(struct page *page, unsigned long c
                              : "g1", "g7");
 }
 
-extern void __update_mmu_cache(unsigned long mmu_context_hw, unsigned long address, pte_t pte, int code);
-
 void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t pte)
 {
         struct page *page;
@@ -207,10 +263,6 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t p
 
                 put_cpu();
         }
-
-        if (get_thread_fault_code())
-                __update_mmu_cache(CTX_NRBITS(vma->vm_mm->context),
-                                   address, pte, get_thread_fault_code());
 }
 
 void flush_dcache_page(struct page *page)
@@ -309,6 +361,7 @@ struct linux_prom_translation {
         unsigned long size;
         unsigned long data;
 };
+static struct linux_prom_translation prom_trans[512] __initdata;
 
 extern unsigned long prom_boot_page;
 extern void prom_remap(unsigned long physpage, unsigned long virtpage, int mmu_ihandle);
@@ -318,14 +371,63 @@ extern void register_prom_callbacks(void);
 /* Exported for SMP bootup purposes. */
 unsigned long kern_locked_tte_data;
 
-void __init early_pgtable_allocfail(char *type)
+/* Exported for kernel TLB miss handling in ktlb.S */
+unsigned long prom_pmd_phys __read_mostly;
+unsigned int swapper_pgd_zero __read_mostly;
+
+/* Allocate power-of-2 aligned chunks from the end of the
+ * kernel image.  Return physical address.
+ */
+static inline unsigned long early_alloc_phys(unsigned long size)
 {
-        prom_printf("inherit_prom_mappings: Cannot alloc kernel %s.\n", type);
-        prom_halt();
+        unsigned long base;
+
+        BUILD_BUG_ON(size & (size - 1));
+
+        kern_size = (kern_size + (size - 1)) & ~(size - 1);
+        base = kern_base + kern_size;
+        kern_size += size;
+
+        return base;
+}
+
+static inline unsigned long load_phys32(unsigned long pa)
+{
+        unsigned long val;
+
+        __asm__ __volatile__("lduwa     [%1] %2, %0"
+                             : "=&r" (val)
+                             : "r" (pa), "i" (ASI_PHYS_USE_EC));
+
+        return val;
+}
+
+static inline unsigned long load_phys64(unsigned long pa)
+{
+        unsigned long val;
+
+        __asm__ __volatile__("ldxa      [%1] %2, %0"
+                             : "=&r" (val)
+                             : "r" (pa), "i" (ASI_PHYS_USE_EC));
+
+        return val;
+}
+
+static inline void store_phys32(unsigned long pa, unsigned long val)
+{
+        __asm__ __volatile__("stwa      %0, [%1] %2"
+                             : /* no outputs */
+                             : "r" (val), "r" (pa), "i" (ASI_PHYS_USE_EC));
+}
+
+static inline void store_phys64(unsigned long pa, unsigned long val)
+{
+        __asm__ __volatile__("stxa      %0, [%1] %2"
+                             : /* no outputs */
+                             : "r" (val), "r" (pa), "i" (ASI_PHYS_USE_EC));
 }
 
 #define BASE_PAGE_SIZE 8192
-static pmd_t *prompmd;
 
 /*
  * Translate PROM's mapping we capture at boot time into physical address.
@@ -333,278 +435,172 @@ static pmd_t *prompmd;
  */
 unsigned long prom_virt_to_phys(unsigned long promva, int *error)
 {
-        pmd_t *pmdp = prompmd + ((promva >> 23) & 0x7ff);
-        pte_t *ptep;
+        unsigned long pmd_phys = (prom_pmd_phys +
+                                  ((promva >> 23) & 0x7ff) * sizeof(pmd_t));
+        unsigned long pte_phys;
+        pmd_t pmd_ent;
+        pte_t pte_ent;
         unsigned long base;
 
-        if (pmd_none(*pmdp)) {
+        pmd_val(pmd_ent) = load_phys32(pmd_phys);
+        if (pmd_none(pmd_ent)) {
                 if (error)
                         *error = 1;
-                return(0);
+                return 0;
         }
-        ptep = (pte_t *)__pmd_page(*pmdp) + ((promva >> 13) & 0x3ff);
-        if (!pte_present(*ptep)) {
+
+        pte_phys = (unsigned long)pmd_val(pmd_ent) << 11UL;
+        pte_phys += ((promva >> 13) & 0x3ff) * sizeof(pte_t);
+        pte_val(pte_ent) = load_phys64(pte_phys);
+        if (!pte_present(pte_ent)) {
                 if (error)
                         *error = 1;
-                return(0);
+                return 0;
         }
         if (error) {
                 *error = 0;
-                return(pte_val(*ptep));
+                return pte_val(pte_ent);
         }
-        base = pte_val(*ptep) & _PAGE_PADDR;
-        return(base + (promva & (BASE_PAGE_SIZE - 1)));
+        base = pte_val(pte_ent) & _PAGE_PADDR;
+        return (base + (promva & (BASE_PAGE_SIZE - 1)));
 }
 
-static void inherit_prom_mappings(void)
+/* The obp translations are saved based on 8k pagesize, since obp can
+ * use a mixture of pagesizes. Misses to the LOW_OBP_ADDRESS ->
+ * HI_OBP_ADDRESS range are handled in entry.S and do not use the vpte
+ * scheme (also, see rant in inherit_locked_prom_mappings()).
+ */
+static void __init build_obp_range(unsigned long start, unsigned long end, unsigned long data)
 {
-        struct linux_prom_translation *trans;
-        unsigned long phys_page, tte_vaddr, tte_data;
-        void (*remap_func)(unsigned long, unsigned long, int);
-        pmd_t *pmdp;
-        pte_t *ptep;
-        int node, n, i, tsz;
-        extern unsigned int obp_iaddr_patch[2], obp_daddr_patch[2];
+        unsigned long vaddr;
 
-        node = prom_finddevice("/virtual-memory");
-        n = prom_getproplen(node, "translations");
-        if (n == 0 || n == -1) {
-                prom_printf("Couldn't get translation property\n");
-                prom_halt();
-        }
-        n += 5 * sizeof(struct linux_prom_translation);
-        for (tsz = 1; tsz < n; tsz <<= 1)
-                /* empty */;
-        trans = __alloc_bootmem(tsz, SMP_CACHE_BYTES, bootmap_base);
-        if (trans == NULL) {
-                prom_printf("inherit_prom_mappings: Cannot alloc translations.\n");
-                prom_halt();
-        }
-        memset(trans, 0, tsz);
+        for (vaddr = start; vaddr < end; vaddr += BASE_PAGE_SIZE) {
+                unsigned long val, pte_phys, pmd_phys;
+                pmd_t pmd_ent;
+                int i;
 
-        if ((n = prom_getproperty(node, "translations", (char *)trans, tsz)) == -1) {
-                prom_printf("Couldn't get translation property\n");
-                prom_halt();
-        }
-        n = n / sizeof(*trans);
+                pmd_phys = (prom_pmd_phys +
+                            (((vaddr >> 23) & 0x7ff) * sizeof(pmd_t)));
+                pmd_val(pmd_ent) = load_phys32(pmd_phys);
+                if (pmd_none(pmd_ent)) {
+                        pte_phys = early_alloc_phys(BASE_PAGE_SIZE);
 
-        /*
-         * The obp translations are saved based on 8k pagesize, since obp can
-         * use a mixture of pagesizes. Misses to the 0xf0000000 - 0x100000000,
-         * ie obp range, are handled in entry.S and do not use the vpte scheme
-         * (see rant in inherit_locked_prom_mappings()).
-         */
-#define OBP_PMD_SIZE 2048
-        prompmd = __alloc_bootmem(OBP_PMD_SIZE, OBP_PMD_SIZE, bootmap_base);
-        if (prompmd == NULL)
-                early_pgtable_allocfail("pmd");
-        memset(prompmd, 0, OBP_PMD_SIZE);
-        for (i = 0; i < n; i++) {
-                unsigned long vaddr;
-
-                if (trans[i].virt >= LOW_OBP_ADDRESS && trans[i].virt < HI_OBP_ADDRESS) {
-                        for (vaddr = trans[i].virt;
-                             ((vaddr < trans[i].virt + trans[i].size) && 
-                             (vaddr < HI_OBP_ADDRESS));
-                             vaddr += BASE_PAGE_SIZE) {
-                                unsigned long val;
-
-                                pmdp = prompmd + ((vaddr >> 23) & 0x7ff);
-                                if (pmd_none(*pmdp)) {
-                                        ptep = __alloc_bootmem(BASE_PAGE_SIZE,
-                                                               BASE_PAGE_SIZE,
-                                                               bootmap_base);
-                                        if (ptep == NULL)
-                                                early_pgtable_allocfail("pte");
-                                        memset(ptep, 0, BASE_PAGE_SIZE);
-                                        pmd_set(pmdp, ptep);
-                                }
-                                ptep = (pte_t *)__pmd_page(*pmdp) +
-                                                ((vaddr >> 13) & 0x3ff);
+                        for (i = 0; i < BASE_PAGE_SIZE / sizeof(pte_t); i++)
+                                store_phys64(pte_phys+i*sizeof(pte_t),0);
 
-                                val = trans[i].data;
+                        pmd_val(pmd_ent) = pte_phys >> 11UL;
+                        store_phys32(pmd_phys, pmd_val(pmd_ent));
+                }
 
-                                /* Clear diag TTE bits. */
-                                if (tlb_type == spitfire)
-                                        val &= ~0x0003fe0000000000UL;
+                pte_phys = (unsigned long)pmd_val(pmd_ent) << 11UL;
+                pte_phys += (((vaddr >> 13) & 0x3ff) * sizeof(pte_t));
 
-                                set_pte_at(&init_mm, vaddr,
-                                           ptep, __pte(val | _PAGE_MODIFIED));
-                                trans[i].data += BASE_PAGE_SIZE;
-                        }
-                }
-        }
-        phys_page = __pa(prompmd);
-        obp_iaddr_patch[0] |= (phys_page >> 10);
-        obp_iaddr_patch[1] |= (phys_page & 0x3ff);
-        flushi((long)&obp_iaddr_patch[0]);
-        obp_daddr_patch[0] |= (phys_page >> 10);
-        obp_daddr_patch[1] |= (phys_page & 0x3ff);
-        flushi((long)&obp_daddr_patch[0]);
+                val = data;
 
-        /* Now fixup OBP's idea about where we really are mapped. */
-        prom_printf("Remapping the kernel... ");
+                /* Clear diag TTE bits. */
+                if (tlb_type == spitfire)
+                        val &= ~0x0003fe0000000000UL;
 
-        /* Spitfire Errata #32 workaround */
-        /* NOTE: Using plain zero for the context value is
-         *       correct here, we are not using the Linux trap
-         *       tables yet so we should not use the special
-         *       UltraSPARC-III+ page size encodings yet.
-         */
-        __asm__ __volatile__("stxa      %0, [%1] %2\n\t"
-                             "flush     %%g6"
-                             : /* No outputs */
-                             : "r" (0), "r" (PRIMARY_CONTEXT), "i" (ASI_DMMU));
-
-        switch (tlb_type) {
-        default:
-        case spitfire:
-                phys_page = spitfire_get_dtlb_data(sparc64_highest_locked_tlbent());
-                break;
-
-        case cheetah:
-        case cheetah_plus:
-                phys_page = cheetah_get_litlb_data(sparc64_highest_locked_tlbent());
-                break;
-        };
-
-        phys_page &= _PAGE_PADDR;
-        phys_page += ((unsigned long)&prom_boot_page -
-                      (unsigned long)KERNBASE);
+                store_phys64(pte_phys, val | _PAGE_MODIFIED);
 
-        if (tlb_type == spitfire) {
-                /* Lock this into i/d tlb entry 59 */
-                __asm__ __volatile__(
-                        "stxa   %%g0, [%2] %3\n\t"
-                        "stxa   %0, [%1] %4\n\t"
-                        "membar #Sync\n\t"
-                        "flush  %%g6\n\t"
-                        "stxa   %%g0, [%2] %5\n\t"
-                        "stxa   %0, [%1] %6\n\t"
-                        "membar #Sync\n\t"
-                        "flush  %%g6"
-                        : : "r" (phys_page | _PAGE_VALID | _PAGE_SZ8K | _PAGE_CP |
-                                 _PAGE_CV | _PAGE_P | _PAGE_L | _PAGE_W),
-                        "r" (59 << 3), "r" (TLB_TAG_ACCESS),
-                        "i" (ASI_DMMU), "i" (ASI_DTLB_DATA_ACCESS),
-                        "i" (ASI_IMMU), "i" (ASI_ITLB_DATA_ACCESS)
-                        : "memory");
-        } else if (tlb_type == cheetah || tlb_type == cheetah_plus) {
-                /* Lock this into i/d tlb-0 entry 11 */
-                __asm__ __volatile__(
-                        "stxa   %%g0, [%2] %3\n\t"
-                        "stxa   %0, [%1] %4\n\t"
-                        "membar #Sync\n\t"
-                        "flush  %%g6\n\t"
-                        "stxa   %%g0, [%2] %5\n\t"
-                        "stxa   %0, [%1] %6\n\t"
-                        "membar #Sync\n\t"
-                        "flush  %%g6"
-                        : : "r" (phys_page | _PAGE_VALID | _PAGE_SZ8K | _PAGE_CP |
-                                 _PAGE_CV | _PAGE_P | _PAGE_L | _PAGE_W),
-                        "r" ((0 << 16) | (11 << 3)), "r" (TLB_TAG_ACCESS),
-                        "i" (ASI_DMMU), "i" (ASI_DTLB_DATA_ACCESS),
-                        "i" (ASI_IMMU), "i" (ASI_ITLB_DATA_ACCESS)
-                        : "memory");
-        } else {
-                /* Implement me :-) */
-                BUG();
+                data += BASE_PAGE_SIZE;
         }
+}
 
-        tte_vaddr = (unsigned long) KERNBASE;
+static inline int in_obp_range(unsigned long vaddr)
+{
+        return (vaddr >= LOW_OBP_ADDRESS &&
+                vaddr < HI_OBP_ADDRESS);
+}
 
-        /* Spitfire Errata #32 workaround */
-        /* NOTE: Using plain zero for the context value is
-         *       correct here, we are not using the Linux trap
-         *       tables yet so we should not use the special
-         *       UltraSPARC-III+ page size encodings yet.
-         */
-        __asm__ __volatile__("stxa      %0, [%1] %2\n\t"
-                             "flush     %%g6"
-                             : /* No outputs */
-                             : "r" (0),
-                             "r" (PRIMARY_CONTEXT), "i" (ASI_DMMU));
-
-        if (tlb_type == spitfire)
-                tte_data = spitfire_get_dtlb_data(sparc64_highest_locked_tlbent());
-        else
-                tte_data = cheetah_get_ldtlb_data(sparc64_highest_locked_tlbent());
+#define OBP_PMD_SIZE 2048
+static void __init build_obp_pgtable(int prom_trans_ents)
+{
+        unsigned long i;
 
-        kern_locked_tte_data = tte_data;
+        prom_pmd_phys = early_alloc_phys(OBP_PMD_SIZE);
+        for (i = 0; i < OBP_PMD_SIZE; i += 4)
+                store_phys32(prom_pmd_phys + i, 0);
 
-        remap_func = (void *)  ((unsigned long) &prom_remap -
-                                (unsigned long) &prom_boot_page);
+        for (i = 0; i < prom_trans_ents; i++) {
+                unsigned long start, end;
 
+                if (!in_obp_range(prom_trans[i].virt))
+                        continue;
 
-        /* Spitfire Errata #32 workaround */
-        /* NOTE: Using plain zero for the context value is
-         *       correct here, we are not using the Linux trap
-         *       tables yet so we should not use the special
-         *       UltraSPARC-III+ page size encodings yet.
-         */
-        __asm__ __volatile__("stxa      %0, [%1] %2\n\t"
-                             "flush     %%g6"
-                             : /* No outputs */
-                             : "r" (0),
-                             "r" (PRIMARY_CONTEXT), "i" (ASI_DMMU));
-
-        remap_func((tlb_type == spitfire ?
-                    (spitfire_get_dtlb_data(sparc64_highest_locked_tlbent()) & _PAGE_PADDR) :
-                    (cheetah_get_litlb_data(sparc64_highest_locked_tlbent()) & _PAGE_PADDR)),
-                   (unsigned long) KERNBASE,
-                   prom_get_mmu_ihandle());
-
-        if (bigkernel)
-                remap_func(((tte_data + 0x400000) & _PAGE_PADDR),
-                        (unsigned long) KERNBASE + 0x400000, prom_get_mmu_ihandle());
-
-        /* Flush out that temporary mapping. */
-        spitfire_flush_dtlb_nucleus_page(0x0);
-        spitfire_flush_itlb_nucleus_page(0x0);
-
-        /* Now lock us back into the TLBs via OBP. */
-        prom_dtlb_load(sparc64_highest_locked_tlbent(), tte_data, tte_vaddr);
-        prom_itlb_load(sparc64_highest_locked_tlbent(), tte_data, tte_vaddr);
-        if (bigkernel) {
-                prom_dtlb_load(sparc64_highest_locked_tlbent()-1, tte_data + 0x400000, 
-                                                                tte_vaddr + 0x400000);
-                prom_itlb_load(sparc64_highest_locked_tlbent()-1, tte_data + 0x400000, 
-                                                                tte_vaddr + 0x400000);
+                start = prom_trans[i].virt;
+                end = start + prom_trans[i].size;
+                if (end > HI_OBP_ADDRESS)
+                        end = HI_OBP_ADDRESS;
+
+                build_obp_range(start, end, prom_trans[i].data);
         }
+}
+
+/* Read OBP translations property into 'prom_trans[]'.
+ * Return the number of entries.
+ */
+static int __init read_obp_translations(void)
+{
+        int n, node;
 
-        /* Re-read translations property. */
-        if ((n = prom_getproperty(node, "translations", (char *)trans, tsz)) == -1) {
-                prom_printf("Couldn't get translation property\n");
+        node = prom_finddevice("/virtual-memory");
+        n = prom_getproplen(node, "translations");
+        if (unlikely(n == 0 || n == -1)) {
+                prom_printf("prom_mappings: Couldn't get size.\n");
+                prom_halt();
+        }
+        if (unlikely(n > sizeof(prom_trans))) {
+                prom_printf("prom_mappings: Size %Zd is too big.\n", n);
                 prom_halt();
         }
-        n = n / sizeof(*trans);
 
-        for (i = 0; i < n; i++) {
-                unsigned long vaddr = trans[i].virt;
-                unsigned long size = trans[i].size;
+        if ((n = prom_getproperty(node, "translations",
+                                  (char *)&prom_trans[0],
+                                  sizeof(prom_trans))) == -1) {
+                prom_printf("prom_mappings: Couldn't get property.\n");
+                prom_halt();
+        }
+        n = n / sizeof(struct linux_prom_translation);
+        return n;
+}
 
-                if (vaddr < 0xf0000000UL) {
-                        unsigned long avoid_start = (unsigned long) KERNBASE;
-                        unsigned long avoid_end = avoid_start + (4 * 1024 * 1024);
+static void __init remap_kernel(void)
+{
+        unsigned long phys_page, tte_vaddr, tte_data;
+        int tlb_ent = sparc64_highest_locked_tlbent();
 
-                        if (bigkernel)
-                                avoid_end += (4 * 1024 * 1024);
-                        if (vaddr < avoid_start) {
-                                unsigned long top = vaddr + size;
+        tte_vaddr = (unsigned long) KERNBASE;
+        phys_page = (prom_boot_mapping_phys_low >> 22UL) << 22UL;
+        tte_data = (phys_page | (_PAGE_VALID | _PAGE_SZ4MB |
+                                 _PAGE_CP | _PAGE_CV | _PAGE_P |
+                                 _PAGE_L | _PAGE_W));
 
-                                if (top > avoid_start)
-                                        top = avoid_start;
-                                prom_unmap(top - vaddr, vaddr);
-                        }
-                        if ((vaddr + size) > avoid_end) {
-                                unsigned long bottom = vaddr;
+        kern_locked_tte_data = tte_data;
 
-                                if (bottom < avoid_end)
-                                        bottom = avoid_end;
-                                prom_unmap((vaddr + size) - bottom, bottom);
-                        }
-                }
+        /* Now lock us into the TLBs via OBP. */
+        prom_dtlb_load(tlb_ent, tte_data, tte_vaddr);
+        prom_itlb_load(tlb_ent, tte_data, tte_vaddr);
+        if (bigkernel) {
+                prom_dtlb_load(tlb_ent - 1,
+                               tte_data + 0x400000, 
+                               tte_vaddr + 0x400000);
+                prom_itlb_load(tlb_ent - 1,
+                               tte_data + 0x400000, 
+                               tte_vaddr + 0x400000);
         }
+}
+
+static void __init inherit_prom_mappings(void)
+{
+        int n;
+
+        n = read_obp_translations();
+        build_obp_pgtable(n);
+
+        /* Now fixup OBP's idea about where we really are mapped. */
+        prom_printf("Remapping the kernel... ");
+        remap_kernel();
 
         prom_printf("done.\n");
 
@@ -1276,14 +1272,14 @@ unsigned long __init bootmem_init(unsigned long *pages_avail)
         int i;
 
 #ifdef CONFIG_DEBUG_BOOTMEM
-        prom_printf("bootmem_init: Scan sp_banks, ");
+        prom_printf("bootmem_init: Scan pavail, ");
 #endif
 
         bytes_avail = 0UL;
-        for (i = 0; sp_banks[i].num_bytes != 0; i++) {
-                end_of_phys_memory = sp_banks[i].base_addr +
-                        sp_banks[i].num_bytes;
-                bytes_avail += sp_banks[i].num_bytes;
+        for (i = 0; i < pavail_ents; i++) {
+                end_of_phys_memory = pavail[i].phys_addr +
+                        pavail[i].reg_size;
+                bytes_avail += pavail[i].reg_size;
                 if (cmdline_memory_size) {
                         if (bytes_avail > cmdline_memory_size) {
                                 unsigned long slack = bytes_avail - cmdline_memory_size;
@@ -1291,12 +1287,15 @@ unsigned long __init bootmem_init(unsigned long *pages_avail)
                                 bytes_avail -= slack;
                                 end_of_phys_memory -= slack;
 
-                                sp_banks[i].num_bytes -= slack;
-                                if (sp_banks[i].num_bytes == 0) {
-                                        sp_banks[i].base_addr = 0xdeadbeef;
+                                pavail[i].reg_size -= slack;
+                                if ((long)pavail[i].reg_size <= 0L) {
+                                        pavail[i].phys_addr = 0xdeadbeefUL;
+                                        pavail[i].reg_size = 0UL;
+                                        pavail_ents = i;
                                 } else {
-                                        sp_banks[i+1].num_bytes = 0;
-                                        sp_banks[i+1].base_addr = 0xdeadbeef;
+                                        pavail[i+1].reg_size = 0Ul;
+                                        pavail[i+1].phys_addr = 0xdeadbeefUL;
+                                        pavail_ents = i + 1;
                                 }
                                 break;
                         }
@@ -1347,17 +1346,15 @@ unsigned long __init bootmem_init(unsigned long *pages_avail)
 #endif
         bootmap_size = init_bootmem_node(NODE_DATA(0), bootmap_pfn, pfn_base, end_pfn);
 
-        bootmap_base = bootmap_pfn << PAGE_SHIFT;
-
         /* Now register the available physical memory with the
          * allocator.
          */
-        for (i = 0; sp_banks[i].num_bytes != 0; i++) {
+        for (i = 0; i < pavail_ents; i++) {
 #ifdef CONFIG_DEBUG_BOOTMEM
-                prom_printf("free_bootmem(sp_banks:%d): base[%lx] size[%lx]\n",
-                            i, sp_banks[i].base_addr, sp_banks[i].num_bytes);
+                prom_printf("free_bootmem(pavail:%d): base[%lx] size[%lx]\n",
+                            i, pavail[i].phys_addr, pavail[i].reg_size);
 #endif
-                free_bootmem(sp_banks[i].base_addr, sp_banks[i].num_bytes);
+                free_bootmem(pavail[i].phys_addr, pavail[i].reg_size);
         }
 
 #ifdef CONFIG_BLK_DEV_INITRD
@@ -1398,120 +1395,167 @@ unsigned long __init bootmem_init(unsigned long *pages_avail)
         return end_pfn;
 }
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+static unsigned long kernel_map_range(unsigned long pstart, unsigned long pend, pgprot_t prot)
+{
+        unsigned long vstart = PAGE_OFFSET + pstart;
+        unsigned long vend = PAGE_OFFSET + pend;
+        unsigned long alloc_bytes = 0UL;
+
+        if ((vstart & ~PAGE_MASK) || (vend & ~PAGE_MASK)) {
+                prom_printf("kernel_map: Unaligned physmem[%lx:%lx]\n",
+                            vstart, vend);
+                prom_halt();
+        }
+
+        while (vstart < vend) {
+                unsigned long this_end, paddr = __pa(vstart);
+                pgd_t *pgd = pgd_offset_k(vstart);
+                pud_t *pud;
+                pmd_t *pmd;
+                pte_t *pte;
+
+                pud = pud_offset(pgd, vstart);
+                if (pud_none(*pud)) {
+                        pmd_t *new;
+
+                        new = __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE);
+                        alloc_bytes += PAGE_SIZE;
+                        pud_populate(&init_mm, pud, new);
+                }
+
+                pmd = pmd_offset(pud, vstart);
+                if (!pmd_present(*pmd)) {
+                        pte_t *new;
+
+                        new = __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE);
+                        alloc_bytes += PAGE_SIZE;
+                        pmd_populate_kernel(&init_mm, pmd, new);
+                }
+
+                pte = pte_offset_kernel(pmd, vstart);
+                this_end = (vstart + PMD_SIZE) & PMD_MASK;
+                if (this_end > vend)
+                        this_end = vend;
+
+                while (vstart < this_end) {
+                        pte_val(*pte) = (paddr | pgprot_val(prot));
+
+                        vstart += PAGE_SIZE;
+                        paddr += PAGE_SIZE;
+                        pte++;
+                }
+        }
+
+        return alloc_bytes;
+}
+
+static struct linux_prom64_registers pall[MAX_BANKS] __initdata;
+static int pall_ents __initdata;
+
+extern unsigned int kvmap_linear_patch[1];
+
+static void __init kernel_physical_mapping_init(void)
+{
+        unsigned long i, mem_alloced = 0UL;
+
+        read_obp_memory("reg", &pall[0], &pall_ents);
+
+        for (i = 0; i < pall_ents; i++) {
+                unsigned long phys_start, phys_end;
+
+                phys_start = pall[i].phys_addr;
+                phys_end = phys_start + pall[i].reg_size;
+                mem_alloced += kernel_map_range(phys_start, phys_end,
+                                                PAGE_KERNEL);
+        }
+
+        printk("Allocated %ld bytes for kernel page tables.\n",
+               mem_alloced);
+
+        kvmap_linear_patch[0] = 0x01000000; /* nop */
+        flushi(&kvmap_linear_patch[0]);
+
+        __flush_tlb_all();
+}
+
+void kernel_map_pages(struct page *page, int numpages, int enable)
+{
+        unsigned long phys_start = page_to_pfn(page) << PAGE_SHIFT;
+        unsigned long phys_end = phys_start + (numpages * PAGE_SIZE);
+
+        kernel_map_range(phys_start, phys_end,
+                         (enable ? PAGE_KERNEL : __pgprot(0)));
+
+        /* we should perform an IPI and flush all tlbs,
+         * but that can deadlock->flush only current cpu.
+         */
+        __flush_tlb_kernel_range(PAGE_OFFSET + phys_start,
+                                 PAGE_OFFSET + phys_end);
+}
+#endif
+
+unsigned long __init find_ecache_flush_span(unsigned long size)
+{
+        int i;
+
+        for (i = 0; i < pavail_ents; i++) {
+                if (pavail[i].reg_size >= size)
+                        return pavail[i].phys_addr;
+        }
+
+        return ~0UL;
+}
+
 /* paging_init() sets up the page tables */
 
 extern void cheetah_ecache_flush_init(void);
 
 static unsigned long last_valid_pfn;
+pgd_t swapper_pg_dir[2048];
 
 void __init paging_init(void)
 {
-        extern pmd_t swapper_pmd_dir[1024];
-        extern unsigned int sparc64_vpte_patchme1[1];
-        extern unsigned int sparc64_vpte_patchme2[1];
-        unsigned long alias_base = kern_base + PAGE_OFFSET;
-        unsigned long second_alias_page = 0;
-        unsigned long pt, flags, end_pfn, pages_avail;
-        unsigned long shift = alias_base - ((unsigned long)KERNBASE);
-        unsigned long real_end;
+        unsigned long end_pfn, pages_avail, shift;
+        unsigned long real_end, i;
+
+        /* Find available physical memory... */
+        read_obp_memory("available", &pavail[0], &pavail_ents);
+
+        phys_base = 0xffffffffffffffffUL;
+        for (i = 0; i < pavail_ents; i++)
+                phys_base = min(phys_base, pavail[i].phys_addr);
+
+        pfn_base = phys_base >> PAGE_SHIFT;
+
+        kern_base = (prom_boot_mapping_phys_low >> 22UL) << 22UL;
+        kern_size = (unsigned long)&_end - (unsigned long)KERNBASE;
 
         set_bit(0, mmu_context_bmap);
 
+        shift = kern_base + PAGE_OFFSET - ((unsigned long)KERNBASE);
+
         real_end = (unsigned long)_end;
         if ((real_end > ((unsigned long)KERNBASE + 0x400000)))
                 bigkernel = 1;
-#ifdef CONFIG_BLK_DEV_INITRD
-        if (sparc_ramdisk_image || sparc_ramdisk_image64)
-                real_end = (PAGE_ALIGN(real_end) + PAGE_ALIGN(sparc_ramdisk_size));
-#endif
-
-        /* We assume physical memory starts at some 4mb multiple,
-         * if this were not true we wouldn't boot up to this point
-         * anyways.
-         */
-        pt  = kern_base | _PAGE_VALID | _PAGE_SZ4MB;
-        pt |= _PAGE_CP | _PAGE_CV | _PAGE_P | _PAGE_L | _PAGE_W;
-        local_irq_save(flags);
-        if (tlb_type == spitfire) {
-                __asm__ __volatile__(
-        "       stxa    %1, [%0] %3\n"
-        "       stxa    %2, [%5] %4\n"
-        "       membar  #Sync\n"
-        "       flush   %%g6\n"
-        "       nop\n"
-        "       nop\n"
-        "       nop\n"
-                : /* No outputs */
-                : "r" (TLB_TAG_ACCESS), "r" (alias_base), "r" (pt),
-                  "i" (ASI_DMMU), "i" (ASI_DTLB_DATA_ACCESS), "r" (61 << 3)
-                : "memory");
-                if (real_end >= KERNBASE + 0x340000) {
-                        second_alias_page = alias_base + 0x400000;
-                        __asm__ __volatile__(
-                "       stxa    %1, [%0] %3\n"
-                "       stxa    %2, [%5] %4\n"
-                "       membar  #Sync\n"
-                "       flush   %%g6\n"
-                "       nop\n"
-                "       nop\n"
-                "       nop\n"
-                        : /* No outputs */
-                        : "r" (TLB_TAG_ACCESS), "r" (second_alias_page), "r" (pt + 0x400000),
-                          "i" (ASI_DMMU), "i" (ASI_DTLB_DATA_ACCESS), "r" (60 << 3)
-                        : "memory");
-                }
-        } else if (tlb_type == cheetah || tlb_type == cheetah_plus) {
-                __asm__ __volatile__(
-        "       stxa    %1, [%0] %3\n"
-        "       stxa    %2, [%5] %4\n"
-        "       membar  #Sync\n"
-        "       flush   %%g6\n"
-        "       nop\n"
-        "       nop\n"
-        "       nop\n"
-                : /* No outputs */
-                : "r" (TLB_TAG_ACCESS), "r" (alias_base), "r" (pt),
-                  "i" (ASI_DMMU), "i" (ASI_DTLB_DATA_ACCESS), "r" ((0<<16) | (13<<3))
-                : "memory");
-                if (real_end >= KERNBASE + 0x340000) {
-                        second_alias_page = alias_base + 0x400000;
-                        __asm__ __volatile__(
-                "       stxa    %1, [%0] %3\n"
-                "       stxa    %2, [%5] %4\n"
-                "       membar  #Sync\n"
-                "       flush   %%g6\n"
-                "       nop\n"
-                "       nop\n"
-                "       nop\n"
-                        : /* No outputs */
-                        : "r" (TLB_TAG_ACCESS), "r" (second_alias_page), "r" (pt + 0x400000),
-                          "i" (ASI_DMMU), "i" (ASI_DTLB_DATA_ACCESS), "r" ((0<<16) | (12<<3))
-                        : "memory");
-                }
+        if ((real_end > ((unsigned long)KERNBASE + 0x800000))) {
+                prom_printf("paging_init: Kernel > 8MB, too large.\n");
+                prom_halt();
         }
-        local_irq_restore(flags);
-        
-        /* Now set kernel pgd to upper alias so physical page computations
+
+        /* Set kernel pgd to upper alias so physical page computations
          * work.
          */
         init_mm.pgd += ((shift) / (sizeof(pgd_t)));
         
-        memset(swapper_pmd_dir, 0, sizeof(swapper_pmd_dir));
+        memset(swapper_low_pmd_dir, 0, sizeof(swapper_low_pmd_dir));
 
         /* Now can init the kernel/bad page tables. */
         pud_set(pud_offset(&swapper_pg_dir[0], 0),
-                swapper_pmd_dir + (shift / sizeof(pgd_t)));
+                swapper_low_pmd_dir + (shift / sizeof(pgd_t)));
         
-        sparc64_vpte_patchme1[0] |=
-                (((unsigned long)pgd_val(init_mm.pgd[0])) >> 10);
-        sparc64_vpte_patchme2[0] |=
-                (((unsigned long)pgd_val(init_mm.pgd[0])) & 0x3ff);
-        flushi((long)&sparc64_vpte_patchme1[0]);
+        swapper_pgd_zero = pgd_val(swapper_pg_dir[0]);
         
-        /* Setup bootmem... */
-        pages_avail = 0;
-        last_valid_pfn = end_pfn = bootmem_init(&pages_avail);
-
         /* Inherit non-locked OBP mappings. */
         inherit_prom_mappings();
         
@@ -1527,13 +1571,16 @@ void __init paging_init(void)
 
         inherit_locked_prom_mappings(1);
 
-        /* We only created DTLB mapping of this stuff. */
-        spitfire_flush_dtlb_nucleus_page(alias_base);
-        if (second_alias_page)
-                spitfire_flush_dtlb_nucleus_page(second_alias_page);
-
         __flush_tlb_all();
 
+        /* Setup bootmem... */
+        pages_avail = 0;
+        last_valid_pfn = end_pfn = bootmem_init(&pages_avail);
+
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        kernel_physical_mapping_init();
+#endif
+
         {
                 unsigned long zones_size[MAX_NR_ZONES];
                 unsigned long zholes_size[MAX_NR_ZONES];
@@ -1554,128 +1601,35 @@ void __init paging_init(void)
         device_scan();
 }
 
-/* Ok, it seems that the prom can allocate some more memory chunks
- * as a side effect of some prom calls we perform during the
- * boot sequence.  My most likely theory is that it is from the
- * prom_set_traptable() call, and OBP is allocating a scratchpad
- * for saving client program register state etc.
- */
-static void __init sort_memlist(struct linux_mlist_p1275 *thislist)
-{
-        int swapi = 0;
-        int i, mitr;
-        unsigned long tmpaddr, tmpsize;
-        unsigned long lowest;
-
-        for (i = 0; thislist[i].theres_more != 0; i++) {
-                lowest = thislist[i].start_adr;
-                for (mitr = i+1; thislist[mitr-1].theres_more != 0; mitr++)
-                        if (thislist[mitr].start_adr < lowest) {
-                                lowest = thislist[mitr].start_adr;
-                                swapi = mitr;
-                        }
-                if (lowest == thislist[i].start_adr)
-                        continue;
-                tmpaddr = thislist[swapi].start_adr;
-                tmpsize = thislist[swapi].num_bytes;
-                for (mitr = swapi; mitr > i; mitr--) {
-                        thislist[mitr].start_adr = thislist[mitr-1].start_adr;
-                        thislist[mitr].num_bytes = thislist[mitr-1].num_bytes;
-                }
-                thislist[i].start_adr = tmpaddr;
-                thislist[i].num_bytes = tmpsize;
-        }
-}
-
-void __init rescan_sp_banks(void)
-{
-        struct linux_prom64_registers memlist[64];
-        struct linux_mlist_p1275 avail[64], *mlist;
-        unsigned long bytes, base_paddr;
-        int num_regs, node = prom_finddevice("/memory");
-        int i;
-
-        num_regs = prom_getproperty(node, "available",
-                                    (char *) memlist, sizeof(memlist));
-        num_regs = (num_regs / sizeof(struct linux_prom64_registers));
-        for (i = 0; i < num_regs; i++) {
-                avail[i].start_adr = memlist[i].phys_addr;
-                avail[i].num_bytes = memlist[i].reg_size;
-                avail[i].theres_more = &avail[i + 1];
-        }
-        avail[i - 1].theres_more = NULL;
-        sort_memlist(avail);
-
-        mlist = &avail[0];
-        i = 0;
-        bytes = mlist->num_bytes;
-        base_paddr = mlist->start_adr;
-  
-        sp_banks[0].base_addr = base_paddr;
-        sp_banks[0].num_bytes = bytes;
-
-        while (mlist->theres_more != NULL){
-                i++;
-                mlist = mlist->theres_more;
-                bytes = mlist->num_bytes;
-                if (i >= SPARC_PHYS_BANKS-1) {
-                        printk ("The machine has more banks than "
-                                "this kernel can support\n"
-                                "Increase the SPARC_PHYS_BANKS "
-                                "setting (currently %d)\n",
-                                SPARC_PHYS_BANKS);
-                        i = SPARC_PHYS_BANKS-1;
-                        break;
-                }
-    
-                sp_banks[i].base_addr = mlist->start_adr;
-                sp_banks[i].num_bytes = mlist->num_bytes;
-        }
-
-        i++;
-        sp_banks[i].base_addr = 0xdeadbeefbeefdeadUL;
-        sp_banks[i].num_bytes = 0;
-
-        for (i = 0; sp_banks[i].num_bytes != 0; i++)
-                sp_banks[i].num_bytes &= PAGE_MASK;
-}
-
 static void __init taint_real_pages(void)
 {
-        struct sparc_phys_banks saved_sp_banks[SPARC_PHYS_BANKS];
         int i;
 
-        for (i = 0; i < SPARC_PHYS_BANKS; i++) {
-                saved_sp_banks[i].base_addr =
-                        sp_banks[i].base_addr;
-                saved_sp_banks[i].num_bytes =
-                        sp_banks[i].num_bytes;
-        }
-
-        rescan_sp_banks();
+        read_obp_memory("available", &pavail_rescan[0], &pavail_rescan_ents);
 
-        /* Find changes discovered in the sp_bank rescan and
+        /* Find changes discovered in the physmem available rescan and
          * reserve the lost portions in the bootmem maps.
          */
-        for (i = 0; saved_sp_banks[i].num_bytes; i++) {
+        for (i = 0; i < pavail_ents; i++) {
                 unsigned long old_start, old_end;
 
-                old_start = saved_sp_banks[i].base_addr;
+                old_start = pavail[i].phys_addr;
                 old_end = old_start +
-                        saved_sp_banks[i].num_bytes;
+                        pavail[i].reg_size;
                 while (old_start < old_end) {
                         int n;
 
-                        for (n = 0; sp_banks[n].num_bytes; n++) {
+                        for (n = 0; pavail_rescan_ents; n++) {
                                 unsigned long new_start, new_end;
 
-                                new_start = sp_banks[n].base_addr;
-                                new_end = new_start + sp_banks[n].num_bytes;
+                                new_start = pavail_rescan[n].phys_addr;
+                                new_end = new_start +
+                                        pavail_rescan[n].reg_size;
 
                                 if (new_start <= old_start &&
                                     new_end >= (old_start + PAGE_SIZE)) {
-                                        set_bit (old_start >> 22,
-                                                 sparc64_valid_addr_bitmap);
+                                        set_bit(old_start >> 22,
+                                                sparc64_valid_addr_bitmap);
                                         goto do_next_page;
                                 }
                         }
@@ -1695,8 +1649,7 @@ void __init mem_init(void)
 
         i = last_valid_pfn >> ((22 - PAGE_SHIFT) + 6);
         i += 1;
-        sparc64_valid_addr_bitmap = (unsigned long *)
-                __alloc_bootmem(i << 3, SMP_CACHE_BYTES, bootmap_base);
+        sparc64_valid_addr_bitmap = (unsigned long *) alloc_bootmem(i << 3);
         if (sparc64_valid_addr_bitmap == NULL) {
                 prom_printf("mem_init: Cannot alloc valid_addr_bitmap.\n");
                 prom_halt();
@@ -1749,7 +1702,7 @@ void __init mem_init(void)
                 cheetah_ecache_flush_init();
 }
 
-void free_initmem (void)
+void free_initmem(void)
 {
         unsigned long addr, initend;
 
diff --git a/arch/sparc64/mm/ultra.S b/arch/sparc64/mm/ultra.S
index b2ee9b53227f..058b8126c1a7 100644
--- a/arch/sparc64/mm/ultra.S
+++ b/arch/sparc64/mm/ultra.S
@@ -144,42 +144,29 @@ __flush_icache_page:	/* %o0 = phys_page */
 
 #define DTAG_MASK 0x3
 
+        /* This routine is Spitfire specific so the hardcoded
+         * D-cache size and line-size are OK.
+         */
         .align          64
         .globl          __flush_dcache_page
 __flush_dcache_page:    /* %o0=kaddr, %o1=flush_icache */
         sethi           %uhi(PAGE_OFFSET), %g1
         sllx            %g1, 32, %g1
-        sub             %o0, %g1, %o0
-        clr             %o4
-        srlx            %o0, 11, %o0
-        sethi           %hi(1 << 14), %o2
-1:      ldxa            [%o4] ASI_DCACHE_TAG, %o3       ! LSU   Group
-        add             %o4, (1 << 5), %o4              ! IEU0
-        ldxa            [%o4] ASI_DCACHE_TAG, %g1       ! LSU   Group
-        add             %o4, (1 << 5), %o4              ! IEU0
-        ldxa            [%o4] ASI_DCACHE_TAG, %g2       ! LSU   Group   o3 available
-        add             %o4, (1 << 5), %o4              ! IEU0
-        andn            %o3, DTAG_MASK, %o3             ! IEU1
-        ldxa            [%o4] ASI_DCACHE_TAG, %g3       ! LSU   Group
-        add             %o4, (1 << 5), %o4              ! IEU0
-        andn            %g1, DTAG_MASK, %g1             ! IEU1
-        cmp             %o0, %o3                        ! IEU1  Group
-        be,a,pn         %xcc, dflush1                   ! CTI
-         sub            %o4, (4 << 5), %o4              ! IEU0  (Group)
-        cmp             %o0, %g1                        ! IEU1  Group
-        andn            %g2, DTAG_MASK, %g2             ! IEU0
-        be,a,pn         %xcc, dflush2                   ! CTI
-         sub            %o4, (3 << 5), %o4              ! IEU0  (Group)
-        cmp             %o0, %g2                        ! IEU1  Group
-        andn            %g3, DTAG_MASK, %g3             ! IEU0
-        be,a,pn         %xcc, dflush3                   ! CTI
-         sub            %o4, (2 << 5), %o4              ! IEU0  (Group)
-        cmp             %o0, %g3                        ! IEU1  Group
-        be,a,pn         %xcc, dflush4                   ! CTI
-         sub            %o4, (1 << 5), %o4              ! IEU0
-2:      cmp             %o4, %o2                        ! IEU1  Group
-        bne,pt          %xcc, 1b                        ! CTI
-         nop                                            ! IEU0
+        sub             %o0, %g1, %o0                   ! physical address
+        srlx            %o0, 11, %o0                    ! make D-cache TAG
+        sethi           %hi(1 << 14), %o2               ! D-cache size
+        sub             %o2, (1 << 5), %o2              ! D-cache line size
+1:      ldxa            [%o2] ASI_DCACHE_TAG, %o3       ! load D-cache TAG
+        andcc           %o3, DTAG_MASK, %g0             ! Valid?
+        be,pn           %xcc, 2f                        ! Nope, branch
+         andn           %o3, DTAG_MASK, %o3             ! Clear valid bits
+        cmp             %o3, %o0                        ! TAG match?
+        bne,pt          %xcc, 2f                        ! Nope, branch
+         nop
+        stxa            %g0, [%o2] ASI_DCACHE_TAG       ! Invalidate TAG
+        membar          #Sync
+2:      brnz,pt         %o2, 1b
+         sub            %o2, (1 << 5), %o2              ! D-cache line size
 
         /* The I-cache does not snoop local stores so we
          * better flush that too when necessary.
@@ -189,48 +176,9 @@ __flush_dcache_page:	/* %o0=kaddr, %o1=flush_icache */
         retl
          nop
 
-dflush1:stxa            %g0, [%o4] ASI_DCACHE_TAG
-        add             %o4, (1 << 5), %o4
-dflush2:stxa            %g0, [%o4] ASI_DCACHE_TAG
-        add             %o4, (1 << 5), %o4
-dflush3:stxa            %g0, [%o4] ASI_DCACHE_TAG
-        add             %o4, (1 << 5), %o4
-dflush4:stxa            %g0, [%o4] ASI_DCACHE_TAG
-        add             %o4, (1 << 5), %o4
-        membar          #Sync
-        ba,pt           %xcc, 2b
-         nop
 #endif /* DCACHE_ALIASING_POSSIBLE */
 
-        .previous .text
-        .align          32
-__prefill_dtlb:
-        rdpr            %pstate, %g7
-        wrpr            %g7, PSTATE_IE, %pstate
-        mov             TLB_TAG_ACCESS, %g1
-        stxa            %o5, [%g1] ASI_DMMU
-        stxa            %o2, [%g0] ASI_DTLB_DATA_IN
-        flush           %g6
-        retl
-         wrpr           %g7, %pstate
-__prefill_itlb:
-        rdpr            %pstate, %g7
-        wrpr            %g7, PSTATE_IE, %pstate
-        mov             TLB_TAG_ACCESS, %g1
-        stxa            %o5, [%g1] ASI_IMMU
-        stxa            %o2, [%g0] ASI_ITLB_DATA_IN
-        flush           %g6
-        retl
-         wrpr           %g7, %pstate
-
-        .globl          __update_mmu_cache
-__update_mmu_cache:     /* %o0=hw_context, %o1=address, %o2=pte, %o3=fault_code */
-        srlx            %o1, PAGE_SHIFT, %o1
-        andcc           %o3, FAULT_CODE_DTLB, %g0
-        sllx            %o1, PAGE_SHIFT, %o5
-        bne,pt          %xcc, __prefill_dtlb
-         or             %o5, %o0, %o5
-        ba,a,pt         %xcc, __prefill_itlb
+        .previous
 
         /* Cheetah specific versions, patched at boot time. */
 __cheetah_flush_tlb_mm: /* 18 insns */
@@ -283,7 +231,7 @@ __cheetah_flush_tlb_pending:	/* 26 insns */
          wrpr           %g7, 0x0, %pstate
 
 #ifdef DCACHE_ALIASING_POSSIBLE
-flush_dcpage_cheetah: /* 11 insns */
+__cheetah_flush_dcache_page: /* 11 insns */
         sethi           %uhi(PAGE_OFFSET), %g1
         sllx            %g1, 32, %g1
         sub             %o0, %g1, %o0
@@ -329,8 +277,8 @@ cheetah_patch_cachetlbops:
 #ifdef DCACHE_ALIASING_POSSIBLE
         sethi           %hi(__flush_dcache_page), %o0
         or              %o0, %lo(__flush_dcache_page), %o0
-        sethi           %hi(flush_dcpage_cheetah), %o1
-        or              %o1, %lo(flush_dcpage_cheetah), %o1
+        sethi           %hi(__cheetah_flush_dcache_page), %o1
+        or              %o1, %lo(__cheetah_flush_dcache_page), %o1
         call            cheetah_patch_one
          mov            11, %o2
 #endif /* DCACHE_ALIASING_POSSIBLE */
diff --git a/arch/sparc64/prom/Makefile b/arch/sparc64/prom/Makefile
index 8f2420d9e9e6..3d33ed27bc27 100644
--- a/arch/sparc64/prom/Makefile
+++ b/arch/sparc64/prom/Makefile
@@ -6,5 +6,5 @@
 EXTRA_AFLAGS := -ansi
 EXTRA_CFLAGS := -Werror
 
-lib-y   := bootstr.o devops.o init.o memory.o misc.o \
-           tree.o console.o printf.o p1275.o map.o cif.o
+lib-y   := bootstr.o devops.o init.o misc.o \
+           tree.o console.o printf.o p1275.o cif.o
diff --git a/arch/sparc64/prom/console.c b/arch/sparc64/prom/console.c
index 028a53fcb1ec..eae5db8dda56 100644
--- a/arch/sparc64/prom/console.c
+++ b/arch/sparc64/prom/console.c
@@ -67,7 +67,7 @@ prom_putchar(char c)
 }
 
 void
-prom_puts(char *s, int len)
+prom_puts(const char *s, int len)
 {
         p1275_cmd("write", P1275_ARG(1,P1275_ARG_IN_BUF)|
                            P1275_INOUT(3,1),
diff --git a/arch/sparc64/prom/devops.c b/arch/sparc64/prom/devops.c
index 2c99b21b6981..4641839eb39a 100644
--- a/arch/sparc64/prom/devops.c
+++ b/arch/sparc64/prom/devops.c
@@ -16,7 +16,7 @@
  * Returns 0 on failure.
  */
 int
-prom_devopen(char *dstr)
+prom_devopen(const char *dstr)
 {
         return p1275_cmd ("open", P1275_ARG(0,P1275_ARG_IN_STRING)|
                                   P1275_INOUT(1,1),
diff --git a/arch/sparc64/prom/init.c b/arch/sparc64/prom/init.c
index 817faae058cd..f3cc2d8578b2 100644
--- a/arch/sparc64/prom/init.c
+++ b/arch/sparc64/prom/init.c
@@ -27,7 +27,6 @@ int prom_chosen_node;
  * failure.  It gets passed the pointer to the PROM vector.
  */
 
-extern void prom_meminit(void);
 extern void prom_cif_init(void *, void *);
 
 void __init prom_init(void *cif_handler, void *cif_stack)
@@ -46,7 +45,7 @@ void __init prom_init(void *cif_handler, void *cif_stack)
         if((prom_root_node == 0) || (prom_root_node == -1))
                 prom_halt();
 
-        prom_chosen_node = prom_finddevice("/chosen");
+        prom_chosen_node = prom_finddevice(prom_chosen_path);
         if (!prom_chosen_node || prom_chosen_node == -1)
                 prom_halt();
 
@@ -90,8 +89,6 @@ void __init prom_init(void *cif_handler, void *cif_stack)
 
         printk ("PROMLIB: Sun IEEE Boot Prom %s\n", buffer + bufadjust);
 
-        prom_meminit();
-
         /* Initialization successful. */
         return;
 
diff --git a/arch/sparc64/prom/map.S b/arch/sparc64/prom/map.S
deleted file mode 100644
index 21b3f9c99ea7..000000000000
--- a/arch/sparc64/prom/map.S
+++ /dev/null
@@ -1,72 +0,0 @@
-/* $Id: map.S,v 1.2 1999/11/19 05:53:02 davem Exp $
- * map.S: Tricky coding required to fixup the kernel OBP maps
- *        properly.
- *
- * Copyright (C) 1999 David S. Miller (davem@redhat.com)
- */
-
-        .text
-        .align  8192
-        .globl  prom_boot_page
-prom_boot_page:
-call_method:
-        .asciz  "call-method"
-        .align  8
-map:
-        .asciz  "map"
-        .align  8
-
-        /* When we are invoked, our caller has remapped us to
-         * page zero, therefore we must use PC relative addressing
-         * for everything after we begin performing the unmap/map
-         * calls.
-         */
-        .globl  prom_remap
-prom_remap:     /* %o0 = physpage, %o1 = virtpage, %o2 = mmu_ihandle */
-        rd      %pc, %g1
-        srl     %o2, 0, %o2                     ! kill sign extension
-        sethi   %hi(p1275buf), %g2
-        or      %g2, %lo(p1275buf), %g2
-        ldx     [%g2 + 0x10], %g3               ! prom_cif_stack
-        save    %g3, -(192 + 128), %sp
-        ldx     [%g2 + 0x08], %l0               ! prom_cif_handler
-        mov     %g6, %i3
-        mov     %g4, %i4
-        mov     %g5, %i5
-        flushw
-
-        sethi   %hi(prom_remap - call_method), %g7
-        or      %g7, %lo(prom_remap - call_method), %g7
-        sub     %g1, %g7, %l2                   ! call-method string
-        sethi   %hi(prom_remap - map), %g7
-        or      %g7, %lo(prom_remap - map), %g7
-        sub     %g1, %g7, %l4                   ! map string
-
-        /* OK, map the 4MB region we really live at. */
-        stx     %l2, [%sp + 2047 + 128 + 0x00]  ! call-method
-        mov     7, %l5
-        stx     %l5, [%sp + 2047 + 128 + 0x08]  ! num_args
-        mov     1, %l5
-        stx     %l5, [%sp + 2047 + 128 + 0x10]  ! num_rets
-        stx     %l4, [%sp + 2047 + 128 + 0x18]  ! map
-        stx     %i2, [%sp + 2047 + 128 + 0x20]  ! mmu_ihandle
-        mov     -1, %l5
-        stx     %l5, [%sp + 2047 + 128 + 0x28]  ! mode == default
-        sethi   %hi(4 * 1024 * 1024), %l5
-        stx     %l5, [%sp + 2047 + 128 + 0x30]  ! size
-        stx     %i1, [%sp + 2047 + 128 + 0x38]  ! vaddr
-        stx     %g0, [%sp + 2047 + 128 + 0x40]  ! filler
-        stx     %i0, [%sp + 2047 + 128 + 0x48]  ! paddr
-        call    %l0
-         add    %sp, (2047 + 128), %o0          ! argument array
-
-        /* Restore hard-coded globals. */
-        mov     %i3, %g6
-        mov     %i4, %g4
-        mov     %i5, %g5
-
-        /* Wheee.... we are done. */
-        ret
-        restore
-
-        .align  8192
diff --git a/arch/sparc64/prom/memory.c b/arch/sparc64/prom/memory.c
deleted file mode 100644
index f4a8143e052c..000000000000
--- a/arch/sparc64/prom/memory.c
+++ /dev/null
@@ -1,152 +0,0 @@
-/* $Id: memory.c,v 1.5 1999/08/31 06:55:04 davem Exp $
- * memory.c: Prom routine for acquiring various bits of information
- *           about RAM on the machine, both virtual and physical.
- *
- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
- * Copyright (C) 1997 Jakub Jelinek (jj@sunsite.mff.cuni.cz)
- */
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-
-#include <asm/openprom.h>
-#include <asm/oplib.h>
-
-/* This routine, for consistency, returns the ram parameters in the
- * V0 prom memory descriptor format.  I choose this format because I
- * think it was the easiest to work with.  I feel the religious
- * arguments now... ;)  Also, I return the linked lists sorted to
- * prevent paging_init() upset stomach as I have not yet written
- * the pepto-bismol kernel module yet.
- */
-
-struct linux_prom64_registers prom_reg_memlist[64];
-struct linux_prom64_registers prom_reg_tmp[64];
-
-struct linux_mlist_p1275 prom_phys_total[64];
-struct linux_mlist_p1275 prom_prom_taken[64];
-struct linux_mlist_p1275 prom_phys_avail[64];
-
-struct linux_mlist_p1275 *prom_ptot_ptr = prom_phys_total;
-struct linux_mlist_p1275 *prom_ptak_ptr = prom_prom_taken;
-struct linux_mlist_p1275 *prom_pavl_ptr = prom_phys_avail;
-
-struct linux_mem_p1275 prom_memlist;
-
-
-/* Internal Prom library routine to sort a linux_mlist_p1275 memory
- * list.  Used below in initialization.
- */
-static void __init
-prom_sortmemlist(struct linux_mlist_p1275 *thislist)
-{
-        int swapi = 0;
-        int i, mitr;
-        unsigned long tmpaddr, tmpsize;
-        unsigned long lowest;
-
-        for(i=0; thislist[i].theres_more; i++) {
-                lowest = thislist[i].start_adr;
-                for(mitr = i+1; thislist[mitr-1].theres_more; mitr++)
-                        if(thislist[mitr].start_adr < lowest) {
-                                lowest = thislist[mitr].start_adr;
-                                swapi = mitr;
-                        }
-                if(lowest == thislist[i].start_adr) continue;
-                tmpaddr = thislist[swapi].start_adr;
-                tmpsize = thislist[swapi].num_bytes;
-                for(mitr = swapi; mitr > i; mitr--) {
-                        thislist[mitr].start_adr = thislist[mitr-1].start_adr;
-                        thislist[mitr].num_bytes = thislist[mitr-1].num_bytes;
-                }
-                thislist[i].start_adr = tmpaddr;
-                thislist[i].num_bytes = tmpsize;
-        }
-}
-
-/* Initialize the memory lists based upon the prom version. */
-void __init prom_meminit(void)
-{
-        int node = 0;
-        unsigned int iter, num_regs;
-
-        node = prom_finddevice("/memory");
-        num_regs = prom_getproperty(node, "available",
-                                    (char *) prom_reg_memlist,
-                                    sizeof(prom_reg_memlist));
-        num_regs = (num_regs/sizeof(struct linux_prom64_registers));
-        for(iter=0; iter<num_regs; iter++) {
-                prom_phys_avail[iter].start_adr =
-                        prom_reg_memlist[iter].phys_addr;
-                prom_phys_avail[iter].num_bytes =
-                        prom_reg_memlist[iter].reg_size;
-                prom_phys_avail[iter].theres_more =
-                        &prom_phys_avail[iter+1];
-        }
-        prom_phys_avail[iter-1].theres_more = NULL;
-
-        num_regs = prom_getproperty(node, "reg",
-                                    (char *) prom_reg_memlist,
-                                    sizeof(prom_reg_memlist));
-        num_regs = (num_regs/sizeof(struct linux_prom64_registers));
-        for(iter=0; iter<num_regs; iter++) {
-                prom_phys_total[iter].start_adr =
-                        prom_reg_memlist[iter].phys_addr;
-                prom_phys_total[iter].num_bytes =
-                        prom_reg_memlist[iter].reg_size;
-                prom_phys_total[iter].theres_more =
-                        &prom_phys_total[iter+1];
-        }
-        prom_phys_total[iter-1].theres_more = NULL;
-
-        node = prom_finddevice("/virtual-memory");
-        num_regs = prom_getproperty(node, "available",
-                                    (char *) prom_reg_memlist,
-                                    sizeof(prom_reg_memlist));
-        num_regs = (num_regs/sizeof(struct linux_prom64_registers));
-
-        /* Convert available virtual areas to taken virtual
-         * areas.  First sort, then convert.
-         */
-        for(iter=0; iter<num_regs; iter++) {
-                prom_prom_taken[iter].start_adr =
-                        prom_reg_memlist[iter].phys_addr;
-                prom_prom_taken[iter].num_bytes =
-                        prom_reg_memlist[iter].reg_size;
-                prom_prom_taken[iter].theres_more =
-                        &prom_prom_taken[iter+1];
-        }
-        prom_prom_taken[iter-1].theres_more = NULL;
-
-        prom_sortmemlist(prom_prom_taken);
-
-        /* Finally, convert. */
-        for(iter=0; iter<num_regs; iter++) {
-                prom_prom_taken[iter].start_adr =
-                        prom_prom_taken[iter].start_adr +
-                        prom_prom_taken[iter].num_bytes;
-                prom_prom_taken[iter].num_bytes =
-                        prom_prom_taken[iter+1].start_adr -
-                        prom_prom_taken[iter].start_adr;
-        }
-        prom_prom_taken[iter-1].num_bytes =
-                -1UL - prom_prom_taken[iter-1].start_adr;
-
-        /* Sort the other two lists. */
-        prom_sortmemlist(prom_phys_total);
-        prom_sortmemlist(prom_phys_avail);
-
-        /* Link all the lists into the top-level descriptor. */
-        prom_memlist.p1275_totphys=&prom_ptot_ptr;
-        prom_memlist.p1275_prommap=&prom_ptak_ptr;
-        prom_memlist.p1275_available=&prom_pavl_ptr;
-}
-
-/* This returns a pointer to our libraries internal p1275 format
- * memory descriptor.
- */
-struct linux_mem_p1275 *
-prom_meminfo(void)
-{
-        return &prom_memlist;
-}
diff --git a/arch/sparc64/prom/misc.c b/arch/sparc64/prom/misc.c
index 19c44e97e9ee..9b895faf077b 100644
--- a/arch/sparc64/prom/misc.c
+++ b/arch/sparc64/prom/misc.c
@@ -17,14 +17,14 @@
 #include <asm/system.h>
 
 /* Reset and reboot the machine with the command 'bcommand'. */
-void prom_reboot(char *bcommand)
+void prom_reboot(const char *bcommand)
 {
         p1275_cmd("boot", P1275_ARG(0, P1275_ARG_IN_STRING) |
                   P1275_INOUT(1, 0), bcommand);
 }
 
 /* Forth evaluate the expression contained in 'fstring'. */
-void prom_feval(char *fstring)
+void prom_feval(const char *fstring)
 {
         if (!fstring || fstring[0] == 0)
                 return;
@@ -148,21 +148,19 @@ void prom_set_trap_table(unsigned long tba)
         p1275_cmd("SUNW,set-trap-table", P1275_INOUT(1, 0), tba);
 }
 
-int mmu_ihandle_cache = 0;
-
 int prom_get_mmu_ihandle(void)
 {
         int node, ret;
 
-        if (mmu_ihandle_cache != 0)
-                return mmu_ihandle_cache;
+        if (prom_mmu_ihandle_cache != 0)
+                return prom_mmu_ihandle_cache;
 
-        node = prom_finddevice("/chosen");
-        ret = prom_getint(node, "mmu");
+        node = prom_finddevice(prom_chosen_path);
+        ret = prom_getint(node, prom_mmu_name);
         if (ret == -1 || ret == 0)
-                mmu_ihandle_cache = -1;
+                prom_mmu_ihandle_cache = -1;
         else
-                mmu_ihandle_cache = ret;
+                prom_mmu_ihandle_cache = ret;
 
         return ret;
 }
@@ -190,7 +188,7 @@ long prom_itlb_load(unsigned long index,
                     unsigned long tte_data,
                     unsigned long vaddr)
 {
-        return p1275_cmd("call-method",
+        return p1275_cmd(prom_callmethod_name,
                          (P1275_ARG(0, P1275_ARG_IN_STRING) |
                           P1275_ARG(2, P1275_ARG_IN_64B) |
                           P1275_ARG(3, P1275_ARG_IN_64B) |
@@ -207,7 +205,7 @@ long prom_dtlb_load(unsigned long index,
                     unsigned long tte_data,
                     unsigned long vaddr)
 {
-        return p1275_cmd("call-method",
+        return p1275_cmd(prom_callmethod_name,
                          (P1275_ARG(0, P1275_ARG_IN_STRING) |
                           P1275_ARG(2, P1275_ARG_IN_64B) |
                           P1275_ARG(3, P1275_ARG_IN_64B) |
@@ -223,13 +221,13 @@ long prom_dtlb_load(unsigned long index,
 int prom_map(int mode, unsigned long size,
              unsigned long vaddr, unsigned long paddr)
 {
-        int ret = p1275_cmd("call-method",
+        int ret = p1275_cmd(prom_callmethod_name,
                             (P1275_ARG(0, P1275_ARG_IN_STRING) |
                              P1275_ARG(3, P1275_ARG_IN_64B) |
                              P1275_ARG(4, P1275_ARG_IN_64B) |
                              P1275_ARG(6, P1275_ARG_IN_64B) |
                              P1275_INOUT(7, 1)),
-                            "map",
+                            prom_map_name,
                             prom_get_mmu_ihandle(),
                             mode,
                             size,
@@ -244,12 +242,12 @@ int prom_map(int mode, unsigned long size,
 
 void prom_unmap(unsigned long size, unsigned long vaddr)
 {
-        p1275_cmd("call-method",
+        p1275_cmd(prom_callmethod_name,
                   (P1275_ARG(0, P1275_ARG_IN_STRING) |
                    P1275_ARG(2, P1275_ARG_IN_64B) |
                    P1275_ARG(3, P1275_ARG_IN_64B) |
                    P1275_INOUT(4, 0)),
-                  "unmap",
+                  prom_unmap_name,
                   prom_get_mmu_ihandle(),
                   size,
                   vaddr);
@@ -258,7 +256,7 @@ void prom_unmap(unsigned long size, unsigned long vaddr)
 /* Set aside physical memory which is not touched or modified
  * across soft resets.
  */
-unsigned long prom_retain(char *name,
+unsigned long prom_retain(const char *name,
                           unsigned long pa_low, unsigned long pa_high,
                           long size, long align)
 {
@@ -290,7 +288,7 @@ int prom_getunumber(int syndrome_code,
                     unsigned long phys_addr,
                     char *buf, int buflen)
 {
-        return p1275_cmd("call-method",
+        return p1275_cmd(prom_callmethod_name,
                          (P1275_ARG(0, P1275_ARG_IN_STRING)     |
                           P1275_ARG(3, P1275_ARG_OUT_BUF)       |
                           P1275_ARG(6, P1275_ARG_IN_64B)        |
diff --git a/arch/sparc64/prom/p1275.c b/arch/sparc64/prom/p1275.c
index 59fe38bba39e..a5a7c5712028 100644
--- a/arch/sparc64/prom/p1275.c
+++ b/arch/sparc64/prom/p1275.c
@@ -46,7 +46,7 @@ static inline unsigned long spitfire_get_primary_context(void)
  */
 DEFINE_SPINLOCK(prom_entry_lock);
 
-long p1275_cmd (char *service, long fmt, ...)
+long p1275_cmd(const char *service, long fmt, ...)
 {
         char *p, *q;
         unsigned long flags;
diff --git a/arch/sparc64/prom/printf.c b/arch/sparc64/prom/printf.c
index a6df82cafa0d..660943ee4c2a 100644
--- a/arch/sparc64/prom/printf.c
+++ b/arch/sparc64/prom/printf.c
@@ -34,7 +34,7 @@ prom_write(const char *buf, unsigned int n)
 }
 
 void
-prom_printf(char *fmt, ...)
+prom_printf(const char *fmt, ...)
 {
         va_list args;
         int i;
diff --git a/arch/sparc64/prom/tree.c b/arch/sparc64/prom/tree.c
index ccf73258ebf7..b1ff9e87dcc6 100644
--- a/arch/sparc64/prom/tree.c
+++ b/arch/sparc64/prom/tree.c
@@ -69,7 +69,7 @@ prom_getsibling(int node)
  * Return -1 on error.
  */
 __inline__ int
-prom_getproplen(int node, char *prop)
+prom_getproplen(int node, const char *prop)
 {
         if((!node) || (!prop)) return -1;
         return p1275_cmd ("getproplen", 
@@ -83,20 +83,20 @@ prom_getproplen(int node, char *prop)
  * was successful the length will be returned, else -1 is returned.
  */
 __inline__ int
-prom_getproperty(int node, char *prop, char *buffer, int bufsize)
+prom_getproperty(int node, const char *prop, char *buffer, int bufsize)
 {
         int plen;
 
         plen = prom_getproplen(node, prop);
-        if((plen > bufsize) || (plen == 0) || (plen == -1))
+        if ((plen > bufsize) || (plen == 0) || (plen == -1)) {
                 return -1;
-        else {
+        } else {
                 /* Ok, things seem all right. */
-                return p1275_cmd ("getprop", 
-                                  P1275_ARG(1,P1275_ARG_IN_STRING)|
-                                  P1275_ARG(2,P1275_ARG_OUT_BUF)|
-                                  P1275_INOUT(4, 1), 
-                                  node, prop, buffer, P1275_SIZE(plen));
+                return p1275_cmd(prom_getprop_name, 
+                                 P1275_ARG(1,P1275_ARG_IN_STRING)|
+                                 P1275_ARG(2,P1275_ARG_OUT_BUF)|
+                                 P1275_INOUT(4, 1), 
+                                 node, prop, buffer, P1275_SIZE(plen));
         }
 }
 
@@ -104,7 +104,7 @@ prom_getproperty(int node, char *prop, char *buffer, int bufsize)
  * on failure.
  */
 __inline__ int
-prom_getint(int node, char *prop)
+prom_getint(int node, const char *prop)
 {
         int intprop;
 
@@ -119,7 +119,7 @@ prom_getint(int node, char *prop)
  */
 
 int
-prom_getintdefault(int node, char *property, int deflt)
+prom_getintdefault(int node, const char *property, int deflt)
 {
         int retval;
 
@@ -131,7 +131,7 @@ prom_getintdefault(int node, char *property, int deflt)
 
 /* Acquire a boolean property, 1=TRUE 0=FALSE. */
 int
-prom_getbool(int node, char *prop)
+prom_getbool(int node, const char *prop)
 {
         int retval;
 
@@ -145,7 +145,7 @@ prom_getbool(int node, char *prop)
  * buffer.
  */
 void
-prom_getstring(int node, char *prop, char *user_buf, int ubuf_size)
+prom_getstring(int node, const char *prop, char *user_buf, int ubuf_size)
 {
         int len;
 
@@ -160,7 +160,7 @@ prom_getstring(int node, char *prop, char *user_buf, int ubuf_size)
  * YES = 1   NO = 0
  */
 int
-prom_nodematch(int node, char *name)
+prom_nodematch(int node, const char *name)
 {
         char namebuf[128];
         prom_getproperty(node, "name", namebuf, sizeof(namebuf));
@@ -172,7 +172,7 @@ prom_nodematch(int node, char *name)
  * 'nodename'.  Return node if successful, zero if not.
  */
 int
-prom_searchsiblings(int node_start, char *nodename)
+prom_searchsiblings(int node_start, const char *nodename)
 {
 
         int thisnode, error;
@@ -294,7 +294,7 @@ prom_firstprop(int node, char *buffer)
  * property types for this node.
  */
 __inline__ char *
-prom_nextprop(int node, char *oprop, char *buffer)
+prom_nextprop(int node, const char *oprop, char *buffer)
 {
         char buf[32];
 
@@ -314,15 +314,17 @@ prom_nextprop(int node, char *oprop, char *buffer)
 }
 
 int
-prom_finddevice(char *name)
+prom_finddevice(const char *name)
 {
-        if(!name) return 0;
-        return p1275_cmd ("finddevice", P1275_ARG(0,P1275_ARG_IN_STRING)|
-                                        P1275_INOUT(1, 1), 
-                                        name);
+        if (!name)
+                return 0;
+        return p1275_cmd(prom_finddev_name,
+                         P1275_ARG(0,P1275_ARG_IN_STRING)|
+                         P1275_INOUT(1, 1), 
+                         name);
 }
 
-int prom_node_has_property(int node, char *prop)
+int prom_node_has_property(int node, const char *prop)
 {
         char buf [32];
         
@@ -339,7 +341,7 @@ int prom_node_has_property(int node, char *prop)
  * of 'size' bytes.  Return the number of bytes the prom accepted.
  */
 int
-prom_setprop(int node, char *pname, char *value, int size)
+prom_setprop(int node, const char *pname, char *value, int size)
 {
         if(size == 0) return 0;
         if((pname == 0) || (value == 0)) return 0;
@@ -364,7 +366,7 @@ prom_inst2pkg(int inst)
  * FIXME: Should work for v0 as well
  */
 int
-prom_pathtoinode(char *path)
+prom_pathtoinode(const char *path)
 {
         int node, inst;
 
diff --git a/arch/um/Kconfig.i386 b/arch/um/Kconfig.i386
index 8ad156a00499..5d92cacd56c6 100644
--- a/arch/um/Kconfig.i386
+++ b/arch/um/Kconfig.i386
@@ -42,3 +42,7 @@ config ARCH_HAS_SC_SIGNALS
 config ARCH_REUSE_HOST_VSYSCALL_AREA
         bool
         default y
+
+config X86_CMPXCHG
+        bool
+        default y
diff --git a/arch/um/Makefile b/arch/um/Makefile
index ce987266dac6..7af37e342e33 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -28,8 +28,6 @@ SYMLINK_HEADERS := $(foreach header,$(SYMLINK_HEADERS),include/asm-um/$(header))
 ARCH_SYMLINKS = include/asm-um/arch $(ARCH_DIR)/include/sysdep $(ARCH_DIR)/os \
         $(SYMLINK_HEADERS) $(ARCH_DIR)/include/uml-config.h
 
-GEN_HEADERS += $(ARCH_DIR)/include/task.h $(ARCH_DIR)/include/kern_constants.h
-
 um-modes-$(CONFIG_MODE_TT) += tt
 um-modes-$(CONFIG_MODE_SKAS) += skas
 
@@ -45,17 +43,19 @@ endif
 
 ARCH_INCLUDE    := -I$(ARCH_DIR)/include
 ifneq ($(KBUILD_SRC),)
-ARCH_INCLUDE    += -I$(ARCH_DIR)/include2
 ARCH_INCLUDE    += -I$(srctree)/$(ARCH_DIR)/include
-MRPROPER_DIRS   += $(ARCH_DIR)/include2
 endif
 SYS_DIR         := $(ARCH_DIR)/include/sysdep-$(SUBARCH)
 
 # -Dvmap=kernel_vmap affects everything, and prevents anything from
 # referencing the libpcap.o symbol so named.
+#
+# Same things for in6addr_loopback - found in libc.
 
 CFLAGS += $(CFLAGS-y) -D__arch_um__ -DSUBARCH=\"$(SUBARCH)\" \
-        $(ARCH_INCLUDE) $(MODE_INCLUDE) -Dvmap=kernel_vmap
+        $(ARCH_INCLUDE) $(MODE_INCLUDE) -Dvmap=kernel_vmap \
+        -Din6addr_loopback=kernel_in6addr_loopback
+
 AFLAGS += $(ARCH_INCLUDE)
 
 USER_CFLAGS := $(patsubst -I%,,$(CFLAGS))
@@ -83,10 +83,6 @@ CONFIG_KERNEL_HALF_GIGS ?= 0
 
 SIZE = (($(CONFIG_NEST_LEVEL) + $(CONFIG_KERNEL_HALF_GIGS)) * 0x20000000)
 
-ifeq ($(CONFIG_MODE_SKAS), y)
-$(SYS_HEADERS) : $(ARCH_DIR)/include/skas_ptregs.h
-endif
-
 .PHONY: linux
 
 all: linux
@@ -107,7 +103,8 @@ else
 $(shell cd $(ARCH_DIR) && ln -sf Kconfig.$(SUBARCH) Kconfig.arch)
 endif
 
-archprepare: $(ARCH_SYMLINKS) $(SYS_HEADERS) $(GEN_HEADERS)
+archprepare: $(ARCH_SYMLINKS) $(ARCH_DIR)/include/user_constants.h
+prepare: $(ARCH_DIR)/include/kern_constants.h
 
 LINK-$(CONFIG_LD_SCRIPT_STATIC) += -static
 LINK-$(CONFIG_LD_SCRIPT_DYN) += -Wl,-rpath,/lib
@@ -142,15 +139,13 @@ endef
 #When cleaning we don't include .config, so we don't include
 #TT or skas makefiles and don't clean skas_ptregs.h.
 CLEAN_FILES += linux x.i gmon.out $(ARCH_DIR)/include/uml-config.h \
-        $(GEN_HEADERS) $(ARCH_DIR)/include/skas_ptregs.h \
-        $(ARCH_DIR)/include/user_constants.h $(ARCH_DIR)/Kconfig.arch
+        $(ARCH_DIR)/include/user_constants.h \
+        $(ARCH_DIR)/include/kern_constants.h $(ARCH_DIR)/Kconfig.arch
 
 MRPROPER_FILES += $(SYMLINK_HEADERS) $(ARCH_SYMLINKS) \
         $(addprefix $(ARCH_DIR)/kernel/,$(KERN_SYMLINKS)) $(ARCH_DIR)/os
 
 archclean:
-        $(Q)$(MAKE) $(clean)=$(ARCH_DIR)/util
-        $(Q)$(MAKE) $(clean)=$(ARCH_DIR)/os-$(OS)/util
         @find . \( -name '*.bb' -o -name '*.bbg' -o -name '*.da' \
                 -o -name '*.gcov' \) -type f -print | xargs rm -f
 
@@ -176,9 +171,7 @@ $(ARCH_DIR)/include/sysdep:
         @echo '  SYMLINK $@'
 ifneq ($(KBUILD_SRC),)
         $(Q)mkdir -p $(ARCH_DIR)/include
-        $(Q)mkdir -p $(ARCH_DIR)/include2
-        $(Q)ln -fsn sysdep-$(SUBARCH) $(ARCH_DIR)/include/sysdep
-        $(Q)ln -fsn $(srctree)/$(ARCH_DIR)/include/sysdep-$(SUBARCH) $(ARCH_DIR)/include2/sysdep
+        $(Q)ln -fsn $(srctree)/$(ARCH_DIR)/include/sysdep-$(SUBARCH) $(ARCH_DIR)/include/sysdep
 else
         $(Q)cd $(ARCH_DIR)/include && ln -sf sysdep-$(SUBARCH) sysdep
 endif
@@ -198,8 +191,6 @@ endef
 
 define filechk_gen-asm-offsets
         (set -e; \
-         echo "#ifndef __ASM_OFFSETS_H__"; \
-         echo "#define __ASM_OFFSETS_H__"; \
          echo "/*"; \
          echo " * DO NOT MODIFY."; \
          echo " *"; \
@@ -208,8 +199,7 @@ define filechk_gen-asm-offsets
          echo " */"; \
          echo ""; \
          sed -ne "/^->/{s:^->\([^ ]*\) [\$$#]*\([^ ]*\) \(.*\):#define \1 \2 /* \3 */:; s:->::; p;}"; \
-         echo ""; \
-         echo "#endif" )
+         echo ""; )
 endef
 
 $(ARCH_DIR)/include/uml-config.h : include/linux/autoconf.h
@@ -218,50 +208,18 @@ $(ARCH_DIR)/include/uml-config.h : include/linux/autoconf.h
 $(ARCH_DIR)/user-offsets.s: $(ARCH_DIR)/sys-$(SUBARCH)/user-offsets.c
         $(CC) $(USER_CFLAGS) -S -o $@ $<
 
-$(ARCH_DIR)/user-offsets.h: $(ARCH_DIR)/user-offsets.s
+$(ARCH_DIR)/include/user_constants.h: $(ARCH_DIR)/user-offsets.s
         $(call filechk,gen-asm-offsets)
 
-CLEAN_FILES += $(ARCH_DIR)/user-offsets.s  $(ARCH_DIR)/user-offsets.h
+CLEAN_FILES += $(ARCH_DIR)/user-offsets.s
 
 $(ARCH_DIR)/kernel-offsets.s: $(ARCH_DIR)/sys-$(SUBARCH)/kernel-offsets.c \
-                                   $(ARCH_SYMLINKS) \
-                                   $(SYS_DIR)/sc.h \
-                                   include/asm include/linux/version.h \
-                                   include/config/MARKER \
-                                   $(ARCH_DIR)/include/user_constants.h
+                                   archprepare
         $(CC) $(CFLAGS) $(NOSTDINC_FLAGS) $(CPPFLAGS) -S -o $@ $<
 
-$(ARCH_DIR)/kernel-offsets.h: $(ARCH_DIR)/kernel-offsets.s
+$(ARCH_DIR)/include/kern_constants.h: $(ARCH_DIR)/kernel-offsets.s
         $(call filechk,gen-asm-offsets)
 
-CLEAN_FILES += $(ARCH_DIR)/kernel-offsets.s  $(ARCH_DIR)/kernel-offsets.h
-
-$(ARCH_DIR)/include/task.h: $(ARCH_DIR)/util/mk_task
-        $(call filechk,gen_header)
-
-$(ARCH_DIR)/include/user_constants.h: $(ARCH_DIR)/os-$(OS)/util/mk_user_constants
-        $(call filechk,gen_header)
-
-$(ARCH_DIR)/include/kern_constants.h: $(ARCH_DIR)/util/mk_constants
-        $(call filechk,gen_header)
-
-$(ARCH_DIR)/include/skas_ptregs.h: $(ARCH_DIR)/kernel/skas/util/mk_ptregs
-        $(call filechk,gen_header)
-
-$(ARCH_DIR)/os-$(OS)/util/mk_user_constants: $(ARCH_DIR)/os-$(OS)/util FORCE ;
-
-$(ARCH_DIR)/util/mk_task $(ARCH_DIR)/util/mk_constants: $(ARCH_DIR)/include/user_constants.h $(ARCH_DIR)/util \
-        FORCE ;
-
-$(ARCH_DIR)/kernel/skas/util/mk_ptregs: $(ARCH_DIR)/kernel/skas/util FORCE ;
-
-$(ARCH_DIR)/util: scripts_basic $(SYS_DIR)/sc.h $(ARCH_DIR)/kernel-offsets.h FORCE
-        $(Q)$(MAKE) $(build)=$@
-
-$(ARCH_DIR)/kernel/skas/util: scripts_basic $(ARCH_DIR)/user-offsets.h FORCE
-        $(Q)$(MAKE) $(build)=$@
-
-$(ARCH_DIR)/os-$(OS)/util: scripts_basic $(ARCH_DIR)/user-offsets.h FORCE
-        $(Q)$(MAKE) $(build)=$@
+CLEAN_FILES += $(ARCH_DIR)/kernel-offsets.s
 
 export SUBARCH USER_CFLAGS OS
diff --git a/arch/um/Makefile-i386 b/arch/um/Makefile-i386
index 1ab431a53ac3..2ee8a2858117 100644
--- a/arch/um/Makefile-i386
+++ b/arch/um/Makefile-i386
@@ -32,25 +32,3 @@ CFLAGS += -U__$(SUBARCH)__ -U$(SUBARCH)
 ifneq ($(CONFIG_GPROF),y)
 ARCH_CFLAGS += -DUM_FASTCALL
 endif
-
-SYS_UTIL_DIR    := $(ARCH_DIR)/sys-i386/util
-SYS_HEADERS     := $(SYS_DIR)/sc.h $(SYS_DIR)/thread.h
-
-prepare: $(SYS_HEADERS)
-
-$(SYS_DIR)/sc.h: $(SYS_UTIL_DIR)/mk_sc
-        $(call filechk,gen_header)
-
-$(SYS_DIR)/thread.h: $(SYS_UTIL_DIR)/mk_thread 
-        $(call filechk,gen_header)
-
-$(SYS_UTIL_DIR)/mk_sc: scripts_basic $(ARCH_DIR)/user-offsets.h FORCE
-        $(Q)$(MAKE) $(build)=$(SYS_UTIL_DIR) $@
-
-$(SYS_UTIL_DIR)/mk_thread: scripts_basic $(ARCH_DIR)/kernel-offsets.h FORCE
-        $(Q)$(MAKE) $(build)=$(SYS_UTIL_DIR) $@
-
-$(SYS_UTIL_DIR): scripts_basic include/asm FORCE
-        $(Q)$(MAKE) $(build)=$(SYS_UTIL_DIR)
-
-CLEAN_FILES += $(SYS_HEADERS)
diff --git a/arch/um/Makefile-skas b/arch/um/Makefile-skas
index fd18ec572271..ac35de5316a6 100644
--- a/arch/um/Makefile-skas
+++ b/arch/um/Makefile-skas
@@ -10,5 +10,3 @@ CFLAGS-$(CONFIG_GCOV) += $(GCOV_OPT)
 CFLAGS-$(CONFIG_GPROF) += $(GPROF_OPT)
 LINK-$(CONFIG_GCOV) += $(GCOV_OPT)
 LINK-$(CONFIG_GPROF) += $(GPROF_OPT)
-
-GEN_HEADERS += $(ARCH_DIR)/include/skas_ptregs.h
diff --git a/arch/um/Makefile-x86_64 b/arch/um/Makefile-x86_64
index 436abbba409b..4f118d5cc2ee 100644
--- a/arch/um/Makefile-x86_64
+++ b/arch/um/Makefile-x86_64
@@ -12,24 +12,3 @@ CHECKFLAGS  += -m64
 
 ELF_ARCH := i386:x86-64
 ELF_FORMAT := elf64-x86-64
-
-SYS_UTIL_DIR := $(ARCH_DIR)/sys-x86_64/util
-SYS_DIR := $(ARCH_DIR)/include/sysdep-x86_64
-
-SYS_HEADERS = $(SYS_DIR)/sc.h $(SYS_DIR)/thread.h
-
-prepare: $(SYS_HEADERS)
-
-$(SYS_DIR)/sc.h: $(SYS_UTIL_DIR)/mk_sc
-        $(call filechk,gen_header)
-
-$(SYS_DIR)/thread.h: $(SYS_UTIL_DIR)/mk_thread
-        $(call filechk,gen_header)
-
-$(SYS_UTIL_DIR)/mk_sc: scripts_basic $(ARCH_DIR)/user-offsets.h FORCE
-        $(Q)$(MAKE) $(build)=$(SYS_UTIL_DIR) $@
-
-$(SYS_UTIL_DIR)/mk_thread: scripts_basic $(GEN_HEADERS) $(ARCH_DIR)/kernel-offsets.h FORCE
-        $(Q)$(MAKE) $(build)=$(SYS_UTIL_DIR) $@
-
-CLEAN_FILES += $(SYS_HEADERS)
diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index 14a12d6b3df6..16e7dc89f61d 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -19,18 +19,44 @@
 #include "line.h"
 #include "os.h"
 
-#ifdef CONFIG_NOCONFIG_CHAN
+/* XXX: could well be moved to somewhere else, if needed. */
+static int my_printf(const char * fmt, ...)
+        __attribute__ ((format (printf, 1, 2)));
+
+static int my_printf(const char * fmt, ...)
+{
+        /* Yes, can be called on atomic context.*/
+        char *buf = kmalloc(4096, GFP_ATOMIC);
+        va_list args;
+        int r;
+
+        if (!buf) {
+                /* We print directly fmt.
+                 * Yes, yes, yes, feel free to complain. */
+                r = strlen(fmt);
+        } else {
+                va_start(args, fmt);
+                r = vsprintf(buf, fmt, args);
+                va_end(args);
+                fmt = buf;
+        }
 
-/* The printk's here are wrong because we are complaining that there is no
- * output device, but printk is printing to that output device.  The user will
- * never see the error.  printf would be better, except it can't run on a
- * kernel stack because it will overflow it.
- * Use printk for now since that will avoid crashing.
- */
+        if (r)
+                r = os_write_file(1, fmt, r);
+        return r;
+
+}
+
+#ifdef CONFIG_NOCONFIG_CHAN
+/* Despite its name, there's no added trailing newline. */
+static int my_puts(const char * buf)
+{
+        return os_write_file(1, buf, strlen(buf));
+}
 
 static void *not_configged_init(char *str, int device, struct chan_opts *opts)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        my_puts("Using a channel type which is configured out of "
                "UML\n");
         return(NULL);
 }
@@ -38,27 +64,27 @@ static void *not_configged_init(char *str, int device, struct chan_opts *opts)
 static int not_configged_open(int input, int output, int primary, void *data,
                               char **dev_out)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        my_puts("Using a channel type which is configured out of "
                "UML\n");
         return(-ENODEV);
 }
 
 static void not_configged_close(int fd, void *data)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        my_puts("Using a channel type which is configured out of "
                "UML\n");
 }
 
 static int not_configged_read(int fd, char *c_out, void *data)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        my_puts("Using a channel type which is configured out of "
                "UML\n");
         return(-EIO);
 }
 
 static int not_configged_write(int fd, const char *buf, int len, void *data)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        my_puts("Using a channel type which is configured out of "
                "UML\n");
         return(-EIO);
 }
@@ -66,7 +92,7 @@ static int not_configged_write(int fd, const char *buf, int len, void *data)
 static int not_configged_console_write(int fd, const char *buf, int len,
                                        void *data)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        my_puts("Using a channel type which is configured out of "
                "UML\n");
         return(-EIO);
 }
@@ -74,14 +100,14 @@ static int not_configged_console_write(int fd, const char *buf, int len,
 static int not_configged_window_size(int fd, void *data, unsigned short *rows,
                                      unsigned short *cols)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        my_puts("Using a channel type which is configured out of "
                "UML\n");
         return(-ENODEV);
 }
 
 static void not_configged_free(void *data)
 {
-        printf(KERN_ERR "Using a channel type which is configured out of "
+        my_puts("Using a channel type which is configured out of "
                "UML\n");
 }
 
@@ -457,7 +483,7 @@ static struct chan *parse_chan(char *str, int pri, int device,
                 }
         }
         if(ops == NULL){
-                printk(KERN_ERR "parse_chan couldn't parse \"%s\"\n", 
+                my_printf("parse_chan couldn't parse \"%s\"\n",
                        str);
                 return(NULL);
         }
@@ -465,7 +491,7 @@ static struct chan *parse_chan(char *str, int pri, int device,
         data = (*ops->init)(str, device, opts);
         if(data == NULL) return(NULL);
 
-        chan = kmalloc(sizeof(*chan), GFP_KERNEL);
+        chan = kmalloc(sizeof(*chan), GFP_ATOMIC);
         if(chan == NULL) return(NULL);
         *chan = ((struct chan) { .list          = LIST_HEAD_INIT(chan->list),
                                  .primary       = 1,
diff --git a/arch/um/drivers/mcast_user.c b/arch/um/drivers/mcast_user.c
index 7a0d115b29d0..5db136e2651c 100644
--- a/arch/um/drivers/mcast_user.c
+++ b/arch/um/drivers/mcast_user.c
@@ -13,7 +13,6 @@
 
 #include <errno.h>
 #include <unistd.h>
-#include <linux/inet.h>
 #include <sys/socket.h>
 #include <sys/un.h>
 #include <sys/time.h>
@@ -55,7 +54,7 @@ static int mcast_open(void *data)
         struct mcast_data *pri = data;
         struct sockaddr_in *sin = pri->mcast_addr;
         struct ip_mreq mreq;
-        int fd = -EINVAL, yes = 1, err = -EINVAL;;
+        int fd, yes = 1, err = 0;
 
 
         if ((sin->sin_addr.s_addr == 0) || (sin->sin_port == 0))
@@ -66,13 +65,14 @@ static int mcast_open(void *data)
         if (fd < 0){
                 printk("mcast_open : data socket failed, errno = %d\n", 
                        errno);
-                fd = -errno;
+                err = -errno;
                 goto out;
         }
 
         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)) < 0) {
                 printk("mcast_open: SO_REUSEADDR failed, errno = %d\n",
                         errno);
+                err = -errno;
                 goto out_close;
         }
 
@@ -81,6 +81,7 @@ static int mcast_open(void *data)
                        sizeof(pri->ttl)) < 0) {
                 printk("mcast_open: IP_MULTICAST_TTL failed, error = %d\n",
                         errno);
+                err = -errno;
                 goto out_close;
         }
 
@@ -88,12 +89,14 @@ static int mcast_open(void *data)
         if (setsockopt(fd, SOL_IP, IP_MULTICAST_LOOP, &yes, sizeof(yes)) < 0) {
                 printk("mcast_open: IP_MULTICAST_LOOP failed, error = %d\n",
                         errno);
+                err = -errno;
                 goto out_close;
         }
 
         /* bind socket to mcast address */
         if (bind(fd, (struct sockaddr *) sin, sizeof(*sin)) < 0) {
                 printk("mcast_open : data bind failed, errno = %d\n", errno);
+                err = -errno;
                 goto out_close;
         }               
         
@@ -108,14 +111,15 @@ static int mcast_open(void *data)
                        "interface on the host.\n");
                 printk("eth0 should be configured in order to use the "
                        "multicast transport.\n");
+                err = -errno;
                 goto out_close;
         }
 
- out:
         return fd;
 
  out_close:
         os_close_file(fd);
+ out:
         return err;
 }
 
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index c190c2414197..12c95368124a 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -32,6 +32,7 @@
 #include "os.h"
 #include "umid.h"
 #include "irq_kern.h"
+#include "choose-mode.h"
 
 static int do_unlink_socket(struct notifier_block *notifier, 
                             unsigned long what, void *data)
@@ -276,6 +277,7 @@ void mconsole_proc(struct mc_request *req)
     go - continue the UML after a 'stop' \n\
     log <string> - make UML enter <string> into the kernel log\n\
     proc <file> - returns the contents of the UML's /proc/<file>\n\
+    stack <pid> - returns the stack of the specified pid\n\
 "
 
 void mconsole_help(struct mc_request *req)
@@ -479,6 +481,56 @@ void mconsole_sysrq(struct mc_request *req)
 }
 #endif
 
+/* Mconsole stack trace
+ *  Added by Allan Graves, Jeff Dike
+ *  Dumps a stacks registers to the linux console.
+ *  Usage stack <pid>.
+ */
+void do_stack(struct mc_request *req)
+{
+        char *ptr = req->request.data;
+        int pid_requested= -1;
+        struct task_struct *from = NULL;
+        struct task_struct *to = NULL;
+
+        /* Would be nice:
+         * 1) Send showregs output to mconsole.
+         * 2) Add a way to stack dump all pids.
+         */
+
+        ptr += strlen("stack");
+        while(isspace(*ptr)) ptr++;
+
+        /* Should really check for multiple pids or reject bad args here */
+        /* What do the arguments in mconsole_reply mean? */
+        if(sscanf(ptr, "%d", &pid_requested) == 0){
+                mconsole_reply(req, "Please specify a pid", 1, 0);
+                return;
+        }
+
+        from = current;
+        to = find_task_by_pid(pid_requested);
+
+        if((to == NULL) || (pid_requested == 0)) {
+                mconsole_reply(req, "Couldn't find that pid", 1, 0);
+                return;
+        }
+        to->thread.saved_task = current;
+
+        switch_to(from, to, from);
+        mconsole_reply(req, "Stack Dumped to console and message log", 0, 0);
+}
+
+void mconsole_stack(struct mc_request *req)
+{
+        /* This command doesn't work in TT mode, so let's check and then
+         * get out of here
+         */
+        CHOOSE_MODE(mconsole_reply(req, "Sorry, this doesn't work in TT mode",
+                                   1, 0),
+                    do_stack(req));
+}
+
 /* Changed by mconsole_setup, which is __setup, and called before SMP is
  * active.
  */
diff --git a/arch/um/drivers/mconsole_user.c b/arch/um/drivers/mconsole_user.c
index fe5afb13252c..310c1f823f26 100644
--- a/arch/um/drivers/mconsole_user.c
+++ b/arch/um/drivers/mconsole_user.c
@@ -30,6 +30,7 @@ static struct mconsole_command commands[] = {
         { "go", mconsole_go, MCONSOLE_INTR },
         { "log", mconsole_log, MCONSOLE_INTR },
         { "proc", mconsole_proc, MCONSOLE_PROC },
+        { "stack", mconsole_stack, MCONSOLE_INTR },
 };
 
 /* Initialized in mconsole_init, which is an initcall */
@@ -172,9 +173,9 @@ int mconsole_notify(char *sock_name, int type, const void *data, int len)
         if(notify_sock < 0){
                 notify_sock = socket(PF_UNIX, SOCK_DGRAM, 0);
                 if(notify_sock < 0){
-                        printk("mconsole_notify - socket failed, errno = %d\n",
-                               errno);
                         err = -errno;
+                        printk("mconsole_notify - socket failed, errno = %d\n",
+                               err);
                 }
         }
         unlock_notify();
@@ -197,8 +198,8 @@ int mconsole_notify(char *sock_name, int type, const void *data, int len)
         n = sendto(notify_sock, &packet, len, 0, (struct sockaddr *) &target, 
                    sizeof(target));
         if(n < 0){
-                printk("mconsole_notify - sendto failed, errno = %d\n", errno);
                 err = -errno;
+                printk("mconsole_notify - sendto failed, errno = %d\n", errno);
         }
         return(err);
 }
diff --git a/arch/um/drivers/port_kern.c b/arch/um/drivers/port_kern.c
index c41efd207fcc..189839e4f1d4 100644
--- a/arch/um/drivers/port_kern.c
+++ b/arch/um/drivers/port_kern.c
@@ -7,7 +7,6 @@
 #include "linux/sched.h"
 #include "linux/slab.h"
 #include "linux/interrupt.h"
-#include "linux/irq.h"
 #include "linux/spinlock.h"
 #include "linux/errno.h"
 #include "asm/atomic.h"
diff --git a/arch/um/drivers/pty.c b/arch/um/drivers/pty.c
index ed84d01df6cc..0306a1b215b7 100644
--- a/arch/um/drivers/pty.c
+++ b/arch/um/drivers/pty.c
@@ -43,8 +43,9 @@ static int pts_open(int input, int output, int primary, void *d,
 
         fd = get_pty();
         if(fd < 0){
+                err = -errno;
                 printk("open_pts : Failed to open pts\n");
-                return(-errno);
+                return err;
         }
         if(data->raw){
                 CATCH_EINTR(err = tcgetattr(fd, &data->tt));
diff --git a/arch/um/drivers/ubd_user.c b/arch/um/drivers/ubd_user.c
deleted file mode 100644
index b94d2bc4fe06..000000000000
--- a/arch/um/drivers/ubd_user.c
+++ /dev/null
@@ -1,75 +0,0 @@
-/* 
- * Copyright (C) 2000, 2001, 2002 Jeff Dike (jdike@karaya.com)
- * Copyright (C) 2001 Ridgerun,Inc (glonnon@ridgerun.com)
- * Licensed under the GPL
- */
-
-#include <stddef.h>
-#include <unistd.h>
-#include <errno.h>
-#include <sched.h>
-#include <signal.h>
-#include <string.h>
-#include <netinet/in.h>
-#include <sys/time.h>
-#include <sys/socket.h>
-#include <sys/mman.h>
-#include <sys/param.h>
-#include "asm/types.h"
-#include "user_util.h"
-#include "kern_util.h"
-#include "user.h"
-#include "ubd_user.h"
-#include "os.h"
-#include "cow.h"
-
-#include <endian.h>
-#include <byteswap.h>
-
-void ignore_sigwinch_sig(void)
-{
-        signal(SIGWINCH, SIG_IGN);
-}
-
-int start_io_thread(unsigned long sp, int *fd_out)
-{
-        int pid, fds[2], err;
-
-        err = os_pipe(fds, 1, 1);
-        if(err < 0){
-                printk("start_io_thread - os_pipe failed, err = %d\n", -err);
-                goto out;
-        }
-
-        kernel_fd = fds[0];
-        *fd_out = fds[1];
-
-        pid = clone(io_thread, (void *) sp, CLONE_FILES | CLONE_VM | SIGCHLD,
-                    NULL);
-        if(pid < 0){
-                printk("start_io_thread - clone failed : errno = %d\n", errno);
-                err = -errno;
-                goto out_close;
-        }
-
-        return(pid);
-
- out_close:
-        os_close_file(fds[0]);
-        os_close_file(fds[1]);
-        kernel_fd = -1;
-        *fd_out = -1;
- out:
-        return(err);
-}
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
index 93dc1911363f..90e0e5ff451e 100644
--- a/arch/um/drivers/xterm.c
+++ b/arch/um/drivers/xterm.c
@@ -110,13 +110,15 @@ int xterm_open(int input, int output, int primary, void *d,
 
         fd = mkstemp(file);
         if(fd < 0){
+                err = -errno;
                 printk("xterm_open : mkstemp failed, errno = %d\n", errno);
-                return(-errno);
+                return err;
         }
 
         if(unlink(file)){
+                err = -errno;
                 printk("xterm_open : unlink failed, errno = %d\n", errno);
-                return(-errno);
+                return err;
         }
         os_close_file(fd);
 
diff --git a/arch/um/include/common-offsets.h b/arch/um/include/common-offsets.h
index 0aa620970adb..356390d1f8b9 100644
--- a/arch/um/include/common-offsets.h
+++ b/arch/um/include/common-offsets.h
@@ -1,7 +1,7 @@
 /* for use by sys-$SUBARCH/kernel-offsets.c */
 
-OFFSET(TASK_REGS, task_struct, thread.regs);
-OFFSET(TASK_PID, task_struct, pid);
+OFFSET(HOST_TASK_REGS, task_struct, thread.regs);
+OFFSET(HOST_TASK_PID, task_struct, pid);
 DEFINE(UM_KERN_PAGE_SIZE, PAGE_SIZE);
 DEFINE(UM_NSEC_PER_SEC, NSEC_PER_SEC);
 DEFINE_STR(UM_KERN_EMERG, KERN_EMERG);
@@ -12,4 +12,6 @@ DEFINE_STR(UM_KERN_WARNING, KERN_WARNING);
 DEFINE_STR(UM_KERN_NOTICE, KERN_NOTICE);
 DEFINE_STR(UM_KERN_INFO, KERN_INFO);
 DEFINE_STR(UM_KERN_DEBUG, KERN_DEBUG);
-DEFINE(HOST_ELF_CLASS, ELF_CLASS);
+DEFINE(UM_ELF_CLASS, ELF_CLASS);
+DEFINE(UM_ELFCLASS32, ELFCLASS32);
+DEFINE(UM_ELFCLASS64, ELFCLASS64);
diff --git a/arch/um/include/mconsole.h b/arch/um/include/mconsole.h
index cfa368e045a5..b1b512f47035 100644
--- a/arch/um/include/mconsole.h
+++ b/arch/um/include/mconsole.h
@@ -81,6 +81,7 @@ extern void mconsole_stop(struct mc_request *req);
 extern void mconsole_go(struct mc_request *req);
 extern void mconsole_log(struct mc_request *req);
 extern void mconsole_proc(struct mc_request *req);
+extern void mconsole_stack(struct mc_request *req);
 
 extern int mconsole_get_request(int fd, struct mc_request *req);
 extern int mconsole_notify(char *sock_name, int type, const void *data, 
diff --git a/arch/um/include/mem_user.h b/arch/um/include/mem_user.h
index d6404bb64662..9fef4123a65a 100644
--- a/arch/um/include/mem_user.h
+++ b/arch/um/include/mem_user.h
@@ -51,7 +51,6 @@ extern unsigned long task_size;
 
 extern void check_devanon(void);
 extern int init_mem_user(void);
-extern int create_mem_file(unsigned long len);
 extern void setup_memory(void *entry);
 extern unsigned long find_iomem(char *driver, unsigned long *len_out);
 extern int init_maps(unsigned long physmem, unsigned long iomem,
@@ -64,20 +63,6 @@ extern unsigned long phys_offset(unsigned long phys);
 extern void unmap_physmem(void);
 extern void map_memory(unsigned long virt, unsigned long phys,
                        unsigned long len, int r, int w, int x);
-extern int protect_memory(unsigned long addr, unsigned long len, 
-                          int r, int w, int x, int must_succeed);
 extern unsigned long get_kmem_end(void);
-extern void check_tmpexec(void);
 
 #endif
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/include/os.h b/arch/um/include/os.h
index 4c362458052c..6f766e1faecc 100644
--- a/arch/um/include/os.h
+++ b/arch/um/include/os.h
@@ -157,6 +157,13 @@ extern int os_lock_file(int fd, int excl);
 extern void os_early_checks(void);
 extern int can_do_skas(void);
 
+/* Make sure they are clear when running in TT mode. Required by
+ * SEGV_MAYBE_FIXABLE */
+#define clear_can_do_skas() do { ptrace_faultinfo = proc_mm = 0; } while (0)
+
+/* mem.c */
+extern int create_mem_file(unsigned long len);
+
 /* process.c */
 extern unsigned long os_process_pc(int pid);
 extern int os_process_parent(int pid);
@@ -181,6 +188,8 @@ extern unsigned long long os_usecs(void);
 /* tt.c
  * for tt mode only (will be deleted in future...)
  */
+extern int protect_memory(unsigned long addr, unsigned long len,
+                          int r, int w, int x, int must_succeed);
 extern void forward_pending_sigio(int target);
 extern int start_fork_tramp(void *arg, unsigned long temp_stack,
                             int clone_flags, int (*tramp)(void *));
diff --git a/arch/um/include/skas_ptregs.h b/arch/um/include/skas_ptregs.h
new file mode 100644
index 000000000000..73db19e9c077
--- /dev/null
+++ b/arch/um/include/skas_ptregs.h
@@ -0,0 +1,6 @@
+#ifndef __SKAS_PT_REGS_
+#define __SKAS_PT_REGS_
+
+#include <user_constants.h>
+
+#endif
diff --git a/arch/um/include/sysdep-i386/sc.h b/arch/um/include/sysdep-i386/sc.h
new file mode 100644
index 000000000000..c57d1780ad37
--- /dev/null
+++ b/arch/um/include/sysdep-i386/sc.h
@@ -0,0 +1,44 @@
+#ifndef __SYSDEP_I386_SC_H
+#define __SYSDEP_I386_SC_H
+
+#include <user_constants.h>
+
+#define SC_OFFSET(sc, field) \
+        *((unsigned long *) &(((char *) (sc))[HOST_##field]))
+#define SC_FP_OFFSET(sc, field) \
+        *((unsigned long *) &(((char *) (SC_FPSTATE(sc)))[HOST_##field]))
+#define SC_FP_OFFSET_PTR(sc, field, type) \
+        ((type *) &(((char *) (SC_FPSTATE(sc)))[HOST_##field]))
+
+#define SC_IP(sc) SC_OFFSET(sc, SC_IP)
+#define SC_SP(sc) SC_OFFSET(sc, SC_SP)
+#define SC_FS(sc) SC_OFFSET(sc, SC_FS)
+#define SC_GS(sc) SC_OFFSET(sc, SC_GS)
+#define SC_DS(sc) SC_OFFSET(sc, SC_DS)
+#define SC_ES(sc) SC_OFFSET(sc, SC_ES)
+#define SC_SS(sc) SC_OFFSET(sc, SC_SS)
+#define SC_CS(sc) SC_OFFSET(sc, SC_CS)
+#define SC_EFLAGS(sc) SC_OFFSET(sc, SC_EFLAGS)
+#define SC_EAX(sc) SC_OFFSET(sc, SC_EAX)
+#define SC_EBX(sc) SC_OFFSET(sc, SC_EBX)
+#define SC_ECX(sc) SC_OFFSET(sc, SC_ECX)
+#define SC_EDX(sc) SC_OFFSET(sc, SC_EDX)
+#define SC_EDI(sc) SC_OFFSET(sc, SC_EDI)
+#define SC_ESI(sc) SC_OFFSET(sc, SC_ESI)
+#define SC_EBP(sc) SC_OFFSET(sc, SC_EBP)
+#define SC_TRAPNO(sc) SC_OFFSET(sc, SC_TRAPNO)
+#define SC_ERR(sc) SC_OFFSET(sc, SC_ERR)
+#define SC_CR2(sc) SC_OFFSET(sc, SC_CR2)
+#define SC_FPSTATE(sc) SC_OFFSET(sc, SC_FPSTATE)
+#define SC_SIGMASK(sc) SC_OFFSET(sc, SC_SIGMASK)
+#define SC_FP_CW(sc) SC_FP_OFFSET(sc, SC_FP_CW)
+#define SC_FP_SW(sc) SC_FP_OFFSET(sc, SC_FP_SW)
+#define SC_FP_TAG(sc) SC_FP_OFFSET(sc, SC_FP_TAG)
+#define SC_FP_IPOFF(sc) SC_FP_OFFSET(sc, SC_FP_IPOFF)
+#define SC_FP_CSSEL(sc) SC_FP_OFFSET(sc, SC_FP_CSSEL)
+#define SC_FP_DATAOFF(sc) SC_FP_OFFSET(sc, SC_FP_DATAOFF)
+#define SC_FP_DATASEL(sc) SC_FP_OFFSET(sc, SC_FP_DATASEL)
+#define SC_FP_ST(sc) SC_FP_OFFSET_PTR(sc, SC_FP_ST, struct _fpstate)
+#define SC_FXSR_ENV(sc) SC_FP_OFFSET_PTR(sc, SC_FXSR_ENV, void)
+
+#endif
diff --git a/arch/um/include/sysdep-i386/sigcontext.h b/arch/um/include/sysdep-i386/sigcontext.h
index 1fe729265167..23fd2644d7ed 100644
--- a/arch/um/include/sysdep-i386/sigcontext.h
+++ b/arch/um/include/sysdep-i386/sigcontext.h
@@ -6,6 +6,7 @@
 #ifndef __SYS_SIGCONTEXT_I386_H
 #define __SYS_SIGCONTEXT_I386_H
 
+#include "uml-config.h"
 #include <sysdep/sc.h>
 
 #define IP_RESTART_SYSCALL(ip) ((ip) -= 2)
@@ -26,7 +27,14 @@
 #define SC_START_SYSCALL(sc) do SC_EAX(sc) = -ENOSYS; while(0)
 
 /* This is Page Fault */
-#define SEGV_IS_FIXABLE(fi) ((fi)->trap_no == 14)
+#define SEGV_IS_FIXABLE(fi)     ((fi)->trap_no == 14)
+
+/* SKAS3 has no trap_no on i386, but get_skas_faultinfo() sets it to 0. */
+#ifdef UML_CONFIG_MODE_SKAS
+#define SEGV_MAYBE_FIXABLE(fi)  ((fi)->trap_no == 0 && ptrace_faultinfo)
+#else
+#define SEGV_MAYBE_FIXABLE(fi)  0
+#endif
 
 extern unsigned long *sc_sigmask(void *sc_ptr);
 extern int sc_get_fpregs(unsigned long buf, void *sc_ptr);
diff --git a/arch/um/include/sysdep-i386/thread.h b/arch/um/include/sysdep-i386/thread.h
new file mode 100644
index 000000000000..e2bd6bae8b8a
--- /dev/null
+++ b/arch/um/include/sysdep-i386/thread.h
@@ -0,0 +1,11 @@
+#ifndef __UM_THREAD_H
+#define __UM_THREAD_H
+
+#include <kern_constants.h>
+
+#define TASK_DEBUGREGS(task) ((unsigned long *) &(((char *) (task))[HOST_TASK_DEBUGREGS]))
+#ifdef CONFIG_MODE_TT
+#define TASK_EXTERN_PID(task) *((int *) &(((char *) (task))[HOST_TASK_EXTERN_PID]))
+#endif
+
+#endif
diff --git a/arch/um/include/sysdep-x86_64/sc.h b/arch/um/include/sysdep-x86_64/sc.h
new file mode 100644
index 000000000000..a160d9fcc596
--- /dev/null
+++ b/arch/um/include/sysdep-x86_64/sc.h
@@ -0,0 +1,45 @@
+#ifndef __SYSDEP_X86_64_SC_H
+#define __SYSDEP_X86_64_SC_H
+
+/* Copyright (C) 2003 - 2004 PathScale, Inc
+ * Released under the GPL
+ */
+
+#include <user_constants.h>
+
+#define SC_OFFSET(sc, field) \
+         *((unsigned long *) &(((char *) (sc))[HOST_##field]))
+
+#define SC_RBX(sc) SC_OFFSET(sc, SC_RBX)
+#define SC_RCX(sc) SC_OFFSET(sc, SC_RCX)
+#define SC_RDX(sc) SC_OFFSET(sc, SC_RDX)
+#define SC_RSI(sc) SC_OFFSET(sc, SC_RSI)
+#define SC_RDI(sc) SC_OFFSET(sc, SC_RDI)
+#define SC_RBP(sc) SC_OFFSET(sc, SC_RBP)
+#define SC_RAX(sc) SC_OFFSET(sc, SC_RAX)
+#define SC_R8(sc) SC_OFFSET(sc, SC_R8)
+#define SC_R9(sc) SC_OFFSET(sc, SC_R9)
+#define SC_R10(sc) SC_OFFSET(sc, SC_R10)
+#define SC_R11(sc) SC_OFFSET(sc, SC_R11)
+#define SC_R12(sc) SC_OFFSET(sc, SC_R12)
+#define SC_R13(sc) SC_OFFSET(sc, SC_R13)
+#define SC_R14(sc) SC_OFFSET(sc, SC_R14)
+#define SC_R15(sc) SC_OFFSET(sc, SC_R15)
+#define SC_IP(sc) SC_OFFSET(sc, SC_IP)
+#define SC_SP(sc) SC_OFFSET(sc, SC_SP)
+#define SC_CR2(sc) SC_OFFSET(sc, SC_CR2)
+#define SC_ERR(sc) SC_OFFSET(sc, SC_ERR)
+#define SC_TRAPNO(sc) SC_OFFSET(sc, SC_TRAPNO)
+#define SC_CS(sc) SC_OFFSET(sc, SC_CS)
+#define SC_FS(sc) SC_OFFSET(sc, SC_FS)
+#define SC_GS(sc) SC_OFFSET(sc, SC_GS)
+#define SC_EFLAGS(sc) SC_OFFSET(sc, SC_EFLAGS)
+#define SC_SIGMASK(sc) SC_OFFSET(sc, SC_SIGMASK)
+#if 0
+#define SC_ORIG_RAX(sc) SC_OFFSET(sc, SC_ORIG_RAX)
+#define SC_DS(sc) SC_OFFSET(sc, SC_DS)
+#define SC_ES(sc) SC_OFFSET(sc, SC_ES)
+#define SC_SS(sc) SC_OFFSET(sc, SC_SS)
+#endif
+
+#endif
diff --git a/arch/um/include/sysdep-x86_64/sigcontext.h b/arch/um/include/sysdep-x86_64/sigcontext.h
index 2a78260d15a0..41073235e7ad 100644
--- a/arch/um/include/sysdep-x86_64/sigcontext.h
+++ b/arch/um/include/sysdep-x86_64/sigcontext.h
@@ -31,7 +31,10 @@
 #define SC_START_SYSCALL(sc) do SC_RAX(sc) = -ENOSYS; while(0)
 
 /* This is Page Fault */
-#define SEGV_IS_FIXABLE(fi) ((fi)->trap_no == 14)
+#define SEGV_IS_FIXABLE(fi)     ((fi)->trap_no == 14)
+
+/* No broken SKAS API, which doesn't pass trap_no, here. */
+#define SEGV_MAYBE_FIXABLE(fi)  0
 
 extern unsigned long *sc_sigmask(void *sc_ptr);
 
diff --git a/arch/um/include/sysdep-x86_64/thread.h b/arch/um/include/sysdep-x86_64/thread.h
new file mode 100644
index 000000000000..6a76a7f3683f
--- /dev/null
+++ b/arch/um/include/sysdep-x86_64/thread.h
@@ -0,0 +1,10 @@
+#ifndef __UM_THREAD_H
+#define __UM_THREAD_H
+
+#include <kern_constants.h>
+
+#ifdef CONFIG_MODE_TT
+#define TASK_EXTERN_PID(task) *((int *) &(((char *) (task))[HOST_TASK_EXTERN_PID]))
+#endif
+
+#endif
diff --git a/arch/um/include/task.h b/arch/um/include/task.h
new file mode 100644
index 000000000000..6375ba7203c9
--- /dev/null
+++ b/arch/um/include/task.h
@@ -0,0 +1,9 @@
+#ifndef __TASK_H
+#define __TASK_H
+
+#include <kern_constants.h>
+
+#define TASK_REGS(task) ((union uml_pt_regs *) &(((char *) (task))[HOST_TASK_REGS]))
+#define TASK_PID(task) *((int *) &(((char *) (task))[HOST_TASK_PID]))
+
+#endif
diff --git a/arch/um/include/user.h b/arch/um/include/user.h
index 57ee9e261228..0f865ef46918 100644
--- a/arch/um/include/user.h
+++ b/arch/um/include/user.h
@@ -14,7 +14,9 @@ extern void *um_kmalloc_atomic(int size);
 extern void kfree(void *ptr);
 extern int in_aton(char *str);
 extern int open_gdb_chan(void);
-extern int strlcpy(char *, const char *, int);
+/* These use size_t, however unsigned long is correct on both i386 and x86_64. */
+extern unsigned long strlcpy(char *, const char *, unsigned long);
+extern unsigned long strlcat(char *, const char *, unsigned long);
 extern void *um_vmalloc(int size);
 extern void vfree(void *ptr);
 
diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile
index 614b8ebeb0ed..1a0001b3850c 100644
--- a/arch/um/kernel/Makefile
+++ b/arch/um/kernel/Makefile
@@ -1,4 +1,4 @@
-# 
+#
 # Copyright (C) 2002 Jeff Dike (jdike@karaya.com)
 # Licensed under the GPL
 #
@@ -7,11 +7,11 @@ extra-y := vmlinux.lds
 clean-files :=
 
 obj-y = config.o exec_kern.o exitcode.o \
-        helper.o init_task.o irq.o irq_user.o ksyms.o main.o mem.o mem_user.o \
-        physmem.o process_kern.o ptrace.o reboot.o resource.o sigio_user.o \
-        sigio_kern.o signal_kern.o signal_user.o smp.o syscall_kern.o sysrq.o \
-        tempfile.o time.o time_kern.o tlb.o trap_kern.o trap_user.o \
-        uaccess_user.o um_arch.o umid.o user_util.o
+        helper.o init_task.o irq.o irq_user.o ksyms.o main.o mem.o physmem.o \
+        process_kern.o ptrace.o reboot.o resource.o sigio_user.o sigio_kern.o \
+        signal_kern.o signal_user.o smp.o syscall_kern.o sysrq.o time.o \
+        time_kern.o tlb.o trap_kern.o trap_user.o uaccess_user.o um_arch.o \
+        umid.o user_util.o
 
 obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o
 obj-$(CONFIG_GPROF)     += gprof_syms.o
@@ -24,8 +24,8 @@ obj-$(CONFIG_MODE_SKAS) += skas/
 
 user-objs-$(CONFIG_TTY_LOG) += tty_log.o
 
-USER_OBJS := $(user-objs-y) config.o helper.o main.o tempfile.o time.o \
-        tty_log.o umid.o user_util.o
+USER_OBJS := $(user-objs-y) config.o helper.o main.o time.o tty_log.o umid.o \
+        user_util.o
 
 include arch/um/scripts/Makefile.rules
 
diff --git a/arch/um/kernel/helper.c b/arch/um/kernel/helper.c
index f83e1e8e2392..33fb0bd3b11a 100644
--- a/arch/um/kernel/helper.c
+++ b/arch/um/kernel/helper.c
@@ -85,8 +85,8 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv,
         data.fd = fds[1];
         pid = clone(helper_child, (void *) sp, CLONE_VM | SIGCHLD, &data);
         if(pid < 0){
-                printk("run_helper : clone failed, errno = %d\n", errno);
                 ret = -errno;
+                printk("run_helper : clone failed, errno = %d\n", errno);
                 goto out_close;
         }
 
@@ -122,7 +122,7 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
                       unsigned long *stack_out, int stack_order)
 {
         unsigned long stack, sp;
-        int pid, status;
+        int pid, status, err;
 
         stack = alloc_stack(stack_order, um_in_interrupt());
         if(stack == 0) return(-ENOMEM);
@@ -130,16 +130,18 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
         sp = stack + (page_size() << stack_order) - sizeof(void *);
         pid = clone(proc, (void *) sp, flags | SIGCHLD, arg);
         if(pid < 0){
+                err = -errno;
                 printk("run_helper_thread : clone failed, errno = %d\n", 
                        errno);
-                return(-errno);
+                return err;
         }
         if(stack_out == NULL){
                 CATCH_EINTR(pid = waitpid(pid, &status, 0));
                 if(pid < 0){
+                        err = -errno;
                         printk("run_helper_thread - wait failed, errno = %d\n",
                                errno);
-                        pid = -errno;
+                        pid = err;
                 }
                 if(!WIFEXITED(status) || (WEXITSTATUS(status) != 0))
                         printk("run_helper_thread - thread returned status "
@@ -156,8 +158,8 @@ int helper_wait(int pid)
 
         CATCH_EINTR(ret = waitpid(pid, NULL, WNOHANG));
         if(ret < 0){
+                ret = -errno;
                 printk("helper_wait : waitpid failed, errno = %d\n", errno);
-                return(-errno);
         }
         return(ret);
 }
diff --git a/arch/um/kernel/init_task.c b/arch/um/kernel/init_task.c
index cd7c85be0a1b..49ed5ddf0704 100644
--- a/arch/um/kernel/init_task.c
+++ b/arch/um/kernel/init_task.c
@@ -13,6 +13,7 @@
 #include "asm/pgtable.h"
 #include "user_util.h"
 #include "mem_user.h"
+#include "os.h"
 
 static struct fs_struct init_fs = INIT_FS;
 struct mm_struct init_mm = INIT_MM(init_mm);
@@ -45,8 +46,8 @@ __attribute__((__section__(".data.init_task"))) =
 
 void unprotect_stack(unsigned long stack)
 {
-        protect_memory(stack, (1 << CONFIG_KERNEL_STACK_ORDER) * PAGE_SIZE, 
-                       1, 1, 0, 1);
+        os_protect_memory((void *) stack, (1 << CONFIG_KERNEL_STACK_ORDER) * PAGE_SIZE,
+                       1, 1, 0);
 }
 
 /*
diff --git a/arch/um/kernel/irq.c b/arch/um/kernel/irq.c
index dcd814971995..bbf94bf2921e 100644
--- a/arch/um/kernel/irq.c
+++ b/arch/um/kernel/irq.c
@@ -9,7 +9,6 @@
 #include "linux/kernel.h"
 #include "linux/module.h"
 #include "linux/smp.h"
-#include "linux/irq.h"
 #include "linux/kernel_stat.h"
 #include "linux/interrupt.h"
 #include "linux/random.h"
diff --git a/arch/um/kernel/mem.c b/arch/um/kernel/mem.c
index 64fa062cc119..ea008b031a8f 100644
--- a/arch/um/kernel/mem.c
+++ b/arch/um/kernel/mem.c
@@ -1,4 +1,4 @@
-/* 
+/*
  * Copyright (C) 2000 - 2003 Jeff Dike (jdike@addtoit.com)
  * Licensed under the GPL
  */
@@ -19,6 +19,10 @@
 #include "mem_user.h"
 #include "uml_uaccess.h"
 #include "os.h"
+#include "linux/types.h"
+#include "linux/string.h"
+#include "init.h"
+#include "kern_constants.h"
 
 extern char __binary_start;
 
@@ -368,6 +372,16 @@ struct page *pte_alloc_one(struct mm_struct *mm, unsigned long address)
         return pte;
 }
 
+struct iomem_region *iomem_regions = NULL;
+int iomem_size = 0;
+
+extern int parse_iomem(char *str, int *add) __init;
+
+__uml_setup("iomem=", parse_iomem,
+"iomem=<name>,<file>\n"
+"    Configure <file> as an IO memory region named <name>.\n\n"
+);
+
 /*
  * Overrides for Emacs so that we follow Linus's tabbing style.
  * Emacs will notice this stuff at the end of the file and automatically
diff --git a/arch/um/kernel/mem_user.c b/arch/um/kernel/mem_user.c
deleted file mode 100644
index 4a663fd434bb..000000000000
--- a/arch/um/kernel/mem_user.c
+++ /dev/null
@@ -1,273 +0,0 @@
-/*
- * arch/um/kernel/mem_user.c
- *
- * BRIEF MODULE DESCRIPTION
- * user side memory routines for supporting IO memory inside user mode linux
- *
- * Copyright (C) 2001 RidgeRun, Inc.
- * Author: RidgeRun, Inc.
- *         Greg Lonnon glonnon@ridgerun.com or info@ridgerun.com
- *
- *  This program is free software; you can redistribute  it and/or modify it
- *  under  the terms of  the GNU General  Public License as published by the
- *  Free Software Foundation;  either version 2 of the  License, or (at your
- *  option) any later version.
- *
- *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
- *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
- *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
- *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
- *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
- *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
- *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *  You should have received a copy of the  GNU General Public License along
- *  with this program; if not, write  to the Free Software Foundation, Inc.,
- *  675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <stddef.h>
-#include <stdarg.h>
-#include <unistd.h>
-#include <errno.h>
-#include <string.h>
-#include <fcntl.h>
-#include <sys/types.h>
-#include <sys/mman.h>
-#include "kern_util.h"
-#include "user.h"
-#include "user_util.h"
-#include "mem_user.h"
-#include "init.h"
-#include "os.h"
-#include "tempfile.h"
-#include "kern_constants.h"
-
-#define TEMPNAME_TEMPLATE "vm_file-XXXXXX"
-
-static int create_tmp_file(unsigned long len)
-{
-        int fd, err;
-        char zero;
-
-        fd = make_tempfile(TEMPNAME_TEMPLATE, NULL, 1);
-        if(fd < 0) {
-                os_print_error(fd, "make_tempfile");
-                exit(1);
-        }
-
-        err = os_mode_fd(fd, 0777);
-        if(err < 0){
-                os_print_error(err, "os_mode_fd");
-                exit(1);
-        }
-        err = os_seek_file(fd, len);
-        if(err < 0){
-                os_print_error(err, "os_seek_file");
-                exit(1);
-        }
-        zero = 0;
-        err = os_write_file(fd, &zero, 1);
-        if(err != 1){
-                os_print_error(err, "os_write_file");
-                exit(1);
-        }
-
-        return(fd);
-}
-
-void check_tmpexec(void)
-{
-        void *addr;
-        int err, fd = create_tmp_file(UM_KERN_PAGE_SIZE);
-
-        addr = mmap(NULL, UM_KERN_PAGE_SIZE,
-                    PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE, fd, 0);
-        printf("Checking PROT_EXEC mmap in /tmp...");
-        fflush(stdout);
-        if(addr == MAP_FAILED){
-                err = errno;
-                perror("failed");
-                if(err == EPERM)
-                        printf("/tmp must be not mounted noexec\n");
-                exit(1);
-        }
-        printf("OK\n");
-        munmap(addr, UM_KERN_PAGE_SIZE);
-
-        os_close_file(fd);
-}
-
-static int have_devanon = 0;
-
-void check_devanon(void)
-{
-        int fd;
-
-        printk("Checking for /dev/anon on the host...");
-        fd = open("/dev/anon", O_RDWR);
-        if(fd < 0){
-                printk("Not available (open failed with errno %d)\n", errno);
-                return;
-        }
-
-        printk("OK\n");
-        have_devanon = 1;
-}
-
-static int create_anon_file(unsigned long len)
-{
-        void *addr;
-        int fd;
-
-        fd = open("/dev/anon", O_RDWR);
-        if(fd < 0) {
-                os_print_error(fd, "opening /dev/anon");
-                exit(1);
-        }
-
-        addr = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-        if(addr == MAP_FAILED){
-                perror("mapping physmem file");
-                exit(1);
-        }
-        munmap(addr, len);
-
-        return(fd);
-}
-
-int create_mem_file(unsigned long len)
-{
-        int err, fd;
-
-        if(have_devanon)
-                fd = create_anon_file(len);
-        else fd = create_tmp_file(len);
-
-        err = os_set_exec_close(fd, 1);
-        if(err < 0)
-                os_print_error(err, "exec_close");
-        return(fd);
-}
-
-struct iomem_region *iomem_regions = NULL;
-int iomem_size = 0;
-
-static int __init parse_iomem(char *str, int *add)
-{
-        struct iomem_region *new;
-        struct uml_stat buf;
-        char *file, *driver;
-        int fd, err, size;
-
-        driver = str;
-        file = strchr(str,',');
-        if(file == NULL){
-                printf("parse_iomem : failed to parse iomem\n");
-                goto out;
-        }
-        *file = '\0';
-        file++;
-        fd = os_open_file(file, of_rdwr(OPENFLAGS()), 0);
-        if(fd < 0){
-                os_print_error(fd, "parse_iomem - Couldn't open io file");
-                goto out;
-        }
-
-        err = os_stat_fd(fd, &buf);
-        if(err < 0){
-                os_print_error(err, "parse_iomem - cannot stat_fd file");
-                goto out_close;
-        }
-
-        new = malloc(sizeof(*new));
-        if(new == NULL){
-                perror("Couldn't allocate iomem_region struct");
-                goto out_close;
-        }
-
-        size = (buf.ust_size + UM_KERN_PAGE_SIZE) & ~(UM_KERN_PAGE_SIZE - 1);
-
-        *new = ((struct iomem_region) { .next           = iomem_regions,
-                                        .driver         = driver,
-                                        .fd             = fd,
-                                        .size           = size,
-                                        .phys           = 0,
-                                        .virt           = 0 });
-        iomem_regions = new;
-        iomem_size += new->size + UM_KERN_PAGE_SIZE;
-
-        return(0);
- out_close:
-        os_close_file(fd);
- out:
-        return(1);
-}
-
-__uml_setup("iomem=", parse_iomem,
-"iomem=<name>,<file>\n"
-"    Configure <file> as an IO memory region named <name>.\n\n"
-);
-
-int protect_memory(unsigned long addr, unsigned long len, int r, int w, int x,
-                   int must_succeed)
-{
-        int err;
-
-        err = os_protect_memory((void *) addr, len, r, w, x);
-        if(err < 0){
-                if(must_succeed)
-                        panic("protect failed, err = %d", -err);
-                else return(err);
-        }
-        return(0);
-}
-
-#if 0
-/* Debugging facility for dumping stuff out to the host, avoiding the timing
- * problems that come with printf and breakpoints.
- * Enable in case of emergency.
- */
-
-int logging = 1;
-int logging_fd = -1;
-
-int logging_line = 0;
-char logging_buf[512];
-
-void log(char *fmt, ...)
-{
-        va_list ap;
-        struct timeval tv;
-        struct openflags flags;
-
-        if(logging == 0) return;
-        if(logging_fd < 0){
-                flags = of_create(of_trunc(of_rdwr(OPENFLAGS())));
-                logging_fd = os_open_file("log", flags, 0644);
-        }
-        gettimeofday(&tv, NULL);
-        sprintf(logging_buf, "%d\t %u.%u  ", logging_line++, tv.tv_sec,
-                tv.tv_usec);
-        va_start(ap, fmt);
-        vsprintf(&logging_buf[strlen(logging_buf)], fmt, ap);
-        va_end(ap);
-        write(logging_fd, logging_buf, strlen(logging_buf));
-}
-#endif
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/kernel/process_kern.c b/arch/um/kernel/process_kern.c
index c23d8a08d0ff..ea65db679e9c 100644
--- a/arch/um/kernel/process_kern.c
+++ b/arch/um/kernel/process_kern.c
@@ -82,7 +82,8 @@ unsigned long alloc_stack(int order, int atomic)
         unsigned long page;
         int flags = GFP_KERNEL;
 
-        if(atomic) flags |= GFP_ATOMIC;
+        if (atomic)
+                flags = GFP_ATOMIC;
         page = __get_free_pages(flags, order);
         if(page == 0)
                 return(0);
@@ -113,8 +114,23 @@ void set_current(void *t)
 
 void *_switch_to(void *prev, void *next, void *last)
 {
-        return(CHOOSE_MODE(switch_to_tt(prev, next), 
-                           switch_to_skas(prev, next)));
+        struct task_struct *from = prev;
+        struct task_struct *to= next;
+
+        to->thread.prev_sched = from;
+        set_current(to);
+
+        do {
+                current->thread.saved_task = NULL ;
+                CHOOSE_MODE_PROC(switch_to_tt, switch_to_skas, prev, next);
+                if(current->thread.saved_task)
+                        show_regs(&(current->thread.regs));
+                next= current->thread.saved_task;
+                prev= current;
+        } while(current->thread.saved_task);
+
+        return(current->thread.prev_sched);
+
 }
 
 void interrupt_end(void)
diff --git a/arch/um/kernel/sigio_user.c b/arch/um/kernel/sigio_user.c
index e89218958f38..a52751108aa1 100644
--- a/arch/um/kernel/sigio_user.c
+++ b/arch/um/kernel/sigio_user.c
@@ -340,7 +340,7 @@ static int setup_initial_poll(int fd)
 {
         struct pollfd *p;
 
-        p = um_kmalloc(sizeof(struct pollfd));
+        p = um_kmalloc_atomic(sizeof(struct pollfd));
         if(p == NULL){
                 printk("setup_initial_poll : failed to allocate poll\n");
                 return(-1);
diff --git a/arch/um/kernel/skas/Makefile b/arch/um/kernel/skas/Makefile
index db36c7c95940..8de471b59c1c 100644
--- a/arch/um/kernel/skas/Makefile
+++ b/arch/um/kernel/skas/Makefile
@@ -6,8 +6,6 @@
 obj-y := clone.o exec_kern.o mem.o mem_user.o mmu.o process.o process_kern.o \
         syscall.o tlb.o trap_user.o uaccess.o
 
-subdir- := util
-
 USER_OBJS := process.o clone.o
 
 include arch/um/scripts/Makefile.rules
diff --git a/arch/um/kernel/skas/include/mode_kern-skas.h b/arch/um/kernel/skas/include/mode_kern-skas.h
index e48490028111..c97a80dfe370 100644
--- a/arch/um/kernel/skas/include/mode_kern-skas.h
+++ b/arch/um/kernel/skas/include/mode_kern-skas.h
@@ -11,7 +11,7 @@
 #include "asm/ptrace.h"
 
 extern void flush_thread_skas(void);
-extern void *switch_to_skas(void *prev, void *next);
+extern void switch_to_skas(void *prev, void *next);
 extern void start_thread_skas(struct pt_regs *regs, unsigned long eip,
                               unsigned long esp);
 extern int copy_thread_skas(int nr, unsigned long clone_flags,
diff --git a/arch/um/kernel/skas/include/uaccess-skas.h b/arch/um/kernel/skas/include/uaccess-skas.h
index 6ee3f3902e68..7da0c2def0ef 100644
--- a/arch/um/kernel/skas/include/uaccess-skas.h
+++ b/arch/um/kernel/skas/include/uaccess-skas.h
@@ -18,12 +18,6 @@
           ((unsigned long) (addr) + (size) <= FIXADDR_USER_END) && \
           ((unsigned long) (addr) + (size) >= (unsigned long)(addr))))
 
-static inline int verify_area_skas(int type, const void __user * addr,
-                                   unsigned long size)
-{
-        return(access_ok_skas(type, addr, size) ? 0 : -EFAULT);
-}
-
 extern int copy_from_user_skas(void *to, const void __user *from, int n);
 extern int copy_to_user_skas(void __user *to, const void *from, int n);
 extern int strncpy_from_user_skas(char *dst, const char __user *src, int count);
diff --git a/arch/um/kernel/skas/process_kern.c b/arch/um/kernel/skas/process_kern.c
index 3d1b227226e6..efe92e8aa2a9 100644
--- a/arch/um/kernel/skas/process_kern.c
+++ b/arch/um/kernel/skas/process_kern.c
@@ -24,7 +24,7 @@
 #include "proc_mm.h"
 #include "registers.h"
 
-void *switch_to_skas(void *prev, void *next)
+void switch_to_skas(void *prev, void *next)
 {
         struct task_struct *from, *to;
 
@@ -35,16 +35,11 @@ void *switch_to_skas(void *prev, void *next)
         if(current->pid == 0)
                 switch_timers(0);
 
-        to->thread.prev_sched = from;
-        set_current(to);
-
         switch_threads(&from->thread.mode.skas.switch_buf, 
                        to->thread.mode.skas.switch_buf);
 
         if(current->pid == 0)
                 switch_timers(1);
-
-        return(current->thread.prev_sched);
 }
 
 extern void schedule_tail(struct task_struct *prev);
diff --git a/arch/um/kernel/skas/util/Makefile b/arch/um/kernel/skas/util/Makefile
deleted file mode 100644
index f7b7eba83340..000000000000
--- a/arch/um/kernel/skas/util/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-hostprogs-y             := mk_ptregs
-always                  := $(hostprogs-y)
-
-mk_ptregs-objs := mk_ptregs-$(SUBARCH).o
-HOSTCFLAGS_mk_ptregs-$(SUBARCH).o := -I$(objtree)/arch/um
diff --git a/arch/um/kernel/skas/util/mk_ptregs-i386.c b/arch/um/kernel/skas/util/mk_ptregs-i386.c
deleted file mode 100644
index 1f96e1eeb8a7..000000000000
--- a/arch/um/kernel/skas/util/mk_ptregs-i386.c
+++ /dev/null
@@ -1,49 +0,0 @@
-#include <stdio.h>
-#include <user-offsets.h>
-
-#define SHOW(name) printf("#define %s %d\n", #name, name)
-
-int main(int argc, char **argv)
-{
-        printf("/* Automatically generated by "
-               "arch/um/kernel/skas/util/mk_ptregs */\n");
-        printf("\n");
-        printf("#ifndef __SKAS_PT_REGS_\n");
-        printf("#define __SKAS_PT_REGS_\n");
-        printf("\n");
-        SHOW(HOST_FRAME_SIZE);
-        SHOW(HOST_FP_SIZE);
-        SHOW(HOST_XFP_SIZE);
-
-        SHOW(HOST_IP);
-        SHOW(HOST_SP);
-        SHOW(HOST_EFLAGS);
-        SHOW(HOST_EAX);
-        SHOW(HOST_EBX);
-        SHOW(HOST_ECX);
-        SHOW(HOST_EDX);
-        SHOW(HOST_ESI);
-        SHOW(HOST_EDI);
-        SHOW(HOST_EBP);
-        SHOW(HOST_CS);
-        SHOW(HOST_SS);
-        SHOW(HOST_DS);
-        SHOW(HOST_FS);
-        SHOW(HOST_ES);
-        SHOW(HOST_GS);
-
-        printf("\n");
-        printf("#endif\n");
-        return(0);
-}
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/kernel/skas/util/mk_ptregs-x86_64.c b/arch/um/kernel/skas/util/mk_ptregs-x86_64.c
deleted file mode 100644
index 5fccbfe35f78..000000000000
--- a/arch/um/kernel/skas/util/mk_ptregs-x86_64.c
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright 2003 PathScale, Inc.
- *
- * Licensed under the GPL
- */
-
-#include <stdio.h>
-#include <user-offsets.h>
-
-#define SHOW(name) \
-        printf("#define %s (%d / sizeof(unsigned long))\n", #name, name)
-
-int main(int argc, char **argv)
-{
-        printf("/* Automatically generated by "
-               "arch/um/kernel/skas/util/mk_ptregs */\n");
-        printf("\n");
-        printf("#ifndef __SKAS_PT_REGS_\n");
-        printf("#define __SKAS_PT_REGS_\n");
-        SHOW(HOST_FRAME_SIZE);
-        SHOW(HOST_RBX);
-        SHOW(HOST_RCX);
-        SHOW(HOST_RDI);
-        SHOW(HOST_RSI);
-        SHOW(HOST_RDX);
-        SHOW(HOST_RBP);
-        SHOW(HOST_RAX);
-        SHOW(HOST_R8);
-        SHOW(HOST_R9);
-        SHOW(HOST_R10);
-        SHOW(HOST_R11);
-        SHOW(HOST_R12);
-        SHOW(HOST_R13);
-        SHOW(HOST_R14);
-        SHOW(HOST_R15);
-        SHOW(HOST_ORIG_RAX);
-        SHOW(HOST_CS);
-        SHOW(HOST_SS);
-        SHOW(HOST_EFLAGS);
-#if 0
-        SHOW(HOST_FS);
-        SHOW(HOST_GS);
-        SHOW(HOST_DS);
-        SHOW(HOST_ES);
-#endif
-
-        SHOW(HOST_IP);
-        SHOW(HOST_SP);
-        printf("#define HOST_FP_SIZE 0\n");
-        printf("#define HOST_XFP_SIZE 0\n");
-        printf("\n");
-        printf("\n");
-        printf("#endif\n");
-        return(0);
-}
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/kernel/tempfile.c b/arch/um/kernel/tempfile.c
deleted file mode 100644
index b1674bc1395d..000000000000
--- a/arch/um/kernel/tempfile.c
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (C) 2002 Jeff Dike (jdike@karaya.com)
- * Licensed under the GPL
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <errno.h>
-#include <sys/param.h>
-#include "init.h"
-
-/* Modified from create_mem_file and start_debugger */
-static char *tempdir = NULL;
-
-static void __init find_tempdir(void)
-{
-        char *dirs[] = { "TMP", "TEMP", "TMPDIR", NULL };
-        int i;
-        char *dir = NULL;
-
-        if(tempdir != NULL) return;     /* We've already been called */
-        for(i = 0; dirs[i]; i++){
-                dir = getenv(dirs[i]);
-                if((dir != NULL) && (*dir != '\0'))
-                        break;
-        }
-        if((dir == NULL) || (*dir == '\0')) 
-                dir = "/tmp";
-
-        tempdir = malloc(strlen(dir) + 2);
-        if(tempdir == NULL){
-                fprintf(stderr, "Failed to malloc tempdir, "
-                        "errno = %d\n", errno);
-                return;
-        }
-        strcpy(tempdir, dir);
-        strcat(tempdir, "/");
-}
-
-int make_tempfile(const char *template, char **out_tempname, int do_unlink)
-{
-        char tempname[MAXPATHLEN];
-        int fd;
-
-        find_tempdir();
-        if (*template != '/')
-                strcpy(tempname, tempdir);
-        else
-                *tempname = 0;
-        strcat(tempname, template);
-        fd = mkstemp(tempname);
-        if(fd < 0){
-                fprintf(stderr, "open - cannot create %s: %s\n", tempname, 
-                        strerror(errno));
-                return -1;
-        }
-        if(do_unlink && (unlink(tempname) < 0)){
-                perror("unlink");
-                return -1;
-        }
-        if(out_tempname){
-                *out_tempname = strdup(tempname);
-                if(*out_tempname == NULL){
-                        perror("strdup");
-                        return -1;
-                }
-        }
-        return(fd);
-}
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/kernel/tlb.c b/arch/um/kernel/tlb.c
index 80ed6188e8a2..f5b0636f9ad7 100644
--- a/arch/um/kernel/tlb.c
+++ b/arch/um/kernel/tlb.c
@@ -193,12 +193,12 @@ void fix_range_common(struct mm_struct *mm, unsigned long start_addr,
                 r = pte_read(*npte);
                 w = pte_write(*npte);
                 x = pte_exec(*npte);
-                if(!pte_dirty(*npte))
-                        w = 0;
-                if(!pte_young(*npte)){
-                        r = 0;
-                        w = 0;
-                }
+                if (!pte_young(*npte)) {
+                        r = 0;
+                        w = 0;
+                } else if (!pte_dirty(*npte)) {
+                        w = 0;
+                }
                 if(force || pte_newpage(*npte)){
                         if(pte_present(*npte))
                           ret = add_mmap(addr,
@@ -307,7 +307,7 @@ int flush_tlb_kernel_range_common(unsigned long start, unsigned long end)
                 }
                 else if(pte_newprot(*pte)){
                         updated = 1;
-                        protect_memory(addr, PAGE_SIZE, 1, 1, 1, 1);
+                        os_protect_memory((void *) addr, PAGE_SIZE, 1, 1, 1);
                 }
                 addr += PAGE_SIZE;
         }
diff --git a/arch/um/kernel/trap_kern.c b/arch/um/kernel/trap_kern.c
index 87cc6fd76ced..95c8f8733baf 100644
--- a/arch/um/kernel/trap_kern.c
+++ b/arch/um/kernel/trap_kern.c
@@ -18,6 +18,7 @@
 #include "asm/a.out.h"
 #include "asm/current.h"
 #include "asm/irq.h"
+#include "sysdep/sigcontext.h"
 #include "user_util.h"
 #include "kern_util.h"
 #include "kern.h"
@@ -25,6 +26,9 @@
 #include "mconsole_kern.h"
 #include "mem.h"
 #include "mem_kern.h"
+#ifdef CONFIG_MODE_SKAS
+#include "skas.h"
+#endif
 
 /* Note this is constrained to return 0, -EFAULT, -EACCESS, -ENOMEM by segv(). */
 int handle_page_fault(unsigned long address, unsigned long ip, 
@@ -39,6 +43,12 @@ int handle_page_fault(unsigned long address, unsigned long ip,
         int err = -EFAULT;
 
         *code_out = SEGV_MAPERR;
+
+        /* If the fault was during atomic operation, don't take the fault, just
+         * fail. */
+        if (in_atomic())
+                goto out_nosemaphore;
+
         down_read(&mm->mmap_sem);
         vma = find_vma(mm, address);
         if(!vma) 
@@ -89,6 +99,7 @@ survive:
         flush_tlb_page(vma, address);
 out:
         up_read(&mm->mmap_sem);
+out_nosemaphore:
         return(err);
 
 /*
@@ -125,7 +136,15 @@ unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user, void *sc)
         }
         else if(current->mm == NULL)
                 panic("Segfault with no mm");
-        err = handle_page_fault(address, ip, is_write, is_user, &si.si_code);
+
+        if (SEGV_IS_FIXABLE(&fi) || SEGV_MAYBE_FIXABLE(&fi))
+                err = handle_page_fault(address, ip, is_write, is_user, &si.si_code);
+        else {
+                err = -EFAULT;
+                /* A thread accessed NULL, we get a fault, but CR2 is invalid.
+                 * This code is used in __do_copy_from_user() of TT mode. */
+                address = 0;
+        }
 
         catcher = current->thread.fault_catcher;
         if(!err)
diff --git a/arch/um/kernel/tt/include/mode_kern-tt.h b/arch/um/kernel/tt/include/mode_kern-tt.h
index e0ca0e0b2516..2a35b15c5fef 100644
--- a/arch/um/kernel/tt/include/mode_kern-tt.h
+++ b/arch/um/kernel/tt/include/mode_kern-tt.h
@@ -11,7 +11,7 @@
 #include "asm/ptrace.h"
 #include "asm/uaccess.h"
 
-extern void *switch_to_tt(void *prev, void *next);
+extern void switch_to_tt(void *prev, void *next);
 extern void flush_thread_tt(void);
 extern void start_thread_tt(struct pt_regs *regs, unsigned long eip,
                            unsigned long esp);
diff --git a/arch/um/kernel/tt/include/uaccess-tt.h b/arch/um/kernel/tt/include/uaccess-tt.h
index aa6db384af80..dc2ebfa8c54f 100644
--- a/arch/um/kernel/tt/include/uaccess-tt.h
+++ b/arch/um/kernel/tt/include/uaccess-tt.h
@@ -33,12 +33,6 @@ extern unsigned long uml_physmem;
          (((unsigned long) (addr) <= ((unsigned long) (addr) + (size))) && \
           (under_task_size(addr, size) || is_stack(addr, size))))
 
-static inline int verify_area_tt(int type, const void __user * addr,
-                                 unsigned long size)
-{
-        return(access_ok_tt(type, addr, size) ? 0 : -EFAULT);
-}
-
 extern unsigned long get_fault_addr(void);
 
 extern int __do_copy_from_user(void *to, const void *from, int n,
diff --git a/arch/um/kernel/tt/mem_user.c b/arch/um/kernel/tt/mem_user.c
index 3085267459b1..03e589895388 100644
--- a/arch/um/kernel/tt/mem_user.c
+++ b/arch/um/kernel/tt/mem_user.c
@@ -12,6 +12,7 @@
 #include "tt.h"
 #include "mem_user.h"
 #include "user_util.h"
+#include "os.h"
 
 void remap_data(void *segment_start, void *segment_end, int w)
 {
diff --git a/arch/um/kernel/tt/process_kern.c b/arch/um/kernel/tt/process_kern.c
index a189a2b92935..cfaa373a6e77 100644
--- a/arch/um/kernel/tt/process_kern.c
+++ b/arch/um/kernel/tt/process_kern.c
@@ -23,10 +23,11 @@
 #include "mem_user.h"
 #include "tlb.h"
 #include "mode.h"
+#include "mode_kern.h"
 #include "init.h"
 #include "tt.h"
 
-void *switch_to_tt(void *prev, void *next, void *last)
+void switch_to_tt(void *prev, void *next)
 {
         struct task_struct *from, *to, *prev_sched;
         unsigned long flags;
@@ -36,8 +37,6 @@ void *switch_to_tt(void *prev, void *next, void *last)
         from = prev;
         to = next;
 
-        to->thread.prev_sched = from;
-
         cpu = from->thread_info->cpu;
         if(cpu == 0)
                 forward_interrupts(to->thread.mode.tt.extern_pid);
@@ -53,7 +52,6 @@ void *switch_to_tt(void *prev, void *next, void *last)
         forward_pending_sigio(to->thread.mode.tt.extern_pid);
 
         c = 0;
-        set_current(to);
 
         err = os_write_file(to->thread.mode.tt.switch_pipe[1], &c, sizeof(c));
         if(err != sizeof(c))
@@ -85,8 +83,6 @@ void *switch_to_tt(void *prev, void *next, void *last)
 
         flush_tlb_all();
         local_irq_restore(flags);
-
-        return(current->thread.prev_sched);
 }
 
 void release_thread_tt(struct task_struct *task)
diff --git a/arch/um/kernel/tt/uaccess_user.c b/arch/um/kernel/tt/uaccess_user.c
index f01475512ecb..8c220f054b61 100644
--- a/arch/um/kernel/tt/uaccess_user.c
+++ b/arch/um/kernel/tt/uaccess_user.c
@@ -22,8 +22,15 @@ int __do_copy_from_user(void *to, const void *from, int n,
                                __do_copy, &faulted);
         TASK_REGS(get_current())->tt = save;
 
-        if(!faulted) return(0);
-        else return(n - (fault - (unsigned long) from));
+        if(!faulted)
+                return 0;
+        else if (fault)
+                return n - (fault - (unsigned long) from);
+        else
+                /* In case of a general protection fault, we don't have the
+                 * fault address, so NULL is used instead. Pretend we didn't
+                 * copy anything. */
+                return n;
 }
 
 static void __do_strncpy(void *dst, const void *src, int count)
diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c
index 09f6f7ce4695..93dc782dc1cc 100644
--- a/arch/um/kernel/um_arch.c
+++ b/arch/um/kernel/um_arch.c
@@ -334,6 +334,8 @@ int linux_main(int argc, char **argv)
                 add_arg(DEFAULT_COMMAND_LINE);
 
         os_early_checks();
+        if (force_tt)
+                clear_can_do_skas();
         mode_tt = force_tt ? 1 : !can_do_skas();
 #ifndef CONFIG_MODE_TT
         if (mode_tt) {
@@ -361,11 +363,6 @@ int linux_main(int argc, char **argv)
         uml_start = CHOOSE_MODE_PROC(set_task_sizes_tt, set_task_sizes_skas, 0,
                                      &host_task_size, &task_size);
 
-        /* Need to check this early because mmapping happens before the
-         * kernel is running.
-         */
-        check_tmpexec();
-
         brk_start = (unsigned long) sbrk(0);
         CHOOSE_MODE_PROC(before_mem_tt, before_mem_skas, brk_start);
         /* Increase physical memory size for exec-shield users
diff --git a/arch/um/kernel/umid.c b/arch/um/kernel/umid.c
index 186c28885016..0b21d59ba0cd 100644
--- a/arch/um/kernel/umid.c
+++ b/arch/um/kernel/umid.c
@@ -31,6 +31,8 @@ static char *uml_dir = UML_DIR;
 /* Changed by set_umid */
 static int umid_is_random = 1;
 static int umid_inited = 0;
+/* Have we created the files? Should we remove them? */
+static int umid_owned = 0;
 
 static int make_umid(int (*printer)(const char *fmt, ...));
 
@@ -82,20 +84,21 @@ int __init umid_file_name(char *name, char *buf, int len)
 
 extern int tracing_pid;
 
-static int __init create_pid_file(void)
+static void __init create_pid_file(void)
 {
         char file[strlen(uml_dir) + UMID_LEN + sizeof("/pid\0")];
         char pid[sizeof("nnnnn\0")];
         int fd, n;
 
-        if(umid_file_name("pid", file, sizeof(file))) return 0;
+        if(umid_file_name("pid", file, sizeof(file)))
+                return;
 
         fd = os_open_file(file, of_create(of_excl(of_rdwr(OPENFLAGS()))), 
                           0644);
         if(fd < 0){
                 printf("Open of machine pid file \"%s\" failed: %s\n",
                        file, strerror(-fd));
-                return 0;
+                return;
         }
 
         sprintf(pid, "%d\n", os_getpid());
@@ -103,7 +106,6 @@ static int __init create_pid_file(void)
         if(n != strlen(pid))
                 printf("Write of pid file failed - err = %d\n", -n);
         os_close_file(fd);
-        return 0;
 }
 
 static int actually_do_remove(char *dir)
@@ -147,7 +149,8 @@ static int actually_do_remove(char *dir)
 void remove_umid_dir(void)
 {
         char dir[strlen(uml_dir) + UMID_LEN + 1];
-        if(!umid_inited) return;
+        if (!umid_owned)
+                return;
 
         sprintf(dir, "%s%s", uml_dir, umid);
         actually_do_remove(dir);
@@ -155,11 +158,12 @@ void remove_umid_dir(void)
 
 char *get_umid(int only_if_set)
 {
-        if(only_if_set && umid_is_random) return(NULL);
-        return(umid);
+        if(only_if_set && umid_is_random)
+                return NULL;
+        return umid;
 }
 
-int not_dead_yet(char *dir)
+static int not_dead_yet(char *dir)
 {
         char file[strlen(uml_dir) + UMID_LEN + sizeof("/pid\0")];
         char pid[sizeof("nnnnn\0")], *end;
@@ -193,7 +197,8 @@ int not_dead_yet(char *dir)
                    (p == CHOOSE_MODE(tracing_pid, os_getpid())))
                         dead = 1;
         }
-        if(!dead) return(1);
+        if(!dead)
+                return(1);
         return(actually_do_remove(dir));
 }
 
@@ -232,16 +237,13 @@ static int __init make_uml_dir(void)
                 strlcpy(dir, home, sizeof(dir));
                 uml_dir++;
         }
+        strlcat(dir, uml_dir, sizeof(dir));
         len = strlen(dir);
-        strncat(dir, uml_dir, sizeof(dir) - len);
-        len = strlen(dir);
-        if((len > 0) && (len < sizeof(dir) - 1) && (dir[len - 1] != '/')){
-                dir[len] = '/';
-                dir[len + 1] = '\0';
-        }
+        if (len > 0 && dir[len - 1] != '/')
+                strlcat(dir, "/", sizeof(dir));
 
         uml_dir = malloc(strlen(dir) + 1);
-        if(uml_dir == NULL){
+        if (uml_dir == NULL) {
                 printf("make_uml_dir : malloc failed, errno = %d\n", errno);
                 exit(1);
         }
@@ -286,6 +288,7 @@ static int __init make_umid(int (*printer)(const char *fmt, ...))
                 if(errno == EEXIST){
                         if(not_dead_yet(tmp)){
                                 (*printer)("umid '%s' is in use\n", umid);
+                                umid_owned = 0;
                                 return(-1);
                         }
                         err = mkdir(tmp, 0777);
@@ -296,7 +299,8 @@ static int __init make_umid(int (*printer)(const char *fmt, ...))
                 return(-1);
         }
 
-        return(0);
+        umid_owned = 1;
+        return 0;
 }
 
 __uml_setup("uml_dir=", set_uml_dir,
@@ -309,7 +313,8 @@ static int __init make_umid_setup(void)
         /* one function with the ordering we need ... */
         make_uml_dir();
         make_umid(printf);
-        return create_pid_file();
+        create_pid_file();
+        return 0;
 }
 __uml_postsetup(make_umid_setup);
 
diff --git a/arch/um/kernel/user_util.c b/arch/um/kernel/user_util.c
index 954ff67cc8b3..41d17c71511c 100644
--- a/arch/um/kernel/user_util.c
+++ b/arch/um/kernel/user_util.c
@@ -109,18 +109,14 @@ int raw(int fd)
         int err;
 
         CATCH_EINTR(err = tcgetattr(fd, &tt));
-        if (err < 0) {
-                        printk("tcgetattr failed, errno = %d\n", errno);
-                return(-errno);
-        }
+        if(err < 0)
+                return -errno;
 
         cfmakeraw(&tt);
 
         CATCH_EINTR(err = tcsetattr(fd, TCSADRAIN, &tt));
-        if (err < 0) {
-                        printk("tcsetattr failed, errno = %d\n", errno);
-                return(-errno);
-        }
+        if(err < 0)
+                return -errno;
 
         /* XXX tcsetattr could have applied only some changes
          * (and cfmakeraw() is a set of changes) */
@@ -132,6 +128,12 @@ void setup_machinename(char *machine_out)
         struct utsname host;
 
         uname(&host);
+#if defined(UML_CONFIG_UML_X86) && !defined(UML_CONFIG_64BIT)
+        if (!strcmp(host.machine, "x86_64")) {
+                strcpy(machine_out, "i686");
+                return;
+        }
+#endif
         strcpy(machine_out, host.machine);
 }
 
diff --git a/arch/um/os-Linux/Makefile b/arch/um/os-Linux/Makefile
index 7a1662419c0c..d15ec2af6a22 100644
--- a/arch/um/os-Linux/Makefile
+++ b/arch/um/os-Linux/Makefile
@@ -3,11 +3,11 @@
 # Licensed under the GPL
 #
 
-obj-y = aio.o elf_aux.o file.o process.o signal.o start_up.o time.o tt.o \
-        tty.o user_syms.o drivers/ sys-$(SUBARCH)/
+obj-y = aio.o elf_aux.o file.o mem.o process.o signal.o start_up.o time.o \
+        tt.o tty.o user_syms.o drivers/ sys-$(SUBARCH)/
 
-USER_OBJS := aio.o elf_aux.o file.o process.o signal.o start_up.o time.o tt.o \
-        tty.o
+USER_OBJS := aio.o elf_aux.o file.o mem.o process.o signal.o start_up.o \
+        time.o tt.o tty.o
 
 elf_aux.o: $(ARCH_DIR)/kernel-offsets.h
 CFLAGS_elf_aux.o += -I$(objtree)/arch/um
diff --git a/arch/um/os-Linux/aio.c b/arch/um/os-Linux/aio.c
index b04897cd995d..f6e64026f995 100644
--- a/arch/um/os-Linux/aio.c
+++ b/arch/um/os-Linux/aio.c
@@ -117,6 +117,8 @@ static int do_aio(aio_context_t ctx, struct aio_context *aio)
         err = io_submit(ctx, 1, &iocbp);
         if(err > 0)
                 err = 0;
+        else
+                err = -errno;
 
  out:
         return err;
@@ -142,7 +144,8 @@ static int aio_thread(void *arg)
                                "errno = %d\n", errno);
                 }
                 else {
-                        aio = (struct aio_context *) event.data;
+                        /* This is safe as we've just a pointer here. */
+                        aio = (struct aio_context *) (long) event.data;
                         if(update_aio(aio, event.res)){
                                 do_aio(ctx, aio);
                                 continue;
@@ -313,15 +316,16 @@ static int init_aio_26(void)
         int err;
 
         if(io_setup(256, &ctx)){
+                err = -errno;
                 printk("aio_thread failed to initialize context, err = %d\n",
                        errno);
-                return -errno;
+                return err;
         }
 
         err = run_helper_thread(aio_thread, NULL,
                                 CLONE_FILES | CLONE_VM | SIGCHLD, &stack, 0);
         if(err < 0)
-                return -errno;
+                return err;
 
         aio_pid = err;
 
diff --git a/arch/um/os-Linux/drivers/tuntap_user.c b/arch/um/os-Linux/drivers/tuntap_user.c
index 4b83c6c3f48d..4ba9b17adf13 100644
--- a/arch/um/os-Linux/drivers/tuntap_user.c
+++ b/arch/um/os-Linux/drivers/tuntap_user.c
@@ -75,7 +75,7 @@ static int tuntap_open_tramp(char *gate, int *fd_out, int me, int remote,
         struct msghdr msg;
         struct cmsghdr *cmsg;
         struct iovec iov;
-        int pid, n;
+        int pid, n, err;
 
         sprintf(version_buf, "%d", UML_NET_VERSION);
 
@@ -105,9 +105,10 @@ static int tuntap_open_tramp(char *gate, int *fd_out, int me, int remote,
         n = recvmsg(me, &msg, 0);
         *used_out = n;
         if(n < 0){
+                err = -errno;
                 printk("tuntap_open_tramp : recvmsg failed - errno = %d\n", 
                        errno);
-                return(-errno);
+                return err;
         }
         CATCH_EINTR(waitpid(pid, NULL, 0));
 
@@ -147,9 +148,10 @@ static int tuntap_open(void *data)
                 ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
                 strlcpy(ifr.ifr_name, pri->dev_name, sizeof(ifr.ifr_name));
                 if(ioctl(pri->fd, TUNSETIFF, (void *) &ifr) < 0){
+                        err = -errno;
                         printk("TUNSETIFF failed, errno = %d\n", errno);
                         os_close_file(pri->fd);
-                        return(-errno);
+                        return err;
                 }
         }
         else {
diff --git a/arch/um/os-Linux/elf_aux.c b/arch/um/os-Linux/elf_aux.c
index 1399520a8588..5a99dd3fbed0 100644
--- a/arch/um/os-Linux/elf_aux.c
+++ b/arch/um/os-Linux/elf_aux.c
@@ -12,9 +12,10 @@
 #include "init.h"
 #include "elf_user.h"
 #include "mem_user.h"
-#include <kernel-offsets.h>
+#include <kern_constants.h>
 
-#if HOST_ELF_CLASS == ELFCLASS32
+/* Use the one from the kernel - the host may miss it, if having old headers. */
+#if UM_ELF_CLASS == UM_ELFCLASS32
 typedef Elf32_auxv_t elf_auxv_t;
 #else
 typedef Elf64_auxv_t elf_auxv_t;
@@ -54,7 +55,8 @@ __init void scan_elf_aux( char **envp)
                                  * a_un, so we have to use a_val, which is
                                  * all that's left.
                                  */
-                                elf_aux_platform = (char *) auxv->a_un.a_val;
+                                elf_aux_platform =
+                                        (char *) (long) auxv->a_un.a_val;
                                 break;
                         case AT_PAGESZ:
                                 page_size = auxv->a_un.a_val;
diff --git a/arch/um/os-Linux/file.c b/arch/um/os-Linux/file.c
index fd45bb260907..f55773c819e6 100644
--- a/arch/um/os-Linux/file.c
+++ b/arch/um/os-Linux/file.c
@@ -119,15 +119,11 @@ int os_window_size(int fd, int *rows, int *cols)
 
 int os_new_tty_pgrp(int fd, int pid)
 {
-        if(ioctl(fd, TIOCSCTTY, 0) < 0){
-                printk("TIOCSCTTY failed, errno = %d\n", errno);
-                return(-errno);
-        }
+        if(ioctl(fd, TIOCSCTTY, 0) < 0)
+                return -errno;
 
-        if(tcsetpgrp(fd, pid) < 0){
-                printk("tcsetpgrp failed, errno = %d\n", errno);
-                return(-errno);
-        }
+        if(tcsetpgrp(fd, pid) < 0)
+                return -errno;
 
         return(0);
 }
@@ -146,18 +142,12 @@ int os_set_slip(int fd)
         int disc, sencap;
 
         disc = N_SLIP;
-        if(ioctl(fd, TIOCSETD, &disc) < 0){
-                printk("Failed to set slip line discipline - "
-                       "errno = %d\n", errno);
-                return(-errno);
-        }
+        if(ioctl(fd, TIOCSETD, &disc) < 0)
+                return -errno;
 
         sencap = 0;
-        if(ioctl(fd, SIOCSIFENCAP, &sencap) < 0){
-                printk("Failed to set slip encapsulation - "
-                       "errno = %d\n", errno);
-                return(-errno);
-        }
+        if(ioctl(fd, SIOCSIFENCAP, &sencap) < 0)
+                return -errno;
 
         return(0);
 }
@@ -180,22 +170,15 @@ int os_sigio_async(int master, int slave)
         int flags;
 
         flags = fcntl(master, F_GETFL);
-        if(flags < 0) {
-                printk("fcntl F_GETFL failed, errno = %d\n", errno);
-                return(-errno);
-        }
+        if(flags < 0)
+                return errno;
 
         if((fcntl(master, F_SETFL, flags | O_NONBLOCK | O_ASYNC) < 0) ||
-           (fcntl(master, F_SETOWN, os_getpid()) < 0)){
-                printk("fcntl F_SETFL or F_SETOWN failed, errno = %d\n",
-                       errno);
-                return(-errno);
-        }
+           (fcntl(master, F_SETOWN, os_getpid()) < 0))
+                return -errno;
 
-        if((fcntl(slave, F_SETFL, flags | O_NONBLOCK) < 0)){
-                printk("fcntl F_SETFL failed, errno = %d\n", errno);
-                return(-errno);
-        }
+        if((fcntl(slave, F_SETFL, flags | O_NONBLOCK) < 0))
+                return -errno;
 
         return(0);
 }
@@ -255,7 +238,7 @@ int os_file_mode(char *file, struct openflags *mode_out)
 
 int os_open_file(char *file, struct openflags flags, int mode)
 {
-        int fd, f = 0;
+        int fd, err, f = 0;
 
         if(flags.r && flags.w) f = O_RDWR;
         else if(flags.r) f = O_RDONLY;
@@ -272,8 +255,9 @@ int os_open_file(char *file, struct openflags flags, int mode)
                 return(-errno);
 
         if(flags.cl && fcntl(fd, F_SETFD, 1)){
+                err = -errno;
                 os_close_file(fd);
-                return(-errno);
+                return err;
         }
 
         return(fd);
@@ -383,9 +367,9 @@ int os_file_size(char *file, unsigned long long *size_out)
                         return(fd);
                 }
                 if(ioctl(fd, BLKGETSIZE, &blocks) < 0){
+                        err = -errno;
                         printk("Couldn't get the block size of \"%s\", "
                                "errno = %d\n", file, errno);
-                        err = -errno;
                         os_close_file(fd);
                         return(err);
                 }
@@ -473,11 +457,14 @@ int os_pipe(int *fds, int stream, int close_on_exec)
 
 int os_set_fd_async(int fd, int owner)
 {
+        int err;
+
         /* XXX This should do F_GETFL first */
         if(fcntl(fd, F_SETFL, O_ASYNC | O_NONBLOCK) < 0){
+                err = -errno;
                 printk("os_set_fd_async : failed to set O_ASYNC and "
                        "O_NONBLOCK on fd # %d, errno = %d\n", fd, errno);
-                return(-errno);
+                return err;
         }
 #ifdef notdef
         if(fcntl(fd, F_SETFD, 1) < 0){
@@ -488,10 +475,11 @@ int os_set_fd_async(int fd, int owner)
 
         if((fcntl(fd, F_SETSIG, SIGIO) < 0) ||
            (fcntl(fd, F_SETOWN, owner) < 0)){
+                err = -errno;
                 printk("os_set_fd_async : Failed to fcntl F_SETOWN "
                        "(or F_SETSIG) fd %d to pid %d, errno = %d\n", fd, 
                        owner, errno);
-                return(-errno);
+                return err;
         }
 
         return(0);
@@ -516,11 +504,9 @@ int os_set_fd_block(int fd, int blocking)
         if(blocking) flags &= ~O_NONBLOCK;
         else flags |= O_NONBLOCK;
 
-        if(fcntl(fd, F_SETFL, flags) < 0){
-                printk("Failed to change blocking on fd # %d, errno = %d\n",
-                       fd, errno);
-                return(-errno);
-        }
+        if(fcntl(fd, F_SETFL, flags) < 0)
+                return -errno;
+
         return(0);
 }
 
@@ -609,11 +595,8 @@ int os_create_unix_socket(char *file, int len, int close_on_exec)
         int sock, err;
 
         sock = socket(PF_UNIX, SOCK_DGRAM, 0);
-        if (sock < 0){
-                printk("create_unix_socket - socket failed, errno = %d\n",
-                       errno);
-                return(-errno);
-        }
+        if(sock < 0)
+                return -errno;
 
         if(close_on_exec) {
                 err = os_set_exec_close(sock, 1);
@@ -628,11 +611,8 @@ int os_create_unix_socket(char *file, int len, int close_on_exec)
         snprintf(addr.sun_path, len, "%s", file);
 
         err = bind(sock, (struct sockaddr *) &addr, sizeof(addr));
-        if (err < 0){
-                printk("create_listening_socket at '%s' - bind failed, "
-                       "errno = %d\n", file, errno);
-                return(-errno);
-        }
+        if(err < 0)
+                return -errno;
 
         return(sock);
 }
diff --git a/arch/um/os-Linux/mem.c b/arch/um/os-Linux/mem.c
new file mode 100644
index 000000000000..8e71edaaf80b
--- /dev/null
+++ b/arch/um/os-Linux/mem.c
@@ -0,0 +1,161 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stddef.h>
+#include <stdarg.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/mman.h>
+#include "kern_util.h"
+#include "user.h"
+#include "user_util.h"
+#include "mem_user.h"
+#include "init.h"
+#include "os.h"
+#include "tempfile.h"
+#include "kern_constants.h"
+
+#include <sys/param.h>
+
+static char *tempdir = NULL;
+
+static void __init find_tempdir(void)
+{
+        char *dirs[] = { "TMP", "TEMP", "TMPDIR", NULL };
+        int i;
+        char *dir = NULL;
+
+        if(tempdir != NULL) return;     /* We've already been called */
+        for(i = 0; dirs[i]; i++){
+                dir = getenv(dirs[i]);
+                if((dir != NULL) && (*dir != '\0'))
+                        break;
+        }
+        if((dir == NULL) || (*dir == '\0'))
+                dir = "/tmp";
+
+        tempdir = malloc(strlen(dir) + 2);
+        if(tempdir == NULL){
+                fprintf(stderr, "Failed to malloc tempdir, "
+                        "errno = %d\n", errno);
+                return;
+        }
+        strcpy(tempdir, dir);
+        strcat(tempdir, "/");
+}
+
+/*
+ * This proc still used in tt-mode
+ * (file: kernel/tt/ptproxy/proxy.c, proc: start_debugger).
+ * So it isn't 'static' yet.
+ */
+int make_tempfile(const char *template, char **out_tempname, int do_unlink)
+{
+        char tempname[MAXPATHLEN];
+        int fd;
+
+        find_tempdir();
+        if (*template != '/')
+                strcpy(tempname, tempdir);
+        else
+                *tempname = 0;
+        strcat(tempname, template);
+        fd = mkstemp(tempname);
+        if(fd < 0){
+                fprintf(stderr, "open - cannot create %s: %s\n", tempname,
+                        strerror(errno));
+                return -1;
+        }
+        if(do_unlink && (unlink(tempname) < 0)){
+                perror("unlink");
+                return -1;
+        }
+        if(out_tempname){
+                *out_tempname = strdup(tempname);
+                if(*out_tempname == NULL){
+                        perror("strdup");
+                        return -1;
+                }
+        }
+        return(fd);
+}
+
+#define TEMPNAME_TEMPLATE "vm_file-XXXXXX"
+
+/*
+ * This proc is used in start_up.c
+ * So it isn't 'static'.
+ */
+int create_tmp_file(unsigned long len)
+{
+        int fd, err;
+        char zero;
+
+        fd = make_tempfile(TEMPNAME_TEMPLATE, NULL, 1);
+        if(fd < 0) {
+                exit(1);
+        }
+
+        err = fchmod(fd, 0777);
+        if(err < 0){
+                perror("os_mode_fd");
+                exit(1);
+        }
+
+        if (lseek64(fd, len, SEEK_SET) < 0) {
+                perror("os_seek_file");
+                exit(1);
+        }
+
+        zero = 0;
+
+        err = os_write_file(fd, &zero, 1);
+        if(err != 1){
+                errno = -err;
+                perror("os_write_file");
+                exit(1);
+        }
+
+        return(fd);
+}
+
+static int create_anon_file(unsigned long len)
+{
+        void *addr;
+        int fd;
+
+        fd = open("/dev/anon", O_RDWR);
+        if(fd < 0) {
+                perror("opening /dev/anon");
+                exit(1);
+        }
+
+        addr = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+        if(addr == MAP_FAILED){
+                perror("mapping physmem file");
+                exit(1);
+        }
+        munmap(addr, len);
+
+        return(fd);
+}
+
+extern int have_devanon;
+
+int create_mem_file(unsigned long len)
+{
+        int err, fd;
+
+        if(have_devanon)
+                fd = create_anon_file(len);
+        else fd = create_tmp_file(len);
+
+        err = os_set_exec_close(fd, 1);
+        if(err < 0){
+                errno = -err;
+                perror("exec_close");
+        }
+        return(fd);
+}
diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
index d32413e4b4ce..d9c52387c4a1 100644
--- a/arch/um/os-Linux/process.c
+++ b/arch/um/os-Linux/process.c
@@ -3,6 +3,7 @@
  * Licensed under the GPL
  */
 
+#include <unistd.h>
 #include <stdio.h>
 #include <errno.h>
 #include <signal.h>
diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
index 040cc1472bc7..6af83171ca4e 100644
--- a/arch/um/os-Linux/start_up.c
+++ b/arch/um/os-Linux/start_up.c
@@ -4,18 +4,22 @@
  */
 
 #include <stdio.h>
+#include <stddef.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
 #include <unistd.h>
 #include <signal.h>
 #include <sched.h>
+#include <fcntl.h>
 #include <errno.h>
-#include <stdarg.h>
-#include <stdlib.h>
 #include <setjmp.h>
 #include <sys/time.h>
 #include <sys/wait.h>
 #include <sys/mman.h>
 #include <asm/unistd.h>
 #include <asm/page.h>
+#include <sys/types.h>
 #include "user_util.h"
 #include "kern_util.h"
 #include "user.h"
@@ -25,6 +29,7 @@
 #include "sysdep/sigcontext.h"
 #include "irq_user.h"
 #include "ptrace_user.h"
+#include "mem_user.h"
 #include "time_user.h"
 #include "init.h"
 #include "os.h"
@@ -32,6 +37,8 @@
 #include "choose-mode.h"
 #include "mode.h"
 #include "tempfile.h"
+#include "kern_constants.h"
+
 #ifdef UML_CONFIG_MODE_SKAS
 #include "skas.h"
 #include "skas_ptrace.h"
@@ -276,9 +283,38 @@ static void __init check_ptrace(void)
         check_sysemu();
 }
 
+extern int create_tmp_file(unsigned long len);
+
+static void check_tmpexec(void)
+{
+        void *addr;
+        int err, fd = create_tmp_file(UM_KERN_PAGE_SIZE);
+
+        addr = mmap(NULL, UM_KERN_PAGE_SIZE,
+                    PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE, fd, 0);
+        printf("Checking PROT_EXEC mmap in /tmp...");
+        fflush(stdout);
+        if(addr == MAP_FAILED){
+                err = errno;
+                perror("failed");
+                if(err == EPERM)
+                        printf("/tmp must be not mounted noexec\n");
+                exit(1);
+        }
+        printf("OK\n");
+        munmap(addr, UM_KERN_PAGE_SIZE);
+
+        close(fd);
+}
+
 void os_early_checks(void)
 {
         check_ptrace();
+
+        /* Need to check this early because mmapping happens before the
+         * kernel is running.
+         */
+        check_tmpexec();
 }
 
 static int __init noprocmm_cmd_param(char *str, int* add)
@@ -357,3 +393,72 @@ int can_do_skas(void)
         return(0);
 }
 #endif
+
+int have_devanon = 0;
+
+void check_devanon(void)
+{
+        int fd;
+
+        printk("Checking for /dev/anon on the host...");
+        fd = open("/dev/anon", O_RDWR);
+        if(fd < 0){
+                printk("Not available (open failed with errno %d)\n", errno);
+                return;
+        }
+
+        printk("OK\n");
+        have_devanon = 1;
+}
+
+int __init parse_iomem(char *str, int *add)
+{
+        struct iomem_region *new;
+        struct uml_stat buf;
+        char *file, *driver;
+        int fd, err, size;
+
+        driver = str;
+        file = strchr(str,',');
+        if(file == NULL){
+                printf("parse_iomem : failed to parse iomem\n");
+                goto out;
+        }
+        *file = '\0';
+        file++;
+        fd = os_open_file(file, of_rdwr(OPENFLAGS()), 0);
+        if(fd < 0){
+                os_print_error(fd, "parse_iomem - Couldn't open io file");
+                goto out;
+        }
+
+        err = os_stat_fd(fd, &buf);
+        if(err < 0){
+                os_print_error(err, "parse_iomem - cannot stat_fd file");
+                goto out_close;
+        }
+
+        new = malloc(sizeof(*new));
+        if(new == NULL){
+                perror("Couldn't allocate iomem_region struct");
+                goto out_close;
+        }
+
+        size = (buf.ust_size + UM_KERN_PAGE_SIZE) & ~(UM_KERN_PAGE_SIZE - 1);
+
+        *new = ((struct iomem_region) { .next           = iomem_regions,
+                                        .driver         = driver,
+                                        .fd             = fd,
+                                        .size           = size,
+                                        .phys           = 0,
+                                        .virt           = 0 });
+        iomem_regions = new;
+        iomem_size += new->size + UM_KERN_PAGE_SIZE;
+
+        return(0);
+ out_close:
+        os_close_file(fd);
+ out:
+        return(1);
+}
+
diff --git a/arch/um/os-Linux/tt.c b/arch/um/os-Linux/tt.c
index 5b047ab8416a..a6db8877931a 100644
--- a/arch/um/os-Linux/tt.c
+++ b/arch/um/os-Linux/tt.c
@@ -36,6 +36,20 @@
 #include "mode.h"
 #include "tempfile.h"
 
+int protect_memory(unsigned long addr, unsigned long len, int r, int w, int x,
+                   int must_succeed)
+{
+        int err;
+
+        err = os_protect_memory((void *) addr, len, r, w, x);
+        if(err < 0){
+                if(must_succeed)
+                        panic("protect failed, err = %d", -err);
+                else return(err);
+        }
+        return(0);
+}
+
 /*
  *-------------------------
  * only for tt mode (will be deleted in future...)
diff --git a/arch/um/os-Linux/util/Makefile b/arch/um/os-Linux/util/Makefile
deleted file mode 100644
index 9778aed0c314..000000000000
--- a/arch/um/os-Linux/util/Makefile
+++ /dev/null
@@ -1,4 +0,0 @@
-hostprogs-y             := mk_user_constants
-always                  := $(hostprogs-y)
-
-HOSTCFLAGS_mk_user_constants.o := -I$(objtree)/arch/um
diff --git a/arch/um/os-Linux/util/mk_user_constants.c b/arch/um/os-Linux/util/mk_user_constants.c
deleted file mode 100644
index 4838f30eecf0..000000000000
--- a/arch/um/os-Linux/util/mk_user_constants.c
+++ /dev/null
@@ -1,23 +0,0 @@
-#include <stdio.h>
-#include <user-offsets.h>
-
-int main(int argc, char **argv)
-{
-  printf("/*\n");
-  printf(" * Generated by mk_user_constants\n");
-  printf(" */\n");
-  printf("\n");
-  printf("#ifndef __UM_USER_CONSTANTS_H\n");
-  printf("#define __UM_USER_CONSTANTS_H\n");
-  printf("\n");
-  /* I'd like to use FRAME_SIZE from ptrace.h here, but that's wrong on
-   * x86_64 (216 vs 168 bytes).  user_regs_struct is the correct size on
-   * both x86_64 and i386.
-   */
-  printf("#define UM_FRAME_SIZE %d\n", __UM_FRAME_SIZE);
-
-  printf("\n");
-  printf("#endif\n");
-
-  return(0);
-}
diff --git a/arch/um/sys-i386/Makefile b/arch/um/sys-i386/Makefile
index 4ca2a229da49..6dfeb70f6957 100644
--- a/arch/um/sys-i386/Makefile
+++ b/arch/um/sys-i386/Makefile
@@ -18,6 +18,4 @@ module.c-dir = kernel
 
 $(obj)/stub_segv.o : _c_flags = $(call unprofile,$(CFLAGS))
 
-subdir- := util
-
 include arch/um/scripts/Makefile.unmap
diff --git a/arch/um/sys-i386/kernel-offsets.c b/arch/um/sys-i386/kernel-offsets.c
index a1070af2bcd8..35db85057506 100644
--- a/arch/um/sys-i386/kernel-offsets.c
+++ b/arch/um/sys-i386/kernel-offsets.c
@@ -18,9 +18,9 @@
 
 void foo(void)
 {
-        OFFSET(TASK_DEBUGREGS, task_struct, thread.arch.debugregs);
+        OFFSET(HOST_TASK_DEBUGREGS, task_struct, thread.arch.debugregs);
 #ifdef CONFIG_MODE_TT
-        OFFSET(TASK_EXTERN_PID, task_struct, thread.mode.tt.extern_pid);
+        OFFSET(HOST_TASK_EXTERN_PID, task_struct, thread.mode.tt.extern_pid);
 #endif
 #include <common-offsets.h>
 }
diff --git a/arch/um/sys-i386/ldt.c b/arch/um/sys-i386/ldt.c
index bd3c34aa52e5..36b5c2c13289 100644
--- a/arch/um/sys-i386/ldt.c
+++ b/arch/um/sys-i386/ldt.c
@@ -83,6 +83,7 @@ int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount)
                         goto out;
                 }
                 p = buf;
+                break;
         default:
                 res = -ENOSYS;
                 goto out;
diff --git a/arch/um/sys-i386/user-offsets.c b/arch/um/sys-i386/user-offsets.c
index 3ceaabceb3d7..677fc26a9bbe 100644
--- a/arch/um/sys-i386/user-offsets.c
+++ b/arch/um/sys-i386/user-offsets.c
@@ -7,47 +7,48 @@
 #define DEFINE(sym, val) \
         asm volatile("\n->" #sym " %0 " #val : : "i" (val))
 
+#define DEFINE_LONGS(sym, val) \
+        asm volatile("\n->" #sym " %0 " #val : : "i" (val/sizeof(unsigned long)))
+
 #define OFFSET(sym, str, mem) \
         DEFINE(sym, offsetof(struct str, mem));
 
 void foo(void)
 {
-        OFFSET(SC_IP, sigcontext, eip);
-        OFFSET(SC_SP, sigcontext, esp);
-        OFFSET(SC_FS, sigcontext, fs);
-        OFFSET(SC_GS, sigcontext, gs);
-        OFFSET(SC_DS, sigcontext, ds);
-        OFFSET(SC_ES, sigcontext, es);
-        OFFSET(SC_SS, sigcontext, ss);
-        OFFSET(SC_CS, sigcontext, cs);
-        OFFSET(SC_EFLAGS, sigcontext, eflags);
-        OFFSET(SC_EAX, sigcontext, eax);
-        OFFSET(SC_EBX, sigcontext, ebx);
-        OFFSET(SC_ECX, sigcontext, ecx);
-        OFFSET(SC_EDX, sigcontext, edx);
-        OFFSET(SC_EDI, sigcontext, edi);
-        OFFSET(SC_ESI, sigcontext, esi);
-        OFFSET(SC_EBP, sigcontext, ebp);
-        OFFSET(SC_TRAPNO, sigcontext, trapno);
-        OFFSET(SC_ERR, sigcontext, err);
-        OFFSET(SC_CR2, sigcontext, cr2);
-        OFFSET(SC_FPSTATE, sigcontext, fpstate);
-        OFFSET(SC_SIGMASK, sigcontext, oldmask);
-        OFFSET(SC_FP_CW, _fpstate, cw);
-        OFFSET(SC_FP_SW, _fpstate, sw);
-        OFFSET(SC_FP_TAG, _fpstate, tag);
-        OFFSET(SC_FP_IPOFF, _fpstate, ipoff);
-        OFFSET(SC_FP_CSSEL, _fpstate, cssel);
-        OFFSET(SC_FP_DATAOFF, _fpstate, dataoff);
-        OFFSET(SC_FP_DATASEL, _fpstate, datasel);
-        OFFSET(SC_FP_ST, _fpstate, _st);
-        OFFSET(SC_FXSR_ENV, _fpstate, _fxsr_env);
+        OFFSET(HOST_SC_IP, sigcontext, eip);
+        OFFSET(HOST_SC_SP, sigcontext, esp);
+        OFFSET(HOST_SC_FS, sigcontext, fs);
+        OFFSET(HOST_SC_GS, sigcontext, gs);
+        OFFSET(HOST_SC_DS, sigcontext, ds);
+        OFFSET(HOST_SC_ES, sigcontext, es);
+        OFFSET(HOST_SC_SS, sigcontext, ss);
+        OFFSET(HOST_SC_CS, sigcontext, cs);
+        OFFSET(HOST_SC_EFLAGS, sigcontext, eflags);
+        OFFSET(HOST_SC_EAX, sigcontext, eax);
+        OFFSET(HOST_SC_EBX, sigcontext, ebx);
+        OFFSET(HOST_SC_ECX, sigcontext, ecx);
+        OFFSET(HOST_SC_EDX, sigcontext, edx);
+        OFFSET(HOST_SC_EDI, sigcontext, edi);
+        OFFSET(HOST_SC_ESI, sigcontext, esi);
+        OFFSET(HOST_SC_EBP, sigcontext, ebp);
+        OFFSET(HOST_SC_TRAPNO, sigcontext, trapno);
+        OFFSET(HOST_SC_ERR, sigcontext, err);
+        OFFSET(HOST_SC_CR2, sigcontext, cr2);
+        OFFSET(HOST_SC_FPSTATE, sigcontext, fpstate);
+        OFFSET(HOST_SC_SIGMASK, sigcontext, oldmask);
+        OFFSET(HOST_SC_FP_CW, _fpstate, cw);
+        OFFSET(HOST_SC_FP_SW, _fpstate, sw);
+        OFFSET(HOST_SC_FP_TAG, _fpstate, tag);
+        OFFSET(HOST_SC_FP_IPOFF, _fpstate, ipoff);
+        OFFSET(HOST_SC_FP_CSSEL, _fpstate, cssel);
+        OFFSET(HOST_SC_FP_DATAOFF, _fpstate, dataoff);
+        OFFSET(HOST_SC_FP_DATASEL, _fpstate, datasel);
+        OFFSET(HOST_SC_FP_ST, _fpstate, _st);
+        OFFSET(HOST_SC_FXSR_ENV, _fpstate, _fxsr_env);
 
-        DEFINE(HOST_FRAME_SIZE, FRAME_SIZE);
-        DEFINE(HOST_FP_SIZE,
-                sizeof(struct user_i387_struct) / sizeof(unsigned long));
-        DEFINE(HOST_XFP_SIZE,
-               sizeof(struct user_fxsr_struct) / sizeof(unsigned long));
+        DEFINE_LONGS(HOST_FRAME_SIZE, FRAME_SIZE);
+        DEFINE_LONGS(HOST_FP_SIZE, sizeof(struct user_i387_struct));
+        DEFINE_LONGS(HOST_XFP_SIZE, sizeof(struct user_fxsr_struct));
 
         DEFINE(HOST_IP, EIP);
         DEFINE(HOST_SP, UESP);
@@ -65,5 +66,5 @@ void foo(void)
         DEFINE(HOST_FS, FS);
         DEFINE(HOST_ES, ES);
         DEFINE(HOST_GS, GS);
-        DEFINE(__UM_FRAME_SIZE, sizeof(struct user_regs_struct));
+        DEFINE(UM_FRAME_SIZE, sizeof(struct user_regs_struct));
 }
diff --git a/arch/um/sys-i386/util/Makefile b/arch/um/sys-i386/util/Makefile
deleted file mode 100644
index bf61afd0b045..000000000000
--- a/arch/um/sys-i386/util/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-hostprogs-y     := mk_sc mk_thread
-always          := $(hostprogs-y)
-
-HOSTCFLAGS_mk_sc.o := -I$(objtree)/arch/um
-HOSTCFLAGS_mk_thread.o := -I$(objtree)/arch/um
diff --git a/arch/um/sys-i386/util/mk_sc.c b/arch/um/sys-i386/util/mk_sc.c
deleted file mode 100644
index 04c0d73433aa..000000000000
--- a/arch/um/sys-i386/util/mk_sc.c
+++ /dev/null
@@ -1,51 +0,0 @@
-#include <stdio.h>
-#include <user-offsets.h>
-
-#define SC_OFFSET(name, field) \
-  printf("#define " #name "(sc) *((unsigned long *) &(((char *) (sc))[%d]))\n",\
-         name)
-
-#define SC_FP_OFFSET(name, field) \
-  printf("#define " #name \
-         "(sc) *((unsigned long *) &(((char *) (SC_FPSTATE(sc)))[%d]))\n",\
-         name)
-
-#define SC_FP_OFFSET_PTR(name, field, type) \
-  printf("#define " #name \
-         "(sc) ((" type " *) &(((char *) (SC_FPSTATE(sc)))[%d]))\n",\
-         name)
-
-int main(int argc, char **argv)
-{
-  SC_OFFSET(SC_IP, eip);
-  SC_OFFSET(SC_SP, esp);
-  SC_OFFSET(SC_FS, fs);
-  SC_OFFSET(SC_GS, gs);
-  SC_OFFSET(SC_DS, ds);
-  SC_OFFSET(SC_ES, es);
-  SC_OFFSET(SC_SS, ss);
-  SC_OFFSET(SC_CS, cs);
-  SC_OFFSET(SC_EFLAGS, eflags);
-  SC_OFFSET(SC_EAX, eax);
-  SC_OFFSET(SC_EBX, ebx);
-  SC_OFFSET(SC_ECX, ecx);
-  SC_OFFSET(SC_EDX, edx);
-  SC_OFFSET(SC_EDI, edi);
-  SC_OFFSET(SC_ESI, esi);
-  SC_OFFSET(SC_EBP, ebp);
-  SC_OFFSET(SC_TRAPNO, trapno);
-  SC_OFFSET(SC_ERR, err);
-  SC_OFFSET(SC_CR2, cr2);
-  SC_OFFSET(SC_FPSTATE, fpstate);
-  SC_OFFSET(SC_SIGMASK, oldmask);
-  SC_FP_OFFSET(SC_FP_CW, cw);
-  SC_FP_OFFSET(SC_FP_SW, sw);
-  SC_FP_OFFSET(SC_FP_TAG, tag);
-  SC_FP_OFFSET(SC_FP_IPOFF, ipoff);
-  SC_FP_OFFSET(SC_FP_CSSEL, cssel);
-  SC_FP_OFFSET(SC_FP_DATAOFF, dataoff);
-  SC_FP_OFFSET(SC_FP_DATASEL, datasel);
-  SC_FP_OFFSET_PTR(SC_FP_ST, _st, "struct _fpstate");
-  SC_FP_OFFSET_PTR(SC_FXSR_ENV, _fxsr_env, "void");
-  return(0);
-}
diff --git a/arch/um/sys-i386/util/mk_thread.c b/arch/um/sys-i386/util/mk_thread.c
deleted file mode 100644
index 7470d0dda67e..000000000000
--- a/arch/um/sys-i386/util/mk_thread.c
+++ /dev/null
@@ -1,22 +0,0 @@
-#include <stdio.h>
-#include <kernel-offsets.h>
-
-int main(int argc, char **argv)
-{
-  printf("/*\n");
-  printf(" * Generated by mk_thread\n");
-  printf(" */\n");
-  printf("\n");
-  printf("#ifndef __UM_THREAD_H\n");
-  printf("#define __UM_THREAD_H\n");
-  printf("\n");
-  printf("#define TASK_DEBUGREGS(task) ((unsigned long *) "
-         "&(((char *) (task))[%d]))\n", TASK_DEBUGREGS);
-#ifdef TASK_EXTERN_PID
-  printf("#define TASK_EXTERN_PID(task) *((int *) &(((char *) (task))[%d]))\n",
-         TASK_EXTERN_PID);
-#endif
-  printf("\n");
-  printf("#endif\n");
-  return(0);
-}
diff --git a/arch/um/sys-x86_64/Makefile b/arch/um/sys-x86_64/Makefile
index f0ab574d1e95..06c3633457a2 100644
--- a/arch/um/sys-x86_64/Makefile
+++ b/arch/um/sys-x86_64/Makefile
@@ -29,6 +29,4 @@ module.c-dir = kernel
 
 $(obj)/stub_segv.o: _c_flags = $(call unprofile,$(CFLAGS))
 
-subdir- := util
-
 include arch/um/scripts/Makefile.unmap
diff --git a/arch/um/sys-x86_64/kernel-offsets.c b/arch/um/sys-x86_64/kernel-offsets.c
index 998541eade41..bfcb104b846e 100644
--- a/arch/um/sys-x86_64/kernel-offsets.c
+++ b/arch/um/sys-x86_64/kernel-offsets.c
@@ -19,7 +19,7 @@
 void foo(void)
 {
 #ifdef CONFIG_MODE_TT
-        OFFSET(TASK_EXTERN_PID, task_struct, thread.mode.tt.extern_pid);
+        OFFSET(HOST_TASK_EXTERN_PID, task_struct, thread.mode.tt.extern_pid);
 #endif
 #include <common-offsets.h>
 }
diff --git a/arch/um/sys-x86_64/user-offsets.c b/arch/um/sys-x86_64/user-offsets.c
index 513d17ceafd4..5a585bfbb8c2 100644
--- a/arch/um/sys-x86_64/user-offsets.c
+++ b/arch/um/sys-x86_64/user-offsets.c
@@ -16,71 +16,76 @@ typedef __u32 u32;
 #define DEFINE(sym, val) \
         asm volatile("\n->" #sym " %0 " #val : : "i" (val))
 
+#define DEFINE_LONGS(sym, val) \
+        asm volatile("\n->" #sym " %0 " #val : : "i" (val/sizeof(unsigned long)))
+
 #define OFFSET(sym, str, mem) \
         DEFINE(sym, offsetof(struct str, mem));
 
 void foo(void)
 {
-        OFFSET(SC_RBX, sigcontext, rbx);
-        OFFSET(SC_RCX, sigcontext, rcx);
-        OFFSET(SC_RDX, sigcontext, rdx);
-        OFFSET(SC_RSI, sigcontext, rsi);
-        OFFSET(SC_RDI, sigcontext, rdi);
-        OFFSET(SC_RBP, sigcontext, rbp);
-        OFFSET(SC_RAX, sigcontext, rax);
-        OFFSET(SC_R8, sigcontext, r8);
-        OFFSET(SC_R9, sigcontext, r9);
-        OFFSET(SC_R10, sigcontext, r10);
-        OFFSET(SC_R11, sigcontext, r11);
-        OFFSET(SC_R12, sigcontext, r12);
-        OFFSET(SC_R13, sigcontext, r13);
-        OFFSET(SC_R14, sigcontext, r14);
-        OFFSET(SC_R15, sigcontext, r15);
-        OFFSET(SC_IP, sigcontext, rip);
-        OFFSET(SC_SP, sigcontext, rsp);
-        OFFSET(SC_CR2, sigcontext, cr2);
-        OFFSET(SC_ERR, sigcontext, err);
-        OFFSET(SC_TRAPNO, sigcontext, trapno);
-        OFFSET(SC_CS, sigcontext, cs);
-        OFFSET(SC_FS, sigcontext, fs);
-        OFFSET(SC_GS, sigcontext, gs);
-        OFFSET(SC_EFLAGS, sigcontext, eflags);
-        OFFSET(SC_SIGMASK, sigcontext, oldmask);
+        OFFSET(HOST_SC_RBX, sigcontext, rbx);
+        OFFSET(HOST_SC_RCX, sigcontext, rcx);
+        OFFSET(HOST_SC_RDX, sigcontext, rdx);
+        OFFSET(HOST_SC_RSI, sigcontext, rsi);
+        OFFSET(HOST_SC_RDI, sigcontext, rdi);
+        OFFSET(HOST_SC_RBP, sigcontext, rbp);
+        OFFSET(HOST_SC_RAX, sigcontext, rax);
+        OFFSET(HOST_SC_R8, sigcontext, r8);
+        OFFSET(HOST_SC_R9, sigcontext, r9);
+        OFFSET(HOST_SC_R10, sigcontext, r10);
+        OFFSET(HOST_SC_R11, sigcontext, r11);
+        OFFSET(HOST_SC_R12, sigcontext, r12);
+        OFFSET(HOST_SC_R13, sigcontext, r13);
+        OFFSET(HOST_SC_R14, sigcontext, r14);
+        OFFSET(HOST_SC_R15, sigcontext, r15);
+        OFFSET(HOST_SC_IP, sigcontext, rip);
+        OFFSET(HOST_SC_SP, sigcontext, rsp);
+        OFFSET(HOST_SC_CR2, sigcontext, cr2);
+        OFFSET(HOST_SC_ERR, sigcontext, err);
+        OFFSET(HOST_SC_TRAPNO, sigcontext, trapno);
+        OFFSET(HOST_SC_CS, sigcontext, cs);
+        OFFSET(HOST_SC_FS, sigcontext, fs);
+        OFFSET(HOST_SC_GS, sigcontext, gs);
+        OFFSET(HOST_SC_EFLAGS, sigcontext, eflags);
+        OFFSET(HOST_SC_SIGMASK, sigcontext, oldmask);
 #if 0
-        OFFSET(SC_ORIG_RAX, sigcontext, orig_rax);
-        OFFSET(SC_DS, sigcontext, ds);
-        OFFSET(SC_ES, sigcontext, es);
-        OFFSET(SC_SS, sigcontext, ss);
+        OFFSET(HOST_SC_ORIG_RAX, sigcontext, orig_rax);
+        OFFSET(HOST_SC_DS, sigcontext, ds);
+        OFFSET(HOST_SC_ES, sigcontext, es);
+        OFFSET(HOST_SC_SS, sigcontext, ss);
 #endif
 
-        DEFINE(HOST_FRAME_SIZE, FRAME_SIZE);
-        DEFINE(HOST_RBX, RBX);
-        DEFINE(HOST_RCX, RCX);
-        DEFINE(HOST_RDI, RDI);
-        DEFINE(HOST_RSI, RSI);
-        DEFINE(HOST_RDX, RDX);
-        DEFINE(HOST_RBP, RBP);
-        DEFINE(HOST_RAX, RAX);
-        DEFINE(HOST_R8, R8);
-        DEFINE(HOST_R9, R9);
-        DEFINE(HOST_R10, R10);
-        DEFINE(HOST_R11, R11);
-        DEFINE(HOST_R12, R12);
-        DEFINE(HOST_R13, R13);
-        DEFINE(HOST_R14, R14);
-        DEFINE(HOST_R15, R15);
-        DEFINE(HOST_ORIG_RAX, ORIG_RAX);
-        DEFINE(HOST_CS, CS);
-        DEFINE(HOST_SS, SS);
-        DEFINE(HOST_EFLAGS, EFLAGS);
+        DEFINE_LONGS(HOST_FRAME_SIZE, FRAME_SIZE);
+        DEFINE(HOST_FP_SIZE, 0);
+        DEFINE(HOST_XFP_SIZE, 0);
+        DEFINE_LONGS(HOST_RBX, RBX);
+        DEFINE_LONGS(HOST_RCX, RCX);
+        DEFINE_LONGS(HOST_RDI, RDI);
+        DEFINE_LONGS(HOST_RSI, RSI);
+        DEFINE_LONGS(HOST_RDX, RDX);
+        DEFINE_LONGS(HOST_RBP, RBP);
+        DEFINE_LONGS(HOST_RAX, RAX);
+        DEFINE_LONGS(HOST_R8, R8);
+        DEFINE_LONGS(HOST_R9, R9);
+        DEFINE_LONGS(HOST_R10, R10);
+        DEFINE_LONGS(HOST_R11, R11);
+        DEFINE_LONGS(HOST_R12, R12);
+        DEFINE_LONGS(HOST_R13, R13);
+        DEFINE_LONGS(HOST_R14, R14);
+        DEFINE_LONGS(HOST_R15, R15);
+        DEFINE_LONGS(HOST_ORIG_RAX, ORIG_RAX);
+        DEFINE_LONGS(HOST_CS, CS);
+        DEFINE_LONGS(HOST_SS, SS);
+        DEFINE_LONGS(HOST_EFLAGS, EFLAGS);
 #if 0
-        DEFINE(HOST_FS, FS);
-        DEFINE(HOST_GS, GS);
-        DEFINE(HOST_DS, DS);
-        DEFINE(HOST_ES, ES);
+        DEFINE_LONGS(HOST_FS, FS);
+        DEFINE_LONGS(HOST_GS, GS);
+        DEFINE_LONGS(HOST_DS, DS);
+        DEFINE_LONGS(HOST_ES, ES);
 #endif
 
-        DEFINE(HOST_IP, RIP);
-        DEFINE(HOST_SP, RSP);
-        DEFINE(__UM_FRAME_SIZE, sizeof(struct user_regs_struct));
+        DEFINE_LONGS(HOST_IP, RIP);
+        DEFINE_LONGS(HOST_SP, RSP);
+        DEFINE(UM_FRAME_SIZE, sizeof(struct user_regs_struct));
 }
diff --git a/arch/um/sys-x86_64/util/Makefile b/arch/um/sys-x86_64/util/Makefile
deleted file mode 100644
index 75b052cfc206..000000000000
--- a/arch/um/sys-x86_64/util/Makefile
+++ /dev/null
@@ -1,8 +0,0 @@
-# Copyright 2003 - 2004 Pathscale, Inc
-# Released under the GPL
-
-hostprogs-y     := mk_sc mk_thread
-always          := $(hostprogs-y)
-
-HOSTCFLAGS_mk_sc.o := -I$(objtree)/arch/um
-HOSTCFLAGS_mk_thread.o := -I$(objtree)/arch/um
diff --git a/arch/um/sys-x86_64/util/mk_sc.c b/arch/um/sys-x86_64/util/mk_sc.c
deleted file mode 100644
index 7619bc377c1f..000000000000
--- a/arch/um/sys-x86_64/util/mk_sc.c
+++ /dev/null
@@ -1,47 +0,0 @@
-/* Copyright (C) 2003 - 2004 PathScale, Inc
- * Released under the GPL
- */
-
-#include <stdio.h>
-#include <user-offsets.h>
-
-#define SC_OFFSET(name) \
-  printf("#define " #name \
-         "(sc) *((unsigned long *) &(((char *) (sc))[%d]))\n",\
-         name)
-
-int main(int argc, char **argv)
-{
-  SC_OFFSET(SC_RBX);
-  SC_OFFSET(SC_RCX);
-  SC_OFFSET(SC_RDX);
-  SC_OFFSET(SC_RSI);
-  SC_OFFSET(SC_RDI);
-  SC_OFFSET(SC_RBP);
-  SC_OFFSET(SC_RAX);
-  SC_OFFSET(SC_R8);
-  SC_OFFSET(SC_R9);
-  SC_OFFSET(SC_R10);
-  SC_OFFSET(SC_R11);
-  SC_OFFSET(SC_R12);
-  SC_OFFSET(SC_R13);
-  SC_OFFSET(SC_R14);
-  SC_OFFSET(SC_R15);
-  SC_OFFSET(SC_IP);
-  SC_OFFSET(SC_SP);
-  SC_OFFSET(SC_CR2);
-  SC_OFFSET(SC_ERR);
-  SC_OFFSET(SC_TRAPNO);
-  SC_OFFSET(SC_CS);
-  SC_OFFSET(SC_FS);
-  SC_OFFSET(SC_GS);
-  SC_OFFSET(SC_EFLAGS);
-  SC_OFFSET(SC_SIGMASK);
-#if 0
-  SC_OFFSET(SC_ORIG_RAX);
-  SC_OFFSET(SC_DS);
-  SC_OFFSET(SC_ES);
-  SC_OFFSET(SC_SS);
-#endif
-  return(0);
-}
diff --git a/arch/um/sys-x86_64/util/mk_thread.c b/arch/um/sys-x86_64/util/mk_thread.c
deleted file mode 100644
index 15517396e9cf..000000000000
--- a/arch/um/sys-x86_64/util/mk_thread.c
+++ /dev/null
@@ -1,20 +0,0 @@
-#include <stdio.h>
-#include <kernel-offsets.h>
-
-int main(int argc, char **argv)
-{
-  printf("/*\n");
-  printf(" * Generated by mk_thread\n");
-  printf(" */\n");
-  printf("\n");
-  printf("#ifndef __UM_THREAD_H\n");
-  printf("#define __UM_THREAD_H\n");
-  printf("\n");
-#ifdef TASK_EXTERN_PID
-  printf("#define TASK_EXTERN_PID(task) *((int *) &(((char *) (task))[%d]))\n",
-         TASK_EXTERN_PID);
-#endif
-  printf("\n");
-  printf("#endif\n");
-  return(0);
-}
diff --git a/arch/um/util/Makefile b/arch/um/util/Makefile
deleted file mode 100644
index 4c7551c28033..000000000000
--- a/arch/um/util/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-hostprogs-y             := mk_task mk_constants
-always                  := $(hostprogs-y)
-
-HOSTCFLAGS_mk_task.o := -I$(objtree)/arch/um
-HOSTCFLAGS_mk_constants.o := -I$(objtree)/arch/um
diff --git a/arch/um/util/mk_constants.c b/arch/um/util/mk_constants.c
deleted file mode 100644
index ab217becc36a..000000000000
--- a/arch/um/util/mk_constants.c
+++ /dev/null
@@ -1,32 +0,0 @@
-#include <stdio.h>
-#include <kernel-offsets.h>
-
-#define SHOW_INT(sym) printf("#define %s %d\n", #sym, sym)
-#define SHOW_STR(sym) printf("#define %s %s\n", #sym, sym)
-
-int main(int argc, char **argv)
-{
-  printf("/*\n");
-  printf(" * Generated by mk_constants\n");
-  printf(" */\n");
-  printf("\n");
-  printf("#ifndef __UM_CONSTANTS_H\n");
-  printf("#define __UM_CONSTANTS_H\n");
-  printf("\n");
-
-  SHOW_INT(UM_KERN_PAGE_SIZE);
-
-  SHOW_STR(UM_KERN_EMERG);
-  SHOW_STR(UM_KERN_ALERT);
-  SHOW_STR(UM_KERN_CRIT);
-  SHOW_STR(UM_KERN_ERR);
-  SHOW_STR(UM_KERN_WARNING);
-  SHOW_STR(UM_KERN_NOTICE);
-  SHOW_STR(UM_KERN_INFO);
-  SHOW_STR(UM_KERN_DEBUG);
-
-  SHOW_INT(UM_NSEC_PER_SEC);
-  printf("\n");
-  printf("#endif\n");
-  return(0);
-}
diff --git a/arch/um/util/mk_task.c b/arch/um/util/mk_task.c
deleted file mode 100644
index 36c9606505e2..000000000000
--- a/arch/um/util/mk_task.c
+++ /dev/null
@@ -1,30 +0,0 @@
-#include <stdio.h>
-#include <kernel-offsets.h>
-
-void print_ptr(char *name, char *type, int offset)
-{
-  printf("#define %s(task) ((%s *) &(((char *) (task))[%d]))\n", name, type,
-         offset);
-}
-
-void print(char *name, char *type, int offset)
-{
-  printf("#define %s(task) *((%s *) &(((char *) (task))[%d]))\n", name, type,
-         offset);
-}
-
-int main(int argc, char **argv)
-{
-  printf("/*\n");
-  printf(" * Generated by mk_task\n");
-  printf(" */\n");
-  printf("\n");
-  printf("#ifndef __TASK_H\n");
-  printf("#define __TASK_H\n");
-  printf("\n");
-  print_ptr("TASK_REGS", "union uml_pt_regs", TASK_REGS);
-  print("TASK_PID", "int", TASK_PID);
-  printf("\n");
-  printf("#endif\n");
-  return(0);
-}
diff --git a/arch/x86_64/Kconfig b/arch/x86_64/Kconfig
index e63323e03ea9..21afa69a086d 100644
--- a/arch/x86_64/Kconfig
+++ b/arch/x86_64/Kconfig
@@ -277,11 +277,6 @@ source "mm/Kconfig"
 config HAVE_ARCH_EARLY_PFN_TO_NID
         def_bool y
 
-config HAVE_DEC_LOCK
-        bool
-        depends on SMP
-        default y
-
 config NR_CPUS
         int "Maximum number of CPUs (2-256)"
         range 2 256
@@ -313,7 +308,7 @@ config HPET_TIMER
           present.  The HPET provides a stable time base on SMP
           systems, unlike the TSC, but it is more expensive to access,
           as it is off-chip.  You can find the HPET spec at
-          <http://www.intel.com/labs/platcomp/hpet/hpetspec.htm>.
+          <http://www.intel.com/hardwaredesign/hpetspec.htm>.
 
 config X86_PM_TIMER
         bool "PM timer"
diff --git a/arch/x86_64/ia32/ia32_binfmt.c b/arch/x86_64/ia32/ia32_binfmt.c
index c8131f342cfc..d9161e395978 100644
--- a/arch/x86_64/ia32/ia32_binfmt.c
+++ b/arch/x86_64/ia32/ia32_binfmt.c
@@ -353,11 +353,6 @@ int setup_arg_pages(struct linux_binprm *bprm, unsigned long stack_top, int exec
         mpnt = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
         if (!mpnt) 
                 return -ENOMEM; 
-        
-        if (security_vm_enough_memory((IA32_STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p))>>PAGE_SHIFT)) {
-                kmem_cache_free(vm_area_cachep, mpnt);
-                return -ENOMEM;
-        }
 
         memset(mpnt, 0, sizeof(*mpnt));
 
diff --git a/arch/x86_64/ia32/syscall32.c b/arch/x86_64/ia32/syscall32.c
index adbc5f8089e9..3a01329473ab 100644
--- a/arch/x86_64/ia32/syscall32.c
+++ b/arch/x86_64/ia32/syscall32.c
@@ -52,17 +52,13 @@ int syscall32_setup_pages(struct linux_binprm *bprm, int exstack)
         vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
         if (!vma)
                 return -ENOMEM;
-        if (security_vm_enough_memory(npages)) {
-                kmem_cache_free(vm_area_cachep, vma);
-                return -ENOMEM;
-        }
 
         memset(vma, 0, sizeof(struct vm_area_struct));
         /* Could randomize here */
         vma->vm_start = VSYSCALL32_BASE;
         vma->vm_end = VSYSCALL32_END;
         /* MAYWRITE to allow gdb to COW and set breakpoints */
-        vma->vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYEXEC|VM_MAYEXEC|VM_MAYWRITE;
+        vma->vm_flags = VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYEXEC|VM_MAYWRITE;
         vma->vm_flags |= mm->def_flags;
         vma->vm_page_prot = protection_map[vma->vm_flags & 7];
         vma->vm_ops = &syscall32_vm_ops;
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index eb7929eea7b3..ab3f87aaff70 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -17,6 +17,8 @@
 #include <linux/ioport.h>
 #include <linux/string.h>
 #include <linux/kexec.h>
+#include <linux/module.h>
+
 #include <asm/page.h>
 #include <asm/e820.h>
 #include <asm/proto.h>
@@ -28,6 +30,7 @@ extern char _end[];
  * PFN of last memory page.
  */
 unsigned long end_pfn; 
+EXPORT_SYMBOL(end_pfn);
 
 /* 
  * end_pfn only includes RAM, while end_pfn_map includes all e820 entries.
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 522944a000ad..c8eee20cd519 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -299,15 +299,6 @@ void __init check_ioapic(void)
 #endif
                                         /* RED-PEN skip them on mptables too? */
                                         return;
-                                case PCI_VENDOR_ID_ATI:
-                                        /* All timer interrupts on atiixp
-                                           are doubled. Disable one. */
-                                        if (disable_timer_pin_1 == 0) {
-                                                disable_timer_pin_1 = 1;
-                                                printk(KERN_INFO
-                "ATI board detected. Disabling timer pin 1.\n");
-                                        }
-                                        return;
                                 } 
 
                                 /* No multi-function device? */
diff --git a/arch/x86_64/kernel/kprobes.c b/arch/x86_64/kernel/kprobes.c
index df08c43276a0..76a28b007be9 100644
--- a/arch/x86_64/kernel/kprobes.c
+++ b/arch/x86_64/kernel/kprobes.c
@@ -77,9 +77,9 @@ static inline int is_IF_modifier(kprobe_opcode_t *insn)
 int __kprobes arch_prepare_kprobe(struct kprobe *p)
 {
         /* insn: must be on special executable page on x86_64. */
-        up(&kprobe_mutex);
-        p->ainsn.insn = get_insn_slot();
         down(&kprobe_mutex);
+        p->ainsn.insn = get_insn_slot();
+        up(&kprobe_mutex);
         if (!p->ainsn.insn) {
                 return -ENOMEM;
         }
@@ -231,9 +231,9 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p)
 
 void __kprobes arch_remove_kprobe(struct kprobe *p)
 {
-        up(&kprobe_mutex);
-        free_insn_slot(p->ainsn.insn);
         down(&kprobe_mutex);
+        free_insn_slot(p->ainsn.insn);
+        up(&kprobe_mutex);
 }
 
 static inline void save_previous_kprobe(void)
diff --git a/arch/x86_64/kernel/mce.c b/arch/x86_64/kernel/mce.c
index 969365c0771b..69541db5ff2c 100644
--- a/arch/x86_64/kernel/mce.c
+++ b/arch/x86_64/kernel/mce.c
@@ -54,9 +54,12 @@ void mce_log(struct mce *mce)
 {
         unsigned next, entry;
         mce->finished = 0;
-        smp_wmb();
+        wmb();
         for (;;) {
                 entry = rcu_dereference(mcelog.next);
+                /* The rmb forces the compiler to reload next in each
+                    iteration */
+                rmb();
                 for (;;) {
                         /* When the buffer fills up discard new entries. Assume
                            that the earlier errors are the more interesting. */
@@ -69,6 +72,7 @@ void mce_log(struct mce *mce)
                                 entry++;
                                 continue;
                         }
+                        break;
                 }
                 smp_rmb();
                 next = entry + 1;
@@ -76,9 +80,9 @@ void mce_log(struct mce *mce)
                         break;
         }
         memcpy(mcelog.entry + entry, mce, sizeof(struct mce));
-        smp_wmb();
+        wmb();
         mcelog.entry[entry].finished = 1;
-        smp_wmb();
+        wmb();
 
         if (!test_and_set_bit(0, &console_logged))
                 notify_user = 1;
@@ -217,7 +221,7 @@ void do_machine_check(struct pt_regs * regs, long error_code)
                         panicm_found = 1;
                 }
 
-                tainted |= TAINT_MACHINE_CHECK;
+                add_taint(TAINT_MACHINE_CHECK);
         }
 
         /* Never do anything final in the polling timer */
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index 4388b8a5bae7..39d445e16f22 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -366,7 +366,7 @@ static void setup_k7_watchdog(void)
                 | K7_NMI_EVENT;
 
         wrmsr(MSR_K7_EVNTSEL0, evntsel, 0);
-        wrmsr(MSR_K7_PERFCTR0, -(cpu_khz/nmi_hz*1000), -1);
+        wrmsrl(MSR_K7_PERFCTR0, -((u64)cpu_khz * 1000 / nmi_hz));
         apic_write(APIC_LVTPC, APIC_DM_NMI);
         evntsel |= K7_EVNTSEL_ENABLE;
         wrmsr(MSR_K7_EVNTSEL0, evntsel, 0);
@@ -407,8 +407,8 @@ static int setup_p4_watchdog(void)
 
         wrmsr(MSR_P4_CRU_ESCR0, P4_NMI_CRU_ESCR0, 0);
         wrmsr(MSR_P4_IQ_CCCR0, P4_NMI_IQ_CCCR0 & ~P4_CCCR_ENABLE, 0);
-        Dprintk("setting P4_IQ_COUNTER0 to 0x%08lx\n", -(cpu_khz/nmi_hz*1000));
-        wrmsr(MSR_P4_IQ_COUNTER0, -(cpu_khz/nmi_hz*1000), -1);
+        Dprintk("setting P4_IQ_COUNTER0 to 0x%08lx\n", -(cpu_khz * 1000UL / nmi_hz));
+        wrmsrl(MSR_P4_IQ_COUNTER0, -((u64)cpu_khz * 1000 / nmi_hz));
         apic_write(APIC_LVTPC, APIC_DM_NMI);
         wrmsr(MSR_P4_IQ_CCCR0, nmi_p4_cccr_val, 0);
         return 1;
@@ -506,7 +506,7 @@ void nmi_watchdog_tick (struct pt_regs * regs, unsigned reason)
                         wrmsr(MSR_P4_IQ_CCCR0, nmi_p4_cccr_val, 0);
                         apic_write(APIC_LVTPC, APIC_DM_NMI);
                 }
-                wrmsr(nmi_perfctr_msr, -(cpu_khz/nmi_hz*1000), -1);
+                wrmsrl(nmi_perfctr_msr, -((u64)cpu_khz * 1000 / nmi_hz));
         }
 }
 
diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
index 351d8d64c2fb..cb28df14ff6f 100644
--- a/arch/x86_64/kernel/setup.c
+++ b/arch/x86_64/kernel/setup.c
@@ -836,6 +836,23 @@ static int __init init_amd(struct cpuinfo_x86 *c)
         int r;
         int level;
 
+#ifdef CONFIG_SMP
+        unsigned long value;
+
+        /*
+         * Disable TLB flush filter by setting HWCR.FFDIS on K8
+         * bit 6 of msr C001_0015
+         *
+         * Errata 63 for SH-B3 steppings
+         * Errata 122 for all steppings (F+ have it disabled by default)
+         */
+        if (c->x86 == 15) {
+                rdmsrl(MSR_K8_HWCR, value);
+                value |= 1 << 6;
+                wrmsrl(MSR_K8_HWCR, value);
+        }
+#endif
+
         /* Bit 31 in normal CPUID used for nonstandard 3DNow ID;
            3DNow is IDd by bit 31 in extended CPUID (1*32+31) anyway */
         clear_bit(0*32+31, &c->x86_capability);
@@ -950,13 +967,12 @@ static int __cpuinit intel_num_cpu_cores(struct cpuinfo_x86 *c)
 static void srat_detect_node(void)
 {
 #ifdef CONFIG_NUMA
-        unsigned apicid, node;
+        unsigned node;
         int cpu = smp_processor_id();
 
         /* Don't do the funky fallback heuristics the AMD version employs
            for now. */
-        apicid = phys_proc_id[cpu];
-        node = apicid_to_node[apicid];
+        node = apicid_to_node[hard_smp_processor_id()];
         if (node == NUMA_NO_NODE)
                 node = 0;
         cpu_to_node[cpu] = node;
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index 2373cb8b8625..703acde2a1a5 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -959,9 +959,6 @@ static __init int unsynchronized_tsc(void)
            are handled in the OEM check above. */
         if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
                 return 0;
-        /* All in a single socket - should be synchronized */
-        if (cpus_weight(cpu_core_map[0]) == num_online_cpus())
-                return 0;
 #endif
         /* Assume multi socket systems are not synchronized */
         return num_online_cpus() > 1;
diff --git a/arch/x86_64/kernel/x8664_ksyms.c b/arch/x86_64/kernel/x8664_ksyms.c
index 68ec03070e5a..fd99ddd009bc 100644
--- a/arch/x86_64/kernel/x8664_ksyms.c
+++ b/arch/x86_64/kernel/x8664_ksyms.c
@@ -178,10 +178,6 @@ EXPORT_SYMBOL(rwsem_down_write_failed_thunk);
 
 EXPORT_SYMBOL(empty_zero_page);
 
-#ifdef CONFIG_HAVE_DEC_LOCK
-EXPORT_SYMBOL(_atomic_dec_and_lock);
-#endif
-
 EXPORT_SYMBOL(die_chain);
 EXPORT_SYMBOL(register_die_notifier);
 
diff --git a/arch/x86_64/lib/Makefile b/arch/x86_64/lib/Makefile
index 6b26a1c1e9ff..bba5db6cebd6 100644
--- a/arch/x86_64/lib/Makefile
+++ b/arch/x86_64/lib/Makefile
@@ -10,5 +10,3 @@ lib-y := csum-partial.o csum-copy.o csum-wrappers.o delay.o \
         usercopy.o getuser.o putuser.o  \
         thunk.o clear_page.o copy_page.o bitstr.o bitops.o
 lib-y += memcpy.o memmove.o memset.o copy_user.o
-
-lib-$(CONFIG_HAVE_DEC_LOCK) += dec_and_lock.o
diff --git a/arch/x86_64/lib/dec_and_lock.c b/arch/x86_64/lib/dec_and_lock.c
deleted file mode 100644
index ab43394dc775..000000000000
--- a/arch/x86_64/lib/dec_and_lock.c
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * x86 version of "atomic_dec_and_lock()" using
- * the atomic "cmpxchg" instruction.
- *
- * (For CPU's lacking cmpxchg, we use the slow
- * generic version, and this one never even gets
- * compiled).
- */
-
-#include <linux/spinlock.h>
-#include <asm/atomic.h>
-
-int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock)
-{
-        int counter;
-        int newcount;
-
-repeat:
-        counter = atomic_read(atomic);
-        newcount = counter-1;
-
-        if (!newcount)
-                goto slow_path;
-
-        asm volatile("lock; cmpxchgl %1,%2"
-                :"=a" (newcount)
-                :"r" (newcount), "m" (atomic->counter), "0" (counter));
-
-        /* If the above failed, "eax" will have changed */
-        if (newcount != counter)
-                goto repeat;
-        return 0;
-
-slow_path:
-        spin_lock(lock);
-        if (atomic_dec_and_test(atomic))
-                return 1;
-        spin_unlock(lock);
-        return 0;
-}
diff --git a/arch/x86_64/mm/numa.c b/arch/x86_64/mm/numa.c
index 80a49d9bd8a7..214803821001 100644
--- a/arch/x86_64/mm/numa.c
+++ b/arch/x86_64/mm/numa.c
@@ -167,18 +167,16 @@ void __init numa_init_array(void)
            mapping. To avoid this fill in the mapping for all possible
            CPUs, as the number of CPUs is not known yet. 
            We round robin the existing nodes. */
-        rr = 0;
+        rr = first_node(node_online_map);
         for (i = 0; i < NR_CPUS; i++) {
                 if (cpu_to_node[i] != NUMA_NO_NODE)
                         continue;
+                cpu_to_node[i] = rr;
                 rr = next_node(rr, node_online_map);
                 if (rr == MAX_NUMNODES)
                         rr = first_node(node_online_map);
-                cpu_to_node[i] = rr;
-                rr++; 
         }
 
-        set_bit(0, &node_to_cpumask[cpu_to_node(0)]);
 }
 
 #ifdef CONFIG_NUMA_EMU
@@ -266,9 +264,7 @@ void __init numa_initmem_init(unsigned long start_pfn, unsigned long end_pfn)
 
 __cpuinit void numa_add_cpu(int cpu)
 {
-        /* BP is initialized elsewhere */
-        if (cpu) 
-                set_bit(cpu, &node_to_cpumask[cpu_to_node(cpu)]);
+        set_bit(cpu, &node_to_cpumask[cpu_to_node(cpu)]);
 } 
 
 unsigned long __init numa_free_all_bootmem(void) 
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 2b6257bec4c3..7e841aa2a4aa 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -26,10 +26,6 @@ config RWSEM_XCHGADD_ALGORITHM
         bool
         default y
 
-config HAVE_DEC_LOCK
-        bool
-        default y
-
 config GENERIC_HARDIRQS
         bool
         default y
diff --git a/arch/xtensa/kernel/pci.c b/arch/xtensa/kernel/pci.c
index 09887c96e9a1..de19501aa809 100644
--- a/arch/xtensa/kernel/pci.c
+++ b/arch/xtensa/kernel/pci.c
@@ -402,8 +402,8 @@ int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
         __pci_mmap_set_flags(dev, vma, mmap_state);
         __pci_mmap_set_pgprot(dev, vma, mmap_state, write_combine);
 
-        ret = io_remap_page_range(vma, vma->vm_start, vma->vm_pgoff<<PAGE_SHIFT,
-                               vma->vm_end - vma->vm_start, vma->vm_page_prot);
+        ret = io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+                                 vma->vm_end - vma->vm_start,vma->vm_page_prot);
 
         return ret;
 }
diff --git a/arch/xtensa/kernel/platform.c b/arch/xtensa/kernel/platform.c
index cf1362784443..03674daabc66 100644
--- a/arch/xtensa/kernel/platform.c
+++ b/arch/xtensa/kernel/platform.c
@@ -39,7 +39,7 @@ _F(int,  pcibios_fixup, (void), { return 0; });
 _F(int, get_rtc_time, (time_t* t), { return 0; });
 _F(int, set_rtc_time, (time_t t), { return 0; });
 
-#if CONFIG_XTENSA_CALIBRATE_CCOUNT
+#ifdef CONFIG_XTENSA_CALIBRATE_CCOUNT
 _F(void, calibrate_ccount, (void),
 {
   printk ("ERROR: Cannot calibrate cpu frequency! Assuming 100MHz.\n");
diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
index c83bb0d41787..08ef6d82ee51 100644
--- a/arch/xtensa/kernel/process.c
+++ b/arch/xtensa/kernel/process.c
@@ -457,7 +457,7 @@ int
 dump_task_fpu(struct pt_regs *regs, struct task_struct *task, elf_fpregset_t *r)
 {
 /* see asm/coprocessor.h for this magic number 16 */
-#if TOTAL_CPEXTRA_SIZE > 16
+#if XTENSA_CP_EXTRA_SIZE > 16
         do_save_fpregs (r, regs, task);
 
         /*  For now, bit 16 means some extra state may be present:  */
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 1f5bf5d624e4..513ed8d67766 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -304,7 +304,7 @@ void __init setup_arch(char **cmdline_p)
 # endif
 #endif
 
-#if CONFIG_PCI
+#ifdef CONFIG_PCI
         platform_pcibios_init();
 #endif
 }
diff --git a/arch/xtensa/kernel/signal.c b/arch/xtensa/kernel/signal.c
index dc42cede9394..e252b61e45a5 100644
--- a/arch/xtensa/kernel/signal.c
+++ b/arch/xtensa/kernel/signal.c
@@ -182,7 +182,7 @@ restore_cpextra (struct _cpstate *buf)
 
         struct task_struct *tsk = current;
         release_all_cp(tsk);
-        return __copy_from_user(tsk->thread.cpextra, buf, TOTAL_CPEXTRA_SIZE);
+        return __copy_from_user(tsk->thread.cpextra, buf, XTENSA_CP_EXTRA_SIZE);
 #endif
         return 0;
 }
diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c
index 1ac7d5ce7456..8e423d1335ce 100644
--- a/arch/xtensa/kernel/time.c
+++ b/arch/xtensa/kernel/time.c
@@ -68,7 +68,7 @@ void __init time_init(void)
          * speed for the CALIBRATE.
          */
 
-#if CONFIG_XTENSA_CALIBRATE_CCOUNT
+#ifdef CONFIG_XTENSA_CALIBRATE_CCOUNT
         printk("Calibrating CPU frequency ");
         platform_calibrate_ccount();
         printk("%d.%02d MHz\n", (int)ccount_per_jiffy/(1000000/HZ),
diff --git a/arch/xtensa/mm/init.c b/arch/xtensa/mm/init.c
index 56aace84aaeb..5a91d6c9e66d 100644
--- a/arch/xtensa/mm/init.c
+++ b/arch/xtensa/mm/init.c
@@ -239,7 +239,7 @@ void __init mem_init(void)
         high_memory = (void *) __va(max_mapnr << PAGE_SHIFT);
         highmemsize = 0;
 
-#if CONFIG_HIGHMEM
+#ifdef CONFIG_HIGHMEM
 #error HIGHGMEM not implemented in init.c
 #endif
 
diff --git a/drivers/acorn/char/pcf8583.c b/drivers/acorn/char/pcf8583.c
index 141b4c237a50..2b850e5860a0 100644
--- a/drivers/acorn/char/pcf8583.c
+++ b/drivers/acorn/char/pcf8583.c
@@ -23,12 +23,13 @@ static struct i2c_driver pcf8583_driver;
 
 static unsigned short ignore[] = { I2C_CLIENT_END };
 static unsigned short normal_addr[] = { 0x50, I2C_CLIENT_END };
+static unsigned short *forces[] = { NULL };
 
 static struct i2c_client_address_data addr_data = {
         .normal_i2c             = normal_addr,
         .probe                  = ignore,
         .ignore                 = ignore,
-        .force                  = ignore,
+        .forces                 = forces,
 };
 
 #define DAT(x) ((unsigned int)(x->dev.driver_data))
diff --git a/drivers/base/attribute_container.c b/drivers/base/attribute_container.c
index 373e7b728fa7..6b2eb6f39b4d 100644
--- a/drivers/base/attribute_container.c
+++ b/drivers/base/attribute_container.c
@@ -152,12 +152,13 @@ attribute_container_add_device(struct device *dev,
 
                 if (!cont->match(cont, dev))
                         continue;
-                ic = kmalloc(sizeof(struct internal_container), GFP_KERNEL);
+
+                ic = kzalloc(sizeof(*ic), GFP_KERNEL);
                 if (!ic) {
                         dev_printk(KERN_ERR, dev, "failed to allocate class container\n");
                         continue;
                 }
-                memset(ic, 0, sizeof(struct internal_container));
+
                 ic->cont = cont;
                 class_device_initialize(&ic->classdev);
                 ic->classdev.dev = get_device(dev);
diff --git a/drivers/base/class.c b/drivers/base/class.c
index d164c32a97ad..ce23dc8c18c5 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -189,12 +189,11 @@ struct class *class_create(struct module *owner, char *name)
         struct class *cls;
         int retval;
 
-        cls = kmalloc(sizeof(struct class), GFP_KERNEL);
+        cls = kzalloc(sizeof(*cls), GFP_KERNEL);
         if (!cls) {
                 retval = -ENOMEM;
                 goto error;
         }
-        memset(cls, 0x00, sizeof(struct class));
 
         cls->name = name;
         cls->owner = owner;
@@ -500,13 +499,13 @@ int class_device_add(struct class_device *class_dev)
         /* add the needed attributes to this device */
         if (MAJOR(class_dev->devt)) {
                 struct class_device_attribute *attr;
-                attr = kmalloc(sizeof(*attr), GFP_KERNEL);
+                attr = kzalloc(sizeof(*attr), GFP_KERNEL);
                 if (!attr) {
                         error = -ENOMEM;
                         kobject_del(&class_dev->kobj);
                         goto register_done;
                 }
-                memset(attr, sizeof(*attr), 0x00);
+
                 attr->attr.name = "dev";
                 attr->attr.mode = S_IRUGO;
                 attr->attr.owner = parent->owner;
@@ -577,12 +576,11 @@ struct class_device *class_device_create(struct class *cls, dev_t devt,
         if (cls == NULL || IS_ERR(cls))
                 goto error;
 
-        class_dev = kmalloc(sizeof(struct class_device), GFP_KERNEL);
+        class_dev = kzalloc(sizeof(*class_dev), GFP_KERNEL);
         if (!class_dev) {
                 retval = -ENOMEM;
                 goto error;
         }
-        memset(class_dev, 0x00, sizeof(struct class_device));
 
         class_dev->devt = devt;
         class_dev->dev = device;
@@ -671,6 +669,7 @@ void class_device_destroy(struct class *cls, dev_t devt)
 int class_device_rename(struct class_device *class_dev, char *new_name)
 {
         int error = 0;
+        char *old_class_name = NULL, *new_class_name = NULL;
 
         class_dev = class_device_get(class_dev);
         if (!class_dev)
@@ -679,12 +678,24 @@ int class_device_rename(struct class_device *class_dev, char *new_name)
         pr_debug("CLASS: renaming '%s' to '%s'\n", class_dev->class_id,
                  new_name);
 
+        if (class_dev->dev)
+                old_class_name = make_class_name(class_dev);
+
         strlcpy(class_dev->class_id, new_name, KOBJ_NAME_LEN);
 
         error = kobject_rename(&class_dev->kobj, new_name);
 
+        if (class_dev->dev) {
+                new_class_name = make_class_name(class_dev);
+                sysfs_create_link(&class_dev->dev->kobj, &class_dev->kobj,
+                                  new_class_name);
+                sysfs_remove_link(&class_dev->dev->kobj, old_class_name);
+        }
         class_device_put(class_dev);
 
+        kfree(old_class_name);
+        kfree(new_class_name);
+
         return error;
 }
 
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index d5bbce38282f..3565e9795301 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -40,6 +40,9 @@
  */
 void device_bind_driver(struct device * dev)
 {
+        if (klist_node_attached(&dev->knode_driver))
+                return;
+
         pr_debug("bound device '%s' to driver '%s'\n",
                  dev->bus_id, dev->driver->name);
         klist_add_tail(&dev->knode_driver, &dev->driver->klist_devices);
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 5bfa2e9a7c26..4acb2c5733c3 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -301,9 +301,9 @@ fw_register_class_device(struct class_device **class_dev_p,
                          const char *fw_name, struct device *device)
 {
         int retval;
-        struct firmware_priv *fw_priv = kmalloc(sizeof (struct firmware_priv),
+        struct firmware_priv *fw_priv = kzalloc(sizeof(*fw_priv),
                                                 GFP_KERNEL);
-        struct class_device *class_dev = kmalloc(sizeof (struct class_device),
+        struct class_device *class_dev = kzalloc(sizeof(*class_dev),
                                                  GFP_KERNEL);
 
         *class_dev_p = NULL;
@@ -313,8 +313,6 @@ fw_register_class_device(struct class_device **class_dev_p,
                 retval = -ENOMEM;
                 goto error_kfree;
         }
-        memset(fw_priv, 0, sizeof (*fw_priv));
-        memset(class_dev, 0, sizeof (*class_dev));
 
         init_completion(&fw_priv->completion);
         fw_priv->attr_data = firmware_attr_data_tmpl;
@@ -402,14 +400,13 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
         if (!firmware_p)
                 return -EINVAL;
 
-        *firmware_p = firmware = kmalloc(sizeof (struct firmware), GFP_KERNEL);
+        *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
         if (!firmware) {
                 printk(KERN_ERR "%s: kmalloc(struct firmware) failed\n",
                        __FUNCTION__);
                 retval = -ENOMEM;
                 goto out;
         }
-        memset(firmware, 0, sizeof (*firmware));
 
         retval = fw_setup_class_device(firmware, &class_dev, name, device,
                 hotplug);
diff --git a/drivers/base/map.c b/drivers/base/map.c
index 2f455d86793c..b449dae6f0d3 100644
--- a/drivers/base/map.c
+++ b/drivers/base/map.c
@@ -135,7 +135,7 @@ retry:
 struct kobj_map *kobj_map_init(kobj_probe_t *base_probe, struct semaphore *sem)
 {
         struct kobj_map *p = kmalloc(sizeof(struct kobj_map), GFP_KERNEL);
-        struct probe *base = kmalloc(sizeof(struct probe), GFP_KERNEL);
+        struct probe *base = kzalloc(sizeof(*base), GFP_KERNEL);
         int i;
 
         if ((p == NULL) || (base == NULL)) {
@@ -144,7 +144,6 @@ struct kobj_map *kobj_map_init(kobj_probe_t *base_probe, struct semaphore *sem)
                 return NULL;
         }
 
-        memset(base, 0, sizeof(struct probe));
         base->dev = 1;
         base->range = ~0;
         base->get = base_probe;
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 3a5f4c991797..361e204209eb 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -225,13 +225,12 @@ struct platform_device *platform_device_register_simple(char *name, unsigned int
         struct platform_object *pobj;
         int retval;
 
-        pobj = kmalloc(sizeof(struct platform_object) + sizeof(struct resource) * num, GFP_KERNEL);
+        pobj = kzalloc(sizeof(*pobj) + sizeof(struct resource) * num, GFP_KERNEL);
         if (!pobj) {
                 retval = -ENOMEM;
                 goto error;
         }
 
-        memset(pobj, 0, sizeof(*pobj));
         pobj->pdev.name = name;
         pobj->pdev.id = id;
         pobj->pdev.dev.release = platform_device_release_simple;
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 28f2c177a541..486b6e1c7dfb 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -47,14 +47,14 @@
 #include <linux/completion.h>
 
 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
-#define DRIVER_NAME "HP CISS Driver (v 2.6.6)"
-#define DRIVER_VERSION CCISS_DRIVER_VERSION(2,6,6)
+#define DRIVER_NAME "HP CISS Driver (v 2.6.8)"
+#define DRIVER_VERSION CCISS_DRIVER_VERSION(2,6,8)
 
 /* Embedded module documentation macros - see modules.h */
 MODULE_AUTHOR("Hewlett-Packard Company");
-MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 2.6.6");
+MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 2.6.8");
 MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
-                        " SA6i P600 P800 E400 E300");
+                        " SA6i P600 P800 P400 P400i E200 E200i");
 MODULE_LICENSE("GPL");
 
 #include "cciss_cmd.h"
@@ -83,12 +83,22 @@ static const struct pci_device_id cciss_pci_device_id[] = {
                 0x0E11, 0x4091, 0, 0, 0},
         { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSA,
                 0x103C, 0x3225, 0, 0, 0},
-        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSB,
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC,
                 0x103c, 0x3223, 0, 0, 0},
         { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC,
-                0x103c, 0x3231, 0, 0, 0},
+                0x103c, 0x3234, 0, 0, 0},
         { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC,
-                0x103c, 0x3233, 0, 0, 0},
+                0x103c, 0x3235, 0, 0, 0},
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD,
+                0x103c, 0x3211, 0, 0, 0},
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD,
+                0x103c, 0x3212, 0, 0, 0},
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD,
+                0x103c, 0x3213, 0, 0, 0},
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD,
+                0x103c, 0x3214, 0, 0, 0},
+        { PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD,
+                0x103c, 0x3215, 0, 0, 0},
         {0,}
 };
 MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
@@ -111,8 +121,13 @@ static struct board_type products[] = {
         { 0x40910E11, "Smart Array 6i", &SA5_access},
         { 0x3225103C, "Smart Array P600", &SA5_access},
         { 0x3223103C, "Smart Array P800", &SA5_access},
-        { 0x3231103C, "Smart Array E400", &SA5_access},
-        { 0x3233103C, "Smart Array E300", &SA5_access},
+        { 0x3234103C, "Smart Array P400", &SA5_access},
+        { 0x3235103C, "Smart Array P400i", &SA5_access},
+        { 0x3211103C, "Smart Array E200i", &SA5_access},
+        { 0x3212103C, "Smart Array E200", &SA5_access},
+        { 0x3213103C, "Smart Array E200i", &SA5_access},
+        { 0x3214103C, "Smart Array E200i", &SA5_access},
+        { 0x3215103C, "Smart Array E200i", &SA5_access},
 };
 
 /* How long to wait (in millesconds) for board to go into simple mode */
@@ -140,15 +155,26 @@ static int cciss_ioctl(struct inode *inode, struct file *filep,
 
 static int revalidate_allvol(ctlr_info_t *host);
 static int cciss_revalidate(struct gendisk *disk);
-static int deregister_disk(struct gendisk *disk);
-static int register_new_disk(ctlr_info_t *h);
+static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk);
+static int deregister_disk(struct gendisk *disk, drive_info_struct *drv, int clear_all);
 
+static void cciss_read_capacity(int ctlr, int logvol, ReadCapdata_struct *buf,
+        int withirq, unsigned int *total_size, unsigned int *block_size);
+static void cciss_geometry_inquiry(int ctlr, int logvol,
+                        int withirq, unsigned int total_size,
+                        unsigned int block_size, InquiryData_struct *inq_buff,
+                        drive_info_struct *drv);
 static void cciss_getgeometry(int cntl_num);
 
 static void start_io( ctlr_info_t *h);
 static int sendcmd( __u8 cmd, int ctlr, void *buff, size_t size,
         unsigned int use_unit_num, unsigned int log_unit, __u8 page_code,
         unsigned char *scsi3addr, int cmd_type);
+static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
+        unsigned int use_unit_num, unsigned int log_unit, __u8  page_code,
+        int cmd_type);
+
+static void fail_all_cmds(unsigned long ctlr);
 
 #ifdef CONFIG_PROC_FS
 static int cciss_proc_get_info(char *buffer, char **start, off_t offset, 
@@ -265,7 +291,7 @@ static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
         for(i=0; i<=h->highest_lun; i++) {
 
                 drv = &h->drv[i];
-                if (drv->block_size == 0)
+                if (drv->heads == 0)
                         continue;
 
                 vol_sz = drv->nr_blocks;
@@ -363,6 +389,8 @@ static CommandList_struct * cmd_alloc(ctlr_info_t *h, int get_from_pool)
                         return NULL;
                 memset(c, 0, sizeof(CommandList_struct));
 
+                c->cmdindex = -1;
+
                 c->err_info = (ErrorInfo_struct *)pci_alloc_consistent(
                                         h->pdev, sizeof(ErrorInfo_struct), 
                                         &err_dma_handle);
@@ -393,6 +421,8 @@ static CommandList_struct * cmd_alloc(ctlr_info_t *h, int get_from_pool)
                 err_dma_handle = h->errinfo_pool_dhandle 
                                         + i*sizeof(ErrorInfo_struct);
                 h->nr_allocs++;
+
+                c->cmdindex = i;
         }
 
         c->busaddr = (__u32) cmd_dma_handle;
@@ -453,6 +483,8 @@ static int cciss_open(struct inode *inode, struct file *filep)
         printk(KERN_DEBUG "cciss_open %s\n", inode->i_bdev->bd_disk->disk_name);
 #endif /* CCISS_DEBUG */ 
 
+        if (host->busy_initializing || drv->busy_configuring)
+                return -EBUSY;
         /*
          * Root is allowed to open raw volume zero even if it's not configured
          * so array config can still work. Root is also allowed to open any
@@ -796,10 +828,10 @@ static int cciss_ioctl(struct inode *inode, struct file *filep,
                 return(0);
         }
         case CCISS_DEREGDISK:
-                return deregister_disk(disk);
+                return rebuild_lun_table(host, disk);
 
         case CCISS_REGNEWD:
-                return register_new_disk(host);
+                return rebuild_lun_table(host, NULL);
 
         case CCISS_PASSTHRU:
         {
@@ -1143,48 +1175,323 @@ static int revalidate_allvol(ctlr_info_t *host)
         return 0;
 }
 
-static int deregister_disk(struct gendisk *disk)
+/* This function will check the usage_count of the drive to be updated/added.
+ * If the usage_count is zero then the drive information will be updated and
+ * the disk will be re-registered with the kernel.  If not then it will be
+ * left alone for the next reboot.  The exception to this is disk 0 which
+ * will always be left registered with the kernel since it is also the
+ * controller node.  Any changes to disk 0 will show up on the next
+ * reboot.
+*/
+static void cciss_update_drive_info(int ctlr, int drv_index)
+  {
+        ctlr_info_t *h = hba[ctlr];
+        struct gendisk *disk;
+        ReadCapdata_struct *size_buff = NULL;
+        InquiryData_struct *inq_buff = NULL;
+        unsigned int block_size;
+        unsigned int total_size;
+        unsigned long flags = 0;
+        int ret = 0;
+
+        /* if the disk already exists then deregister it before proceeding*/
+        if (h->drv[drv_index].raid_level != -1){
+                spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
+                h->drv[drv_index].busy_configuring = 1;
+                spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
+                ret = deregister_disk(h->gendisk[drv_index],
+                        &h->drv[drv_index], 0);
+                h->drv[drv_index].busy_configuring = 0;
+        }
+
+        /* If the disk is in use return */
+        if (ret)
+                return;
+
+
+        /* Get information about the disk and modify the driver sturcture */
+        size_buff = kmalloc(sizeof( ReadCapdata_struct), GFP_KERNEL);
+        if (size_buff == NULL)
+                goto mem_msg;
+        inq_buff = kmalloc(sizeof( InquiryData_struct), GFP_KERNEL);
+        if (inq_buff == NULL)
+                goto mem_msg;
+
+        cciss_read_capacity(ctlr, drv_index, size_buff, 1,
+                &total_size, &block_size);
+        cciss_geometry_inquiry(ctlr, drv_index, 1, total_size, block_size,
+                inq_buff, &h->drv[drv_index]);
+
+        ++h->num_luns;
+        disk = h->gendisk[drv_index];
+        set_capacity(disk, h->drv[drv_index].nr_blocks);
+
+
+        /* if it's the controller it's already added */
+        if (drv_index){
+                disk->queue = blk_init_queue(do_cciss_request, &h->lock);
+
+                /* Set up queue information */
+                disk->queue->backing_dev_info.ra_pages = READ_AHEAD;
+                blk_queue_bounce_limit(disk->queue, hba[ctlr]->pdev->dma_mask);
+
+                /* This is a hardware imposed limit. */
+                blk_queue_max_hw_segments(disk->queue, MAXSGENTRIES);
+
+                /* This is a limit in the driver and could be eliminated. */
+                blk_queue_max_phys_segments(disk->queue, MAXSGENTRIES);
+
+                blk_queue_max_sectors(disk->queue, 512);
+
+                disk->queue->queuedata = hba[ctlr];
+
+                blk_queue_hardsect_size(disk->queue,
+                        hba[ctlr]->drv[drv_index].block_size);
+
+                h->drv[drv_index].queue = disk->queue;
+                add_disk(disk);
+        }
+
+freeret:
+        kfree(size_buff);
+        kfree(inq_buff);
+        return;
+mem_msg:
+        printk(KERN_ERR "cciss: out of memory\n");
+        goto freeret;
+}
+
+/* This function will find the first index of the controllers drive array
+ * that has a -1 for the raid_level and will return that index.  This is
+ * where new drives will be added.  If the index to be returned is greater
+ * than the highest_lun index for the controller then highest_lun is set
+ * to this new index.  If there are no available indexes then -1 is returned.
+*/
+static int cciss_find_free_drive_index(int ctlr)
 {
+        int i;
+
+        for (i=0; i < CISS_MAX_LUN; i++){
+                if (hba[ctlr]->drv[i].raid_level == -1){
+                        if (i > hba[ctlr]->highest_lun)
+                                hba[ctlr]->highest_lun = i;
+                        return i;
+                }
+        }
+        return -1;
+}
+
+/* This function will add and remove logical drives from the Logical
+ * drive array of the controller and maintain persistancy of ordering
+ * so that mount points are preserved until the next reboot.  This allows
+ * for the removal of logical drives in the middle of the drive array
+ * without a re-ordering of those drives.
+ * INPUT
+ * h            = The controller to perform the operations on
+ * del_disk     = The disk to remove if specified.  If the value given
+ *                is NULL then no disk is removed.
+*/
+static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk)
+{
+        int ctlr = h->ctlr;
+        int num_luns;
+        ReportLunData_struct *ld_buff = NULL;
+        drive_info_struct *drv = NULL;
+        int return_code;
+        int listlength = 0;
+        int i;
+        int drv_found;
+        int drv_index = 0;
+        __u32 lunid = 0;
         unsigned long flags;
+
+        /* Set busy_configuring flag for this operation */
+        spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
+        if (h->num_luns >= CISS_MAX_LUN){
+                spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
+                return -EINVAL;
+        }
+
+        if (h->busy_configuring){
+                spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
+                return -EBUSY;
+        }
+        h->busy_configuring = 1;
+
+        /* if del_disk is NULL then we are being called to add a new disk
+         * and update the logical drive table.  If it is not NULL then
+         * we will check if the disk is in use or not.
+         */
+        if (del_disk != NULL){
+                drv = get_drv(del_disk);
+                drv->busy_configuring = 1;
+                spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
+                return_code = deregister_disk(del_disk, drv, 1);
+                drv->busy_configuring = 0;
+                h->busy_configuring = 0;
+                return return_code;
+        } else {
+                spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
+                if (!capable(CAP_SYS_RAWIO))
+                        return -EPERM;
+
+                ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
+                if (ld_buff == NULL)
+                        goto mem_msg;
+
+                return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff,
+                                sizeof(ReportLunData_struct), 0, 0, 0,
+                                TYPE_CMD);
+
+                if (return_code == IO_OK){
+                        listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[0])) << 24;
+                        listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[1])) << 16;
+                        listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[2])) << 8;
+                        listlength |= 0xff & (unsigned int)(ld_buff->LUNListLength[3]);
+                } else{ /* reading number of logical volumes failed */
+                        printk(KERN_WARNING "cciss: report logical volume"
+                                " command failed\n");
+                        listlength = 0;
+                        goto freeret;
+                }
+
+                num_luns = listlength / 8;      /* 8 bytes per entry */
+                if (num_luns > CISS_MAX_LUN){
+                        num_luns = CISS_MAX_LUN;
+                        printk(KERN_WARNING "cciss: more luns configured"
+                                " on controller than can be handled by"
+                                " this driver.\n");
+                }
+
+                /* Compare controller drive array to drivers drive array.
+                * Check for updates in the drive information and any new drives
+                * on the controller.
+                */
+                for (i=0; i < num_luns; i++){
+                        int j;
+
+                        drv_found = 0;
+
+                        lunid = (0xff &
+                                (unsigned int)(ld_buff->LUN[i][3])) << 24;
+                        lunid |= (0xff &
+                                (unsigned int)(ld_buff->LUN[i][2])) << 16;
+                        lunid |= (0xff &
+                                (unsigned int)(ld_buff->LUN[i][1])) << 8;
+                        lunid |= 0xff &
+                                (unsigned int)(ld_buff->LUN[i][0]);
+
+                        /* Find if the LUN is already in the drive array
+                         * of the controller.  If so then update its info
+                         * if not is use.  If it does not exist then find
+                         * the first free index and add it.
+                        */
+                        for (j=0; j <= h->highest_lun; j++){
+                                if (h->drv[j].LunID == lunid){
+                                        drv_index = j;
+                                        drv_found = 1;
+                                }
+                        }
+
+                        /* check if the drive was found already in the array */
+                        if (!drv_found){
+                                drv_index = cciss_find_free_drive_index(ctlr);
+                                if (drv_index == -1)
+                                        goto freeret;
+
+                        }
+                        h->drv[drv_index].LunID = lunid;
+                        cciss_update_drive_info(ctlr, drv_index);
+                } /* end for */
+        } /* end else */
+
+freeret:
+        kfree(ld_buff);
+        h->busy_configuring = 0;
+        /* We return -1 here to tell the ACU that we have registered/updated
+         * all of the drives that we can and to keep it from calling us
+         * additional times.
+        */
+        return -1;
+mem_msg:
+        printk(KERN_ERR "cciss: out of memory\n");
+        goto freeret;
+}
+
+/* This function will deregister the disk and it's queue from the
+ * kernel.  It must be called with the controller lock held and the
+ * drv structures busy_configuring flag set.  It's parameters are:
+ *
+ * disk = This is the disk to be deregistered
+ * drv  = This is the drive_info_struct associated with the disk to be
+ *        deregistered.  It contains information about the disk used
+ *        by the driver.
+ * clear_all = This flag determines whether or not the disk information
+ *             is going to be completely cleared out and the highest_lun
+ *             reset.  Sometimes we want to clear out information about
+ *             the disk in preperation for re-adding it.  In this case
+ *             the highest_lun should be left unchanged and the LunID
+ *             should not be cleared.
+*/
+static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
+                           int clear_all)
+{
         ctlr_info_t *h = get_host(disk);
-        drive_info_struct *drv = get_drv(disk);
-        int ctlr = h->ctlr;
 
         if (!capable(CAP_SYS_RAWIO))
                 return -EPERM;
 
-        spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
         /* make sure logical volume is NOT is use */
-        if( drv->usage_count > 1) {
-                spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
+        if(clear_all || (h->gendisk[0] == disk)) {
+        if (drv->usage_count > 1)
                 return -EBUSY;
         }
-        drv->usage_count++;
-        spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
+        else
+                if( drv->usage_count > 0 )
+                        return -EBUSY;
 
-        /* invalidate the devices and deregister the disk */ 
-        if (disk->flags & GENHD_FL_UP)
+        /* invalidate the devices and deregister the disk.  If it is disk
+         * zero do not deregister it but just zero out it's values.  This
+         * allows us to delete disk zero but keep the controller registered.
+        */
+        if (h->gendisk[0] != disk){
+                if (disk->flags & GENHD_FL_UP){
+                        blk_cleanup_queue(disk->queue);
                 del_gendisk(disk);
+                        drv->queue = NULL;
+                }
+        }
+
+        --h->num_luns;
+        /* zero out the disk size info */
+        drv->nr_blocks = 0;
+        drv->block_size = 0;
+        drv->heads = 0;
+        drv->sectors = 0;
+        drv->cylinders = 0;
+        drv->raid_level = -1;   /* This can be used as a flag variable to
+                                 * indicate that this element of the drive
+                                 * array is free.
+                                */
+
+        if (clear_all){
         /* check to see if it was the last disk */
         if (drv == h->drv + h->highest_lun) {
                 /* if so, find the new hightest lun */
                 int i, newhighest =-1;
                 for(i=0; i<h->highest_lun; i++) {
                         /* if the disk has size > 0, it is available */
-                        if (h->drv[i].nr_blocks)
+                                if (h->drv[i].heads)
                                 newhighest = i;
                 }
                 h->highest_lun = newhighest;
-                                
         }
-        --h->num_luns;
-        /* zero out the disk size info */ 
-        drv->nr_blocks = 0;
-        drv->block_size = 0;
-        drv->cylinders = 0;
+
         drv->LunID = 0;
+        }
         return(0);
 }
+
 static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
         size_t size,
         unsigned int use_unit_num, /* 0: address the controller,
@@ -1420,8 +1727,10 @@ case CMD_HARDWARE_ERR:
                 }
         }       
         /* unlock the buffers from DMA */
+        buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
+        buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
         pci_unmap_single( h->pdev, (dma_addr_t) buff_dma_handle.val,
-                        size, PCI_DMA_BIDIRECTIONAL);
+                        c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
         cmd_free(h, c, 0);
         return(return_status);
 
@@ -1495,164 +1804,6 @@ cciss_read_capacity(int ctlr, int logvol, ReadCapdata_struct *buf,
         return;
 }
 
-static int register_new_disk(ctlr_info_t *h)
-{
-        struct gendisk *disk;
-        int ctlr = h->ctlr;
-        int i;
-        int num_luns;
-        int logvol;
-        int new_lun_found = 0;
-        int new_lun_index = 0;
-        int free_index_found = 0;
-        int free_index = 0;
-        ReportLunData_struct *ld_buff = NULL;
-        ReadCapdata_struct *size_buff = NULL;
-        InquiryData_struct *inq_buff = NULL;
-        int return_code;
-        int listlength = 0;
-        __u32 lunid = 0;
-        unsigned int block_size;
-        unsigned int total_size;
-
-        if (!capable(CAP_SYS_RAWIO))
-                return -EPERM;
-        /* if we have no space in our disk array left to add anything */
-        if(  h->num_luns >= CISS_MAX_LUN)
-                return -EINVAL;
-        
-        ld_buff = kmalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
-        if (ld_buff == NULL)
-                goto mem_msg;
-        memset(ld_buff, 0, sizeof(ReportLunData_struct));
-        size_buff = kmalloc(sizeof( ReadCapdata_struct), GFP_KERNEL);
-        if (size_buff == NULL)
-                goto mem_msg;
-        inq_buff = kmalloc(sizeof( InquiryData_struct), GFP_KERNEL);
-        if (inq_buff == NULL)
-                goto mem_msg;
-        
-        return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff, 
-                        sizeof(ReportLunData_struct), 0, 0, 0, TYPE_CMD);
-
-        if( return_code == IO_OK)
-        {
-                
-                // printk("LUN Data\n--------------------------\n");
-
-                listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[0])) << 24;
-                listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[1])) << 16;
-                listlength |= (0xff & (unsigned int)(ld_buff->LUNListLength[2])) << 8;  
-                listlength |= 0xff & (unsigned int)(ld_buff->LUNListLength[3]);
-        } else /* reading number of logical volumes failed */
-        {
-                printk(KERN_WARNING "cciss: report logical volume"
-                        " command failed\n");
-                listlength = 0;
-                goto free_err;
-        }
-        num_luns = listlength / 8; // 8 bytes pre entry
-        if (num_luns > CISS_MAX_LUN)
-        {
-                num_luns = CISS_MAX_LUN;
-        }
-#ifdef CCISS_DEBUG
-        printk(KERN_DEBUG "Length = %x %x %x %x = %d\n", ld_buff->LUNListLength[0],
-                ld_buff->LUNListLength[1], ld_buff->LUNListLength[2],
-                ld_buff->LUNListLength[3],  num_luns);
-#endif 
-        for(i=0; i<  num_luns; i++)
-        {
-                int j;
-                int lunID_found = 0;
-
-                lunid = (0xff & (unsigned int)(ld_buff->LUN[i][3])) << 24;
-                lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][2])) << 16;
-                lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][1])) << 8;
-                lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
-                
-                /* check to see if this is a new lun */ 
-                for(j=0; j <= h->highest_lun; j++)
-                {
-#ifdef CCISS_DEBUG
-                        printk("Checking %d %x against %x\n", j,h->drv[j].LunID,
-                                                lunid);
-#endif /* CCISS_DEBUG */
-                        if (h->drv[j].LunID == lunid)
-                        {
-                                lunID_found = 1;
-                                break;
-                        }
-                        
-                }
-                if( lunID_found == 1)
-                        continue;
-                else
-                {       /* It is the new lun we have been looking for */
-#ifdef CCISS_DEBUG
-                        printk("new lun found at %d\n", i);
-#endif /* CCISS_DEBUG */
-                        new_lun_index = i;
-                        new_lun_found = 1;
-                        break;  
-                }
-         }
-         if (!new_lun_found)
-         {
-                printk(KERN_WARNING "cciss:  New Logical Volume not found\n");
-                goto free_err;
-         }
-         /* Now find the free index     */
-        for(i=0; i <CISS_MAX_LUN; i++)
-        {
-#ifdef CCISS_DEBUG
-                printk("Checking Index %d\n", i);
-#endif /* CCISS_DEBUG */
-                if(h->drv[i].LunID == 0)
-                {
-#ifdef CCISS_DEBUG
-                        printk("free index found at %d\n", i);
-#endif /* CCISS_DEBUG */
-                        free_index_found = 1;
-                        free_index = i;
-                        break;
-                }
-        }
-        if (!free_index_found)
-        {
-                printk(KERN_WARNING "cciss: unable to find free slot for disk\n");
-                goto free_err;
-         }
-
-        logvol = free_index;
-        h->drv[logvol].LunID = lunid;
-                /* there could be gaps in lun numbers, track hightest */
-        if(h->highest_lun < lunid)
-                h->highest_lun = logvol;
-        cciss_read_capacity(ctlr, logvol, size_buff, 1,
-                &total_size, &block_size);
-        cciss_geometry_inquiry(ctlr, logvol, 1, total_size, block_size,
-                        inq_buff, &h->drv[logvol]);
-        h->drv[logvol].usage_count = 0;
-        ++h->num_luns;
-        /* setup partitions per disk */
-        disk = h->gendisk[logvol];
-        set_capacity(disk, h->drv[logvol].nr_blocks);
-        /* if it's the controller it's already added */
-        if(logvol)
-                add_disk(disk);
-freeret:
-        kfree(ld_buff);
-        kfree(size_buff);
-        kfree(inq_buff);
-        return (logvol);
-mem_msg:
-        printk(KERN_ERR "cciss: out of memory\n");
-free_err:
-        logvol = -1;
-        goto freeret;
-}
-
 static int cciss_revalidate(struct gendisk *disk)
 {
         ctlr_info_t *h = get_host(disk);
@@ -1859,8 +2010,10 @@ resend_cmd1:
                 
 cleanup1:       
         /* unlock the data buffer from DMA */
+        buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
+        buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
         pci_unmap_single(info_p->pdev, (dma_addr_t) buff_dma_handle.val,
-                                size, PCI_DMA_BIDIRECTIONAL);
+                                c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
         cmd_free(info_p, c, 1);
         return (status);
 } 
@@ -2111,7 +2264,11 @@ queue:
         /* fill in the request */ 
         drv = creq->rq_disk->private_data;
         c->Header.ReplyQueue = 0;  // unused in simple mode
-        c->Header.Tag.lower = c->busaddr;  // use the physical address the cmd block for tag
+        /* got command from pool, so use the command block index instead */
+        /* for direct lookups. */
+        /* The first 2 bits are reserved for controller error reporting. */
+        c->Header.Tag.lower = (c->cmdindex << 3);
+        c->Header.Tag.lower |= 0x04; /* flag for direct lookup. */
         c->Header.LUN.LogDev.VolId= drv->LunID;
         c->Header.LUN.LogDev.Mode = 1;
         c->Request.CDBLen = 10; // 12 byte commands not in FW yet;
@@ -2186,7 +2343,7 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
         ctlr_info_t *h = dev_id;
         CommandList_struct *c;
         unsigned long flags;
-        __u32 a, a1;
+        __u32 a, a1, a2;
         int j;
         int start_queue = h->next_to_run;
 
@@ -2204,10 +2361,21 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
                 while((a = h->access.command_completed(h)) != FIFO_EMPTY) 
                 {
                         a1 = a;
+                        if ((a & 0x04)) {
+                                a2 = (a >> 3);
+                                if (a2 >= NR_CMDS) {
+                                        printk(KERN_WARNING "cciss: controller cciss%d failed, stopping.\n", h->ctlr);
+                                        fail_all_cmds(h->ctlr);
+                                        return IRQ_HANDLED;
+                                }
+
+                                c = h->cmd_pool + a2;
+                                a = c->busaddr;
+
+                        } else {
                         a &= ~3;
-                        if ((c = h->cmpQ) == NULL)
-                        {  
-                                printk(KERN_WARNING "cciss: Completion of %08lx ignored\n", (unsigned long)a1);
+                                if ((c = h->cmpQ) == NULL) {
+                                        printk(KERN_WARNING "cciss: Completion of %08x ignored\n", a1);
                                 continue;       
                         } 
                         while(c->busaddr != a) {
@@ -2215,6 +2383,7 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
                                 if (c == h->cmpQ) 
                                         break;
                         }
+                        }
                         /*
                          * If we've found the command, take it off the
                          * completion Q and free it
@@ -2634,12 +2803,16 @@ static void cciss_getgeometry(int cntl_num)
 #endif /* CCISS_DEBUG */
 
         hba[cntl_num]->highest_lun = hba[cntl_num]->num_luns-1;
-        for(i=0; i<  hba[cntl_num]->num_luns; i++)
+//      for(i=0; i<  hba[cntl_num]->num_luns; i++)
+        for(i=0; i < CISS_MAX_LUN; i++)
         {
-
-                lunid = (0xff & (unsigned int)(ld_buff->LUN[i][3])) << 24;
-                lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][2])) << 16;
-                lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][1])) << 8;
+                if (i < hba[cntl_num]->num_luns){
+                        lunid = (0xff & (unsigned int)(ld_buff->LUN[i][3]))
+                                 << 24;
+                        lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][2]))
+                                 << 16;
+                        lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][1]))
+                                 << 8;
                 lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
                 
                 hba[cntl_num]->drv[i].LunID = lunid;
@@ -2647,13 +2820,18 @@ static void cciss_getgeometry(int cntl_num)
 
 #ifdef CCISS_DEBUG
                 printk(KERN_DEBUG "LUN[%d]:  %x %x %x %x = %x\n", i, 
-                ld_buff->LUN[i][0], ld_buff->LUN[i][1],ld_buff->LUN[i][2], 
-                ld_buff->LUN[i][3], hba[cntl_num]->drv[i].LunID);
+                        ld_buff->LUN[i][0], ld_buff->LUN[i][1],
+                        ld_buff->LUN[i][2], ld_buff->LUN[i][3],
+                        hba[cntl_num]->drv[i].LunID);
 #endif /* CCISS_DEBUG */
                 cciss_read_capacity(cntl_num, i, size_buff, 0,
                         &total_size, &block_size);
-                cciss_geometry_inquiry(cntl_num, i, 0, total_size, block_size,
-                        inq_buff, &hba[cntl_num]->drv[i]);
+                        cciss_geometry_inquiry(cntl_num, i, 0, total_size,
+                                block_size, inq_buff, &hba[cntl_num]->drv[i]);
+                } else {
+                        /* initialize raid_level to indicate a free space */
+                        hba[cntl_num]->drv[i].raid_level = -1;
+                }
         }
         kfree(ld_buff);
         kfree(size_buff);
@@ -2727,6 +2905,9 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
         i = alloc_cciss_hba();
         if(i < 0)
                 return (-1);
+
+        hba[i]->busy_initializing = 1;
+
         if (cciss_pci_init(hba[i], pdev) != 0)
                 goto clean1;
 
@@ -2807,6 +2988,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
         hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
 
         cciss_procinit(i);
+        hba[i]->busy_initializing = 0;
 
         for(j=0; j < NWD; j++) { /* mfm */
                 drive_info_struct *drv = &(hba[i]->drv[j]);
@@ -2869,6 +3051,7 @@ clean2:
 clean1:
         release_io_mem(hba[i]);
         free_hba(i);
+        hba[i]->busy_initializing = 0;
         return(-1);
 }
 
@@ -2913,9 +3096,10 @@ static void __devexit cciss_remove_one (struct pci_dev *pdev)
         /* remove it from the disk list */
         for (j = 0; j < NWD; j++) {
                 struct gendisk *disk = hba[i]->gendisk[j];
-                if (disk->flags & GENHD_FL_UP)
-                        blk_cleanup_queue(disk->queue);
+                if (disk->flags & GENHD_FL_UP) {
                         del_gendisk(disk);
+                        blk_cleanup_queue(disk->queue);
+                }
         }
 
         pci_free_consistent(hba[i]->pdev, NR_CMDS * sizeof(CommandList_struct),
@@ -2964,5 +3148,43 @@ static void __exit cciss_cleanup(void)
         remove_proc_entry("cciss", proc_root_driver);
 }
 
+static void fail_all_cmds(unsigned long ctlr)
+{
+        /* If we get here, the board is apparently dead. */
+        ctlr_info_t *h = hba[ctlr];
+        CommandList_struct *c;
+        unsigned long flags;
+
+        printk(KERN_WARNING "cciss%d: controller not responding.\n", h->ctlr);
+        h->alive = 0;   /* the controller apparently died... */
+
+        spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
+
+        pci_disable_device(h->pdev); /* Make sure it is really dead. */
+
+        /* move everything off the request queue onto the completed queue */
+        while( (c = h->reqQ) != NULL ) {
+                removeQ(&(h->reqQ), c);
+                h->Qdepth--;
+                addQ (&(h->cmpQ), c);
+        }
+
+        /* Now, fail everything on the completed queue with a HW error */
+        while( (c = h->cmpQ) != NULL ) {
+                removeQ(&h->cmpQ, c);
+                c->err_info->CommandStatus = CMD_HARDWARE_ERR;
+                if (c->cmd_type == CMD_RWREQ) {
+                        complete_command(h, c, 0);
+                } else if (c->cmd_type == CMD_IOCTL_PEND)
+                        complete(c->waiting);
+#ifdef CONFIG_CISS_SCSI_TAPE
+                        else if (c->cmd_type == CMD_SCSI)
+                                complete_scsi_command(c, 0, 0);
+#endif
+        }
+        spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
+        return;
+}
+
 module_init(cciss_init);
 module_exit(cciss_cleanup);
diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
index 566587d0a500..ef277baee9fd 100644
--- a/drivers/block/cciss.h
+++ b/drivers/block/cciss.h
@@ -35,7 +35,13 @@ typedef struct _drive_info_struct
         int     heads;
         int     sectors;
         int     cylinders;
-        int     raid_level;
+        int     raid_level; /* set to -1 to indicate that
+                             * the drive is not in use/configured
+                            */
+        int     busy_configuring; /*This is set when the drive is being removed
+                                   *to prevent it from being opened or it's queue
+                                   *from being started.
+                                  */
 } drive_info_struct;
 
 struct ctlr_info 
@@ -83,6 +89,7 @@ struct ctlr_info
         int                     nr_allocs;
         int                     nr_frees; 
         int                     busy_configuring;
+        int                     busy_initializing;
 
         /* This element holds the zero based queue number of the last
          * queue to be started.  It is used for fairness.
@@ -94,6 +101,7 @@ struct ctlr_info
 #ifdef CONFIG_CISS_SCSI_TAPE
         void *scsi_ctlr; /* ptr to structure containing scsi related stuff */
 #endif
+        unsigned char alive;
 };
 
 /*  Defining the diffent access_menthods */
diff --git a/drivers/block/cciss_cmd.h b/drivers/block/cciss_cmd.h
index a88a88817623..53fea549ba8b 100644
--- a/drivers/block/cciss_cmd.h
+++ b/drivers/block/cciss_cmd.h
@@ -226,6 +226,10 @@ typedef struct _ErrorInfo_struct {
 #define CMD_MSG_DONE    0x04
 #define CMD_MSG_TIMEOUT 0x05
 
+/* This structure needs to be divisible by 8 for new
+ * indexing method.
+ */
+#define PADSIZE (sizeof(long) - 4)
 typedef struct _CommandList_struct {
   CommandListHeader_struct Header;
   RequestBlock_struct      Request;
@@ -236,14 +240,14 @@ typedef struct _CommandList_struct {
   ErrorInfo_struct *       err_info; /* pointer to the allocated mem */ 
   int                      ctlr;
   int                      cmd_type; 
+  long                     cmdindex;
   struct _CommandList_struct *prev;
   struct _CommandList_struct *next;
   struct request *         rq;
   struct completion *waiting;
   int    retry_count;
-#ifdef CONFIG_CISS_SCSI_TAPE
   void * scsi_cmd;
-#endif
+  char   pad[PADSIZE];
 } CommandList_struct;
 
 //Configuration Table Structure
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index f16e3caed58a..e183a3ef7839 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -93,6 +93,7 @@ struct cciss_scsi_cmd_stack_elem_t {
         CommandList_struct cmd;
         ErrorInfo_struct Err;
         __u32 busaddr;
+        __u32 pad;
 };
 
 #pragma pack()
@@ -877,7 +878,7 @@ cciss_scsi_interpret_error(CommandList_struct *cp)
 
 static int
 cciss_scsi_do_inquiry(ctlr_info_t *c, unsigned char *scsi3addr, 
-                 InquiryData_struct *buf)
+                 unsigned char *buf, unsigned char bufsize)
 {
         int rc;
         CommandList_struct *cp;
@@ -900,11 +901,10 @@ cciss_scsi_do_inquiry(ctlr_info_t *c, unsigned char *scsi3addr,
         cdb[1] = 0;
         cdb[2] = 0;
         cdb[3] = 0;
-        cdb[4] = sizeof(*buf) & 0xff;
+        cdb[4] = bufsize;
         cdb[5] = 0;
         rc = cciss_scsi_do_simple_cmd(c, cp, scsi3addr, cdb, 
-                                6, (unsigned char *) buf, 
-                                sizeof(*buf), XFER_READ);
+                                6, buf, bufsize, XFER_READ);
 
         if (rc != 0) return rc; /* something went wrong */
 
@@ -1000,9 +1000,10 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
            that though.  
 
          */
-
+#define OBDR_TAPE_INQ_SIZE 49
+#define OBDR_TAPE_SIG "$DR-10"
         ReportLunData_struct *ld_buff;
-        InquiryData_struct *inq_buff;
+        unsigned char *inq_buff;
         unsigned char scsi3addr[8];
         ctlr_info_t *c;
         __u32 num_luns=0;
@@ -1020,7 +1021,7 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
                 return;
         }
         memset(ld_buff, 0, reportlunsize);
-        inq_buff = kmalloc(sizeof( InquiryData_struct), GFP_KERNEL);
+        inq_buff = kmalloc(OBDR_TAPE_INQ_SIZE, GFP_KERNEL);
         if (inq_buff == NULL) {
                 printk(KERN_ERR "cciss: out of memory\n");
                 kfree(ld_buff);
@@ -1051,19 +1052,36 @@ cciss_update_non_disk_devices(int cntl_num, int hostno)
 
                 /* for each physical lun, do an inquiry */
                 if (ld_buff->LUN[i][3] & 0xC0) continue;
-                memset(inq_buff, 0, sizeof(InquiryData_struct));
+                memset(inq_buff, 0, OBDR_TAPE_INQ_SIZE);
                 memcpy(&scsi3addr[0], &ld_buff->LUN[i][0], 8);
 
-                if (cciss_scsi_do_inquiry(hba[cntl_num], 
-                        scsi3addr, inq_buff) != 0)
-                {
+                if (cciss_scsi_do_inquiry(hba[cntl_num], scsi3addr, inq_buff,
+                        (unsigned char) OBDR_TAPE_INQ_SIZE) != 0) {
                         /* Inquiry failed (msg printed already) */
                         devtype = 0; /* so we will skip this device. */
                 } else /* what kind of device is this? */
-                        devtype = (inq_buff->data_byte[0] & 0x1f);
+                        devtype = (inq_buff[0] & 0x1f);
 
                 switch (devtype)
                 {
+                  case 0x05: /* CD-ROM */ {
+
+                        /* We don't *really* support actual CD-ROM devices,
+                         * just this "One Button Disaster Recovery" tape drive
+                         * which temporarily pretends to be a CD-ROM drive.
+                         * So we check that the device is really an OBDR tape
+                         * device by checking for "$DR-10" in bytes 43-48 of
+                         * the inquiry data.
+                         */
+                                char obdr_sig[7];
+
+                                strncpy(obdr_sig, &inq_buff[43], 6);
+                                obdr_sig[6] = '\0';
+                                if (strncmp(obdr_sig, OBDR_TAPE_SIG, 6) != 0)
+                                        /* Not OBDR device, ignore it. */
+                                        break;
+                        }
+                        /* fall through . . . */
                   case 0x01: /* sequential access, (tape) */
                   case 0x08: /* medium changer */
                         if (ncurrent >= CCISS_MAX_SCSI_DEVS_PER_HBA) {
@@ -1126,6 +1144,7 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
 
         int buflen, datalen;
         ctlr_info_t *ci;
+        int i;
         int cntl_num;
 
 
@@ -1136,8 +1155,28 @@ cciss_scsi_proc_info(struct Scsi_Host *sh,
         cntl_num = ci->ctlr;    /* Get our index into the hba[] array */
 
         if (func == 0) {        /* User is reading from /proc/scsi/ciss*?/?*  */
-                buflen = sprintf(buffer, "hostnum=%d\n", sh->host_no);  
-
+                buflen = sprintf(buffer, "cciss%d: SCSI host: %d\n",
+                                cntl_num, sh->host_no);
+
+                /* this information is needed by apps to know which cciss
+                   device corresponds to which scsi host number without
+                   having to open a scsi target device node.  The device
+                   information is not a duplicate of /proc/scsi/scsi because
+                   the two may be out of sync due to scsi hotplug, rather
+                   this info is for an app to be able to use to know how to
+                   get them back in sync. */
+
+                for (i=0;i<ccissscsi[cntl_num].ndevices;i++) {
+                        struct cciss_scsi_dev_t *sd = &ccissscsi[cntl_num].dev[i];
+                        buflen += sprintf(&buffer[buflen], "c%db%dt%dl%d %02d "
+                                "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+                                sh->host_no, sd->bus, sd->target, sd->lun,
+                                sd->devtype,
+                                sd->scsi3addr[0], sd->scsi3addr[1],
+                                sd->scsi3addr[2], sd->scsi3addr[3],
+                                sd->scsi3addr[4], sd->scsi3addr[5],
+                                sd->scsi3addr[6], sd->scsi3addr[7]);
+                }
                 datalen = buflen - offset;
                 if (datalen < 0) {      /* they're reading past EOF. */
                         datalen = 0;
@@ -1399,7 +1438,7 @@ cciss_proc_tape_report(int ctlr, unsigned char *buffer, off_t *pos, off_t *len)
 
         CPQ_TAPE_LOCK(ctlr, flags);
         size = sprintf(buffer + *len, 
-                "       Sequential access devices: %d\n\n",
+                "Sequential access devices: %d\n\n",
                         ccissscsi[ctlr].ndevices);
         CPQ_TAPE_UNLOCK(ctlr, flags);
         *pos += size; *len += size;
diff --git a/drivers/block/ll_rw_blk.c b/drivers/block/ll_rw_blk.c
index 483d71b10cf9..baedac522945 100644
--- a/drivers/block/ll_rw_blk.c
+++ b/drivers/block/ll_rw_blk.c
@@ -2373,44 +2373,6 @@ int blkdev_issue_flush(struct block_device *bdev, sector_t *error_sector)
 
 EXPORT_SYMBOL(blkdev_issue_flush);
 
-/**
- * blkdev_scsi_issue_flush_fn - issue flush for SCSI devices
- * @q:          device queue
- * @disk:       gendisk
- * @error_sector:       error offset
- *
- * Description:
- *    Devices understanding the SCSI command set, can use this function as
- *    a helper for issuing a cache flush. Note: driver is required to store
- *    the error offset (in case of error flushing) in ->sector of struct
- *    request.
- */
-int blkdev_scsi_issue_flush_fn(request_queue_t *q, struct gendisk *disk,
-                               sector_t *error_sector)
-{
-        struct request *rq = blk_get_request(q, WRITE, __GFP_WAIT);
-        int ret;
-
-        rq->flags |= REQ_BLOCK_PC | REQ_SOFTBARRIER;
-        rq->sector = 0;
-        memset(rq->cmd, 0, sizeof(rq->cmd));
-        rq->cmd[0] = 0x35;
-        rq->cmd_len = 12;
-        rq->data = NULL;
-        rq->data_len = 0;
-        rq->timeout = 60 * HZ;
-
-        ret = blk_execute_rq(q, disk, rq, 0);
-
-        if (ret && error_sector)
-                *error_sector = rq->sector;
-
-        blk_put_request(rq);
-        return ret;
-}
-
-EXPORT_SYMBOL(blkdev_scsi_issue_flush_fn);
-
 static void drive_stat_acct(struct request *rq, int nr_sectors, int new_io)
 {
         int rw = rq_data_dir(rq);
diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c
index 711d2f314ac3..94af920465b5 100644
--- a/drivers/block/paride/pf.c
+++ b/drivers/block/paride/pf.c
@@ -750,6 +750,14 @@ static int pf_ready(void)
 
 static struct request_queue *pf_queue;
 
+static void pf_end_request(int uptodate)
+{
+        if (pf_req) {
+                end_request(pf_req, uptodate);
+                pf_req = NULL;
+        }
+}
+
 static void do_pf_request(request_queue_t * q)
 {
         if (pf_busy)
@@ -765,7 +773,7 @@ repeat:
         pf_count = pf_req->current_nr_sectors;
 
         if (pf_block + pf_count > get_capacity(pf_req->rq_disk)) {
-                end_request(pf_req, 0);
+                pf_end_request(0);
                 goto repeat;
         }
 
@@ -780,7 +788,7 @@ repeat:
                 pi_do_claimed(pf_current->pi, do_pf_write);
         else {
                 pf_busy = 0;
-                end_request(pf_req, 0);
+                pf_end_request(0);
                 goto repeat;
         }
 }
@@ -798,9 +806,11 @@ static int pf_next_buf(void)
         if (!pf_count)
                 return 1;
         spin_lock_irqsave(&pf_spin_lock, saved_flags);
-        end_request(pf_req, 1);
-        pf_count = pf_req->current_nr_sectors;
-        pf_buf = pf_req->buffer;
+        pf_end_request(1);
+        if (pf_req) {
+                pf_count = pf_req->current_nr_sectors;
+                pf_buf = pf_req->buffer;
+        }
         spin_unlock_irqrestore(&pf_spin_lock, saved_flags);
         return 1;
 }
@@ -810,7 +820,7 @@ static inline void next_request(int success)
         unsigned long saved_flags;
 
         spin_lock_irqsave(&pf_spin_lock, saved_flags);
-        end_request(pf_req, success);
+        pf_end_request(success);
         pf_busy = 0;
         do_pf_request(pf_queue);
         spin_unlock_irqrestore(&pf_spin_lock, saved_flags);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 7b838342f0a3..7e22a58926b8 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -5,29 +5,41 @@
  * May be copied or modified under the terms of the GNU General Public
  * License.  See linux/COPYING for more information.
  *
- * Packet writing layer for ATAPI and SCSI CD-R, CD-RW, DVD-R, and
- * DVD-RW devices (aka an exercise in block layer masturbation)
+ * Packet writing layer for ATAPI and SCSI CD-RW, DVD+RW, DVD-RW and
+ * DVD-RAM devices.
  *
+ * Theory of operation:
  *
- * TODO: (circa order of when I will fix it)
- * - Only able to write on CD-RW media right now.
- * - check host application code on media and set it in write page
- * - interface for UDF <-> packet to negotiate a new location when a write
- *   fails.
- * - handle OPC, especially for -RW media
+ * At the lowest level, there is the standard driver for the CD/DVD device,
+ * typically ide-cd.c or sr.c. This driver can handle read and write requests,
+ * but it doesn't know anything about the special restrictions that apply to
+ * packet writing. One restriction is that write requests must be aligned to
+ * packet boundaries on the physical media, and the size of a write request
+ * must be equal to the packet size. Another restriction is that a
+ * GPCMD_FLUSH_CACHE command has to be issued to the drive before a read
+ * command, if the previous command was a write.
  *
- * Theory of operation:
+ * The purpose of the packet writing driver is to hide these restrictions from
+ * higher layers, such as file systems, and present a block device that can be
+ * randomly read and written using 2kB-sized blocks.
+ *
+ * The lowest layer in the packet writing driver is the packet I/O scheduler.
+ * Its data is defined by the struct packet_iosched and includes two bio
+ * queues with pending read and write requests. These queues are processed
+ * by the pkt_iosched_process_queue() function. The write requests in this
+ * queue are already properly aligned and sized. This layer is responsible for
+ * issuing the flush cache commands and scheduling the I/O in a good order.
  *
- * We use a custom make_request_fn function that forwards reads directly to
- * the underlying CD device. Write requests are either attached directly to
- * a live packet_data object, or simply stored sequentially in a list for
- * later processing by the kcdrwd kernel thread. This driver doesn't use
- * any elevator functionally as defined by the elevator_s struct, but the
- * underlying CD device uses a standard elevator.
+ * The next layer transforms unaligned write requests to aligned writes. This
+ * transformation requires reading missing pieces of data from the underlying
+ * block device, assembling the pieces to full packets and queuing them to the
+ * packet I/O scheduler.
  *
- * This strategy makes it possible to do very late merging of IO requests.
- * A new bio sent to pkt_make_request can be merged with a live packet_data
- * object even if the object is in the data gathering state.
+ * At the top layer there is a custom make_request_fn function that forwards
+ * read requests directly to the iosched queue and puts write requests in the
+ * unaligned write queue. A kernel thread performs the necessary read
+ * gathering to convert the unaligned writes to aligned writes and then feeds
+ * them to the packet I/O scheduler.
  *
  *************************************************************************/
 
@@ -100,10 +112,9 @@ static struct bio *pkt_bio_alloc(int nr_iovecs)
                 goto no_bio;
         bio_init(bio);
 
-        bvl = kmalloc(nr_iovecs * sizeof(struct bio_vec), GFP_KERNEL);
+        bvl = kcalloc(nr_iovecs, sizeof(struct bio_vec), GFP_KERNEL);
         if (!bvl)
                 goto no_bvl;
-        memset(bvl, 0, nr_iovecs * sizeof(struct bio_vec));
 
         bio->bi_max_vecs = nr_iovecs;
         bio->bi_io_vec = bvl;
@@ -125,10 +136,9 @@ static struct packet_data *pkt_alloc_packet_data(void)
         int i;
         struct packet_data *pkt;
 
-        pkt = kmalloc(sizeof(struct packet_data), GFP_KERNEL);
+        pkt = kzalloc(sizeof(struct packet_data), GFP_KERNEL);
         if (!pkt)
                 goto no_pkt;
-        memset(pkt, 0, sizeof(struct packet_data));
 
         pkt->w_bio = pkt_bio_alloc(PACKET_MAX_SIZE);
         if (!pkt->w_bio)
@@ -659,7 +669,6 @@ static void pkt_make_local_copy(struct packet_data *pkt, struct page **pages, in
                 }
                 offs += CD_FRAMESIZE;
                 if (offs >= PAGE_SIZE) {
-                        BUG_ON(offs > PAGE_SIZE);
                         offs = 0;
                         p++;
                 }
@@ -724,12 +733,6 @@ static void pkt_gather_data(struct pktcdvd_device *pd, struct packet_data *pkt)
         atomic_set(&pkt->io_wait, 0);
         atomic_set(&pkt->io_errors, 0);
 
-        if (pkt->cache_valid) {
-                VPRINTK("pkt_gather_data: zone %llx cached\n",
-                        (unsigned long long)pkt->sector);
-                goto out_account;
-        }
-
         /*
          * Figure out which frames we need to read before we can write.
          */
@@ -738,6 +741,7 @@ static void pkt_gather_data(struct pktcdvd_device *pd, struct packet_data *pkt)
         for (bio = pkt->orig_bios; bio; bio = bio->bi_next) {
                 int first_frame = (bio->bi_sector - pkt->sector) / (CD_FRAMESIZE >> 9);
                 int num_frames = bio->bi_size / CD_FRAMESIZE;
+                pd->stats.secs_w += num_frames * (CD_FRAMESIZE >> 9);
                 BUG_ON(first_frame < 0);
                 BUG_ON(first_frame + num_frames > pkt->frames);
                 for (f = first_frame; f < first_frame + num_frames; f++)
@@ -745,6 +749,12 @@ static void pkt_gather_data(struct pktcdvd_device *pd, struct packet_data *pkt)
         }
         spin_unlock(&pkt->lock);
 
+        if (pkt->cache_valid) {
+                VPRINTK("pkt_gather_data: zone %llx cached\n",
+                        (unsigned long long)pkt->sector);
+                goto out_account;
+        }
+
         /*
          * Schedule reads for missing parts of the packet.
          */
@@ -778,7 +788,6 @@ out_account:
                 frames_read, (unsigned long long)pkt->sector);
         pd->stats.pkt_started++;
         pd->stats.secs_rg += frames_read * (CD_FRAMESIZE >> 9);
-        pd->stats.secs_w += pd->settings.size;
 }
 
 /*
@@ -794,10 +803,11 @@ static struct packet_data *pkt_get_packet_data(struct pktcdvd_device *pd, int zo
                         list_del_init(&pkt->list);
                         if (pkt->sector != zone)
                                 pkt->cache_valid = 0;
-                        break;
+                        return pkt;
                 }
         }
-        return pkt;
+        BUG();
+        return NULL;
 }
 
 static void pkt_put_packet_data(struct pktcdvd_device *pd, struct packet_data *pkt)
@@ -941,12 +951,10 @@ try_next_bio:
         }
 
         pkt = pkt_get_packet_data(pd, zone);
-        BUG_ON(!pkt);
 
         pd->current_sector = zone + pd->settings.size;
         pkt->sector = zone;
         pkt->frames = pd->settings.size >> 2;
-        BUG_ON(pkt->frames > PACKET_MAX_SIZE);
         pkt->write_size = 0;
 
         /*
@@ -1636,6 +1644,10 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                 printk("pktcdvd: detected zero packet size!\n");
                 pd->settings.size = 128;
         }
+        if (pd->settings.size > PACKET_MAX_SECTORS) {
+                printk("pktcdvd: packet size is too big\n");
+                return -ENXIO;
+        }
         pd->settings.fp = ti.fp;
         pd->offset = (be32_to_cpu(ti.track_start) << 2) & (pd->settings.size - 1);
 
@@ -2198,7 +2210,6 @@ static int pkt_make_request(request_queue_t *q, struct bio *bio)
          * No matching packet found. Store the bio in the work queue.
          */
         node = mempool_alloc(pd->rb_pool, GFP_NOIO);
-        BUG_ON(!node);
         node->bio = bio;
         spin_lock(&pd->lock);
         BUG_ON(pd->bio_queue_size < 0);
@@ -2406,7 +2417,6 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
         struct pktcdvd_device *pd = inode->i_bdev->bd_disk->private_data;
 
         VPRINTK("pkt_ioctl: cmd %x, dev %d:%d\n", cmd, imajor(inode), iminor(inode));
-        BUG_ON(!pd);
 
         switch (cmd) {
         /*
@@ -2477,10 +2487,9 @@ static int pkt_setup_dev(struct pkt_ctrl_command *ctrl_cmd)
                 return -EBUSY;
         }
 
-        pd = kmalloc(sizeof(struct pktcdvd_device), GFP_KERNEL);
+        pd = kzalloc(sizeof(struct pktcdvd_device), GFP_KERNEL);
         if (!pd)
                 return ret;
-        memset(pd, 0, sizeof(struct pktcdvd_device));
 
         pd->rb_pool = mempool_create(PKT_RB_POOL_SIZE, pkt_rb_alloc, pkt_rb_free, NULL);
         if (!pd->rb_pool)
diff --git a/drivers/block/scsi_ioctl.c b/drivers/block/scsi_ioctl.c
index 856c2278e9d0..079ec344eb47 100644
--- a/drivers/block/scsi_ioctl.c
+++ b/drivers/block/scsi_ioctl.c
@@ -168,6 +168,7 @@ static int verify_command(struct file *file, unsigned char *cmd)
                 safe_for_write(WRITE_VERIFY_12),
                 safe_for_write(WRITE_16),
                 safe_for_write(WRITE_LONG),
+                safe_for_write(WRITE_LONG_2),
                 safe_for_write(ERASE),
                 safe_for_write(GPCMD_MODE_SELECT_10),
                 safe_for_write(MODE_SELECT),
diff --git a/drivers/block/ub.c b/drivers/block/ub.c
index aa0bf7ee008d..ed4d5006fe62 100644
--- a/drivers/block/ub.c
+++ b/drivers/block/ub.c
@@ -172,7 +172,7 @@ struct bulk_cs_wrap {
  */
 struct ub_dev;
 
-#define UB_MAX_REQ_SG   4
+#define UB_MAX_REQ_SG   9       /* cdrecord requires 32KB and maybe a header */
 #define UB_MAX_SECTORS 64
 
 /*
@@ -387,7 +387,7 @@ struct ub_dev {
         struct bulk_cs_wrap work_bcs;
         struct usb_ctrlrequest work_cr;
 
-        int sg_stat[UB_MAX_REQ_SG+1];
+        int sg_stat[6];
         struct ub_scsi_trace tr;
 };
 
@@ -525,12 +525,13 @@ static ssize_t ub_diag_show(struct device *dev, struct device_attribute *attr,
             "qlen %d qmax %d\n",
             sc->cmd_queue.qlen, sc->cmd_queue.qmax);
         cnt += sprintf(page + cnt,
-            "sg %d %d %d %d %d\n",
+            "sg %d %d %d %d %d .. %d\n",
             sc->sg_stat[0],
             sc->sg_stat[1],
             sc->sg_stat[2],
             sc->sg_stat[3],
-            sc->sg_stat[4]);
+            sc->sg_stat[4],
+            sc->sg_stat[5]);
 
         list_for_each (p, &sc->luns) {
                 lun = list_entry(p, struct ub_lun, link);
@@ -835,7 +836,7 @@ static int ub_cmd_build_block(struct ub_dev *sc, struct ub_lun *lun,
                 return -1;
         }
         cmd->nsg = n_elem;
-        sc->sg_stat[n_elem]++;
+        sc->sg_stat[n_elem < 5 ? n_elem : 5]++;
 
         /*
          * build the command
@@ -891,7 +892,7 @@ static int ub_cmd_build_packet(struct ub_dev *sc, struct ub_lun *lun,
                 return -1;
         }
         cmd->nsg = n_elem;
-        sc->sg_stat[n_elem]++;
+        sc->sg_stat[n_elem < 5 ? n_elem : 5]++;
 
         memcpy(&cmd->cdb, rq->cmd, rq->cmd_len);
         cmd->cdb_len = rq->cmd_len;
@@ -1010,7 +1011,6 @@ static int ub_scsi_cmd_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
         sc->last_pipe = sc->send_bulk_pipe;
         usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->send_bulk_pipe,
             bcb, US_BULK_CB_WRAP_LEN, ub_urb_complete, sc);
-        sc->work_urb.transfer_flags = 0;
 
         /* Fill what we shouldn't be filling, because usb-storage did so. */
         sc->work_urb.actual_length = 0;
@@ -1019,7 +1019,6 @@ static int ub_scsi_cmd_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 
         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
                 /* XXX Clear stalls */
-                printk("ub: cmd #%d start failed (%d)\n", cmd->tag, rc); /* P3 */
                 ub_complete(&sc->work_done);
                 return rc;
         }
@@ -1190,11 +1189,9 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                         return;
                 }
                 if (urb->status != 0) {
-                        printk("ub: cmd #%d cmd status (%d)\n", cmd->tag, urb->status); /* P3 */
                         goto Bad_End;
                 }
                 if (urb->actual_length != US_BULK_CB_WRAP_LEN) {
-                        printk("ub: cmd #%d xferred %d\n", cmd->tag, urb->actual_length); /* P3 */
                         /* XXX Must do reset here to unconfuse the device */
                         goto Bad_End;
                 }
@@ -1395,14 +1392,12 @@ static void ub_data_start(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
         usb_fill_bulk_urb(&sc->work_urb, sc->dev, pipe,
             page_address(sg->page) + sg->offset, sg->length,
             ub_urb_complete, sc);
-        sc->work_urb.transfer_flags = 0;
         sc->work_urb.actual_length = 0;
         sc->work_urb.error_count = 0;
         sc->work_urb.status = 0;
 
         if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
                 /* XXX Clear stalls */
-                printk("ub: data #%d submit failed (%d)\n", cmd->tag, rc); /* P3 */
                 ub_complete(&sc->work_done);
                 ub_state_done(sc, cmd, rc);
                 return;
@@ -1442,7 +1437,6 @@ static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
         sc->last_pipe = sc->recv_bulk_pipe;
         usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->recv_bulk_pipe,
             &sc->work_bcs, US_BULK_CS_WRAP_LEN, ub_urb_complete, sc);
-        sc->work_urb.transfer_flags = 0;
         sc->work_urb.actual_length = 0;
         sc->work_urb.error_count = 0;
         sc->work_urb.status = 0;
@@ -1563,7 +1557,6 @@ static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
 
         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
             (unsigned char*) cr, NULL, 0, ub_urb_complete, sc);
-        sc->work_urb.transfer_flags = 0;
         sc->work_urb.actual_length = 0;
         sc->work_urb.error_count = 0;
         sc->work_urb.status = 0;
@@ -2000,17 +1993,16 @@ static int ub_sync_getmaxlun(struct ub_dev *sc)
 
         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->recv_ctrl_pipe,
             (unsigned char*) cr, p, 1, ub_probe_urb_complete, &compl);
-        sc->work_urb.transfer_flags = 0;
         sc->work_urb.actual_length = 0;
         sc->work_urb.error_count = 0;
         sc->work_urb.status = 0;
 
         if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
                 if (rc == -EPIPE) {
-                        printk("%s: Stall at GetMaxLUN, using 1 LUN\n",
+                        printk("%s: Stall submitting GetMaxLUN, using 1 LUN\n",
                              sc->name); /* P3 */
                 } else {
-                        printk(KERN_WARNING
+                        printk(KERN_NOTICE
                              "%s: Unable to submit GetMaxLUN (%d)\n",
                              sc->name, rc);
                 }
@@ -2028,6 +2020,18 @@ static int ub_sync_getmaxlun(struct ub_dev *sc)
         del_timer_sync(&timer);
         usb_kill_urb(&sc->work_urb);
 
+        if ((rc = sc->work_urb.status) < 0) {
+                if (rc == -EPIPE) {
+                        printk("%s: Stall at GetMaxLUN, using 1 LUN\n",
+                             sc->name); /* P3 */
+                } else {
+                        printk(KERN_NOTICE
+                             "%s: Error at GetMaxLUN (%d)\n",
+                             sc->name, rc);
+                }
+                goto err_io;
+        }
+
         if (sc->work_urb.actual_length != 1) {
                 printk("%s: GetMaxLUN returned %d bytes\n", sc->name,
                     sc->work_urb.actual_length); /* P3 */
@@ -2048,6 +2052,7 @@ static int ub_sync_getmaxlun(struct ub_dev *sc)
         kfree(p);
         return nluns;
 
+err_io:
 err_submit:
         kfree(p);
 err_alloc:
@@ -2080,7 +2085,6 @@ static int ub_probe_clear_stall(struct ub_dev *sc, int stalled_pipe)
 
         usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
             (unsigned char*) cr, NULL, 0, ub_probe_urb_complete, &compl);
-        sc->work_urb.transfer_flags = 0;
         sc->work_urb.actual_length = 0;
         sc->work_urb.error_count = 0;
         sc->work_urb.status = 0;
@@ -2213,8 +2217,10 @@ static int ub_probe(struct usb_interface *intf,
          * This is needed to clear toggles. It is a problem only if we do
          * `rmmod ub && modprobe ub` without disconnects, but we like that.
          */
+#if 0 /* iPod Mini fails if we do this (big white iPod works) */
         ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
         ub_probe_clear_stall(sc, sc->send_bulk_pipe);
+#endif
 
         /*
          * The way this is used by the startup code is a little specific.
@@ -2241,10 +2247,10 @@ static int ub_probe(struct usb_interface *intf,
         for (i = 0; i < 3; i++) {
                 if ((rc = ub_sync_getmaxlun(sc)) < 0) {
                         /* 
-                         * Some devices (i.e. Iomega Zip100) need this --
-                         * apparently the bulk pipes get STALLed when the
-                         * GetMaxLUN request is processed.
-                         * XXX I have a ZIP-100, verify it does this.
+                         * This segment is taken from usb-storage. They say
+                         * that ZIP-100 needs this, but my own ZIP-100 works
+                         * fine without this.
+                         * Still, it does not seem to hurt anything.
                          */
                         if (rc == -EPIPE) {
                                 ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
@@ -2313,7 +2319,7 @@ static int ub_probe_lun(struct ub_dev *sc, int lnum)
         disk->first_minor = lun->id * UB_MINORS_PER_MAJOR;
         disk->fops = &ub_bd_fops;
         disk->private_data = lun;
-        disk->driverfs_dev = &sc->intf->dev;    /* XXX Many to one ok? */
+        disk->driverfs_dev = &sc->intf->dev;
 
         rc = -ENOMEM;
         if ((q = blk_init_queue(ub_request_fn, &sc->lock)) == NULL)
@@ -2466,9 +2472,6 @@ static int __init ub_init(void)
 {
         int rc;
 
-        /* P3 */ printk("ub: sizeof ub_scsi_cmd %zu ub_dev %zu ub_lun %zu\n",
-                        sizeof(struct ub_scsi_cmd), sizeof(struct ub_dev), sizeof(struct ub_lun));
-
         if ((rc = register_blkdev(UB_MAJOR, DRV_NAME)) != 0)
                 goto err_regblkdev;
         devfs_mk_dir(DEVFS_NAME);
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index 67d96b5cbb96..57c48bbf6fe6 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -65,13 +65,15 @@
 #endif
 
 static int ignore = 0;
+static int ignore_csr = 0;
+static int ignore_sniffer = 0;
 static int reset = 0;
 
 #ifdef CONFIG_BT_HCIUSB_SCO
 static int isoc = 2;
 #endif
 
-#define VERSION "2.8"
+#define VERSION "2.9"
 
 static struct usb_driver hci_usb_driver; 
 
@@ -98,6 +100,9 @@ static struct usb_device_id bluetooth_ids[] = {
 MODULE_DEVICE_TABLE (usb, bluetooth_ids);
 
 static struct usb_device_id blacklist_ids[] = {
+        /* CSR BlueCore devices */
+        { USB_DEVICE(0x0a12, 0x0001), .driver_info = HCI_CSR },
+
         /* Broadcom BCM2033 without firmware */
         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = HCI_IGNORE },
 
@@ -836,6 +841,12 @@ static int hci_usb_probe(struct usb_interface *intf, const struct usb_device_id
         if (ignore || id->driver_info & HCI_IGNORE)
                 return -ENODEV;
 
+        if (ignore_csr && id->driver_info & HCI_CSR)
+                return -ENODEV;
+
+        if (ignore_sniffer && id->driver_info & HCI_SNIFFER)
+                return -ENODEV;
+
         if (intf->cur_altsetting->desc.bInterfaceNumber > 0)
                 return -ENODEV;
 
@@ -1061,6 +1072,12 @@ module_exit(hci_usb_exit);
 module_param(ignore, bool, 0644);
 MODULE_PARM_DESC(ignore, "Ignore devices from the matching table");
 
+module_param(ignore_csr, bool, 0644);
+MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001");
+
+module_param(ignore_sniffer, bool, 0644);
+MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002");
+
 module_param(reset, bool, 0644);
 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
 
diff --git a/drivers/bluetooth/hci_usb.h b/drivers/bluetooth/hci_usb.h
index 29936b43d4f8..37100a6ea1a8 100644
--- a/drivers/bluetooth/hci_usb.h
+++ b/drivers/bluetooth/hci_usb.h
@@ -31,9 +31,10 @@
 #define HCI_IGNORE              0x01
 #define HCI_RESET               0x02
 #define HCI_DIGIANSWER          0x04
-#define HCI_SNIFFER             0x08
-#define HCI_BROKEN_ISOC         0x10
+#define HCI_CSR                 0x08
+#define HCI_SNIFFER             0x10
 #define HCI_BCM92035            0x20
+#define HCI_BROKEN_ISOC         0x40
 
 #define HCI_MAX_IFACE_NUM       3
 
diff --git a/drivers/char/agp/hp-agp.c b/drivers/char/agp/hp-agp.c
index 99762b6c19ae..de5d6d212674 100644
--- a/drivers/char/agp/hp-agp.c
+++ b/drivers/char/agp/hp-agp.c
@@ -252,7 +252,7 @@ hp_zx1_configure (void)
                 readl(hp->ioc_regs+HP_ZX1_PDIR_BASE);
                 writel(hp->io_tlb_ps, hp->ioc_regs+HP_ZX1_TCNFG);
                 readl(hp->ioc_regs+HP_ZX1_TCNFG);
-                writel(~(HP_ZX1_IOVA_SIZE-1), hp->ioc_regs+HP_ZX1_IMASK);
+                writel((unsigned int)(~(HP_ZX1_IOVA_SIZE-1)), hp->ioc_regs+HP_ZX1_IMASK);
                 readl(hp->ioc_regs+HP_ZX1_IMASK);
                 writel(hp->iova_base|1, hp->ioc_regs+HP_ZX1_IBASE);
                 readl(hp->ioc_regs+HP_ZX1_IBASE);
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index 2a36561eec68..a124f8c5d062 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -2053,10 +2053,6 @@ static int __init rs_init(void)
         state->icount.rx = state->icount.tx = 0;
         state->icount.frame = state->icount.parity = 0;
         state->icount.overrun = state->icount.brk = 0;
-        /*
-        if(state->port && check_region(state->port,REGION_LENGTH(state)))
-          continue;
-        */
 
         printk(KERN_INFO "ttyS%d is the amiga builtin serial port\n",
                        state->line);
diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index 6ba48f346fcf..041bb47b5c39 100644
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -376,7 +376,7 @@ static int __init drm_core_init(void)
                 goto err_p2;
         }
 
-        drm_proc_root = create_proc_entry("dri", S_IFDIR, NULL);
+        drm_proc_root = proc_mkdir("dri", NULL);
         if (!drm_proc_root) {
                 DRM_ERROR("Cannot create /proc/dri\n");
                 ret = -1;
diff --git a/drivers/char/drm/drm_proc.c b/drivers/char/drm/drm_proc.c
index 32d2bb99462c..977961002488 100644
--- a/drivers/char/drm/drm_proc.c
+++ b/drivers/char/drm/drm_proc.c
@@ -95,7 +95,7 @@ int drm_proc_init(drm_device_t *dev, int minor,
         char                  name[64];
 
         sprintf(name, "%d", minor);
-        *dev_root = create_proc_entry(name, S_IFDIR, root);
+        *dev_root = proc_mkdir(name, root);
         if (!*dev_root) {
                 DRM_ERROR("Cannot create /proc/dri/%s\n", name);
                 return -1;
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index 58d3738a2b7f..407708a001e4 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -534,7 +534,7 @@ static void shutdown(struct channel *ch)
 
         unsigned long flags;
         struct tty_struct *tty;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
 
         if (!(ch->asyncflags & ASYNC_INITIALIZED)) 
                 return;
@@ -618,7 +618,7 @@ static int pc_write(struct tty_struct * tty,
         struct channel *ch;
         unsigned long flags;
         int remain;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
 
         /* ----------------------------------------------------------------
                 pc_write is primarily called directly by the kernel routine
@@ -685,7 +685,7 @@ static int pc_write(struct tty_struct * tty,
                 ------------------------------------------------------------------- */
 
                 dataLen = min(bytesAvailable, dataLen);
-                memcpy(ch->txptr + head, buf, dataLen);
+                memcpy_toio(ch->txptr + head, buf, dataLen);
                 buf += dataLen;
                 head += dataLen;
                 amountCopied += dataLen;
@@ -726,7 +726,7 @@ static int pc_write_room(struct tty_struct *tty)
         struct channel *ch;
         unsigned long flags;
         unsigned int head, tail;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
 
         remain = 0;
 
@@ -773,7 +773,7 @@ static int pc_chars_in_buffer(struct tty_struct *tty)
         int remain;
         unsigned long flags;
         struct channel *ch;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
 
         /* ---------------------------------------------------------
                 verifyChannel returns the channel from the tty struct
@@ -830,7 +830,7 @@ static void pc_flush_buffer(struct tty_struct *tty)
         unsigned int tail;
         unsigned long flags;
         struct channel *ch;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
         /* ---------------------------------------------------------
                 verifyChannel returns the channel from the tty struct
                 if it is valid.  This serves as a sanity check.
@@ -976,7 +976,7 @@ static int pc_open(struct tty_struct *tty, struct file * filp)
         struct channel *ch;
         unsigned long flags;
         int line, retval, boardnum;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
         unsigned int head;
 
         line = tty->index;
@@ -1041,7 +1041,7 @@ static int pc_open(struct tty_struct *tty, struct file * filp)
         ch->statusflags = 0;
 
         /* Save boards current modem status */
-        ch->imodem = bc->mstat;
+        ch->imodem = readb(&bc->mstat);
 
         /* ----------------------------------------------------------------
            Set receive head and tail ptrs to each other.  This indicates
@@ -1399,10 +1399,10 @@ static void post_fep_init(unsigned int crd)
 { /* Begin post_fep_init */
 
         int i;
-        unsigned char *memaddr;
-        struct global_data *gd;
+        void __iomem *memaddr;
+        struct global_data __iomem *gd;
         struct board_info *bd;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
         struct channel *ch; 
         int shrinkmem = 0, lowwater ; 
  
@@ -1461,7 +1461,7 @@ static void post_fep_init(unsigned int crd)
                 8 and 64 of these structures.
         -------------------------------------------------------------------- */
 
-        bc = (struct board_chan *)(memaddr + CHANSTRUCT);
+        bc = memaddr + CHANSTRUCT;
 
         /* -------------------------------------------------------------------
                 The below assignment will set gd to point at the BEGINING of
@@ -1470,7 +1470,7 @@ static void post_fep_init(unsigned int crd)
                 pointer begins at 0xd10.
         ---------------------------------------------------------------------- */
 
-        gd = (struct global_data *)(memaddr + GLOBAL);
+        gd = memaddr + GLOBAL;
 
         /* --------------------------------------------------------------------
                 XEPORTS (address 0xc22) points at the number of channels the
@@ -1493,6 +1493,7 @@ static void post_fep_init(unsigned int crd)
 
         for (i = 0; i < bd->numports; i++, ch++, bc++)  { /* Begin for each port */
                 unsigned long flags;
+                u16 tseg, rseg;
 
                 ch->brdchan        = bc;
                 ch->mailbox        = gd; 
@@ -1553,50 +1554,53 @@ static void post_fep_init(unsigned int crd)
                         shrinkmem = 0;
                 }
 
+                tseg = readw(&bc->tseg);
+                rseg = readw(&bc->rseg);
+
                 switch (bd->type) {
 
                         case PCIXEM:
                         case PCIXRJ:
                         case PCIXR:
                                 /* Cover all the 2MEG cards */
-                                ch->txptr = memaddr + (((bc->tseg) << 4) & 0x1fffff);
-                                ch->rxptr = memaddr + (((bc->rseg) << 4) & 0x1fffff);
-                                ch->txwin = FEPWIN | ((bc->tseg) >> 11);
-                                ch->rxwin = FEPWIN | ((bc->rseg) >> 11);
+                                ch->txptr = memaddr + ((tseg << 4) & 0x1fffff);
+                                ch->rxptr = memaddr + ((rseg << 4) & 0x1fffff);
+                                ch->txwin = FEPWIN | (tseg >> 11);
+                                ch->rxwin = FEPWIN | (rseg >> 11);
                                 break;
 
                         case PCXEM:
                         case EISAXEM:
                                 /* Cover all the 32K windowed cards */
                                 /* Mask equal to window size - 1 */
-                                ch->txptr = memaddr + (((bc->tseg) << 4) & 0x7fff);
-                                ch->rxptr = memaddr + (((bc->rseg) << 4) & 0x7fff);
-                                ch->txwin = FEPWIN | ((bc->tseg) >> 11);
-                                ch->rxwin = FEPWIN | ((bc->rseg) >> 11);
+                                ch->txptr = memaddr + ((tseg << 4) & 0x7fff);
+                                ch->rxptr = memaddr + ((rseg << 4) & 0x7fff);
+                                ch->txwin = FEPWIN | (tseg >> 11);
+                                ch->rxwin = FEPWIN | (rseg >> 11);
                                 break;
 
                         case PCXEVE:
                         case PCXE:
-                                ch->txptr = memaddr + (((bc->tseg - bd->memory_seg) << 4) & 0x1fff);
-                                ch->txwin = FEPWIN | ((bc->tseg - bd->memory_seg) >> 9);
-                                ch->rxptr = memaddr + (((bc->rseg - bd->memory_seg) << 4) & 0x1fff);
-                                ch->rxwin = FEPWIN | ((bc->rseg - bd->memory_seg) >>9 );
+                                ch->txptr = memaddr + (((tseg - bd->memory_seg) << 4) & 0x1fff);
+                                ch->txwin = FEPWIN | ((tseg - bd->memory_seg) >> 9);
+                                ch->rxptr = memaddr + (((rseg - bd->memory_seg) << 4) & 0x1fff);
+                                ch->rxwin = FEPWIN | ((rseg - bd->memory_seg) >>9 );
                                 break;
 
                         case PCXI:
                         case PC64XE:
-                                ch->txptr = memaddr + ((bc->tseg - bd->memory_seg) << 4);
-                                ch->rxptr = memaddr + ((bc->rseg - bd->memory_seg) << 4);
+                                ch->txptr = memaddr + ((tseg - bd->memory_seg) << 4);
+                                ch->rxptr = memaddr + ((rseg - bd->memory_seg) << 4);
                                 ch->txwin = ch->rxwin = 0;
                                 break;
 
                 } /* End switch bd->type */
 
                 ch->txbufhead = 0;
-                ch->txbufsize = bc->tmax + 1;
+                ch->txbufsize = readw(&bc->tmax) + 1;
         
                 ch->rxbufhead = 0;
-                ch->rxbufsize = bc->rmax + 1;
+                ch->rxbufsize = readw(&bc->rmax) + 1;
         
                 lowwater = ch->txbufsize >= 2000 ? 1024 : (ch->txbufsize / 2);
 
@@ -1718,11 +1722,11 @@ static void epcapoll(unsigned long ignored)
 static void doevent(int crd)
 { /* Begin doevent */
 
-        void *eventbuf;
+        void __iomem *eventbuf;
         struct channel *ch, *chan0;
         static struct tty_struct *tty;
         struct board_info *bd;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
         unsigned int tail, head;
         int event, channel;
         int mstat, lstat;
@@ -1817,7 +1821,7 @@ static void doevent(int crd)
 static void fepcmd(struct channel *ch, int cmd, int word_or_byte,
                    int byte2, int ncmds, int bytecmd)
 { /* Begin fepcmd */
-        unchar *memaddr;
+        unchar __iomem *memaddr;
         unsigned int head, cmdTail, cmdStart, cmdMax;
         long count;
         int n;
@@ -2000,7 +2004,7 @@ static void epcaparam(struct tty_struct *tty, struct channel *ch)
 
         unsigned int cmdHead;
         struct termios *ts;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
         unsigned mval, hflow, cflag, iflag;
 
         bc = ch->brdchan;
@@ -2010,7 +2014,7 @@ static void epcaparam(struct tty_struct *tty, struct channel *ch)
         ts = tty->termios;
         if ((ts->c_cflag & CBAUD) == 0)  { /* Begin CBAUD detected */
                 cmdHead = readw(&bc->rin);
-                bc->rout = cmdHead;
+                writew(cmdHead, &bc->rout);
                 cmdHead = readw(&bc->tin);
                 /* Changing baud in mid-stream transmission can be wonderful */
                 /* ---------------------------------------------------------------
@@ -2116,7 +2120,7 @@ static void receive_data(struct channel *ch)
         unchar *rptr;
         struct termios *ts = NULL;
         struct tty_struct *tty;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
         int dataToRead, wrapgap, bytesAvailable;
         unsigned int tail, head;
         unsigned int wrapmask;
@@ -2154,7 +2158,7 @@ static void receive_data(struct channel *ch)
         --------------------------------------------------------------------- */
 
         if (!tty || !ts || !(ts->c_cflag & CREAD))  {
-                bc->rout = head;
+                writew(head, &bc->rout);
                 return;
         }
 
@@ -2270,7 +2274,7 @@ static int info_ioctl(struct tty_struct *tty, struct file * file,
 static int pc_tiocmget(struct tty_struct *tty, struct file *file)
 {
         struct channel *ch = (struct channel *) tty->driver_data;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
         unsigned int mstat, mflag = 0;
         unsigned long flags;
 
@@ -2351,7 +2355,7 @@ static int pc_ioctl(struct tty_struct *tty, struct file * file,
         unsigned long flags;
         unsigned int mflag, mstat;
         unsigned char startc, stopc;
-        struct board_chan *bc;
+        struct board_chan __iomem *bc;
         struct channel *ch = (struct channel *) tty->driver_data;
         void __user *argp = (void __user *)arg;
         
@@ -2633,7 +2637,7 @@ static void pc_start(struct tty_struct *tty)
                 spin_lock_irqsave(&epca_lock, flags);
                 /* Just in case output was resumed because of a change in Digi-flow */
                 if (ch->statusflags & TXSTOPPED)  { /* Begin transmit resume requested */
-                        struct board_chan *bc;
+                        struct board_chan __iomem *bc;
                         globalwinon(ch);
                         bc = ch->brdchan;
                         if (ch->statusflags & LOWWAIT)
@@ -2727,7 +2731,7 @@ void digi_send_break(struct channel *ch, int msec)
 static void setup_empty_event(struct tty_struct *tty, struct channel *ch)
 { /* Begin setup_empty_event */
 
-        struct board_chan *bc = ch->brdchan;
+        struct board_chan __iomem *bc = ch->brdchan;
 
         globalwinon(ch);
         ch->statusflags |= EMPTYWAIT;
diff --git a/drivers/char/epca.h b/drivers/char/epca.h
index 20eeb5a70e1a..456d6c8f94a8 100644
--- a/drivers/char/epca.h
+++ b/drivers/char/epca.h
@@ -128,17 +128,17 @@ struct channel
         unsigned long  c_cflag;
         unsigned long  c_lflag;
         unsigned long  c_oflag;
-        unsigned char *txptr;
-        unsigned char *rxptr;
+        unsigned char __iomem *txptr;
+        unsigned char __iomem *rxptr;
         unsigned char *tmp_buf;
         struct board_info           *board;
-        struct board_chan           *brdchan;
+        struct board_chan           __iomem *brdchan;
         struct digi_struct          digiext;
         struct tty_struct           *tty;
         wait_queue_head_t           open_wait;
         wait_queue_head_t           close_wait;
         struct work_struct          tqueue;
-        struct global_data          *mailbox;
+        struct global_data          __iomem *mailbox;
 };
 
 struct board_info       
@@ -149,8 +149,8 @@ struct board_info
         unsigned short numports;
         unsigned long port;
         unsigned long membase;
-        unsigned char __iomem *re_map_port;
-        unsigned char *re_map_membase;
+        void __iomem *re_map_port;
+        void __iomem *re_map_membase;
         unsigned long  memory_seg;
         void ( * memwinon )     (struct board_info *, unsigned int) ;
         void ( * memwinoff )    (struct board_info *, unsigned int) ;
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index de0379b6d502..c055bb630ffc 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -273,7 +273,6 @@ static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
 
         vma->vm_flags |= VM_IO;
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-        addr = __pa(addr);
 
         if (io_remap_pfn_range(vma, vma->vm_start, addr >> PAGE_SHIFT,
                                         PAGE_SIZE, vma->vm_page_prot)) {
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index cddb789902db..f92177634677 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -839,9 +839,6 @@ int __init hvc_init(void)
         hvc_driver->flags = TTY_DRIVER_REAL_RAW;
         tty_set_operations(hvc_driver, &hvc_ops);
 
-        if (tty_register_driver(hvc_driver))
-                panic("Couldn't register hvc console driver\n");
-
         /* Always start the kthread because there can be hotplug vty adapters
          * added later. */
         hvc_task = kthread_run(khvcd, NULL, "khvcd");
@@ -851,6 +848,9 @@ int __init hvc_init(void)
                 return -EIO;
         }
 
+        if (tty_register_driver(hvc_driver))
+                panic("Couldn't register hvc console driver\n");
+
         return 0;
 }
 module_init(hvc_init);
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 463351d4f942..32fa82c78c73 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -2620,7 +2620,7 @@ void ipmi_smi_msg_received(ipmi_smi_t          intf,
         spin_lock_irqsave(&(intf->waiting_msgs_lock), flags);
         if (!list_empty(&(intf->waiting_msgs))) {
                 list_add_tail(&(msg->link), &(intf->waiting_msgs));
-                spin_unlock(&(intf->waiting_msgs_lock));
+                spin_unlock_irqrestore(&(intf->waiting_msgs_lock), flags);
                 goto out_unlock;
         }
         spin_unlock_irqrestore(&(intf->waiting_msgs_lock), flags);
@@ -2629,9 +2629,9 @@ void ipmi_smi_msg_received(ipmi_smi_t          intf,
         if (rv > 0) {
                 /* Could not handle the message now, just add it to a
                    list to handle later. */
-                spin_lock(&(intf->waiting_msgs_lock));
+                spin_lock_irqsave(&(intf->waiting_msgs_lock), flags);
                 list_add_tail(&(msg->link), &(intf->waiting_msgs));
-                spin_unlock(&(intf->waiting_msgs_lock));
+                spin_unlock_irqrestore(&(intf->waiting_msgs_lock), flags);
         } else if (rv == 0) {
                 ipmi_free_smi_msg(msg);
         }
diff --git a/drivers/char/ipmi/ipmi_poweroff.c b/drivers/char/ipmi/ipmi_poweroff.c
index e82a96ba396b..f66947722e12 100644
--- a/drivers/char/ipmi/ipmi_poweroff.c
+++ b/drivers/char/ipmi/ipmi_poweroff.c
@@ -55,7 +55,7 @@ extern void (*pm_power_off)(void);
 static int poweroff_powercycle;
 
 /* parameter definition to allow user to flag power cycle */
-module_param(poweroff_powercycle, int, 0);
+module_param(poweroff_powercycle, int, 0644);
 MODULE_PARM_DESC(poweroff_powercycles, " Set to non-zero to enable power cycle instead of power down. Power cycle is contingent on hardware support, otherwise it defaults back to power down.");
 
 /* Stuff from the get device id command. */
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index 2291a87e8ada..97d6dc24b800 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -229,8 +229,8 @@ static int __init r3964_init(void)
        TRACE_L("line discipline %d registered", N_R3964);
        TRACE_L("flags=%x num=%x", tty_ldisc_N_R3964.flags, 
                tty_ldisc_N_R3964.num);
-       TRACE_L("open=%x", (int)tty_ldisc_N_R3964.open);
-       TRACE_L("tty_ldisc_N_R3964 = %x", (int)&tty_ldisc_N_R3964);
+       TRACE_L("open=%p", tty_ldisc_N_R3964.open);
+       TRACE_L("tty_ldisc_N_R3964 = %p", &tty_ldisc_N_R3964);
      }
    else
      {
@@ -267,8 +267,8 @@ static void add_tx_queue(struct r3964_info *pInfo, struct r3964_block_header *pH
    
    spin_unlock_irqrestore(&pInfo->lock, flags);
 
-   TRACE_Q("add_tx_queue %x, length %d, tx_first = %x", 
-          (int)pHeader, pHeader->length, (int)pInfo->tx_first );
+   TRACE_Q("add_tx_queue %p, length %d, tx_first = %p", 
+          pHeader, pHeader->length, pInfo->tx_first );
 }
 
 static void remove_from_tx_queue(struct r3964_info *pInfo, int error_code)
@@ -285,10 +285,10 @@ static void remove_from_tx_queue(struct r3964_info *pInfo, int error_code)
       return;
 
 #ifdef DEBUG_QUEUE
-   printk("r3964: remove_from_tx_queue: %x, length %d - ",
-          (int)pHeader, (int)pHeader->length );
+   printk("r3964: remove_from_tx_queue: %p, length %u - ",
+          pHeader, pHeader->length );
    for(pDump=pHeader;pDump;pDump=pDump->next)
-         printk("%x ", (int)pDump);
+         printk("%p ", pDump);
    printk("\n");
 #endif
 
@@ -319,10 +319,10 @@ static void remove_from_tx_queue(struct r3964_info *pInfo, int error_code)
    spin_unlock_irqrestore(&pInfo->lock, flags);
 
    kfree(pHeader);
-   TRACE_M("remove_from_tx_queue - kfree %x",(int)pHeader);
+   TRACE_M("remove_from_tx_queue - kfree %p",pHeader);
 
-   TRACE_Q("remove_from_tx_queue: tx_first = %x, tx_last = %x",
-          (int)pInfo->tx_first, (int)pInfo->tx_last );
+   TRACE_Q("remove_from_tx_queue: tx_first = %p, tx_last = %p",
+          pInfo->tx_first, pInfo->tx_last );
 }
 
 static void add_rx_queue(struct r3964_info *pInfo, struct r3964_block_header *pHeader)
@@ -346,9 +346,9 @@ static void add_rx_queue(struct r3964_info *pInfo, struct r3964_block_header *pH
    
    spin_unlock_irqrestore(&pInfo->lock, flags);
 
-   TRACE_Q("add_rx_queue: %x, length = %d, rx_first = %x, count = %d",
-          (int)pHeader, pHeader->length,
-          (int)pInfo->rx_first, pInfo->blocks_in_rx_queue);
+   TRACE_Q("add_rx_queue: %p, length = %d, rx_first = %p, count = %d",
+          pHeader, pHeader->length,
+          pInfo->rx_first, pInfo->blocks_in_rx_queue);
 }
 
 static void remove_from_rx_queue(struct r3964_info *pInfo,
@@ -360,10 +360,10 @@ static void remove_from_rx_queue(struct r3964_info *pInfo,
    if(pHeader==NULL)
       return;
 
-   TRACE_Q("remove_from_rx_queue: rx_first = %x, rx_last = %x, count = %d",
-          (int)pInfo->rx_first, (int)pInfo->rx_last, pInfo->blocks_in_rx_queue );
-   TRACE_Q("remove_from_rx_queue: %x, length %d",
-          (int)pHeader, (int)pHeader->length );
+   TRACE_Q("remove_from_rx_queue: rx_first = %p, rx_last = %p, count = %d",
+          pInfo->rx_first, pInfo->rx_last, pInfo->blocks_in_rx_queue );
+   TRACE_Q("remove_from_rx_queue: %p, length %u",
+          pHeader, pHeader->length );
 
    spin_lock_irqsave(&pInfo->lock, flags);
 
@@ -401,10 +401,10 @@ static void remove_from_rx_queue(struct r3964_info *pInfo,
    spin_unlock_irqrestore(&pInfo->lock, flags);
 
    kfree(pHeader);
-   TRACE_M("remove_from_rx_queue - kfree %x",(int)pHeader);
+   TRACE_M("remove_from_rx_queue - kfree %p",pHeader);
 
-   TRACE_Q("remove_from_rx_queue: rx_first = %x, rx_last = %x, count = %d",
-          (int)pInfo->rx_first, (int)pInfo->rx_last, pInfo->blocks_in_rx_queue );
+   TRACE_Q("remove_from_rx_queue: rx_first = %p, rx_last = %p, count = %d",
+          pInfo->rx_first, pInfo->rx_last, pInfo->blocks_in_rx_queue );
 }
 
 static void put_char(struct r3964_info *pInfo, unsigned char ch)
@@ -506,8 +506,8 @@ static void transmit_block(struct r3964_info *pInfo)
    if(tty->driver->write_room)
       room=tty->driver->write_room(tty);
 
-   TRACE_PS("transmit_block %x, room %d, length %d", 
-          (int)pBlock, room, pBlock->length);
+   TRACE_PS("transmit_block %p, room %d, length %d", 
+          pBlock, room, pBlock->length);
    
    while(pInfo->tx_position < pBlock->length)
    {
@@ -588,7 +588,7 @@ static void on_receive_block(struct r3964_info *pInfo)
 
    /* prepare struct r3964_block_header: */
    pBlock = kmalloc(length+sizeof(struct r3964_block_header), GFP_KERNEL);
-   TRACE_M("on_receive_block - kmalloc %x",(int)pBlock);
+   TRACE_M("on_receive_block - kmalloc %p",pBlock);
 
    if(pBlock==NULL)
       return;
@@ -868,11 +868,11 @@ static int enable_signals(struct r3964_info *pInfo, pid_t pid, int arg)
                if(pMsg)
                {
                   kfree(pMsg);
-                  TRACE_M("enable_signals - msg kfree %x",(int)pMsg);
+                  TRACE_M("enable_signals - msg kfree %p",pMsg);
                }
             }
             kfree(pClient);
-            TRACE_M("enable_signals - kfree %x",(int)pClient);
+            TRACE_M("enable_signals - kfree %p",pClient);
             return 0;
          }
       }
@@ -890,7 +890,7 @@ static int enable_signals(struct r3964_info *pInfo, pid_t pid, int arg)
       {
          /* add client to client list */
          pClient=kmalloc(sizeof(struct r3964_client_info), GFP_KERNEL);
-         TRACE_M("enable_signals - kmalloc %x",(int)pClient);
+         TRACE_M("enable_signals - kmalloc %p",pClient);
          if(pClient==NULL)
             return -ENOMEM;
 
@@ -954,7 +954,7 @@ static void add_msg(struct r3964_client_info *pClient, int msg_id, int arg,
 queue_the_message:
 
       pMsg = kmalloc(sizeof(struct r3964_message), GFP_KERNEL);
-      TRACE_M("add_msg - kmalloc %x",(int)pMsg);
+      TRACE_M("add_msg - kmalloc %p",pMsg);
       if(pMsg==NULL) {
          return;
       }
@@ -1067,11 +1067,11 @@ static int r3964_open(struct tty_struct *tty)
    struct r3964_info *pInfo;
    
    TRACE_L("open");
-   TRACE_L("tty=%x, PID=%d, disc_data=%x", 
-          (int)tty, current->pid, (int)tty->disc_data);
+   TRACE_L("tty=%p, PID=%d, disc_data=%p", 
+          tty, current->pid, tty->disc_data);
    
    pInfo=kmalloc(sizeof(struct r3964_info), GFP_KERNEL); 
-   TRACE_M("r3964_open - info kmalloc %x",(int)pInfo);
+   TRACE_M("r3964_open - info kmalloc %p",pInfo);
 
    if(!pInfo)
    {
@@ -1080,26 +1080,26 @@ static int r3964_open(struct tty_struct *tty)
    }
 
    pInfo->rx_buf = kmalloc(RX_BUF_SIZE, GFP_KERNEL);
-   TRACE_M("r3964_open - rx_buf kmalloc %x",(int)pInfo->rx_buf);
+   TRACE_M("r3964_open - rx_buf kmalloc %p",pInfo->rx_buf);
 
    if(!pInfo->rx_buf)
    {
       printk(KERN_ERR "r3964: failed to alloc receive buffer\n");
       kfree(pInfo);
-      TRACE_M("r3964_open - info kfree %x",(int)pInfo);
+      TRACE_M("r3964_open - info kfree %p",pInfo);
       return -ENOMEM;
    }
    
    pInfo->tx_buf = kmalloc(TX_BUF_SIZE, GFP_KERNEL);
-   TRACE_M("r3964_open - tx_buf kmalloc %x",(int)pInfo->tx_buf);
+   TRACE_M("r3964_open - tx_buf kmalloc %p",pInfo->tx_buf);
 
    if(!pInfo->tx_buf)
    {
       printk(KERN_ERR "r3964: failed to alloc transmit buffer\n");
       kfree(pInfo->rx_buf);
-      TRACE_M("r3964_open - rx_buf kfree %x",(int)pInfo->rx_buf);
+      TRACE_M("r3964_open - rx_buf kfree %p",pInfo->rx_buf);
       kfree(pInfo);
-      TRACE_M("r3964_open - info kfree %x",(int)pInfo);
+      TRACE_M("r3964_open - info kfree %p",pInfo);
       return -ENOMEM;
    }
 
@@ -1154,11 +1154,11 @@ static void r3964_close(struct tty_struct *tty)
           if(pMsg)
           {
              kfree(pMsg);
-             TRACE_M("r3964_close - msg kfree %x",(int)pMsg);
+             TRACE_M("r3964_close - msg kfree %p",pMsg);
           }
        }
        kfree(pClient);
-       TRACE_M("r3964_close - client kfree %x",(int)pClient);
+       TRACE_M("r3964_close - client kfree %p",pClient);
        pClient=pNext;
     }
     /* Remove jobs from tx_queue: */
@@ -1177,11 +1177,11 @@ static void r3964_close(struct tty_struct *tty)
     /* Free buffers: */
     wake_up_interruptible(&pInfo->read_wait);
     kfree(pInfo->rx_buf);
-    TRACE_M("r3964_close - rx_buf kfree %x",(int)pInfo->rx_buf);
+    TRACE_M("r3964_close - rx_buf kfree %p",pInfo->rx_buf);
     kfree(pInfo->tx_buf);
-    TRACE_M("r3964_close - tx_buf kfree %x",(int)pInfo->tx_buf);
+    TRACE_M("r3964_close - tx_buf kfree %p",pInfo->tx_buf);
     kfree(pInfo);
-    TRACE_M("r3964_close - info kfree %x",(int)pInfo);
+    TRACE_M("r3964_close - info kfree %p",pInfo);
 }
 
 static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
@@ -1234,7 +1234,7 @@ repeat:
       count = sizeof(struct r3964_client_message);
 
       kfree(pMsg);
-      TRACE_M("r3964_read - msg kfree %x",(int)pMsg);
+      TRACE_M("r3964_read - msg kfree %p",pMsg);
 
       if (copy_to_user(buf,&theMsg, count))
         return -EFAULT;
@@ -1279,7 +1279,7 @@ static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
  * Allocate a buffer for the data and copy it from the buffer with header prepended
  */
    new_data = kmalloc (count+sizeof(struct r3964_block_header), GFP_KERNEL);
-   TRACE_M("r3964_write - kmalloc %x",(int)new_data);
+   TRACE_M("r3964_write - kmalloc %p",new_data);
    if (new_data == NULL) {
       if (pInfo->flags & R3964_DEBUG)
       {
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 1e33cb032e07..e91268e86833 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -810,13 +810,14 @@ int vc_resize(struct vc_data *vc, unsigned int cols, unsigned int lines)
                          * from the top and bottom of cursor position
                          */
                         old_origin += (vc->vc_y - new_rows/2) * old_row_size;
-                        end = old_origin + new_screen_size;
+                        end = old_origin + (old_row_size * new_rows);
                 }
         } else
                 /*
                  * Cursor near the top, copy contents from the top of buffer
                  */
-                end = (old_rows > new_rows) ? old_origin + new_screen_size :
+                end = (old_rows > new_rows) ? old_origin +
+                        (old_row_size * new_rows) :
                         vc->vc_scr_end;
 
         update_attr(vc);
diff --git a/drivers/char/watchdog/Kconfig b/drivers/char/watchdog/Kconfig
index fa789ea36bbe..344001b45af9 100644
--- a/drivers/char/watchdog/Kconfig
+++ b/drivers/char/watchdog/Kconfig
@@ -84,6 +84,17 @@ config 977_WATCHDOG
 
           Not sure? It's safe to say N.
 
+config IXP2000_WATCHDOG
+        tristate "IXP2000 Watchdog"
+        depends on WATCHDOG && ARCH_IXP2000
+        help
+          Say Y here if to include support for the watchdog timer
+          in the Intel IXP2000(2400, 2800, 2850) network processors.
+          This driver can be built as a module by choosing M. The module
+          will be called ixp2000_wdt.
+
+          Say N if you are unsure.
+
 config IXP4XX_WATCHDOG
         tristate "IXP4xx Watchdog"
         depends on WATCHDOG && ARCH_IXP4XX
@@ -100,17 +111,6 @@ config IXP4XX_WATCHDOG
 
           Say N if you are unsure.
 
-config IXP2000_WATCHDOG
-        tristate "IXP2000 Watchdog"
-        depends on WATCHDOG && ARCH_IXP2000
-        help
-          Say Y here if to include support for the watchdog timer
-          in the Intel IXP2000(2400, 2800, 2850) network processors.
-          This driver can be built as a module by choosing M. The module
-          will be called ixp2000_wdt.
-
-          Say N if you are unsure.
-
 config S3C2410_WATCHDOG
         tristate "S3C2410 Watchdog"
         depends on WATCHDOG && ARCH_S3C2410
@@ -233,6 +233,16 @@ config IB700_WDT
 
           Most people will say N.
 
+config IBMASR
+        tristate "IBM Automatic Server Restart"
+        depends on WATCHDOG && X86
+        help
+          This is the driver for the IBM Automatic Server Restart watchdog
+          timer builtin into some eServer xSeries machines.
+
+          To compile this driver as a module, choose M here: the
+          module will be called ibmasr.
+
 config WAFER_WDT
         tristate "ICP Wafer 5823 Single Board Computer Watchdog"
         depends on WATCHDOG && X86
@@ -243,6 +253,16 @@ config WAFER_WDT
           To compile this driver as a module, choose M here: the
           module will be called wafer5823wdt.
 
+config I6300ESB_WDT
+        tristate "Intel 6300ESB Timer/Watchdog"
+        depends on WATCHDOG && X86 && PCI
+        ---help---
+          Hardware driver for the watchdog timer built into the Intel
+          6300ESB controller hub.
+
+          To compile this driver as a module, choose M here: the
+          module will be called i6300esb.
+
 config I8XX_TCO
         tristate "Intel i8xx TCO Timer/Watchdog"
         depends on WATCHDOG && (X86 || IA64) && PCI
@@ -298,6 +318,19 @@ config 60XX_WDT
           You can compile this driver directly into the kernel, or use
           it as a module.  The module will be called sbc60xxwdt.
 
+config SBC8360_WDT
+        tristate "SBC8360 Watchdog Timer"
+        depends on WATCHDOG && X86
+        ---help---
+
+          This is the driver for the hardware watchdog on the SBC8360 Single
+          Board Computer produced by Axiomtek Co., Ltd. (www.axiomtek.com).
+
+          To compile this driver as a module, choose M here: the
+          module will be called sbc8360.ko.
+
+          Most people will say N.
+
 config CPU5_WDT
         tristate "SMA CPU5 Watchdog"
         depends on WATCHDOG && X86
@@ -336,6 +369,19 @@ config W83877F_WDT
 
           Most people will say N.
 
+config W83977F_WDT
+        tristate "W83977F (PCM-5335) Watchdog Timer"
+        depends on WATCHDOG && X86
+        ---help---
+          This is the driver for the hardware watchdog on the W83977F I/O chip
+          as used in AAEON's PCM-5335 SBC (and likely others).  This
+          watchdog simply watches your kernel to make sure it doesn't freeze,
+          and if it does, it reboots your computer after a certain amount of
+          time.
+
+          To compile this driver as a module, choose M here: the
+          module will be called w83977f_wdt.
+
 config MACHZ_WDT
         tristate "ZF MachZ Watchdog"
         depends on WATCHDOG && X86
@@ -355,6 +401,10 @@ config 8xx_WDT
         tristate "MPC8xx Watchdog Timer"
         depends on WATCHDOG && 8xx
 
+config MV64X60_WDT
+        tristate "MV64X60 (Marvell Discovery) Watchdog Timer"
+        depends on WATCHDOG && MV64X60
+
 config BOOKE_WDT
         tristate "PowerPC Book-E Watchdog Timer"
         depends on WATCHDOG && (BOOKE || 4xx)
@@ -362,6 +412,17 @@ config BOOKE_WDT
           Please see Documentation/watchdog/watchdog-api.txt for
           more information.
 
+# PPC64 Architecture
+
+config WATCHDOG_RTAS
+        tristate "RTAS watchdog"
+        depends on WATCHDOG && PPC_RTAS
+        help
+          This driver adds watchdog support for the RTAS watchdog.
+
+          To compile this driver as a module, choose M here. The module
+          will be called wdrtas.
+
 # MIPS Architecture
 
 config INDYDOG
@@ -430,16 +491,6 @@ config WATCHDOG_RIO
           machines.  The watchdog timeout period is normally one minute but
           can be changed with a boot-time parameter.
 
-# ppc64 RTAS watchdog
-config WATCHDOG_RTAS
-        tristate "RTAS watchdog"
-        depends on WATCHDOG && PPC_RTAS
-        help
-          This driver adds watchdog support for the RTAS watchdog.
-
-          To compile this driver as a module, choose M here. The module
-          will be called wdrtas.
-
 #
 # ISA-based Watchdog Cards
 #
diff --git a/drivers/char/watchdog/Makefile b/drivers/char/watchdog/Makefile
index bc6f5fe88c8c..cfd0a3987710 100644
--- a/drivers/char/watchdog/Makefile
+++ b/drivers/char/watchdog/Makefile
@@ -39,22 +39,27 @@ obj-$(CONFIG_ALIM7101_WDT) += alim7101_wdt.o
 obj-$(CONFIG_SC520_WDT) += sc520_wdt.o
 obj-$(CONFIG_EUROTECH_WDT) += eurotechwdt.o
 obj-$(CONFIG_IB700_WDT) += ib700wdt.o
+obj-$(CONFIG_IBMASR) += ibmasr.o
 obj-$(CONFIG_WAFER_WDT) += wafer5823wdt.o
+obj-$(CONFIG_I6300ESB_WDT) += i6300esb.o
 obj-$(CONFIG_I8XX_TCO) += i8xx_tco.o
 obj-$(CONFIG_SC1200_WDT) += sc1200wdt.o
 obj-$(CONFIG_SCx200_WDT) += scx200_wdt.o
 obj-$(CONFIG_60XX_WDT) += sbc60xxwdt.o
+obj-$(CONFIG_SBC8360_WDT) += sbc8360.o
 obj-$(CONFIG_CPU5_WDT) += cpu5wdt.o
 obj-$(CONFIG_W83627HF_WDT) += w83627hf_wdt.o
 obj-$(CONFIG_W83877F_WDT) += w83877f_wdt.o
+obj-$(CONFIG_W83977F_WDT) += w83977f_wdt.o
 obj-$(CONFIG_MACHZ_WDT) += machzwd.o
 
 # PowerPC Architecture
 obj-$(CONFIG_8xx_WDT) += mpc8xx_wdt.o
+obj-$(CONFIG_MV64X60_WDT) += mv64x60_wdt.o
+obj-$(CONFIG_BOOKE_WDT) += booke_wdt.o
 
 # PPC64 Architecture
 obj-$(CONFIG_WATCHDOG_RTAS) += wdrtas.o
-obj-$(CONFIG_BOOKE_WDT) += booke_wdt.o
 
 # MIPS Architecture
 obj-$(CONFIG_INDYDOG) += indydog.o
diff --git a/drivers/char/watchdog/i6300esb.c b/drivers/char/watchdog/i6300esb.c
new file mode 100644
index 000000000000..93785f13242e
--- /dev/null
+++ b/drivers/char/watchdog/i6300esb.c
@@ -0,0 +1,527 @@
+/*
+ *      i6300esb:       Watchdog timer driver for Intel 6300ESB chipset
+ *
+ *      (c) Copyright 2004 Google Inc.
+ *      (c) Copyright 2005 David Härdeman <david@2gen.com>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *      based on i810-tco.c which is in turn based on softdog.c
+ *
+ *      The timer is implemented in the following I/O controller hubs:
+ *      (See the intel documentation on http://developer.intel.com.)
+ *      6300ESB chip : document number 300641-003
+ *
+ *  2004YYZZ Ross Biro
+ *      Initial version 0.01
+ *  2004YYZZ Ross Biro
+ *      Version 0.02
+ *  20050210 David Härdeman <david@2gen.com>
+ *      Ported driver to kernel 2.6
+ */
+
+/*
+ *      Includes, defines, variables, module parameters, ...
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/mm.h>
+#include <linux/miscdevice.h>
+#include <linux/watchdog.h>
+#include <linux/reboot.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/ioport.h>
+
+#include <asm/uaccess.h>
+#include <asm/io.h>
+
+/* Module and version information */
+#define ESB_VERSION "0.03"
+#define ESB_MODULE_NAME "i6300ESB timer"
+#define ESB_DRIVER_NAME ESB_MODULE_NAME ", v" ESB_VERSION
+#define PFX ESB_MODULE_NAME ": "
+
+/* PCI configuration registers */
+#define ESB_CONFIG_REG  0x60            /* Config register                   */
+#define ESB_LOCK_REG    0x68            /* WDT lock register                 */
+
+/* Memory mapped registers */
+#define ESB_TIMER1_REG  BASEADDR + 0x00 /* Timer1 value after each reset     */
+#define ESB_TIMER2_REG  BASEADDR + 0x04 /* Timer2 value after each reset     */
+#define ESB_GINTSR_REG  BASEADDR + 0x08 /* General Interrupt Status Register */
+#define ESB_RELOAD_REG  BASEADDR + 0x0c /* Reload register                   */
+
+/* Lock register bits */
+#define ESB_WDT_FUNC    ( 0x01 << 2 )   /* Watchdog functionality            */
+#define ESB_WDT_ENABLE  ( 0x01 << 1 )   /* Enable WDT                        */
+#define ESB_WDT_LOCK    ( 0x01 << 0 )   /* Lock (nowayout)                   */
+
+/* Config register bits */
+#define ESB_WDT_REBOOT  ( 0x01 << 5 )   /* Enable reboot on timeout          */
+#define ESB_WDT_FREQ    ( 0x01 << 2 )   /* Decrement frequency               */
+#define ESB_WDT_INTTYPE ( 0x11 << 0 )   /* Interrupt type on timer1 timeout  */
+
+/* Reload register bits */
+#define ESB_WDT_RELOAD ( 0x01 << 8 )    /* prevent timeout                   */
+
+/* Magic constants */
+#define ESB_UNLOCK1     0x80            /* Step 1 to unlock reset registers  */
+#define ESB_UNLOCK2     0x86            /* Step 2 to unlock reset registers  */
+
+/* internal variables */
+static void __iomem *BASEADDR;
+static spinlock_t esb_lock; /* Guards the hardware */
+static unsigned long timer_alive;
+static struct pci_dev *esb_pci;
+static unsigned short triggered; /* The status of the watchdog upon boot */
+static char esb_expect_close;
+
+/* module parameters */
+#define WATCHDOG_HEARTBEAT 30   /* 30 sec default heartbeat (1<heartbeat<2*1023) */
+static int heartbeat = WATCHDOG_HEARTBEAT;  /* in seconds */
+module_param(heartbeat, int, 0);
+MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (1<heartbeat<2046, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
+
+static int nowayout = WATCHDOG_NOWAYOUT;
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+
+/*
+ * Some i6300ESB specific functions
+ */
+
+/*
+ * Prepare for reloading the timer by unlocking the proper registers.
+ * This is performed by first writing 0x80 followed by 0x86 to the
+ * reload register. After this the appropriate registers can be written
+ * to once before they need to be unlocked again.
+ */
+static inline void esb_unlock_registers(void) {
+        writeb(ESB_UNLOCK1, ESB_RELOAD_REG);
+        writeb(ESB_UNLOCK2, ESB_RELOAD_REG);
+}
+
+static void esb_timer_start(void)
+{
+        u8 val;
+
+        /* Enable or Enable + Lock? */
+        val = 0x02 | (nowayout ? 0x01 : 0x00);
+
+        pci_write_config_byte(esb_pci, ESB_LOCK_REG, val);
+}
+
+static int esb_timer_stop(void)
+{
+        u8 val;
+
+        spin_lock(&esb_lock);
+        /* First, reset timers as suggested by the docs */
+        esb_unlock_registers();
+        writew(ESB_WDT_RELOAD, ESB_RELOAD_REG);
+        /* Then disable the WDT */
+        pci_write_config_byte(esb_pci, ESB_LOCK_REG, 0x0);
+        pci_read_config_byte(esb_pci, ESB_LOCK_REG, &val);
+        spin_unlock(&esb_lock);
+
+        /* Returns 0 if the timer was disabled, non-zero otherwise */
+        return (val & 0x01);
+}
+
+static void esb_timer_keepalive(void)
+{
+        spin_lock(&esb_lock);
+        esb_unlock_registers();
+        writew(ESB_WDT_RELOAD, ESB_RELOAD_REG);
+        /* FIXME: Do we need to flush anything here? */
+        spin_unlock(&esb_lock);
+}
+
+static int esb_timer_set_heartbeat(int time)
+{
+        u32 val;
+
+        if (time < 0x1 || time > (2 * 0x03ff))
+                return -EINVAL;
+
+        spin_lock(&esb_lock);
+
+        /* We shift by 9, so if we are passed a value of 1 sec,
+         * val will be 1 << 9 = 512, then write that to two
+         * timers => 2 * 512 = 1024 (which is decremented at 1KHz)
+         */
+        val = time << 9;
+
+        /* Write timer 1 */
+        esb_unlock_registers();
+        writel(val, ESB_TIMER1_REG);
+
+        /* Write timer 2 */
+        esb_unlock_registers();
+        writel(val, ESB_TIMER2_REG);
+
+        /* Reload */
+        esb_unlock_registers();
+        writew(ESB_WDT_RELOAD, ESB_RELOAD_REG);
+
+        /* FIXME: Do we need to flush everything out? */
+
+        /* Done */
+        heartbeat = time;
+        spin_unlock(&esb_lock);
+        return 0;
+}
+
+static int esb_timer_read (void)
+{
+        u32 count;
+
+        /* This isn't documented, and doesn't take into
+         * acount which stage is running, but it looks
+         * like a 20 bit count down, so we might as well report it.
+         */
+        pci_read_config_dword(esb_pci, 0x64, &count);
+        return (int)count;
+}
+
+/*
+ *      /dev/watchdog handling
+ */
+
+static int esb_open (struct inode *inode, struct file *file)
+{
+        /* /dev/watchdog can only be opened once */
+        if (test_and_set_bit(0, &timer_alive))
+                return -EBUSY;
+
+        /* Reload and activate timer */
+        esb_timer_keepalive ();
+        esb_timer_start ();
+
+        return nonseekable_open(inode, file);
+}
+
+static int esb_release (struct inode *inode, struct file *file)
+{
+        /* Shut off the timer. */
+        if (esb_expect_close == 42) {
+                esb_timer_stop ();
+        } else {
+                printk(KERN_CRIT PFX "Unexpected close, not stopping watchdog!\n");
+                esb_timer_keepalive ();
+        }
+        clear_bit(0, &timer_alive);
+        esb_expect_close = 0;
+        return 0;
+}
+
+static ssize_t esb_write (struct file *file, const char __user *data,
+                          size_t len, loff_t * ppos)
+{
+        /* See if we got the magic character 'V' and reload the timer */
+        if (len) {
+                if (!nowayout) {
+                        size_t i;
+
+                        /* note: just in case someone wrote the magic character
+                         * five months ago... */
+                        esb_expect_close = 0;
+
+                        /* scan to see whether or not we got the magic character */
+                        for (i = 0; i != len; i++) {
+                                char c;
+                                if(get_user(c, data+i))
+                                        return -EFAULT;
+                                if (c == 'V')
+                                        esb_expect_close = 42;
+                        }
+                }
+
+                /* someone wrote to us, we should reload the timer */
+                esb_timer_keepalive ();
+        }
+        return len;
+}
+
+static int esb_ioctl (struct inode *inode, struct file *file,
+                      unsigned int cmd, unsigned long arg)
+{
+        int new_options, retval = -EINVAL;
+        int new_heartbeat;
+        void __user *argp = (void __user *)arg;
+        int __user *p = argp;
+        static struct watchdog_info ident = {
+                .options =              WDIOF_SETTIMEOUT |
+                                        WDIOF_KEEPALIVEPING |
+                                        WDIOF_MAGICCLOSE,
+                .firmware_version =     0,
+                .identity =             ESB_MODULE_NAME,
+        };
+
+        switch (cmd) {
+                case WDIOC_GETSUPPORT:
+                        return copy_to_user(argp, &ident,
+                                            sizeof (ident)) ? -EFAULT : 0;
+
+                case WDIOC_GETSTATUS:
+                        return put_user (esb_timer_read(), p);
+
+                case WDIOC_GETBOOTSTATUS:
+                        return put_user (triggered, p);
+
+                case WDIOC_KEEPALIVE:
+                        esb_timer_keepalive ();
+                        return 0;
+
+                case WDIOC_SETOPTIONS:
+                {
+                        if (get_user (new_options, p))
+                                return -EFAULT;
+
+                        if (new_options & WDIOS_DISABLECARD) {
+                                esb_timer_stop ();
+                                retval = 0;
+                        }
+
+                        if (new_options & WDIOS_ENABLECARD) {
+                                esb_timer_keepalive ();
+                                esb_timer_start ();
+                                retval = 0;
+                        }
+
+                        return retval;
+                }
+
+                case WDIOC_SETTIMEOUT:
+                {
+                        if (get_user(new_heartbeat, p))
+                                return -EFAULT;
+
+                        if (esb_timer_set_heartbeat(new_heartbeat))
+                            return -EINVAL;
+
+                        esb_timer_keepalive ();
+                        /* Fall */
+                }
+
+                case WDIOC_GETTIMEOUT:
+                        return put_user(heartbeat, p);
+
+                default:
+                        return -ENOIOCTLCMD;
+        }
+}
+
+/*
+ *      Notify system
+ */
+
+static int esb_notify_sys (struct notifier_block *this, unsigned long code, void *unused)
+{
+        if (code==SYS_DOWN || code==SYS_HALT) {
+                /* Turn the WDT off */
+                esb_timer_stop ();
+        }
+
+        return NOTIFY_DONE;
+}
+
+/*
+ *      Kernel Interfaces
+ */
+
+static struct file_operations esb_fops = {
+        .owner =        THIS_MODULE,
+        .llseek =       no_llseek,
+        .write =        esb_write,
+        .ioctl =        esb_ioctl,
+        .open =         esb_open,
+        .release =      esb_release,
+};
+
+static struct miscdevice esb_miscdev = {
+        .minor =        WATCHDOG_MINOR,
+        .name =         "watchdog",
+        .fops =         &esb_fops,
+};
+
+static struct notifier_block esb_notifier = {
+        .notifier_call =        esb_notify_sys,
+};
+
+/*
+ * Data for PCI driver interface
+ *
+ * This data only exists for exporting the supported
+ * PCI ids via MODULE_DEVICE_TABLE.  We do not actually
+ * register a pci_driver, because someone else might one day
+ * want to register another driver on the same PCI id.
+ */
+static struct pci_device_id esb_pci_tbl[] = {
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB_9), },
+        { 0, },                 /* End of list */
+};
+MODULE_DEVICE_TABLE (pci, esb_pci_tbl);
+
+/*
+ *      Init & exit routines
+ */
+
+static unsigned char __init esb_getdevice (void)
+{
+        u8 val1;
+        unsigned short val2;
+
+        struct pci_dev *dev = NULL;
+        /*
+         *      Find the PCI device
+         */
+
+        for_each_pci_dev(dev) {
+                if (pci_match_id(esb_pci_tbl, dev)) {
+                        esb_pci = dev;
+                        break;
+                }
+        }
+
+        if (esb_pci) {
+                if (pci_enable_device(esb_pci)) {
+                        printk (KERN_ERR PFX "failed to enable device\n");
+                        goto err_devput;
+                }
+
+                if (pci_request_region(esb_pci, 0, ESB_MODULE_NAME)) {
+                        printk (KERN_ERR PFX "failed to request region\n");
+                        goto err_disable;
+                }
+
+                BASEADDR = ioremap(pci_resource_start(esb_pci, 0),
+                                   pci_resource_len(esb_pci, 0));
+                if (BASEADDR == NULL) {
+                        /* Something's wrong here, BASEADDR has to be set */
+                        printk (KERN_ERR PFX "failed to get BASEADDR\n");
+                        goto err_release;
+                }
+
+                /*
+                 * The watchdog has two timers, it can be setup so that the
+                 * expiry of timer1 results in an interrupt and the expiry of
+                 * timer2 results in a reboot. We set it to not generate
+                 * any interrupts as there is not much we can do with it
+                 * right now.
+                 *
+                 * We also enable reboots and set the timer frequency to
+                 * the PCI clock divided by 2^15 (approx 1KHz).
+                 */
+                pci_write_config_word(esb_pci, ESB_CONFIG_REG, 0x0003);
+
+                /* Check that the WDT isn't already locked */
+                pci_read_config_byte(esb_pci, ESB_LOCK_REG, &val1);
+                if (val1 & ESB_WDT_LOCK)
+                        printk (KERN_WARNING PFX "nowayout already set\n");
+
+                /* Set the timer to watchdog mode and disable it for now */
+                pci_write_config_byte(esb_pci, ESB_LOCK_REG, 0x00);
+
+                /* Check if the watchdog was previously triggered */
+                esb_unlock_registers();
+                val2 = readw(ESB_RELOAD_REG);
+                triggered = (val2 & (0x01 << 9) >> 9);
+
+                /* Reset trigger flag and timers */
+                esb_unlock_registers();
+                writew((0x11 << 8), ESB_RELOAD_REG);
+
+                /* Done */
+                return 1;
+
+err_release:
+                pci_release_region(esb_pci, 0);
+err_disable:
+                pci_disable_device(esb_pci);
+err_devput:
+                pci_dev_put(esb_pci);
+        }
+        return 0;
+}
+
+static int __init watchdog_init (void)
+{
+        int ret;
+
+        spin_lock_init(&esb_lock);
+
+        /* Check whether or not the hardware watchdog is there */
+        if (!esb_getdevice () || esb_pci == NULL)
+                return -ENODEV;
+
+        /* Check that the heartbeat value is within it's range ; if not reset to the default */
+        if (esb_timer_set_heartbeat (heartbeat)) {
+                esb_timer_set_heartbeat (WATCHDOG_HEARTBEAT);
+                printk(KERN_INFO PFX "heartbeat value must be 1<heartbeat<2046, using %d\n",
+                       heartbeat);
+        }
+
+        ret = register_reboot_notifier(&esb_notifier);
+        if (ret != 0) {
+                printk(KERN_ERR PFX "cannot register reboot notifier (err=%d)\n",
+                        ret);
+                goto err_unmap;
+        }
+
+        ret = misc_register(&esb_miscdev);
+        if (ret != 0) {
+                printk(KERN_ERR PFX "cannot register miscdev on minor=%d (err=%d)\n",
+                        WATCHDOG_MINOR, ret);
+                goto err_notifier;
+        }
+
+        esb_timer_stop ();
+
+        printk (KERN_INFO PFX "initialized (0x%p). heartbeat=%d sec (nowayout=%d)\n",
+                BASEADDR, heartbeat, nowayout);
+
+        return 0;
+
+err_notifier:
+        unregister_reboot_notifier(&esb_notifier);
+err_unmap:
+        iounmap(BASEADDR);
+/* err_release: */
+        pci_release_region(esb_pci, 0);
+/* err_disable: */
+        pci_disable_device(esb_pci);
+/* err_devput: */
+        pci_dev_put(esb_pci);
+        return ret;
+}
+
+static void __exit watchdog_cleanup (void)
+{
+        /* Stop the timer before we leave */
+        if (!nowayout)
+                esb_timer_stop ();
+
+        /* Deregister */
+        misc_deregister(&esb_miscdev);
+        unregister_reboot_notifier(&esb_notifier);
+        iounmap(BASEADDR);
+        pci_release_region(esb_pci, 0);
+        pci_disable_device(esb_pci);
+        pci_dev_put(esb_pci);
+}
+
+module_init(watchdog_init);
+module_exit(watchdog_cleanup);
+
+MODULE_AUTHOR("Ross Biro and David Härdeman");
+MODULE_DESCRIPTION("Watchdog driver for Intel 6300ESB chipsets");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/char/watchdog/ibmasr.c b/drivers/char/watchdog/ibmasr.c
new file mode 100644
index 000000000000..294c474ae485
--- /dev/null
+++ b/drivers/char/watchdog/ibmasr.c
@@ -0,0 +1,405 @@
+/*
+ * IBM Automatic Server Restart driver.
+ *
+ * Copyright (c) 2005 Andrey Panin <pazke@donpac.ru>
+ *
+ * Based on driver written by Pete Reynolds.
+ * Copyright (c) IBM Corporation, 1998-2004.
+ *
+ * This software may be used and distributed according to the terms
+ * of the GNU Public License, incorporated herein by reference.
+ */
+
+#include <linux/config.h>
+#include <linux/fs.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/timer.h>
+#include <linux/miscdevice.h>
+#include <linux/watchdog.h>
+#include <linux/dmi.h>
+
+#include <asm/io.h>
+#include <asm/uaccess.h>
+
+
+enum {
+        ASMTYPE_UNKNOWN,
+        ASMTYPE_TOPAZ,
+        ASMTYPE_JASPER,
+        ASMTYPE_PEARL,
+        ASMTYPE_JUNIPER,
+        ASMTYPE_SPRUCE,
+};
+
+#define PFX "ibmasr: "
+
+#define TOPAZ_ASR_REG_OFFSET    4
+#define TOPAZ_ASR_TOGGLE        0x40
+#define TOPAZ_ASR_DISABLE       0x80
+
+/* PEARL ASR S/W REGISTER SUPERIO PORT ADDRESSES */
+#define PEARL_BASE      0xe04
+#define PEARL_WRITE     0xe06
+#define PEARL_READ      0xe07
+
+#define PEARL_ASR_DISABLE_MASK  0x80    /* bit 7: disable = 1, enable = 0 */
+#define PEARL_ASR_TOGGLE_MASK   0x40    /* bit 6: 0, then 1, then 0 */
+
+/* JASPER OFFSET FROM SIO BASE ADDR TO ASR S/W REGISTERS. */
+#define JASPER_ASR_REG_OFFSET   0x38
+
+#define JASPER_ASR_DISABLE_MASK 0x01    /* bit 0: disable = 1, enable = 0 */
+#define JASPER_ASR_TOGGLE_MASK  0x02    /* bit 1: 0, then 1, then 0 */
+
+#define JUNIPER_BASE_ADDRESS    0x54b   /* Base address of Juniper ASR */
+#define JUNIPER_ASR_DISABLE_MASK 0x01   /* bit 0: disable = 1 enable = 0 */
+#define JUNIPER_ASR_TOGGLE_MASK 0x02    /* bit 1: 0, then 1, then 0 */
+
+#define SPRUCE_BASE_ADDRESS     0x118e  /* Base address of Spruce ASR */
+#define SPRUCE_ASR_DISABLE_MASK 0x01    /* bit 1: disable = 1 enable = 0 */
+#define SPRUCE_ASR_TOGGLE_MASK  0x02    /* bit 0: 0, then 1, then 0 */
+
+
+static int nowayout = WATCHDOG_NOWAYOUT;
+
+static unsigned long asr_is_open;
+static char asr_expect_close;
+
+static unsigned int asr_type, asr_base, asr_length;
+static unsigned int asr_read_addr, asr_write_addr;
+static unsigned char asr_toggle_mask, asr_disable_mask;
+
+static void asr_toggle(void)
+{
+        unsigned char reg = inb(asr_read_addr);
+
+        outb(reg & ~asr_toggle_mask, asr_write_addr);
+        reg = inb(asr_read_addr);
+
+        outb(reg | asr_toggle_mask, asr_write_addr);
+        reg = inb(asr_read_addr);
+
+        outb(reg & ~asr_toggle_mask, asr_write_addr);
+        reg = inb(asr_read_addr);
+}
+
+static void asr_enable(void)
+{
+        unsigned char reg;
+
+        if (asr_type == ASMTYPE_TOPAZ) {
+                /* asr_write_addr == asr_read_addr */
+                reg = inb(asr_read_addr);
+                outb(reg & ~(TOPAZ_ASR_TOGGLE | TOPAZ_ASR_DISABLE),
+                     asr_read_addr);
+        } else {
+                /*
+                 * First make sure the hardware timer is reset by toggling
+                 * ASR hardware timer line.
+                 */
+                asr_toggle();
+
+                reg = inb(asr_read_addr);
+                outb(reg & ~asr_disable_mask, asr_write_addr);
+        }
+        reg = inb(asr_read_addr);
+}
+
+static void asr_disable(void)
+{
+        unsigned char reg = inb(asr_read_addr);
+
+        if (asr_type == ASMTYPE_TOPAZ)
+                /* asr_write_addr == asr_read_addr */
+                outb(reg | TOPAZ_ASR_TOGGLE | TOPAZ_ASR_DISABLE,
+                     asr_read_addr);
+        else {
+                outb(reg | asr_toggle_mask, asr_write_addr);
+                reg = inb(asr_read_addr);
+
+                outb(reg | asr_disable_mask, asr_write_addr);
+        }
+        reg = inb(asr_read_addr);
+}
+
+static int __init asr_get_base_address(void)
+{
+        unsigned char low, high;
+        const char *type = "";
+
+        asr_length = 1;
+
+        switch (asr_type) {
+        case ASMTYPE_TOPAZ:
+                /* SELECT SuperIO CHIP FOR QUERYING (WRITE 0x07 TO BOTH 0x2E and 0x2F) */
+                outb(0x07, 0x2e);
+                outb(0x07, 0x2f);
+
+                /* SELECT AND READ THE HIGH-NIBBLE OF THE GPIO BASE ADDRESS */
+                outb(0x60, 0x2e);
+                high = inb(0x2f);
+
+                /* SELECT AND READ THE LOW-NIBBLE OF THE GPIO BASE ADDRESS */
+                outb(0x61, 0x2e);
+                low = inb(0x2f);
+
+                asr_base = (high << 16) | low;
+                asr_read_addr = asr_write_addr =
+                        asr_base + TOPAZ_ASR_REG_OFFSET;
+                asr_length = 5;
+
+                break;
+
+        case ASMTYPE_JASPER:
+                type = "Jaspers ";
+
+                /* FIXME: need to use pci_config_lock here, but it's not exported */
+
+/*              spin_lock_irqsave(&pci_config_lock, flags);*/
+
+                /* Select the SuperIO chip in the PCI I/O port register */
+                outl(0x8000f858, 0xcf8);
+
+                /*
+                 * Read the base address for the SuperIO chip.
+                 * Only the lower 16 bits are valid, but the address is word
+                 * aligned so the last bit must be masked off.
+                 */
+                asr_base = inl(0xcfc) & 0xfffe;
+
+/*              spin_unlock_irqrestore(&pci_config_lock, flags);*/
+
+                asr_read_addr = asr_write_addr =
+                        asr_base + JASPER_ASR_REG_OFFSET;
+                asr_toggle_mask = JASPER_ASR_TOGGLE_MASK;
+                asr_disable_mask = JASPER_ASR_DISABLE_MASK;
+                asr_length = JASPER_ASR_REG_OFFSET + 1;
+
+                break;
+
+        case ASMTYPE_PEARL:
+                type = "Pearls ";
+                asr_base = PEARL_BASE;
+                asr_read_addr = PEARL_READ;
+                asr_write_addr = PEARL_WRITE;
+                asr_toggle_mask = PEARL_ASR_TOGGLE_MASK;
+                asr_disable_mask = PEARL_ASR_DISABLE_MASK;
+                asr_length = 4;
+                break;
+
+        case ASMTYPE_JUNIPER:
+                type = "Junipers ";
+                asr_base = JUNIPER_BASE_ADDRESS;
+                asr_read_addr = asr_write_addr = asr_base;
+                asr_toggle_mask = JUNIPER_ASR_TOGGLE_MASK;
+                asr_disable_mask = JUNIPER_ASR_DISABLE_MASK;
+                break;
+
+        case ASMTYPE_SPRUCE:
+                type = "Spruce's ";
+                asr_base = SPRUCE_BASE_ADDRESS;
+                asr_read_addr = asr_write_addr = asr_base;
+                asr_toggle_mask = SPRUCE_ASR_TOGGLE_MASK;
+                asr_disable_mask = SPRUCE_ASR_DISABLE_MASK;
+                break;
+        }
+
+        if (!request_region(asr_base, asr_length, "ibmasr")) {
+                printk(KERN_ERR PFX "address %#x already in use\n",
+                        asr_base);
+                return -EBUSY;
+        }
+
+        printk(KERN_INFO PFX "found %sASR @ addr %#x\n", type, asr_base);
+
+        return 0;
+}
+
+
+static ssize_t asr_write(struct file *file, const char __user *buf,
+                         size_t count, loff_t *ppos)
+{
+        if (count) {
+                if (!nowayout) {
+                        size_t i;
+
+                        /* In case it was set long ago */
+                        asr_expect_close = 0;
+
+                        for (i = 0; i != count; i++) {
+                                char c;
+                                if (get_user(c, buf + i))
+                                        return -EFAULT;
+                                if (c == 'V')
+                                        asr_expect_close = 42;
+                        }
+                }
+                asr_toggle();
+        }
+        return count;
+}
+
+static int asr_ioctl(struct inode *inode, struct file *file,
+                     unsigned int cmd, unsigned long arg)
+{
+        static const struct watchdog_info ident = {
+                .options =      WDIOF_KEEPALIVEPING | 
+                                WDIOF_MAGICCLOSE,
+                .identity =     "IBM ASR"
+        };
+        void __user *argp = (void __user *)arg;
+        int __user *p = argp;
+        int heartbeat;
+
+        switch (cmd) {
+                case WDIOC_GETSUPPORT:
+                        return copy_to_user(argp, &ident, sizeof(ident)) ?
+                                -EFAULT : 0;
+
+                case WDIOC_GETSTATUS:
+                case WDIOC_GETBOOTSTATUS:
+                        return put_user(0, p);
+
+                case WDIOC_KEEPALIVE:
+                        asr_toggle();
+                        return 0;
+
+                /*
+                 * The hardware has a fixed timeout value, so no WDIOC_SETTIMEOUT
+                 * and WDIOC_GETTIMEOUT always returns 256.
+                 */
+                case WDIOC_GETTIMEOUT:
+                        heartbeat = 256;
+                        return put_user(heartbeat, p);
+
+                case WDIOC_SETOPTIONS: {
+                        int new_options, retval = -EINVAL;
+
+                        if (get_user(new_options, p))
+                                return -EFAULT;
+
+                        if (new_options & WDIOS_DISABLECARD) {
+                                asr_disable();
+                                retval = 0;
+                        }
+
+                        if (new_options & WDIOS_ENABLECARD) {
+                                asr_enable();
+                                asr_toggle();
+                                retval = 0;
+                        }
+
+                        return retval;
+                }
+        }
+
+        return -ENOIOCTLCMD;
+}
+
+static int asr_open(struct inode *inode, struct file *file)
+{
+        if(test_and_set_bit(0, &asr_is_open))
+                return -EBUSY;
+
+        asr_toggle();
+        asr_enable();
+
+        return nonseekable_open(inode, file);
+}
+
+static int asr_release(struct inode *inode, struct file *file)
+{
+        if (asr_expect_close == 42)
+                asr_disable();
+        else {
+                printk(KERN_CRIT PFX "unexpected close, not stopping watchdog!\n");
+                asr_toggle();
+        }
+        clear_bit(0, &asr_is_open);
+        asr_expect_close = 0;
+        return 0;
+}
+
+static struct file_operations asr_fops = {
+        .owner =        THIS_MODULE,
+        .llseek =       no_llseek,
+        .write =        asr_write,
+        .ioctl =        asr_ioctl,
+        .open =         asr_open,
+        .release =      asr_release,
+};
+
+static struct miscdevice asr_miscdev = {
+        .minor =        WATCHDOG_MINOR,
+        .name =         "watchdog",
+        .fops =         &asr_fops,
+};
+
+
+struct ibmasr_id {
+        const char *desc;
+        int type;
+};
+
+static struct ibmasr_id __initdata ibmasr_id_table[] = {
+        { "IBM Automatic Server Restart - eserver xSeries 220", ASMTYPE_TOPAZ },
+        { "IBM Automatic Server Restart - Machine Type 8673", ASMTYPE_PEARL },
+        { "IBM Automatic Server Restart - Machine Type 8480", ASMTYPE_JASPER },
+        { "IBM Automatic Server Restart - Machine Type 8482", ASMTYPE_JUNIPER },
+        { "IBM Automatic Server Restart - Machine Type 8648", ASMTYPE_SPRUCE },
+        { NULL }
+};
+
+static int __init ibmasr_init(void)
+{
+        struct ibmasr_id *id;
+        int rc;
+
+        for (id = ibmasr_id_table; id->desc; id++) {
+                if (dmi_find_device(DMI_DEV_TYPE_OTHER, id->desc, NULL)) {
+                        asr_type = id->type;
+                        break;
+                }
+        }
+
+        if (!asr_type)
+                return -ENODEV;
+
+        rc = misc_register(&asr_miscdev);
+        if (rc < 0) {
+                printk(KERN_ERR PFX "failed to register misc device\n");
+                return rc;
+        }
+
+        rc = asr_get_base_address();
+        if (rc) {
+                misc_deregister(&asr_miscdev);
+                return rc;
+        }
+
+        return 0;
+}
+
+static void __exit ibmasr_exit(void)
+{
+        if (!nowayout)
+                asr_disable();
+
+        misc_deregister(&asr_miscdev);
+
+        release_region(asr_base, asr_length);
+}
+
+module_init(ibmasr_init);
+module_exit(ibmasr_exit);
+
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+
+MODULE_DESCRIPTION("IBM Automatic Server Restart driver");
+MODULE_AUTHOR("Andrey Panin");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/char/watchdog/mpcore_wdt.c b/drivers/char/watchdog/mpcore_wdt.c
index c694eee1fb24..75ca84ed4adf 100644
--- a/drivers/char/watchdog/mpcore_wdt.c
+++ b/drivers/char/watchdog/mpcore_wdt.c
@@ -30,6 +30,8 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/device.h>
+
+#include <asm/hardware/arm_twd.h>
 #include <asm/uaccess.h>
 
 struct mpcore_wdt {
diff --git a/drivers/char/watchdog/mv64x60_wdt.c b/drivers/char/watchdog/mv64x60_wdt.c
new file mode 100644
index 000000000000..6d3ff0836c44
--- /dev/null
+++ b/drivers/char/watchdog/mv64x60_wdt.c
@@ -0,0 +1,252 @@
+/*
+ * mv64x60_wdt.c - MV64X60 (Marvell Discovery) watchdog userspace interface
+ *
+ * Author: James Chapman <jchapman@katalix.com>
+ *
+ * Platform-specific setup code should configure the dog to generate
+ * interrupt or reset as required.  This code only enables/disables
+ * and services the watchdog.
+ *
+ * Derived from mpc8xx_wdt.c, with the following copyright.
+ * 
+ * 2002 (c) Florian Schirmer <jolt@tuxbox.org> This file is licensed under
+ * the terms of the GNU General Public License version 2. This program
+ * is licensed "as is" without any warranty of any kind, whether express
+ * or implied.
+ */
+
+#include <linux/config.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/watchdog.h>
+#include <asm/mv64x60.h>
+#include <asm/uaccess.h>
+#include <asm/io.h>
+
+/* MV64x60 WDC (config) register access definitions */
+#define MV64x60_WDC_CTL1_MASK   (3 << 24)
+#define MV64x60_WDC_CTL1(val)   ((val & 3) << 24)
+#define MV64x60_WDC_CTL2_MASK   (3 << 26)
+#define MV64x60_WDC_CTL2(val)   ((val & 3) << 26)
+
+/* Flags bits */
+#define MV64x60_WDOG_FLAG_OPENED        0
+#define MV64x60_WDOG_FLAG_ENABLED       1
+
+static unsigned long wdt_flags;
+static int wdt_status;
+static void __iomem *mv64x60_regs;
+static int mv64x60_wdt_timeout;
+
+static void mv64x60_wdt_reg_write(u32 val)
+{
+        /* Allow write only to CTL1 / CTL2 fields, retaining values in
+         * other fields.
+         */
+        u32 data = readl(mv64x60_regs + MV64x60_WDT_WDC);
+        data &= ~(MV64x60_WDC_CTL1_MASK | MV64x60_WDC_CTL2_MASK);
+        data |= val;
+        writel(data, mv64x60_regs + MV64x60_WDT_WDC);
+}
+
+static void mv64x60_wdt_service(void)
+{
+        /* Write 01 followed by 10 to CTL2 */
+        mv64x60_wdt_reg_write(MV64x60_WDC_CTL2(0x01));
+        mv64x60_wdt_reg_write(MV64x60_WDC_CTL2(0x02));
+}
+
+static void mv64x60_wdt_handler_disable(void)
+{
+        if (test_and_clear_bit(MV64x60_WDOG_FLAG_ENABLED, &wdt_flags)) {
+                /* Write 01 followed by 10 to CTL1 */
+                mv64x60_wdt_reg_write(MV64x60_WDC_CTL1(0x01));
+                mv64x60_wdt_reg_write(MV64x60_WDC_CTL1(0x02));
+                printk(KERN_NOTICE "mv64x60_wdt: watchdog deactivated\n");
+        }
+}
+
+static void mv64x60_wdt_handler_enable(void)
+{
+        if (!test_and_set_bit(MV64x60_WDOG_FLAG_ENABLED, &wdt_flags)) {
+                /* Write 01 followed by 10 to CTL1 */
+                mv64x60_wdt_reg_write(MV64x60_WDC_CTL1(0x01));
+                mv64x60_wdt_reg_write(MV64x60_WDC_CTL1(0x02));
+                printk(KERN_NOTICE "mv64x60_wdt: watchdog activated\n");
+        }
+}
+
+static int mv64x60_wdt_open(struct inode *inode, struct file *file)
+{
+        if (test_and_set_bit(MV64x60_WDOG_FLAG_OPENED, &wdt_flags))
+                return -EBUSY;
+
+        mv64x60_wdt_service();
+        mv64x60_wdt_handler_enable();
+
+        nonseekable_open(inode, file);
+
+        return 0;
+}
+
+static int mv64x60_wdt_release(struct inode *inode, struct file *file)
+{
+        mv64x60_wdt_service();
+
+#if !defined(CONFIG_WATCHDOG_NOWAYOUT)
+        mv64x60_wdt_handler_disable();
+#endif
+
+        clear_bit(MV64x60_WDOG_FLAG_OPENED, &wdt_flags);
+
+        return 0;
+}
+
+static ssize_t mv64x60_wdt_write(struct file *file, const char __user *data,
+                                 size_t len, loff_t * ppos)
+{
+        if (len)
+                mv64x60_wdt_service();
+
+        return len;
+}
+
+static int mv64x60_wdt_ioctl(struct inode *inode, struct file *file,
+                             unsigned int cmd, unsigned long arg)
+{
+        int timeout;
+        void __user *argp = (void __user *)arg;
+        static struct watchdog_info info = {
+                .options = WDIOF_KEEPALIVEPING,
+                .firmware_version = 0,
+                .identity = "MV64x60 watchdog",
+        };
+
+        switch (cmd) {
+        case WDIOC_GETSUPPORT:
+                if (copy_to_user(argp, &info, sizeof(info)))
+                        return -EFAULT;
+                break;
+
+        case WDIOC_GETSTATUS:
+        case WDIOC_GETBOOTSTATUS:
+                if (put_user(wdt_status, (int __user *)argp))
+                        return -EFAULT;
+                wdt_status &= ~WDIOF_KEEPALIVEPING;
+                break;
+
+        case WDIOC_GETTEMP:
+                return -EOPNOTSUPP;
+
+        case WDIOC_SETOPTIONS:
+                return -EOPNOTSUPP;
+
+        case WDIOC_KEEPALIVE:
+                mv64x60_wdt_service();
+                wdt_status |= WDIOF_KEEPALIVEPING;
+                break;
+
+        case WDIOC_SETTIMEOUT:
+                return -EOPNOTSUPP;
+
+        case WDIOC_GETTIMEOUT:
+                timeout = mv64x60_wdt_timeout * HZ;
+                if (put_user(timeout, (int __user *)argp))
+                        return -EFAULT;
+                break;
+
+        default:
+                return -ENOIOCTLCMD;
+        }
+
+        return 0;
+}
+
+static struct file_operations mv64x60_wdt_fops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .write = mv64x60_wdt_write,
+        .ioctl = mv64x60_wdt_ioctl,
+        .open = mv64x60_wdt_open,
+        .release = mv64x60_wdt_release,
+};
+
+static struct miscdevice mv64x60_wdt_miscdev = {
+        .minor = WATCHDOG_MINOR,
+        .name = "watchdog",
+        .fops = &mv64x60_wdt_fops,
+};
+
+static int __devinit mv64x60_wdt_probe(struct device *dev)
+{
+        struct platform_device *pd = to_platform_device(dev);
+        struct mv64x60_wdt_pdata *pdata = pd->dev.platform_data;
+        int bus_clk = 133;
+
+        mv64x60_wdt_timeout = 10;
+        if (pdata) {
+                mv64x60_wdt_timeout = pdata->timeout;
+                bus_clk = pdata->bus_clk;
+        }
+
+        mv64x60_regs = mv64x60_get_bridge_vbase();
+
+        writel((mv64x60_wdt_timeout * (bus_clk * 1000000)) >> 8,
+               mv64x60_regs + MV64x60_WDT_WDC);
+
+        return misc_register(&mv64x60_wdt_miscdev);
+}
+
+static int __devexit mv64x60_wdt_remove(struct device *dev)
+{
+        misc_deregister(&mv64x60_wdt_miscdev);
+
+        mv64x60_wdt_service();
+        mv64x60_wdt_handler_disable();
+
+        return 0;
+}
+
+static struct device_driver mv64x60_wdt_driver = {
+        .name = MV64x60_WDT_NAME,
+        .bus = &platform_bus_type,
+        .probe = mv64x60_wdt_probe,
+        .remove = __devexit_p(mv64x60_wdt_remove),
+};
+
+static struct platform_device *mv64x60_wdt_dev;
+
+static int __init mv64x60_wdt_init(void)
+{
+        int ret;
+
+        printk(KERN_INFO "MV64x60 watchdog driver\n");
+
+        mv64x60_wdt_dev = platform_device_register_simple(MV64x60_WDT_NAME,
+                                                          -1, NULL, 0);
+        if (IS_ERR(mv64x60_wdt_dev)) {
+                ret = PTR_ERR(mv64x60_wdt_dev);
+                goto out;
+        }
+
+        ret = driver_register(&mv64x60_wdt_driver);
+      out:
+        return ret;
+}
+
+static void __exit mv64x60_wdt_exit(void)
+{
+        driver_unregister(&mv64x60_wdt_driver);
+        platform_device_unregister(mv64x60_wdt_dev);
+}
+
+module_init(mv64x60_wdt_init);
+module_exit(mv64x60_wdt_exit);
+
+MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
+MODULE_DESCRIPTION("MV64x60 watchdog driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/char/watchdog/pcwd_pci.c b/drivers/char/watchdog/pcwd_pci.c
index 2b13afb09c5d..5a80adbf8032 100644
--- a/drivers/char/watchdog/pcwd_pci.c
+++ b/drivers/char/watchdog/pcwd_pci.c
@@ -29,27 +29,29 @@
  *      Includes, defines, variables, module parameters, ...
  */
 
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/types.h>
-#include <linux/delay.h>
-#include <linux/miscdevice.h>
-#include <linux/watchdog.h>
-#include <linux/notifier.h>
-#include <linux/reboot.h>
-#include <linux/init.h>
-#include <linux/fs.h>
-#include <linux/pci.h>
-#include <linux/ioport.h>
-#include <linux/spinlock.h>
-
-#include <asm/uaccess.h>
-#include <asm/io.h>
+#include <linux/config.h>       /* For CONFIG_WATCHDOG_NOWAYOUT/... */
+#include <linux/module.h>       /* For module specific items */
+#include <linux/moduleparam.h>  /* For new moduleparam's */
+#include <linux/types.h>        /* For standard types (like size_t) */
+#include <linux/errno.h>        /* For the -ENODEV/... values */
+#include <linux/kernel.h>       /* For printk/panic/... */
+#include <linux/delay.h>        /* For mdelay function */
+#include <linux/miscdevice.h>   /* For MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR) */
+#include <linux/watchdog.h>     /* For the watchdog specific items */
+#include <linux/notifier.h>     /* For notifier support */
+#include <linux/reboot.h>       /* For reboot_notifier stuff */
+#include <linux/init.h>         /* For __init/__exit/... */
+#include <linux/fs.h>           /* For file operations */
+#include <linux/pci.h>          /* For pci functions */
+#include <linux/ioport.h>       /* For io-port access */
+#include <linux/spinlock.h>     /* For spin_lock/spin_unlock/... */
+
+#include <asm/uaccess.h>        /* For copy_to_user/put_user/... */
+#include <asm/io.h>             /* For inb/outb/... */
 
 /* Module and version information */
 #define WATCHDOG_VERSION "1.01"
-#define WATCHDOG_DATE "15 Mar 2005"
+#define WATCHDOG_DATE "02 Sep 2005"
 #define WATCHDOG_DRIVER_NAME "PCI-PC Watchdog"
 #define WATCHDOG_NAME "pcwd_pci"
 #define PFX WATCHDOG_NAME ": "
@@ -335,12 +337,14 @@ static int pcipcwd_ioctl(struct inode *inode, struct file *file,
                                 return -EFAULT;
 
                         if (new_options & WDIOS_DISABLECARD) {
-                                pcipcwd_stop();
+                                if (pcipcwd_stop())
+                                        return -EIO;
                                 retval = 0;
                         }
 
                         if (new_options & WDIOS_ENABLECARD) {
-                                pcipcwd_start();
+                                if (pcipcwd_start())
+                                        return -EIO;
                                 retval = 0;
                         }
 
diff --git a/drivers/char/watchdog/s3c2410_wdt.c b/drivers/char/watchdog/s3c2410_wdt.c
index 8b292bf343c4..3625b2601b42 100644
--- a/drivers/char/watchdog/s3c2410_wdt.c
+++ b/drivers/char/watchdog/s3c2410_wdt.c
@@ -464,7 +464,7 @@ static void s3c2410wdt_shutdown(struct device *dev)
 static unsigned long wtcon_save;
 static unsigned long wtdat_save;
 
-static int s3c2410wdt_suspend(struct device *dev, u32 state, u32 level)
+static int s3c2410wdt_suspend(struct device *dev, pm_message_t state, u32 level)
 {
         if (level == SUSPEND_POWER_DOWN) {
                 /* Save watchdog state, and turn it off. */
diff --git a/drivers/char/watchdog/sbc8360.c b/drivers/char/watchdog/sbc8360.c
new file mode 100644
index 000000000000..c6cbf808d8c2
--- /dev/null
+++ b/drivers/char/watchdog/sbc8360.c
@@ -0,0 +1,414 @@
+/*
+ *      SBC8360 Watchdog driver
+ *
+ *      (c) Copyright 2005 Webcon, Inc.
+ *
+ *      Based on ib700wdt.c, which is based on advantechwdt.c which is based
+ *      on acquirewdt.c which is based on wdt.c.
+ *
+ *      (c) Copyright 2001 Charles Howes <chowes@vsol.net>
+ *
+ *      Based on advantechwdt.c which is based on acquirewdt.c which
+ *       is based on wdt.c.
+ *
+ *      (c) Copyright 2000-2001 Marek Michalkiewicz <marekm@linux.org.pl>
+ *
+ *      Based on acquirewdt.c which is based on wdt.c.
+ *      Original copyright messages:
+ *
+ *      (c) Copyright 1996 Alan Cox <alan@redhat.com>, All Rights Reserved.
+ *                              http://www.redhat.com
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *      Neither Alan Cox nor CymruNet Ltd. admit liability nor provide
+ *      warranty for any of this software. This material is provided
+ *      "AS-IS" and at no charge.
+ *
+ *      (c) Copyright 1995    Alan Cox <alan@redhat.com>
+ *
+ *      14-Dec-2001 Matt Domsch <Matt_Domsch@dell.com>
+ *           Added nowayout module option to override CONFIG_WATCHDOG_NOWAYOUT
+ *           Added timeout module option to override default
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/miscdevice.h>
+#include <linux/watchdog.h>
+#include <linux/ioport.h>
+#include <linux/delay.h>
+#include <linux/notifier.h>
+#include <linux/fs.h>
+#include <linux/reboot.h>
+#include <linux/init.h>
+#include <linux/spinlock.h>
+#include <linux/moduleparam.h>
+
+#include <asm/io.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+
+static unsigned long sbc8360_is_open;
+static spinlock_t sbc8360_lock;
+static char expect_close;
+
+#define PFX "sbc8360: "
+
+/*
+ *
+ * Watchdog Timer Configuration
+ *
+ * The function of the watchdog timer is to reset the system automatically
+ * and is defined at I/O port 0120H and 0121H.  To enable the watchdog timer
+ * and allow the system to reset, write appropriate values from the table
+ * below to I/O port 0120H and 0121H.  To disable the timer, write a zero
+ * value to I/O port 0121H for the system to stop the watchdog function.
+ *
+ * The following describes how the timer should be programmed (according to
+ * the vendor documentation)
+ *
+ * Enabling Watchdog:
+ * MOV AX,000AH (enable, phase I)
+ * MOV DX,0120H
+ * OUT DX,AX
+ * MOV AX,000BH (enable, phase II)
+ * MOV DX,0120H
+ * OUT DX,AX
+ * MOV AX,000nH (set multiplier n, from 1-4)
+ * MOV DX,0120H
+ * OUT DX,AX
+ * MOV AX,000mH (set base timer m, from 0-F)
+ * MOV DX,0121H
+ * OUT DX,AX
+ *
+ * Reset timer:
+ * MOV AX,000mH (same as set base timer, above)
+ * MOV DX,0121H
+ * OUT DX,AX
+ *
+ * Disabling Watchdog:
+ * MOV AX,0000H (a zero value)
+ * MOV DX,0120H
+ * OUT DX,AX
+ *
+ * Watchdog timeout configuration values:
+ *              N
+ *      M |     1       2       3       4
+ *      --|----------------------------------
+ *      0 |     0.5s    5s      50s     100s
+ *      1 |     1s      10s     100s    200s
+ *      2 |     1.5s    15s     150s    300s
+ *      3 |     2s      20s     200s    400s
+ *      4 |     2.5s    25s     250s    500s
+ *      5 |     3s      30s     300s    600s
+ *      6 |     3.5s    35s     350s    700s
+ *      7 |     4s      40s     400s    800s
+ *      8 |     4.5s    45s     450s    900s
+ *      9 |     5s      50s     500s    1000s
+ *      A |     5.5s    55s     550s    1100s
+ *      B |     6s      60s     600s    1200s
+ *      C |     6.5s    65s     650s    1300s
+ *      D |     7s      70s     700s    1400s
+ *      E |     7.5s    75s     750s    1500s
+ *      F |     8s      80s     800s    1600s
+ *
+ * Another way to say the same things is:
+ *  For N=1, Timeout = (M+1) * 0.5s
+ *  For N=2, Timeout = (M+1) * 5s
+ *  For N=3, Timeout = (M+1) * 50s
+ *  For N=4, Timeout = (M+1) * 100s
+ *
+ */
+
+static int wd_times[64][2] = {
+        {0, 1},                 /* 0  = 0.5s */
+        {1, 1},                 /* 1  = 1s   */
+        {2, 1},                 /* 2  = 1.5s */
+        {3, 1},                 /* 3  = 2s   */
+        {4, 1},                 /* 4  = 2.5s */
+        {5, 1},                 /* 5  = 3s   */
+        {6, 1},                 /* 6  = 3.5s */
+        {7, 1},                 /* 7  = 4s   */
+        {8, 1},                 /* 8  = 4.5s */
+        {9, 1},                 /* 9  = 5s   */
+        {0xA, 1},               /* 10 = 5.5s */
+        {0xB, 1},               /* 11 = 6s   */
+        {0xC, 1},               /* 12 = 6.5s */
+        {0xD, 1},               /* 13 = 7s   */
+        {0xE, 1},               /* 14 = 7.5s */
+        {0xF, 1},               /* 15 = 8s   */
+        {0, 2},                 /* 16 = 5s  */
+        {1, 2},                 /* 17 = 10s */
+        {2, 2},                 /* 18 = 15s */
+        {3, 2},                 /* 19 = 20s */
+        {4, 2},                 /* 20 = 25s */
+        {5, 2},                 /* 21 = 30s */
+        {6, 2},                 /* 22 = 35s */
+        {7, 2},                 /* 23 = 40s */
+        {8, 2},                 /* 24 = 45s */
+        {9, 2},                 /* 25 = 50s */
+        {0xA, 2},               /* 26 = 55s */
+        {0xB, 2},               /* 27 = 60s */
+        {0xC, 2},               /* 28 = 65s */
+        {0xD, 2},               /* 29 = 70s */
+        {0xE, 2},               /* 30 = 75s */
+        {0xF, 2},               /* 31 = 80s */
+        {0, 3},                 /* 32 = 50s  */
+        {1, 3},                 /* 33 = 100s */
+        {2, 3},                 /* 34 = 150s */
+        {3, 3},                 /* 35 = 200s */
+        {4, 3},                 /* 36 = 250s */
+        {5, 3},                 /* 37 = 300s */
+        {6, 3},                 /* 38 = 350s */
+        {7, 3},                 /* 39 = 400s */
+        {8, 3},                 /* 40 = 450s */
+        {9, 3},                 /* 41 = 500s */
+        {0xA, 3},               /* 42 = 550s */
+        {0xB, 3},               /* 43 = 600s */
+        {0xC, 3},               /* 44 = 650s */
+        {0xD, 3},               /* 45 = 700s */
+        {0xE, 3},               /* 46 = 750s */
+        {0xF, 3},               /* 47 = 800s */
+        {0, 4},                 /* 48 = 100s */
+        {1, 4},                 /* 49 = 200s */
+        {2, 4},                 /* 50 = 300s */
+        {3, 4},                 /* 51 = 400s */
+        {4, 4},                 /* 52 = 500s */
+        {5, 4},                 /* 53 = 600s */
+        {6, 4},                 /* 54 = 700s */
+        {7, 4},                 /* 55 = 800s */
+        {8, 4},                 /* 56 = 900s */
+        {9, 4},                 /* 57 = 1000s */
+        {0xA, 4},               /* 58 = 1100s */
+        {0xB, 4},               /* 59 = 1200s */
+        {0xC, 4},               /* 60 = 1300s */
+        {0xD, 4},               /* 61 = 1400s */
+        {0xE, 4},               /* 62 = 1500s */
+        {0xF, 4}                /* 63 = 1600s */
+};
+
+#define SBC8360_ENABLE 0x120
+#define SBC8360_BASETIME 0x121
+
+static int timeout = 27;
+static int wd_margin = 0xB;
+static int wd_multiplier = 2;
+static int nowayout = WATCHDOG_NOWAYOUT;
+
+module_param(timeout, int, 27);
+MODULE_PARM_DESC(timeout, "Index into timeout table (0-63) (default=27 (60s))");
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout,
+                 "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+
+/*
+ *      Kernel methods.
+ */
+
+/* Activate and pre-configure watchdog */
+static void sbc8360_activate(void)
+{
+        /* Enable the watchdog */
+        outb(0x0A, SBC8360_ENABLE);
+        msleep_interruptible(100);
+        outb(0x0B, SBC8360_ENABLE);
+        msleep_interruptible(100);
+        /* Set timeout multiplier */
+        outb(wd_multiplier, SBC8360_ENABLE);
+        msleep_interruptible(100);
+        /* Nothing happens until first sbc8360_ping() */
+}
+
+/* Kernel pings watchdog */
+static void sbc8360_ping(void)
+{
+        /* Write the base timer register */
+        outb(wd_margin, SBC8360_BASETIME);
+}
+
+/* Userspace pings kernel driver, or requests clean close */
+static ssize_t sbc8360_write(struct file *file, const char __user * buf,
+                             size_t count, loff_t * ppos)
+{
+        if (count) {
+                if (!nowayout) {
+                        size_t i;
+
+                        /* In case it was set long ago */
+                        expect_close = 0;
+
+                        for (i = 0; i != count; i++) {
+                                char c;
+                                if (get_user(c, buf + i))
+                                        return -EFAULT;
+                                if (c == 'V')
+                                        expect_close = 42;
+                        }
+                }
+                sbc8360_ping();
+        }
+        return count;
+}
+
+static int sbc8360_open(struct inode *inode, struct file *file)
+{
+        spin_lock(&sbc8360_lock);
+        if (test_and_set_bit(0, &sbc8360_is_open)) {
+                spin_unlock(&sbc8360_lock);
+                return -EBUSY;
+        }
+        if (nowayout)
+                __module_get(THIS_MODULE);
+
+        /* Activate and ping once to start the countdown */
+        spin_unlock(&sbc8360_lock);
+        sbc8360_activate();
+        sbc8360_ping();
+        return nonseekable_open(inode, file);
+}
+
+static int sbc8360_close(struct inode *inode, struct file *file)
+{
+        spin_lock(&sbc8360_lock);
+        if (expect_close == 42)
+                outb(0, SBC8360_ENABLE);
+        else
+                printk(KERN_CRIT PFX
+                       "SBC8360 device closed unexpectedly.  SBC8360 will not stop!\n");
+
+        clear_bit(0, &sbc8360_is_open);
+        expect_close = 0;
+        spin_unlock(&sbc8360_lock);
+        return 0;
+}
+
+/*
+ *      Notifier for system down
+ */
+
+static int sbc8360_notify_sys(struct notifier_block *this, unsigned long code,
+                              void *unused)
+{
+        if (code == SYS_DOWN || code == SYS_HALT) {
+                /* Disable the SBC8360 Watchdog */
+                outb(0, SBC8360_ENABLE);
+        }
+        return NOTIFY_DONE;
+}
+
+/*
+ *      Kernel Interfaces
+ */
+
+static struct file_operations sbc8360_fops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .write = sbc8360_write,
+        .open = sbc8360_open,
+        .release = sbc8360_close,
+};
+
+static struct miscdevice sbc8360_miscdev = {
+        .minor = WATCHDOG_MINOR,
+        .name = "watchdog",
+        .fops = &sbc8360_fops,
+};
+
+/*
+ *      The SBC8360 needs to learn about soft shutdowns in order to
+ *      turn the timebomb registers off.
+ */
+
+static struct notifier_block sbc8360_notifier = {
+        .notifier_call = sbc8360_notify_sys,
+};
+
+static int __init sbc8360_init(void)
+{
+        int res;
+        unsigned long int mseconds = 60000;
+
+        spin_lock_init(&sbc8360_lock);
+        res = misc_register(&sbc8360_miscdev);
+        if (res) {
+                printk(KERN_ERR PFX "failed to register misc device\n");
+                goto out_nomisc;
+        }
+
+        if (!request_region(SBC8360_ENABLE, 1, "SBC8360")) {
+                printk(KERN_ERR PFX "ENABLE method I/O %X is not available.\n",
+                       SBC8360_ENABLE);
+                res = -EIO;
+                goto out_noenablereg;
+        }
+        if (!request_region(SBC8360_BASETIME, 1, "SBC8360")) {
+                printk(KERN_ERR PFX
+                       "BASETIME method I/O %X is not available.\n",
+                       SBC8360_BASETIME);
+                res = -EIO;
+                goto out_nobasetimereg;
+        }
+
+        res = register_reboot_notifier(&sbc8360_notifier);
+        if (res) {
+                printk(KERN_ERR PFX "Failed to register reboot notifier.\n");
+                goto out_noreboot;
+        }
+
+        if (timeout < 0 || timeout > 63) {
+                printk(KERN_ERR PFX "Invalid timeout index (must be 0-63).\n");
+                res = -EINVAL;
+                goto out_noreboot;
+        }
+
+        wd_margin = wd_times[timeout][0];
+        wd_multiplier = wd_times[timeout][1];
+
+        if (wd_multiplier == 1)
+                mseconds = (wd_margin + 1) * 500;
+        else if (wd_multiplier == 2)
+                mseconds = (wd_margin + 1) * 5000;
+        else if (wd_multiplier == 3)
+                mseconds = (wd_margin + 1) * 50000;
+        else if (wd_multiplier == 4)
+                mseconds = (wd_margin + 1) * 100000;
+
+        /* My kingdom for the ability to print "0.5 seconds" in the kernel! */
+        printk(KERN_INFO PFX "Timeout set at %ld ms.\n", mseconds);
+
+        return 0;
+
+      out_noreboot:
+        release_region(SBC8360_ENABLE, 1);
+        release_region(SBC8360_BASETIME, 1);
+      out_noenablereg:
+      out_nobasetimereg:
+        misc_deregister(&sbc8360_miscdev);
+      out_nomisc:
+        return res;
+}
+
+static void __exit sbc8360_exit(void)
+{
+        misc_deregister(&sbc8360_miscdev);
+        unregister_reboot_notifier(&sbc8360_notifier);
+        release_region(SBC8360_ENABLE, 1);
+        release_region(SBC8360_BASETIME, 1);
+}
+
+module_init(sbc8360_init);
+module_exit(sbc8360_exit);
+
+MODULE_AUTHOR("Ian E. Morgan <imorgan@webcon.ca>");
+MODULE_DESCRIPTION("SBC8360 watchdog driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION("1.0");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+
+/* end of sbc8360.c */
diff --git a/drivers/char/watchdog/w83977f_wdt.c b/drivers/char/watchdog/w83977f_wdt.c
new file mode 100644
index 000000000000..a7ff64c8921f
--- /dev/null
+++ b/drivers/char/watchdog/w83977f_wdt.c
@@ -0,0 +1,543 @@
+/*
+ *      W83977F Watchdog Timer Driver for Winbond W83977F I/O Chip
+ *
+ *      (c) Copyright 2005  Jose Goncalves <jose.goncalves@inov.pt>
+ *
+ *      Based on w83877f_wdt.c by Scott Jennings,
+ *           and wdt977.c by Woody Suwalski
+ *
+ *                      -----------------------
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/config.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/miscdevice.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/watchdog.h>
+#include <linux/notifier.h>
+#include <linux/reboot.h>
+
+#include <asm/io.h>
+#include <asm/system.h>
+#include <asm/uaccess.h>
+
+#define WATCHDOG_VERSION  "1.00"
+#define WATCHDOG_NAME     "W83977F WDT"
+#define PFX WATCHDOG_NAME ": "
+#define DRIVER_VERSION    WATCHDOG_NAME " driver, v" WATCHDOG_VERSION "\n"
+
+#define IO_INDEX_PORT     0x3F0
+#define IO_DATA_PORT      (IO_INDEX_PORT+1)
+
+#define UNLOCK_DATA       0x87
+#define LOCK_DATA         0xAA
+#define DEVICE_REGISTER   0x07
+
+#define DEFAULT_TIMEOUT   45            /* default timeout in seconds */
+
+static  int timeout = DEFAULT_TIMEOUT;
+static  int timeoutW;                   /* timeout in watchdog counter units */
+static  unsigned long timer_alive;
+static  int testmode;
+static  char expect_close;
+static  spinlock_t spinlock;
+
+module_param(timeout, int, 0);
+MODULE_PARM_DESC(timeout,"Watchdog timeout in seconds (15..7635), default=" __MODULE_STRING(DEFAULT_TIMEOUT) ")");
+module_param(testmode, int, 0);
+MODULE_PARM_DESC(testmode,"Watchdog testmode (1 = no reboot), default=0");
+
+static int nowayout = WATCHDOG_NOWAYOUT;
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+
+/*
+ * Start the watchdog
+ */
+
+static int wdt_start(void)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&spinlock, flags);
+
+        /* Unlock the SuperIO chip */
+        outb_p(UNLOCK_DATA,IO_INDEX_PORT);
+        outb_p(UNLOCK_DATA,IO_INDEX_PORT);
+
+        /*
+         * Select device Aux2 (device=8) to set watchdog regs F2, F3 and F4.
+         * F2 has the timeout in watchdog counter units.
+         * F3 is set to enable watchdog LED blink at timeout.
+         * F4 is used to just clear the TIMEOUT'ed state (bit 0).
+         */
+        outb_p(DEVICE_REGISTER,IO_INDEX_PORT);
+        outb_p(0x08,IO_DATA_PORT);
+        outb_p(0xF2,IO_INDEX_PORT);
+        outb_p(timeoutW,IO_DATA_PORT);
+        outb_p(0xF3,IO_INDEX_PORT);
+        outb_p(0x08,IO_DATA_PORT);
+        outb_p(0xF4,IO_INDEX_PORT);
+        outb_p(0x00,IO_DATA_PORT);
+
+        /* Set device Aux2 active */
+        outb_p(0x30,IO_INDEX_PORT);
+        outb_p(0x01,IO_DATA_PORT);
+
+        /* 
+         * Select device Aux1 (dev=7) to set GP16 as the watchdog output
+         * (in reg E6) and GP13 as the watchdog LED output (in reg E3).
+         * Map GP16 at pin 119.
+         * In test mode watch the bit 0 on F4 to indicate "triggered" or
+         * check watchdog LED on SBC.
+         */
+        outb_p(DEVICE_REGISTER,IO_INDEX_PORT);
+        outb_p(0x07,IO_DATA_PORT);
+        if (!testmode)
+        {
+                unsigned pin_map;
+
+                outb_p(0xE6,IO_INDEX_PORT);
+                outb_p(0x0A,IO_DATA_PORT);
+                outb_p(0x2C,IO_INDEX_PORT);
+                pin_map = inb_p(IO_DATA_PORT);
+                pin_map |= 0x10;
+                pin_map &= ~(0x20);
+                outb_p(0x2C,IO_INDEX_PORT);
+                outb_p(pin_map,IO_DATA_PORT);
+        }
+        outb_p(0xE3,IO_INDEX_PORT);
+        outb_p(0x08,IO_DATA_PORT);
+
+        /* Set device Aux1 active */
+        outb_p(0x30,IO_INDEX_PORT);
+        outb_p(0x01,IO_DATA_PORT);
+
+        /* Lock the SuperIO chip */
+        outb_p(LOCK_DATA,IO_INDEX_PORT);
+
+        spin_unlock_irqrestore(&spinlock, flags);
+
+        printk(KERN_INFO PFX "activated.\n");
+
+        return 0;
+}
+
+/*
+ * Stop the watchdog
+ */
+
+static int wdt_stop(void)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&spinlock, flags);
+
+        /* Unlock the SuperIO chip */
+        outb_p(UNLOCK_DATA,IO_INDEX_PORT);
+        outb_p(UNLOCK_DATA,IO_INDEX_PORT);
+
+        /* 
+         * Select device Aux2 (device=8) to set watchdog regs F2, F3 and F4.
+         * F2 is reset to its default value (watchdog timer disabled).
+         * F3 is reset to its default state.
+         * F4 clears the TIMEOUT'ed state (bit 0) - back to default.
+         */
+        outb_p(DEVICE_REGISTER,IO_INDEX_PORT);
+        outb_p(0x08,IO_DATA_PORT);
+        outb_p(0xF2,IO_INDEX_PORT);
+        outb_p(0xFF,IO_DATA_PORT);
+        outb_p(0xF3,IO_INDEX_PORT);
+        outb_p(0x00,IO_DATA_PORT);
+        outb_p(0xF4,IO_INDEX_PORT);
+        outb_p(0x00,IO_DATA_PORT);
+        outb_p(0xF2,IO_INDEX_PORT);
+        outb_p(0x00,IO_DATA_PORT);
+
+        /*
+         * Select device Aux1 (dev=7) to set GP16 (in reg E6) and 
+         * Gp13 (in reg E3) as inputs.
+         */
+        outb_p(DEVICE_REGISTER,IO_INDEX_PORT);
+        outb_p(0x07,IO_DATA_PORT);
+        if (!testmode)
+        {
+                outb_p(0xE6,IO_INDEX_PORT);
+                outb_p(0x01,IO_DATA_PORT);
+        }
+        outb_p(0xE3,IO_INDEX_PORT);
+        outb_p(0x01,IO_DATA_PORT);
+
+        /* Lock the SuperIO chip */
+        outb_p(LOCK_DATA,IO_INDEX_PORT);
+
+        spin_unlock_irqrestore(&spinlock, flags);
+
+        printk(KERN_INFO PFX "shutdown.\n");
+
+        return 0;
+}
+
+/*
+ * Send a keepalive ping to the watchdog
+ * This is done by simply re-writing the timeout to reg. 0xF2
+ */
+
+static int wdt_keepalive(void)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&spinlock, flags);
+
+        /* Unlock the SuperIO chip */
+        outb_p(UNLOCK_DATA,IO_INDEX_PORT);
+        outb_p(UNLOCK_DATA,IO_INDEX_PORT);
+
+        /* Select device Aux2 (device=8) to kick watchdog reg F2 */
+        outb_p(DEVICE_REGISTER,IO_INDEX_PORT);
+        outb_p(0x08,IO_DATA_PORT);
+        outb_p(0xF2,IO_INDEX_PORT);
+        outb_p(timeoutW,IO_DATA_PORT);
+
+        /* Lock the SuperIO chip */
+        outb_p(LOCK_DATA,IO_INDEX_PORT);
+
+        spin_unlock_irqrestore(&spinlock, flags);
+
+        return 0;
+}
+
+/*
+ * Set the watchdog timeout value
+ */
+
+static int wdt_set_timeout(int t)
+{
+        int tmrval;
+
+        /*
+         * Convert seconds to watchdog counter time units, rounding up.
+         * On PCM-5335 watchdog units are 30 seconds/step with 15 sec startup 
+         * value. This information is supplied in the PCM-5335 manual and was
+         * checked by me on a real board. This is a bit strange because W83977f
+         * datasheet says counter unit is in minutes!
+         */
+        if (t < 15)
+                return -EINVAL;
+
+        tmrval = ((t + 15) + 29) / 30;
+
+        if (tmrval > 255)
+                return -EINVAL;
+
+        /*
+         * timeout is the timeout in seconds, 
+         * timeoutW is the timeout in watchdog counter units.
+         */
+        timeoutW = tmrval;
+        timeout = (timeoutW * 30) - 15;
+        return 0;
+}
+
+/*
+ * Get the watchdog status
+ */
+
+static int wdt_get_status(int *status)
+{
+        int new_status;
+        unsigned long flags;
+
+        spin_lock_irqsave(&spinlock, flags);
+
+        /* Unlock the SuperIO chip */
+        outb_p(UNLOCK_DATA,IO_INDEX_PORT);
+        outb_p(UNLOCK_DATA,IO_INDEX_PORT);
+
+        /* Select device Aux2 (device=8) to read watchdog reg F4 */
+        outb_p(DEVICE_REGISTER,IO_INDEX_PORT);
+        outb_p(0x08,IO_DATA_PORT);
+        outb_p(0xF4,IO_INDEX_PORT);
+        new_status = inb_p(IO_DATA_PORT);
+
+        /* Lock the SuperIO chip */
+        outb_p(LOCK_DATA,IO_INDEX_PORT);
+
+        spin_unlock_irqrestore(&spinlock, flags);
+
+        *status = 0;
+        if (new_status & 1)
+                *status |= WDIOF_CARDRESET;
+
+        return 0;
+}
+
+
+/*
+ *      /dev/watchdog handling
+ */
+
+static int wdt_open(struct inode *inode, struct file *file)
+{
+        /* If the watchdog is alive we don't need to start it again */
+        if( test_and_set_bit(0, &timer_alive) )
+                return -EBUSY;
+
+        if (nowayout)
+                __module_get(THIS_MODULE);
+
+        wdt_start();
+        return nonseekable_open(inode, file);
+}
+
+static int wdt_release(struct inode *inode, struct file *file)
+{
+        /*
+         * Shut off the timer.
+         * Lock it in if it's a module and we set nowayout
+         */
+        if (expect_close == 42)
+        {
+                wdt_stop();
+                clear_bit(0, &timer_alive);
+        } else {
+                wdt_keepalive();
+                printk(KERN_CRIT PFX "unexpected close, not stopping watchdog!\n");
+        }
+        expect_close = 0;
+        return 0;
+}
+
+/*
+ *      wdt_write:
+ *      @file: file handle to the watchdog
+ *      @buf: buffer to write (unused as data does not matter here
+ *      @count: count of bytes
+ *      @ppos: pointer to the position to write. No seeks allowed
+ *
+ *      A write to a watchdog device is defined as a keepalive signal. Any
+ *      write of data will do, as we we don't define content meaning.
+ */
+
+static ssize_t wdt_write(struct file *file, const char __user *buf,
+                            size_t count, loff_t *ppos)
+{
+        /* See if we got the magic character 'V' and reload the timer */
+        if(count)
+        {
+                if (!nowayout)
+                {
+                        size_t ofs;
+
+                        /* note: just in case someone wrote the magic character long ago */
+                        expect_close = 0;
+
+                        /* scan to see whether or not we got the magic character */
+                        for(ofs = 0; ofs != count; ofs++)
+                        {
+                                char c;
+                                if (get_user(c, buf + ofs))
+                                        return -EFAULT;
+                                if (c == 'V') {
+                                        expect_close = 42;
+                                }
+                        }
+                }
+
+                /* someone wrote to us, we should restart timer */
+                wdt_keepalive();
+        }
+        return count;
+}
+
+/*
+ *      wdt_ioctl:
+ *      @inode: inode of the device
+ *      @file: file handle to the device
+ *      @cmd: watchdog command
+ *      @arg: argument pointer
+ *
+ *      The watchdog API defines a common set of functions for all watchdogs
+ *      according to their available features.
+ */
+
+static struct watchdog_info ident = {
+        .options = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING,
+        .firmware_version =     1,
+        .identity = WATCHDOG_NAME,
+};
+
+static int wdt_ioctl(struct inode *inode, struct file *file,
+        unsigned int cmd, unsigned long arg)
+{
+        int status;
+        int new_options, retval = -EINVAL;
+        int new_timeout;
+        union {
+                struct watchdog_info __user *ident;
+                int __user *i;
+        } uarg;
+
+        uarg.i = (int __user *)arg;
+
+        switch(cmd)
+        {
+        default:
+                return -ENOIOCTLCMD;
+
+        case WDIOC_GETSUPPORT:
+                return copy_to_user(uarg.ident, &ident, sizeof(ident)) ? -EFAULT : 0;
+
+        case WDIOC_GETSTATUS:
+                wdt_get_status(&status);
+                return put_user(status, uarg.i);
+
+        case WDIOC_GETBOOTSTATUS:
+                return put_user(0, uarg.i);
+
+        case WDIOC_KEEPALIVE:
+                wdt_keepalive();
+                return 0;
+
+        case WDIOC_SETOPTIONS:
+                if (get_user (new_options, uarg.i))
+                        return -EFAULT;
+
+                if (new_options & WDIOS_DISABLECARD) {
+                        wdt_stop();
+                        retval = 0;
+                }
+
+                if (new_options & WDIOS_ENABLECARD) {
+                        wdt_start();
+                        retval = 0;
+                }
+
+                return retval;
+
+        case WDIOC_SETTIMEOUT:
+                if (get_user(new_timeout, uarg.i))
+                        return -EFAULT;
+
+                if (wdt_set_timeout(new_timeout))
+                    return -EINVAL;
+
+                wdt_keepalive();
+                /* Fall */
+
+        case WDIOC_GETTIMEOUT:
+                return put_user(timeout, uarg.i);
+
+        }
+}
+
+static int wdt_notify_sys(struct notifier_block *this, unsigned long code,
+        void *unused)
+{
+        if (code==SYS_DOWN || code==SYS_HALT)
+                wdt_stop();
+        return NOTIFY_DONE;
+}
+
+static struct file_operations wdt_fops=
+{
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .write          = wdt_write,
+        .ioctl          = wdt_ioctl,
+        .open           = wdt_open,
+        .release        = wdt_release,
+};
+
+static struct miscdevice wdt_miscdev=
+{
+        .minor          = WATCHDOG_MINOR,
+        .name           = "watchdog",
+        .fops           = &wdt_fops,
+};
+
+static struct notifier_block wdt_notifier = {
+        .notifier_call = wdt_notify_sys,
+};
+
+static int __init w83977f_wdt_init(void)
+{
+        int rc;
+
+        printk(KERN_INFO PFX DRIVER_VERSION);
+
+        spin_lock_init(&spinlock);
+
+        /*
+         * Check that the timeout value is within it's range ; 
+         * if not reset to the default
+         */
+        if (wdt_set_timeout(timeout)) {
+                wdt_set_timeout(DEFAULT_TIMEOUT);
+                printk(KERN_INFO PFX "timeout value must be 15<=timeout<=7635, using %d\n",
+                        DEFAULT_TIMEOUT);
+        }
+
+        if (!request_region(IO_INDEX_PORT, 2, WATCHDOG_NAME))
+        {
+                printk(KERN_ERR PFX "I/O address 0x%04x already in use\n",
+                        IO_INDEX_PORT);
+                rc = -EIO;
+                goto err_out;
+        }
+
+        rc = misc_register(&wdt_miscdev);
+        if (rc)
+        {
+                printk(KERN_ERR PFX "cannot register miscdev on minor=%d (err=%d)\n",
+                        wdt_miscdev.minor, rc);
+                goto err_out_region;
+        }
+
+        rc = register_reboot_notifier(&wdt_notifier);
+        if (rc)
+        {
+                printk(KERN_ERR PFX "cannot register reboot notifier (err=%d)\n",
+                        rc);
+                goto err_out_miscdev;
+        }
+
+        printk(KERN_INFO PFX "initialized. timeout=%d sec (nowayout=%d testmode=%d)\n",
+                timeout, nowayout, testmode);
+
+        return 0;
+
+err_out_miscdev:
+        misc_deregister(&wdt_miscdev);
+err_out_region:
+        release_region(IO_INDEX_PORT,2);
+err_out:
+        return rc;
+}
+
+static void __exit w83977f_wdt_exit(void)
+{
+        wdt_stop();
+        misc_deregister(&wdt_miscdev);
+        unregister_reboot_notifier(&wdt_notifier);
+        release_region(IO_INDEX_PORT,2);
+}
+
+module_init(w83977f_wdt_init);
+module_exit(w83977f_wdt_exit);
+
+MODULE_AUTHOR("Jose Goncalves <jose.goncalves@inov.pt>");
+MODULE_DESCRIPTION("Driver for watchdog timer in W83977F I/O chip");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/connector/cn_queue.c b/drivers/connector/cn_queue.c
index 966632182e2d..9f2f00d82917 100644
--- a/drivers/connector/cn_queue.c
+++ b/drivers/connector/cn_queue.c
@@ -31,16 +31,19 @@
 #include <linux/connector.h>
 #include <linux/delay.h>
 
-static void cn_queue_wrapper(void *data)
+void cn_queue_wrapper(void *data)
 {
-        struct cn_callback_entry *cbq = data;
+        struct cn_callback_data *d = data;
 
-        cbq->cb->callback(cbq->cb->priv);
-        cbq->destruct_data(cbq->ddata);
-        cbq->ddata = NULL;
+        d->callback(d->callback_priv);
+
+        d->destruct_data(d->ddata);
+        d->ddata = NULL;
+
+        kfree(d->free);
 }
 
-static struct cn_callback_entry *cn_queue_alloc_callback_entry(struct cn_callback *cb)
+static struct cn_callback_entry *cn_queue_alloc_callback_entry(char *name, struct cb_id *id, void (*callback)(void *))
 {
         struct cn_callback_entry *cbq;
 
@@ -50,8 +53,11 @@ static struct cn_callback_entry *cn_queue_alloc_callback_entry(struct cn_callbac
                 return NULL;
         }
 
-        cbq->cb = cb;
-        INIT_WORK(&cbq->work, &cn_queue_wrapper, cbq);
+        snprintf(cbq->id.name, sizeof(cbq->id.name), "%s", name);
+        memcpy(&cbq->id.id, id, sizeof(struct cb_id));
+        cbq->data.callback = callback;
+        
+        INIT_WORK(&cbq->work, &cn_queue_wrapper, &cbq->data);
         return cbq;
 }
 
@@ -68,12 +74,12 @@ int cn_cb_equal(struct cb_id *i1, struct cb_id *i2)
         return ((i1->idx == i2->idx) && (i1->val == i2->val));
 }
 
-int cn_queue_add_callback(struct cn_queue_dev *dev, struct cn_callback *cb)
+int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *))
 {
         struct cn_callback_entry *cbq, *__cbq;
         int found = 0;
 
-        cbq = cn_queue_alloc_callback_entry(cb);
+        cbq = cn_queue_alloc_callback_entry(name, id, callback);
         if (!cbq)
                 return -ENOMEM;
 
@@ -82,7 +88,7 @@ int cn_queue_add_callback(struct cn_queue_dev *dev, struct cn_callback *cb)
 
         spin_lock_bh(&dev->queue_lock);
         list_for_each_entry(__cbq, &dev->queue_list, callback_entry) {
-                if (cn_cb_equal(&__cbq->cb->id, &cb->id)) {
+                if (cn_cb_equal(&__cbq->id.id, id)) {
                         found = 1;
                         break;
                 }
@@ -99,7 +105,7 @@ int cn_queue_add_callback(struct cn_queue_dev *dev, struct cn_callback *cb)
 
         cbq->nls = dev->nls;
         cbq->seq = 0;
-        cbq->group = cbq->cb->id.idx;
+        cbq->group = cbq->id.id.idx;
 
         return 0;
 }
@@ -111,7 +117,7 @@ void cn_queue_del_callback(struct cn_queue_dev *dev, struct cb_id *id)
 
         spin_lock_bh(&dev->queue_lock);
         list_for_each_entry_safe(cbq, n, &dev->queue_list, callback_entry) {
-                if (cn_cb_equal(&cbq->cb->id, id)) {
+                if (cn_cb_equal(&cbq->id.id, id)) {
                         list_del(&cbq->callback_entry);
                         found = 1;
                         break;
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index aaf6d468a8b9..bb0b3a8de14b 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -84,7 +84,7 @@ int cn_netlink_send(struct cn_msg *msg, u32 __group, int gfp_mask)
                 spin_lock_bh(&dev->cbdev->queue_lock);
                 list_for_each_entry(__cbq, &dev->cbdev->queue_list,
                                     callback_entry) {
-                        if (cn_cb_equal(&__cbq->cb->id, &msg->id)) {
+                        if (cn_cb_equal(&__cbq->id.id, &msg->id)) {
                                 found = 1;
                                 group = __cbq->group;
                         }
@@ -127,42 +127,56 @@ static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), v
 {
         struct cn_callback_entry *__cbq;
         struct cn_dev *dev = &cdev;
-        int found = 0;
+        int err = -ENODEV;
 
         spin_lock_bh(&dev->cbdev->queue_lock);
         list_for_each_entry(__cbq, &dev->cbdev->queue_list, callback_entry) {
-                if (cn_cb_equal(&__cbq->cb->id, &msg->id)) {
-                        /*
-                         * Let's scream if there is some magic and the
-                         * data will arrive asynchronously here.
-                         * [i.e. netlink messages will be queued].
-                         * After the first warning I will fix it
-                         * quickly, but now I think it is
-                         * impossible. --zbr (2004_04_27).
-                         */
+                if (cn_cb_equal(&__cbq->id.id, &msg->id)) {
                         if (likely(!test_bit(0, &__cbq->work.pending) &&
-                                        __cbq->ddata == NULL)) {
-                                __cbq->cb->priv = msg;
+                                        __cbq->data.ddata == NULL)) {
+                                __cbq->data.callback_priv = msg;
 
-                                __cbq->ddata = data;
-                                __cbq->destruct_data = destruct_data;
+                                __cbq->data.ddata = data;
+                                __cbq->data.destruct_data = destruct_data;
 
                                 if (queue_work(dev->cbdev->cn_queue,
                                                 &__cbq->work))
-                                        found = 1;
+                                        err = 0;
                         } else {
-                                printk("%s: cbq->data=%p, "
-                                       "work->pending=%08lx.\n",
-                                       __func__, __cbq->ddata,
-                                       __cbq->work.pending);
-                                WARN_ON(1);
+                                struct work_struct *w;
+                                struct cn_callback_data *d;
+                                
+                                w = kzalloc(sizeof(*w) + sizeof(*d), GFP_ATOMIC);
+                                if (w) {
+                                        d = (struct cn_callback_data *)(w+1);
+
+                                        d->callback_priv = msg;
+                                        d->callback = __cbq->data.callback;
+                                        d->ddata = data;
+                                        d->destruct_data = destruct_data;
+                                        d->free = w;
+
+                                        INIT_LIST_HEAD(&w->entry);
+                                        w->pending = 0;
+                                        w->func = &cn_queue_wrapper;
+                                        w->data = d;
+                                        init_timer(&w->timer);
+                                        
+                                        if (queue_work(dev->cbdev->cn_queue, w))
+                                                err = 0;
+                                        else {
+                                                kfree(w);
+                                                err = -EINVAL;
+                                        }
+                                } else
+                                        err = -ENOMEM;
                         }
                         break;
                 }
         }
         spin_unlock_bh(&dev->cbdev->queue_lock);
 
-        return found ? 0 : -ENODEV;
+        return err;
 }
 
 /*
@@ -291,22 +305,10 @@ int cn_add_callback(struct cb_id *id, char *name, void (*callback)(void *))
 {
         int err;
         struct cn_dev *dev = &cdev;
-        struct cn_callback *cb;
-
-        cb = kzalloc(sizeof(*cb), GFP_KERNEL);
-        if (!cb)
-                return -ENOMEM;
-
-        scnprintf(cb->name, sizeof(cb->name), "%s", name);
 
-        memcpy(&cb->id, id, sizeof(cb->id));
-        cb->callback = callback;
-
-        err = cn_queue_add_callback(dev->cbdev, cb);
-        if (err) {
-                kfree(cb);
+        err = cn_queue_add_callback(dev->cbdev, name, id, callback);
+        if (err)
                 return err;
-        }
 
         cn_notify(id, 0);
 
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index 3b865f34a095..b66782398258 100644
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -50,7 +50,7 @@
 MODULE_AUTHOR("Abhay Salunke <abhay_salunke@dell.com>");
 MODULE_DESCRIPTION("Driver for updating BIOS image on DELL systems");
 MODULE_LICENSE("GPL");
-MODULE_VERSION("1.0");
+MODULE_VERSION("2.0");
 
 #define BIOS_SCAN_LIMIT 0xffffffff
 #define MAX_IMAGE_LENGTH 16
@@ -65,10 +65,11 @@ static struct _rbu_data {
         unsigned long packet_write_count;
         unsigned long num_packets;
         unsigned long packetsize;
+        int entry_created;
 } rbu_data;
 
-static char image_type[MAX_IMAGE_LENGTH] = "mono";
-module_param_string(image_type, image_type, sizeof(image_type), 0);
+static char image_type[MAX_IMAGE_LENGTH + 1] = "mono";
+module_param_string(image_type, image_type, sizeof (image_type), 0);
 MODULE_PARM_DESC(image_type, "BIOS image type. choose- mono or packet");
 
 struct packet_data {
@@ -114,7 +115,7 @@ static int fill_last_packet(void *data, size_t length)
 
         if ((rbu_data.packet_write_count + length) > rbu_data.packetsize) {
                 pr_debug("dell_rbu:%s: packet size data "
-                         "overrun\n", __FUNCTION__);
+                        "overrun\n", __FUNCTION__);
                 return -EINVAL;
         }
 
@@ -146,12 +147,14 @@ static int create_packet(size_t length)
                 pr_debug("create_packet: packetsize not specified\n");
                 return -EINVAL;
         }
+        spin_unlock(&rbu_data.lock);
+        newpacket = kmalloc(sizeof (struct packet_data), GFP_KERNEL);
+        spin_lock(&rbu_data.lock);
 
-        newpacket = kmalloc(sizeof(struct packet_data), GFP_KERNEL);
         if (!newpacket) {
                 printk(KERN_WARNING
-                       "dell_rbu:%s: failed to allocate new "
-                       "packet\n", __FUNCTION__);
+                        "dell_rbu:%s: failed to allocate new "
+                        "packet\n", __FUNCTION__);
                 return -ENOMEM;
         }
 
@@ -160,15 +163,17 @@ static int create_packet(size_t length)
          * there is no upper limit on memory
          * address for packetized mechanism
          */
-        newpacket->data = (unsigned char *)__get_free_pages(GFP_KERNEL,
-                                                            ordernum);
+        spin_unlock(&rbu_data.lock);
+        newpacket->data = (unsigned char *) __get_free_pages(GFP_KERNEL,
+                ordernum);
+        spin_lock(&rbu_data.lock);
 
         pr_debug("create_packet: newpacket %p\n", newpacket->data);
 
         if (!newpacket->data) {
                 printk(KERN_WARNING
-                       "dell_rbu:%s: failed to allocate new "
-                       "packet\n", __FUNCTION__);
+                        "dell_rbu:%s: failed to allocate new "
+                        "packet\n", __FUNCTION__);
                 kfree(newpacket);
                 return -ENOMEM;
         }
@@ -204,9 +209,8 @@ static int packetize_data(void *data, size_t length)
         return rc;
 }
 
-static int
-do_packet_read(char *data, struct list_head *ptemp_list,
-               int length, int bytes_read, int *list_read_count)
+static int do_packet_read(char *data, struct list_head *ptemp_list,
+        int length, int bytes_read, int *list_read_count)
 {
         void *ptemp_buf;
         struct packet_data *newpacket = NULL;
@@ -239,7 +243,7 @@ do_packet_read(char *data, struct list_head *ptemp_list,
         return bytes_copied;
 }
 
-static int packet_read_list(char *data, size_t * pread_length)
+static int packet_read_list(char *data, size_t *pread_length)
 {
         struct list_head *ptemp_list;
         int temp_count = 0;
@@ -258,8 +262,7 @@ static int packet_read_list(char *data, size_t * pread_length)
         ptemp_list = (&packet_data_head.list)->next;
         while (!list_empty(ptemp_list)) {
                 bytes_copied = do_packet_read(pdest, ptemp_list,
-                                              remaining_bytes, bytes_read,
-                                              &temp_count);
+                        remaining_bytes, bytes_read, &temp_count);
                 remaining_bytes -= bytes_copied;
                 bytes_read += bytes_copied;
                 pdest += bytes_copied;
@@ -287,7 +290,7 @@ static void packet_empty_list(void)
         ptemp_list = (&packet_data_head.list)->next;
         while (!list_empty(ptemp_list)) {
                 newpacket =
-                    list_entry(ptemp_list, struct packet_data, list);
+                        list_entry(ptemp_list, struct packet_data, list);
                 pnext_list = ptemp_list->next;
                 list_del(ptemp_list);
                 ptemp_list = pnext_list;
@@ -296,8 +299,8 @@ static void packet_empty_list(void)
                  * to make sure there are no stale RBU packets left in memory
                  */
                 memset(newpacket->data, 0, rbu_data.packetsize);
-                free_pages((unsigned long)newpacket->data,
-                           newpacket->ordernum);
+                free_pages((unsigned long) newpacket->data,
+                        newpacket->ordernum);
                 kfree(newpacket);
         }
         rbu_data.packet_write_count = 0;
@@ -319,14 +322,13 @@ static void img_update_free(void)
          * BIOS image copied in memory.
          */
         memset(rbu_data.image_update_buffer, 0,
-               rbu_data.image_update_buffer_size);
+                rbu_data.image_update_buffer_size);
         if (rbu_data.dma_alloc == 1)
                 dma_free_coherent(NULL, rbu_data.bios_image_size,
-                                  rbu_data.image_update_buffer,
-                                  dell_rbu_dmaaddr);
+                        rbu_data.image_update_buffer, dell_rbu_dmaaddr);
         else
-                free_pages((unsigned long)rbu_data.image_update_buffer,
-                           rbu_data.image_update_ordernum);
+                free_pages((unsigned long) rbu_data.image_update_buffer,
+                        rbu_data.image_update_ordernum);
 
         /*
          * Re-initialize the rbu_data variables after a free
@@ -366,7 +368,7 @@ static int img_update_realloc(unsigned long size)
                  */
                 if ((size != 0) && (rbu_data.image_update_buffer == NULL)) {
                         printk(KERN_ERR "dell_rbu:%s: corruption "
-                               "check failed\n", __FUNCTION__);
+                                "check failed\n", __FUNCTION__);
                         return -EINVAL;
                 }
                 /*
@@ -385,17 +387,16 @@ static int img_update_realloc(unsigned long size)
 
         ordernum = get_order(size);
         image_update_buffer =
-            (unsigned char *)__get_free_pages(GFP_KERNEL, ordernum);
+                (unsigned char *) __get_free_pages(GFP_KERNEL, ordernum);
 
         img_buf_phys_addr =
-            (unsigned long)virt_to_phys(image_update_buffer);
+                (unsigned long) virt_to_phys(image_update_buffer);
 
         if (img_buf_phys_addr > BIOS_SCAN_LIMIT) {
-                free_pages((unsigned long)image_update_buffer, ordernum);
+                free_pages((unsigned long) image_update_buffer, ordernum);
                 ordernum = -1;
                 image_update_buffer = dma_alloc_coherent(NULL, size,
-                                                         &dell_rbu_dmaaddr,
-                                                         GFP_KERNEL);
+                        &dell_rbu_dmaaddr, GFP_KERNEL);
                 dma_alloc = 1;
         }
 
@@ -405,13 +406,13 @@ static int img_update_realloc(unsigned long size)
                 rbu_data.image_update_buffer = image_update_buffer;
                 rbu_data.image_update_buffer_size = size;
                 rbu_data.bios_image_size =
-                    rbu_data.image_update_buffer_size;
+                        rbu_data.image_update_buffer_size;
                 rbu_data.image_update_ordernum = ordernum;
                 rbu_data.dma_alloc = dma_alloc;
                 rc = 0;
         } else {
                 pr_debug("Not enough memory for image update:"
-                         "size = %ld\n", size);
+                        "size = %ld\n", size);
                 rc = -ENOMEM;
         }
 
@@ -438,7 +439,7 @@ static ssize_t read_packet_data(char *buffer, loff_t pos, size_t count)
         if (pos > imagesize) {
                 retval = 0;
                 printk(KERN_WARNING "dell_rbu:read_packet_data: "
-                       "data underrun\n");
+                        "data underrun\n");
                 goto read_rbu_data_exit;
         }
 
@@ -468,11 +469,11 @@ static ssize_t read_rbu_mono_data(char *buffer, loff_t pos, size_t count)
 
         /* check to see if we have something to return */
         if ((rbu_data.image_update_buffer == NULL) ||
-            (rbu_data.bios_image_size == 0)) {
+                (rbu_data.bios_image_size == 0)) {
                 pr_debug("read_rbu_data_mono: image_update_buffer %p ,"
-                         "bios_image_size %lu\n",
-                         rbu_data.image_update_buffer,
-                         rbu_data.bios_image_size);
+                        "bios_image_size %lu\n",
+                        rbu_data.image_update_buffer,
+                        rbu_data.bios_image_size);
                 ret_count = -ENOMEM;
                 goto read_rbu_data_exit;
         }
@@ -497,8 +498,8 @@ static ssize_t read_rbu_mono_data(char *buffer, loff_t pos, size_t count)
         return ret_count;
 }
 
-static ssize_t
-read_rbu_data(struct kobject *kobj, char *buffer, loff_t pos, size_t count)
+static ssize_t read_rbu_data(struct kobject *kobj, char *buffer,
+                        loff_t pos, size_t count)
 {
         ssize_t ret_count = 0;
 
@@ -515,62 +516,20 @@ read_rbu_data(struct kobject *kobj, char *buffer, loff_t pos, size_t count)
         return ret_count;
 }
 
-static ssize_t
-read_rbu_image_type(struct kobject *kobj, char *buffer, loff_t pos,
-                    size_t count)
-{
-        int size = 0;
-        if (!pos)
-                size = sprintf(buffer, "%s\n", image_type);
-        return size;
-}
-
-static ssize_t
-write_rbu_image_type(struct kobject *kobj, char *buffer, loff_t pos,
-                     size_t count)
-{
-        int rc = count;
-        spin_lock(&rbu_data.lock);
-
-        if (strlen(buffer) < MAX_IMAGE_LENGTH)
-                sscanf(buffer, "%s", image_type);
-        else
-                printk(KERN_WARNING "dell_rbu: image_type is invalid"
-                       "max chars = %d, \n incoming str--%s-- \n",
-                       MAX_IMAGE_LENGTH, buffer);
-
-        /* we must free all previous allocations */
-        packet_empty_list();
-        img_update_free();
-
-        spin_unlock(&rbu_data.lock);
-        return rc;
-
-}
-
-static struct bin_attribute rbu_data_attr = {
-        .attr = {.name = "data",.owner = THIS_MODULE,.mode = 0444},
-        .read = read_rbu_data,
-};
-
-static struct bin_attribute rbu_image_type_attr = {
-        .attr = {.name = "image_type",.owner = THIS_MODULE,.mode = 0644},
-        .read = read_rbu_image_type,
-        .write = write_rbu_image_type,
-};
-
 static void callbackfn_rbu(const struct firmware *fw, void *context)
 {
         int rc = 0;
 
-        if (!fw || !fw->size)
+        if (!fw || !fw->size) {
+                rbu_data.entry_created = 0;
                 return;
+        }
 
         spin_lock(&rbu_data.lock);
         if (!strcmp(image_type, "mono")) {
                 if (!img_update_realloc(fw->size))
                         memcpy(rbu_data.image_update_buffer,
-                               fw->data, fw->size);
+                                fw->data, fw->size);
         } else if (!strcmp(image_type, "packet")) {
                 if (!rbu_data.packetsize)
                         rbu_data.packetsize = fw->size;
@@ -584,14 +543,103 @@ static void callbackfn_rbu(const struct firmware *fw, void *context)
         spin_unlock(&rbu_data.lock);
 
         rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG,
-                                     "dell_rbu", &rbu_device->dev,
-                                     &context, callbackfn_rbu);
+                "dell_rbu", &rbu_device->dev, &context, callbackfn_rbu);
         if (rc)
                 printk(KERN_ERR
-                       "dell_rbu:%s request_firmware_nowait failed"
-                       " %d\n", __FUNCTION__, rc);
+                        "dell_rbu:%s request_firmware_nowait failed"
+                        " %d\n", __FUNCTION__, rc);
+        else
+                rbu_data.entry_created = 1;
+}
+
+static ssize_t read_rbu_image_type(struct kobject *kobj, char *buffer,
+                        loff_t pos, size_t count)
+{
+        int size = 0;
+        if (!pos)
+                size = sprintf(buffer, "%s\n", image_type);
+        return size;
+}
+
+static ssize_t write_rbu_image_type(struct kobject *kobj, char *buffer,
+                        loff_t pos, size_t count)
+{
+        int rc = count;
+        int req_firm_rc = 0;
+        int i;
+        spin_lock(&rbu_data.lock);
+        /*
+         * Find the first newline or space
+         */
+        for (i = 0; i < count; ++i)
+                if (buffer[i] == '\n' || buffer[i] == ' ') {
+                        buffer[i] = '\0';
+                        break;
+                }
+        if (i == count)
+                buffer[count] = '\0';
+
+        if (strstr(buffer, "mono"))
+                strcpy(image_type, "mono");
+        else if (strstr(buffer, "packet"))
+                strcpy(image_type, "packet");
+        else if (strstr(buffer, "init")) {
+                /*
+                 * If due to the user error the driver gets in a bad
+                 * state where even though it is loaded , the
+                 * /sys/class/firmware/dell_rbu entries are missing.
+                 * to cover this situation the user can recreate entries
+                 * by writing init to image_type.
+                 */
+                if (!rbu_data.entry_created) {
+                        spin_unlock(&rbu_data.lock);
+                        req_firm_rc = request_firmware_nowait(THIS_MODULE,
+                                FW_ACTION_NOHOTPLUG, "dell_rbu",
+                                &rbu_device->dev, &context,
+                                callbackfn_rbu);
+                        if (req_firm_rc) {
+                                printk(KERN_ERR
+                                        "dell_rbu:%s request_firmware_nowait"
+                                        " failed %d\n", __FUNCTION__, rc);
+                                rc = -EIO;
+                        } else
+                                rbu_data.entry_created = 1;
+
+                        spin_lock(&rbu_data.lock);
+                }
+        } else {
+                printk(KERN_WARNING "dell_rbu: image_type is invalid\n");
+                spin_unlock(&rbu_data.lock);
+                return -EINVAL;
+        }
+
+        /* we must free all previous allocations */
+        packet_empty_list();
+        img_update_free();
+        spin_unlock(&rbu_data.lock);
+
+        return rc;
 }
 
+static struct bin_attribute rbu_data_attr = {
+        .attr = {
+                .name = "data",
+                .owner = THIS_MODULE,
+                .mode = 0444,
+        },
+        .read = read_rbu_data,
+};
+
+static struct bin_attribute rbu_image_type_attr = {
+        .attr = {
+                .name = "image_type",
+                .owner = THIS_MODULE,
+                .mode = 0644,
+        },
+        .read = read_rbu_image_type,
+        .write = write_rbu_image_type,
+};
+
 static int __init dcdrbu_init(void)
 {
         int rc = 0;
@@ -599,11 +647,11 @@ static int __init dcdrbu_init(void)
 
         init_packet_head();
         rbu_device =
-            platform_device_register_simple("dell_rbu", -1, NULL, 0);
+                platform_device_register_simple("dell_rbu", -1, NULL, 0);
         if (!rbu_device) {
                 printk(KERN_ERR
-                       "dell_rbu:%s:platform_device_register_simple "
-                       "failed\n", __FUNCTION__);
+                        "dell_rbu:%s:platform_device_register_simple "
+                        "failed\n", __FUNCTION__);
                 return -EIO;
         }
 
@@ -611,11 +659,12 @@ static int __init dcdrbu_init(void)
         sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_image_type_attr);
 
         rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG,
-                                     "dell_rbu", &rbu_device->dev,
-                                     &context, callbackfn_rbu);
+                "dell_rbu", &rbu_device->dev, &context, callbackfn_rbu);
         if (rc)
                 printk(KERN_ERR "dell_rbu:%s:request_firmware_nowait"
-                       " failed %d\n", __FUNCTION__, rc);
+                        " failed %d\n", __FUNCTION__, rc);
+        else
+                rbu_data.entry_created = 1;
 
         return rc;
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 7e72e922b41c..db358cfa7cbf 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -418,12 +418,11 @@ config SENSORS_HDAPS
         help
           This driver provides support for the IBM Hard Drive Active Protection
           System (hdaps), which provides an accelerometer and other misc. data.
-          Supported laptops include the IBM ThinkPad T41, T42, T43, and R51.
-          The accelerometer data is readable via sysfs.
+          ThinkPads starting with the R50, T41, and X40 are supported.  The
+          accelerometer data is readable via sysfs.
 
-          This driver also provides an input class device, allowing the
-          laptop to act as a pinball machine-esque mouse.  This is off by
-          default but enabled via sysfs or the module parameter "mousedev".
+          This driver also provides an absolute input class device, allowing
+          the laptop to act as a pinball machine-esque joystick.
 
           Say Y here if you have an applicable laptop and want to experience
           the awesome power of hdaps.
diff --git a/drivers/hwmon/hdaps.c b/drivers/hwmon/hdaps.c
index eaebfc14c933..7f0107613827 100644
--- a/drivers/hwmon/hdaps.c
+++ b/drivers/hwmon/hdaps.c
@@ -4,11 +4,11 @@
  * Copyright (C) 2005 Robert Love <rml@novell.com>
  * Copyright (C) 2005 Jesper Juhl <jesper.juhl@gmail.com>
  *
- * The HardDisk Active Protection System (hdaps) is present in the IBM ThinkPad
- * T41, T42, T43, R51, and X40, at least.  It provides a basic two-axis
+ * The HardDisk Active Protection System (hdaps) is present in IBM ThinkPads
+ * starting with the R40, T41, and X40.  It provides a basic two-axis
  * accelerometer and other data, such as the device's temperature.
  *
- * Based on the document by Mark A. Smith available at
+ * This driver is based on the document by Mark A. Smith available at
  * http://www.almaden.ibm.com/cs/people/marksmith/tpaps.html and a lot of trial
  * and error.
  *
@@ -36,12 +36,7 @@
 #include <asm/io.h>
 
 #define HDAPS_LOW_PORT          0x1600  /* first port used by hdaps */
-#define HDAPS_NR_PORTS          0x30    /* 0x1600 - 0x162f */
-
-#define STATE_FRESH             0x50    /* accelerometer data is fresh */
-
-#define REFRESH_ASYNC           0x00    /* do asynchronous refresh */
-#define REFRESH_SYNC            0x01    /* do synchronous refresh */
+#define HDAPS_NR_PORTS          0x30    /* number of ports: 0x1600 - 0x162f */
 
 #define HDAPS_PORT_STATE        0x1611  /* device state */
 #define HDAPS_PORT_YPOS         0x1612  /* y-axis position */
@@ -53,7 +48,7 @@
 #define HDAPS_PORT_UNKNOWN      0x161c  /* what is this? */
 #define HDAPS_PORT_KMACT        0x161d  /* keyboard or mouse activity */
 
-#define HDAPS_READ_MASK         0xff    /* some reads have the low 8 bits set */
+#define STATE_FRESH             0x50    /* accelerometer data is fresh */
 
 #define KEYBD_MASK              0x20    /* set if keyboard activity */
 #define MOUSE_MASK              0x40    /* set if mouse activity */
@@ -63,12 +58,11 @@
 #define INIT_TIMEOUT_MSECS      4000    /* wait up to 4s for device init ... */
 #define INIT_WAIT_MSECS         200     /* ... in 200ms increments */
 
-static struct platform_device *pdev;
-static struct input_dev hdaps_idev;
+#define HDAPS_POLL_PERIOD       (HZ/20) /* poll for input every 1/20s */
+#define HDAPS_INPUT_FUZZ        4       /* input event threshold */
+
 static struct timer_list hdaps_timer;
-static unsigned int hdaps_mousedev_threshold = 4;
-static unsigned long hdaps_poll_ms = 50;
-static unsigned int hdaps_mousedev;
+static struct platform_device *pdev;
 static unsigned int hdaps_invert;
 static u8 km_activity;
 static int rest_x;
@@ -81,14 +75,14 @@ static DECLARE_MUTEX(hdaps_sem);
  */
 static inline u8 __get_latch(u16 port)
 {
-        return inb(port) & HDAPS_READ_MASK;
+        return inb(port) & 0xff;
 }
 
 /*
- * __check_latch - Check a port latch for a given value.  Callers must hold
- * hdaps_sem.  Returns zero if the port contains the given value.
+ * __check_latch - Check a port latch for a given value.  Returns zero if the
+ * port contains the given value.  Callers must hold hdaps_sem.
  */
-static inline unsigned int __check_latch(u16 port, u8 val)
+static inline int __check_latch(u16 port, u8 val)
 {
         if (__get_latch(port) == val)
                 return 0;
@@ -99,7 +93,7 @@ static inline unsigned int __check_latch(u16 port, u8 val)
  * __wait_latch - Wait up to 100us for a port latch to get a certain value,
  * returning zero if the value is obtained.  Callers must hold hdaps_sem.
  */
-static unsigned int __wait_latch(u16 port, u8 val)
+static int __wait_latch(u16 port, u8 val)
 {
         unsigned int i;
 
@@ -109,59 +103,42 @@ static unsigned int __wait_latch(u16 port, u8 val)
                 udelay(5);
         }
 
-        return -EINVAL;
+        return -EIO;
 }
 
 /*
- * __device_refresh - Request a refresh from the accelerometer.
- *
- * If sync is REFRESH_SYNC, we perform a synchronous refresh and will wait.
- * Returns zero if successful and nonzero on error.
- *
- * If sync is REFRESH_ASYNC, we merely kick off a new refresh if the device is
- * not up-to-date.  Always returns zero.
- *
- * Callers must hold hdaps_sem.
+ * __device_refresh - request a refresh from the accelerometer.  Does not wait
+ * for refresh to complete.  Callers must hold hdaps_sem.
  */
-static int __device_refresh(unsigned int sync)
+static void __device_refresh(void)
 {
-        u8 state;
-
-        udelay(100);
-
-        state = inb(0x1604);
-        if (state == STATE_FRESH)
-                return 0;
-
-        outb(0x11, 0x1610);
-        outb(0x01, 0x161f);
-        if (sync == REFRESH_ASYNC)
-                return 0;
+        udelay(200);
+        if (inb(0x1604) != STATE_FRESH) {
+                outb(0x11, 0x1610);
+                outb(0x01, 0x161f);
+        }
+}
 
+/*
+ * __device_refresh_sync - request a synchronous refresh from the
+ * accelerometer.  We wait for the refresh to complete.  Returns zero if
+ * successful and nonzero on error.  Callers must hold hdaps_sem.
+ */
+static int __device_refresh_sync(void)
+{
+        __device_refresh();
         return __wait_latch(0x1604, STATE_FRESH);
 }
 
 /*
- * __device_complete - Indicate to the accelerometer that we are done reading
+ * __device_complete - indicate to the accelerometer that we are done reading
  * data, and then initiate an async refresh.  Callers must hold hdaps_sem.
  */
 static inline void __device_complete(void)
 {
         inb(0x161f);
         inb(0x1604);
-        __device_refresh(REFRESH_ASYNC);
-}
-
-static int __hdaps_readb_one(unsigned int port, u8 *val)
-{
-        /* do a sync refresh -- we need to be sure that we read fresh data */
-        if (__device_refresh(REFRESH_SYNC))
-                return -EIO;
-
-        *val = inb(port);
-        __device_complete();
-
-        return 0;
+        __device_refresh();
 }
 
 /*
@@ -174,17 +151,26 @@ static int hdaps_readb_one(unsigned int port, u8 *val)
         int ret;
 
         down(&hdaps_sem);
-        ret = __hdaps_readb_one(port, val);
-        up(&hdaps_sem);
 
+        /* do a sync refresh -- we need to be sure that we read fresh data */
+        ret = __device_refresh_sync();
+        if (ret)
+                goto out;
+
+        *val = inb(port);
+        __device_complete();
+
+out:
+        up(&hdaps_sem);
         return ret;
 }
 
+/* __hdaps_read_pair - internal lockless helper for hdaps_read_pair(). */
 static int __hdaps_read_pair(unsigned int port1, unsigned int port2,
                              int *x, int *y)
 {
         /* do a sync refresh -- we need to be sure that we read fresh data */
-        if (__device_refresh(REFRESH_SYNC))
+        if (__device_refresh_sync())
                 return -EIO;
 
         *y = inw(port2);
@@ -217,11 +203,13 @@ static int hdaps_read_pair(unsigned int port1, unsigned int port2,
         return ret;
 }
 
-/* initialize the accelerometer */
+/*
+ * hdaps_device_init - initialize the accelerometer.  Returns zero on success
+ * and negative error code on failure.  Can sleep.
+ */
 static int hdaps_device_init(void)
 {
-        unsigned int total_msecs = INIT_TIMEOUT_MSECS;
-        int ret = -ENXIO;
+        int total, ret = -ENXIO;
 
         down(&hdaps_sem);
 
@@ -231,8 +219,10 @@ static int hdaps_device_init(void)
                 goto out;
 
         /*
-         * The 0x03 value appears to only work on some thinkpads, such as the
-         * T42p.  Others return 0x01.
+         * Most ThinkPads return 0x01.
+         *
+         * Others--namely the R50p, T41p, and T42p--return 0x03.  These laptops
+         * have "inverted" axises.
          *
          * The 0x02 value occurs when the chip has been previously initialized.
          */
@@ -267,24 +257,23 @@ static int hdaps_device_init(void)
         outb(0x01, 0x161f);
         if (__wait_latch(0x161f, 0x00))
                 goto out;
-        if (__device_refresh(REFRESH_SYNC))
+        if (__device_refresh_sync())
                 goto out;
         if (__wait_latch(0x1611, 0x00))
                 goto out;
 
         /* we have done our dance, now let's wait for the applause */
-        while (total_msecs > 0) {
-                u8 ignored;
+        for (total = INIT_TIMEOUT_MSECS; total > 0; total -= INIT_WAIT_MSECS) {
+                int x, y;
 
                 /* a read of the device helps push it into action */
-                __hdaps_readb_one(HDAPS_PORT_UNKNOWN, &ignored);
+                __hdaps_read_pair(HDAPS_PORT_XPOS, HDAPS_PORT_YPOS, &x, &y);
                 if (!__wait_latch(0x1611, 0x02)) {
                         ret = 0;
                         break;
                 }
 
                 msleep(INIT_WAIT_MSECS);
-                total_msecs -= INIT_WAIT_MSECS;
         }
 
 out:
@@ -293,96 +282,6 @@ out:
 }
 
 
-/* Input class stuff */
-
-/*
- * hdaps_calibrate - Zero out our "resting" values. Callers must hold hdaps_sem.
- */
-static void hdaps_calibrate(void)
-{
-        int x, y;
-
-        if (__hdaps_read_pair(HDAPS_PORT_XPOS, HDAPS_PORT_YPOS, &x, &y))
-                return;
-
-        rest_x = x;
-        rest_y = y;
-}
-
-static void hdaps_mousedev_poll(unsigned long unused)
-{
-        int x, y;
-
-        /* Cannot sleep.  Try nonblockingly.  If we fail, try again later. */
-        if (down_trylock(&hdaps_sem)) {
-                mod_timer(&hdaps_timer,jiffies+msecs_to_jiffies(hdaps_poll_ms));
-                return;
-        }
-
-        if (__hdaps_read_pair(HDAPS_PORT_XPOS, HDAPS_PORT_YPOS, &x, &y))
-                goto out;
-
-        x -= rest_x;
-        y -= rest_y;
-        if (abs(x) > hdaps_mousedev_threshold)
-                input_report_rel(&hdaps_idev, REL_X, x);
-        if (abs(y) > hdaps_mousedev_threshold)
-                input_report_rel(&hdaps_idev, REL_Y, y);
-        input_sync(&hdaps_idev);
-
-        mod_timer(&hdaps_timer, jiffies + msecs_to_jiffies(hdaps_poll_ms));
-
-out:
-        up(&hdaps_sem);
-}
-
-/*
- * hdaps_mousedev_enable - enable the input class device.  Can sleep.
- */
-static void hdaps_mousedev_enable(void)
-{
-        down(&hdaps_sem);
-
-        /* calibrate the device before enabling */
-        hdaps_calibrate();
-
-        /* initialize the input class */
-        init_input_dev(&hdaps_idev);
-        hdaps_idev.dev = &pdev->dev;
-        hdaps_idev.evbit[0] = BIT(EV_KEY) | BIT(EV_REL);
-        hdaps_idev.relbit[0] = BIT(REL_X) | BIT(REL_Y);
-        hdaps_idev.keybit[LONG(BTN_LEFT)] = BIT(BTN_LEFT);
-        input_register_device(&hdaps_idev);
-
-        /* start up our timer */
-        init_timer(&hdaps_timer);
-        hdaps_timer.function = hdaps_mousedev_poll;
-        hdaps_timer.expires = jiffies + msecs_to_jiffies(hdaps_poll_ms);
-        add_timer(&hdaps_timer);
-
-        hdaps_mousedev = 1;
-
-        up(&hdaps_sem);
-
-        printk(KERN_INFO "hdaps: input device enabled.\n");
-}
-
-/*
- * hdaps_mousedev_disable - disable the input class device.  Caller must hold
- * hdaps_sem.
- */
-static void hdaps_mousedev_disable(void)
-{
-        down(&hdaps_sem);
-        if (hdaps_mousedev) {
-                hdaps_mousedev = 0;
-                del_timer_sync(&hdaps_timer);
-                input_unregister_device(&hdaps_idev);
-        }
-        up(&hdaps_sem);
-}
-
-
 /* Device model stuff */
 
 static int hdaps_probe(struct device *dev)
@@ -412,6 +311,49 @@ static struct device_driver hdaps_driver = {
         .resume = hdaps_resume
 };
 
+/* Input class stuff */
+
+static struct input_dev hdaps_idev = {
+        .name = "hdaps",
+        .evbit = { BIT(EV_ABS) },
+        .absbit = { BIT(ABS_X) | BIT(ABS_Y) },
+        .absmin  = { [ABS_X] = -256, [ABS_Y] = -256 },
+        .absmax  = { [ABS_X] = 256, [ABS_Y] = 256 },
+        .absfuzz = { [ABS_X] = HDAPS_INPUT_FUZZ, [ABS_Y] = HDAPS_INPUT_FUZZ },
+        .absflat = { [ABS_X] = HDAPS_INPUT_FUZZ, [ABS_Y] = HDAPS_INPUT_FUZZ },
+};
+
+/*
+ * hdaps_calibrate - Set our "resting" values.  Callers must hold hdaps_sem.
+ */
+static void hdaps_calibrate(void)
+{
+        __hdaps_read_pair(HDAPS_PORT_XPOS, HDAPS_PORT_YPOS, &rest_x, &rest_y);
+}
+
+static void hdaps_mousedev_poll(unsigned long unused)
+{
+        int x, y;
+
+        /* Cannot sleep.  Try nonblockingly.  If we fail, try again later. */
+        if (down_trylock(&hdaps_sem)) {
+                mod_timer(&hdaps_timer,jiffies + HDAPS_POLL_PERIOD);
+                return;
+        }
+
+        if (__hdaps_read_pair(HDAPS_PORT_XPOS, HDAPS_PORT_YPOS, &x, &y))
+                goto out;
+
+        input_report_abs(&hdaps_idev, ABS_X, x - rest_x);
+        input_report_abs(&hdaps_idev, ABS_Y, y - rest_y);
+        input_sync(&hdaps_idev);
+
+        mod_timer(&hdaps_timer, jiffies + HDAPS_POLL_PERIOD);
+
+out:
+        up(&hdaps_sem);
+}
+
 
 /* Sysfs Files */
 
@@ -517,69 +459,6 @@ static ssize_t hdaps_invert_store(struct device *dev,
         return count;
 }
 
-static ssize_t hdaps_mousedev_show(struct device *dev,
-                                   struct device_attribute *attr, char *buf)
-{
-        return sprintf(buf, "%d\n", hdaps_mousedev);
-}
-
-static ssize_t hdaps_mousedev_store(struct device *dev,
-                                    struct device_attribute *attr,
-                                    const char *buf, size_t count)
-{
-        int enable;
-
-        if (sscanf(buf, "%d", &enable) != 1)
-                return -EINVAL;
-
-        if (enable == 1)
-                hdaps_mousedev_enable();
-        else if (enable == 0)
-                hdaps_mousedev_disable();
-        else
-                return -EINVAL;
-
-        return count;
-}
-
-static ssize_t hdaps_poll_show(struct device *dev,
-                               struct device_attribute *attr, char *buf)
-{
-        return sprintf(buf, "%lu\n", hdaps_poll_ms);
-}
-
-static ssize_t hdaps_poll_store(struct device *dev,
-                                struct device_attribute *attr,
-                                const char *buf, size_t count)
-{
-        unsigned int poll;
-
-        if (sscanf(buf, "%u", &poll) != 1 || poll == 0)
-                return -EINVAL;
-        hdaps_poll_ms = poll;
-
-        return count;
-}
-
-static ssize_t hdaps_threshold_show(struct device *dev,
-                                    struct device_attribute *attr, char *buf)
-{
-        return sprintf(buf, "%u\n", hdaps_mousedev_threshold);
-}
-
-static ssize_t hdaps_threshold_store(struct device *dev,
-                                     struct device_attribute *attr,
-                                     const char *buf, size_t count)
-{
-        unsigned int threshold;
-
-        if (sscanf(buf, "%u", &threshold) != 1 || threshold == 0)
-                return -EINVAL;
-        hdaps_mousedev_threshold = threshold;
-
-        return count;
-}
-
 static DEVICE_ATTR(position, 0444, hdaps_position_show, NULL);
 static DEVICE_ATTR(variance, 0444, hdaps_variance_show, NULL);
 static DEVICE_ATTR(temp1, 0444, hdaps_temp1_show, NULL);
@@ -588,10 +467,6 @@ static DEVICE_ATTR(keyboard_activity, 0444, hdaps_keyboard_activity_show, NULL);
 static DEVICE_ATTR(mouse_activity, 0444, hdaps_mouse_activity_show, NULL);
 static DEVICE_ATTR(calibrate, 0644, hdaps_calibrate_show,hdaps_calibrate_store);
 static DEVICE_ATTR(invert, 0644, hdaps_invert_show, hdaps_invert_store);
-static DEVICE_ATTR(mousedev, 0644, hdaps_mousedev_show, hdaps_mousedev_store);
-static DEVICE_ATTR(mousedev_poll_ms, 0644, hdaps_poll_show, hdaps_poll_store);
-static DEVICE_ATTR(mousedev_threshold, 0644, hdaps_threshold_show,
-                   hdaps_threshold_store);
 
 static struct attribute *hdaps_attributes[] = {
         &dev_attr_position.attr,
@@ -601,9 +476,6 @@ static struct attribute *hdaps_attributes[] = {
         &dev_attr_keyboard_activity.attr,
         &dev_attr_mouse_activity.attr,
         &dev_attr_calibrate.attr,
-        &dev_attr_mousedev.attr,
-        &dev_attr_mousedev_threshold.attr,
-        &dev_attr_mousedev_poll_ms.attr,
         &dev_attr_invert.attr,
         NULL,
 };
@@ -615,24 +487,19 @@ static struct attribute_group hdaps_attribute_group = {
 
 /* Module stuff */
 
-/*
- * XXX: We should be able to return nonzero and halt the detection process.
- * But there is a bug in dmi_check_system() where a nonzero return from the
- * first match will result in a return of failure from dmi_check_system().
- * I fixed this; the patch is in 2.6-mm.  Once in Linus's tree we can make
- * hdaps_dmi_match_invert() return hdaps_dmi_match(), which in turn returns 1.
- */
+/* hdaps_dmi_match - found a match.  return one, short-circuiting the hunt. */
 static int hdaps_dmi_match(struct dmi_system_id *id)
 {
         printk(KERN_INFO "hdaps: %s detected.\n", id->ident);
-        return 0;
+        return 1;
 }
 
+/* hdaps_dmi_match_invert - found an inverted match. */
 static int hdaps_dmi_match_invert(struct dmi_system_id *id)
 {
         hdaps_invert = 1;
         printk(KERN_INFO "hdaps: inverting axis readings.\n");
-        return 0;
+        return hdaps_dmi_match(id);
 }
 
 #define HDAPS_DMI_MATCH_NORMAL(model)   {               \
@@ -662,12 +529,15 @@ static int __init hdaps_init(void)
                 HDAPS_DMI_MATCH_INVERT("ThinkPad R50p"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad R50"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad R51"),
+                HDAPS_DMI_MATCH_NORMAL("ThinkPad R52"),
                 HDAPS_DMI_MATCH_INVERT("ThinkPad T41p"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad T41"),
                 HDAPS_DMI_MATCH_INVERT("ThinkPad T42p"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad T42"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad T43"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad X40"),
+                HDAPS_DMI_MATCH_NORMAL("ThinkPad X41 Tablet"),
+                HDAPS_DMI_MATCH_NORMAL("ThinkPad X41"),
                 { .ident = NULL }
         };
 
@@ -696,8 +566,18 @@ static int __init hdaps_init(void)
         if (ret)
                 goto out_device;
 
-        if (hdaps_mousedev)
-                hdaps_mousedev_enable();
+        /* initial calibrate for the input device */
+        hdaps_calibrate();
+
+        /* initialize the input class */
+        hdaps_idev.dev = &pdev->dev;
+        input_register_device(&hdaps_idev);
+
+        /* start up our timer for the input device */
+        init_timer(&hdaps_timer);
+        hdaps_timer.function = hdaps_mousedev_poll;
+        hdaps_timer.expires = jiffies + HDAPS_POLL_PERIOD;
+        add_timer(&hdaps_timer);
 
         printk(KERN_INFO "hdaps: driver successfully loaded.\n");
         return 0;
@@ -715,8 +595,8 @@ out:
 
 static void __exit hdaps_exit(void)
 {
-        hdaps_mousedev_disable();
-
+        del_timer_sync(&hdaps_timer);
+        input_unregister_device(&hdaps_idev);
         sysfs_remove_group(&pdev->dev.kobj, &hdaps_attribute_group);
         platform_device_unregister(pdev);
         driver_unregister(&hdaps_driver);
@@ -728,9 +608,6 @@ static void __exit hdaps_exit(void)
 module_init(hdaps_init);
 module_exit(hdaps_exit);
 
-module_param_named(mousedev, hdaps_mousedev, bool, 0);
-MODULE_PARM_DESC(mousedev, "enable the input class device");
-
 module_param_named(invert, hdaps_invert, bool, 0);
 MODULE_PARM_DESC(invert, "invert data along each axis");
 
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 8334496a7e0a..3badfec75b1c 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -245,6 +245,18 @@ config I2C_KEYWEST
           This support is also available as a module.  If so, the module 
           will be called i2c-keywest.
 
+config I2C_PMAC_SMU
+        tristate "Powermac SMU I2C interface"
+        depends on I2C && PMAC_SMU
+        help
+          This supports the use of the I2C interface in the SMU
+          chip on recent Apple machines like the iMac G5.  It is used
+          among others by the thermal control driver for those machines.
+          Say Y if you have such a machine.
+
+          This support is also available as a module.  If so, the module
+          will be called i2c-pmac-smu.
+
 config I2C_MPC
         tristate "MPC107/824x/85xx/52xx"
         depends on I2C && PPC32
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index 980b3e983670..f1df00f66c6c 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -20,6 +20,7 @@ obj-$(CONFIG_I2C_ITE)		+= i2c-ite.o
 obj-$(CONFIG_I2C_IXP2000)       += i2c-ixp2000.o
 obj-$(CONFIG_I2C_IXP4XX)        += i2c-ixp4xx.o
 obj-$(CONFIG_I2C_KEYWEST)       += i2c-keywest.o
+obj-$(CONFIG_I2C_PMAC_SMU)      += i2c-pmac-smu.o
 obj-$(CONFIG_I2C_MPC)           += i2c-mpc.o
 obj-$(CONFIG_I2C_MV64XXX)       += i2c-mv64xxx.o
 obj-$(CONFIG_I2C_NFORCE2)       += i2c-nforce2.o
diff --git a/drivers/i2c/busses/i2c-keywest.c b/drivers/i2c/busses/i2c-keywest.c
index 37b49c2daf5f..eff5896ce865 100644
--- a/drivers/i2c/busses/i2c-keywest.c
+++ b/drivers/i2c/busses/i2c-keywest.c
@@ -611,7 +611,6 @@ create_iface(struct device_node *np, struct device *dev)
         
         for (i=0; i<nchan; i++) {
                 struct keywest_chan* chan = &iface->channels[i];
-                u8 addr;
                 
                 sprintf(chan->adapter.name, "%s %d", np->parent->name, i);
                 chan->iface = iface;
diff --git a/drivers/i2c/busses/i2c-pmac-smu.c b/drivers/i2c/busses/i2c-pmac-smu.c
new file mode 100644
index 000000000000..8a9f5648a23d
--- /dev/null
+++ b/drivers/i2c/busses/i2c-pmac-smu.c
@@ -0,0 +1,316 @@
+/*
+    i2c Support for Apple SMU Controller
+
+    Copyright (c) 2005 Benjamin Herrenschmidt, IBM Corp.
+                       <benh@kernel.crashing.org>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+
+*/
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/i2c.h>
+#include <linux/init.h>
+#include <linux/completion.h>
+#include <linux/device.h>
+#include <asm/prom.h>
+#include <asm/of_device.h>
+#include <asm/smu.h>
+
+static int probe;
+
+MODULE_AUTHOR("Benjamin Herrenschmidt <benh@kernel.crashing.org>");
+MODULE_DESCRIPTION("I2C driver for Apple's SMU");
+MODULE_LICENSE("GPL");
+module_param(probe, bool, 0);
+
+
+/* Physical interface */
+struct smu_iface
+{
+        struct i2c_adapter      adapter;
+        struct completion       complete;
+        u32                     busid;
+};
+
+static void smu_i2c_done(struct smu_i2c_cmd *cmd, void *misc)
+{
+        struct smu_iface        *iface = misc;
+        complete(&iface->complete);
+}
+
+/*
+ * SMBUS-type transfer entrypoint
+ */
+static s32 smu_smbus_xfer(      struct i2c_adapter*     adap,
+                                u16                     addr,
+                                unsigned short          flags,
+                                char                    read_write,
+                                u8                      command,
+                                int                     size,
+                                union i2c_smbus_data*   data)
+{
+        struct smu_iface        *iface = i2c_get_adapdata(adap);
+        struct smu_i2c_cmd      cmd;
+        int                     rc = 0;
+        int                     read = (read_write == I2C_SMBUS_READ);
+
+        cmd.info.bus = iface->busid;
+        cmd.info.devaddr = (addr << 1) | (read ? 0x01 : 0x00);
+
+        /* Prepare datas & select mode */
+        switch (size) {
+        case I2C_SMBUS_QUICK:
+                cmd.info.type = SMU_I2C_TRANSFER_SIMPLE;
+                cmd.info.datalen = 0;
+                break;
+        case I2C_SMBUS_BYTE:
+                cmd.info.type = SMU_I2C_TRANSFER_SIMPLE;
+                cmd.info.datalen = 1;
+                if (!read)
+                        cmd.info.data[0] = data->byte;
+                break;
+        case I2C_SMBUS_BYTE_DATA:
+                cmd.info.type = SMU_I2C_TRANSFER_STDSUB;
+                cmd.info.datalen = 1;
+                cmd.info.sublen = 1;
+                cmd.info.subaddr[0] = command;
+                cmd.info.subaddr[1] = 0;
+                cmd.info.subaddr[2] = 0;
+                if (!read)
+                        cmd.info.data[0] = data->byte;
+                break;
+        case I2C_SMBUS_WORD_DATA:
+                cmd.info.type = SMU_I2C_TRANSFER_STDSUB;
+                cmd.info.datalen = 2;
+                cmd.info.sublen = 1;
+                cmd.info.subaddr[0] = command;
+                cmd.info.subaddr[1] = 0;
+                cmd.info.subaddr[2] = 0;
+                if (!read) {
+                        cmd.info.data[0] = data->byte & 0xff;
+                        cmd.info.data[1] = (data->byte >> 8) & 0xff;
+                }
+                break;
+        /* Note that these are broken vs. the expected smbus API where
+         * on reads, the lenght is actually returned from the function,
+         * but I think the current API makes no sense and I don't want
+         * any driver that I haven't verified for correctness to go
+         * anywhere near a pmac i2c bus anyway ...
+         */
+        case I2C_SMBUS_BLOCK_DATA:
+                cmd.info.type = SMU_I2C_TRANSFER_STDSUB;
+                cmd.info.datalen = data->block[0] + 1;
+                if (cmd.info.datalen > 6)
+                        return -EINVAL;
+                if (!read)
+                        memcpy(cmd.info.data, data->block, cmd.info.datalen);
+                cmd.info.sublen = 1;
+                cmd.info.subaddr[0] = command;
+                cmd.info.subaddr[1] = 0;
+                cmd.info.subaddr[2] = 0;
+                break;
+        case I2C_SMBUS_I2C_BLOCK_DATA:
+                cmd.info.type = SMU_I2C_TRANSFER_STDSUB;
+                cmd.info.datalen = data->block[0];
+                if (cmd.info.datalen > 7)
+                        return -EINVAL;
+                if (!read)
+                        memcpy(cmd.info.data, &data->block[1],
+                               cmd.info.datalen);
+                cmd.info.sublen = 1;
+                cmd.info.subaddr[0] = command;
+                cmd.info.subaddr[1] = 0;
+                cmd.info.subaddr[2] = 0;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        /* Turn a standardsub read into a combined mode access */
+        if (read_write == I2C_SMBUS_READ &&
+            cmd.info.type == SMU_I2C_TRANSFER_STDSUB)
+                cmd.info.type = SMU_I2C_TRANSFER_COMBINED;
+
+        /* Finish filling command and submit it */
+        cmd.done = smu_i2c_done;
+        cmd.misc = iface;
+        rc = smu_queue_i2c(&cmd);
+        if (rc < 0)
+                return rc;
+        wait_for_completion(&iface->complete);
+        rc = cmd.status;
+
+        if (!read || rc < 0)
+                return rc;
+
+        switch (size) {
+        case I2C_SMBUS_BYTE:
+        case I2C_SMBUS_BYTE_DATA:
+                data->byte = cmd.info.data[0];
+                break;
+        case I2C_SMBUS_WORD_DATA:
+                data->word = ((u16)cmd.info.data[1]) << 8;
+                data->word |= cmd.info.data[0];
+                break;
+        /* Note that these are broken vs. the expected smbus API where
+         * on reads, the lenght is actually returned from the function,
+         * but I think the current API makes no sense and I don't want
+         * any driver that I haven't verified for correctness to go
+         * anywhere near a pmac i2c bus anyway ...
+         */
+        case I2C_SMBUS_BLOCK_DATA:
+        case I2C_SMBUS_I2C_BLOCK_DATA:
+                memcpy(&data->block[0], cmd.info.data, cmd.info.datalen);
+                break;
+        }
+
+        return rc;
+}
+
+static u32
+smu_smbus_func(struct i2c_adapter * adapter)
+{
+        return I2C_FUNC_SMBUS_QUICK | I2C_FUNC_SMBUS_BYTE |
+               I2C_FUNC_SMBUS_BYTE_DATA | I2C_FUNC_SMBUS_WORD_DATA |
+               I2C_FUNC_SMBUS_BLOCK_DATA;
+}
+
+/* For now, we only handle combined mode (smbus) */
+static struct i2c_algorithm smu_algorithm = {
+        .smbus_xfer     = smu_smbus_xfer,
+        .functionality  = smu_smbus_func,
+};
+
+static int create_iface(struct device_node *np, struct device *dev)
+{
+        struct smu_iface* iface;
+        u32 *reg, busid;
+        int rc;
+
+        reg = (u32 *)get_property(np, "reg", NULL);
+        if (reg == NULL) {
+                printk(KERN_ERR "i2c-pmac-smu: can't find bus number !\n");
+                return -ENXIO;
+        }
+        busid = *reg;
+
+        iface = kmalloc(sizeof(struct smu_iface), GFP_KERNEL);
+        if (iface == NULL) {
+                printk(KERN_ERR "i2c-pmac-smu: can't allocate inteface !\n");
+                return -ENOMEM;
+        }
+        memset(iface, 0, sizeof(struct smu_iface));
+        init_completion(&iface->complete);
+        iface->busid = busid;
+
+        dev_set_drvdata(dev, iface);
+
+        sprintf(iface->adapter.name, "smu-i2c-%02x", busid);
+        iface->adapter.algo = &smu_algorithm;
+        iface->adapter.algo_data = NULL;
+        iface->adapter.client_register = NULL;
+        iface->adapter.client_unregister = NULL;
+        i2c_set_adapdata(&iface->adapter, iface);
+        iface->adapter.dev.parent = dev;
+
+        rc = i2c_add_adapter(&iface->adapter);
+        if (rc) {
+                printk(KERN_ERR "i2c-pamc-smu.c: Adapter %s registration "
+                       "failed\n", iface->adapter.name);
+                i2c_set_adapdata(&iface->adapter, NULL);
+        }
+
+        if (probe) {
+                unsigned char addr;
+                printk("Probe: ");
+                for (addr = 0x00; addr <= 0x7f; addr++) {
+                        if (i2c_smbus_xfer(&iface->adapter,addr,
+                                           0,0,0,I2C_SMBUS_QUICK,NULL) >= 0)
+                                printk("%02x ", addr);
+                }
+                printk("\n");
+        }
+
+        printk(KERN_INFO "SMU i2c bus %x registered\n", busid);
+
+        return 0;
+}
+
+static int dispose_iface(struct device *dev)
+{
+        struct smu_iface *iface = dev_get_drvdata(dev);
+        int rc;
+
+        rc = i2c_del_adapter(&iface->adapter);
+        i2c_set_adapdata(&iface->adapter, NULL);
+        /* We aren't that prepared to deal with this... */
+        if (rc)
+                printk("i2c-pmac-smu.c: Failed to remove bus %s !\n",
+                       iface->adapter.name);
+        dev_set_drvdata(dev, NULL);
+        kfree(iface);
+
+        return 0;
+}
+
+
+static int create_iface_of_platform(struct of_device* dev,
+                                    const struct of_device_id *match)
+{
+        return create_iface(dev->node, &dev->dev);
+}
+
+
+static int dispose_iface_of_platform(struct of_device* dev)
+{
+        return dispose_iface(&dev->dev);
+}
+
+
+static struct of_device_id i2c_smu_match[] =
+{
+        {
+                .compatible     = "smu-i2c",
+        },
+        {},
+};
+static struct of_platform_driver i2c_smu_of_platform_driver =
+{
+        .name           = "i2c-smu",
+        .match_table    = i2c_smu_match,
+        .probe          = create_iface_of_platform,
+        .remove         = dispose_iface_of_platform
+};
+
+
+static int __init i2c_pmac_smu_init(void)
+{
+        of_register_driver(&i2c_smu_of_platform_driver);
+        return 0;
+}
+
+
+static void __exit i2c_pmac_smu_cleanup(void)
+{
+        of_unregister_driver(&i2c_smu_of_platform_driver);
+}
+
+module_init(i2c_pmac_smu_init);
+module_exit(i2c_pmac_smu_cleanup);
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index fdf53ce04248..44b595d90a4a 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -914,19 +914,23 @@ static int i2c_pxa_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num
         return ret;
 }
 
+static u32 i2c_pxa_functionality(struct i2c_adapter *adap)
+{
+        return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
+}
+
 static struct i2c_algorithm i2c_pxa_algorithm = {
-        .name           = "PXA-I2C-Algorithm",
-        .id             = I2C_ALGO_PXA,
         .master_xfer    = i2c_pxa_xfer,
+        .functionality  = i2c_pxa_functionality,
 };
 
 static struct pxa_i2c i2c_pxa = {
         .lock   = SPIN_LOCK_UNLOCKED,
         .wait   = __WAIT_QUEUE_HEAD_INITIALIZER(i2c_pxa.wait),
         .adap   = {
-                .name           = "pxa2xx-i2c",
-                .id             = I2C_ALGO_PXA,
+                .owner          = THIS_MODULE,
                 .algo           = &i2c_pxa_algorithm,
+                .name           = "pxa2xx-i2c",
                 .retries        = 5,
         },
 };
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index b443b04a4c5a..0b0aa4f51628 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -601,44 +601,15 @@ EXPORT_SYMBOL(ide_wait_stat);
  */
 u8 eighty_ninty_three (ide_drive_t *drive)
 {
-#if 0
-        if (!HWIF(drive)->udma_four)
+        if(HWIF(drive)->udma_four == 0)
+                return 0;
+        if (!(drive->id->hw_config & 0x6000))
                 return 0;
-
-        if (drive->id->major_rev_num) {
-                int hssbd = 0;
-                int i;
-                /*
-                 * Determine highest Supported SPEC
-                 */
-                for (i=1; i<=15; i++)
-                        if (drive->id->major_rev_num & (1<<i))
-                                hssbd++;
-
-                switch (hssbd) {
-                        case 7:
-                        case 6:
-                        case 5:
-                /* ATA-4 and older do not support above Ultra 33 */
-                        default:
-                                return 0;
-                }
-        }
-
-        return ((u8) (
-#ifndef CONFIG_IDEDMA_IVB
-                (drive->id->hw_config & 0x4000) &&
-#endif /* CONFIG_IDEDMA_IVB */
-                 (drive->id->hw_config & 0x6000)) ? 1 : 0);
-
-#else
-
-        return ((u8) ((HWIF(drive)->udma_four) &&
 #ifndef CONFIG_IDEDMA_IVB
-                        (drive->id->hw_config & 0x4000) &&
+        if(!(drive->id->hw_config & 0x4000))
+                return 0;
 #endif /* CONFIG_IDEDMA_IVB */
-                        (drive->id->hw_config & 0x6000)) ? 1 : 0);
-#endif
+        return 1;
 }
 
 EXPORT_SYMBOL(eighty_ninty_three);
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
index d04f62ab5de1..ace8edad6e96 100644
--- a/drivers/ide/ide-taskfile.c
+++ b/drivers/ide/ide-taskfile.c
@@ -500,6 +500,7 @@ static int ide_diag_taskfile(ide_drive_t *drive, ide_task_t *args, unsigned long
         }
 
         rq.special = args;
+        args->rq = &rq;
         return ide_do_drive_cmd(drive, &rq, ide_wait);
 }
 
diff --git a/drivers/ide/legacy/ide-cs.c b/drivers/ide/legacy/ide-cs.c
index 0ccf85fcee34..a35a58bef1a4 100644
--- a/drivers/ide/legacy/ide-cs.c
+++ b/drivers/ide/legacy/ide-cs.c
@@ -477,7 +477,7 @@ static struct pcmcia_device_id ide_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("IO DATA", "PCIDE", 0x547e66dc, 0x5c5ab149),
         PCMCIA_DEVICE_PROD_ID12("IO DATA", "PCIDEII", 0x547e66dc, 0xb3662674),
         PCMCIA_DEVICE_PROD_ID12("LOOKMEET", "CBIDE2      ", 0xe37be2b5, 0x8671043b),
-        PCMCIA_DEVICE_PROD_ID12(" ", "NinjaATA-", 0x3b6e20c8, 0xebe0bd79),
+        PCMCIA_DEVICE_PROD_ID2("NinjaATA-", 0xebe0bd79),
         PCMCIA_DEVICE_PROD_ID12("PCMCIA", "CD-ROM", 0x281f1c5d, 0x66536591),
         PCMCIA_DEVICE_PROD_ID12("PCMCIA", "PnPIDE", 0x281f1c5d, 0x0c694728),
         PCMCIA_DEVICE_PROD_ID12("SHUTTLE TECHNOLOGY LTD.", "PCCARD-IDE/ATAPI Adapter", 0x4a3f0ba0, 0x322560e1),
diff --git a/drivers/ide/pci/cmd64x.c b/drivers/ide/pci/cmd64x.c
index 3de9ab897e42..3d9c7afc8695 100644
--- a/drivers/ide/pci/cmd64x.c
+++ b/drivers/ide/pci/cmd64x.c
@@ -608,7 +608,7 @@ static unsigned int __devinit init_chipset_cmd64x(struct pci_dev *dev, const cha
 
 #ifdef __i386__
         if (dev->resource[PCI_ROM_RESOURCE].start) {
-                pci_write_config_byte(dev, PCI_ROM_ADDRESS, dev->resource[PCI_ROM_RESOURCE].start | PCI_ROM_ADDRESS_ENABLE);
+                pci_write_config_dword(dev, PCI_ROM_ADDRESS, dev->resource[PCI_ROM_RESOURCE].start | PCI_ROM_ADDRESS_ENABLE);
                 printk(KERN_INFO "%s: ROM enabled at 0x%08lx\n", name, dev->resource[PCI_ROM_RESOURCE].start);
         }
 #endif
diff --git a/drivers/ide/pci/hpt34x.c b/drivers/ide/pci/hpt34x.c
index bbde46279984..be334da7a754 100644
--- a/drivers/ide/pci/hpt34x.c
+++ b/drivers/ide/pci/hpt34x.c
@@ -173,7 +173,7 @@ static unsigned int __devinit init_chipset_hpt34x(struct pci_dev *dev, const cha
 
         if (cmd & PCI_COMMAND_MEMORY) {
                 if (pci_resource_start(dev, PCI_ROM_RESOURCE)) {
-                        pci_write_config_byte(dev, PCI_ROM_ADDRESS,
+                        pci_write_config_dword(dev, PCI_ROM_ADDRESS,
                                 dev->resource[PCI_ROM_RESOURCE].start | PCI_ROM_ADDRESS_ENABLE);
                         printk(KERN_INFO "HPT345: ROM enabled at 0x%08lx\n",
                                 dev->resource[PCI_ROM_RESOURCE].start);
diff --git a/drivers/ieee1394/amdtp.c b/drivers/ieee1394/amdtp.c
index 84ae027b021a..e8e28569a668 100644
--- a/drivers/ieee1394/amdtp.c
+++ b/drivers/ieee1394/amdtp.c
@@ -1297,4 +1297,3 @@ static void __exit amdtp_exit_module (void)
 
 module_init(amdtp_init_module);
 module_exit(amdtp_exit_module);
-MODULE_ALIAS_CHARDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_AMDTP * 16);
diff --git a/drivers/ieee1394/csr1212.h b/drivers/ieee1394/csr1212.h
index e6734263a1d3..28c5f4b726e2 100644
--- a/drivers/ieee1394/csr1212.h
+++ b/drivers/ieee1394/csr1212.h
@@ -37,7 +37,6 @@
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/interrupt.h>
-#include <linux/sched.h>
 #include <linux/vmalloc.h>
 #include <asm/pgalloc.h>
 
diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
index 4538b0235ca3..e34730c7a874 100644
--- a/drivers/ieee1394/dv1394.c
+++ b/drivers/ieee1394/dv1394.c
@@ -2660,4 +2660,3 @@ static int __init dv1394_init_module(void)
 
 module_init(dv1394_init_module);
 module_exit(dv1394_exit_module);
-MODULE_ALIAS_CHARDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_DV1394 * 16);
diff --git a/drivers/ieee1394/eth1394.c b/drivers/ieee1394/eth1394.c
index cd53c174ced1..4802bbbb6dc9 100644
--- a/drivers/ieee1394/eth1394.c
+++ b/drivers/ieee1394/eth1394.c
@@ -89,7 +89,7 @@
 #define TRACE() printk(KERN_ERR "%s:%s[%d] ---- TRACE\n", driver_name, __FUNCTION__, __LINE__)
 
 static char version[] __devinitdata =
-        "$Rev: 1264 $ Ben Collins <bcollins@debian.org>";
+        "$Rev: 1312 $ Ben Collins <bcollins@debian.org>";
 
 struct fragment_info {
         struct list_head list;
@@ -221,9 +221,7 @@ static int ether1394_open (struct net_device *dev)
         if (priv->bc_state == ETHER1394_BC_ERROR) {
                 /* we'll try again */
                 priv->iso = hpsb_iso_recv_init(priv->host,
-                                               ETHER1394_GASP_BUFFERS * 2 *
-                                               (1 << (priv->host->csr.max_rec +
-                                                      1)),
+                                               ETHER1394_ISO_BUF_SIZE,
                                                ETHER1394_GASP_BUFFERS,
                                                priv->broadcast_channel,
                                                HPSB_ISO_DMA_PACKET_PER_BUFFER,
@@ -635,8 +633,8 @@ static void ether1394_add_host (struct hpsb_host *host)
          * be checked when the eth device is opened. */
         priv->broadcast_channel = host->csr.broadcast_channel & 0x3f;
 
-        priv->iso = hpsb_iso_recv_init(host, (ETHER1394_GASP_BUFFERS * 2 *
-                                              (1 << (host->csr.max_rec + 1))),
+        priv->iso = hpsb_iso_recv_init(host,
+                                       ETHER1394_ISO_BUF_SIZE,
                                        ETHER1394_GASP_BUFFERS,
                                        priv->broadcast_channel,
                                        HPSB_ISO_DMA_PACKET_PER_BUFFER,
@@ -1770,7 +1768,7 @@ fail:
 static void ether1394_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
 {
         strcpy (info->driver, driver_name);
-        strcpy (info->version, "$Rev: 1264 $");
+        strcpy (info->version, "$Rev: 1312 $");
         /* FIXME XXX provide sane businfo */
         strcpy (info->bus_info, "ieee1394");
 }
diff --git a/drivers/ieee1394/eth1394.h b/drivers/ieee1394/eth1394.h
index ed8f1c4b7fd8..a77213cfc483 100644
--- a/drivers/ieee1394/eth1394.h
+++ b/drivers/ieee1394/eth1394.h
@@ -44,6 +44,12 @@
 
 #define ETHER1394_GASP_BUFFERS 16
 
+/* rawiso buffer size - due to a limitation in rawiso, we must limit each
+ * GASP buffer to be less than PAGE_SIZE. */
+#define ETHER1394_ISO_BUF_SIZE  ETHER1394_GASP_BUFFERS *                        \
+                                   min((unsigned int)PAGE_SIZE,                 \
+                                       2 * (1U << (priv->host->csr.max_rec + 1)))
+
 /* Node set == 64 */
 #define NODE_SET                        (ALL_NODES + 1)
 
diff --git a/drivers/ieee1394/hosts.c b/drivers/ieee1394/hosts.c
index c502c6e9c440..aeeaeb670d03 100644
--- a/drivers/ieee1394/hosts.c
+++ b/drivers/ieee1394/hosts.c
@@ -18,6 +18,7 @@
 #include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/timer.h>
+#include <linux/jiffies.h>
 
 #include "csr1212.h"
 #include "ieee1394.h"
@@ -217,7 +218,7 @@ int hpsb_update_config_rom_image(struct hpsb_host *host)
 
         /* IEEE 1394a-2000 prohibits using the same generation number
          * twice in a 60 second period. */
-        if (jiffies - host->csr.gen_timestamp[next_gen] < 60 * HZ)
+        if (time_before(jiffies, host->csr.gen_timestamp[next_gen] + 60 * HZ))
                 /* Wait 60 seconds from the last time this generation number was
                  * used. */
                 reset_delay = (60 * HZ) + host->csr.gen_timestamp[next_gen] - jiffies;
diff --git a/drivers/ieee1394/hosts.h b/drivers/ieee1394/hosts.h
index 739e76840d51..38f42112dff0 100644
--- a/drivers/ieee1394/hosts.h
+++ b/drivers/ieee1394/hosts.h
@@ -135,17 +135,17 @@ enum isoctl_cmd {
 
 enum reset_types {
         /* 166 microsecond reset -- only type of reset available on
-           non-1394a capable IEEE 1394 controllers */
+           non-1394a capable controllers */
         LONG_RESET,
 
         /* Short (arbitrated) reset -- only available on 1394a capable
-           IEEE 1394 capable controllers */
+           controllers */
         SHORT_RESET,
 
-        /* Variants, that set force_root before issueing the bus reset */
+        /* Variants that set force_root before issueing the bus reset */
         LONG_RESET_FORCE_ROOT, SHORT_RESET_FORCE_ROOT,
 
-        /* Variants, that clear force_root before issueing the bus reset */
+        /* Variants that clear force_root before issueing the bus reset */
         LONG_RESET_NO_FORCE_ROOT, SHORT_RESET_NO_FORCE_ROOT
 };
 
diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
index d633770fac8e..32a1e016c85e 100644
--- a/drivers/ieee1394/ieee1394_core.c
+++ b/drivers/ieee1394/ieee1394_core.c
@@ -70,7 +70,7 @@ const char *hpsb_speedto_str[] = { "S100", "S200", "S400", "S800", "S1600", "S32
 struct class *hpsb_protocol_class;
 
 #ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-static void dump_packet(const char *text, quadlet_t *data, int size)
+static void dump_packet(const char *text, quadlet_t *data, int size, int speed)
 {
         int i;
 
@@ -78,12 +78,15 @@ static void dump_packet(const char *text, quadlet_t *data, int size)
         size = (size > 4 ? 4 : size);
 
         printk(KERN_DEBUG "ieee1394: %s", text);
+        if (speed > -1 && speed < 6)
+                printk(" at %s", hpsb_speedto_str[speed]);
+        printk(":");
         for (i = 0; i < size; i++)
                 printk(" %08x", data[i]);
         printk("\n");
 }
 #else
-#define dump_packet(x,y,z)
+#define dump_packet(a,b,c,d)
 #endif
 
 static void abort_requests(struct hpsb_host *host);
@@ -544,8 +547,7 @@ int hpsb_send_packet(struct hpsb_packet *packet)
                 if (packet->data_size)
                         memcpy(((u8*)data) + packet->header_size, packet->data, packet->data_size);
 
-                dump_packet("send packet local:", packet->header,
-                            packet->header_size);
+                dump_packet("send packet local", packet->header, packet->header_size, -1);
 
                 hpsb_packet_sent(host, packet, packet->expect_response ? ACK_PENDING : ACK_COMPLETE);
                 hpsb_packet_received(host, data, size, 0);
@@ -561,21 +563,7 @@ int hpsb_send_packet(struct hpsb_packet *packet)
                                        + NODEID_TO_NODE(packet->node_id)];
         }
 
-#ifdef CONFIG_IEEE1394_VERBOSEDEBUG
-        switch (packet->speed_code) {
-        case 2:
-                dump_packet("send packet 400:", packet->header,
-                            packet->header_size);
-                break;
-        case 1:
-                dump_packet("send packet 200:", packet->header,
-                            packet->header_size);
-                break;
-        default:
-                dump_packet("send packet 100:", packet->header,
-                            packet->header_size);
-        }
-#endif
+        dump_packet("send packet", packet->header, packet->header_size, packet->speed_code);
 
         return host->driver->transmit_packet(host, packet);
 }
@@ -636,7 +624,7 @@ static void handle_packet_response(struct hpsb_host *host, int tcode,
 
         if (packet == NULL) {
                 HPSB_DEBUG("unsolicited response packet received - no tlabel match");
-                dump_packet("contents:", data, 16);
+                dump_packet("contents", data, 16, -1);
                 spin_unlock_irqrestore(&host->pending_packet_queue.lock, flags);
                 return;
         }
@@ -677,7 +665,7 @@ static void handle_packet_response(struct hpsb_host *host, int tcode,
         if (!tcode_match) {
                 spin_unlock_irqrestore(&host->pending_packet_queue.lock, flags);
                 HPSB_INFO("unsolicited response packet received - tcode mismatch");
-                dump_packet("contents:", data, 16);
+                dump_packet("contents", data, 16, -1);
                 return;
         }
 
@@ -914,7 +902,7 @@ void hpsb_packet_received(struct hpsb_host *host, quadlet_t *data, size_t size,
                 return;
         }
 
-        dump_packet("received packet:", data, size);
+        dump_packet("received packet", data, size, -1);
 
         tcode = (data[0] >> 4) & 0xf;
 
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index b23322523ef5..347ece6b583c 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -64,10 +64,10 @@ static int nodemgr_bus_read(struct csr1212_csr *csr, u64 addr, u16 length,
         struct nodemgr_csr_info *ci = (struct nodemgr_csr_info*)__ci;
         int i, ret = 0;
 
-        for (i = 0; i < 3; i++) {
+        for (i = 1; ; i++) {
                 ret = hpsb_read(ci->host, ci->nodeid, ci->generation, addr,
                                 buffer, length);
-                if (!ret)
+                if (!ret || i == 3)
                         break;
 
                 if (msleep_interruptible(334))
@@ -1438,9 +1438,13 @@ static int nodemgr_do_irm_duties(struct hpsb_host *host, int cycles)
         if (host->busmgr_id == 0xffff && host->node_count > 1)
         {
                 u16 root_node = host->node_count - 1;
-                struct node_entry *ne = find_entry_by_nodeid(host, root_node | LOCAL_BUS);
 
-                if (ne && ne->busopt.cmc)
+                /* get cycle master capability flag from root node */
+                if (host->is_cycmst ||
+                    (!hpsb_read(host, LOCAL_BUS | root_node, get_hpsb_generation(host),
+                                (CSR_REGISTER_BASE + CSR_CONFIG_ROM + 2 * sizeof(quadlet_t)),
+                                &bc, sizeof(quadlet_t)) &&
+                     be32_to_cpu(bc) & 1 << CSR_CMC_SHIFT))
                         hpsb_send_phy_config(host, root_node, -1);
                 else {
                         HPSB_DEBUG("The root node is not cycle master capable; "
@@ -1557,24 +1561,19 @@ static int nodemgr_host_thread(void *__hi)
                         }
                 }
 
-                if (!nodemgr_check_irm_capability(host, reset_cycles)) {
+                if (!nodemgr_check_irm_capability(host, reset_cycles) ||
+                    !nodemgr_do_irm_duties(host, reset_cycles)) {
                         reset_cycles++;
                         up(&nodemgr_serialize);
                         continue;
                 }
+                reset_cycles = 0;
 
                 /* Scan our nodes to get the bus options and create node
                  * entries. This does not do the sysfs stuff, since that
                  * would trigger hotplug callbacks and such, which is a
                  * bad idea at this point. */
                 nodemgr_node_scan(hi, generation);
-                if (!nodemgr_do_irm_duties(host, reset_cycles)) {
-                        reset_cycles++;
-                        up(&nodemgr_serialize);
-                        continue;
-                }
-
-                reset_cycles = 0;
 
                 /* This actually does the full probe, with sysfs
                  * registration. */
diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
index 27018c8efc24..6a6acbd80af4 100644
--- a/drivers/ieee1394/ohci1394.c
+++ b/drivers/ieee1394/ohci1394.c
@@ -162,7 +162,7 @@ printk(level "%s: " fmt "\n" , OHCI1394_DRIVER_NAME , ## args)
 printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
 
 static char version[] __devinitdata =
-        "$Rev: 1299 $ Ben Collins <bcollins@debian.org>";
+        "$Rev: 1313 $ Ben Collins <bcollins@debian.org>";
 
 /* Module Parameters */
 static int phys_dma = 1;
@@ -1084,7 +1084,7 @@ static int ohci_devctl(struct hpsb_host *host, enum devctl_cmd cmd, int arg)
                         initialize_dma_rcv_ctx(&ohci->ir_legacy_context, 1);
 
                         if (printk_ratelimit())
-                                PRINT(KERN_ERR, "IR legacy activated");
+                                DBGMSG("IR legacy activated");
                 }
 
                 spin_lock_irqsave(&ohci->IR_channel_lock, flags);
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c
index b4fa14793fe5..5fe4f2ba0979 100644
--- a/drivers/ieee1394/raw1394.c
+++ b/drivers/ieee1394/raw1394.c
@@ -2958,4 +2958,3 @@ static void __exit cleanup_raw1394(void)
 module_init(init_raw1394);
 module_exit(cleanup_raw1394);
 MODULE_LICENSE("GPL");
-MODULE_ALIAS_CHARDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_RAW1394 * 16);
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index de88218ef7cc..12cec7c4a342 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -97,16 +97,18 @@ static char version[] __devinitdata =
  */
 static int max_speed = IEEE1394_SPEED_MAX;
 module_param(max_speed, int, 0644);
-MODULE_PARM_DESC(max_speed, "Force max speed (3 = 800mb, 2 = 400mb default, 1 = 200mb, 0 = 100mb)");
+MODULE_PARM_DESC(max_speed, "Force max speed (3 = 800mb, 2 = 400mb, 1 = 200mb, 0 = 100mb)");
 
 /*
  * Set serialize_io to 1 if you'd like only one scsi command sent
  * down to us at a time (debugging). This might be necessary for very
  * badly behaved sbp2 devices.
+ *
+ * TODO: Make this configurable per device.
  */
-static int serialize_io;
+static int serialize_io = 1;
 module_param(serialize_io, int, 0444);
-MODULE_PARM_DESC(serialize_io, "Serialize all I/O coming down from the scsi drivers (default = 0)");
+MODULE_PARM_DESC(serialize_io, "Serialize I/O coming from scsi drivers (default = 1, faster = 0)");
 
 /*
  * Bump up max_sectors if you'd like to support very large sized
@@ -596,6 +598,14 @@ static void sbp2util_mark_command_completed(struct scsi_id_instance_data *scsi_i
         spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
 }
 
+/*
+ * Is scsi_id valid? Is the 1394 node still present?
+ */
+static inline int sbp2util_node_is_available(struct scsi_id_instance_data *scsi_id)
+{
+        return scsi_id && scsi_id->ne && !scsi_id->ne->in_limbo;
+}
+
 
 
 /*********************************************
@@ -631,11 +641,23 @@ static int sbp2_remove(struct device *dev)
 {
         struct unit_directory *ud;
         struct scsi_id_instance_data *scsi_id;
+        struct scsi_device *sdev;
 
         SBP2_DEBUG("sbp2_remove");
 
         ud = container_of(dev, struct unit_directory, device);
         scsi_id = ud->device.driver_data;
+        if (!scsi_id)
+                return 0;
+
+        /* Trigger shutdown functions in scsi's highlevel. */
+        if (scsi_id->scsi_host)
+                scsi_unblock_requests(scsi_id->scsi_host);
+        sdev = scsi_id->sdev;
+        if (sdev) {
+                scsi_id->sdev = NULL;
+                scsi_remove_device(sdev);
+        }
 
         sbp2_logout_device(scsi_id);
         sbp2_remove_device(scsi_id);
@@ -2473,37 +2495,26 @@ static int sbp2scsi_queuecommand(struct scsi_cmnd *SCpnt,
         struct scsi_id_instance_data *scsi_id =
                 (struct scsi_id_instance_data *)SCpnt->device->host->hostdata[0];
         struct sbp2scsi_host_info *hi;
+        int result = DID_NO_CONNECT << 16;
 
         SBP2_DEBUG("sbp2scsi_queuecommand");
 
-        /*
-         * If scsi_id is null, it means there is no device in this slot,
-         * so we should return selection timeout.
-         */
-        if (!scsi_id) {
-                SCpnt->result = DID_NO_CONNECT << 16;
-                done (SCpnt);
-                return 0;
-        }
+        if (!sbp2util_node_is_available(scsi_id))
+                goto done;
 
         hi = scsi_id->hi;
 
         if (!hi) {
                 SBP2_ERR("sbp2scsi_host_info is NULL - this is bad!");
-                SCpnt->result = DID_NO_CONNECT << 16;
-                done (SCpnt);
-                return(0);
+                goto done;
         }
 
         /*
          * Until we handle multiple luns, just return selection time-out
          * to any IO directed at non-zero LUNs
          */
-        if (SCpnt->device->lun) {
-                SCpnt->result = DID_NO_CONNECT << 16;
-                done (SCpnt);
-                return(0);
-        }
+        if (SCpnt->device->lun)
+                goto done;
 
         /*
          * Check for request sense command, and handle it here
@@ -2514,7 +2525,7 @@ static int sbp2scsi_queuecommand(struct scsi_cmnd *SCpnt,
                 memcpy(SCpnt->request_buffer, SCpnt->sense_buffer, SCpnt->request_bufflen);
                 memset(SCpnt->sense_buffer, 0, sizeof(SCpnt->sense_buffer));
                 sbp2scsi_complete_command(scsi_id, SBP2_SCSI_STATUS_GOOD, SCpnt, done);
-                return(0);
+                return 0;
         }
 
         /*
@@ -2522,9 +2533,8 @@ static int sbp2scsi_queuecommand(struct scsi_cmnd *SCpnt,
          */
         if (!hpsb_node_entry_valid(scsi_id->ne)) {
                 SBP2_ERR("Bus reset in progress - rejecting command");
-                SCpnt->result = DID_BUS_BUSY << 16;
-                done (SCpnt);
-                return(0);
+                result = DID_BUS_BUSY << 16;
+                goto done;
         }
 
         /*
@@ -2535,8 +2545,12 @@ static int sbp2scsi_queuecommand(struct scsi_cmnd *SCpnt,
                 sbp2scsi_complete_command(scsi_id, SBP2_SCSI_STATUS_SELECTION_TIMEOUT,
                                           SCpnt, done);
         }
+        return 0;
 
-        return(0);
+done:
+        SCpnt->result = result;
+        done(SCpnt);
+        return 0;
 }
 
 /*
@@ -2683,14 +2697,27 @@ static void sbp2scsi_complete_command(struct scsi_id_instance_data *scsi_id,
 }
 
 
-static int sbp2scsi_slave_configure (struct scsi_device *sdev)
+static int sbp2scsi_slave_alloc(struct scsi_device *sdev)
 {
-        blk_queue_dma_alignment(sdev->request_queue, (512 - 1));
+        ((struct scsi_id_instance_data *)sdev->host->hostdata[0])->sdev = sdev;
+        return 0;
+}
+
 
+static int sbp2scsi_slave_configure(struct scsi_device *sdev)
+{
+        blk_queue_dma_alignment(sdev->request_queue, (512 - 1));
         return 0;
 }
 
 
+static void sbp2scsi_slave_destroy(struct scsi_device *sdev)
+{
+        ((struct scsi_id_instance_data *)sdev->host->hostdata[0])->sdev = NULL;
+        return;
+}
+
+
 /*
  * Called by scsi stack when something has really gone wrong.  Usually
  * called when a command has timed-out for some reason.
@@ -2705,7 +2732,7 @@ static int sbp2scsi_abort(struct scsi_cmnd *SCpnt)
         SBP2_ERR("aborting sbp2 command");
         scsi_print_command(SCpnt);
 
-        if (scsi_id) {
+        if (sbp2util_node_is_available(scsi_id)) {
 
                 /*
                  * Right now, just return any matching command structures
@@ -2742,31 +2769,24 @@ static int sbp2scsi_abort(struct scsi_cmnd *SCpnt)
 /*
  * Called by scsi stack when something has really gone wrong.
  */
-static int __sbp2scsi_reset(struct scsi_cmnd *SCpnt)
+static int sbp2scsi_reset(struct scsi_cmnd *SCpnt)
 {
         struct scsi_id_instance_data *scsi_id =
                 (struct scsi_id_instance_data *)SCpnt->device->host->hostdata[0];
+        unsigned long flags;
 
         SBP2_ERR("reset requested");
 
-        if (scsi_id) {
+        spin_lock_irqsave(SCpnt->device->host->host_lock, flags);
+
+        if (sbp2util_node_is_available(scsi_id)) {
                 SBP2_ERR("Generating sbp2 fetch agent reset");
                 sbp2_agent_reset(scsi_id, 0);
         }
 
-        return(SUCCESS);
-}
-
-static int sbp2scsi_reset(struct scsi_cmnd *SCpnt)
-{
-        unsigned long flags;
-        int rc;
-
-        spin_lock_irqsave(SCpnt->device->host->host_lock, flags);
-        rc = __sbp2scsi_reset(SCpnt);
         spin_unlock_irqrestore(SCpnt->device->host->host_lock, flags);
 
-        return rc;
+        return SUCCESS;
 }
 
 static const char *sbp2scsi_info (struct Scsi_Host *host)
@@ -2817,7 +2837,9 @@ static struct scsi_host_template scsi_driver_template = {
         .eh_device_reset_handler =      sbp2scsi_reset,
         .eh_bus_reset_handler =         sbp2scsi_reset,
         .eh_host_reset_handler =        sbp2scsi_reset,
+        .slave_alloc =                  sbp2scsi_slave_alloc,
         .slave_configure =              sbp2scsi_slave_configure,
+        .slave_destroy =                sbp2scsi_slave_destroy,
         .this_id =                      -1,
         .sg_tablesize =                 SG_ALL,
         .use_clustering =               ENABLE_CLUSTERING,
@@ -2837,7 +2859,8 @@ static int sbp2_module_init(void)
 
         /* Module load debug option to force one command at a time (serializing I/O) */
         if (serialize_io) {
-                SBP2_ERR("Driver forced to serialize I/O (serialize_io = 1)");
+                SBP2_INFO("Driver forced to serialize I/O (serialize_io=1)");
+                SBP2_INFO("Try serialize_io=0 for better performance");
                 scsi_driver_template.can_queue = 1;
                 scsi_driver_template.cmd_per_lun = 1;
         }
diff --git a/drivers/ieee1394/video1394.c b/drivers/ieee1394/video1394.c
index 9d6facf2f78f..11be9c9c82a8 100644
--- a/drivers/ieee1394/video1394.c
+++ b/drivers/ieee1394/video1394.c
@@ -1571,4 +1571,3 @@ static int __init video1394_init_module (void)
 
 module_init(video1394_init_module);
 module_exit(video1394_exit_module);
-MODULE_ALIAS_CHARDEV(IEEE1394_MAJOR, IEEE1394_MINOR_BLOCK_VIDEO1394 * 16);
diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c
index 2bd8b1cc57c4..e23836d0e21b 100644
--- a/drivers/infiniband/core/mad_rmpp.c
+++ b/drivers/infiniband/core/mad_rmpp.c
@@ -412,8 +412,8 @@ static inline int get_mad_len(struct mad_rmpp_recv *rmpp_recv)
 
         hdr_size = data_offset(rmpp_mad->mad_hdr.mgmt_class);
         data_size = sizeof(struct ib_rmpp_mad) - hdr_size;
-        pad = data_size - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
-        if (pad > data_size || pad < 0)
+        pad = IB_MGMT_RMPP_DATA - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
+        if (pad > IB_MGMT_RMPP_DATA || pad < 0)
                 pad = 0;
 
         return hdr_size + rmpp_recv->seg_num * data_size - pad;
@@ -583,6 +583,7 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
 {
         struct ib_rmpp_mad *rmpp_mad;
         int timeout;
+        u32 paylen;
 
         rmpp_mad = (struct ib_rmpp_mad *)mad_send_wr->send_wr.wr.ud.mad_hdr;
         ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
@@ -590,11 +591,9 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
 
         if (mad_send_wr->seg_num == 1) {
                 rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_FIRST;
-                rmpp_mad->rmpp_hdr.paylen_newwin =
-                        cpu_to_be32(mad_send_wr->total_seg *
-                                    (sizeof(struct ib_rmpp_mad) -
-                                       offsetof(struct ib_rmpp_mad, data)) -
-                                    mad_send_wr->pad);
+                paylen = mad_send_wr->total_seg * IB_MGMT_RMPP_DATA -
+                         mad_send_wr->pad;
+                rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(paylen);
                 mad_send_wr->sg_list[0].length = sizeof(struct ib_rmpp_mad);
         } else {
                 mad_send_wr->send_wr.num_sge = 2;
@@ -608,10 +607,8 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
 
         if (mad_send_wr->seg_num == mad_send_wr->total_seg) {
                 rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_LAST;
-                rmpp_mad->rmpp_hdr.paylen_newwin =
-                        cpu_to_be32(sizeof(struct ib_rmpp_mad) -
-                                    offsetof(struct ib_rmpp_mad, data) -
-                                    mad_send_wr->pad);
+                paylen = IB_MGMT_RMPP_DATA - mad_send_wr->pad;
+                rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(paylen);
         }
 
         /* 2 seconds for an ACK until we can find the packet lifetime */
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index 7c2f03057ddb..a64d6b4dcc16 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -334,10 +334,11 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
                         ret = -EINVAL;
                         goto err_ah;
                 }
-                /* Validate that management class can support RMPP */
+
+                /* Validate that the management class can support RMPP */
                 if (rmpp_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_ADM) {
                         hdr_len = offsetof(struct ib_sa_mad, data);
-                        data_len = length;
+                        data_len = length - hdr_len;
                 } else if ((rmpp_mad->mad_hdr.mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
                             (rmpp_mad->mad_hdr.mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END)) {
                                 hdr_len = offsetof(struct ib_vendor_mad, data);
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index b1897bed14ad..cc124344dd2c 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -69,6 +69,7 @@ struct ib_uverbs_event_file {
 
 struct ib_uverbs_file {
         struct kref                             ref;
+        struct semaphore                        mutex;
         struct ib_uverbs_device                *device;
         struct ib_ucontext                     *ucontext;
         struct ib_event_handler                 event_handler;
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index e91ebde46481..562445165d2b 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -76,8 +76,9 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
         struct ib_uverbs_get_context_resp resp;
         struct ib_udata                   udata;
         struct ib_device                 *ibdev = file->device->ib_dev;
+        struct ib_ucontext               *ucontext;
         int i;
-        int ret = in_len;
+        int ret;
 
         if (out_len < sizeof resp)
                 return -ENOSPC;
@@ -85,45 +86,56 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
         if (copy_from_user(&cmd, buf, sizeof cmd))
                 return -EFAULT;
 
+        down(&file->mutex);
+
+        if (file->ucontext) {
+                ret = -EINVAL;
+                goto err;
+        }
+
         INIT_UDATA(&udata, buf + sizeof cmd,
                    (unsigned long) cmd.response + sizeof resp,
                    in_len - sizeof cmd, out_len - sizeof resp);
 
-        file->ucontext = ibdev->alloc_ucontext(ibdev, &udata);
-        if (IS_ERR(file->ucontext)) {
-                ret = PTR_ERR(file->ucontext);
-                file->ucontext = NULL;
-                return ret;
-        }
+        ucontext = ibdev->alloc_ucontext(ibdev, &udata);
+        if (IS_ERR(ucontext))
+                return PTR_ERR(file->ucontext);
 
-        file->ucontext->device = ibdev;
-        INIT_LIST_HEAD(&file->ucontext->pd_list);
-        INIT_LIST_HEAD(&file->ucontext->mr_list);
-        INIT_LIST_HEAD(&file->ucontext->mw_list);
-        INIT_LIST_HEAD(&file->ucontext->cq_list);
-        INIT_LIST_HEAD(&file->ucontext->qp_list);
-        INIT_LIST_HEAD(&file->ucontext->srq_list);
-        INIT_LIST_HEAD(&file->ucontext->ah_list);
-        spin_lock_init(&file->ucontext->lock);
+        ucontext->device = ibdev;
+        INIT_LIST_HEAD(&ucontext->pd_list);
+        INIT_LIST_HEAD(&ucontext->mr_list);
+        INIT_LIST_HEAD(&ucontext->mw_list);
+        INIT_LIST_HEAD(&ucontext->cq_list);
+        INIT_LIST_HEAD(&ucontext->qp_list);
+        INIT_LIST_HEAD(&ucontext->srq_list);
+        INIT_LIST_HEAD(&ucontext->ah_list);
 
         resp.async_fd = file->async_file.fd;
         for (i = 0; i < file->device->num_comp; ++i)
                 if (copy_to_user((void __user *) (unsigned long) cmd.cq_fd_tab +
                                  i * sizeof (__u32),
-                                 &file->comp_file[i].fd, sizeof (__u32)))
-                        goto err;
+                                 &file->comp_file[i].fd, sizeof (__u32))) {
+                        ret = -EFAULT;
+                        goto err_free;
+                }
 
         if (copy_to_user((void __user *) (unsigned long) cmd.response,
-                         &resp, sizeof resp))
-                goto err;
+                         &resp, sizeof resp)) {
+                ret = -EFAULT;
+                goto err_free;
+        }
+
+        file->ucontext = ucontext;
+        up(&file->mutex);
 
         return in_len;
 
-err:
-        ibdev->dealloc_ucontext(file->ucontext);
-        file->ucontext = NULL;
+err_free:
+        ibdev->dealloc_ucontext(ucontext);
 
-        return -EFAULT;
+err:
+        up(&file->mutex);
+        return ret;
 }
 
 ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
@@ -352,9 +364,9 @@ retry:
         if (ret)
                 goto err_pd;
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_add_tail(&uobj->list, &file->ucontext->pd_list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         memset(&resp, 0, sizeof resp);
         resp.pd_handle = uobj->id;
@@ -368,9 +380,9 @@ retry:
         return in_len;
 
 err_list:
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         down(&ib_uverbs_idr_mutex);
         idr_remove(&ib_uverbs_pd_idr, uobj->id);
@@ -410,9 +422,9 @@ ssize_t ib_uverbs_dealloc_pd(struct ib_uverbs_file *file,
 
         idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         kfree(uobj);
 
@@ -512,9 +524,9 @@ retry:
 
         resp.mr_handle = obj->uobject.id;
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_add_tail(&obj->uobject.list, &file->ucontext->mr_list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         if (copy_to_user((void __user *) (unsigned long) cmd.response,
                          &resp, sizeof resp)) {
@@ -527,9 +539,9 @@ retry:
         return in_len;
 
 err_list:
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&obj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
 err_unreg:
         ib_dereg_mr(mr);
@@ -570,9 +582,9 @@ ssize_t ib_uverbs_dereg_mr(struct ib_uverbs_file *file,
 
         idr_remove(&ib_uverbs_mr_idr, cmd.mr_handle);
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&memobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         ib_umem_release(file->device->ib_dev, &memobj->umem);
         kfree(memobj);
@@ -647,9 +659,9 @@ retry:
         if (ret)
                 goto err_cq;
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_add_tail(&uobj->uobject.list, &file->ucontext->cq_list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         memset(&resp, 0, sizeof resp);
         resp.cq_handle = uobj->uobject.id;
@@ -664,9 +676,9 @@ retry:
         return in_len;
 
 err_list:
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         down(&ib_uverbs_idr_mutex);
         idr_remove(&ib_uverbs_cq_idr, uobj->uobject.id);
@@ -712,9 +724,9 @@ ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
 
         idr_remove(&ib_uverbs_cq_idr, cmd.cq_handle);
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         spin_lock_irq(&file->comp_file[0].lock);
         list_for_each_entry_safe(evt, tmp, &uobj->comp_list, obj_list) {
@@ -847,9 +859,9 @@ retry:
 
         resp.qp_handle = uobj->uobject.id;
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_add_tail(&uobj->uobject.list, &file->ucontext->qp_list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         if (copy_to_user((void __user *) (unsigned long) cmd.response,
                          &resp, sizeof resp)) {
@@ -862,9 +874,9 @@ retry:
         return in_len;
 
 err_list:
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
 err_destroy:
         ib_destroy_qp(qp);
@@ -989,9 +1001,9 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
 
         idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         spin_lock_irq(&file->async_file.lock);
         list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
@@ -1136,9 +1148,9 @@ retry:
 
         resp.srq_handle = uobj->uobject.id;
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_add_tail(&uobj->uobject.list, &file->ucontext->srq_list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         if (copy_to_user((void __user *) (unsigned long) cmd.response,
                          &resp, sizeof resp)) {
@@ -1151,9 +1163,9 @@ retry:
         return in_len;
 
 err_list:
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
 err_destroy:
         ib_destroy_srq(srq);
@@ -1227,9 +1239,9 @@ ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
 
         idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
 
-        spin_lock_irq(&file->ucontext->lock);
+        down(&file->mutex);
         list_del(&uobj->uobject.list);
-        spin_unlock_irq(&file->ucontext->lock);
+        up(&file->mutex);
 
         spin_lock_irq(&file->async_file.lock);
         list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index ce5bdb7af306..12511808de21 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -448,7 +448,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
         if (hdr.in_words * 4 != count)
                 return -EINVAL;
 
-        if (hdr.command < 0 || hdr.command >= ARRAY_SIZE(uverbs_cmd_table))
+        if (hdr.command < 0                             ||
+            hdr.command >= ARRAY_SIZE(uverbs_cmd_table) ||
+            !uverbs_cmd_table[hdr.command])
                 return -EINVAL;
 
         if (!file->ucontext                               &&
@@ -484,27 +486,29 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
         file = kmalloc(sizeof *file +
                        (dev->num_comp - 1) * sizeof (struct ib_uverbs_event_file),
                        GFP_KERNEL);
-        if (!file)
-                return -ENOMEM;
+        if (!file) {
+                ret = -ENOMEM;
+                goto err;
+        }
 
         file->device = dev;
         kref_init(&file->ref);
+        init_MUTEX(&file->mutex);
 
         file->ucontext = NULL;
 
+        kref_get(&file->ref);
         ret = ib_uverbs_event_init(&file->async_file, file);
         if (ret)
-                goto err;
+                goto err_kref;
 
         file->async_file.is_async = 1;
 
-        kref_get(&file->ref);
-
         for (i = 0; i < dev->num_comp; ++i) {
+                kref_get(&file->ref);
                 ret = ib_uverbs_event_init(&file->comp_file[i], file);
                 if (ret)
                         goto err_async;
-                kref_get(&file->ref);
                 file->comp_file[i].is_async = 0;
         }
 
@@ -524,9 +528,16 @@ err_async:
 
         ib_uverbs_event_release(&file->async_file);
 
-err:
+err_kref:
+        /*
+         * One extra kref_put() because we took a reference before the
+         * event file creation that failed and got us here.
+         */
+        kref_put(&file->ref, ib_uverbs_release_file);
         kref_put(&file->ref, ib_uverbs_release_file);
 
+err:
+        module_put(dev->ib_dev->owner);
         return ret;
 }
 
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index cc758a2d2bc6..f6a8ac026557 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -605,7 +605,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm,
                         err = -EINVAL;
                         goto out;
                 }
-                for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i, ++nent) {
+                for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i) {
                         if (virt != -1) {
                                 pages[nent * 2] = cpu_to_be64(virt);
                                 virt += 1 << lg;
@@ -616,7 +616,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm,
                         ts += 1 << (lg - 10);
                         ++tc;
 
-                        if (nent == MTHCA_MAILBOX_SIZE / 16) {
+                        if (++nent == MTHCA_MAILBOX_SIZE / 16) {
                                 err = mthca_cmd(dev, mailbox->dma, nent, 0, op,
                                                 CMD_TIME_CLASS_B, status);
                                 if (err || *status)
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 18f0981eb0c1..c81fa8e975ef 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -476,12 +476,8 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         int i;
         u8 status;
 
-        /* Make sure EQ size is aligned to a power of 2 size. */
-        for (i = 1; i < nent; i <<= 1)
-                ; /* nothing */
-        nent = i;
-
-        eq->dev = dev;
+        eq->dev  = dev;
+        eq->nent = roundup_pow_of_two(max(nent, 2));
 
         eq->page_list = kmalloc(npages * sizeof *eq->page_list,
                                 GFP_KERNEL);
@@ -512,7 +508,7 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
                 memset(eq->page_list[i].buf, 0, PAGE_SIZE);
         }
 
-        for (i = 0; i < nent; ++i)
+        for (i = 0; i < eq->nent; ++i)
                 set_eqe_hw(get_eqe(eq, i));
 
         eq->eqn = mthca_alloc(&dev->eq_table.alloc);
@@ -528,8 +524,6 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         if (err)
                 goto err_out_free_eq;
 
-        eq->nent = nent;
-
         memset(eq_context, 0, sizeof *eq_context);
         eq_context->flags           = cpu_to_be32(MTHCA_EQ_STATUS_OK   |
                                                   MTHCA_EQ_OWNER_HW    |
@@ -538,7 +532,7 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         if (mthca_is_memfree(dev))
                 eq_context->flags  |= cpu_to_be32(MTHCA_EQ_STATE_ARBEL);
 
-        eq_context->logsize_usrpage = cpu_to_be32((ffs(nent) - 1) << 24);
+        eq_context->logsize_usrpage = cpu_to_be32((ffs(eq->nent) - 1) << 24);
         if (mthca_is_memfree(dev)) {
                 eq_context->arbel_pd = cpu_to_be32(dev->driver_pd.pd_num);
         } else {
@@ -569,7 +563,7 @@ static int __devinit mthca_create_eq(struct mthca_dev *dev,
         dev->eq_table.arm_mask |= eq->eqn_mask;
 
         mthca_dbg(dev, "Allocated EQ %d with %d entries\n",
-                  eq->eqn, nent);
+                  eq->eqn, eq->nent);
 
         return err;
 
@@ -842,7 +836,7 @@ int __devinit mthca_init_eq_table(struct mthca_dev *dev)
                 dev->eq_table.clr_mask =
                         swab32(1 << (dev->eq_table.inta_pin & 31));
                 dev->eq_table.clr_int  = dev->clr_base +
-                        (dev->eq_table.inta_pin < 31 ? 4 : 0);
+                        (dev->eq_table.inta_pin < 32 ? 4 : 0);
         }
 
         dev->eq_table.arm_mask = 0;
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 1827400f189b..7bd7a4bec7b4 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -290,7 +290,7 @@ struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev,
         int i;
         u8 status;
 
-        num_icm = obj_size * nobj / MTHCA_TABLE_CHUNK_SIZE;
+        num_icm = (obj_size * nobj + MTHCA_TABLE_CHUNK_SIZE - 1) / MTHCA_TABLE_CHUNK_SIZE;
 
         table = kmalloc(sizeof *table + num_icm * sizeof *table->icm, GFP_KERNEL);
         if (!table)
@@ -529,12 +529,25 @@ int mthca_alloc_db(struct mthca_dev *dev, int type, u32 qn, __be32 **db)
                         goto found;
                 }
 
+        for (i = start; i != end; i += dir)
+                if (!dev->db_tab->page[i].db_rec) {
+                        page = dev->db_tab->page + i;
+                        goto alloc;
+                }
+
         if (dev->db_tab->max_group1 >= dev->db_tab->min_group2 - 1) {
                 ret = -ENOMEM;
                 goto out;
         }
 
+        if (group == 0)
+                ++dev->db_tab->max_group1;
+        else
+                --dev->db_tab->min_group2;
+
         page = dev->db_tab->page + end;
+
+alloc:
         page->db_rec = dma_alloc_coherent(&dev->pdev->dev, 4096,
                                           &page->mapping, GFP_KERNEL);
         if (!page->db_rec) {
@@ -554,10 +567,6 @@ int mthca_alloc_db(struct mthca_dev *dev, int type, u32 qn, __be32 **db)
         }
 
         bitmap_zero(page->used, MTHCA_DB_REC_PER_PAGE);
-        if (group == 0)
-                ++dev->db_tab->max_group1;
-        else
-                --dev->db_tab->min_group2;
 
 found:
         j = find_first_zero_bit(page->used, MTHCA_DB_REC_PER_PAGE);
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 1c1c2e230871..3f5319a46577 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -84,7 +84,7 @@ static int mthca_query_device(struct ib_device *ibdev,
         props->vendor_id           = be32_to_cpup((__be32 *) (out_mad->data + 36)) &
                 0xffffff;
         props->vendor_part_id      = be16_to_cpup((__be16 *) (out_mad->data + 30));
-        props->hw_ver              = be16_to_cpup((__be16 *) (out_mad->data + 32));
+        props->hw_ver              = be32_to_cpup((__be32 *) (out_mad->data + 32));
         memcpy(&props->sys_image_guid, out_mad->data +  4, 8);
         memcpy(&props->node_guid,      out_mad->data + 12, 8);
 
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index bcef06bf15e7..5fa00669f9b8 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -227,7 +227,6 @@ static void mthca_wq_init(struct mthca_wq *wq)
         wq->last_comp = wq->max - 1;
         wq->head      = 0;
         wq->tail      = 0;
-        wq->last      = NULL;
 }
 
 void mthca_qp_event(struct mthca_dev *dev, u32 qpn,
@@ -687,7 +686,7 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
         }
 
         if (attr_mask & IB_QP_TIMEOUT) {
-                qp_context->pri_path.ackto = attr->timeout;
+                qp_context->pri_path.ackto = attr->timeout << 3;
                 qp_param->opt_param_mask |= cpu_to_be32(MTHCA_QP_OPTPAR_ACK_TIMEOUT);
         }
 
@@ -1103,6 +1102,9 @@ static int mthca_alloc_qp_common(struct mthca_dev *dev,
                 }
         }
 
+        qp->sq.last = get_send_wqe(qp, qp->sq.max - 1);
+        qp->rq.last = get_recv_wqe(qp, qp->rq.max - 1);
+
         return 0;
 }
 
@@ -1583,15 +1585,13 @@ int mthca_tavor_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
-                if (prev_wqe) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32(((ind << qp->sq.wqe_shift) +
-                                             qp->send_wqe_offset) |
-                                            mthca_opcode[wr->opcode]);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32((size0 ? 0 : MTHCA_NEXT_DBD) | size);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32(((ind << qp->sq.wqe_shift) +
+                                     qp->send_wqe_offset) |
+                                    mthca_opcode[wr->opcode]);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32((size0 ? 0 : MTHCA_NEXT_DBD) | size);
 
                 if (!size0) {
                         size0 = size;
@@ -1688,13 +1688,11 @@ int mthca_tavor_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 
                 qp->wrid[ind] = wr->wr_id;
 
-                if (likely(prev_wqe)) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32((ind << qp->rq.wqe_shift) | 1);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32(MTHCA_NEXT_DBD | size);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32((ind << qp->rq.wqe_shift) | 1);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32(MTHCA_NEXT_DBD | size);
 
                 if (!size0)
                         size0 = size;
@@ -1905,15 +1903,13 @@ int mthca_arbel_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
-                if (likely(prev_wqe)) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32(((ind << qp->sq.wqe_shift) +
-                                             qp->send_wqe_offset) |
-                                            mthca_opcode[wr->opcode]);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32(MTHCA_NEXT_DBD | size);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32(((ind << qp->sq.wqe_shift) +
+                                     qp->send_wqe_offset) |
+                                    mthca_opcode[wr->opcode]);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32(MTHCA_NEXT_DBD | size);
 
                 if (!size0) {
                         size0 = size;
@@ -2127,5 +2123,6 @@ void __devexit mthca_cleanup_qp_table(struct mthca_dev *dev)
         for (i = 0; i < 2; ++i)
                 mthca_CONF_SPECIAL_QP(dev, i, 0, &status);
 
+        mthca_array_cleanup(&dev->qp_table.qp, dev->limits.num_qps);
         mthca_alloc_cleanup(&dev->qp_table.alloc);
 }
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index 75cd2d84ef12..18998d48c53e 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -172,6 +172,8 @@ static int mthca_alloc_srq_buf(struct mthca_dev *dev, struct mthca_pd *pd,
                         scatter->lkey = cpu_to_be32(MTHCA_INVAL_LKEY);
         }
 
+        srq->last = get_wqe(srq, srq->max - 1);
+
         return 0;
 }
 
@@ -189,7 +191,6 @@ int mthca_alloc_srq(struct mthca_dev *dev, struct mthca_pd *pd,
 
         srq->max      = attr->max_wr;
         srq->max_gs   = attr->max_sge;
-        srq->last     = NULL;
         srq->counter  = 0;
 
         if (mthca_is_memfree(dev))
@@ -409,7 +410,7 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         mthca_err(dev, "SRQ %06x full\n", srq->srqn);
                         err = -ENOMEM;
                         *bad_wr = wr;
-                        return nreq;
+                        break;
                 }
 
                 wqe       = get_wqe(srq, ind);
@@ -427,7 +428,7 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         err = -EINVAL;
                         *bad_wr = wr;
                         srq->last = prev_wqe;
-                        return nreq;
+                        break;
                 }
 
                 for (i = 0; i < wr->num_sge; ++i) {
@@ -446,20 +447,16 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         ((struct mthca_data_seg *) wqe)->addr = 0;
                 }
 
-                if (likely(prev_wqe)) {
-                        ((struct mthca_next_seg *) prev_wqe)->nda_op =
-                                cpu_to_be32((ind << srq->wqe_shift) | 1);
-                        wmb();
-                        ((struct mthca_next_seg *) prev_wqe)->ee_nds =
-                                cpu_to_be32(MTHCA_NEXT_DBD);
-                }
+                ((struct mthca_next_seg *) prev_wqe)->nda_op =
+                        cpu_to_be32((ind << srq->wqe_shift) | 1);
+                wmb();
+                ((struct mthca_next_seg *) prev_wqe)->ee_nds =
+                        cpu_to_be32(MTHCA_NEXT_DBD);
 
                 srq->wrid[ind]  = wr->wr_id;
                 srq->first_free = next_ind;
         }
 
-        return nreq;
-
         if (likely(nreq)) {
                 __be32 doorbell[2];
 
@@ -503,7 +500,7 @@ int mthca_arbel_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                         mthca_err(dev, "SRQ %06x full\n", srq->srqn);
                         err = -ENOMEM;
                         *bad_wr = wr;
-                        return nreq;
+                        break;
                 }
 
                 wqe       = get_wqe(srq, ind);
@@ -519,7 +516,7 @@ int mthca_arbel_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                 if (unlikely(wr->num_sge > srq->max_gs)) {
                         err = -EINVAL;
                         *bad_wr = wr;
-                        return nreq;
+                        break;
                 }
 
                 for (i = 0; i < wr->num_sge; ++i) {
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index bea960b8191f..4ea1c1ca85bc 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -257,7 +257,7 @@ void ipoib_mcast_send(struct net_device *dev, union ib_gid *mgid,
 
 void ipoib_mcast_restart_task(void *dev_ptr);
 int ipoib_mcast_start_thread(struct net_device *dev);
-int ipoib_mcast_stop_thread(struct net_device *dev);
+int ipoib_mcast_stop_thread(struct net_device *dev, int flush);
 
 void ipoib_mcast_dev_down(struct net_device *dev);
 void ipoib_mcast_dev_flush(struct net_device *dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index ef0e3894863c..f7440096b5ed 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -432,7 +432,7 @@ int ipoib_ib_dev_down(struct net_device *dev)
                 flush_workqueue(ipoib_workqueue);
         }
 
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, 1);
 
         /*
          * Flush the multicast groups first so we stop any multicast joins. The
@@ -599,7 +599,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
 
         ipoib_dbg(priv, "cleaning up ib_dev\n");
 
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, 1);
 
         /* Delete the broadcast address and the local address */
         ipoib_mcast_dev_down(dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 49d120d2b92c..704f48e0b6a7 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1005,6 +1005,7 @@ debug_failed:
 
 register_failed:
         ib_unregister_event_handler(&priv->event_handler);
+        flush_scheduled_work();
 
 event_failed:
         ipoib_dev_cleanup(priv->dev);
@@ -1057,6 +1058,7 @@ static void ipoib_remove_one(struct ib_device *device)
 
         list_for_each_entry_safe(priv, tmp, dev_list, list) {
                 ib_unregister_event_handler(&priv->event_handler);
+                flush_scheduled_work();
 
                 unregister_netdev(priv->dev);
                 ipoib_dev_cleanup(priv->dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index aca7aea18a69..36ce29836bf2 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -145,7 +145,7 @@ static struct ipoib_mcast *ipoib_mcast_alloc(struct net_device *dev,
 
         mcast->dev = dev;
         mcast->created = jiffies;
-        mcast->backoff = HZ;
+        mcast->backoff = 1;
         mcast->logcount = 0;
 
         INIT_LIST_HEAD(&mcast->list);
@@ -396,7 +396,7 @@ static void ipoib_mcast_join_complete(int status,
                         IPOIB_GID_ARG(mcast->mcmember.mgid), status);
 
         if (!status && !ipoib_mcast_join_finish(mcast, mcmember)) {
-                mcast->backoff = HZ;
+                mcast->backoff = 1;
                 down(&mcast_mutex);
                 if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
                         queue_work(ipoib_workqueue, &priv->mcast_task);
@@ -496,7 +496,7 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast,
                 if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
                         queue_delayed_work(ipoib_workqueue,
                                            &priv->mcast_task,
-                                           mcast->backoff);
+                                           mcast->backoff * HZ);
                 up(&mcast_mutex);
         } else
                 mcast->query_id = ret;
@@ -598,7 +598,7 @@ int ipoib_mcast_start_thread(struct net_device *dev)
         return 0;
 }
 
-int ipoib_mcast_stop_thread(struct net_device *dev)
+int ipoib_mcast_stop_thread(struct net_device *dev, int flush)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ipoib_mcast *mcast;
@@ -610,7 +610,8 @@ int ipoib_mcast_stop_thread(struct net_device *dev)
         cancel_delayed_work(&priv->mcast_task);
         up(&mcast_mutex);
 
-        flush_workqueue(ipoib_workqueue);
+        if (flush)
+                flush_workqueue(ipoib_workqueue);
 
         if (priv->broadcast && priv->broadcast->query) {
                 ib_sa_cancel_query(priv->broadcast->query_id, priv->broadcast->query);
@@ -832,7 +833,7 @@ void ipoib_mcast_restart_task(void *dev_ptr)
 
         ipoib_dbg_mcast(priv, "restarting multicast task\n");
 
-        ipoib_mcast_stop_thread(dev);
+        ipoib_mcast_stop_thread(dev, 0);
 
         spin_lock_irqsave(&priv->lock, flags);
 
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 88636a204525..14ae5583e198 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -308,6 +308,7 @@ static struct input_device_id *input_match_device(struct input_device_id *id, st
                 MATCH_BIT(ledbit, LED_MAX);
                 MATCH_BIT(sndbit, SND_MAX);
                 MATCH_BIT(ffbit,  FF_MAX);
+                MATCH_BIT(swbit,  SW_MAX);
 
                 return id;
         }
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index e55dee390775..444f7756fee6 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -132,6 +132,17 @@ config KEYBOARD_CORGI
           To compile this driver as a module, choose M here: the 
           module will be called corgikbd.
 
+config KEYBOARD_SPITZ
+        tristate "Spitz keyboard"
+        depends on PXA_SHARPSL
+        default y
+        help
+          Say Y here to enable the keyboard on the Sharp Zaurus SL-C1000,
+          SL-C3000 and Sl-C3100 series of PDAs.
+
+          To compile this driver as a module, choose M here: the
+          module will be called spitzkbd.
+
 config KEYBOARD_MAPLE
         tristate "Maple bus keyboard"
         depends on SH_DREAMCAST && MAPLE
diff --git a/drivers/input/keyboard/Makefile b/drivers/input/keyboard/Makefile
index b02eeceea3c3..9ce0b87f2fac 100644
--- a/drivers/input/keyboard/Makefile
+++ b/drivers/input/keyboard/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_KEYBOARD_LOCOMO)		+= locomokbd.o
 obj-$(CONFIG_KEYBOARD_NEWTON)           += newtonkbd.o
 obj-$(CONFIG_KEYBOARD_98KBD)            += 98kbd.o
 obj-$(CONFIG_KEYBOARD_CORGI)            += corgikbd.o
+obj-$(CONFIG_KEYBOARD_SPITZ)            += spitzkbd.o
 obj-$(CONFIG_KEYBOARD_HIL)              += hil_kbd.o
 obj-$(CONFIG_KEYBOARD_HIL_OLD)          += hilkbd.o
 
diff --git a/drivers/input/keyboard/spitzkbd.c b/drivers/input/keyboard/spitzkbd.c
new file mode 100644
index 000000000000..1714045a182b
--- /dev/null
+++ b/drivers/input/keyboard/spitzkbd.c
@@ -0,0 +1,478 @@
+/*
+ *  Keyboard driver for Sharp Spitz, Borzoi and Akita (SL-Cxx00 series)
+ *
+ *  Copyright (c) 2005 Richard Purdie
+ *
+ *  Based on corgikbd.c
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/init.h>
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/jiffies.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <asm/irq.h>
+
+#include <asm/arch/spitz.h>
+#include <asm/arch/hardware.h>
+#include <asm/arch/pxa-regs.h>
+
+#define KB_ROWS                 7
+#define KB_COLS                 11
+#define KB_ROWMASK(r)           (1 << (r))
+#define SCANCODE(r,c)           (((r)<<4) + (c) + 1)
+#define NR_SCANCODES            ((KB_ROWS<<4) + 1)
+
+#define HINGE_SCAN_INTERVAL     (150) /* ms */
+
+#define SPITZ_KEY_CALENDER      KEY_F1
+#define SPITZ_KEY_ADDRESS       KEY_F2
+#define SPITZ_KEY_FN            KEY_F3
+#define SPITZ_KEY_CANCEL        KEY_F4
+#define SPITZ_KEY_EXOK          KEY_F5
+#define SPITZ_KEY_EXCANCEL      KEY_F6
+#define SPITZ_KEY_EXJOGDOWN     KEY_F7
+#define SPITZ_KEY_EXJOGUP       KEY_F8
+#define SPITZ_KEY_JAP1          KEY_LEFTALT
+#define SPITZ_KEY_JAP2          KEY_RIGHTCTRL
+#define SPITZ_KEY_SYNC          KEY_F9
+#define SPITZ_KEY_MAIL          KEY_F10
+#define SPITZ_KEY_OK            KEY_F11
+#define SPITZ_KEY_MENU          KEY_F12
+
+static unsigned char spitzkbd_keycode[NR_SCANCODES] = {
+        0,                                                                                                                /* 0 */
+        KEY_LEFTCTRL, KEY_1, KEY_3, KEY_5, KEY_6, KEY_7, KEY_9, KEY_0, KEY_BACKSPACE, SPITZ_KEY_EXOK, SPITZ_KEY_EXCANCEL, 0, 0, 0, 0, 0,  /* 1-16 */
+        0, KEY_2, KEY_4, KEY_R, KEY_Y, KEY_8, KEY_I, KEY_O, KEY_P, SPITZ_KEY_EXJOGDOWN, SPITZ_KEY_EXJOGUP, 0, 0, 0, 0, 0, /* 17-32 */
+        KEY_TAB, KEY_Q, KEY_E, KEY_T, KEY_G, KEY_U, KEY_J, KEY_K, 0, 0, 0, 0, 0, 0, 0, 0,                                 /* 33-48 */
+        SPITZ_KEY_CALENDER, KEY_W, KEY_S, KEY_F, KEY_V, KEY_H, KEY_M, KEY_L, 0, 0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0,         /* 49-64 */
+        SPITZ_KEY_ADDRESS, KEY_A, KEY_D, KEY_C, KEY_B, KEY_N, KEY_DOT, 0, KEY_ENTER, KEY_LEFTSHIFT, 0, 0, 0, 0, 0, 0,     /* 65-80 */
+        SPITZ_KEY_MAIL, KEY_Z, KEY_X, KEY_MINUS, KEY_SPACE, KEY_COMMA, 0, KEY_UP, 0, 0, SPITZ_KEY_FN, 0, 0, 0, 0, 0,      /* 81-96 */
+        KEY_SYSRQ, SPITZ_KEY_JAP1, SPITZ_KEY_JAP2, SPITZ_KEY_CANCEL, SPITZ_KEY_OK, SPITZ_KEY_MENU, KEY_LEFT, KEY_DOWN, KEY_RIGHT, 0, 0, 0, 0, 0, 0, 0  /* 97-112 */
+};
+
+static int spitz_strobes[] = {
+        SPITZ_GPIO_KEY_STROBE0,
+        SPITZ_GPIO_KEY_STROBE1,
+        SPITZ_GPIO_KEY_STROBE2,
+        SPITZ_GPIO_KEY_STROBE3,
+        SPITZ_GPIO_KEY_STROBE4,
+        SPITZ_GPIO_KEY_STROBE5,
+        SPITZ_GPIO_KEY_STROBE6,
+        SPITZ_GPIO_KEY_STROBE7,
+        SPITZ_GPIO_KEY_STROBE8,
+        SPITZ_GPIO_KEY_STROBE9,
+        SPITZ_GPIO_KEY_STROBE10,
+};
+
+static int spitz_senses[] = {
+        SPITZ_GPIO_KEY_SENSE0,
+        SPITZ_GPIO_KEY_SENSE1,
+        SPITZ_GPIO_KEY_SENSE2,
+        SPITZ_GPIO_KEY_SENSE3,
+        SPITZ_GPIO_KEY_SENSE4,
+        SPITZ_GPIO_KEY_SENSE5,
+        SPITZ_GPIO_KEY_SENSE6,
+};
+
+struct spitzkbd {
+        unsigned char keycode[ARRAY_SIZE(spitzkbd_keycode)];
+        struct input_dev input;
+        char phys[32];
+
+        spinlock_t lock;
+        struct timer_list timer;
+        struct timer_list htimer;
+
+        unsigned int suspended;
+        unsigned long suspend_jiffies;
+};
+
+#define KB_DISCHARGE_DELAY      10
+#define KB_ACTIVATE_DELAY       10
+
+/* Helper functions for reading the keyboard matrix
+ * Note: We should really be using pxa_gpio_mode to alter GPDR but it
+ *       requires a function call per GPIO bit which is excessive
+ *       when we need to access 11 bits at once, multiple times.
+ * These functions must be called within local_irq_save()/local_irq_restore()
+ * or similar.
+ */
+static inline void spitzkbd_discharge_all(void)
+{
+        /* STROBE All HiZ */
+        GPCR0  =  SPITZ_GPIO_G0_STROBE_BIT;
+        GPDR0 &= ~SPITZ_GPIO_G0_STROBE_BIT;
+        GPCR1  =  SPITZ_GPIO_G1_STROBE_BIT;
+        GPDR1 &= ~SPITZ_GPIO_G1_STROBE_BIT;
+        GPCR2  =  SPITZ_GPIO_G2_STROBE_BIT;
+        GPDR2 &= ~SPITZ_GPIO_G2_STROBE_BIT;
+        GPCR3  =  SPITZ_GPIO_G3_STROBE_BIT;
+        GPDR3 &= ~SPITZ_GPIO_G3_STROBE_BIT;
+}
+
+static inline void spitzkbd_activate_all(void)
+{
+        /* STROBE ALL -> High */
+        GPSR0  =  SPITZ_GPIO_G0_STROBE_BIT;
+        GPDR0 |=  SPITZ_GPIO_G0_STROBE_BIT;
+        GPSR1  =  SPITZ_GPIO_G1_STROBE_BIT;
+        GPDR1 |=  SPITZ_GPIO_G1_STROBE_BIT;
+        GPSR2  =  SPITZ_GPIO_G2_STROBE_BIT;
+        GPDR2 |=  SPITZ_GPIO_G2_STROBE_BIT;
+        GPSR3  =  SPITZ_GPIO_G3_STROBE_BIT;
+        GPDR3 |=  SPITZ_GPIO_G3_STROBE_BIT;
+
+        udelay(KB_DISCHARGE_DELAY);
+
+        /* Clear any interrupts we may have triggered when altering the GPIO lines */
+        GEDR0 = SPITZ_GPIO_G0_SENSE_BIT;
+        GEDR1 = SPITZ_GPIO_G1_SENSE_BIT;
+        GEDR2 = SPITZ_GPIO_G2_SENSE_BIT;
+        GEDR3 = SPITZ_GPIO_G3_SENSE_BIT;
+}
+
+static inline void spitzkbd_activate_col(int col)
+{
+        int gpio = spitz_strobes[col];
+        GPDR0 &= ~SPITZ_GPIO_G0_STROBE_BIT;
+        GPDR1 &= ~SPITZ_GPIO_G1_STROBE_BIT;
+        GPDR2 &= ~SPITZ_GPIO_G2_STROBE_BIT;
+        GPDR3 &= ~SPITZ_GPIO_G3_STROBE_BIT;
+        GPSR(gpio) = GPIO_bit(gpio);
+        GPDR(gpio) |= GPIO_bit(gpio);
+}
+
+static inline void spitzkbd_reset_col(int col)
+{
+        int gpio = spitz_strobes[col];
+        GPDR0 &= ~SPITZ_GPIO_G0_STROBE_BIT;
+        GPDR1 &= ~SPITZ_GPIO_G1_STROBE_BIT;
+        GPDR2 &= ~SPITZ_GPIO_G2_STROBE_BIT;
+        GPDR3 &= ~SPITZ_GPIO_G3_STROBE_BIT;
+        GPCR(gpio) = GPIO_bit(gpio);
+        GPDR(gpio) |= GPIO_bit(gpio);
+}
+
+static inline int spitzkbd_get_row_status(int col)
+{
+        return ((GPLR0 >> 12) & 0x01) | ((GPLR0 >> 16) & 0x02)
+                | ((GPLR2 >> 25) & 0x04) | ((GPLR1 << 1) & 0x08)
+                | ((GPLR1 >> 0) & 0x10) | ((GPLR1 >> 1) & 0x60);
+}
+
+/*
+ * The spitz keyboard only generates interrupts when a key is pressed.
+ * When a key is pressed, we enable a timer which then scans the
+ * keyboard to detect when the key is released.
+ */
+
+/* Scan the hardware keyboard and push any changes up through the input layer */
+static void spitzkbd_scankeyboard(struct spitzkbd *spitzkbd_data, struct pt_regs *regs)
+{
+        unsigned int row, col, rowd;
+        unsigned long flags;
+        unsigned int num_pressed, pwrkey = ((GPLR(SPITZ_GPIO_ON_KEY) & GPIO_bit(SPITZ_GPIO_ON_KEY)) != 0);
+
+        if (spitzkbd_data->suspended)
+                return;
+
+        spin_lock_irqsave(&spitzkbd_data->lock, flags);
+
+        if (regs)
+                input_regs(&spitzkbd_data->input, regs);
+
+        num_pressed = 0;
+        for (col = 0; col < KB_COLS; col++) {
+                /*
+                 * Discharge the output driver capacitatance
+                 * in the keyboard matrix. (Yes it is significant..)
+                 */
+
+                spitzkbd_discharge_all();
+                udelay(KB_DISCHARGE_DELAY);
+
+                spitzkbd_activate_col(col);
+                udelay(KB_ACTIVATE_DELAY);
+
+                rowd = spitzkbd_get_row_status(col);
+                for (row = 0; row < KB_ROWS; row++) {
+                        unsigned int scancode, pressed;
+
+                        scancode = SCANCODE(row, col);
+                        pressed = rowd & KB_ROWMASK(row);
+
+                        input_report_key(&spitzkbd_data->input, spitzkbd_data->keycode[scancode], pressed);
+
+                        if (pressed)
+                                num_pressed++;
+                }
+                spitzkbd_reset_col(col);
+        }
+
+        spitzkbd_activate_all();
+
+        input_report_key(&spitzkbd_data->input, SPITZ_KEY_SYNC, (GPLR(SPITZ_GPIO_SYNC) & GPIO_bit(SPITZ_GPIO_SYNC)) != 0 );
+        input_report_key(&spitzkbd_data->input, KEY_SUSPEND, pwrkey);
+
+        if (pwrkey && time_after(jiffies, spitzkbd_data->suspend_jiffies + msecs_to_jiffies(1000))) {
+                input_event(&spitzkbd_data->input, EV_PWR, KEY_SUSPEND, 1);
+                spitzkbd_data->suspend_jiffies = jiffies;
+        }
+
+        input_sync(&spitzkbd_data->input);
+
+        /* if any keys are pressed, enable the timer */
+        if (num_pressed)
+                mod_timer(&spitzkbd_data->timer, jiffies + msecs_to_jiffies(100));
+
+        spin_unlock_irqrestore(&spitzkbd_data->lock, flags);
+}
+
+/*
+ * spitz keyboard interrupt handler.
+ */
+static irqreturn_t spitzkbd_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct spitzkbd *spitzkbd_data = dev_id;
+
+        if (!timer_pending(&spitzkbd_data->timer)) {
+                /** wait chattering delay **/
+                udelay(20);
+                spitzkbd_scankeyboard(spitzkbd_data, regs);
+        }
+
+        return IRQ_HANDLED;
+}
+
+/*
+ * spitz timer checking for released keys
+ */
+static void spitzkbd_timer_callback(unsigned long data)
+{
+        struct spitzkbd *spitzkbd_data = (struct spitzkbd *) data;
+        spitzkbd_scankeyboard(spitzkbd_data, NULL);
+}
+
+/*
+ * The hinge switches generate an interrupt.
+ * We debounce the switches and pass them to the input system.
+ */
+
+static irqreturn_t spitzkbd_hinge_isr(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct spitzkbd *spitzkbd_data = dev_id;
+
+        if (!timer_pending(&spitzkbd_data->htimer))
+                mod_timer(&spitzkbd_data->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
+
+        return IRQ_HANDLED;
+}
+
+#define HINGE_STABLE_COUNT 2
+static int sharpsl_hinge_state;
+static int hinge_count;
+
+static void spitzkbd_hinge_timer(unsigned long data)
+{
+        struct spitzkbd *spitzkbd_data = (struct spitzkbd *) data;
+        unsigned long state;
+        unsigned long flags;
+
+        state = GPLR(SPITZ_GPIO_SWA) & (GPIO_bit(SPITZ_GPIO_SWA)|GPIO_bit(SPITZ_GPIO_SWB));
+        if (state != sharpsl_hinge_state) {
+                hinge_count = 0;
+                sharpsl_hinge_state = state;
+        } else if (hinge_count < HINGE_STABLE_COUNT) {
+                hinge_count++;
+        }
+
+        if (hinge_count >= HINGE_STABLE_COUNT) {
+                spin_lock_irqsave(&spitzkbd_data->lock, flags);
+
+                input_report_switch(&spitzkbd_data->input, SW_0, ((GPLR(SPITZ_GPIO_SWA) & GPIO_bit(SPITZ_GPIO_SWA)) != 0));
+                input_report_switch(&spitzkbd_data->input, SW_1, ((GPLR(SPITZ_GPIO_SWB) & GPIO_bit(SPITZ_GPIO_SWB)) != 0));
+                input_sync(&spitzkbd_data->input);
+
+                spin_unlock_irqrestore(&spitzkbd_data->lock, flags);
+        } else {
+                mod_timer(&spitzkbd_data->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
+        }
+}
+
+#ifdef CONFIG_PM
+static int spitzkbd_suspend(struct device *dev, pm_message_t state, uint32_t level)
+{
+        if (level == SUSPEND_POWER_DOWN) {
+                int i;
+                struct spitzkbd *spitzkbd = dev_get_drvdata(dev);
+                spitzkbd->suspended = 1;
+
+                /* Set Strobe lines as inputs - *except* strobe line 0 leave this
+                   enabled so we can detect a power button press for resume */
+                for (i = 1; i < SPITZ_KEY_STROBE_NUM; i++)
+                        pxa_gpio_mode(spitz_strobes[i] | GPIO_IN);
+        }
+        return 0;
+}
+
+static int spitzkbd_resume(struct device *dev, uint32_t level)
+{
+        if (level == RESUME_POWER_ON) {
+                int i;
+                struct spitzkbd *spitzkbd = dev_get_drvdata(dev);
+
+                for (i = 0; i < SPITZ_KEY_STROBE_NUM; i++)
+                        pxa_gpio_mode(spitz_strobes[i] | GPIO_OUT | GPIO_DFLT_HIGH);
+
+                /* Upon resume, ignore the suspend key for a short while */
+                spitzkbd->suspend_jiffies = jiffies;
+                spitzkbd->suspended = 0;
+        }
+        return 0;
+}
+#else
+#define spitzkbd_suspend        NULL
+#define spitzkbd_resume         NULL
+#endif
+
+static int __init spitzkbd_probe(struct device *dev)
+{
+        int i;
+        struct spitzkbd *spitzkbd;
+
+        spitzkbd = kzalloc(sizeof(struct spitzkbd), GFP_KERNEL);
+        if (!spitzkbd)
+                return -ENOMEM;
+
+        dev_set_drvdata(dev,spitzkbd);
+        strcpy(spitzkbd->phys, "spitzkbd/input0");
+
+        spin_lock_init(&spitzkbd->lock);
+
+        /* Init Keyboard rescan timer */
+        init_timer(&spitzkbd->timer);
+        spitzkbd->timer.function = spitzkbd_timer_callback;
+        spitzkbd->timer.data = (unsigned long) spitzkbd;
+
+        /* Init Hinge Timer */
+        init_timer(&spitzkbd->htimer);
+        spitzkbd->htimer.function = spitzkbd_hinge_timer;
+        spitzkbd->htimer.data = (unsigned long) spitzkbd;
+
+        spitzkbd->suspend_jiffies=jiffies;
+
+        init_input_dev(&spitzkbd->input);
+        spitzkbd->input.private = spitzkbd;
+        spitzkbd->input.name = "Spitz Keyboard";
+        spitzkbd->input.dev = dev;
+        spitzkbd->input.phys = spitzkbd->phys;
+        spitzkbd->input.id.bustype = BUS_HOST;
+        spitzkbd->input.id.vendor = 0x0001;
+        spitzkbd->input.id.product = 0x0001;
+        spitzkbd->input.id.version = 0x0100;
+        spitzkbd->input.evbit[0] = BIT(EV_KEY) | BIT(EV_REP) | BIT(EV_PWR) | BIT(EV_SW);
+        spitzkbd->input.keycode = spitzkbd->keycode;
+        spitzkbd->input.keycodesize = sizeof(unsigned char);
+        spitzkbd->input.keycodemax = ARRAY_SIZE(spitzkbd_keycode);
+
+        memcpy(spitzkbd->keycode, spitzkbd_keycode, sizeof(spitzkbd->keycode));
+        for (i = 0; i < ARRAY_SIZE(spitzkbd_keycode); i++)
+                set_bit(spitzkbd->keycode[i], spitzkbd->input.keybit);
+        clear_bit(0, spitzkbd->input.keybit);
+        set_bit(SW_0, spitzkbd->input.swbit);
+        set_bit(SW_1, spitzkbd->input.swbit);
+
+        input_register_device(&spitzkbd->input);
+        mod_timer(&spitzkbd->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
+
+        /* Setup sense interrupts - RisingEdge Detect, sense lines as inputs */
+        for (i = 0; i < SPITZ_KEY_SENSE_NUM; i++) {
+                pxa_gpio_mode(spitz_senses[i] | GPIO_IN);
+                if (request_irq(IRQ_GPIO(spitz_senses[i]), spitzkbd_interrupt,
+                                                SA_INTERRUPT, "Spitzkbd Sense", spitzkbd))
+                        printk(KERN_WARNING "spitzkbd: Can't get Sense IRQ: %d!\n", i);
+                else
+                        set_irq_type(IRQ_GPIO(spitz_senses[i]),IRQT_RISING);
+        }
+
+        /* Set Strobe lines as outputs - set high */
+        for (i = 0; i < SPITZ_KEY_STROBE_NUM; i++)
+                pxa_gpio_mode(spitz_strobes[i] | GPIO_OUT | GPIO_DFLT_HIGH);
+
+        pxa_gpio_mode(SPITZ_GPIO_SYNC | GPIO_IN);
+        pxa_gpio_mode(SPITZ_GPIO_ON_KEY | GPIO_IN);
+        pxa_gpio_mode(SPITZ_GPIO_SWA | GPIO_IN);
+        pxa_gpio_mode(SPITZ_GPIO_SWB | GPIO_IN);
+
+        request_irq(SPITZ_IRQ_GPIO_SYNC, spitzkbd_interrupt, SA_INTERRUPT, "Spitzkbd Sync", spitzkbd);
+        request_irq(SPITZ_IRQ_GPIO_ON_KEY, spitzkbd_interrupt, SA_INTERRUPT, "Spitzkbd PwrOn", spitzkbd);
+        request_irq(SPITZ_IRQ_GPIO_SWA, spitzkbd_hinge_isr, SA_INTERRUPT, "Spitzkbd SWA", spitzkbd);
+        request_irq(SPITZ_IRQ_GPIO_SWB, spitzkbd_hinge_isr, SA_INTERRUPT, "Spitzkbd SWB", spitzkbd);
+
+        set_irq_type(SPITZ_IRQ_GPIO_SYNC, IRQT_BOTHEDGE);
+        set_irq_type(SPITZ_IRQ_GPIO_ON_KEY, IRQT_BOTHEDGE);
+        set_irq_type(SPITZ_IRQ_GPIO_SWA, IRQT_BOTHEDGE);
+        set_irq_type(SPITZ_IRQ_GPIO_SWB, IRQT_BOTHEDGE);
+
+        printk(KERN_INFO "input: Spitz Keyboard Registered\n");
+
+        return 0;
+}
+
+static int spitzkbd_remove(struct device *dev)
+{
+        int i;
+        struct spitzkbd *spitzkbd = dev_get_drvdata(dev);
+
+        for (i = 0; i < SPITZ_KEY_SENSE_NUM; i++)
+                free_irq(IRQ_GPIO(spitz_senses[i]), spitzkbd);
+
+        free_irq(SPITZ_IRQ_GPIO_SYNC, spitzkbd);
+        free_irq(SPITZ_IRQ_GPIO_ON_KEY, spitzkbd);
+        free_irq(SPITZ_IRQ_GPIO_SWA, spitzkbd);
+        free_irq(SPITZ_IRQ_GPIO_SWB, spitzkbd);
+
+        del_timer_sync(&spitzkbd->htimer);
+        del_timer_sync(&spitzkbd->timer);
+
+        input_unregister_device(&spitzkbd->input);
+
+        kfree(spitzkbd);
+
+        return 0;
+}
+
+static struct device_driver spitzkbd_driver = {
+        .name           = "spitz-keyboard",
+        .bus            = &platform_bus_type,
+        .probe          = spitzkbd_probe,
+        .remove         = spitzkbd_remove,
+        .suspend        = spitzkbd_suspend,
+        .resume         = spitzkbd_resume,
+};
+
+static int __devinit spitzkbd_init(void)
+{
+        return driver_register(&spitzkbd_driver);
+}
+
+static void __exit spitzkbd_exit(void)
+{
+        driver_unregister(&spitzkbd_driver);
+}
+
+module_init(spitzkbd_init);
+module_exit(spitzkbd_exit);
+
+MODULE_AUTHOR("Richard Purdie <rpurdie@rpsys.net>");
+MODULE_DESCRIPTION("Spitz Keyboard Driver");
+MODULE_LICENSE("GPLv2");
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 0489af5a80c9..21d55ed4b88a 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -24,17 +24,17 @@ config TOUCHSCREEN_BITSY
           module will be called h3600_ts_input.
 
 config TOUCHSCREEN_CORGI
-        tristate "Corgi touchscreen (for Sharp SL-C7xx)"
+        tristate "SharpSL (Corgi and Spitz series) touchscreen driver"
         depends on PXA_SHARPSL
         default y       
         help
           Say Y here to enable the driver for the touchscreen on the 
-          Sharp SL-C7xx series of PDAs.
+          Sharp SL-C7xx and SL-Cxx00 series of PDAs.
 
           If unsure, say N.
 
           To compile this driver as a module, choose M here: the
-          module will be called ads7846_ts.
+          module will be called corgi_ts.
 
 config TOUCHSCREEN_GUNZE
         tristate "Gunze AHL-51S touchscreen"
diff --git a/drivers/input/touchscreen/corgi_ts.c b/drivers/input/touchscreen/corgi_ts.c
index 5d19261b884f..4c7fbe550365 100644
--- a/drivers/input/touchscreen/corgi_ts.c
+++ b/drivers/input/touchscreen/corgi_ts.c
@@ -1,5 +1,5 @@
 /*
- *  Touchscreen driver for Sharp Corgi models (SL-C7xx)
+ *  Touchscreen driver for Sharp SL-C7xx and SL-Cxx00 models
  *
  *  Copyright (c) 2004-2005 Richard Purdie
  *
@@ -19,7 +19,7 @@
 #include <linux/slab.h>
 #include <asm/irq.h>
 
-#include <asm/arch/corgi.h>
+#include <asm/arch/sharpsl.h>
 #include <asm/arch/hardware.h>
 #include <asm/arch/pxa-regs.h>
 
@@ -47,15 +47,20 @@ struct corgi_ts {
         struct ts_event tc;
         int pendown;
         int power_mode;
+        int irq_gpio;
+        struct corgits_machinfo *machinfo;
 };
 
-#define STATUS_HSYNC            (GPLR(CORGI_GPIO_HSYNC) & GPIO_bit(CORGI_GPIO_HSYNC))
-
-#define SyncHS()        while((STATUS_HSYNC) == 0); while((STATUS_HSYNC) != 0);
+#ifdef CONFIG_PXA25x
 #define CCNT(a)         asm volatile ("mrc p14, 0, %0, C1, C0, 0" : "=r"(a))
 #define PMNC_GET(x)     asm volatile ("mrc p14, 0, %0, C0, C0, 0" : "=r"(x))
 #define PMNC_SET(x)     asm volatile ("mcr p14, 0, %0, C0, C0, 0" : : "r"(x))
-
+#endif
+#ifdef CONFIG_PXA27x
+#define CCNT(a)         asm volatile ("mrc p14, 0, %0, C1, C1, 0" : "=r"(a))
+#define PMNC_GET(x)     asm volatile ("mrc p14, 0, %0, C0, C1, 0" : "=r"(x))
+#define PMNC_SET(x)     asm volatile ("mcr p14, 0, %0, C0, C1, 0" : : "r"(x))
+#endif
 
 /* ADS7846 Touch Screen Controller bit definitions */
 #define ADSCTRL_PD0             (1u << 0)       /* PD0 */
@@ -66,12 +71,11 @@ struct corgi_ts {
 #define ADSCTRL_STS             (1u << 7)       /* Start Bit */
 
 /* External Functions */
-extern unsigned long w100fb_get_hsynclen(struct device *dev);
 extern unsigned int get_clk_frequency_khz(int info);
 
-static unsigned long calc_waittime(void)
+static unsigned long calc_waittime(struct corgi_ts *corgi_ts)
 {
-        unsigned long hsync_len = w100fb_get_hsynclen(&corgifb_device.dev);
+        unsigned long hsync_len = corgi_ts->machinfo->get_hsync_len();
 
         if (hsync_len)
                 return get_clk_frequency_khz(0)*1000/hsync_len;
@@ -79,7 +83,8 @@ static unsigned long calc_waittime(void)
                 return 0;
 }
 
-static int sync_receive_data_send_cmd(int doRecive, int doSend, unsigned int address, unsigned long wait_time)
+static int sync_receive_data_send_cmd(struct corgi_ts *corgi_ts, int doRecive, int doSend,
+                unsigned int address, unsigned long wait_time)
 {
         unsigned long timer1 = 0, timer2, pmnc = 0;
         int pos = 0;
@@ -90,7 +95,7 @@ static int sync_receive_data_send_cmd(int doRecive, int doSend, unsigned int add
                         PMNC_SET(0x01);
 
                 /* polling HSync */
-                SyncHS();
+                corgi_ts->machinfo->wait_hsync();
                 /* get CCNT */
                 CCNT(timer1);
         }
@@ -109,7 +114,7 @@ static int sync_receive_data_send_cmd(int doRecive, int doSend, unsigned int add
                         CCNT(timer2);
                         if (timer2-timer1 > wait_time) {
                                 /* too slow - timeout, try again */
-                                SyncHS();
+                                corgi_ts->machinfo->wait_hsync();
                                 /* get OSCR */
                                 CCNT(timer1);
                                 /* Wait after HSync */
@@ -133,23 +138,23 @@ static int read_xydata(struct corgi_ts *corgi_ts)
         /* critical section */
         local_irq_save(flags);
         corgi_ssp_ads7846_lock();
-        wait_time=calc_waittime();
+        wait_time = calc_waittime(corgi_ts);
 
         /* Y-axis */
-        sync_receive_data_send_cmd(0, 1, 1u, wait_time);
+        sync_receive_data_send_cmd(corgi_ts, 0, 1, 1u, wait_time);
 
         /* Y-axis */
-        sync_receive_data_send_cmd(1, 1, 1u, wait_time);
+        sync_receive_data_send_cmd(corgi_ts, 1, 1, 1u, wait_time);
 
         /* X-axis */
-        y = sync_receive_data_send_cmd(1, 1, 5u, wait_time);
+        y = sync_receive_data_send_cmd(corgi_ts, 1, 1, 5u, wait_time);
 
         /* Z1 */
-        x = sync_receive_data_send_cmd(1, 1, 3u, wait_time);
+        x = sync_receive_data_send_cmd(corgi_ts, 1, 1, 3u, wait_time);
 
         /* Z2 */
-        z1 = sync_receive_data_send_cmd(1, 1, 4u, wait_time);
-        z2 = sync_receive_data_send_cmd(1, 0, 4u, wait_time);
+        z1 = sync_receive_data_send_cmd(corgi_ts, 1, 1, 4u, wait_time);
+        z2 = sync_receive_data_send_cmd(corgi_ts, 1, 0, 4u, wait_time);
 
         /* Power-Down Enable */
         corgi_ssp_ads7846_put((1u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
@@ -189,9 +194,9 @@ static void new_data(struct corgi_ts *corgi_ts, struct pt_regs *regs)
 
 static void ts_interrupt_main(struct corgi_ts *corgi_ts, int isTimer, struct pt_regs *regs)
 {
-        if ((GPLR(CORGI_GPIO_TP_INT) & GPIO_bit(CORGI_GPIO_TP_INT)) == 0) {
+        if ((GPLR(IRQ_TO_GPIO(corgi_ts->irq_gpio)) & GPIO_bit(IRQ_TO_GPIO(corgi_ts->irq_gpio))) == 0) {
                 /* Disable Interrupt */
-                set_irq_type(CORGI_IRQ_GPIO_TP_INT, IRQT_NOEDGE);
+                set_irq_type(corgi_ts->irq_gpio, IRQT_NOEDGE);
                 if (read_xydata(corgi_ts)) {
                         corgi_ts->pendown = 1;
                         new_data(corgi_ts, regs);
@@ -210,7 +215,7 @@ static void ts_interrupt_main(struct corgi_ts *corgi_ts, int isTimer, struct pt_
                 }
 
                 /* Enable Falling Edge */
-                set_irq_type(CORGI_IRQ_GPIO_TP_INT, IRQT_FALLING);
+                set_irq_type(corgi_ts->irq_gpio, IRQT_FALLING);
                 corgi_ts->pendown = 0;
         }
 }
@@ -254,7 +259,7 @@ static int corgits_resume(struct device *dev, uint32_t level)
 
                 corgi_ssp_ads7846_putget((4u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
                 /* Enable Falling Edge */
-                set_irq_type(CORGI_IRQ_GPIO_TP_INT, IRQT_FALLING);
+                set_irq_type(corgi_ts->irq_gpio, IRQT_FALLING);
                 corgi_ts->power_mode = PWR_MODE_ACTIVE;
         }
         return 0;
@@ -267,6 +272,7 @@ static int corgits_resume(struct device *dev, uint32_t level)
 static int __init corgits_probe(struct device *dev)
 {
         struct corgi_ts *corgi_ts;
+        struct platform_device *pdev = to_platform_device(dev);
 
         if (!(corgi_ts = kmalloc(sizeof(struct corgi_ts), GFP_KERNEL)))
                 return -ENOMEM;
@@ -275,6 +281,14 @@ static int __init corgits_probe(struct device *dev)
 
         memset(corgi_ts, 0, sizeof(struct corgi_ts));
 
+        corgi_ts->machinfo = dev->platform_data;
+        corgi_ts->irq_gpio = platform_get_irq(pdev, 0);
+
+        if (corgi_ts->irq_gpio < 0) {
+                kfree(corgi_ts);
+                return -ENODEV;
+        }
+
         init_input_dev(&corgi_ts->input);
         corgi_ts->input.evbit[0] = BIT(EV_KEY) | BIT(EV_ABS);
         corgi_ts->input.keybit[LONG(BTN_TOUCH)] = BIT(BTN_TOUCH);
@@ -293,8 +307,7 @@ static int __init corgits_probe(struct device *dev)
         corgi_ts->input.id.product = 0x0002;
         corgi_ts->input.id.version = 0x0100;
 
-        pxa_gpio_mode(CORGI_GPIO_TP_INT | GPIO_IN);
-        pxa_gpio_mode(CORGI_GPIO_HSYNC | GPIO_IN);
+        pxa_gpio_mode(IRQ_TO_GPIO(corgi_ts->irq_gpio) | GPIO_IN);
 
         /* Initiaize ADS7846 Difference Reference mode */
         corgi_ssp_ads7846_putget((1u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
@@ -313,14 +326,14 @@ static int __init corgits_probe(struct device *dev)
         input_register_device(&corgi_ts->input);
         corgi_ts->power_mode = PWR_MODE_ACTIVE;
 
-        if (request_irq(CORGI_IRQ_GPIO_TP_INT, ts_interrupt, SA_INTERRUPT, "ts", corgi_ts)) {
+        if (request_irq(corgi_ts->irq_gpio, ts_interrupt, SA_INTERRUPT, "ts", corgi_ts)) {
                 input_unregister_device(&corgi_ts->input);
                 kfree(corgi_ts);
                 return -EBUSY;
         }
 
         /* Enable Falling Edge */
-        set_irq_type(CORGI_IRQ_GPIO_TP_INT, IRQT_FALLING);
+        set_irq_type(corgi_ts->irq_gpio, IRQT_FALLING);
 
         printk(KERN_INFO "input: Corgi Touchscreen Registered\n");
 
@@ -331,8 +344,9 @@ static int corgits_remove(struct device *dev)
 {
         struct corgi_ts *corgi_ts = dev_get_drvdata(dev);
 
-        free_irq(CORGI_IRQ_GPIO_TP_INT, NULL);
+        free_irq(corgi_ts->irq_gpio, NULL);
         del_timer_sync(&corgi_ts->timer);
+        corgi_ts->machinfo->put_hsync();
         input_unregister_device(&corgi_ts->input);
         kfree(corgi_ts);
         return 0;
diff --git a/drivers/isdn/divert/divert_procfs.c b/drivers/isdn/divert/divert_procfs.c
index e1f0d87de0eb..0b0ea26023e5 100644
--- a/drivers/isdn/divert/divert_procfs.c
+++ b/drivers/isdn/divert/divert_procfs.c
@@ -287,12 +287,12 @@ divert_dev_init(void)
         init_waitqueue_head(&rd_queue);
 
 #ifdef CONFIG_PROC_FS
-        isdn_proc_entry = create_proc_entry("isdn", S_IFDIR | S_IRUGO | S_IXUGO, proc_net);
+        isdn_proc_entry = proc_mkdir("net/isdn", NULL);
         if (!isdn_proc_entry)
                 return (-1);
         isdn_divert_entry = create_proc_entry("divert", S_IFREG | S_IRUGO, isdn_proc_entry);
         if (!isdn_divert_entry) {
-                remove_proc_entry("isdn", proc_net);
+                remove_proc_entry("net/isdn", NULL);
                 return (-1);
         }
         isdn_divert_entry->proc_fops = &isdn_fops; 
@@ -312,7 +312,7 @@ divert_dev_deinit(void)
 
 #ifdef CONFIG_PROC_FS
         remove_proc_entry("divert", isdn_proc_entry);
-        remove_proc_entry("isdn", proc_net);
+        remove_proc_entry("net/isdn", NULL);
 #endif  /* CONFIG_PROC_FS */
 
         return (0);
diff --git a/drivers/isdn/hardware/eicon/diva_didd.c b/drivers/isdn/hardware/eicon/diva_didd.c
index 7fdf8ae5be52..27204f4b111a 100644
--- a/drivers/isdn/hardware/eicon/diva_didd.c
+++ b/drivers/isdn/hardware/eicon/diva_didd.c
@@ -30,8 +30,6 @@ static char *DRIVERNAME =
 static char *DRIVERLNAME = "divadidd";
 char *DRIVERRELEASE_DIDD = "2.0";
 
-static char *main_proc_dir = "eicon";
-
 MODULE_DESCRIPTION("DIDD table driver for diva drivers");
 MODULE_AUTHOR("Cytronics & Melware, Eicon Networks");
 MODULE_SUPPORTED_DEVICE("Eicon diva drivers");
@@ -89,7 +87,7 @@ proc_read(char *page, char **start, off_t off, int count, int *eof,
 
 static int DIVA_INIT_FUNCTION create_proc(void)
 {
-        proc_net_eicon = create_proc_entry(main_proc_dir, S_IFDIR, proc_net);
+        proc_net_eicon = proc_mkdir("net/eicon", NULL);
 
         if (proc_net_eicon) {
                 if ((proc_didd =
@@ -105,7 +103,7 @@ static int DIVA_INIT_FUNCTION create_proc(void)
 static void DIVA_EXIT_FUNCTION remove_proc(void)
 {
         remove_proc_entry(DRIVERLNAME, proc_net_eicon);
-        remove_proc_entry(main_proc_dir, proc_net);
+        remove_proc_entry("net/eicon", NULL);
 }
 
 static int DIVA_INIT_FUNCTION divadidd_init(void)
diff --git a/drivers/isdn/hardware/eicon/divasproc.c b/drivers/isdn/hardware/eicon/divasproc.c
index b6435589d459..c12efa6f8429 100644
--- a/drivers/isdn/hardware/eicon/divasproc.c
+++ b/drivers/isdn/hardware/eicon/divasproc.c
@@ -381,7 +381,7 @@ int create_adapter_proc(diva_os_xdi_adapter_t * a)
         char tmp[16];
 
         sprintf(tmp, "%s%d", adapter_dir_name, a->controller);
-        if (!(de = create_proc_entry(tmp, S_IFDIR, proc_net_eicon)))
+        if (!(de = proc_mkdir(tmp, proc_net_eicon)))
                 return (0);
         a->proc_adapter_dir = (void *) de;
 
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 8337b0f26cc4..4866fc32d8d9 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -61,6 +61,7 @@ static const PCI_ENTRY id_list[] =
         {PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_DIGI_DF_M_E,"Digi International", "Digi DataFire Micro V (Europe)"},
         {PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_DIGI_DF_M_IOM2_A,"Digi International", "Digi DataFire Micro V IOM2 (North America)"},
         {PCI_VENDOR_ID_DIGI, PCI_DEVICE_ID_DIGI_DF_M_A,"Digi International", "Digi DataFire Micro V (North America)"},
+        {PCI_VENDOR_ID_SITECOM, PCI_DEVICE_ID_SITECOM_DC105V2, "Sitecom Europe", "DC-105 ISDN PCI"},
         {0, 0, NULL, NULL},
 };
 
diff --git a/drivers/isdn/hisax/sedlbauer_cs.c b/drivers/isdn/hisax/sedlbauer_cs.c
index c6b5bf7d2aca..dc334aab433e 100644
--- a/drivers/isdn/hisax/sedlbauer_cs.c
+++ b/drivers/isdn/hisax/sedlbauer_cs.c
@@ -611,7 +611,7 @@ static int sedlbauer_event(event_t event, int priority,
 } /* sedlbauer_event */
 
 static struct pcmcia_device_id sedlbauer_ids[] = {
-        PCMCIA_DEVICE_PROD_ID1234("SEDLBAUER", "speed star II", "V 3.1", "(c) 93 - 98 cb ", 0x81fb79f5, 0xf3612e1d, 0x6b95c78a, 0x50d4149c),
+        PCMCIA_DEVICE_PROD_ID123("SEDLBAUER", "speed star II", "V 3.1", 0x81fb79f5, 0xf3612e1d, 0x6b95c78a),
         PCMCIA_DEVICE_PROD_ID123("SEDLBAUER", "ISDN-Adapter", "4D67", 0x81fb79f5, 0xe4e9bc12, 0x397b7e90),
         PCMCIA_DEVICE_PROD_ID123("SEDLBAUER", "ISDN-Adapter", "4D98", 0x81fb79f5, 0xe4e9bc12, 0x2e5c7fce),
         PCMCIA_DEVICE_PROD_ID123("SEDLBAUER", "ISDN-Adapter", " (C) 93-94 VK", 0x81fb79f5, 0xe4e9bc12, 0x8db143fe),
diff --git a/drivers/isdn/hisax/st5481.h b/drivers/isdn/hisax/st5481.h
index 0fda5c89429b..9ffaae7c657a 100644
--- a/drivers/isdn/hisax/st5481.h
+++ b/drivers/isdn/hisax/st5481.h
@@ -466,10 +466,10 @@ void st5481_stop(struct st5481_adapter *adapter);
 #define __debug_variable st5481_debug
 #include "hisax_debug.h"
 
-#ifdef CONFIG_HISAX_DEBUG
-
 extern int st5481_debug;
 
+#ifdef CONFIG_HISAX_DEBUG
+
 #define DBG_ISO_PACKET(level,urb) \
   if (level & __debug_variable) dump_iso_packet(__FUNCTION__,urb)
 
diff --git a/drivers/isdn/hisax/st5481_b.c b/drivers/isdn/hisax/st5481_b.c
index 2fcd093921d8..657817a591fe 100644
--- a/drivers/isdn/hisax/st5481_b.c
+++ b/drivers/isdn/hisax/st5481_b.c
@@ -172,14 +172,18 @@ static void usb_b_out_complete(struct urb *urb, struct pt_regs *regs)
         test_and_clear_bit(buf_nr, &b_out->busy);
 
         if (unlikely(urb->status < 0)) {
-                if (urb->status != -ENOENT && urb->status != -ESHUTDOWN) {
-                        WARN("urb status %d",urb->status);
-                        if (b_out->busy == 0) {
-                                st5481_usb_pipe_reset(adapter, (bcs->channel+1)*2 | USB_DIR_OUT, NULL, NULL);
-                        }
-                } else {
-                        DBG(1,"urb killed"); 
-                        return; // Give up
+                switch (urb->status) {
+                        case -ENOENT:
+                        case -ESHUTDOWN:
+                        case -ECONNRESET:
+                                DBG(4,"urb killed status %d", urb->status);
+                                return; // Give up
+                        default: 
+                                WARN("urb status %d",urb->status);
+                                if (b_out->busy == 0) {
+                                        st5481_usb_pipe_reset(adapter, (bcs->channel+1)*2 | USB_DIR_OUT, NULL, NULL);
+                                }
+                                break;
                 }
         }
 
diff --git a/drivers/isdn/hisax/st5481_d.c b/drivers/isdn/hisax/st5481_d.c
index 071b1d31999f..941f7022ada1 100644
--- a/drivers/isdn/hisax/st5481_d.c
+++ b/drivers/isdn/hisax/st5481_d.c
@@ -382,16 +382,20 @@ static void usb_d_out_complete(struct urb *urb, struct pt_regs *regs)
         test_and_clear_bit(buf_nr, &d_out->busy);
 
         if (unlikely(urb->status < 0)) {
-                if (urb->status != -ENOENT && urb->status != -ESHUTDOWN) {
-                        WARN("urb status %d",urb->status);
-                        if (d_out->busy == 0) {
-                                st5481_usb_pipe_reset(adapter, EP_D_OUT | USB_DIR_OUT, fifo_reseted, adapter);
-                        }
-                        return;
-                } else {
-                        DBG(1,"urb killed"); 
-                        return; // Give up
+                switch (urb->status) {
+                        case -ENOENT:
+                        case -ESHUTDOWN:
+                        case -ECONNRESET:
+                                DBG(1,"urb killed status %d", urb->status);
+                                break;
+                        default: 
+                                WARN("urb status %d",urb->status);
+                                if (d_out->busy == 0) {
+                                        st5481_usb_pipe_reset(adapter, EP_D_OUT | USB_DIR_OUT, fifo_reseted, adapter);
+                                }
+                                break;
                 }
+                return; // Give up
         }
 
         FsmEvent(&adapter->d_out.fsm, EV_DOUT_COMPLETE, (void *) buf_nr);
@@ -709,14 +713,14 @@ int st5481_setup_d(struct st5481_adapter *adapter)
 
         adapter->l1m.fsm = &l1fsm;
         adapter->l1m.state = ST_L1_F3;
-        adapter->l1m.debug = 1;
+        adapter->l1m.debug = st5481_debug & 0x100;
         adapter->l1m.userdata = adapter;
         adapter->l1m.printdebug = l1m_debug;
         FsmInitTimer(&adapter->l1m, &adapter->timer);
 
         adapter->d_out.fsm.fsm = &dout_fsm;
         adapter->d_out.fsm.state = ST_DOUT_NONE;
-        adapter->d_out.fsm.debug = 1;
+        adapter->d_out.fsm.debug = st5481_debug & 0x100;
         adapter->d_out.fsm.userdata = adapter;
         adapter->d_out.fsm.printdebug = dout_debug;
 
diff --git a/drivers/isdn/hisax/st5481_init.c b/drivers/isdn/hisax/st5481_init.c
index 7aa810d5d333..2cf5d1a6df6c 100644
--- a/drivers/isdn/hisax/st5481_init.c
+++ b/drivers/isdn/hisax/st5481_init.c
@@ -43,10 +43,10 @@ static int number_of_leds = 2;       /* 2 LEDs on the adpater default */
 module_param(number_of_leds, int, 0);
 
 #ifdef CONFIG_HISAX_DEBUG
-static int debug = 0x1;
+static int debug = 0;
 module_param(debug, int, 0);
-int st5481_debug;
 #endif
+int st5481_debug;
 
 static LIST_HEAD(adapter_list);
 
diff --git a/drivers/isdn/hisax/st5481_usb.c b/drivers/isdn/hisax/st5481_usb.c
index ab62223297a5..89fbeb58485d 100644
--- a/drivers/isdn/hisax/st5481_usb.c
+++ b/drivers/isdn/hisax/st5481_usb.c
@@ -132,11 +132,15 @@ static void usb_ctrl_complete(struct urb *urb, struct pt_regs *regs)
         struct ctrl_msg *ctrl_msg;
         
         if (unlikely(urb->status < 0)) {
-                if (urb->status != -ENOENT && urb->status != -ESHUTDOWN) {
-                        WARN("urb status %d",urb->status);
-                } else {
-                        DBG(1,"urb killed");
-                        return; // Give up
+                switch (urb->status) {
+                        case -ENOENT:
+                        case -ESHUTDOWN:
+                        case -ECONNRESET:
+                                DBG(1,"urb killed status %d", urb->status);
+                                return; // Give up
+                        default: 
+                                WARN("urb status %d",urb->status);
+                                break;
                 }
         }
 
@@ -184,22 +188,22 @@ static void usb_int_complete(struct urb *urb, struct pt_regs *regs)
         int status;
 
         switch (urb->status) {
-        case 0:
-                /* success */
-                break;
-        case -ECONNRESET:
-        case -ENOENT:
-        case -ESHUTDOWN:
-                /* this urb is terminated, clean up */
-                DBG(1, "urb shutting down with status: %d", urb->status);
-                return;
-        default:
-                WARN("nonzero urb status received: %d", urb->status);
-                goto exit;
+                case 0:
+                        /* success */
+                        break;
+                case -ECONNRESET:
+                case -ENOENT:
+                case -ESHUTDOWN:
+                        /* this urb is terminated, clean up */
+                        DBG(2, "urb shutting down with status: %d", urb->status);
+                        return;
+                default:
+                        WARN("nonzero urb status received: %d", urb->status);
+                        goto exit;
         }
 
         
-        DBG_PACKET(1, data, INT_PKT_SIZE);
+        DBG_PACKET(2, data, INT_PKT_SIZE);
                 
         if (urb->actual_length == 0) {
                 goto exit;
@@ -250,7 +254,7 @@ int st5481_setup_usb(struct st5481_adapter *adapter)
         struct urb *urb;
         u8 *buf;
         
-        DBG(1,"");
+        DBG(2,"");
         
         if ((status = usb_reset_configuration (dev)) < 0) {
                 WARN("reset_configuration failed,status=%d",status);
@@ -330,15 +334,17 @@ void st5481_release_usb(struct st5481_adapter *adapter)
         DBG(1,"");
 
         // Stop and free Control and Interrupt URBs
-        usb_unlink_urb(ctrl->urb);
+        usb_kill_urb(ctrl->urb);
         if (ctrl->urb->transfer_buffer)
                 kfree(ctrl->urb->transfer_buffer);
         usb_free_urb(ctrl->urb);
+        ctrl->urb = NULL;
 
-        usb_unlink_urb(intr->urb);
+        usb_kill_urb(intr->urb);
         if (intr->urb->transfer_buffer)
                 kfree(intr->urb->transfer_buffer);
         usb_free_urb(intr->urb);
+        ctrl->urb = NULL;
 }
 
 /*
@@ -406,6 +412,7 @@ fill_isoc_urb(struct urb *urb, struct usb_device *dev,
         spin_lock_init(&urb->lock);
         urb->dev=dev;
         urb->pipe=pipe;
+        urb->interval = 1;
         urb->transfer_buffer=buf;
         urb->number_of_packets = num_packets;
         urb->transfer_buffer_length=num_packets*packet_size;
@@ -452,7 +459,9 @@ st5481_setup_isocpipes(struct urb* urb[2], struct usb_device *dev,
                 if (urb[j]) {
                         if (urb[j]->transfer_buffer)
                                 kfree(urb[j]->transfer_buffer);
+                        urb[j]->transfer_buffer = NULL;
                         usb_free_urb(urb[j]);
+                        urb[j] = NULL;
                 }
         }
         return retval;
@@ -463,10 +472,11 @@ void st5481_release_isocpipes(struct urb* urb[2])
         int j;
 
         for (j = 0; j < 2; j++) {
-                usb_unlink_urb(urb[j]);
+                usb_kill_urb(urb[j]);
                 if (urb[j]->transfer_buffer)
                         kfree(urb[j]->transfer_buffer);                 
                 usb_free_urb(urb[j]);
+                urb[j] = NULL;
         }
 }
 
@@ -485,11 +495,15 @@ static void usb_in_complete(struct urb *urb, struct pt_regs *regs)
         int len, count, status;
 
         if (unlikely(urb->status < 0)) {
-                if (urb->status != -ENOENT && urb->status != -ESHUTDOWN) {
-                        WARN("urb status %d",urb->status);
-                } else {
-                        DBG(1,"urb killed");
-                        return; // Give up
+                switch (urb->status) {
+                        case -ENOENT:
+                        case -ESHUTDOWN:
+                        case -ECONNRESET:
+                                DBG(1,"urb killed status %d", urb->status);
+                                return; // Give up
+                        default: 
+                                WARN("urb status %d",urb->status);
+                                break;
                 }
         }
 
diff --git a/drivers/isdn/hysdn/hysdn_procconf.c b/drivers/isdn/hysdn/hysdn_procconf.c
index 5da507e532fc..639582f61f41 100644
--- a/drivers/isdn/hysdn/hysdn_procconf.c
+++ b/drivers/isdn/hysdn/hysdn_procconf.c
@@ -394,7 +394,7 @@ hysdn_procconf_init(void)
         hysdn_card *card;
         uchar conf_name[20];
 
-        hysdn_proc_entry = create_proc_entry(PROC_SUBDIR_NAME, S_IFDIR | S_IRUGO | S_IXUGO, proc_net);
+        hysdn_proc_entry = proc_mkdir(PROC_SUBDIR_NAME, proc_net);
         if (!hysdn_proc_entry) {
                 printk(KERN_ERR "HYSDN: unable to create hysdn subdir\n");
                 return (-1);
diff --git a/drivers/isdn/sc/init.c b/drivers/isdn/sc/init.c
index 40b0df04ed9f..1ebed041672d 100644
--- a/drivers/isdn/sc/init.c
+++ b/drivers/isdn/sc/init.c
@@ -87,7 +87,7 @@ static int __init sc_init(void)
                          */
                         for (i = 0 ; i < MAX_IO_REGS - 1 ; i++) {
                                 if(!request_region(io[b] + i * 0x400, 1, "sc test")) {
-                                        pr_debug("check_region for 0x%x failed\n", io[b] + i * 0x400);
+                                        pr_debug("request_region for 0x%x failed\n", io[b] + i * 0x400);
                                         io[b] = 0;
                                         break;
                                 } else
@@ -181,7 +181,7 @@ static int __init sc_init(void)
                         for (i = SRAM_MIN ; i < SRAM_MAX ; i += SRAM_PAGESIZE) {
                                 pr_debug("Checking RAM address 0x%x...\n", i);
                                 if(request_region(i, SRAM_PAGESIZE, "sc test")) {
-                                        pr_debug("  check_region succeeded\n");
+                                        pr_debug("  request_region succeeded\n");
                                         model = identify_board(i, io[b]);
                                         release_region(i, SRAM_PAGESIZE);
                                         if (model >= 0) {
diff --git a/drivers/macintosh/smu.c b/drivers/macintosh/smu.c
index fb535737d17d..9b38674fbf75 100644
--- a/drivers/macintosh/smu.c
+++ b/drivers/macintosh/smu.c
@@ -8,21 +8,15 @@
  */
 
 /*
- * For now, this driver includes:
- * - RTC get & set
- * - reboot & shutdown commands
- * all synchronous with IRQ disabled (ugh)
- *
  * TODO:
- *   rework in a way the PMU driver works, that is asynchronous
- *   with a queue of commands. I'll do that as soon as I have an
- *   SMU based machine at hand. Some more cleanup is needed too,
- *   like maybe fitting it into a platform device, etc...
- *   Also check what's up with cache coherency, and if we really
- *   can't do better than flushing the cache, maybe build a table
- *   of command len/reply len like the PMU driver to only flush
- *   what is actually necessary.
- *   --BenH.
+ *  - maybe add timeout to commands ?
+ *  - blocking version of time functions
+ *  - polling version of i2c commands (including timer that works with
+ *    interrutps off)
+ *  - maybe avoid some data copies with i2c by directly using the smu cmd
+ *    buffer and a lower level internal interface
+ *  - understand SMU -> CPU events and implement reception of them via
+ *    the userland interface
  */
 
 #include <linux/config.h>
@@ -36,6 +30,11 @@
 #include <linux/jiffies.h>
 #include <linux/interrupt.h>
 #include <linux/rtc.h>
+#include <linux/completion.h>
+#include <linux/miscdevice.h>
+#include <linux/delay.h>
+#include <linux/sysdev.h>
+#include <linux/poll.h>
 
 #include <asm/byteorder.h>
 #include <asm/io.h>
@@ -45,8 +44,13 @@
 #include <asm/smu.h>
 #include <asm/sections.h>
 #include <asm/abs_addr.h>
+#include <asm/uaccess.h>
+#include <asm/of_device.h>
+
+#define VERSION "0.6"
+#define AUTHOR  "(c) 2005 Benjamin Herrenschmidt, IBM Corp."
 
-#define DEBUG_SMU 1
+#undef DEBUG_SMU
 
 #ifdef DEBUG_SMU
 #define DPRINTK(fmt, args...) do { printk(KERN_DEBUG fmt , ##args); } while (0)
@@ -57,20 +61,30 @@
 /*
  * This is the command buffer passed to the SMU hardware
  */
+#define SMU_MAX_DATA    254
+
 struct smu_cmd_buf {
         u8 cmd;
         u8 length;
-        u8 data[0x0FFE];
+        u8 data[SMU_MAX_DATA];
 };
 
 struct smu_device {
         spinlock_t              lock;
         struct device_node      *of_node;
-        int                     db_ack;         /* doorbell ack GPIO */
-        int                     db_req;         /* doorbell req GPIO */
+        struct of_device        *of_dev;
+        int                     doorbell;       /* doorbell gpio */
         u32 __iomem             *db_buf;        /* doorbell buffer */
+        int                     db_irq;
+        int                     msg;
+        int                     msg_irq;
         struct smu_cmd_buf      *cmd_buf;       /* command buffer virtual */
         u32                     cmd_buf_abs;    /* command buffer absolute */
+        struct list_head        cmd_list;
+        struct smu_cmd          *cmd_cur;       /* pending command */
+        struct list_head        cmd_i2c_list;
+        struct smu_i2c_cmd      *cmd_i2c_cur;   /* pending i2c command */
+        struct timer_list       i2c_timer;
 };
 
 /*
@@ -79,113 +93,245 @@ struct smu_device {
  */
 static struct smu_device        *smu;
 
+
 /*
- * SMU low level communication stuff
+ * SMU driver low level stuff
  */
-static inline int smu_cmd_stat(struct smu_cmd_buf *cmd_buf, u8 cmd_ack)
-{
-        rmb();
-        return cmd_buf->cmd == cmd_ack && cmd_buf->length != 0;
-}
 
-static inline u8 smu_save_ack_cmd(struct smu_cmd_buf *cmd_buf)
+static void smu_start_cmd(void)
 {
-        return (~cmd_buf->cmd) & 0xff;
-}
+        unsigned long faddr, fend;
+        struct smu_cmd *cmd;
 
-static void smu_send_cmd(struct smu_device *dev)
-{
-        /* SMU command buf is currently cacheable, we need a physical
-         * address. This isn't exactly a DMA mapping here, I suspect
+        if (list_empty(&smu->cmd_list))
+                return;
+
+        /* Fetch first command in queue */
+        cmd = list_entry(smu->cmd_list.next, struct smu_cmd, link);
+        smu->cmd_cur = cmd;
+        list_del(&cmd->link);
+
+        DPRINTK("SMU: starting cmd %x, %d bytes data\n", cmd->cmd,
+                cmd->data_len);
+        DPRINTK("SMU: data buffer: %02x %02x %02x %02x ...\n",
+                ((u8 *)cmd->data_buf)[0], ((u8 *)cmd->data_buf)[1],
+                ((u8 *)cmd->data_buf)[2], ((u8 *)cmd->data_buf)[3]);
+
+        /* Fill the SMU command buffer */
+        smu->cmd_buf->cmd = cmd->cmd;
+        smu->cmd_buf->length = cmd->data_len;
+        memcpy(smu->cmd_buf->data, cmd->data_buf, cmd->data_len);
+
+        /* Flush command and data to RAM */
+        faddr = (unsigned long)smu->cmd_buf;
+        fend = faddr + smu->cmd_buf->length + 2;
+        flush_inval_dcache_range(faddr, fend);
+
+        /* This isn't exactly a DMA mapping here, I suspect
          * the SMU is actually communicating with us via i2c to the
          * northbridge or the CPU to access RAM.
          */
-        writel(dev->cmd_buf_abs, dev->db_buf);
+        writel(smu->cmd_buf_abs, smu->db_buf);
 
         /* Ring the SMU doorbell */
-        pmac_do_feature_call(PMAC_FTR_WRITE_GPIO, NULL, dev->db_req, 4);
-        pmac_do_feature_call(PMAC_FTR_READ_GPIO, NULL, dev->db_req, 4);
+        pmac_do_feature_call(PMAC_FTR_WRITE_GPIO, NULL, smu->doorbell, 4);
 }
 
-static int smu_cmd_done(struct smu_device *dev)
+
+static irqreturn_t smu_db_intr(int irq, void *arg, struct pt_regs *regs)
 {
-        unsigned long wait = 0;
-        int gpio;
+        unsigned long flags;
+        struct smu_cmd *cmd;
+        void (*done)(struct smu_cmd *cmd, void *misc) = NULL;
+        void *misc = NULL;
+        u8 gpio;
+        int rc = 0;
 
-        /* Check the SMU doorbell */
-        do  {
-                gpio = pmac_do_feature_call(PMAC_FTR_READ_GPIO,
-                                            NULL, dev->db_ack);
-                if ((gpio & 7) == 7)
-                        return 0;
-                udelay(100);
-        } while(++wait < 10000);
+        /* SMU completed the command, well, we hope, let's make sure
+         * of it
+         */
+        spin_lock_irqsave(&smu->lock, flags);
 
-        printk(KERN_ERR "SMU timeout !\n");
-        return -ENXIO;
+        gpio = pmac_do_feature_call(PMAC_FTR_READ_GPIO, NULL, smu->doorbell);
+        if ((gpio & 7) != 7) {
+                spin_unlock_irqrestore(&smu->lock, flags);
+                return IRQ_HANDLED;
+        }
+
+        cmd = smu->cmd_cur;
+        smu->cmd_cur = NULL;
+        if (cmd == NULL)
+                goto bail;
+
+        if (rc == 0) {
+                unsigned long faddr;
+                int reply_len;
+                u8 ack;
+
+                /* CPU might have brought back the cache line, so we need
+                 * to flush again before peeking at the SMU response. We
+                 * flush the entire buffer for now as we haven't read the
+                 * reply lenght (it's only 2 cache lines anyway)
+                 */
+                faddr = (unsigned long)smu->cmd_buf;
+                flush_inval_dcache_range(faddr, faddr + 256);
+
+                /* Now check ack */
+                ack = (~cmd->cmd) & 0xff;
+                if (ack != smu->cmd_buf->cmd) {
+                        DPRINTK("SMU: incorrect ack, want %x got %x\n",
+                                ack, smu->cmd_buf->cmd);
+                        rc = -EIO;
+                }
+                reply_len = rc == 0 ? smu->cmd_buf->length : 0;
+                DPRINTK("SMU: reply len: %d\n", reply_len);
+                if (reply_len > cmd->reply_len) {
+                        printk(KERN_WARNING "SMU: reply buffer too small,"
+                               "got %d bytes for a %d bytes buffer\n",
+                               reply_len, cmd->reply_len);
+                        reply_len = cmd->reply_len;
+                }
+                cmd->reply_len = reply_len;
+                if (cmd->reply_buf && reply_len)
+                        memcpy(cmd->reply_buf, smu->cmd_buf->data, reply_len);
+        }
+
+        /* Now complete the command. Write status last in order as we lost
+         * ownership of the command structure as soon as it's no longer -1
+         */
+        done = cmd->done;
+        misc = cmd->misc;
+        mb();
+        cmd->status = rc;
+ bail:
+        /* Start next command if any */
+        smu_start_cmd();
+        spin_unlock_irqrestore(&smu->lock, flags);
+
+        /* Call command completion handler if any */
+        if (done)
+                done(cmd, misc);
+
+        /* It's an edge interrupt, nothing to do */
+        return IRQ_HANDLED;
 }
 
-static int smu_do_cmd(struct smu_device *dev)
+
+static irqreturn_t smu_msg_intr(int irq, void *arg, struct pt_regs *regs)
 {
-        int rc;
-        u8 cmd_ack;
+        /* I don't quite know what to do with this one, we seem to never
+         * receive it, so I suspect we have to arm it someway in the SMU
+         * to start getting events that way.
+         */
 
-        DPRINTK("SMU do_cmd %02x len=%d %02x\n",
-                dev->cmd_buf->cmd, dev->cmd_buf->length,
-                dev->cmd_buf->data[0]);
+        printk(KERN_INFO "SMU: message interrupt !\n");
 
-        cmd_ack = smu_save_ack_cmd(dev->cmd_buf);
+        /* It's an edge interrupt, nothing to do */
+        return IRQ_HANDLED;
+}
 
-        /* Clear cmd_buf cache lines */
-        flush_inval_dcache_range((unsigned long)dev->cmd_buf,
-                                 ((unsigned long)dev->cmd_buf) +
-                                 sizeof(struct smu_cmd_buf));
-        smu_send_cmd(dev);
-        rc = smu_cmd_done(dev);
-        if (rc == 0)
-                rc = smu_cmd_stat(dev->cmd_buf, cmd_ack) ? 0 : -1;
 
-        DPRINTK("SMU do_cmd %02x len=%d %02x => %d (%02x)\n",
-                dev->cmd_buf->cmd, dev->cmd_buf->length,
-                dev->cmd_buf->data[0], rc, cmd_ack);
+/*
+ * Queued command management.
+ *
+ */
+
+int smu_queue_cmd(struct smu_cmd *cmd)
+{
+        unsigned long flags;
 
-        return rc;
+        if (smu == NULL)
+                return -ENODEV;
+        if (cmd->data_len > SMU_MAX_DATA ||
+            cmd->reply_len > SMU_MAX_DATA)
+                return -EINVAL;
+
+        cmd->status = 1;
+        spin_lock_irqsave(&smu->lock, flags);
+        list_add_tail(&cmd->link, &smu->cmd_list);
+        if (smu->cmd_cur == NULL)
+                smu_start_cmd();
+        spin_unlock_irqrestore(&smu->lock, flags);
+
+        return 0;
 }
+EXPORT_SYMBOL(smu_queue_cmd);
 
-/* RTC low level commands */
-static inline int bcd2hex (int n)
+
+int smu_queue_simple(struct smu_simple_cmd *scmd, u8 command,
+                     unsigned int data_len,
+                     void (*done)(struct smu_cmd *cmd, void *misc),
+                     void *misc, ...)
 {
-        return (((n & 0xf0) >> 4) * 10) + (n & 0xf);
+        struct smu_cmd *cmd = &scmd->cmd;
+        va_list list;
+        int i;
+
+        if (data_len > sizeof(scmd->buffer))
+                return -EINVAL;
+
+        memset(scmd, 0, sizeof(*scmd));
+        cmd->cmd = command;
+        cmd->data_len = data_len;
+        cmd->data_buf = scmd->buffer;
+        cmd->reply_len = sizeof(scmd->buffer);
+        cmd->reply_buf = scmd->buffer;
+        cmd->done = done;
+        cmd->misc = misc;
+
+        va_start(list, misc);
+        for (i = 0; i < data_len; ++i)
+                scmd->buffer[i] = (u8)va_arg(list, int);
+        va_end(list);
+
+        return smu_queue_cmd(cmd);
 }
+EXPORT_SYMBOL(smu_queue_simple);
 
-static inline int hex2bcd (int n)
+
+void smu_poll(void)
 {
-        return ((n / 10) << 4) + (n % 10);
+        u8 gpio;
+
+        if (smu == NULL)
+                return;
+
+        gpio = pmac_do_feature_call(PMAC_FTR_READ_GPIO, NULL, smu->doorbell);
+        if ((gpio & 7) == 7)
+                smu_db_intr(smu->db_irq, smu, NULL);
 }
+EXPORT_SYMBOL(smu_poll);
 
-#if 0
-static inline void smu_fill_set_pwrup_timer_cmd(struct smu_cmd_buf *cmd_buf)
+
+void smu_done_complete(struct smu_cmd *cmd, void *misc)
 {
-        cmd_buf->cmd = 0x8e;
-        cmd_buf->length = 8;
-        cmd_buf->data[0] = 0x00;
-        memset(cmd_buf->data + 1, 0, 7);
+        struct completion *comp = misc;
+
+        complete(comp);
 }
+EXPORT_SYMBOL(smu_done_complete);
+
 
-static inline void smu_fill_get_pwrup_timer_cmd(struct smu_cmd_buf *cmd_buf)
+void smu_spinwait_cmd(struct smu_cmd *cmd)
 {
-        cmd_buf->cmd = 0x8e;
-        cmd_buf->length = 1;
-        cmd_buf->data[0] = 0x01;
+        while(cmd->status == 1)
+                smu_poll();
 }
+EXPORT_SYMBOL(smu_spinwait_cmd);
+
 
-static inline void smu_fill_dis_pwrup_timer_cmd(struct smu_cmd_buf *cmd_buf)
+/* RTC low level commands */
+static inline int bcd2hex (int n)
 {
-        cmd_buf->cmd = 0x8e;
-        cmd_buf->length = 1;
-        cmd_buf->data[0] = 0x02;
+        return (((n & 0xf0) >> 4) * 10) + (n & 0xf);
 }
-#endif
+
+
+static inline int hex2bcd (int n)
+{
+        return ((n / 10) << 4) + (n % 10);
+}
+
 
 static inline void smu_fill_set_rtc_cmd(struct smu_cmd_buf *cmd_buf,
                                         struct rtc_time *time)
@@ -202,100 +348,96 @@ static inline void smu_fill_set_rtc_cmd(struct smu_cmd_buf *cmd_buf,
         cmd_buf->data[7] = hex2bcd(time->tm_year - 100);
 }
 
-static inline void smu_fill_get_rtc_cmd(struct smu_cmd_buf *cmd_buf)
-{
-        cmd_buf->cmd = 0x8e;
-        cmd_buf->length = 1;
-        cmd_buf->data[0] = 0x81;
-}
 
-static void smu_parse_get_rtc_reply(struct smu_cmd_buf *cmd_buf,
-                                    struct rtc_time *time)
+int smu_get_rtc_time(struct rtc_time *time, int spinwait)
 {
-        time->tm_sec = bcd2hex(cmd_buf->data[0]);
-        time->tm_min = bcd2hex(cmd_buf->data[1]);
-        time->tm_hour = bcd2hex(cmd_buf->data[2]);
-        time->tm_wday = bcd2hex(cmd_buf->data[3]);
-        time->tm_mday = bcd2hex(cmd_buf->data[4]);
-        time->tm_mon = bcd2hex(cmd_buf->data[5]) - 1;
-        time->tm_year = bcd2hex(cmd_buf->data[6]) + 100;
-}
-
-int smu_get_rtc_time(struct rtc_time *time)
-{
-        unsigned long flags;
+        struct smu_simple_cmd cmd;
         int rc;
 
         if (smu == NULL)
                 return -ENODEV;
 
         memset(time, 0, sizeof(struct rtc_time));
-        spin_lock_irqsave(&smu->lock, flags);
-        smu_fill_get_rtc_cmd(smu->cmd_buf);
-        rc = smu_do_cmd(smu);
-        if (rc == 0)
-                smu_parse_get_rtc_reply(smu->cmd_buf, time);
-        spin_unlock_irqrestore(&smu->lock, flags);
+        rc = smu_queue_simple(&cmd, SMU_CMD_RTC_COMMAND, 1, NULL, NULL,
+                              SMU_CMD_RTC_GET_DATETIME);
+        if (rc)
+                return rc;
+        smu_spinwait_simple(&cmd);
 
-        return rc;
+        time->tm_sec = bcd2hex(cmd.buffer[0]);
+        time->tm_min = bcd2hex(cmd.buffer[1]);
+        time->tm_hour = bcd2hex(cmd.buffer[2]);
+        time->tm_wday = bcd2hex(cmd.buffer[3]);
+        time->tm_mday = bcd2hex(cmd.buffer[4]);
+        time->tm_mon = bcd2hex(cmd.buffer[5]) - 1;
+        time->tm_year = bcd2hex(cmd.buffer[6]) + 100;
+
+        return 0;
 }
 
-int smu_set_rtc_time(struct rtc_time *time)
+
+int smu_set_rtc_time(struct rtc_time *time, int spinwait)
 {
-        unsigned long flags;
+        struct smu_simple_cmd cmd;
         int rc;
 
         if (smu == NULL)
                 return -ENODEV;
 
-        spin_lock_irqsave(&smu->lock, flags);
-        smu_fill_set_rtc_cmd(smu->cmd_buf, time);
-        rc = smu_do_cmd(smu);
-        spin_unlock_irqrestore(&smu->lock, flags);
+        rc = smu_queue_simple(&cmd, SMU_CMD_RTC_COMMAND, 8, NULL, NULL,
+                              SMU_CMD_RTC_SET_DATETIME,
+                              hex2bcd(time->tm_sec),
+                              hex2bcd(time->tm_min),
+                              hex2bcd(time->tm_hour),
+                              time->tm_wday,
+                              hex2bcd(time->tm_mday),
+                              hex2bcd(time->tm_mon) + 1,
+                              hex2bcd(time->tm_year - 100));
+        if (rc)
+                return rc;
+        smu_spinwait_simple(&cmd);
 
-        return rc;
+        return 0;
 }
 
+
 void smu_shutdown(void)
 {
-        const unsigned char *command = "SHUTDOWN";
-        unsigned long flags;
+        struct smu_simple_cmd cmd;
 
         if (smu == NULL)
                 return;
 
-        spin_lock_irqsave(&smu->lock, flags);
-        smu->cmd_buf->cmd = 0xaa;
-        smu->cmd_buf->length = strlen(command);
-        strcpy(smu->cmd_buf->data, command);
-        smu_do_cmd(smu);
+        if (smu_queue_simple(&cmd, SMU_CMD_POWER_COMMAND, 9, NULL, NULL,
+                             'S', 'H', 'U', 'T', 'D', 'O', 'W', 'N', 0))
+                return;
+        smu_spinwait_simple(&cmd);
         for (;;)
                 ;
-        spin_unlock_irqrestore(&smu->lock, flags);
 }
 
+
 void smu_restart(void)
 {
-        const unsigned char *command = "RESTART";
-        unsigned long flags;
+        struct smu_simple_cmd cmd;
 
         if (smu == NULL)
                 return;
 
-        spin_lock_irqsave(&smu->lock, flags);
-        smu->cmd_buf->cmd = 0xaa;
-        smu->cmd_buf->length = strlen(command);
-        strcpy(smu->cmd_buf->data, command);
-        smu_do_cmd(smu);
+        if (smu_queue_simple(&cmd, SMU_CMD_POWER_COMMAND, 8, NULL, NULL,
+                             'R', 'E', 'S', 'T', 'A', 'R', 'T', 0))
+                return;
+        smu_spinwait_simple(&cmd);
         for (;;)
                 ;
-        spin_unlock_irqrestore(&smu->lock, flags);
 }
 
+
 int smu_present(void)
 {
         return smu != NULL;
 }
+EXPORT_SYMBOL(smu_present);
 
 
 int smu_init (void)
@@ -307,6 +449,8 @@ int smu_init (void)
         if (np == NULL)
                 return -ENODEV;
 
+        printk(KERN_INFO "SMU driver %s %s\n", VERSION, AUTHOR);
+
         if (smu_cmdbuf_abs == 0) {
                 printk(KERN_ERR "SMU: Command buffer not allocated !\n");
                 return -EINVAL;
@@ -318,7 +462,13 @@ int smu_init (void)
         memset(smu, 0, sizeof(*smu));
 
         spin_lock_init(&smu->lock);
+        INIT_LIST_HEAD(&smu->cmd_list);
+        INIT_LIST_HEAD(&smu->cmd_i2c_list);
         smu->of_node = np;
+        smu->db_irq = NO_IRQ;
+        smu->msg_irq = NO_IRQ;
+        init_timer(&smu->i2c_timer);
+
         /* smu_cmdbuf_abs is in the low 2G of RAM, can be converted to a
          * 32 bits value safely
          */
@@ -331,8 +481,8 @@ int smu_init (void)
                 goto fail;
         }
         data = (u32 *)get_property(np, "reg", NULL);
-        of_node_put(np);
         if (data == NULL) {
+                of_node_put(np);
                 printk(KERN_ERR "SMU: Can't find doorbell GPIO address !\n");
                 goto fail;
         }
@@ -341,8 +491,31 @@ int smu_init (void)
          * and ack. GPIOs are at 0x50, best would be to find that out
          * in the device-tree though.
          */
-        smu->db_req = 0x50 + *data;
-        smu->db_ack = 0x50 + *data;
+        smu->doorbell = *data;
+        if (smu->doorbell < 0x50)
+                smu->doorbell += 0x50;
+        if (np->n_intrs > 0)
+                smu->db_irq = np->intrs[0].line;
+
+        of_node_put(np);
+
+        /* Now look for the smu-interrupt GPIO */
+        do {
+                np = of_find_node_by_name(NULL, "smu-interrupt");
+                if (np == NULL)
+                        break;
+                data = (u32 *)get_property(np, "reg", NULL);
+                if (data == NULL) {
+                        of_node_put(np);
+                        break;
+                }
+                smu->msg = *data;
+                if (smu->msg < 0x50)
+                        smu->msg += 0x50;
+                if (np->n_intrs > 0)
+                        smu->msg_irq = np->intrs[0].line;
+                of_node_put(np);
+        } while(0);
 
         /* Doorbell buffer is currently hard-coded, I didn't find a proper
          * device-tree entry giving the address. Best would probably to use
@@ -362,3 +535,584 @@ int smu_init (void)
         return -ENXIO;
 
 }
+
+
+static int smu_late_init(void)
+{
+        if (!smu)
+                return 0;
+
+        /*
+         * Try to request the interrupts
+         */
+
+        if (smu->db_irq != NO_IRQ) {
+                if (request_irq(smu->db_irq, smu_db_intr,
+                                SA_SHIRQ, "SMU doorbell", smu) < 0) {
+                        printk(KERN_WARNING "SMU: can't "
+                               "request interrupt %d\n",
+                               smu->db_irq);
+                        smu->db_irq = NO_IRQ;
+                }
+        }
+
+        if (smu->msg_irq != NO_IRQ) {
+                if (request_irq(smu->msg_irq, smu_msg_intr,
+                                SA_SHIRQ, "SMU message", smu) < 0) {
+                        printk(KERN_WARNING "SMU: can't "
+                               "request interrupt %d\n",
+                               smu->msg_irq);
+                        smu->msg_irq = NO_IRQ;
+                }
+        }
+
+        return 0;
+}
+arch_initcall(smu_late_init);
+
+/*
+ * sysfs visibility
+ */
+
+static void smu_expose_childs(void *unused)
+{
+        struct device_node *np;
+
+        for (np = NULL; (np = of_get_next_child(smu->of_node, np)) != NULL;) {
+                if (device_is_compatible(np, "smu-i2c")) {
+                        char name[32];
+                        u32 *reg = (u32 *)get_property(np, "reg", NULL);
+
+                        if (reg == NULL)
+                                continue;
+                        sprintf(name, "smu-i2c-%02x", *reg);
+                        of_platform_device_create(np, name, &smu->of_dev->dev);
+                }
+        }
+
+}
+
+static DECLARE_WORK(smu_expose_childs_work, smu_expose_childs, NULL);
+
+static int smu_platform_probe(struct of_device* dev,
+                              const struct of_device_id *match)
+{
+        if (!smu)
+                return -ENODEV;
+        smu->of_dev = dev;
+
+        /*
+         * Ok, we are matched, now expose all i2c busses. We have to defer
+         * that unfortunately or it would deadlock inside the device model
+         */
+        schedule_work(&smu_expose_childs_work);
+
+        return 0;
+}
+
+static struct of_device_id smu_platform_match[] =
+{
+        {
+                .type           = "smu",
+        },
+        {},
+};
+
+static struct of_platform_driver smu_of_platform_driver =
+{
+        .name           = "smu",
+        .match_table    = smu_platform_match,
+        .probe          = smu_platform_probe,
+};
+
+static int __init smu_init_sysfs(void)
+{
+        int rc;
+
+        /*
+         * Due to sysfs bogosity, a sysdev is not a real device, so
+         * we should in fact create both if we want sysdev semantics
+         * for power management.
+         * For now, we don't power manage machines with an SMU chip,
+         * I'm a bit too far from figuring out how that works with those
+         * new chipsets, but that will come back and bite us
+         */
+        rc = of_register_driver(&smu_of_platform_driver);
+        return 0;
+}
+
+device_initcall(smu_init_sysfs);
+
+struct of_device *smu_get_ofdev(void)
+{
+        if (!smu)
+                return NULL;
+        return smu->of_dev;
+}
+
+EXPORT_SYMBOL_GPL(smu_get_ofdev);
+
+/*
+ * i2c interface
+ */
+
+static void smu_i2c_complete_command(struct smu_i2c_cmd *cmd, int fail)
+{
+        void (*done)(struct smu_i2c_cmd *cmd, void *misc) = cmd->done;
+        void *misc = cmd->misc;
+        unsigned long flags;
+
+        /* Check for read case */
+        if (!fail && cmd->read) {
+                if (cmd->pdata[0] < 1)
+                        fail = 1;
+                else
+                        memcpy(cmd->info.data, &cmd->pdata[1],
+                               cmd->info.datalen);
+        }
+
+        DPRINTK("SMU: completing, success: %d\n", !fail);
+
+        /* Update status and mark no pending i2c command with lock
+         * held so nobody comes in while we dequeue an eventual
+         * pending next i2c command
+         */
+        spin_lock_irqsave(&smu->lock, flags);
+        smu->cmd_i2c_cur = NULL;
+        wmb();
+        cmd->status = fail ? -EIO : 0;
+
+        /* Is there another i2c command waiting ? */
+        if (!list_empty(&smu->cmd_i2c_list)) {
+                struct smu_i2c_cmd *newcmd;
+
+                /* Fetch it, new current, remove from list */
+                newcmd = list_entry(smu->cmd_i2c_list.next,
+                                    struct smu_i2c_cmd, link);
+                smu->cmd_i2c_cur = newcmd;
+                list_del(&cmd->link);
+
+                /* Queue with low level smu */
+                list_add_tail(&cmd->scmd.link, &smu->cmd_list);
+                if (smu->cmd_cur == NULL)
+                        smu_start_cmd();
+        }
+        spin_unlock_irqrestore(&smu->lock, flags);
+
+        /* Call command completion handler if any */
+        if (done)
+                done(cmd, misc);
+
+}
+
+
+static void smu_i2c_retry(unsigned long data)
+{
+        struct smu_i2c_cmd      *cmd = (struct smu_i2c_cmd *)data;
+
+        DPRINTK("SMU: i2c failure, requeuing...\n");
+
+        /* requeue command simply by resetting reply_len */
+        cmd->pdata[0] = 0xff;
+        cmd->scmd.reply_len = 0x10;
+        smu_queue_cmd(&cmd->scmd);
+}
+
+
+static void smu_i2c_low_completion(struct smu_cmd *scmd, void *misc)
+{
+        struct smu_i2c_cmd      *cmd = misc;
+        int                     fail = 0;
+
+        DPRINTK("SMU: i2c compl. stage=%d status=%x pdata[0]=%x rlen: %x\n",
+                cmd->stage, scmd->status, cmd->pdata[0], scmd->reply_len);
+
+        /* Check for possible status */
+        if (scmd->status < 0)
+                fail = 1;
+        else if (cmd->read) {
+                if (cmd->stage == 0)
+                        fail = cmd->pdata[0] != 0;
+                else
+                        fail = cmd->pdata[0] >= 0x80;
+        } else {
+                fail = cmd->pdata[0] != 0;
+        }
+
+        /* Handle failures by requeuing command, after 5ms interval
+         */
+        if (fail && --cmd->retries > 0) {
+                DPRINTK("SMU: i2c failure, starting timer...\n");
+                smu->i2c_timer.function = smu_i2c_retry;
+                smu->i2c_timer.data = (unsigned long)cmd;
+                smu->i2c_timer.expires = jiffies + msecs_to_jiffies(5);
+                add_timer(&smu->i2c_timer);
+                return;
+        }
+
+        /* If failure or stage 1, command is complete */
+        if (fail || cmd->stage != 0) {
+                smu_i2c_complete_command(cmd, fail);
+                return;
+        }
+
+        DPRINTK("SMU: going to stage 1\n");
+
+        /* Ok, initial command complete, now poll status */
+        scmd->reply_buf = cmd->pdata;
+        scmd->reply_len = 0x10;
+        scmd->data_buf = cmd->pdata;
+        scmd->data_len = 1;
+        cmd->pdata[0] = 0;
+        cmd->stage = 1;
+        cmd->retries = 20;
+        smu_queue_cmd(scmd);
+}
+
+
+int smu_queue_i2c(struct smu_i2c_cmd *cmd)
+{
+        unsigned long flags;
+
+        if (smu == NULL)
+                return -ENODEV;
+
+        /* Fill most fields of scmd */
+        cmd->scmd.cmd = SMU_CMD_I2C_COMMAND;
+        cmd->scmd.done = smu_i2c_low_completion;
+        cmd->scmd.misc = cmd;
+        cmd->scmd.reply_buf = cmd->pdata;
+        cmd->scmd.reply_len = 0x10;
+        cmd->scmd.data_buf = (u8 *)(char *)&cmd->info;
+        cmd->scmd.status = 1;
+        cmd->stage = 0;
+        cmd->pdata[0] = 0xff;
+        cmd->retries = 20;
+        cmd->status = 1;
+
+        /* Check transfer type, sanitize some "info" fields
+         * based on transfer type and do more checking
+         */
+        cmd->info.caddr = cmd->info.devaddr;
+        cmd->read = cmd->info.devaddr & 0x01;
+        switch(cmd->info.type) {
+        case SMU_I2C_TRANSFER_SIMPLE:
+                memset(&cmd->info.sublen, 0, 4);
+                break;
+        case SMU_I2C_TRANSFER_COMBINED:
+                cmd->info.devaddr &= 0xfe;
+        case SMU_I2C_TRANSFER_STDSUB:
+                if (cmd->info.sublen > 3)
+                        return -EINVAL;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        /* Finish setting up command based on transfer direction
+         */
+        if (cmd->read) {
+                if (cmd->info.datalen > SMU_I2C_READ_MAX)
+                        return -EINVAL;
+                memset(cmd->info.data, 0xff, cmd->info.datalen);
+                cmd->scmd.data_len = 9;
+        } else {
+                if (cmd->info.datalen > SMU_I2C_WRITE_MAX)
+                        return -EINVAL;
+                cmd->scmd.data_len = 9 + cmd->info.datalen;
+        }
+
+        DPRINTK("SMU: i2c enqueuing command\n");
+        DPRINTK("SMU:   %s, len=%d bus=%x addr=%x sub0=%x type=%x\n",
+                cmd->read ? "read" : "write", cmd->info.datalen,
+                cmd->info.bus, cmd->info.caddr,
+                cmd->info.subaddr[0], cmd->info.type);
+
+
+        /* Enqueue command in i2c list, and if empty, enqueue also in
+         * main command list
+         */
+        spin_lock_irqsave(&smu->lock, flags);
+        if (smu->cmd_i2c_cur == NULL) {
+                smu->cmd_i2c_cur = cmd;
+                list_add_tail(&cmd->scmd.link, &smu->cmd_list);
+                if (smu->cmd_cur == NULL)
+                        smu_start_cmd();
+        } else
+                list_add_tail(&cmd->link, &smu->cmd_i2c_list);
+        spin_unlock_irqrestore(&smu->lock, flags);
+
+        return 0;
+}
+
+
+
+/*
+ * Userland driver interface
+ */
+
+
+static LIST_HEAD(smu_clist);
+static DEFINE_SPINLOCK(smu_clist_lock);
+
+enum smu_file_mode {
+        smu_file_commands,
+        smu_file_events,
+        smu_file_closing
+};
+
+struct smu_private
+{
+        struct list_head        list;
+        enum smu_file_mode      mode;
+        int                     busy;
+        struct smu_cmd          cmd;
+        spinlock_t              lock;
+        wait_queue_head_t       wait;
+        u8                      buffer[SMU_MAX_DATA];
+};
+
+
+static int smu_open(struct inode *inode, struct file *file)
+{
+        struct smu_private *pp;
+        unsigned long flags;
+
+        pp = kmalloc(sizeof(struct smu_private), GFP_KERNEL);
+        if (pp == 0)
+                return -ENOMEM;
+        memset(pp, 0, sizeof(struct smu_private));
+        spin_lock_init(&pp->lock);
+        pp->mode = smu_file_commands;
+        init_waitqueue_head(&pp->wait);
+
+        spin_lock_irqsave(&smu_clist_lock, flags);
+        list_add(&pp->list, &smu_clist);
+        spin_unlock_irqrestore(&smu_clist_lock, flags);
+        file->private_data = pp;
+
+        return 0;
+}
+
+
+static void smu_user_cmd_done(struct smu_cmd *cmd, void *misc)
+{
+        struct smu_private *pp = misc;
+
+        wake_up_all(&pp->wait);
+}
+
+
+static ssize_t smu_write(struct file *file, const char __user *buf,
+                         size_t count, loff_t *ppos)
+{
+        struct smu_private *pp = file->private_data;
+        unsigned long flags;
+        struct smu_user_cmd_hdr hdr;
+        int rc = 0;
+
+        if (pp->busy)
+                return -EBUSY;
+        else if (copy_from_user(&hdr, buf, sizeof(hdr)))
+                return -EFAULT;
+        else if (hdr.cmdtype == SMU_CMDTYPE_WANTS_EVENTS) {
+                pp->mode = smu_file_events;
+                return 0;
+        } else if (hdr.cmdtype != SMU_CMDTYPE_SMU)
+                return -EINVAL;
+        else if (pp->mode != smu_file_commands)
+                return -EBADFD;
+        else if (hdr.data_len > SMU_MAX_DATA)
+                return -EINVAL;
+
+        spin_lock_irqsave(&pp->lock, flags);
+        if (pp->busy) {
+                spin_unlock_irqrestore(&pp->lock, flags);
+                return -EBUSY;
+        }
+        pp->busy = 1;
+        pp->cmd.status = 1;
+        spin_unlock_irqrestore(&pp->lock, flags);
+
+        if (copy_from_user(pp->buffer, buf + sizeof(hdr), hdr.data_len)) {
+                pp->busy = 0;
+                return -EFAULT;
+        }
+
+        pp->cmd.cmd = hdr.cmd;
+        pp->cmd.data_len = hdr.data_len;
+        pp->cmd.reply_len = SMU_MAX_DATA;
+        pp->cmd.data_buf = pp->buffer;
+        pp->cmd.reply_buf = pp->buffer;
+        pp->cmd.done = smu_user_cmd_done;
+        pp->cmd.misc = pp;
+        rc = smu_queue_cmd(&pp->cmd);
+        if (rc < 0)
+                return rc;
+        return count;
+}
+
+
+static ssize_t smu_read_command(struct file *file, struct smu_private *pp,
+                                char __user *buf, size_t count)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        struct smu_user_reply_hdr hdr;
+        unsigned long flags;
+        int size, rc = 0;
+
+        if (!pp->busy)
+                return 0;
+        if (count < sizeof(struct smu_user_reply_hdr))
+                return -EOVERFLOW;
+        spin_lock_irqsave(&pp->lock, flags);
+        if (pp->cmd.status == 1) {
+                if (file->f_flags & O_NONBLOCK)
+                        return -EAGAIN;
+                add_wait_queue(&pp->wait, &wait);
+                for (;;) {
+                        set_current_state(TASK_INTERRUPTIBLE);
+                        rc = 0;
+                        if (pp->cmd.status != 1)
+                                break;
+                        rc = -ERESTARTSYS;
+                        if (signal_pending(current))
+                                break;
+                        spin_unlock_irqrestore(&pp->lock, flags);
+                        schedule();
+                        spin_lock_irqsave(&pp->lock, flags);
+                }
+                set_current_state(TASK_RUNNING);
+                remove_wait_queue(&pp->wait, &wait);
+        }
+        spin_unlock_irqrestore(&pp->lock, flags);
+        if (rc)
+                return rc;
+        if (pp->cmd.status != 0)
+                pp->cmd.reply_len = 0;
+        size = sizeof(hdr) + pp->cmd.reply_len;
+        if (count < size)
+                size = count;
+        rc = size;
+        hdr.status = pp->cmd.status;
+        hdr.reply_len = pp->cmd.reply_len;
+        if (copy_to_user(buf, &hdr, sizeof(hdr)))
+                return -EFAULT;
+        size -= sizeof(hdr);
+        if (size && copy_to_user(buf + sizeof(hdr), pp->buffer, size))
+                return -EFAULT;
+        pp->busy = 0;
+
+        return rc;
+}
+
+
+static ssize_t smu_read_events(struct file *file, struct smu_private *pp,
+                               char __user *buf, size_t count)
+{
+        /* Not implemented */
+        msleep_interruptible(1000);
+        return 0;
+}
+
+
+static ssize_t smu_read(struct file *file, char __user *buf,
+                        size_t count, loff_t *ppos)
+{
+        struct smu_private *pp = file->private_data;
+
+        if (pp->mode == smu_file_commands)
+                return smu_read_command(file, pp, buf, count);
+        if (pp->mode == smu_file_events)
+                return smu_read_events(file, pp, buf, count);
+
+        return -EBADFD;
+}
+
+static unsigned int smu_fpoll(struct file *file, poll_table *wait)
+{
+        struct smu_private *pp = file->private_data;
+        unsigned int mask = 0;
+        unsigned long flags;
+
+        if (pp == 0)
+                return 0;
+
+        if (pp->mode == smu_file_commands) {
+                poll_wait(file, &pp->wait, wait);
+
+                spin_lock_irqsave(&pp->lock, flags);
+                if (pp->busy && pp->cmd.status != 1)
+                        mask |= POLLIN;
+                spin_unlock_irqrestore(&pp->lock, flags);
+        } if (pp->mode == smu_file_events) {
+                /* Not yet implemented */
+        }
+        return mask;
+}
+
+static int smu_release(struct inode *inode, struct file *file)
+{
+        struct smu_private *pp = file->private_data;
+        unsigned long flags;
+        unsigned int busy;
+
+        if (pp == 0)
+                return 0;
+
+        file->private_data = NULL;
+
+        /* Mark file as closing to avoid races with new request */
+        spin_lock_irqsave(&pp->lock, flags);
+        pp->mode = smu_file_closing;
+        busy = pp->busy;
+
+        /* Wait for any pending request to complete */
+        if (busy && pp->cmd.status == 1) {
+                DECLARE_WAITQUEUE(wait, current);
+
+                add_wait_queue(&pp->wait, &wait);
+                for (;;) {
+                        set_current_state(TASK_UNINTERRUPTIBLE);
+                        if (pp->cmd.status != 1)
+                                break;
+                        spin_lock_irqsave(&pp->lock, flags);
+                        schedule();
+                        spin_unlock_irqrestore(&pp->lock, flags);
+                }
+                set_current_state(TASK_RUNNING);
+                remove_wait_queue(&pp->wait, &wait);
+        }
+        spin_unlock_irqrestore(&pp->lock, flags);
+
+        spin_lock_irqsave(&smu_clist_lock, flags);
+        list_del(&pp->list);
+        spin_unlock_irqrestore(&smu_clist_lock, flags);
+        kfree(pp);
+
+        return 0;
+}
+
+
+static struct file_operations smu_device_fops __pmacdata = {
+        .llseek         = no_llseek,
+        .read           = smu_read,
+        .write          = smu_write,
+        .poll           = smu_fpoll,
+        .open           = smu_open,
+        .release        = smu_release,
+};
+
+static struct miscdevice pmu_device __pmacdata = {
+        MISC_DYNAMIC_MINOR, "smu", &smu_device_fops
+};
+
+static int smu_device_init(void)
+{
+        if (!smu)
+                return -ENODEV;
+        if (misc_register(&pmu_device) < 0)
+                printk(KERN_ERR "via-pmu: cannot register misc device.\n");
+        return 0;
+}
+device_initcall(smu_device_init);
diff --git a/drivers/macintosh/therm_adt746x.c b/drivers/macintosh/therm_adt746x.c
index c9ca1118e449..f38696622eb4 100644
--- a/drivers/macintosh/therm_adt746x.c
+++ b/drivers/macintosh/therm_adt746x.c
@@ -599,7 +599,7 @@ thermostat_init(void)
                 sensor_location[2] = "?";
         }
 
-        of_dev = of_platform_device_create(np, "temperatures");
+        of_dev = of_platform_device_create(np, "temperatures", NULL);
         
         if (of_dev == NULL) {
                 printk(KERN_ERR "Can't register temperatures device !\n");
diff --git a/drivers/macintosh/therm_pm72.c b/drivers/macintosh/therm_pm72.c
index 703e31973314..cc507ceef153 100644
--- a/drivers/macintosh/therm_pm72.c
+++ b/drivers/macintosh/therm_pm72.c
@@ -2051,7 +2051,7 @@ static int __init therm_pm72_init(void)
                             return -ENODEV;
                 }
         }
-        of_dev = of_platform_device_create(np, "temperature");
+        of_dev = of_platform_device_create(np, "temperature", NULL);
         if (of_dev == NULL) {
                 printk(KERN_ERR "Can't register FCU platform device !\n");
                 return -ENODEV;
diff --git a/drivers/macintosh/therm_windtunnel.c b/drivers/macintosh/therm_windtunnel.c
index cbb72eb0426d..6aaa1df1a64e 100644
--- a/drivers/macintosh/therm_windtunnel.c
+++ b/drivers/macintosh/therm_windtunnel.c
@@ -504,7 +504,7 @@ g4fan_init( void )
         }
         if( !(np=of_find_node_by_name(NULL, "fan")) )
                 return -ENODEV;
-        x.of_dev = of_platform_device_create( np, "temperature" );
+        x.of_dev = of_platform_device_create(np, "temperature", NULL);
         of_node_put( np );
 
         if( !x.of_dev ) {
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 200a0688f717..54ec737195e0 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -230,11 +230,20 @@ static int dm_hash_insert(const char *name, const char *uuid, struct mapped_devi
 
 static void __hash_remove(struct hash_cell *hc)
 {
+        struct dm_table *table;
+
         /* remove from the dev hash */
         list_del(&hc->uuid_list);
         list_del(&hc->name_list);
         unregister_with_devfs(hc);
         dm_set_mdptr(hc->md, NULL);
+
+        table = dm_get_table(hc->md);
+        if (table) {
+                dm_table_event(table);
+                dm_table_put(table);
+        }
+
         dm_put(hc->md);
         if (hc->new_map)
                 dm_table_put(hc->new_map);
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 785806bdb248..f9b7b32d5d5c 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -329,13 +329,17 @@ static int map_io(struct multipath *m, struct bio *bio, struct mpath_io *mpio,
 /*
  * If we run out of usable paths, should we queue I/O or error it?
  */
-static int queue_if_no_path(struct multipath *m, unsigned queue_if_no_path)
+static int queue_if_no_path(struct multipath *m, unsigned queue_if_no_path,
+                            unsigned save_old_value)
 {
         unsigned long flags;
 
         spin_lock_irqsave(&m->lock, flags);
 
-        m->saved_queue_if_no_path = m->queue_if_no_path;
+        if (save_old_value)
+                m->saved_queue_if_no_path = m->queue_if_no_path;
+        else
+                m->saved_queue_if_no_path = queue_if_no_path;
         m->queue_if_no_path = queue_if_no_path;
         if (!m->queue_if_no_path && m->queue_size)
                 queue_work(kmultipathd, &m->process_queued_ios);
@@ -677,7 +681,7 @@ static int parse_features(struct arg_set *as, struct multipath *m,
                 return 0;
 
         if (!strnicmp(shift(as), MESG_STR("queue_if_no_path")))
-                return queue_if_no_path(m, 1);
+                return queue_if_no_path(m, 1, 0);
         else {
                 ti->error = "Unrecognised multipath feature request";
                 return -EINVAL;
@@ -1077,7 +1081,7 @@ static void multipath_presuspend(struct dm_target *ti)
 {
         struct multipath *m = (struct multipath *) ti->private;
 
-        queue_if_no_path(m, 0);
+        queue_if_no_path(m, 0, 1);
 }
 
 /*
@@ -1222,9 +1226,9 @@ static int multipath_message(struct dm_target *ti, unsigned argc, char **argv)
 
         if (argc == 1) {
                 if (!strnicmp(argv[0], MESG_STR("queue_if_no_path")))
-                        return queue_if_no_path(m, 1);
+                        return queue_if_no_path(m, 1, 0);
                 else if (!strnicmp(argv[0], MESG_STR("fail_if_no_path")))
-                        return queue_if_no_path(m, 0);
+                        return queue_if_no_path(m, 0, 0);
         }
 
         if (argc != 2)
diff --git a/drivers/md/raid6.h b/drivers/md/raid6.h
index f80ee6350edf..31cbee71365f 100644
--- a/drivers/md/raid6.h
+++ b/drivers/md/raid6.h
@@ -69,9 +69,13 @@ extern const char raid6_empty_zero_page[PAGE_SIZE];
 #define __init
 #define __exit
 #define __attribute_const__ __attribute__((const))
+#define noinline __attribute__((noinline))
 
 #define preempt_enable()
 #define preempt_disable()
+#define cpu_has_feature(x) 1
+#define enable_kernel_altivec()
+#define disable_kernel_altivec()
 
 #endif /* __KERNEL__ */
 
diff --git a/drivers/md/raid6algos.c b/drivers/md/raid6algos.c
index acf386fc4b4f..51c63c0cf1c9 100644
--- a/drivers/md/raid6algos.c
+++ b/drivers/md/raid6algos.c
@@ -19,6 +19,7 @@
 #include "raid6.h"
 #ifndef __KERNEL__
 #include <sys/mman.h>
+#include <stdio.h>
 #endif
 
 struct raid6_calls raid6_call;
diff --git a/drivers/md/raid6altivec.uc b/drivers/md/raid6altivec.uc
index 1de8f030eee0..b9afd35b8812 100644
--- a/drivers/md/raid6altivec.uc
+++ b/drivers/md/raid6altivec.uc
@@ -27,16 +27,20 @@
 #ifdef CONFIG_ALTIVEC
 
 #include <altivec.h>
-#include <asm/system.h>
-#include <asm/cputable.h>
+#ifdef __KERNEL__
+# include <asm/system.h>
+# include <asm/cputable.h>
+#endif
 
 /*
- * This is the C data type to use
+ * This is the C data type to use.  We use a vector of
+ * signed char so vec_cmpgt() will generate the right
+ * instruction.
  */
 
-typedef vector unsigned char unative_t;
+typedef vector signed char unative_t;
 
-#define NBYTES(x) ((vector unsigned char) {x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x})
+#define NBYTES(x) ((vector signed char) {x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x})
 #define NSIZE   sizeof(unative_t)
 
 /*
@@ -108,7 +112,11 @@ int raid6_have_altivec(void);
 int raid6_have_altivec(void)
 {
         /* This assumes either all CPUs have Altivec or none does */
+# ifdef __KERNEL__
         return cpu_has_feature(CPU_FTR_ALTIVEC);
+# else
+        return 1;
+# endif
 }
 #endif
 
diff --git a/drivers/md/raid6test/Makefile b/drivers/md/raid6test/Makefile
index 557806728609..78e0396adf2a 100644
--- a/drivers/md/raid6test/Makefile
+++ b/drivers/md/raid6test/Makefile
@@ -8,6 +8,8 @@ OPTFLAGS = -O2			# Adjust as desired
 CFLAGS   = -I.. -g $(OPTFLAGS)
 LD       = ld
 PERL     = perl
+AR       = ar
+RANLIB   = ranlib
 
 .c.o:
         $(CC) $(CFLAGS) -c -o $@ $<
@@ -18,18 +20,33 @@ PERL	 = perl
 %.uc: ../%.uc
         cp -f $< $@
 
-all:    raid6.o raid6test
+all:    raid6.a raid6test
 
-raid6.o: raid6int1.o raid6int2.o raid6int4.o raid6int8.o raid6int16.o \
+raid6.a: raid6int1.o raid6int2.o raid6int4.o raid6int8.o raid6int16.o \
          raid6int32.o \
          raid6mmx.o raid6sse1.o raid6sse2.o \
+         raid6altivec1.o raid6altivec2.o raid6altivec4.o raid6altivec8.o \
          raid6recov.o raid6algos.o \
          raid6tables.o
-        $(LD) -r -o $@ $^
+         rm -f $@
+         $(AR) cq $@ $^
+         $(RANLIB) $@
 
-raid6test: raid6.o test.c
+raid6test: test.c raid6.a
         $(CC) $(CFLAGS) -o raid6test $^
 
+raid6altivec1.c: raid6altivec.uc ../unroll.pl
+        $(PERL) ../unroll.pl 1 < raid6altivec.uc > $@
+
+raid6altivec2.c: raid6altivec.uc ../unroll.pl
+        $(PERL) ../unroll.pl 2 < raid6altivec.uc > $@
+
+raid6altivec4.c: raid6altivec.uc ../unroll.pl
+        $(PERL) ../unroll.pl 4 < raid6altivec.uc > $@
+
+raid6altivec8.c: raid6altivec.uc ../unroll.pl
+        $(PERL) ../unroll.pl 8 < raid6altivec.uc > $@
+
 raid6int1.c: raid6int.uc ../unroll.pl
         $(PERL) ../unroll.pl 1 < raid6int.uc > $@
 
@@ -52,7 +69,7 @@ raid6tables.c: mktables
         ./mktables > raid6tables.c
 
 clean:
-        rm -f *.o mktables mktables.c raid6int.uc raid6*.c raid6test
+        rm -f *.o *.a mktables mktables.c raid6int.uc raid6*.c raid6test
 
 spotless: clean
         rm -f *~
diff --git a/drivers/media/dvb/frontends/tda10021.c b/drivers/media/dvb/frontends/tda10021.c
index 87d5f4d8790f..eaf130e666d8 100644
--- a/drivers/media/dvb/frontends/tda10021.c
+++ b/drivers/media/dvb/frontends/tda10021.c
@@ -100,8 +100,8 @@ static u8 tda10021_readreg (struct tda10021_state* state, u8 reg)
 
         ret = i2c_transfer (state->i2c, msg, 2);
         if (ret != 2)
-                printk("DVB: TDA10021(%d): %s: readreg error (ret == %i)\n",
-                                state->frontend.dvb->num, __FUNCTION__, ret);
+                printk("DVB: TDA10021: %s: readreg error (ret == %i)\n",
+                                __FUNCTION__, ret);
         return b1[0];
 }
 
diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c
index 8b4ad70dd1b2..877c770558e9 100644
--- a/drivers/media/radio/radio-aimslab.c
+++ b/drivers/media/radio/radio-aimslab.c
@@ -29,7 +29,7 @@
 
 #include <linux/module.h>       /* Modules                      */
 #include <linux/init.h>         /* Initdata                     */
-#include <linux/ioport.h>       /* check_region, request_region */
+#include <linux/ioport.h>       /* request_region               */
 #include <linux/delay.h>        /* udelay                       */
 #include <asm/io.h>             /* outb, outb_p                 */
 #include <asm/uaccess.h>        /* copy to/from user            */
diff --git a/drivers/media/radio/radio-aztech.c b/drivers/media/radio/radio-aztech.c
index 013c835ed910..5319a9c9a979 100644
--- a/drivers/media/radio/radio-aztech.c
+++ b/drivers/media/radio/radio-aztech.c
@@ -26,7 +26,7 @@
 
 #include <linux/module.h>       /* Modules                      */
 #include <linux/init.h>         /* Initdata                     */
-#include <linux/ioport.h>       /* check_region, request_region */
+#include <linux/ioport.h>       /* request_region               */
 #include <linux/delay.h>        /* udelay                       */
 #include <asm/io.h>             /* outb, outb_p                 */
 #include <asm/uaccess.h>        /* copy to/from user            */
diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
index 53d399b6652b..022913da8c59 100644
--- a/drivers/media/radio/radio-cadet.c
+++ b/drivers/media/radio/radio-cadet.c
@@ -29,7 +29,7 @@
 
 #include <linux/module.h>       /* Modules                      */
 #include <linux/init.h>         /* Initdata                     */
-#include <linux/ioport.h>       /* check_region, request_region */
+#include <linux/ioport.h>       /* request_region               */
 #include <linux/delay.h>        /* udelay                       */
 #include <asm/io.h>             /* outb, outb_p                 */
 #include <asm/uaccess.h>        /* copy to/from user            */
diff --git a/drivers/media/radio/radio-gemtek.c b/drivers/media/radio/radio-gemtek.c
index 202bfe6819b8..6418f03b9ce4 100644
--- a/drivers/media/radio/radio-gemtek.c
+++ b/drivers/media/radio/radio-gemtek.c
@@ -17,7 +17,7 @@
 
 #include <linux/module.h>       /* Modules                      */
 #include <linux/init.h>         /* Initdata                     */
-#include <linux/ioport.h>       /* check_region, request_region */
+#include <linux/ioport.h>       /* request_region               */
 #include <linux/delay.h>        /* udelay                       */
 #include <asm/io.h>             /* outb, outb_p                 */
 #include <asm/uaccess.h>        /* copy to/from user            */
diff --git a/drivers/media/radio/radio-rtrack2.c b/drivers/media/radio/radio-rtrack2.c
index c00245d4d249..b2256d675b44 100644
--- a/drivers/media/radio/radio-rtrack2.c
+++ b/drivers/media/radio/radio-rtrack2.c
@@ -10,7 +10,7 @@
 
 #include <linux/module.h>       /* Modules                      */
 #include <linux/init.h>         /* Initdata                     */
-#include <linux/ioport.h>       /* check_region, request_region */
+#include <linux/ioport.h>       /* request_region               */
 #include <linux/delay.h>        /* udelay                       */
 #include <asm/io.h>             /* outb, outb_p                 */
 #include <asm/uaccess.h>        /* copy to/from user            */
diff --git a/drivers/media/radio/radio-sf16fmi.c b/drivers/media/radio/radio-sf16fmi.c
index 3a464a09221f..6f03ce4dd7b0 100644
--- a/drivers/media/radio/radio-sf16fmi.c
+++ b/drivers/media/radio/radio-sf16fmi.c
@@ -18,7 +18,7 @@
 #include <linux/kernel.h>       /* __setup                      */
 #include <linux/module.h>       /* Modules                      */
 #include <linux/init.h>         /* Initdata                     */
-#include <linux/ioport.h>       /* check_region, request_region */
+#include <linux/ioport.h>       /* request_region               */
 #include <linux/delay.h>        /* udelay                       */
 #include <linux/videodev.h>     /* kernel radio structs         */
 #include <linux/isapnp.h>
diff --git a/drivers/media/radio/radio-sf16fmr2.c b/drivers/media/radio/radio-sf16fmr2.c
index 0732efda6a98..71971e9bb342 100644
--- a/drivers/media/radio/radio-sf16fmr2.c
+++ b/drivers/media/radio/radio-sf16fmr2.c
@@ -14,7 +14,7 @@
 
 #include <linux/module.h>       /* Modules                      */
 #include <linux/init.h>         /* Initdata                     */
-#include <linux/ioport.h>       /* check_region, request_region */
+#include <linux/ioport.h>       /* request_region               */
 #include <linux/delay.h>        /* udelay                       */
 #include <asm/io.h>             /* outb, outb_p                 */
 #include <asm/uaccess.h>        /* copy to/from user            */
diff --git a/drivers/media/radio/radio-terratec.c b/drivers/media/radio/radio-terratec.c
index 248d67fde037..b03573c6840e 100644
--- a/drivers/media/radio/radio-terratec.c
+++ b/drivers/media/radio/radio-terratec.c
@@ -25,7 +25,7 @@
 
 #include <linux/module.h>       /* Modules                      */
 #include <linux/init.h>         /* Initdata                     */
-#include <linux/ioport.h>       /* check_region, request_region */
+#include <linux/ioport.h>       /* request_region               */
 #include <linux/delay.h>        /* udelay                       */
 #include <asm/io.h>             /* outb, outb_p                 */
 #include <asm/uaccess.h>        /* copy to/from user            */
diff --git a/drivers/media/radio/radio-typhoon.c b/drivers/media/radio/radio-typhoon.c
index d7da901ebe90..f304f3c14763 100644
--- a/drivers/media/radio/radio-typhoon.c
+++ b/drivers/media/radio/radio-typhoon.c
@@ -31,7 +31,7 @@
 
 #include <linux/module.h>       /* Modules                        */
 #include <linux/init.h>         /* Initdata                       */
-#include <linux/ioport.h>       /* check_region, request_region   */
+#include <linux/ioport.h>       /* request_region                 */
 #include <linux/proc_fs.h>      /* radio card status report       */
 #include <asm/io.h>             /* outb, outb_p                   */
 #include <asm/uaccess.h>        /* copy to/from user              */
diff --git a/drivers/media/radio/radio-zoltrix.c b/drivers/media/radio/radio-zoltrix.c
index 342f92df4aba..4c6d6fb49034 100644
--- a/drivers/media/radio/radio-zoltrix.c
+++ b/drivers/media/radio/radio-zoltrix.c
@@ -28,7 +28,7 @@
 
 #include <linux/module.h>       /* Modules                        */
 #include <linux/init.h>         /* Initdata                       */
-#include <linux/ioport.h>       /* check_region, request_region   */
+#include <linux/ioport.h>       /* request_region                 */
 #include <linux/delay.h>        /* udelay, msleep                 */
 #include <asm/io.h>             /* outb, outb_p                   */
 #include <asm/uaccess.h>        /* copy to/from user              */
diff --git a/drivers/media/video/bttv-cards.c b/drivers/media/video/bttv-cards.c
index 190977a1e549..6c332800d6ab 100644
--- a/drivers/media/video/bttv-cards.c
+++ b/drivers/media/video/bttv-cards.c
@@ -2398,7 +2398,7 @@ struct tvcard bttv_tvcards[] = {
         .svhs           = 2,
         .muxsel         = { 2, 3 },
         .gpiomask       = 0x00e00007,
-        .audiomux       = { 0x00400005, 0, 0, 0, 0, 0 },
+        .audiomux       = { 0x00400005, 0, 0x00000001, 0, 0x00c00007, 0 },
         .no_msp34xx     = 1,
         .no_tda9875     = 1,
         .no_tda7432     = 1,
diff --git a/drivers/media/video/bttv-driver.c b/drivers/media/video/bttv-driver.c
index a564321db2f0..c062a017491e 100644
--- a/drivers/media/video/bttv-driver.c
+++ b/drivers/media/video/bttv-driver.c
@@ -763,21 +763,21 @@ static void set_pll(struct bttv *btv)
                 /* no PLL needed */
                 if (btv->pll.pll_current == 0)
                         return;
-                vprintk(KERN_INFO "bttv%d: PLL can sleep, using XTAL (%d).\n",
-                        btv->c.nr,btv->pll.pll_ifreq);
+                bttv_printk(KERN_INFO "bttv%d: PLL can sleep, using XTAL (%d).\n",
+                           btv->c.nr,btv->pll.pll_ifreq);
                 btwrite(0x00,BT848_TGCTRL);
                 btwrite(0x00,BT848_PLL_XCI);
                 btv->pll.pll_current = 0;
                 return;
         }
 
-        vprintk(KERN_INFO "bttv%d: PLL: %d => %d ",btv->c.nr,
-                btv->pll.pll_ifreq, btv->pll.pll_ofreq);
+        bttv_printk(KERN_INFO "bttv%d: PLL: %d => %d ",btv->c.nr,
+                   btv->pll.pll_ifreq, btv->pll.pll_ofreq);
         set_pll_freq(btv, btv->pll.pll_ifreq, btv->pll.pll_ofreq);
 
         for (i=0; i<10; i++) {
                 /*  Let other people run while the PLL stabilizes */
-                vprintk(".");
+                bttv_printk(".");
                 msleep(10);
 
                 if (btread(BT848_DSTATUS) & BT848_DSTATUS_PLOCK) {
@@ -785,12 +785,12 @@ static void set_pll(struct bttv *btv)
                 } else {
                         btwrite(0x08,BT848_TGCTRL);
                         btv->pll.pll_current = btv->pll.pll_ofreq;
-                        vprintk(" ok\n");
+                        bttv_printk(" ok\n");
                         return;
                 }
         }
         btv->pll.pll_current = -1;
-        vprintk("failed\n");
+        bttv_printk("failed\n");
         return;
 }
 
diff --git a/drivers/media/video/bttvp.h b/drivers/media/video/bttvp.h
index 9b0b7ca035f8..7a312f79340a 100644
--- a/drivers/media/video/bttvp.h
+++ b/drivers/media/video/bttvp.h
@@ -221,7 +221,7 @@ extern void bttv_gpio_tracking(struct bttv *btv, char *comment);
 extern int init_bttv_i2c(struct bttv *btv);
 extern int fini_bttv_i2c(struct bttv *btv);
 
-#define vprintk  if (bttv_verbose) printk
+#define bttv_printk if (bttv_verbose) printk
 #define dprintk  if (bttv_debug >= 1) printk
 #define d2printk if (bttv_debug >= 2) printk
 
diff --git a/drivers/media/video/cpia.c b/drivers/media/video/cpia.c
index 8c08b7f1ad23..b7ec9bf45085 100644
--- a/drivers/media/video/cpia.c
+++ b/drivers/media/video/cpia.c
@@ -1397,7 +1397,7 @@ static void destroy_proc_cpia_cam(struct cam_data *cam)
 
 static void proc_cpia_create(void)
 {
-        cpia_proc_root = create_proc_entry("cpia", S_IFDIR, NULL);
+        cpia_proc_root = proc_mkdir("cpia", NULL);
 
         if (cpia_proc_root)
                 cpia_proc_root->owner = THIS_MODULE;
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index c9106b1d79df..4334744652de 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -221,9 +221,7 @@ static int lgdt330x_pll_set(struct dvb_frontend* fe,
         int err;
 
         /* Put the analog decoder in standby to keep it quiet */
-        if (core->tda9887_conf) {
-                cx88_call_i2c_clients (dev->core, TUNER_SET_STANDBY, NULL);
-        }
+        cx88_call_i2c_clients (dev->core, TUNER_SET_STANDBY, NULL);
 
         dvb_pll_configure(core->pll_desc, buf, params->frequency, 0);
         dprintk(1, "%s: tuner at 0x%02x bytes: 0x%02x 0x%02x 0x%02x 0x%02x\n",
@@ -402,6 +400,9 @@ static int dvb_register(struct cx8802_dev *dev)
                 dev->dvb.frontend->ops->info.frequency_max = dev->core->pll_desc->max;
         }
 
+        /* Put the analog decoder in standby to keep it quiet */
+        cx88_call_i2c_clients (dev->core, TUNER_SET_STANDBY, NULL);
+
         /* register everything */
         return videobuf_dvb_register(&dev->dvb, THIS_MODULE, dev);
 }
diff --git a/drivers/media/video/rds.h b/drivers/media/video/rds.h
index 30337d0f1a87..0d30eb744e61 100644
--- a/drivers/media/video/rds.h
+++ b/drivers/media/video/rds.h
@@ -31,7 +31,7 @@
 struct rds_command {
         unsigned int  block_count;
         int           result;
-        unsigned char *buffer;
+        unsigned char __user *buffer;
         struct file   *instance;
         poll_table    *event_list;
 };
diff --git a/drivers/media/video/saa6588.c b/drivers/media/video/saa6588.c
index 1a657a70ff43..72b70eb5da1d 100644
--- a/drivers/media/video/saa6588.c
+++ b/drivers/media/video/saa6588.c
@@ -157,7 +157,7 @@ static struct i2c_client client_template;
 
 /* ---------------------------------------------------------------------- */
 
-static int block_to_user_buf(struct saa6588 *s, unsigned char *user_buf)
+static int block_to_user_buf(struct saa6588 *s, unsigned char __user *user_buf)
 {
         int i;
 
@@ -191,7 +191,7 @@ static void read_from_buf(struct saa6588 *s, struct rds_command *a)
 {
         unsigned long flags;
 
-        unsigned char *buf_ptr = a->buffer;     /* This is a user space buffer! */
+        unsigned char __user *buf_ptr = a->buffer;
         unsigned int i;
         unsigned int rd_blocks;
 
diff --git a/drivers/message/fusion/Kconfig b/drivers/message/fusion/Kconfig
index 33f209a39cb6..1883d22cffeb 100644
--- a/drivers/message/fusion/Kconfig
+++ b/drivers/message/fusion/Kconfig
@@ -35,6 +35,23 @@ config FUSION_FC
           LSIFC929X
           LSIFC929XL
 
+config FUSION_SAS
+        tristate "Fusion MPT ScsiHost drivers for SAS"
+        depends on PCI && SCSI
+        select FUSION
+        select SCSI_SAS_ATTRS
+        ---help---
+          SCSI HOST support for a SAS host adapters.
+
+          List of supported controllers:
+
+          LSISAS1064
+          LSISAS1066
+          LSISAS1068
+          LSISAS1064E
+          LSISAS1066E
+          LSISAS1068E
+
 config FUSION_MAX_SGE
         int "Maximum number of scatter gather entries (16 - 128)"
         depends on FUSION
diff --git a/drivers/message/fusion/Makefile b/drivers/message/fusion/Makefile
index 1d2f9db813c1..8a2e2657f4c2 100644
--- a/drivers/message/fusion/Makefile
+++ b/drivers/message/fusion/Makefile
@@ -34,5 +34,6 @@
 
 obj-$(CONFIG_FUSION_SPI)        += mptbase.o mptscsih.o mptspi.o
 obj-$(CONFIG_FUSION_FC)         += mptbase.o mptscsih.o mptfc.o
+obj-$(CONFIG_FUSION_SAS)        += mptbase.o mptscsih.o mptsas.o
 obj-$(CONFIG_FUSION_CTL)        += mptctl.o
 obj-$(CONFIG_FUSION_LAN)        += mptlan.o
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index f517d0692d5f..790a2932ded9 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -135,13 +135,12 @@ static void	mpt_adapter_dispose(MPT_ADAPTER *ioc);
 
 static void     MptDisplayIocCapabilities(MPT_ADAPTER *ioc);
 static int      MakeIocReady(MPT_ADAPTER *ioc, int force, int sleepFlag);
-//static u32    mpt_GetIocState(MPT_ADAPTER *ioc, int cooked);
 static int      GetIocFacts(MPT_ADAPTER *ioc, int sleepFlag, int reason);
 static int      GetPortFacts(MPT_ADAPTER *ioc, int portnum, int sleepFlag);
 static int      SendIocInit(MPT_ADAPTER *ioc, int sleepFlag);
 static int      SendPortEnable(MPT_ADAPTER *ioc, int portnum, int sleepFlag);
 static int      mpt_do_upload(MPT_ADAPTER *ioc, int sleepFlag);
-static int      mpt_downloadboot(MPT_ADAPTER *ioc, int sleepFlag);
+static int      mpt_downloadboot(MPT_ADAPTER *ioc, MpiFwHeader_t *pFwHeader, int sleepFlag);
 static int      mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag);
 static int      KickStart(MPT_ADAPTER *ioc, int ignore, int sleepFlag);
 static int      SendIocReset(MPT_ADAPTER *ioc, u8 reset_type, int sleepFlag);
@@ -152,6 +151,7 @@ static int	WaitForDoorbellReply(MPT_ADAPTER *ioc, int howlong, int sleepFlag);
 static int      GetLanConfigPages(MPT_ADAPTER *ioc);
 static int      GetFcPortPage0(MPT_ADAPTER *ioc, int portnum);
 static int      GetIoUnitPage2(MPT_ADAPTER *ioc);
+int             mptbase_sas_persist_operation(MPT_ADAPTER *ioc, u8 persist_opcode);
 static int      mpt_GetScsiPortSettings(MPT_ADAPTER *ioc, int portnum);
 static int      mpt_readScsiDevicePageHeaders(MPT_ADAPTER *ioc, int portnum);
 static void     mpt_read_ioc_pg_1(MPT_ADAPTER *ioc);
@@ -159,6 +159,8 @@ static void 	mpt_read_ioc_pg_4(MPT_ADAPTER *ioc);
 static void     mpt_timer_expired(unsigned long data);
 static int      SendEventNotification(MPT_ADAPTER *ioc, u8 EvSwitch);
 static int      SendEventAck(MPT_ADAPTER *ioc, EventNotificationReply_t *evnp);
+static int      mpt_host_page_access_control(MPT_ADAPTER *ioc, u8 access_control_value, int sleepFlag);
+static int      mpt_host_page_alloc(MPT_ADAPTER *ioc, pIOCInit_t ioc_init);
 
 #ifdef CONFIG_PROC_FS
 static int      procmpt_summary_read(char *buf, char **start, off_t offset,
@@ -175,6 +177,7 @@ static int	ProcessEventNotification(MPT_ADAPTER *ioc, EventNotificationReply_t *
 static void     mpt_sp_ioc_info(MPT_ADAPTER *ioc, u32 ioc_status, MPT_FRAME_HDR *mf);
 static void     mpt_fc_log_info(MPT_ADAPTER *ioc, u32 log_info);
 static void     mpt_sp_log_info(MPT_ADAPTER *ioc, u32 log_info);
+static void     mpt_sas_log_info(MPT_ADAPTER *ioc, u32 log_info);
 
 /* module entry point */
 static int  __init    fusion_init  (void);
@@ -206,6 +209,144 @@ pci_enable_io_access(struct pci_dev *pdev)
         pci_write_config_word(pdev, PCI_COMMAND, command_reg);
 }
 
+/*
+ *  Process turbo (context) reply...
+ */
+static void
+mpt_turbo_reply(MPT_ADAPTER *ioc, u32 pa)
+{
+        MPT_FRAME_HDR *mf = NULL;
+        MPT_FRAME_HDR *mr = NULL;
+        int req_idx = 0;
+        int cb_idx;
+
+        dmfprintk((MYIOC_s_INFO_FMT "Got TURBO reply req_idx=%08x\n",
+                                ioc->name, pa));
+
+        switch (pa >> MPI_CONTEXT_REPLY_TYPE_SHIFT) {
+        case MPI_CONTEXT_REPLY_TYPE_SCSI_INIT:
+                req_idx = pa & 0x0000FFFF;
+                cb_idx = (pa & 0x00FF0000) >> 16;
+                mf = MPT_INDEX_2_MFPTR(ioc, req_idx);
+                break;
+        case MPI_CONTEXT_REPLY_TYPE_LAN:
+                cb_idx = mpt_lan_index;
+                /*
+                 *  Blind set of mf to NULL here was fatal
+                 *  after lan_reply says "freeme"
+                 *  Fix sort of combined with an optimization here;
+                 *  added explicit check for case where lan_reply
+                 *  was just returning 1 and doing nothing else.
+                 *  For this case skip the callback, but set up
+                 *  proper mf value first here:-)
+                 */
+                if ((pa & 0x58000000) == 0x58000000) {
+                        req_idx = pa & 0x0000FFFF;
+                        mf = MPT_INDEX_2_MFPTR(ioc, req_idx);
+                        mpt_free_msg_frame(ioc, mf);
+                        mb();
+                        return;
+                        break;
+                }
+                mr = (MPT_FRAME_HDR *) CAST_U32_TO_PTR(pa);
+                break;
+        case MPI_CONTEXT_REPLY_TYPE_SCSI_TARGET:
+                cb_idx = mpt_stm_index;
+                mr = (MPT_FRAME_HDR *) CAST_U32_TO_PTR(pa);
+                break;
+        default:
+                cb_idx = 0;
+                BUG();
+        }
+
+        /*  Check for (valid) IO callback!  */
+        if (cb_idx < 1 || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS ||
+                        MptCallbacks[cb_idx] == NULL) {
+                printk(MYIOC_s_WARN_FMT "%s: Invalid cb_idx (%d)!\n",
+                                __FUNCTION__, ioc->name, cb_idx);
+                goto out;
+        }
+
+        if (MptCallbacks[cb_idx](ioc, mf, mr))
+                mpt_free_msg_frame(ioc, mf);
+ out:
+        mb();
+}
+
+static void
+mpt_reply(MPT_ADAPTER *ioc, u32 pa)
+{
+        MPT_FRAME_HDR   *mf;
+        MPT_FRAME_HDR   *mr;
+        int              req_idx;
+        int              cb_idx;
+        int              freeme;
+
+        u32 reply_dma_low;
+        u16 ioc_stat;
+
+        /* non-TURBO reply!  Hmmm, something may be up...
+         *  Newest turbo reply mechanism; get address
+         *  via left shift 1 (get rid of MPI_ADDRESS_REPLY_A_BIT)!
+         */
+
+        /* Map DMA address of reply header to cpu address.
+         * pa is 32 bits - but the dma address may be 32 or 64 bits
+         * get offset based only only the low addresses
+         */
+
+        reply_dma_low = (pa <<= 1);
+        mr = (MPT_FRAME_HDR *)((u8 *)ioc->reply_frames +
+                         (reply_dma_low - ioc->reply_frames_low_dma));
+
+        req_idx = le16_to_cpu(mr->u.frame.hwhdr.msgctxu.fld.req_idx);
+        cb_idx = mr->u.frame.hwhdr.msgctxu.fld.cb_idx;
+        mf = MPT_INDEX_2_MFPTR(ioc, req_idx);
+
+        dmfprintk((MYIOC_s_INFO_FMT "Got non-TURBO reply=%p req_idx=%x cb_idx=%x Function=%x\n",
+                        ioc->name, mr, req_idx, cb_idx, mr->u.hdr.Function));
+        DBG_DUMP_REPLY_FRAME(mr)
+
+         /*  Check/log IOC log info
+         */
+        ioc_stat = le16_to_cpu(mr->u.reply.IOCStatus);
+        if (ioc_stat & MPI_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE) {
+                u32      log_info = le32_to_cpu(mr->u.reply.IOCLogInfo);
+                if (ioc->bus_type == FC)
+                        mpt_fc_log_info(ioc, log_info);
+                else if (ioc->bus_type == SCSI)
+                        mpt_sp_log_info(ioc, log_info);
+                else if (ioc->bus_type == SAS)
+                        mpt_sas_log_info(ioc, log_info);
+        }
+        if (ioc_stat & MPI_IOCSTATUS_MASK) {
+                if (ioc->bus_type == SCSI &&
+                    cb_idx != mpt_stm_index &&
+                    cb_idx != mpt_lan_index)
+                        mpt_sp_ioc_info(ioc, (u32)ioc_stat, mf);
+        }
+
+
+        /*  Check for (valid) IO callback!  */
+        if (cb_idx < 1 || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS ||
+                        MptCallbacks[cb_idx] == NULL) {
+                printk(MYIOC_s_WARN_FMT "%s: Invalid cb_idx (%d)!\n",
+                                __FUNCTION__, ioc->name, cb_idx);
+                freeme = 0;
+                goto out;
+        }
+
+        freeme = MptCallbacks[cb_idx](ioc, mf, mr);
+
+ out:
+        /*  Flush (non-TURBO) reply with a WRITE!  */
+        CHIPREG_WRITE32(&ioc->chip->ReplyFifo, pa);
+
+        if (freeme)
+                mpt_free_msg_frame(ioc, mf);
+        mb();
+}
+
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
  *      mpt_interrupt - MPT adapter (IOC) specific interrupt handler.
@@ -227,164 +368,21 @@ pci_enable_io_access(struct pci_dev *pdev)
 static irqreturn_t
 mpt_interrupt(int irq, void *bus_id, struct pt_regs *r)
 {
-        MPT_ADAPTER     *ioc;
-        MPT_FRAME_HDR   *mf;
-        MPT_FRAME_HDR   *mr;
-        u32              pa;
-        int              req_idx;
-        int              cb_idx;
-        int              type;
-        int              freeme;
-
-        ioc = (MPT_ADAPTER *)bus_id;
+        MPT_ADAPTER *ioc = bus_id;
+        u32 pa;
 
         /*
          *  Drain the reply FIFO!
-         *
-         * NOTES: I've seen up to 10 replies processed in this loop, so far...
-         * Update: I've seen up to 9182 replies processed in this loop! ??
-         * Update: Limit ourselves to processing max of N replies
-         *      (bottom of loop).
          */
         while (1) {
-
-                if ((pa = CHIPREG_READ32_dmasync(&ioc->chip->ReplyFifo)) == 0xFFFFFFFF)
+                pa = CHIPREG_READ32_dmasync(&ioc->chip->ReplyFifo);
+                if (pa == 0xFFFFFFFF)
                         return IRQ_HANDLED;
-
-                cb_idx = 0;
-                freeme = 0;
-
-                /*
-                 *  Check for non-TURBO reply!
-                 */
-                if (pa & MPI_ADDRESS_REPLY_A_BIT) {
-                        u32 reply_dma_low;
-                        u16 ioc_stat;
-
-                        /* non-TURBO reply!  Hmmm, something may be up...
-                         *  Newest turbo reply mechanism; get address
-                         *  via left shift 1 (get rid of MPI_ADDRESS_REPLY_A_BIT)!
-                         */
-
-                        /* Map DMA address of reply header to cpu address.
-                         * pa is 32 bits - but the dma address may be 32 or 64 bits
-                         * get offset based only only the low addresses
-                         */
-                        reply_dma_low = (pa = (pa << 1));
-                        mr = (MPT_FRAME_HDR *)((u8 *)ioc->reply_frames +
-                                         (reply_dma_low - ioc->reply_frames_low_dma));
-
-                        req_idx = le16_to_cpu(mr->u.frame.hwhdr.msgctxu.fld.req_idx);
-                        cb_idx = mr->u.frame.hwhdr.msgctxu.fld.cb_idx;
-                        mf = MPT_INDEX_2_MFPTR(ioc, req_idx);
-
-                        dmfprintk((MYIOC_s_INFO_FMT "Got non-TURBO reply=%p req_idx=%x cb_idx=%x Function=%x\n",
-                                        ioc->name, mr, req_idx, cb_idx, mr->u.hdr.Function));
-                        DBG_DUMP_REPLY_FRAME(mr)
-
-                         /*  Check/log IOC log info
-                         */
-                        ioc_stat = le16_to_cpu(mr->u.reply.IOCStatus);
-                        if (ioc_stat & MPI_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE) {
-                                u32      log_info = le32_to_cpu(mr->u.reply.IOCLogInfo);
-                                if (ioc->bus_type == FC)
-                                        mpt_fc_log_info(ioc, log_info);
-                                else if (ioc->bus_type == SCSI)
-                                        mpt_sp_log_info(ioc, log_info);
-                        }
-                        if (ioc_stat & MPI_IOCSTATUS_MASK) {
-                                if (ioc->bus_type == SCSI)
-                                        mpt_sp_ioc_info(ioc, (u32)ioc_stat, mf);
-                        }
-                } else {
-                        /*
-                         *  Process turbo (context) reply...
-                         */
-                        dmfprintk((MYIOC_s_INFO_FMT "Got TURBO reply req_idx=%08x\n", ioc->name, pa));
-                        type = (pa >> MPI_CONTEXT_REPLY_TYPE_SHIFT);
-                        if (type == MPI_CONTEXT_REPLY_TYPE_SCSI_TARGET) {
-                                cb_idx = mpt_stm_index;
-                                mf = NULL;
-                                mr = (MPT_FRAME_HDR *) CAST_U32_TO_PTR(pa);
-                        } else if (type == MPI_CONTEXT_REPLY_TYPE_LAN) {
-                                cb_idx = mpt_lan_index;
-                                 /*  Blind set of mf to NULL here was fatal
-                                 *  after lan_reply says "freeme"
-                                 *  Fix sort of combined with an optimization here;
-                                 *  added explicit check for case where lan_reply
-                                 *  was just returning 1 and doing nothing else.
-                                 *  For this case skip the callback, but set up
-                                 *  proper mf value first here:-)
-                                 */
-                                if ((pa & 0x58000000) == 0x58000000) {
-                                        req_idx = pa & 0x0000FFFF;
-                                        mf = MPT_INDEX_2_MFPTR(ioc, req_idx);
-                                        freeme = 1;
-                                        /*
-                                         *  IMPORTANT!  Invalidate the callback!
-                                         */
-                                        cb_idx = 0;
-                                } else {
-                                        mf = NULL;
-                                }
-                                mr = (MPT_FRAME_HDR *) CAST_U32_TO_PTR(pa);
-                        } else {
-                                req_idx = pa & 0x0000FFFF;
-                                cb_idx = (pa & 0x00FF0000) >> 16;
-                                mf = MPT_INDEX_2_MFPTR(ioc, req_idx);
-                                mr = NULL;
-                        }
-                        pa = 0;                                 /* No reply flush! */
-                }
-
-#ifdef MPT_DEBUG_IRQ
-                if (ioc->bus_type == SCSI) {
-                        /* Verify mf, mr are reasonable.
-                         */
-                        if ((mf) && ((mf >= MPT_INDEX_2_MFPTR(ioc, ioc->req_depth))
-                                || (mf < ioc->req_frames)) ) {
-                                printk(MYIOC_s_WARN_FMT
-                                        "mpt_interrupt: Invalid mf (%p)!\n", ioc->name, (void *)mf);
-                                cb_idx = 0;
-                                pa = 0;
-                                freeme = 0;
-                        }
-                        if ((pa) && (mr) && ((mr >= MPT_INDEX_2_RFPTR(ioc, ioc->req_depth))
-                                || (mr < ioc->reply_frames)) ) {
-                                printk(MYIOC_s_WARN_FMT
-                                        "mpt_interrupt: Invalid rf (%p)!\n", ioc->name, (void *)mr);
-                                cb_idx = 0;
-                                pa = 0;
-                                freeme = 0;
-                        }
-                        if (cb_idx > (MPT_MAX_PROTOCOL_DRIVERS-1)) {
-                                printk(MYIOC_s_WARN_FMT
-                                        "mpt_interrupt: Invalid cb_idx (%d)!\n", ioc->name, cb_idx);
-                                cb_idx = 0;
-                                pa = 0;
-                                freeme = 0;
-                        }
-                }
-#endif
-
-                /*  Check for (valid) IO callback!  */
-                if (cb_idx) {
-                        /*  Do the callback!  */
-                        freeme = (*(MptCallbacks[cb_idx]))(ioc, mf, mr);
-                }
-
-                if (pa) {
-                        /*  Flush (non-TURBO) reply with a WRITE!  */
-                        CHIPREG_WRITE32(&ioc->chip->ReplyFifo, pa);
-                }
-
-                if (freeme) {
-                        /*  Put Request back on FreeQ!  */
-                        mpt_free_msg_frame(ioc, mf);
-                }
-
-                mb();
-        }       /* drain reply FIFO */
+                else if (pa & MPI_ADDRESS_REPLY_A_BIT)
+                        mpt_reply(ioc, pa);
+                else
+                        mpt_turbo_reply(ioc, pa);
+        }
 
         return IRQ_HANDLED;
 }
@@ -509,6 +507,14 @@ mpt_base_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *reply)
                         pCfg->wait_done = 1;
                         wake_up(&mpt_waitq);
                 }
+        } else if (func == MPI_FUNCTION_SAS_IO_UNIT_CONTROL) {
+                /* we should be always getting a reply frame */
+                memcpy(ioc->persist_reply_frame, reply,
+                    min(MPT_DEFAULT_FRAME_SIZE,
+                    4*reply->u.reply.MsgLength));
+                del_timer(&ioc->persist_timer);
+                ioc->persist_wait_done = 1;
+                wake_up(&mpt_waitq);
         } else {
                 printk(MYIOC_s_ERR_FMT "Unexpected msg function (=%02Xh) reply received!\n",
                                 ioc->name, func);
@@ -750,6 +756,7 @@ mpt_get_msg_frame(int handle, MPT_ADAPTER *ioc)
                 mf = list_entry(ioc->FreeQ.next, MPT_FRAME_HDR,
                                 u.frame.linkage.list);
                 list_del(&mf->u.frame.linkage.list);
+                mf->u.frame.linkage.arg1 = 0;
                 mf->u.frame.hwhdr.msgctxu.fld.cb_idx = handle;  /* byte */
                 req_offset = (u8 *)mf - (u8 *)ioc->req_frames;
                                                                 /* u16! */
@@ -845,6 +852,7 @@ mpt_free_msg_frame(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf)
 
         /*  Put Request back on FreeQ!  */
         spin_lock_irqsave(&ioc->FreeQlock, flags);
+        mf->u.frame.linkage.arg1 = 0xdeadbeaf; /* signature to know if this mf is freed */
         list_add_tail(&mf->u.frame.linkage.list, &ioc->FreeQ);
 #ifdef MFCNT
         ioc->mfcnt--;
@@ -971,12 +979,123 @@ mpt_send_handshake_request(int handle, MPT_ADAPTER *ioc, int reqBytes, u32 *req,
 
         /* Make sure there are no doorbells */
         CHIPREG_WRITE32(&ioc->chip->IntStatus, 0);
-        
+
         return r;
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /**
+ * mpt_host_page_access_control - provides mechanism for the host
+ * driver to control the IOC's Host Page Buffer access.
+ * @ioc: Pointer to MPT adapter structure
+ * @access_control_value: define bits below
+ *
+ * Access Control Value - bits[15:12]
+ * 0h Reserved
+ * 1h Enable Access { MPI_DB_HPBAC_ENABLE_ACCESS }
+ * 2h Disable Access { MPI_DB_HPBAC_DISABLE_ACCESS }
+ * 3h Free Buffer { MPI_DB_HPBAC_FREE_BUFFER }
+ *
+ * Returns 0 for success, non-zero for failure.
+ */
+
+static int
+mpt_host_page_access_control(MPT_ADAPTER *ioc, u8 access_control_value, int sleepFlag)
+{
+        int      r = 0;
+
+        /* return if in use */
+        if (CHIPREG_READ32(&ioc->chip->Doorbell)
+            & MPI_DOORBELL_ACTIVE)
+            return -1;
+
+        CHIPREG_WRITE32(&ioc->chip->IntStatus, 0);
+
+        CHIPREG_WRITE32(&ioc->chip->Doorbell,
+                ((MPI_FUNCTION_HOST_PAGEBUF_ACCESS_CONTROL
+                 <<MPI_DOORBELL_FUNCTION_SHIFT) |
+                 (access_control_value<<12)));
+
+        /* Wait for IOC to clear Doorbell Status bit */
+        if ((r = WaitForDoorbellAck(ioc, 5, sleepFlag)) < 0) {
+                return -2;
+        }else
+                return 0;
+}
+
+/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+/**
+ *      mpt_host_page_alloc - allocate system memory for the fw
+ *      If we already allocated memory in past, then resend the same pointer.
+ *      ioc@: Pointer to pointer to IOC adapter
+ *      ioc_init@: Pointer to ioc init config page
+ *
+ *      Returns 0 for success, non-zero for failure.
+ */
+static int
+mpt_host_page_alloc(MPT_ADAPTER *ioc, pIOCInit_t ioc_init)
+{
+        char    *psge;
+        int     flags_length;
+        u32     host_page_buffer_sz=0;
+
+        if(!ioc->HostPageBuffer) {
+
+                host_page_buffer_sz =
+                    le32_to_cpu(ioc->facts.HostPageBufferSGE.FlagsLength) & 0xFFFFFF;
+
+                if(!host_page_buffer_sz)
+                        return 0; /* fw doesn't need any host buffers */
+
+                /* spin till we get enough memory */
+                while(host_page_buffer_sz > 0) {
+
+                        if((ioc->HostPageBuffer = pci_alloc_consistent(
+                            ioc->pcidev,
+                            host_page_buffer_sz,
+                            &ioc->HostPageBuffer_dma)) != NULL) {
+
+                                dinitprintk((MYIOC_s_INFO_FMT
+                                    "host_page_buffer @ %p, dma @ %x, sz=%d bytes\n",
+                                    ioc->name,
+                                    ioc->HostPageBuffer,
+                                    ioc->HostPageBuffer_dma,
+                                    host_page_buffer_sz));
+                                ioc->alloc_total += host_page_buffer_sz;
+                                ioc->HostPageBuffer_sz = host_page_buffer_sz;
+                                break;
+                        }
+
+                        host_page_buffer_sz -= (4*1024);
+                }
+        }
+
+        if(!ioc->HostPageBuffer) {
+                printk(MYIOC_s_ERR_FMT
+                    "Failed to alloc memory for host_page_buffer!\n",
+                    ioc->name);
+                return -999;
+        }
+
+        psge = (char *)&ioc_init->HostPageBufferSGE;
+        flags_length = MPI_SGE_FLAGS_SIMPLE_ELEMENT |
+            MPI_SGE_FLAGS_SYSTEM_ADDRESS |
+            MPI_SGE_FLAGS_32_BIT_ADDRESSING |
+            MPI_SGE_FLAGS_HOST_TO_IOC |
+            MPI_SGE_FLAGS_END_OF_BUFFER;
+        if (sizeof(dma_addr_t) == sizeof(u64)) {
+            flags_length |= MPI_SGE_FLAGS_64_BIT_ADDRESSING;
+        }
+        flags_length = flags_length << MPI_SGE_FLAGS_SHIFT;
+        flags_length |= ioc->HostPageBuffer_sz;
+        mpt_add_sge(psge, flags_length, ioc->HostPageBuffer_dma);
+        ioc->facts.HostPageBufferSGE = ioc_init->HostPageBufferSGE;
+
+return 0;
+}
+
+/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+/**
  *      mpt_verify_adapter - Given a unique IOC identifier, set pointer to
  *      the associated MPT adapter structure.
  *      @iocid: IOC unique identifier (integer)
@@ -1084,7 +1203,7 @@ mpt_attach(struct pci_dev *pdev, const struct pci_device_id *id)
 
         /* Initilize SCSI Config Data structure
          */
-        memset(&ioc->spi_data, 0, sizeof(ScsiCfgData));
+        memset(&ioc->spi_data, 0, sizeof(SpiCfgData));
 
         /* Initialize the running configQ head.
          */
@@ -1213,6 +1332,33 @@ mpt_attach(struct pci_dev *pdev, const struct pci_device_id *id)
                 ioc->prod_name = "LSI53C1035";
                 ioc->bus_type = SCSI;
         }
+        else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1064) {
+                ioc->prod_name = "LSISAS1064";
+                ioc->bus_type = SAS;
+                ioc->errata_flag_1064 = 1;
+        }
+        else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1066) {
+                ioc->prod_name = "LSISAS1066";
+                ioc->bus_type = SAS;
+                ioc->errata_flag_1064 = 1;
+        }
+        else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1068) {
+                ioc->prod_name = "LSISAS1068";
+                ioc->bus_type = SAS;
+                ioc->errata_flag_1064 = 1;
+        }
+        else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1064E) {
+                ioc->prod_name = "LSISAS1064E";
+                ioc->bus_type = SAS;
+        }
+        else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1066E) {
+                ioc->prod_name = "LSISAS1066E";
+                ioc->bus_type = SAS;
+        }
+        else if (pdev->device == MPI_MANUFACTPAGE_DEVID_SAS1068E) {
+                ioc->prod_name = "LSISAS1068E";
+                ioc->bus_type = SAS;
+        }
 
         if (ioc->errata_flag_1064)
                 pci_disable_io_access(pdev);
@@ -1604,8 +1750,23 @@ mpt_do_ioc_recovery(MPT_ADAPTER *ioc, u32 reason, int sleepFlag)
                          */
                         if (ret == 0) {
                                 rc = mpt_do_upload(ioc, sleepFlag);
-                                if (rc != 0)
+                                if (rc == 0) {
+                                        if (ioc->alt_ioc && ioc->alt_ioc->cached_fw) {
+                                                /*
+                                                 * Maintain only one pointer to FW memory
+                                                 * so there will not be two attempt to
+                                                 * downloadboot onboard dual function
+                                                 * chips (mpt_adapter_disable,
+                                                 * mpt_diag_reset)
+                                                 */
+                                                ioc->cached_fw = NULL;
+                                                ddlprintk((MYIOC_s_INFO_FMT ": mpt_upload:  alt_%s has cached_fw=%p \n",
+                                                        ioc->name, ioc->alt_ioc->name, ioc->alt_ioc->cached_fw));
+                                        }
+                                } else {
                                         printk(KERN_WARNING MYNAM ": firmware upload failure!\n");
+                                        ret = -5;
+                                }
                         }
                 }
         }
@@ -1640,7 +1801,22 @@ mpt_do_ioc_recovery(MPT_ADAPTER *ioc, u32 reason, int sleepFlag)
          *      and we try GetLanConfigPages again...
          */
         if ((ret == 0) && (reason == MPT_HOSTEVENT_IOC_BRINGUP)) {
-                if (ioc->bus_type == FC) {
+                if (ioc->bus_type == SAS) {
+
+                        /* clear persistency table */
+                        if(ioc->facts.IOCExceptions &
+                            MPI_IOCFACTS_EXCEPT_PERSISTENT_TABLE_FULL) {
+                                ret = mptbase_sas_persist_operation(ioc,
+                                    MPI_SAS_OP_CLEAR_NOT_PRESENT);
+                                if(ret != 0)
+                                        return -1;
+                        }
+
+                        /* Find IM volumes
+                         */
+                        mpt_findImVolumes(ioc);
+
+                } else if (ioc->bus_type == FC) {
                         /*
                          *  Pre-fetch FC port WWN and stuff...
                          *  (FCPortPage0_t stuff)
@@ -1783,7 +1959,7 @@ mpt_adapter_disable(MPT_ADAPTER *ioc)
 
         if (ioc->cached_fw != NULL) {
                 ddlprintk((KERN_INFO MYNAM ": mpt_adapter_disable: Pushing FW onto adapter\n"));
-                if ((ret = mpt_downloadboot(ioc, NO_SLEEP)) < 0) {
+                if ((ret = mpt_downloadboot(ioc, (MpiFwHeader_t *)ioc->cached_fw, NO_SLEEP)) < 0) {
                         printk(KERN_WARNING MYNAM
                                 ": firmware downloadboot failure (%d)!\n", ret);
                 }
@@ -1831,9 +2007,9 @@ mpt_adapter_disable(MPT_ADAPTER *ioc)
         }
 
         kfree(ioc->spi_data.nvram);
-        kfree(ioc->spi_data.pIocPg3);
+        kfree(ioc->raid_data.pIocPg3);
         ioc->spi_data.nvram = NULL;
-        ioc->spi_data.pIocPg3 = NULL;
+        ioc->raid_data.pIocPg3 = NULL;
 
         if (ioc->spi_data.pIocPg4 != NULL) {
                 sz = ioc->spi_data.IocPg4Sz;
@@ -1852,6 +2028,23 @@ mpt_adapter_disable(MPT_ADAPTER *ioc)
 
         kfree(ioc->ChainToChain);
         ioc->ChainToChain = NULL;
+
+        if (ioc->HostPageBuffer != NULL) {
+                if((ret = mpt_host_page_access_control(ioc,
+                    MPI_DB_HPBAC_FREE_BUFFER, NO_SLEEP)) != 0) {
+                        printk(KERN_ERR MYNAM
+                           ": %s: host page buffers free failed (%d)!\n",
+                            __FUNCTION__, ret);
+                }
+                dexitprintk((KERN_INFO MYNAM ": %s HostPageBuffer free  @ %p, sz=%d bytes\n",
+                        ioc->name, ioc->HostPageBuffer, ioc->HostPageBuffer_sz));
+                pci_free_consistent(ioc->pcidev, ioc->HostPageBuffer_sz,
+                                ioc->HostPageBuffer,
+                                ioc->HostPageBuffer_dma);
+                ioc->HostPageBuffer = NULL;
+                ioc->HostPageBuffer_sz = 0;
+                ioc->alloc_total -= ioc->HostPageBuffer_sz;
+        }
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
@@ -2034,7 +2227,7 @@ MakeIocReady(MPT_ADAPTER *ioc, int force, int sleepFlag)
          *  Loop here waiting for IOC to come READY.
          */
         ii = 0;
-        cntdn = ((sleepFlag == CAN_SLEEP) ? HZ : 1000) * 15;    /* 15 seconds */
+        cntdn = ((sleepFlag == CAN_SLEEP) ? HZ : 1000) * 5;     /* 5 seconds */
 
         while ((ioc_state = mpt_GetIocState(ioc, 1)) != MPI_IOC_STATE_READY) {
                 if (ioc_state == MPI_IOC_STATE_OPERATIONAL) {
@@ -2212,6 +2405,7 @@ GetIocFacts(MPT_ADAPTER *ioc, int sleepFlag, int reason)
                                 le32_to_cpu(facts->CurrentSenseBufferHighAddr);
                 facts->CurReplyFrameSize =
                                 le16_to_cpu(facts->CurReplyFrameSize);
+                facts->IOCCapabilities = le32_to_cpu(facts->IOCCapabilities);
 
                 /*
                  * Handle NEW (!) IOCFactsReply fields in MPI-1.01.xx
@@ -2383,13 +2577,25 @@ SendIocInit(MPT_ADAPTER *ioc, int sleepFlag)
         ddlprintk((MYIOC_s_INFO_FMT "upload_fw %d facts.Flags=%x\n",
                    ioc->name, ioc->upload_fw, ioc->facts.Flags));
 
-        if (ioc->bus_type == FC)
+        if(ioc->bus_type == SAS)
+                ioc_init.MaxDevices = ioc->facts.MaxDevices;
+        else if(ioc->bus_type == FC)
                 ioc_init.MaxDevices = MPT_MAX_FC_DEVICES;
         else
                 ioc_init.MaxDevices = MPT_MAX_SCSI_DEVICES;
-        
         ioc_init.MaxBuses = MPT_MAX_BUS;
-
+        dinitprintk((MYIOC_s_INFO_FMT "facts.MsgVersion=%x\n",
+                   ioc->name, ioc->facts.MsgVersion));
+        if (ioc->facts.MsgVersion >= MPI_VERSION_01_05) {
+                // set MsgVersion and HeaderVersion host driver was built with
+                ioc_init.MsgVersion = cpu_to_le16(MPI_VERSION);
+                ioc_init.HeaderVersion = cpu_to_le16(MPI_HEADER_VERSION);
+
+                if (ioc->facts.Flags & MPI_IOCFACTS_FLAGS_HOST_PAGE_BUFFER_PERSISTENT) {
+                        ioc_init.HostPageBufferSGE = ioc->facts.HostPageBufferSGE;
+                } else if(mpt_host_page_alloc(ioc, &ioc_init))
+                        return -99;
+        }
         ioc_init.ReplyFrameSize = cpu_to_le16(ioc->reply_sz);   /* in BYTES */
 
         if (sizeof(dma_addr_t) == sizeof(u64)) {
@@ -2403,17 +2609,21 @@ SendIocInit(MPT_ADAPTER *ioc, int sleepFlag)
                 ioc_init.HostMfaHighAddr = cpu_to_le32(0);
                 ioc_init.SenseBufferHighAddr = cpu_to_le32(0);
         }
-                
+
         ioc->facts.CurrentHostMfaHighAddr = ioc_init.HostMfaHighAddr;
         ioc->facts.CurrentSenseBufferHighAddr = ioc_init.SenseBufferHighAddr;
+        ioc->facts.MaxDevices = ioc_init.MaxDevices;
+        ioc->facts.MaxBuses = ioc_init.MaxBuses;
 
         dhsprintk((MYIOC_s_INFO_FMT "Sending IOCInit (req @ %p)\n",
                         ioc->name, &ioc_init));
 
         r = mpt_handshake_req_reply_wait(ioc, sizeof(IOCInit_t), (u32*)&ioc_init,
                                 sizeof(MPIDefaultReply_t), (u16*)&init_reply, 10 /*seconds*/, sleepFlag);
-        if (r != 0)
+        if (r != 0) {
+                printk(MYIOC_s_ERR_FMT "Sending IOCInit failed(%d)!\n",ioc->name, r);
                 return r;
+        }
 
         /* No need to byte swap the multibyte fields in the reply
          * since we don't even look at it's contents.
@@ -2472,7 +2682,7 @@ SendPortEnable(MPT_ADAPTER *ioc, int portnum, int sleepFlag)
 {
         PortEnable_t             port_enable;
         MPIDefaultReply_t        reply_buf;
-        int      ii;
+        int      rc;
         int      req_sz;
         int      reply_sz;
 
@@ -2494,22 +2704,15 @@ SendPortEnable(MPT_ADAPTER *ioc, int portnum, int sleepFlag)
 
         /* RAID FW may take a long time to enable
          */
-        if (ioc->bus_type == FC) {
-                ii = mpt_handshake_req_reply_wait(ioc, req_sz, (u32*)&port_enable,
-                                reply_sz, (u16*)&reply_buf, 65 /*seconds*/, sleepFlag);
-        } else {
-                ii = mpt_handshake_req_reply_wait(ioc, req_sz, (u32*)&port_enable,
+        if ( (ioc->facts.ProductID & MPI_FW_HEADER_PID_PROD_MASK)
+                        > MPI_FW_HEADER_PID_PROD_TARGET_SCSI ) {
+                rc = mpt_handshake_req_reply_wait(ioc, req_sz, (u32*)&port_enable,
                                 reply_sz, (u16*)&reply_buf, 300 /*seconds*/, sleepFlag);
+        } else {
+                rc = mpt_handshake_req_reply_wait(ioc, req_sz, (u32*)&port_enable,
+                                reply_sz, (u16*)&reply_buf, 30 /*seconds*/, sleepFlag);
         }
-
-        if (ii != 0)
-                return ii;
-
-        /* We do not even look at the reply, so we need not
-         * swap the multi-byte fields.
-         */
-
-        return 0;
+        return rc;
 }
 
 /*
@@ -2666,9 +2869,8 @@ mpt_do_upload(MPT_ADAPTER *ioc, int sleepFlag)
  *              <0 for fw upload failure.
  */
 static int
-mpt_downloadboot(MPT_ADAPTER *ioc, int sleepFlag)
+mpt_downloadboot(MPT_ADAPTER *ioc, MpiFwHeader_t *pFwHeader, int sleepFlag)
 {
-        MpiFwHeader_t           *pFwHeader;
         MpiExtImageHeader_t     *pExtImage;
         u32                      fwSize;
         u32                      diag0val;
@@ -2679,18 +2881,8 @@ mpt_downloadboot(MPT_ADAPTER *ioc, int sleepFlag)
         u32                      load_addr;
         u32                      ioc_state=0;
 
-        ddlprintk((MYIOC_s_INFO_FMT "downloadboot: fw size 0x%x, ioc FW Ptr %p\n",
-                                ioc->name, ioc->facts.FWImageSize, ioc->cached_fw));
-
-        if ( ioc->facts.FWImageSize == 0 )
-                return -1;
-
-        if (ioc->cached_fw == NULL)
-                return -2;
-
-        /* prevent a second downloadboot and memory free with alt_ioc */
-        if (ioc->alt_ioc && ioc->alt_ioc->cached_fw)
-                ioc->alt_ioc->cached_fw = NULL;
+        ddlprintk((MYIOC_s_INFO_FMT "downloadboot: fw size 0x%x (%d), FW Ptr %p\n",
+                                ioc->name, pFwHeader->ImageSize, pFwHeader->ImageSize, pFwHeader));
 
         CHIPREG_WRITE32(&ioc->chip->WriteSequence, 0xFF);
         CHIPREG_WRITE32(&ioc->chip->WriteSequence, MPI_WRSEQ_1ST_KEY_VALUE);
@@ -2718,16 +2910,17 @@ mpt_downloadboot(MPT_ADAPTER *ioc, int sleepFlag)
                                 ioc->name, count));
                         break;
                 }
-                /* wait 1 sec */
+                /* wait .1 sec */
                 if (sleepFlag == CAN_SLEEP) {
-                        msleep_interruptible (1000);
+                        msleep_interruptible (100);
                 } else {
-                        mdelay (1000);
+                        mdelay (100);
                 }
         }
 
         if ( count == 30 ) {
-                ddlprintk((MYIOC_s_INFO_FMT "downloadboot failed! Unable to RESET_ADAPTER diag0val=%x\n",
+                ddlprintk((MYIOC_s_INFO_FMT "downloadboot failed! "
+                "Unable to get MPI_DIAG_DRWE mode, diag0val=%x\n",
                 ioc->name, diag0val));
                 return -3;
         }
@@ -2742,7 +2935,6 @@ mpt_downloadboot(MPT_ADAPTER *ioc, int sleepFlag)
         /* Set the DiagRwEn and Disable ARM bits */
         CHIPREG_WRITE32(&ioc->chip->Diagnostic, (MPI_DIAG_RW_ENABLE | MPI_DIAG_DISABLE_ARM));
 
-        pFwHeader = (MpiFwHeader_t *) ioc->cached_fw;
         fwSize = (pFwHeader->ImageSize + 3)/4;
         ptrFw = (u32 *) pFwHeader;
 
@@ -2792,19 +2984,38 @@ mpt_downloadboot(MPT_ADAPTER *ioc, int sleepFlag)
         /* Clear the internal flash bad bit - autoincrementing register,
          * so must do two writes.
          */
-        CHIPREG_PIO_WRITE32(&ioc->pio_chip->DiagRwAddress, 0x3F000000);
-        diagRwData = CHIPREG_PIO_READ32(&ioc->pio_chip->DiagRwData);
-        diagRwData |= 0x4000000;
-        CHIPREG_PIO_WRITE32(&ioc->pio_chip->DiagRwAddress, 0x3F000000);
-        CHIPREG_PIO_WRITE32(&ioc->pio_chip->DiagRwData, diagRwData);
+        if (ioc->bus_type == SCSI) {
+                /*
+                 * 1030 and 1035 H/W errata, workaround to access
+                 * the ClearFlashBadSignatureBit
+                 */
+                CHIPREG_PIO_WRITE32(&ioc->pio_chip->DiagRwAddress, 0x3F000000);
+                diagRwData = CHIPREG_PIO_READ32(&ioc->pio_chip->DiagRwData);
+                diagRwData |= 0x40000000;
+                CHIPREG_PIO_WRITE32(&ioc->pio_chip->DiagRwAddress, 0x3F000000);
+                CHIPREG_PIO_WRITE32(&ioc->pio_chip->DiagRwData, diagRwData);
+
+        } else /* if((ioc->bus_type == SAS) || (ioc->bus_type == FC)) */ {
+                diag0val = CHIPREG_READ32(&ioc->chip->Diagnostic);
+                CHIPREG_WRITE32(&ioc->chip->Diagnostic, diag0val |
+                    MPI_DIAG_CLEAR_FLASH_BAD_SIG);
+
+                /* wait 1 msec */
+                if (sleepFlag == CAN_SLEEP) {
+                        msleep_interruptible (1);
+                } else {
+                        mdelay (1);
+                }
+        }
 
         if (ioc->errata_flag_1064)
                 pci_disable_io_access(ioc->pcidev);
 
         diag0val = CHIPREG_READ32(&ioc->chip->Diagnostic);
-        ddlprintk((MYIOC_s_INFO_FMT "downloadboot diag0val=%x, turning off PREVENT_IOC_BOOT, DISABLE_ARM\n",
+        ddlprintk((MYIOC_s_INFO_FMT "downloadboot diag0val=%x, "
+                "turning off PREVENT_IOC_BOOT, DISABLE_ARM, RW_ENABLE\n",
                 ioc->name, diag0val));
-        diag0val &= ~(MPI_DIAG_PREVENT_IOC_BOOT | MPI_DIAG_DISABLE_ARM);
+        diag0val &= ~(MPI_DIAG_PREVENT_IOC_BOOT | MPI_DIAG_DISABLE_ARM | MPI_DIAG_RW_ENABLE);
         ddlprintk((MYIOC_s_INFO_FMT "downloadboot now diag0val=%x\n",
                 ioc->name, diag0val));
         CHIPREG_WRITE32(&ioc->chip->Diagnostic, diag0val);
@@ -2812,10 +3023,23 @@ mpt_downloadboot(MPT_ADAPTER *ioc, int sleepFlag)
         /* Write 0xFF to reset the sequencer */
         CHIPREG_WRITE32(&ioc->chip->WriteSequence, 0xFF);
 
+        if (ioc->bus_type == SAS) {
+                ioc_state = mpt_GetIocState(ioc, 0);
+                if ( (GetIocFacts(ioc, sleepFlag,
+                                MPT_HOSTEVENT_IOC_BRINGUP)) != 0 ) {
+                        ddlprintk((MYIOC_s_INFO_FMT "GetIocFacts failed: IocState=%x\n",
+                                        ioc->name, ioc_state));
+                        return -EFAULT;
+                }
+        }
+
         for (count=0; count<HZ*20; count++) {
                 if ((ioc_state = mpt_GetIocState(ioc, 0)) & MPI_IOC_STATE_READY) {
                         ddlprintk((MYIOC_s_INFO_FMT "downloadboot successful! (count=%d) IocState=%x\n",
                                         ioc->name, count, ioc_state));
+                        if (ioc->bus_type == SAS) {
+                                return 0;
+                        }
                         if ((SendIocInit(ioc, sleepFlag)) != 0) {
                                 ddlprintk((MYIOC_s_INFO_FMT "downloadboot: SendIocInit failed\n",
                                         ioc->name));
@@ -3049,12 +3273,13 @@ mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
 
                                 /* wait 1 sec */
                                 if (sleepFlag == CAN_SLEEP) {
-                                        ssleep(1);
+                                        msleep_interruptible (1000);
                                 } else {
                                         mdelay (1000);
                                 }
                         }
-                        if ((count = mpt_downloadboot(ioc, sleepFlag)) < 0) {
+                        if ((count = mpt_downloadboot(ioc,
+                                (MpiFwHeader_t *)ioc->cached_fw, sleepFlag)) < 0) {
                                 printk(KERN_WARNING MYNAM
                                         ": firmware downloadboot failure (%d)!\n", count);
                         }
@@ -3637,7 +3862,7 @@ WaitForDoorbellAck(MPT_ADAPTER *ioc, int howlong, int sleepFlag)
         int count = 0;
         u32 intstat=0;
 
-        cntdn = ((sleepFlag == CAN_SLEEP) ? HZ : 1000) * howlong;
+        cntdn = 1000 * howlong;
 
         if (sleepFlag == CAN_SLEEP) {
                 while (--cntdn) {
@@ -3687,7 +3912,7 @@ WaitForDoorbellInt(MPT_ADAPTER *ioc, int howlong, int sleepFlag)
         int count = 0;
         u32 intstat=0;
 
-        cntdn = ((sleepFlag == CAN_SLEEP) ? HZ : 1000) * howlong;
+        cntdn = 1000 * howlong;
         if (sleepFlag == CAN_SLEEP) {
                 while (--cntdn) {
                         intstat = CHIPREG_READ32(&ioc->chip->IntStatus);
@@ -4001,6 +4226,85 @@ GetFcPortPage0(MPT_ADAPTER *ioc, int portnum)
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
+ *      mptbase_sas_persist_operation - Perform operation on SAS Persitent Table
+ *      @ioc: Pointer to MPT_ADAPTER structure
+ *      @sas_address: 64bit SAS Address for operation.
+ *      @target_id: specified target for operation
+ *      @bus: specified bus for operation
+ *      @persist_opcode: see below
+ *
+ *      MPI_SAS_OP_CLEAR_NOT_PRESENT - Free all persist TargetID mappings for
+ *              devices not currently present.
+ *      MPI_SAS_OP_CLEAR_ALL_PERSISTENT - Clear al persist TargetID mappings
+ *
+ *      NOTE: Don't use not this function during interrupt time.
+ *
+ *      Returns: 0 for success, non-zero error
+ */
+
+/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+int
+mptbase_sas_persist_operation(MPT_ADAPTER *ioc, u8 persist_opcode)
+{
+        SasIoUnitControlRequest_t       *sasIoUnitCntrReq;
+        SasIoUnitControlReply_t         *sasIoUnitCntrReply;
+        MPT_FRAME_HDR                   *mf = NULL;
+        MPIHeader_t                     *mpi_hdr;
+
+
+        /* insure garbage is not sent to fw */
+        switch(persist_opcode) {
+
+        case MPI_SAS_OP_CLEAR_NOT_PRESENT:
+        case MPI_SAS_OP_CLEAR_ALL_PERSISTENT:
+                break;
+
+        default:
+                return -1;
+                break;
+        }
+
+        printk("%s: persist_opcode=%x\n",__FUNCTION__, persist_opcode);
+
+        /* Get a MF for this command.
+         */
+        if ((mf = mpt_get_msg_frame(mpt_base_index, ioc)) == NULL) {
+                printk("%s: no msg frames!\n",__FUNCTION__);
+                return -1;
+        }
+
+        mpi_hdr = (MPIHeader_t *) mf;
+        sasIoUnitCntrReq = (SasIoUnitControlRequest_t *)mf;
+        memset(sasIoUnitCntrReq,0,sizeof(SasIoUnitControlRequest_t));
+        sasIoUnitCntrReq->Function = MPI_FUNCTION_SAS_IO_UNIT_CONTROL;
+        sasIoUnitCntrReq->MsgContext = mpi_hdr->MsgContext;
+        sasIoUnitCntrReq->Operation = persist_opcode;
+
+        init_timer(&ioc->persist_timer);
+        ioc->persist_timer.data = (unsigned long) ioc;
+        ioc->persist_timer.function = mpt_timer_expired;
+        ioc->persist_timer.expires = jiffies + HZ*10 /* 10 sec */;
+        ioc->persist_wait_done=0;
+        add_timer(&ioc->persist_timer);
+        mpt_put_msg_frame(mpt_base_index, ioc, mf);
+        wait_event(mpt_waitq, ioc->persist_wait_done);
+
+        sasIoUnitCntrReply =
+            (SasIoUnitControlReply_t *)ioc->persist_reply_frame;
+        if (le16_to_cpu(sasIoUnitCntrReply->IOCStatus) != MPI_IOCSTATUS_SUCCESS) {
+                printk("%s: IOCStatus=0x%X IOCLogInfo=0x%X\n",
+                    __FUNCTION__,
+                    sasIoUnitCntrReply->IOCStatus,
+                    sasIoUnitCntrReply->IOCLogInfo);
+                return -1;
+        }
+
+        printk("%s: success\n",__FUNCTION__);
+        return 0;
+}
+
+/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+/*
  *      GetIoUnitPage2 - Retrieve BIOS version and boot order information.
  *      @ioc: Pointer to MPT_ADAPTER structure
  *
@@ -4340,10 +4644,10 @@ mpt_findImVolumes(MPT_ADAPTER *ioc)
         if (mpt_config(ioc, &cfg) != 0)
                 goto done_and_free;
 
-        if ( (mem = (u8 *)ioc->spi_data.pIocPg2) == NULL ) {
+        if ( (mem = (u8 *)ioc->raid_data.pIocPg2) == NULL ) {
                 mem = kmalloc(iocpage2sz, GFP_ATOMIC);
                 if (mem) {
-                        ioc->spi_data.pIocPg2 = (IOCPage2_t *) mem;
+                        ioc->raid_data.pIocPg2 = (IOCPage2_t *) mem;
                 } else {
                         goto done_and_free;
                 }
@@ -4360,7 +4664,7 @@ mpt_findImVolumes(MPT_ADAPTER *ioc)
                 /* At least 1 RAID Volume
                  */
                 pIocRv = pIoc2->RaidVolume;
-                ioc->spi_data.isRaid = 0;
+                ioc->raid_data.isRaid = 0;
                 for (jj = 0; jj < nVols; jj++, pIocRv++) {
                         vid = pIocRv->VolumeID;
                         vbus = pIocRv->VolumeBus;
@@ -4369,7 +4673,7 @@ mpt_findImVolumes(MPT_ADAPTER *ioc)
                         /* find the match
                          */
                         if (vbus == 0) {
-                                ioc->spi_data.isRaid |= (1 << vid);
+                                ioc->raid_data.isRaid |= (1 << vid);
                         } else {
                                 /* Error! Always bus 0
                                  */
@@ -4404,8 +4708,8 @@ mpt_read_ioc_pg_3(MPT_ADAPTER *ioc)
 
         /* Free the old page
          */
-        kfree(ioc->spi_data.pIocPg3);
-        ioc->spi_data.pIocPg3 = NULL;
+        kfree(ioc->raid_data.pIocPg3);
+        ioc->raid_data.pIocPg3 = NULL;
 
         /* There is at least one physical disk.
          * Read and save IOC Page 3
@@ -4442,7 +4746,7 @@ mpt_read_ioc_pg_3(MPT_ADAPTER *ioc)
                 mem = kmalloc(iocpage3sz, GFP_ATOMIC);
                 if (mem) {
                         memcpy(mem, (u8 *)pIoc3, iocpage3sz);
-                        ioc->spi_data.pIocPg3 = (IOCPage3_t *) mem;
+                        ioc->raid_data.pIocPg3 = (IOCPage3_t *) mem;
                 }
         }
 
@@ -5366,8 +5670,8 @@ mpt_HardResetHandler(MPT_ADAPTER *ioc, int sleepFlag)
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-static char *
-EventDescriptionStr(u8 event, u32 evData0)
+static void
+EventDescriptionStr(u8 event, u32 evData0, char *evStr)
 {
         char *ds;
 
@@ -5420,8 +5724,95 @@ EventDescriptionStr(u8 event, u32 evData0)
                         ds = "Events(OFF) Change";
                 break;
         case MPI_EVENT_INTEGRATED_RAID:
-                ds = "Integrated Raid";
+        {
+                u8 ReasonCode = (u8)(evData0 >> 16);
+                switch (ReasonCode) {
+                case MPI_EVENT_RAID_RC_VOLUME_CREATED :
+                        ds = "Integrated Raid: Volume Created";
+                        break;
+                case MPI_EVENT_RAID_RC_VOLUME_DELETED :
+                        ds = "Integrated Raid: Volume Deleted";
+                        break;
+                case MPI_EVENT_RAID_RC_VOLUME_SETTINGS_CHANGED :
+                        ds = "Integrated Raid: Volume Settings Changed";
+                        break;
+                case MPI_EVENT_RAID_RC_VOLUME_STATUS_CHANGED :
+                        ds = "Integrated Raid: Volume Status Changed";
+                        break;
+                case MPI_EVENT_RAID_RC_VOLUME_PHYSDISK_CHANGED :
+                        ds = "Integrated Raid: Volume Physdisk Changed";
+                        break;
+                case MPI_EVENT_RAID_RC_PHYSDISK_CREATED :
+                        ds = "Integrated Raid: Physdisk Created";
+                        break;
+                case MPI_EVENT_RAID_RC_PHYSDISK_DELETED :
+                        ds = "Integrated Raid: Physdisk Deleted";
+                        break;
+                case MPI_EVENT_RAID_RC_PHYSDISK_SETTINGS_CHANGED :
+                        ds = "Integrated Raid: Physdisk Settings Changed";
+                        break;
+                case MPI_EVENT_RAID_RC_PHYSDISK_STATUS_CHANGED :
+                        ds = "Integrated Raid: Physdisk Status Changed";
+                        break;
+                case MPI_EVENT_RAID_RC_DOMAIN_VAL_NEEDED :
+                        ds = "Integrated Raid: Domain Validation Needed";
+                        break;
+                case MPI_EVENT_RAID_RC_SMART_DATA :
+                        ds = "Integrated Raid; Smart Data";
+                        break;
+                case MPI_EVENT_RAID_RC_REPLACE_ACTION_STARTED :
+                        ds = "Integrated Raid: Replace Action Started";
+                        break;
+                default:
+                        ds = "Integrated Raid";
+                break;
+                }
+                break;
+        }
+        case MPI_EVENT_SCSI_DEVICE_STATUS_CHANGE:
+                ds = "SCSI Device Status Change";
+                break;
+        case MPI_EVENT_SAS_DEVICE_STATUS_CHANGE:
+        {
+                u8 ReasonCode = (u8)(evData0 >> 16);
+                switch (ReasonCode) {
+                case MPI_EVENT_SAS_DEV_STAT_RC_ADDED:
+                        ds = "SAS Device Status Change: Added";
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_NOT_RESPONDING:
+                        ds = "SAS Device Status Change: Deleted";
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_SMART_DATA:
+                        ds = "SAS Device Status Change: SMART Data";
+                        break;
+                case MPI_EVENT_SAS_DEV_STAT_RC_NO_PERSIST_ADDED:
+                        ds = "SAS Device Status Change: No Persistancy Added";
+                        break;
+                default:
+                        ds = "SAS Device Status Change: Unknown";
+                break;
+                }
+                break;
+        }
+        case MPI_EVENT_ON_BUS_TIMER_EXPIRED:
+                ds = "Bus Timer Expired";
+                break;
+        case MPI_EVENT_QUEUE_FULL:
+                ds = "Queue Full";
+                break;
+        case MPI_EVENT_SAS_SES:
+                ds = "SAS SES Event";
+                break;
+        case MPI_EVENT_PERSISTENT_TABLE_FULL:
+                ds = "Persistent Table Full";
+                break;
+        case MPI_EVENT_SAS_PHY_LINK_STATUS:
+                ds = "SAS PHY Link Status";
+                break;
+        case MPI_EVENT_SAS_DISCOVERY_ERROR:
+                ds = "SAS Discovery Error";
                 break;
+
         /*
          *  MPT base "custom" events may be added here...
          */
@@ -5429,7 +5820,7 @@ EventDescriptionStr(u8 event, u32 evData0)
                 ds = "Unknown";
                 break;
         }
-        return ds;
+        strcpy(evStr,ds);
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
@@ -5451,7 +5842,7 @@ ProcessEventNotification(MPT_ADAPTER *ioc, EventNotificationReply_t *pEventReply
         int ii;
         int r = 0;
         int handlers = 0;
-        char *evStr;
+        char evStr[100];
         u8 event;
 
         /*
@@ -5464,7 +5855,7 @@ ProcessEventNotification(MPT_ADAPTER *ioc, EventNotificationReply_t *pEventReply
                 evData0 = le32_to_cpu(pEventReply->Data[0]);
         }
 
-        evStr = EventDescriptionStr(event, evData0);
+        EventDescriptionStr(event, evData0, evStr);
         devtprintk((MYIOC_s_INFO_FMT "MPT event (%s=%02Xh) detected!\n",
                         ioc->name,
                         evStr,
@@ -5481,20 +5872,6 @@ ProcessEventNotification(MPT_ADAPTER *ioc, EventNotificationReply_t *pEventReply
          *  Do general / base driver event processing
          */
         switch(event) {
-        case MPI_EVENT_NONE:                    /* 00 */
-        case MPI_EVENT_LOG_DATA:                /* 01 */
-        case MPI_EVENT_STATE_CHANGE:            /* 02 */
-        case MPI_EVENT_UNIT_ATTENTION:          /* 03 */
-        case MPI_EVENT_IOC_BUS_RESET:           /* 04 */
-        case MPI_EVENT_EXT_BUS_RESET:           /* 05 */
-        case MPI_EVENT_RESCAN:                  /* 06 */
-        case MPI_EVENT_LINK_STATUS_CHANGE:      /* 07 */
-        case MPI_EVENT_LOOP_STATE_CHANGE:       /* 08 */
-        case MPI_EVENT_LOGOUT:                  /* 09 */
-        case MPI_EVENT_INTEGRATED_RAID:         /* 0B */
-        case MPI_EVENT_SCSI_DEVICE_STATUS_CHANGE:       /* 0C */
-        default:
-                break;
         case MPI_EVENT_EVENT_CHANGE:            /* 0A */
                 if (evDataLen) {
                         u8 evState = evData0 & 0xFF;
@@ -5507,6 +5884,8 @@ ProcessEventNotification(MPT_ADAPTER *ioc, EventNotificationReply_t *pEventReply
                         }
                 }
                 break;
+        default:
+                break;
         }
 
         /*
@@ -5653,6 +6032,111 @@ mpt_sp_log_info(MPT_ADAPTER *ioc, u32 log_info)
         printk(MYIOC_s_INFO_FMT "LogInfo(0x%08x): F/W: %s\n", ioc->name, log_info, desc);
 }
 
+/* strings for sas loginfo */
+        static char *originator_str[] = {
+                "IOP",                                          /* 00h */
+                "PL",                                           /* 01h */
+                "IR"                                            /* 02h */
+        };
+        static char *iop_code_str[] = {
+                NULL,                                           /* 00h */
+                "Invalid SAS Address",                          /* 01h */
+                NULL,                                           /* 02h */
+                "Invalid Page",                                 /* 03h */
+                NULL,                                           /* 04h */
+                "Task Terminated"                               /* 05h */
+        };
+        static char *pl_code_str[] = {
+                NULL,                                           /* 00h */
+                "Open Failure",                                 /* 01h */
+                "Invalid Scatter Gather List",                  /* 02h */
+                "Wrong Relative Offset or Frame Length",        /* 03h */
+                "Frame Transfer Error",                         /* 04h */
+                "Transmit Frame Connected Low",                 /* 05h */
+                "SATA Non-NCQ RW Error Bit Set",                /* 06h */
+                "SATA Read Log Receive Data Error",             /* 07h */
+                "SATA NCQ Fail All Commands After Error",       /* 08h */
+                "SATA Error in Receive Set Device Bit FIS",     /* 09h */
+                "Receive Frame Invalid Message",                /* 0Ah */
+                "Receive Context Message Valid Error",          /* 0Bh */
+                "Receive Frame Current Frame Error",            /* 0Ch */
+                "SATA Link Down",                               /* 0Dh */
+                "Discovery SATA Init W IOS",                    /* 0Eh */
+                "Config Invalid Page",                          /* 0Fh */
+                "Discovery SATA Init Timeout",                  /* 10h */
+                "Reset",                                        /* 11h */
+                "Abort",                                        /* 12h */
+                "IO Not Yet Executed",                          /* 13h */
+                "IO Executed",                                  /* 14h */
+                NULL,                                           /* 15h */
+                NULL,                                           /* 16h */
+                NULL,                                           /* 17h */
+                NULL,                                           /* 18h */
+                NULL,                                           /* 19h */
+                NULL,                                           /* 1Ah */
+                NULL,                                           /* 1Bh */
+                NULL,                                           /* 1Ch */
+                NULL,                                           /* 1Dh */
+                NULL,                                           /* 1Eh */
+                NULL,                                           /* 1Fh */
+                "Enclosure Management"                          /* 20h */
+        };
+
+/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+/*
+ *      mpt_sas_log_info - Log information returned from SAS IOC.
+ *      @ioc: Pointer to MPT_ADAPTER structure
+ *      @log_info: U32 LogInfo reply word from the IOC
+ *
+ *      Refer to lsi/mpi_log_sas.h.
+ */
+static void
+mpt_sas_log_info(MPT_ADAPTER *ioc, u32 log_info)
+{
+union loginfo_type {
+        u32     loginfo;
+        struct {
+                u32     subcode:16;
+                u32     code:8;
+                u32     originator:4;
+                u32     bus_type:4;
+        }dw;
+};
+        union loginfo_type sas_loginfo;
+        char *code_desc = NULL;
+
+        sas_loginfo.loginfo = log_info;
+        if ((sas_loginfo.dw.bus_type != 3 /*SAS*/) &&
+            (sas_loginfo.dw.originator < sizeof(originator_str)/sizeof(char*)))
+                return;
+        if ((sas_loginfo.dw.originator == 0 /*IOP*/) &&
+            (sas_loginfo.dw.code < sizeof(iop_code_str)/sizeof(char*))) {
+                code_desc = iop_code_str[sas_loginfo.dw.code];
+        }else if ((sas_loginfo.dw.originator == 1 /*PL*/) &&
+            (sas_loginfo.dw.code < sizeof(pl_code_str)/sizeof(char*) )) {
+                code_desc = pl_code_str[sas_loginfo.dw.code];
+        }
+
+        if (code_desc != NULL)
+                printk(MYIOC_s_INFO_FMT
+                        "LogInfo(0x%08x): Originator={%s}, Code={%s},"
+                        " SubCode(0x%04x)\n",
+                        ioc->name,
+                        log_info,
+                        originator_str[sas_loginfo.dw.originator],
+                        code_desc,
+                        sas_loginfo.dw.subcode);
+        else
+                printk(MYIOC_s_INFO_FMT
+                        "LogInfo(0x%08x): Originator={%s}, Code=(0x%02x),"
+                        " SubCode(0x%04x)\n",
+                        ioc->name,
+                        log_info,
+                        originator_str[sas_loginfo.dw.originator],
+                        sas_loginfo.dw.code,
+                        sas_loginfo.dw.subcode);
+}
+
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
  *      mpt_sp_ioc_info - IOC information returned from SCSI Parallel IOC.
@@ -5814,6 +6298,7 @@ EXPORT_SYMBOL(mpt_findImVolumes);
 EXPORT_SYMBOL(mpt_read_ioc_pg_3);
 EXPORT_SYMBOL(mpt_alloc_fw_memory);
 EXPORT_SYMBOL(mpt_free_fw_memory);
+EXPORT_SYMBOL(mptbase_sas_persist_operation);
 
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
diff --git a/drivers/message/fusion/mptbase.h b/drivers/message/fusion/mptbase.h
index f4827d923731..75105277e22f 100644
--- a/drivers/message/fusion/mptbase.h
+++ b/drivers/message/fusion/mptbase.h
@@ -65,6 +65,7 @@
 #include "lsi/mpi_fc.h"         /* Fibre Channel (lowlevel) support */
 #include "lsi/mpi_targ.h"       /* SCSI/FCP Target protcol support */
 #include "lsi/mpi_tool.h"       /* Tools support */
+#include "lsi/mpi_sas.h"        /* SAS support */
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 
@@ -76,8 +77,8 @@
 #define COPYRIGHT       "Copyright (c) 1999-2005 " MODULEAUTHOR
 #endif
 
-#define MPT_LINUX_VERSION_COMMON        "3.03.02"
-#define MPT_LINUX_PACKAGE_NAME          "@(#)mptlinux-3.03.02"
+#define MPT_LINUX_VERSION_COMMON        "3.03.03"
+#define MPT_LINUX_PACKAGE_NAME          "@(#)mptlinux-3.03.03"
 #define WHAT_MAGIC_STRING               "@" "(" "#" ")"
 
 #define show_mptmod_ver(s,ver)  \
@@ -423,7 +424,7 @@ typedef struct _MPT_IOCTL {
 /*
  *  Event Structure and define
  */
-#define MPTCTL_EVENT_LOG_SIZE           (0x0000000A)
+#define MPTCTL_EVENT_LOG_SIZE           (0x000000032)
 typedef struct _mpt_ioctl_events {
         u32     event;          /* Specified by define above */
         u32     eventContext;   /* Index or counter */
@@ -451,16 +452,13 @@ typedef struct _mpt_ioctl_events {
 #define MPT_SCSICFG_ALL_IDS             0x02    /* WriteSDP1 to all IDS */
 /* #define MPT_SCSICFG_BLK_NEGO         0x10       WriteSDP1 with WDTR and SDTR disabled */
 
-typedef struct _ScsiCfgData {
+typedef struct _SpiCfgData {
         u32              PortFlags;
         int             *nvram;                 /* table of device NVRAM values */
-        IOCPage2_t      *pIocPg2;               /* table of Raid Volumes */
-        IOCPage3_t      *pIocPg3;               /* table of physical disks */
         IOCPage4_t      *pIocPg4;               /* SEP devices addressing */
         dma_addr_t       IocPg4_dma;            /* Phys Addr of IOCPage4 data */
         int              IocPg4Sz;              /* IOCPage4 size */
         u8               dvStatus[MPT_MAX_SCSI_DEVICES];
-        int              isRaid;                /* bit field, 1 if RAID */
         u8               minSyncFactor;         /* 0xFF if async */
         u8               maxSyncOffset;         /* 0 if async */
         u8               maxBusWidth;           /* 0 if narrow, 1 if wide */
@@ -472,10 +470,28 @@ typedef	struct _ScsiCfgData {
         u8               dvScheduled;           /* 1 if scheduled */
         u8               forceDv;               /* 1 to force DV scheduling */
         u8               noQas;                 /* Disable QAS for this adapter */
-        u8               Saf_Te;                /* 1 to force all Processors as SAF-TE if Inquiry data length is too short to check for SAF-TE */
+        u8               Saf_Te;                /* 1 to force all Processors as
+                                                 * SAF-TE if Inquiry data length
+                                                 * is too short to check for SAF-TE
+                                                 */
         u8               mpt_dv;                /* command line option: enhanced=1, basic=0 */
+        u8               bus_reset;             /* 1 to allow bus reset */
         u8               rsvd[1];
-} ScsiCfgData;
+}SpiCfgData;
+
+typedef struct _SasCfgData {
+        u8               ptClear;               /* 1 to automatically clear the
+                                                 * persistent table.
+                                                 * 0 to disable
+                                                 * automatic clearing.
+                                                 */
+}SasCfgData;
+
+typedef struct _RaidCfgData {
+        IOCPage2_t      *pIocPg2;               /* table of Raid Volumes */
+        IOCPage3_t      *pIocPg3;               /* table of physical disks */
+        int              isRaid;                /* bit field, 1 if RAID */
+}RaidCfgData;
 
 /*
  *  Adapter Structure - pci_dev specific. Maximum: MPT_MAX_ADAPTERS
@@ -530,11 +546,16 @@ typedef struct _MPT_ADAPTER
         u8                      *sense_buf_pool;
         dma_addr_t               sense_buf_pool_dma;
         u32                      sense_buf_low_dma;
+        u8                      *HostPageBuffer; /* SAS - host page buffer support */
+        u32                     HostPageBuffer_sz;
+        dma_addr_t              HostPageBuffer_dma;
         int                      mtrr_reg;
         struct pci_dev          *pcidev;        /* struct pci_dev pointer */
         u8                      __iomem *memmap;        /* mmap address */
         struct Scsi_Host        *sh;            /* Scsi Host pointer */
-        ScsiCfgData             spi_data;       /* Scsi config. data */
+        SpiCfgData              spi_data;       /* Scsi config. data */
+        RaidCfgData             raid_data;      /* Raid config. data */
+        SasCfgData              sas_data;       /* Sas config. data */
         MPT_IOCTL               *ioctl;         /* ioctl data pointer */
         struct proc_dir_entry   *ioc_dentry;
         struct _MPT_ADAPTER     *alt_ioc;       /* ptr to 929 bound adapter port */
@@ -554,31 +575,35 @@ typedef struct _MPT_ADAPTER
 #else
         u32                      mfcnt;
 #endif
-        u32                      NB_for_64_byte_frame;       
+        u32                      NB_for_64_byte_frame;
         u32                      hs_req[MPT_MAX_FRAME_SIZE/sizeof(u32)];
         u16                      hs_reply[MPT_MAX_FRAME_SIZE/sizeof(u16)];
         IOCFactsReply_t          facts;
         PortFactsReply_t         pfacts[2];
         FCPortPage0_t            fc_port_page0[2];
+        struct timer_list        persist_timer; /* persist table timer */
+        int                      persist_wait_done; /* persist completion flag */
+        u8                       persist_reply_frame[MPT_DEFAULT_FRAME_SIZE]; /* persist reply */
         LANPage0_t               lan_cnfg_page0;
         LANPage1_t               lan_cnfg_page1;
-        /*  
+        /*
          * Description: errata_flag_1064
          * If a PCIX read occurs within 1 or 2 cycles after the chip receives
          * a split completion for a read data, an internal address pointer incorrectly
          * increments by 32 bytes
          */
-        int                      errata_flag_1064;      
+        int                      errata_flag_1064;
         u8                       FirstWhoInit;
         u8                       upload_fw;     /* If set, do a fw upload */
         u8                       reload_fw;     /* Force a FW Reload on next reset */
-        u8                       NBShiftFactor;  /* NB Shift Factor based on Block Size (Facts)  */     
+        u8                       NBShiftFactor;  /* NB Shift Factor based on Block Size (Facts)  */
         u8                       pad1[4];
         int                      DoneCtx;
         int                      TaskCtx;
         int                      InternalCtx;
-        struct list_head         list; 
+        struct list_head         list;
         struct net_device       *netdev;
+        struct list_head         sas_topology;
 } MPT_ADAPTER;
 
 /*
@@ -964,6 +989,7 @@ extern void	 mpt_alloc_fw_memory(MPT_ADAPTER *ioc, int size);
 extern void      mpt_free_fw_memory(MPT_ADAPTER *ioc);
 extern int       mpt_findImVolumes(MPT_ADAPTER *ioc);
 extern int       mpt_read_ioc_pg_3(MPT_ADAPTER *ioc);
+extern int       mptbase_sas_persist_operation(MPT_ADAPTER *ioc, u8 persist_opcode);
 
 /*
  *  Public data decl's...
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index 7577c2417e2e..cb2d59d5f5af 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -1326,7 +1326,7 @@ mptctl_gettargetinfo (unsigned long arg)
                  */
                 if (hd && hd->Targets) {
                         mpt_findImVolumes(ioc);
-                        pIoc2 = ioc->spi_data.pIocPg2;
+                        pIoc2 = ioc->raid_data.pIocPg2;
                         for ( id = 0; id <= max_id; ) {
                                 if ( pIoc2 && pIoc2->NumActiveVolumes ) {
                                         if ( id == pIoc2->RaidVolume[0].VolumeID ) {
@@ -1348,7 +1348,7 @@ mptctl_gettargetinfo (unsigned long arg)
                                                 --maxWordsLeft;
                                                 goto next_id;
                                         } else {
-                                                pIoc3 = ioc->spi_data.pIocPg3;
+                                                pIoc3 = ioc->raid_data.pIocPg3;
                                                 for ( jj = 0; jj < pIoc3->NumPhysDisks; jj++ ) {
                                                         if ( pIoc3->PhysDisk[jj].PhysDiskID == id )
                                                                 goto next_id;
diff --git a/drivers/message/fusion/mptfc.c b/drivers/message/fusion/mptfc.c
index 13771abea13f..a628be9bbbad 100644
--- a/drivers/message/fusion/mptfc.c
+++ b/drivers/message/fusion/mptfc.c
@@ -189,7 +189,7 @@ mptfc_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 printk(MYIOC_s_WARN_FMT
                         "Skipping ioc=%p because SCSI Initiator mode is NOT enabled!\n",
                         ioc->name, ioc);
-                return -ENODEV;
+                return 0;
         }
 
         sh = scsi_host_alloc(&mptfc_driver_template, sizeof(MPT_SCSI_HOST));
diff --git a/drivers/message/fusion/mptlan.c b/drivers/message/fusion/mptlan.c
index 52794be5a95c..ed3c891e388f 100644
--- a/drivers/message/fusion/mptlan.c
+++ b/drivers/message/fusion/mptlan.c
@@ -312,7 +312,12 @@ static int
 mpt_lan_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
 {
         struct net_device *dev = ioc->netdev;
-        struct mpt_lan_priv *priv = netdev_priv(dev);
+        struct mpt_lan_priv *priv;
+
+        if (dev == NULL)
+                return(1);
+        else
+                priv = netdev_priv(dev);
 
         dlprintk((KERN_INFO MYNAM ": IOC %s_reset routed to LAN driver!\n",
                         reset_phase==MPT_IOC_SETUP_RESET ? "setup" : (
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
new file mode 100644
index 000000000000..429820e48c69
--- /dev/null
+++ b/drivers/message/fusion/mptsas.c
@@ -0,0 +1,1235 @@
+/*
+ *  linux/drivers/message/fusion/mptsas.c
+ *      For use with LSI Logic PCI chip/adapter(s)
+ *      running LSI Logic Fusion MPT (Message Passing Technology) firmware.
+ *
+ *  Copyright (c) 1999-2005 LSI Logic Corporation
+ *  (mailto:mpt_linux_developer@lsil.com)
+ *  Copyright (c) 2005 Dell
+ */
+/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+/*
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; version 2 of the License.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    NO WARRANTY
+    THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
+    CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
+    LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
+    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
+    solely responsible for determining the appropriateness of using and
+    distributing the Program and assumes all risks associated with its
+    exercise of rights under this Agreement, including but not limited to
+    the risks and costs of program errors, damage to or loss of data,
+    programs or equipment, and unavailability or interruption of operations.
+
+    DISCLAIMER OF LIABILITY
+    NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
+    DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+    DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
+    ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+    TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+    USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
+    HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+*/
+/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/sched.h>
+#include <linux/workqueue.h>
+
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_host.h>
+#include <scsi/scsi_transport_sas.h>
+
+#include "mptbase.h"
+#include "mptscsih.h"
+
+
+#define my_NAME         "Fusion MPT SAS Host driver"
+#define my_VERSION      MPT_LINUX_VERSION_COMMON
+#define MYNAM           "mptsas"
+
+MODULE_AUTHOR(MODULEAUTHOR);
+MODULE_DESCRIPTION(my_NAME);
+MODULE_LICENSE("GPL");
+
+static int mpt_pq_filter;
+module_param(mpt_pq_filter, int, 0);
+MODULE_PARM_DESC(mpt_pq_filter,
+                "Enable peripheral qualifier filter: enable=1  "
+                "(default=0)");
+
+static int mpt_pt_clear;
+module_param(mpt_pt_clear, int, 0);
+MODULE_PARM_DESC(mpt_pt_clear,
+                "Clear persistency table: enable=1  "
+                "(default=MPTSCSIH_PT_CLEAR=0)");
+
+static int      mptsasDoneCtx = -1;
+static int      mptsasTaskCtx = -1;
+static int      mptsasInternalCtx = -1; /* Used only for internal commands */
+
+
+/*
+ * SAS topology structures
+ *
+ * The MPT Fusion firmware interface spreads information about the
+ * SAS topology over many manufacture pages, thus we need some data
+ * structure to collect it and process it for the SAS transport class.
+ */
+
+struct mptsas_devinfo {
+        u16     handle;         /* unique id to address this device */
+        u8      phy_id;         /* phy number of parent device */
+        u8      port_id;        /* sas physical port this device
+                                   is assoc'd with */
+        u8      target;         /* logical target id of this device */
+        u8      bus;            /* logical bus number of this device */
+        u64     sas_address;    /* WWN of this device,
+                                   SATA is assigned by HBA,expander */
+        u32     device_info;    /* bitfield detailed info about this device */
+};
+
+struct mptsas_phyinfo {
+        u8      phy_id;                 /* phy index */
+        u8      port_id;                /* port number this phy is part of */
+        u8      negotiated_link_rate;   /* nego'd link rate for this phy */
+        u8      hw_link_rate;           /* hardware max/min phys link rate */
+        u8      programmed_link_rate;   /* programmed max/min phy link rate */
+        struct mptsas_devinfo identify; /* point to phy device info */
+        struct mptsas_devinfo attached; /* point to attached device info */
+        struct sas_rphy *rphy;
+};
+
+struct mptsas_portinfo {
+        struct list_head list;
+        u16             handle;         /* unique id to address this */
+        u8              num_phys;       /* number of phys */
+        struct mptsas_phyinfo *phy_info;
+};
+
+/*
+ * This is pretty ugly.  We will be able to seriously clean it up
+ * once the DV code in mptscsih goes away and we can properly
+ * implement ->target_alloc.
+ */
+static int
+mptsas_slave_alloc(struct scsi_device *device)
+{
+        struct Scsi_Host        *host = device->host;
+        MPT_SCSI_HOST           *hd = (MPT_SCSI_HOST *)host->hostdata;
+        struct sas_rphy         *rphy;
+        struct mptsas_portinfo  *p;
+        VirtDevice              *vdev;
+        uint                    target = device->id;
+        int i;
+
+        if ((vdev = hd->Targets[target]) != NULL)
+                goto out;
+
+        vdev = kmalloc(sizeof(VirtDevice), GFP_KERNEL);
+        if (!vdev) {
+                printk(MYIOC_s_ERR_FMT "slave_alloc kmalloc(%zd) FAILED!\n",
+                                hd->ioc->name, sizeof(VirtDevice));
+                return -ENOMEM;
+        }
+
+        memset(vdev, 0, sizeof(VirtDevice));
+        vdev->tflags = MPT_TARGET_FLAGS_Q_YES|MPT_TARGET_FLAGS_VALID_INQUIRY;
+        vdev->ioc_id = hd->ioc->id;
+
+        rphy = dev_to_rphy(device->sdev_target->dev.parent);
+        list_for_each_entry(p, &hd->ioc->sas_topology, list) {
+                for (i = 0; i < p->num_phys; i++) {
+                        if (p->phy_info[i].attached.sas_address ==
+                                        rphy->identify.sas_address) {
+                                vdev->target_id =
+                                        p->phy_info[i].attached.target;
+                                vdev->bus_id = p->phy_info[i].attached.bus;
+                                hd->Targets[device->id] = vdev;
+                                goto out;
+                        }
+                }
+        }
+
+        printk("No matching SAS device found!!\n");
+        kfree(vdev);
+        return -ENODEV;
+
+ out:
+        vdev->num_luns++;
+        device->hostdata = vdev;
+        return 0;
+}
+
+static struct scsi_host_template mptsas_driver_template = {
+        .proc_name                      = "mptsas",
+        .proc_info                      = mptscsih_proc_info,
+        .name                           = "MPT SPI Host",
+        .info                           = mptscsih_info,
+        .queuecommand                   = mptscsih_qcmd,
+        .slave_alloc                    = mptsas_slave_alloc,
+        .slave_configure                = mptscsih_slave_configure,
+        .slave_destroy                  = mptscsih_slave_destroy,
+        .change_queue_depth             = mptscsih_change_queue_depth,
+        .eh_abort_handler               = mptscsih_abort,
+        .eh_device_reset_handler        = mptscsih_dev_reset,
+        .eh_bus_reset_handler           = mptscsih_bus_reset,
+        .eh_host_reset_handler          = mptscsih_host_reset,
+        .bios_param                     = mptscsih_bios_param,
+        .can_queue                      = MPT_FC_CAN_QUEUE,
+        .this_id                        = -1,
+        .sg_tablesize                   = MPT_SCSI_SG_DEPTH,
+        .max_sectors                    = 8192,
+        .cmd_per_lun                    = 7,
+        .use_clustering                 = ENABLE_CLUSTERING,
+};
+
+static struct sas_function_template mptsas_transport_functions = {
+};
+
+static struct scsi_transport_template *mptsas_transport_template;
+
+#ifdef SASDEBUG
+static void mptsas_print_phy_data(MPI_SAS_IO_UNIT0_PHY_DATA *phy_data)
+{
+        printk("---- IO UNIT PAGE 0 ------------\n");
+        printk("Handle=0x%X\n",
+                le16_to_cpu(phy_data->AttachedDeviceHandle));
+        printk("Controller Handle=0x%X\n",
+                le16_to_cpu(phy_data->ControllerDevHandle));
+        printk("Port=0x%X\n", phy_data->Port);
+        printk("Port Flags=0x%X\n", phy_data->PortFlags);
+        printk("PHY Flags=0x%X\n", phy_data->PhyFlags);
+        printk("Negotiated Link Rate=0x%X\n", phy_data->NegotiatedLinkRate);
+        printk("Controller PHY Device Info=0x%X\n",
+                le32_to_cpu(phy_data->ControllerPhyDeviceInfo));
+        printk("DiscoveryStatus=0x%X\n",
+                le32_to_cpu(phy_data->DiscoveryStatus));
+        printk("\n");
+}
+
+static void mptsas_print_phy_pg0(SasPhyPage0_t *pg0)
+{
+        __le64 sas_address;
+
+        memcpy(&sas_address, &pg0->SASAddress, sizeof(__le64));
+
+        printk("---- SAS PHY PAGE 0 ------------\n");
+        printk("Attached Device Handle=0x%X\n",
+                        le16_to_cpu(pg0->AttachedDevHandle));
+        printk("SAS Address=0x%llX\n",
+                        (unsigned long long)le64_to_cpu(sas_address));
+        printk("Attached PHY Identifier=0x%X\n", pg0->AttachedPhyIdentifier);
+        printk("Attached Device Info=0x%X\n",
+                        le32_to_cpu(pg0->AttachedDeviceInfo));
+        printk("Programmed Link Rate=0x%X\n", pg0->ProgrammedLinkRate);
+        printk("Change Count=0x%X\n", pg0->ChangeCount);
+        printk("PHY Info=0x%X\n", le32_to_cpu(pg0->PhyInfo));
+        printk("\n");
+}
+
+static void mptsas_print_device_pg0(SasDevicePage0_t *pg0)
+{
+        __le64 sas_address;
+
+        memcpy(&sas_address, &pg0->SASAddress, sizeof(__le64));
+
+        printk("---- SAS DEVICE PAGE 0 ---------\n");
+        printk("Handle=0x%X\n" ,le16_to_cpu(pg0->DevHandle));
+        printk("Enclosure Handle=0x%X\n", le16_to_cpu(pg0->EnclosureHandle));
+        printk("Slot=0x%X\n", le16_to_cpu(pg0->Slot));
+        printk("SAS Address=0x%llX\n", le64_to_cpu(sas_address));
+        printk("Target ID=0x%X\n", pg0->TargetID);
+        printk("Bus=0x%X\n", pg0->Bus);
+        printk("PhyNum=0x%X\n", pg0->PhyNum);
+        printk("AccessStatus=0x%X\n", le16_to_cpu(pg0->AccessStatus));
+        printk("Device Info=0x%X\n", le32_to_cpu(pg0->DeviceInfo));
+        printk("Flags=0x%X\n", le16_to_cpu(pg0->Flags));
+        printk("Physical Port=0x%X\n", pg0->PhysicalPort);
+        printk("\n");
+}
+
+static void mptsas_print_expander_pg1(SasExpanderPage1_t *pg1)
+{
+        printk("---- SAS EXPANDER PAGE 1 ------------\n");
+
+        printk("Physical Port=0x%X\n", pg1->PhysicalPort);
+        printk("PHY Identifier=0x%X\n", pg1->Phy);
+        printk("Negotiated Link Rate=0x%X\n", pg1->NegotiatedLinkRate);
+        printk("Programmed Link Rate=0x%X\n", pg1->ProgrammedLinkRate);
+        printk("Hardware Link Rate=0x%X\n", pg1->HwLinkRate);
+        printk("Owner Device Handle=0x%X\n",
+                        le16_to_cpu(pg1->OwnerDevHandle));
+        printk("Attached Device Handle=0x%X\n",
+                        le16_to_cpu(pg1->AttachedDevHandle));
+}
+#else
+#define mptsas_print_phy_data(phy_data)         do { } while (0)
+#define mptsas_print_phy_pg0(pg0)               do { } while (0)
+#define mptsas_print_device_pg0(pg0)            do { } while (0)
+#define mptsas_print_expander_pg1(pg1)          do { } while (0)
+#endif
+
+static int
+mptsas_sas_io_unit_pg0(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
+{
+        ConfigExtendedPageHeader_t hdr;
+        CONFIGPARMS cfg;
+        SasIOUnitPage0_t *buffer;
+        dma_addr_t dma_handle;
+        int error, i;
+
+        hdr.PageVersion = MPI_SASIOUNITPAGE0_PAGEVERSION;
+        hdr.ExtPageLength = 0;
+        hdr.PageNumber = 0;
+        hdr.Reserved1 = 0;
+        hdr.Reserved2 = 0;
+        hdr.PageType = MPI_CONFIG_PAGETYPE_EXTENDED;
+        hdr.ExtPageType = MPI_CONFIG_EXTPAGETYPE_SAS_IO_UNIT;
+
+        cfg.cfghdr.ehdr = &hdr;
+        cfg.physAddr = -1;
+        cfg.pageAddr = 0;
+        cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
+        cfg.dir = 0;    /* read */
+        cfg.timeout = 10;
+
+        error = mpt_config(ioc, &cfg);
+        if (error)
+                goto out;
+        if (!hdr.ExtPageLength) {
+                error = -ENXIO;
+                goto out;
+        }
+
+        buffer = pci_alloc_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
+                                            &dma_handle);
+        if (!buffer) {
+                error = -ENOMEM;
+                goto out;
+        }
+
+        cfg.physAddr = dma_handle;
+        cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
+
+        error = mpt_config(ioc, &cfg);
+        if (error)
+                goto out_free_consistent;
+
+        port_info->num_phys = buffer->NumPhys;
+        port_info->phy_info = kcalloc(port_info->num_phys,
+                sizeof(struct mptsas_phyinfo),GFP_KERNEL);
+        if (!port_info->phy_info) {
+                error = -ENOMEM;
+                goto out_free_consistent;
+        }
+
+        for (i = 0; i < port_info->num_phys; i++) {
+                mptsas_print_phy_data(&buffer->PhyData[i]);
+                port_info->phy_info[i].phy_id = i;
+                port_info->phy_info[i].port_id =
+                    buffer->PhyData[i].Port;
+                port_info->phy_info[i].negotiated_link_rate =
+                    buffer->PhyData[i].NegotiatedLinkRate;
+        }
+
+ out_free_consistent:
+        pci_free_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
+                            buffer, dma_handle);
+ out:
+        return error;
+}
+
+static int
+mptsas_sas_phy_pg0(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info,
+                u32 form, u32 form_specific)
+{
+        ConfigExtendedPageHeader_t hdr;
+        CONFIGPARMS cfg;
+        SasPhyPage0_t *buffer;
+        dma_addr_t dma_handle;
+        int error;
+
+        hdr.PageVersion = MPI_SASPHY0_PAGEVERSION;
+        hdr.ExtPageLength = 0;
+        hdr.PageNumber = 0;
+        hdr.Reserved1 = 0;
+        hdr.Reserved2 = 0;
+        hdr.PageType = MPI_CONFIG_PAGETYPE_EXTENDED;
+        hdr.ExtPageType = MPI_CONFIG_EXTPAGETYPE_SAS_PHY;
+
+        cfg.cfghdr.ehdr = &hdr;
+        cfg.dir = 0;    /* read */
+        cfg.timeout = 10;
+
+        /* Get Phy Pg 0 for each Phy. */
+        cfg.physAddr = -1;
+        cfg.pageAddr = form + form_specific;
+        cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
+
+        error = mpt_config(ioc, &cfg);
+        if (error)
+                goto out;
+
+        if (!hdr.ExtPageLength) {
+                error = -ENXIO;
+                goto out;
+        }
+
+        buffer = pci_alloc_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
+                                      &dma_handle);
+        if (!buffer) {
+                error = -ENOMEM;
+                goto out;
+        }
+
+        cfg.physAddr = dma_handle;
+        cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
+
+        error = mpt_config(ioc, &cfg);
+        if (error)
+                goto out_free_consistent;
+
+        mptsas_print_phy_pg0(buffer);
+
+        phy_info->hw_link_rate = buffer->HwLinkRate;
+        phy_info->programmed_link_rate = buffer->ProgrammedLinkRate;
+        phy_info->identify.handle = le16_to_cpu(buffer->OwnerDevHandle);
+        phy_info->attached.handle = le16_to_cpu(buffer->AttachedDevHandle);
+
+ out_free_consistent:
+        pci_free_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
+                            buffer, dma_handle);
+ out:
+        return error;
+}
+
+static int
+mptsas_sas_device_pg0(MPT_ADAPTER *ioc, struct mptsas_devinfo *device_info,
+                u32 form, u32 form_specific)
+{
+        ConfigExtendedPageHeader_t hdr;
+        CONFIGPARMS cfg;
+        SasDevicePage0_t *buffer;
+        dma_addr_t dma_handle;
+        __le64 sas_address;
+        int error;
+
+        hdr.PageVersion = MPI_SASDEVICE0_PAGEVERSION;
+        hdr.ExtPageLength = 0;
+        hdr.PageNumber = 0;
+        hdr.Reserved1 = 0;
+        hdr.Reserved2 = 0;
+        hdr.PageType = MPI_CONFIG_PAGETYPE_EXTENDED;
+        hdr.ExtPageType = MPI_CONFIG_EXTPAGETYPE_SAS_DEVICE;
+
+        cfg.cfghdr.ehdr = &hdr;
+        cfg.pageAddr = form + form_specific;
+        cfg.physAddr = -1;
+        cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
+        cfg.dir = 0;    /* read */
+        cfg.timeout = 10;
+
+        error = mpt_config(ioc, &cfg);
+        if (error)
+                goto out;
+        if (!hdr.ExtPageLength) {
+                error = -ENXIO;
+                goto out;
+        }
+
+        buffer = pci_alloc_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
+                                      &dma_handle);
+        if (!buffer) {
+                error = -ENOMEM;
+                goto out;
+        }
+
+        cfg.physAddr = dma_handle;
+        cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
+
+        error = mpt_config(ioc, &cfg);
+        if (error)
+                goto out_free_consistent;
+
+        mptsas_print_device_pg0(buffer);
+
+        device_info->handle = le16_to_cpu(buffer->DevHandle);
+        device_info->phy_id = buffer->PhyNum;
+        device_info->port_id = buffer->PhysicalPort;
+        device_info->target = buffer->TargetID;
+        device_info->bus = buffer->Bus;
+        memcpy(&sas_address, &buffer->SASAddress, sizeof(__le64));
+        device_info->sas_address = le64_to_cpu(sas_address);
+        device_info->device_info =
+            le32_to_cpu(buffer->DeviceInfo);
+
+ out_free_consistent:
+        pci_free_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
+                            buffer, dma_handle);
+ out:
+        return error;
+}
+
+static int
+mptsas_sas_expander_pg0(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info,
+                u32 form, u32 form_specific)
+{
+        ConfigExtendedPageHeader_t hdr;
+        CONFIGPARMS cfg;
+        SasExpanderPage0_t *buffer;
+        dma_addr_t dma_handle;
+        int error;
+
+        hdr.PageVersion = MPI_SASEXPANDER0_PAGEVERSION;
+        hdr.ExtPageLength = 0;
+        hdr.PageNumber = 0;
+        hdr.Reserved1 = 0;
+        hdr.Reserved2 = 0;
+        hdr.PageType = MPI_CONFIG_PAGETYPE_EXTENDED;
+        hdr.ExtPageType = MPI_CONFIG_EXTPAGETYPE_SAS_EXPANDER;
+
+        cfg.cfghdr.ehdr = &hdr;
+        cfg.physAddr = -1;
+        cfg.pageAddr = form + form_specific;
+        cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
+        cfg.dir = 0;    /* read */
+        cfg.timeout = 10;
+
+        error = mpt_config(ioc, &cfg);
+        if (error)
+                goto out;
+
+        if (!hdr.ExtPageLength) {
+                error = -ENXIO;
+                goto out;
+        }
+
+        buffer = pci_alloc_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
+                                      &dma_handle);
+        if (!buffer) {
+                error = -ENOMEM;
+                goto out;
+        }
+
+        cfg.physAddr = dma_handle;
+        cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
+
+        error = mpt_config(ioc, &cfg);
+        if (error)
+                goto out_free_consistent;
+
+        /* save config data */
+        port_info->num_phys = buffer->NumPhys;
+        port_info->handle = le16_to_cpu(buffer->DevHandle);
+        port_info->phy_info = kcalloc(port_info->num_phys,
+                sizeof(struct mptsas_phyinfo),GFP_KERNEL);
+        if (!port_info->phy_info) {
+                error = -ENOMEM;
+                goto out_free_consistent;
+        }
+
+ out_free_consistent:
+        pci_free_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
+                            buffer, dma_handle);
+ out:
+        return error;
+}
+
+static int
+mptsas_sas_expander_pg1(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info,
+                u32 form, u32 form_specific)
+{
+        ConfigExtendedPageHeader_t hdr;
+        CONFIGPARMS cfg;
+        SasExpanderPage1_t *buffer;
+        dma_addr_t dma_handle;
+        int error;
+
+        hdr.PageVersion = MPI_SASEXPANDER0_PAGEVERSION;
+        hdr.ExtPageLength = 0;
+        hdr.PageNumber = 1;
+        hdr.Reserved1 = 0;
+        hdr.Reserved2 = 0;
+        hdr.PageType = MPI_CONFIG_PAGETYPE_EXTENDED;
+        hdr.ExtPageType = MPI_CONFIG_EXTPAGETYPE_SAS_EXPANDER;
+
+        cfg.cfghdr.ehdr = &hdr;
+        cfg.physAddr = -1;
+        cfg.pageAddr = form + form_specific;
+        cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
+        cfg.dir = 0;    /* read */
+        cfg.timeout = 10;
+
+        error = mpt_config(ioc, &cfg);
+        if (error)
+                goto out;
+
+        if (!hdr.ExtPageLength) {
+                error = -ENXIO;
+                goto out;
+        }
+
+        buffer = pci_alloc_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
+                                      &dma_handle);
+        if (!buffer) {
+                error = -ENOMEM;
+                goto out;
+        }
+
+        cfg.physAddr = dma_handle;
+        cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
+
+        error = mpt_config(ioc, &cfg);
+        if (error)
+                goto out_free_consistent;
+
+
+        mptsas_print_expander_pg1(buffer);
+
+        /* save config data */
+        phy_info->phy_id = buffer->Phy;
+        phy_info->port_id = buffer->PhysicalPort;
+        phy_info->negotiated_link_rate = buffer->NegotiatedLinkRate;
+        phy_info->programmed_link_rate = buffer->ProgrammedLinkRate;
+        phy_info->hw_link_rate = buffer->HwLinkRate;
+        phy_info->identify.handle = le16_to_cpu(buffer->OwnerDevHandle);
+        phy_info->attached.handle = le16_to_cpu(buffer->AttachedDevHandle);
+
+
+ out_free_consistent:
+        pci_free_consistent(ioc->pcidev, hdr.ExtPageLength * 4,
+                            buffer, dma_handle);
+ out:
+        return error;
+}
+
+static void
+mptsas_parse_device_info(struct sas_identify *identify,
+                struct mptsas_devinfo *device_info)
+{
+        u16 protocols;
+
+        identify->sas_address = device_info->sas_address;
+        identify->phy_identifier = device_info->phy_id;
+
+        /*
+         * Fill in Phy Initiator Port Protocol.
+         * Bits 6:3, more than one bit can be set, fall through cases.
+         */
+        protocols = device_info->device_info & 0x78;
+        identify->initiator_port_protocols = 0;
+        if (protocols & MPI_SAS_DEVICE_INFO_SSP_INITIATOR)
+                identify->initiator_port_protocols |= SAS_PROTOCOL_SSP;
+        if (protocols & MPI_SAS_DEVICE_INFO_STP_INITIATOR)
+                identify->initiator_port_protocols |= SAS_PROTOCOL_STP;
+        if (protocols & MPI_SAS_DEVICE_INFO_SMP_INITIATOR)
+                identify->initiator_port_protocols |= SAS_PROTOCOL_SMP;
+        if (protocols & MPI_SAS_DEVICE_INFO_SATA_HOST)
+                identify->initiator_port_protocols |= SAS_PROTOCOL_SATA;
+
+        /*
+         * Fill in Phy Target Port Protocol.
+         * Bits 10:7, more than one bit can be set, fall through cases.
+         */
+        protocols = device_info->device_info & 0x780;
+        identify->target_port_protocols = 0;
+        if (protocols & MPI_SAS_DEVICE_INFO_SSP_TARGET)
+                identify->target_port_protocols |= SAS_PROTOCOL_SSP;
+        if (protocols & MPI_SAS_DEVICE_INFO_STP_TARGET)
+                identify->target_port_protocols |= SAS_PROTOCOL_STP;
+        if (protocols & MPI_SAS_DEVICE_INFO_SMP_TARGET)
+                identify->target_port_protocols |= SAS_PROTOCOL_SMP;
+        if (protocols & MPI_SAS_DEVICE_INFO_SATA_DEVICE)
+                identify->target_port_protocols |= SAS_PROTOCOL_SATA;
+
+        /*
+         * Fill in Attached device type.
+         */
+        switch (device_info->device_info &
+                        MPI_SAS_DEVICE_INFO_MASK_DEVICE_TYPE) {
+        case MPI_SAS_DEVICE_INFO_NO_DEVICE:
+                identify->device_type = SAS_PHY_UNUSED;
+                break;
+        case MPI_SAS_DEVICE_INFO_END_DEVICE:
+                identify->device_type = SAS_END_DEVICE;
+                break;
+        case MPI_SAS_DEVICE_INFO_EDGE_EXPANDER:
+                identify->device_type = SAS_EDGE_EXPANDER_DEVICE;
+                break;
+        case MPI_SAS_DEVICE_INFO_FANOUT_EXPANDER:
+                identify->device_type = SAS_FANOUT_EXPANDER_DEVICE;
+                break;
+        }
+}
+
+static int mptsas_probe_one_phy(struct device *dev,
+                struct mptsas_phyinfo *phy_info, int index)
+{
+        struct sas_phy *port;
+        int error;
+
+        port = sas_phy_alloc(dev, index);
+        if (!port)
+                return -ENOMEM;
+
+        port->port_identifier = phy_info->port_id;
+        mptsas_parse_device_info(&port->identify, &phy_info->identify);
+
+        /*
+         * Set Negotiated link rate.
+         */
+        switch (phy_info->negotiated_link_rate) {
+        case MPI_SAS_IOUNIT0_RATE_PHY_DISABLED:
+                port->negotiated_linkrate = SAS_PHY_DISABLED;
+                break;
+        case MPI_SAS_IOUNIT0_RATE_FAILED_SPEED_NEGOTIATION:
+                port->negotiated_linkrate = SAS_LINK_RATE_FAILED;
+                break;
+        case MPI_SAS_IOUNIT0_RATE_1_5:
+                port->negotiated_linkrate = SAS_LINK_RATE_1_5_GBPS;
+                break;
+        case MPI_SAS_IOUNIT0_RATE_3_0:
+                port->negotiated_linkrate = SAS_LINK_RATE_3_0_GBPS;
+                break;
+        case MPI_SAS_IOUNIT0_RATE_SATA_OOB_COMPLETE:
+        case MPI_SAS_IOUNIT0_RATE_UNKNOWN:
+        default:
+                port->negotiated_linkrate = SAS_LINK_RATE_UNKNOWN;
+                break;
+        }
+
+        /*
+         * Set Max hardware link rate.
+         */
+        switch (phy_info->hw_link_rate & MPI_SAS_PHY0_PRATE_MAX_RATE_MASK) {
+        case MPI_SAS_PHY0_HWRATE_MAX_RATE_1_5:
+                port->maximum_linkrate_hw = SAS_LINK_RATE_1_5_GBPS;
+                break;
+        case MPI_SAS_PHY0_PRATE_MAX_RATE_3_0:
+                port->maximum_linkrate_hw = SAS_LINK_RATE_3_0_GBPS;
+                break;
+        default:
+                break;
+        }
+
+        /*
+         * Set Max programmed link rate.
+         */
+        switch (phy_info->programmed_link_rate &
+                        MPI_SAS_PHY0_PRATE_MAX_RATE_MASK) {
+        case MPI_SAS_PHY0_PRATE_MAX_RATE_1_5:
+                port->maximum_linkrate = SAS_LINK_RATE_1_5_GBPS;
+                break;
+        case MPI_SAS_PHY0_PRATE_MAX_RATE_3_0:
+                port->maximum_linkrate = SAS_LINK_RATE_3_0_GBPS;
+                break;
+        default:
+                break;
+        }
+
+        /*
+         * Set Min hardware link rate.
+         */
+        switch (phy_info->hw_link_rate & MPI_SAS_PHY0_HWRATE_MIN_RATE_MASK) {
+        case MPI_SAS_PHY0_HWRATE_MIN_RATE_1_5:
+                port->minimum_linkrate_hw = SAS_LINK_RATE_1_5_GBPS;
+                break;
+        case MPI_SAS_PHY0_PRATE_MIN_RATE_3_0:
+                port->minimum_linkrate_hw = SAS_LINK_RATE_3_0_GBPS;
+                break;
+        default:
+                break;
+        }
+
+        /*
+         * Set Min programmed link rate.
+         */
+        switch (phy_info->programmed_link_rate &
+                        MPI_SAS_PHY0_PRATE_MIN_RATE_MASK) {
+        case MPI_SAS_PHY0_PRATE_MIN_RATE_1_5:
+                port->minimum_linkrate = SAS_LINK_RATE_1_5_GBPS;
+                break;
+        case MPI_SAS_PHY0_PRATE_MIN_RATE_3_0:
+                port->minimum_linkrate = SAS_LINK_RATE_3_0_GBPS;
+                break;
+        default:
+                break;
+        }
+
+        error = sas_phy_add(port);
+        if (error) {
+                sas_phy_free(port);
+                return error;
+        }
+
+        if (phy_info->attached.handle) {
+                struct sas_rphy *rphy;
+
+                rphy = sas_rphy_alloc(port);
+                if (!rphy)
+                        return 0; /* non-fatal: an rphy can be added later */
+
+                mptsas_parse_device_info(&rphy->identify, &phy_info->attached);
+                error = sas_rphy_add(rphy);
+                if (error) {
+                        sas_rphy_free(rphy);
+                        return error;
+                }
+
+                phy_info->rphy = rphy;
+        }
+
+        return 0;
+}
+
+static int
+mptsas_probe_hba_phys(MPT_ADAPTER *ioc, int *index)
+{
+        struct mptsas_portinfo *port_info;
+        u32 handle = 0xFFFF;
+        int error = -ENOMEM, i;
+
+        port_info = kmalloc(sizeof(*port_info), GFP_KERNEL);
+        if (!port_info)
+                goto out;
+        memset(port_info, 0, sizeof(*port_info));
+
+        error = mptsas_sas_io_unit_pg0(ioc, port_info);
+        if (error)
+                goto out_free_port_info;
+
+        list_add_tail(&port_info->list, &ioc->sas_topology);
+
+        for (i = 0; i < port_info->num_phys; i++) {
+                mptsas_sas_phy_pg0(ioc, &port_info->phy_info[i],
+                        (MPI_SAS_PHY_PGAD_FORM_PHY_NUMBER <<
+                         MPI_SAS_PHY_PGAD_FORM_SHIFT), i);
+
+                mptsas_sas_device_pg0(ioc, &port_info->phy_info[i].identify,
+                        (MPI_SAS_DEVICE_PGAD_FORM_GET_NEXT_HANDLE <<
+                         MPI_SAS_DEVICE_PGAD_FORM_SHIFT), handle);
+                handle = port_info->phy_info[i].identify.handle;
+
+                if (port_info->phy_info[i].attached.handle) {
+                        mptsas_sas_device_pg0(ioc,
+                                &port_info->phy_info[i].attached,
+                                (MPI_SAS_DEVICE_PGAD_FORM_HANDLE <<
+                                 MPI_SAS_DEVICE_PGAD_FORM_SHIFT),
+                                port_info->phy_info[i].attached.handle);
+                }
+
+                mptsas_probe_one_phy(&ioc->sh->shost_gendev,
+                                     &port_info->phy_info[i], *index);
+                (*index)++;
+        }
+
+        return 0;
+
+ out_free_port_info:
+        kfree(port_info);
+ out:
+        return error;
+}
+
+static int
+mptsas_probe_expander_phys(MPT_ADAPTER *ioc, u32 *handle, int *index)
+{
+        struct mptsas_portinfo *port_info, *p;
+        int error = -ENOMEM, i, j;
+
+        port_info = kmalloc(sizeof(*port_info), GFP_KERNEL);
+        if (!port_info)
+                goto out;
+        memset(port_info, 0, sizeof(*port_info));
+
+        error = mptsas_sas_expander_pg0(ioc, port_info,
+                (MPI_SAS_EXPAND_PGAD_FORM_GET_NEXT_HANDLE <<
+                 MPI_SAS_EXPAND_PGAD_FORM_SHIFT), *handle);
+        if (error)
+                goto out_free_port_info;
+
+        *handle = port_info->handle;
+
+        list_add_tail(&port_info->list, &ioc->sas_topology);
+        for (i = 0; i < port_info->num_phys; i++) {
+                struct device *parent;
+
+                mptsas_sas_expander_pg1(ioc, &port_info->phy_info[i],
+                        (MPI_SAS_EXPAND_PGAD_FORM_HANDLE_PHY_NUM <<
+                         MPI_SAS_EXPAND_PGAD_FORM_SHIFT), (i << 16) + *handle);
+
+                if (port_info->phy_info[i].identify.handle) {
+                        mptsas_sas_device_pg0(ioc,
+                                &port_info->phy_info[i].identify,
+                                (MPI_SAS_DEVICE_PGAD_FORM_HANDLE <<
+                                 MPI_SAS_DEVICE_PGAD_FORM_SHIFT),
+                                port_info->phy_info[i].identify.handle);
+                }
+
+                if (port_info->phy_info[i].attached.handle) {
+                        mptsas_sas_device_pg0(ioc,
+                                &port_info->phy_info[i].attached,
+                                (MPI_SAS_DEVICE_PGAD_FORM_HANDLE <<
+                                 MPI_SAS_DEVICE_PGAD_FORM_SHIFT),
+                                port_info->phy_info[i].attached.handle);
+                }
+
+                /*
+                 * If we find a parent port handle this expander is
+                 * attached to another expander, else it hangs of the
+                 * HBA phys.
+                 */
+                parent = &ioc->sh->shost_gendev;
+                list_for_each_entry(p, &ioc->sas_topology, list) {
+                        for (j = 0; j < p->num_phys; j++) {
+                                if (port_info->phy_info[i].identify.handle ==
+                                                p->phy_info[j].attached.handle)
+                                        parent = &p->phy_info[j].rphy->dev;
+                        }
+                }
+
+                mptsas_probe_one_phy(parent, &port_info->phy_info[i], *index);
+                (*index)++;
+        }
+
+        return 0;
+
+ out_free_port_info:
+        kfree(port_info);
+ out:
+        return error;
+}
+
+static void
+mptsas_scan_sas_topology(MPT_ADAPTER *ioc)
+{
+        u32 handle = 0xFFFF;
+        int index = 0;
+
+        mptsas_probe_hba_phys(ioc, &index);
+        while (!mptsas_probe_expander_phys(ioc, &handle, &index))
+                ;
+}
+
+static int
+mptsas_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+{
+        struct Scsi_Host        *sh;
+        MPT_SCSI_HOST           *hd;
+        MPT_ADAPTER             *ioc;
+        unsigned long            flags;
+        int                      sz, ii;
+        int                      numSGE = 0;
+        int                      scale;
+        int                      ioc_cap;
+        u8                      *mem;
+        int                     error=0;
+        int                     r;
+
+        r = mpt_attach(pdev,id);
+        if (r)
+                return r;
+
+        ioc = pci_get_drvdata(pdev);
+        ioc->DoneCtx = mptsasDoneCtx;
+        ioc->TaskCtx = mptsasTaskCtx;
+        ioc->InternalCtx = mptsasInternalCtx;
+
+        /*  Added sanity check on readiness of the MPT adapter.
+         */
+        if (ioc->last_state != MPI_IOC_STATE_OPERATIONAL) {
+                printk(MYIOC_s_WARN_FMT
+                  "Skipping because it's not operational!\n",
+                  ioc->name);
+                return -ENODEV;
+        }
+
+        if (!ioc->active) {
+                printk(MYIOC_s_WARN_FMT "Skipping because it's disabled!\n",
+                  ioc->name);
+                return -ENODEV;
+        }
+
+        /*  Sanity check - ensure at least 1 port is INITIATOR capable
+         */
+        ioc_cap = 0;
+        for (ii = 0; ii < ioc->facts.NumberOfPorts; ii++) {
+                if (ioc->pfacts[ii].ProtocolFlags &
+                                MPI_PORTFACTS_PROTOCOL_INITIATOR)
+                        ioc_cap++;
+        }
+
+        if (!ioc_cap) {
+                printk(MYIOC_s_WARN_FMT
+                        "Skipping ioc=%p because SCSI Initiator mode "
+                        "is NOT enabled!\n", ioc->name, ioc);
+                return 0;
+        }
+
+        sh = scsi_host_alloc(&mptsas_driver_template, sizeof(MPT_SCSI_HOST));
+        if (!sh) {
+                printk(MYIOC_s_WARN_FMT
+                        "Unable to register controller with SCSI subsystem\n",
+                        ioc->name);
+                return -1;
+        }
+
+        spin_lock_irqsave(&ioc->FreeQlock, flags);
+
+        /* Attach the SCSI Host to the IOC structure
+         */
+        ioc->sh = sh;
+
+        sh->io_port = 0;
+        sh->n_io_port = 0;
+        sh->irq = 0;
+
+        /* set 16 byte cdb's */
+        sh->max_cmd_len = 16;
+
+        sh->max_id = ioc->pfacts->MaxDevices + 1;
+
+        sh->transportt = mptsas_transport_template;
+
+        sh->max_lun = MPT_LAST_LUN + 1;
+        sh->max_channel = 0;
+        sh->this_id = ioc->pfacts[0].PortSCSIID;
+
+        /* Required entry.
+         */
+        sh->unique_id = ioc->id;
+
+        INIT_LIST_HEAD(&ioc->sas_topology);
+
+        /* Verify that we won't exceed the maximum
+         * number of chain buffers
+         * We can optimize:  ZZ = req_sz/sizeof(SGE)
+         * For 32bit SGE's:
+         *  numSGE = 1 + (ZZ-1)*(maxChain -1) + ZZ
+         *               + (req_sz - 64)/sizeof(SGE)
+         * A slightly different algorithm is required for
+         * 64bit SGEs.
+         */
+        scale = ioc->req_sz/(sizeof(dma_addr_t) + sizeof(u32));
+        if (sizeof(dma_addr_t) == sizeof(u64)) {
+                numSGE = (scale - 1) *
+                  (ioc->facts.MaxChainDepth-1) + scale +
+                  (ioc->req_sz - 60) / (sizeof(dma_addr_t) +
+                  sizeof(u32));
+        } else {
+                numSGE = 1 + (scale - 1) *
+                  (ioc->facts.MaxChainDepth-1) + scale +
+                  (ioc->req_sz - 64) / (sizeof(dma_addr_t) +
+                  sizeof(u32));
+        }
+
+        if (numSGE < sh->sg_tablesize) {
+                /* Reset this value */
+                dprintk((MYIOC_s_INFO_FMT
+                  "Resetting sg_tablesize to %d from %d\n",
+                  ioc->name, numSGE, sh->sg_tablesize));
+                sh->sg_tablesize = numSGE;
+        }
+
+        spin_unlock_irqrestore(&ioc->FreeQlock, flags);
+
+        hd = (MPT_SCSI_HOST *) sh->hostdata;
+        hd->ioc = ioc;
+
+        /* SCSI needs scsi_cmnd lookup table!
+         * (with size equal to req_depth*PtrSz!)
+         */
+        sz = ioc->req_depth * sizeof(void *);
+        mem = kmalloc(sz, GFP_ATOMIC);
+        if (mem == NULL) {
+                error = -ENOMEM;
+                goto mptsas_probe_failed;
+        }
+
+        memset(mem, 0, sz);
+        hd->ScsiLookup = (struct scsi_cmnd **) mem;
+
+        dprintk((MYIOC_s_INFO_FMT "ScsiLookup @ %p, sz=%d\n",
+                 ioc->name, hd->ScsiLookup, sz));
+
+        /* Allocate memory for the device structures.
+         * A non-Null pointer at an offset
+         * indicates a device exists.
+         * max_id = 1 + maximum id (hosts.h)
+         */
+        sz = sh->max_id * sizeof(void *);
+        mem = kmalloc(sz, GFP_ATOMIC);
+        if (mem == NULL) {
+                error = -ENOMEM;
+                goto mptsas_probe_failed;
+        }
+
+        memset(mem, 0, sz);
+        hd->Targets = (VirtDevice **) mem;
+
+        dprintk((KERN_INFO
+          "  Targets @ %p, sz=%d\n", hd->Targets, sz));
+
+        /* Clear the TM flags
+         */
+        hd->tmPending = 0;
+        hd->tmState = TM_STATE_NONE;
+        hd->resetPending = 0;
+        hd->abortSCpnt = NULL;
+
+        /* Clear the pointer used to store
+         * single-threaded commands, i.e., those
+         * issued during a bus scan, dv and
+         * configuration pages.
+         */
+        hd->cmdPtr = NULL;
+
+        /* Initialize this SCSI Hosts' timers
+         * To use, set the timer expires field
+         * and add_timer
+         */
+        init_timer(&hd->timer);
+        hd->timer.data = (unsigned long) hd;
+        hd->timer.function = mptscsih_timer_expired;
+
+        hd->mpt_pq_filter = mpt_pq_filter;
+        ioc->sas_data.ptClear = mpt_pt_clear;
+
+        if (ioc->sas_data.ptClear==1) {
+                mptbase_sas_persist_operation(
+                    ioc, MPI_SAS_OP_CLEAR_ALL_PERSISTENT);
+        }
+
+        ddvprintk((MYIOC_s_INFO_FMT
+                "mpt_pq_filter %x mpt_pq_filter %x\n",
+                ioc->name,
+                mpt_pq_filter,
+                mpt_pq_filter));
+
+        init_waitqueue_head(&hd->scandv_waitq);
+        hd->scandv_wait_done = 0;
+        hd->last_queue_full = 0;
+
+        error = scsi_add_host(sh, &ioc->pcidev->dev);
+        if (error) {
+                dprintk((KERN_ERR MYNAM
+                  "scsi_add_host failed\n"));
+                goto mptsas_probe_failed;
+        }
+
+        mptsas_scan_sas_topology(ioc);
+
+        return 0;
+
+mptsas_probe_failed:
+
+        mptscsih_remove(pdev);
+        return error;
+}
+
+static void __devexit mptsas_remove(struct pci_dev *pdev)
+{
+        MPT_ADAPTER *ioc = pci_get_drvdata(pdev);
+        struct mptsas_portinfo *p, *n;
+
+        sas_remove_host(ioc->sh);
+
+        list_for_each_entry_safe(p, n, &ioc->sas_topology, list) {
+                list_del(&p->list);
+                kfree(p);
+        }
+
+        mptscsih_remove(pdev);
+}
+
+static struct pci_device_id mptsas_pci_table[] = {
+        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1064,
+                PCI_ANY_ID, PCI_ANY_ID },
+        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1066,
+                PCI_ANY_ID, PCI_ANY_ID },
+        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1068,
+                PCI_ANY_ID, PCI_ANY_ID },
+        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1064E,
+                PCI_ANY_ID, PCI_ANY_ID },
+        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1066E,
+                PCI_ANY_ID, PCI_ANY_ID },
+        { PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1068E,
+                PCI_ANY_ID, PCI_ANY_ID },
+        {0}     /* Terminating entry */
+};
+MODULE_DEVICE_TABLE(pci, mptsas_pci_table);
+
+
+static struct pci_driver mptsas_driver = {
+        .name           = "mptsas",
+        .id_table       = mptsas_pci_table,
+        .probe          = mptsas_probe,
+        .remove         = __devexit_p(mptsas_remove),
+        .shutdown       = mptscsih_shutdown,
+#ifdef CONFIG_PM
+        .suspend        = mptscsih_suspend,
+        .resume         = mptscsih_resume,
+#endif
+};
+
+static int __init
+mptsas_init(void)
+{
+        show_mptmod_ver(my_NAME, my_VERSION);
+
+        mptsas_transport_template =
+            sas_attach_transport(&mptsas_transport_functions);
+        if (!mptsas_transport_template)
+                return -ENODEV;
+
+        mptsasDoneCtx = mpt_register(mptscsih_io_done, MPTSAS_DRIVER);
+        mptsasTaskCtx = mpt_register(mptscsih_taskmgmt_complete, MPTSAS_DRIVER);
+        mptsasInternalCtx =
+                mpt_register(mptscsih_scandv_complete, MPTSAS_DRIVER);
+
+        if (mpt_event_register(mptsasDoneCtx, mptscsih_event_process) == 0) {
+                devtprintk((KERN_INFO MYNAM
+                  ": Registered for IOC event notifications\n"));
+        }
+
+        if (mpt_reset_register(mptsasDoneCtx, mptscsih_ioc_reset) == 0) {
+                dprintk((KERN_INFO MYNAM
+                  ": Registered for IOC reset notifications\n"));
+        }
+
+        return pci_register_driver(&mptsas_driver);
+}
+
+static void __exit
+mptsas_exit(void)
+{
+        pci_unregister_driver(&mptsas_driver);
+        sas_release_transport(mptsas_transport_template);
+
+        mpt_reset_deregister(mptsasDoneCtx);
+        mpt_event_deregister(mptsasDoneCtx);
+
+        mpt_deregister(mptsasInternalCtx);
+        mpt_deregister(mptsasTaskCtx);
+        mpt_deregister(mptsasDoneCtx);
+}
+
+module_init(mptsas_init);
+module_exit(mptsas_exit);
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index 4a003dc5fde8..5cb07eb224d7 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -62,6 +62,7 @@
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_tcq.h>
+#include <scsi/scsi_dbg.h>
 
 #include "mptbase.h"
 #include "mptscsih.h"
@@ -93,8 +94,9 @@ typedef struct _BIG_SENSE_BUF {
 
 #define MPT_ICFLAG_BUF_CAP      0x01    /* ReadBuffer Read Capacity format */
 #define MPT_ICFLAG_ECHO         0x02    /* ReadBuffer Echo buffer format */
-#define MPT_ICFLAG_PHYS_DISK    0x04    /* Any SCSI IO but do Phys Disk Format */
-#define MPT_ICFLAG_TAGGED_CMD   0x08    /* Do tagged IO */
+#define MPT_ICFLAG_EBOS         0x04    /* ReadBuffer Echo buffer has EBOS */
+#define MPT_ICFLAG_PHYS_DISK    0x08    /* Any SCSI IO but do Phys Disk Format */
+#define MPT_ICFLAG_TAGGED_CMD   0x10    /* Do tagged IO */
 #define MPT_ICFLAG_DID_RESET    0x20    /* Bus Reset occurred with this command */
 #define MPT_ICFLAG_RESERVED     0x40    /* Reserved has been issued */
 
@@ -159,6 +161,8 @@ int		mptscsih_scandv_complete(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR
 static int      mptscsih_do_cmd(MPT_SCSI_HOST *hd, INTERNAL_CMD *iocmd);
 static int      mptscsih_synchronize_cache(MPT_SCSI_HOST *hd, int portnum);
 
+static struct work_struct   mptscsih_persistTask;
+
 #ifdef MPTSCSIH_ENABLE_DOMAIN_VALIDATION
 static int      mptscsih_do_raid(MPT_SCSI_HOST *hd, u8 action, INTERNAL_CMD *io);
 static void     mptscsih_domainValidation(void *hd);
@@ -167,6 +171,7 @@ static void	mptscsih_qas_check(MPT_SCSI_HOST *hd, int id);
 static int      mptscsih_doDv(MPT_SCSI_HOST *hd, int channel, int target);
 static void     mptscsih_dv_parms(MPT_SCSI_HOST *hd, DVPARAMETERS *dv,void *pPage);
 static void     mptscsih_fillbuf(char *buffer, int size, int index, int width);
+static void     mptscsih_set_dvflags_raid(MPT_SCSI_HOST *hd, int id);
 #endif
 
 void            mptscsih_remove(struct pci_dev *);
@@ -606,11 +611,24 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                 xfer_cnt = le32_to_cpu(pScsiReply->TransferCount);
                 sc->resid = sc->request_bufflen - xfer_cnt;
 
+                /*
+                 *  if we get a data underrun indication, yet no data was
+                 *  transferred and the SCSI status indicates that the
+                 *  command was never started, change the data underrun
+                 *  to success
+                 */
+                if (status == MPI_IOCSTATUS_SCSI_DATA_UNDERRUN && xfer_cnt == 0 &&
+                    (scsi_status == MPI_SCSI_STATUS_BUSY ||
+                     scsi_status == MPI_SCSI_STATUS_RESERVATION_CONFLICT ||
+                     scsi_status == MPI_SCSI_STATUS_TASK_SET_FULL)) {
+                        status = MPI_IOCSTATUS_SUCCESS;
+                }
+
                 dreplyprintk((KERN_NOTICE "Reply ha=%d id=%d lun=%d:\n"
                         "IOCStatus=%04xh SCSIState=%02xh SCSIStatus=%02xh\n"
                         "resid=%d bufflen=%d xfer_cnt=%d\n",
                         ioc->id, pScsiReq->TargetID, pScsiReq->LUN[1],
-                        status, scsi_state, scsi_status, sc->resid, 
+                        status, scsi_state, scsi_status, sc->resid,
                         sc->request_bufflen, xfer_cnt));
 
                 if (scsi_state & MPI_SCSI_STATE_AUTOSENSE_VALID)
@@ -619,8 +637,11 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                 /*
                  *  Look for + dump FCP ResponseInfo[]!
                  */
-                if (scsi_state & MPI_SCSI_STATE_RESPONSE_INFO_VALID) {
-                        printk(KERN_NOTICE "  FCP_ResponseInfo=%08xh\n",
+                if (scsi_state & MPI_SCSI_STATE_RESPONSE_INFO_VALID &&
+                    pScsiReply->ResponseInfo) {
+                        printk(KERN_NOTICE "ha=%d id=%d lun=%d: "
+                        "FCP_ResponseInfo=%08xh\n",
+                        ioc->id, pScsiReq->TargetID, pScsiReq->LUN[1],
                         le32_to_cpu(pScsiReply->ResponseInfo));
                 }
 
@@ -661,23 +682,13 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                         break;
 
                 case MPI_IOCSTATUS_SCSI_RESIDUAL_MISMATCH:      /* 0x0049 */
-                        if ( xfer_cnt >= sc->underflow ) {
-                                /* Sufficient data transfer occurred */
+                        sc->resid = sc->request_bufflen - xfer_cnt;
+                        if((xfer_cnt==0)||(sc->underflow > xfer_cnt))
+                                sc->result=DID_SOFT_ERROR << 16;
+                        else /* Sufficient data transfer occurred */
                                 sc->result = (DID_OK << 16) | scsi_status;
-                        } else if ( xfer_cnt == 0 ) {
-                                /* A CRC Error causes this condition; retry */
-                                sc->result = (DRIVER_SENSE << 24) | (DID_OK << 16) |
-                                        (CHECK_CONDITION << 1);
-                                sc->sense_buffer[0] = 0x70;
-                                sc->sense_buffer[2] = NO_SENSE;
-                                sc->sense_buffer[12] = 0;
-                                sc->sense_buffer[13] = 0;
-                        } else {
-                                sc->result = DID_SOFT_ERROR << 16;
-                        }
-                        dreplyprintk((KERN_NOTICE
-                            "RESIDUAL_MISMATCH: result=%x on id=%d\n",
-                            sc->result, sc->device->id));
+                        dreplyprintk((KERN_NOTICE 
+                            "RESIDUAL_MISMATCH: result=%x on id=%d\n", sc->result, sc->device->id));
                         break;
 
                 case MPI_IOCSTATUS_SCSI_DATA_UNDERRUN:          /* 0x0045 */
@@ -692,7 +703,10 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
                                 ;
                         } else {
                                 if (xfer_cnt < sc->underflow) {
-                                        sc->result = DID_SOFT_ERROR << 16;
+                                        if (scsi_status == SAM_STAT_BUSY)
+                                                sc->result = SAM_STAT_BUSY;
+                                        else
+                                                sc->result = DID_SOFT_ERROR << 16;
                                 }
                                 if (scsi_state & (MPI_SCSI_STATE_AUTOSENSE_FAILED | MPI_SCSI_STATE_NO_SCSI_STATUS)) {
                                         /* What to do?
@@ -717,8 +731,10 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
 
                 case MPI_IOCSTATUS_SCSI_RECOVERED_ERROR:        /* 0x0040 */
                 case MPI_IOCSTATUS_SUCCESS:                     /* 0x0000 */
-                        scsi_status = pScsiReply->SCSIStatus;
-                        sc->result = (DID_OK << 16) | scsi_status;
+                        if (scsi_status == MPI_SCSI_STATUS_BUSY)
+                                sc->result = (DID_BUS_BUSY << 16) | scsi_status;
+                        else
+                                sc->result = (DID_OK << 16) | scsi_status;
                         if (scsi_state == 0) {
                                 ;
                         } else if (scsi_state & MPI_SCSI_STATE_AUTOSENSE_VALID) {
@@ -890,12 +906,13 @@ mptscsih_search_running_cmds(MPT_SCSI_HOST *hd, uint target, uint lun)
         SCSIIORequest_t *mf = NULL;
         int              ii;
         int              max = hd->ioc->req_depth;
+        struct scsi_cmnd *sc;
 
         dsprintk((KERN_INFO MYNAM ": search_running target %d lun %d max %d\n",
                         target, lun, max));
 
         for (ii=0; ii < max; ii++) {
-                if (hd->ScsiLookup[ii] != NULL) {
+                if ((sc = hd->ScsiLookup[ii]) != NULL) {
 
                         mf = (SCSIIORequest_t *)MPT_INDEX_2_MFPTR(hd->ioc, ii);
 
@@ -910,9 +927,22 @@ mptscsih_search_running_cmds(MPT_SCSI_HOST *hd, uint target, uint lun)
                         hd->ScsiLookup[ii] = NULL;
                         mptscsih_freeChainBuffers(hd->ioc, ii);
                         mpt_free_msg_frame(hd->ioc, (MPT_FRAME_HDR *)mf);
+                        if (sc->use_sg) {
+                                pci_unmap_sg(hd->ioc->pcidev,
+                                (struct scatterlist *) sc->request_buffer,
+                                        sc->use_sg,
+                                        sc->sc_data_direction);
+                        } else if (sc->request_bufflen) {
+                                pci_unmap_single(hd->ioc->pcidev,
+                                        sc->SCp.dma_handle,
+                                        sc->request_bufflen,
+                                        sc->sc_data_direction);
+                        }
+                        sc->host_scribble = NULL;
+                        sc->result = DID_NO_CONNECT << 16;
+                        sc->scsi_done(sc);
                 }
         }
-
         return;
 }
 
@@ -967,8 +997,10 @@ mptscsih_remove(struct pci_dev *pdev)
         unsigned long           flags;
         int sz1;
 
-        if(!host)
+        if(!host) {
+                mpt_detach(pdev);
                 return;
+        }
 
         scsi_remove_host(host);
 
@@ -1256,8 +1288,7 @@ mptscsih_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
         MPT_SCSI_HOST           *hd;
         MPT_FRAME_HDR           *mf;
         SCSIIORequest_t         *pScsiReq;
-        VirtDevice              *pTarget;
-        int      target;
+        VirtDevice              *pTarget = SCpnt->device->hostdata;
         int      lun;
         u32      datalen;
         u32      scsictl;
@@ -1267,12 +1298,9 @@ mptscsih_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
         int      ii;
 
         hd = (MPT_SCSI_HOST *) SCpnt->device->host->hostdata;
-        target = SCpnt->device->id;
         lun = SCpnt->device->lun;
         SCpnt->scsi_done = done;
 
-        pTarget = hd->Targets[target];
-
         dmfprintk((MYIOC_s_INFO_FMT "qcmd: SCpnt=%p, done()=%p\n",
                         (hd && hd->ioc) ? hd->ioc->name : "ioc?", SCpnt, done));
 
@@ -1315,7 +1343,7 @@ mptscsih_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
         /* Default to untagged. Once a target structure has been allocated,
          * use the Inquiry data to determine if device supports tagged.
          */
-        if (   pTarget
+        if (pTarget
             && (pTarget->tflags & MPT_TARGET_FLAGS_Q_YES)
             && (SCpnt->device->tagged_supported)) {
                 scsictl = scsidir | MPI_SCSIIO_CONTROL_SIMPLEQ;
@@ -1325,8 +1353,8 @@ mptscsih_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
 
         /* Use the above information to set up the message frame
          */
-        pScsiReq->TargetID = (u8) target;
-        pScsiReq->Bus = (u8) SCpnt->device->channel;
+        pScsiReq->TargetID = (u8) pTarget->target_id;
+        pScsiReq->Bus = pTarget->bus_id;
         pScsiReq->ChainOffset = 0;
         pScsiReq->Function = MPI_FUNCTION_SCSI_IO_REQUEST;
         pScsiReq->CDBLength = SCpnt->cmd_len;
@@ -1378,7 +1406,7 @@ mptscsih_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
 
 #ifdef MPTSCSIH_ENABLE_DOMAIN_VALIDATION
         if (hd->ioc->bus_type == SCSI) {
-                int dvStatus = hd->ioc->spi_data.dvStatus[target];
+                int dvStatus = hd->ioc->spi_data.dvStatus[pTarget->target_id];
                 int issueCmd = 1;
 
                 if (dvStatus || hd->ioc->spi_data.forceDv) {
@@ -1426,6 +1454,7 @@ mptscsih_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
         return 0;
 
  fail:
+        hd->ScsiLookup[my_idx] = NULL;
         mptscsih_freeChainBuffers(hd->ioc, my_idx);
         mpt_free_msg_frame(hd->ioc, mf);
         return SCSI_MLQUEUE_HOST_BUSY;
@@ -1713,24 +1742,23 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
         MPT_FRAME_HDR   *mf;
         u32              ctx2abort;
         int              scpnt_idx;
+        int              retval;
 
         /* If we can't locate our host adapter structure, return FAILED status.
          */
         if ((hd = (MPT_SCSI_HOST *) SCpnt->device->host->hostdata) == NULL) {
                 SCpnt->result = DID_RESET << 16;
                 SCpnt->scsi_done(SCpnt);
-                dfailprintk((KERN_WARNING MYNAM ": mptscsih_abort: "
+                dfailprintk((KERN_INFO MYNAM ": mptscsih_abort: "
                            "Can't locate host! (sc=%p)\n",
                            SCpnt));
                 return FAILED;
         }
 
         ioc = hd->ioc;
-        if (hd->resetPending)
+        if (hd->resetPending) {
                 return FAILED;
-
-        printk(KERN_WARNING MYNAM ": %s: >> Attempting task abort! (sc=%p)\n",
-               hd->ioc->name, SCpnt);
+        }
 
         if (hd->timeouts < -1)
                 hd->timeouts++;
@@ -1738,16 +1766,20 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
         /* Find this command
          */
         if ((scpnt_idx = SCPNT_TO_LOOKUP_IDX(SCpnt)) < 0) {
-                /* Cmd not found in ScsiLookup. 
+                /* Cmd not found in ScsiLookup.
                  * Do OS callback.
                  */
                 SCpnt->result = DID_RESET << 16;
-                dtmprintk((KERN_WARNING MYNAM ": %s: mptscsih_abort: "
+                dtmprintk((KERN_INFO MYNAM ": %s: mptscsih_abort: "
                            "Command not in the active list! (sc=%p)\n",
                            hd->ioc->name, SCpnt));
                 return SUCCESS;
         }
 
+        printk(KERN_WARNING MYNAM ": %s: attempting task abort! (sc=%p)\n",
+               hd->ioc->name, SCpnt);
+        scsi_print_command(SCpnt);
+
         /* Most important!  Set TaskMsgContext to SCpnt's MsgContext!
          * (the IO to be ABORT'd)
          *
@@ -1760,38 +1792,22 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
 
         hd->abortSCpnt = SCpnt;
 
-        if (mptscsih_TMHandler(hd, MPI_SCSITASKMGMT_TASKTYPE_ABORT_TASK,
+        retval = mptscsih_TMHandler(hd, MPI_SCSITASKMGMT_TASKTYPE_ABORT_TASK,
                 SCpnt->device->channel, SCpnt->device->id, SCpnt->device->lun,
-                ctx2abort, 2 /* 2 second timeout */)
-                < 0) {
+                ctx2abort, 2 /* 2 second timeout */);
 
-                /* The TM request failed and the subsequent FW-reload failed!
-                 * Fatal error case.
-                 */
-                printk(MYIOC_s_WARN_FMT "Error issuing abort task! (sc=%p)\n",
-                       hd->ioc->name, SCpnt);
+        printk (KERN_WARNING MYNAM ": %s: task abort: %s (sc=%p)\n",
+                hd->ioc->name,
+                ((retval == 0) ? "SUCCESS" : "FAILED" ), SCpnt);
 
-                /* We must clear our pending flag before clearing our state.
-                 */
+        if (retval == 0)
+                return SUCCESS;
+
+        if(retval != FAILED ) {
                 hd->tmPending = 0;
                 hd->tmState = TM_STATE_NONE;
-
-                /* Unmap the DMA buffers, if any. */
-                if (SCpnt->use_sg) {
-                        pci_unmap_sg(ioc->pcidev, (struct scatterlist *) SCpnt->request_buffer,
-                                    SCpnt->use_sg, SCpnt->sc_data_direction);
-                } else if (SCpnt->request_bufflen) {
-                        pci_unmap_single(ioc->pcidev, SCpnt->SCp.dma_handle,
-                                SCpnt->request_bufflen, SCpnt->sc_data_direction);
-                }
-                hd->ScsiLookup[scpnt_idx] = NULL;
-                SCpnt->result = DID_RESET << 16;
-                SCpnt->scsi_done(SCpnt);                /* Issue the command callback */
-                mptscsih_freeChainBuffers(ioc, scpnt_idx);
-                mpt_free_msg_frame(ioc, mf);
-                return FAILED;
         }
-        return SUCCESS;
+        return FAILED;
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
@@ -1807,11 +1823,12 @@ int
 mptscsih_dev_reset(struct scsi_cmnd * SCpnt)
 {
         MPT_SCSI_HOST   *hd;
+        int              retval;
 
         /* If we can't locate our host adapter structure, return FAILED status.
          */
         if ((hd = (MPT_SCSI_HOST *) SCpnt->device->host->hostdata) == NULL){
-                dtmprintk((KERN_WARNING MYNAM ": mptscsih_dev_reset: "
+                dtmprintk((KERN_INFO MYNAM ": mptscsih_dev_reset: "
                            "Can't locate host! (sc=%p)\n",
                            SCpnt));
                 return FAILED;
@@ -1820,24 +1837,26 @@ mptscsih_dev_reset(struct scsi_cmnd * SCpnt)
         if (hd->resetPending)
                 return FAILED;
 
-        printk(KERN_WARNING MYNAM ": %s: >> Attempting target reset! (sc=%p)\n",
+        printk(KERN_WARNING MYNAM ": %s: attempting target reset! (sc=%p)\n",
                hd->ioc->name, SCpnt);
+        scsi_print_command(SCpnt);
 
-        if (mptscsih_TMHandler(hd, MPI_SCSITASKMGMT_TASKTYPE_TARGET_RESET,
+        retval = mptscsih_TMHandler(hd, MPI_SCSITASKMGMT_TASKTYPE_TARGET_RESET,
                 SCpnt->device->channel, SCpnt->device->id,
-                0, 0, 5 /* 5 second timeout */)
-                < 0){
-                /* The TM request failed and the subsequent FW-reload failed!
-                 * Fatal error case.
-                 */
-                printk(MYIOC_s_WARN_FMT "Error processing TaskMgmt request (sc=%p)\n",
-                                hd->ioc->name, SCpnt);
+                0, 0, 5 /* 5 second timeout */);
+
+        printk (KERN_WARNING MYNAM ": %s: target reset: %s (sc=%p)\n",
+                hd->ioc->name,
+                ((retval == 0) ? "SUCCESS" : "FAILED" ), SCpnt);
+
+        if (retval == 0)
+                return SUCCESS;
+
+        if(retval != FAILED ) {
                 hd->tmPending = 0;
                 hd->tmState = TM_STATE_NONE;
-                return FAILED;
         }
-
-        return SUCCESS;
+        return FAILED;
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
@@ -1853,41 +1872,39 @@ int
 mptscsih_bus_reset(struct scsi_cmnd * SCpnt)
 {
         MPT_SCSI_HOST   *hd;
-        spinlock_t      *host_lock = SCpnt->device->host->host_lock;
+        int              retval;
 
         /* If we can't locate our host adapter structure, return FAILED status.
          */
         if ((hd = (MPT_SCSI_HOST *) SCpnt->device->host->hostdata) == NULL){
-                dtmprintk((KERN_WARNING MYNAM ": mptscsih_bus_reset: "
+                dtmprintk((KERN_INFO MYNAM ": mptscsih_bus_reset: "
                            "Can't locate host! (sc=%p)\n",
                            SCpnt ) );
                 return FAILED;
         }
 
-        printk(KERN_WARNING MYNAM ": %s: >> Attempting bus reset! (sc=%p)\n",
+        printk(KERN_WARNING MYNAM ": %s: attempting bus reset! (sc=%p)\n",
                hd->ioc->name, SCpnt);
+        scsi_print_command(SCpnt);
 
         if (hd->timeouts < -1)
                 hd->timeouts++;
 
-        /* We are now ready to execute the task management request. */
-        if (mptscsih_TMHandler(hd, MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS,
-                SCpnt->device->channel, 0, 0, 0, 5 /* 5 second timeout */)
-            < 0){
+        retval = mptscsih_TMHandler(hd, MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS,
+                SCpnt->device->channel, 0, 0, 0, 5 /* 5 second timeout */);
 
-                /* The TM request failed and the subsequent FW-reload failed!
-                 * Fatal error case.
-                 */
-                printk(MYIOC_s_WARN_FMT
-                       "Error processing TaskMgmt request (sc=%p)\n",
-                       hd->ioc->name, SCpnt);
+        printk (KERN_WARNING MYNAM ": %s: bus reset: %s (sc=%p)\n",
+                hd->ioc->name,
+                ((retval == 0) ? "SUCCESS" : "FAILED" ), SCpnt);
+
+        if (retval == 0)
+                return SUCCESS;
+
+        if(retval != FAILED ) {
                 hd->tmPending = 0;
                 hd->tmState = TM_STATE_NONE;
-                spin_lock_irq(host_lock);
-                return FAILED;
         }
-
-        return SUCCESS;
+        return FAILED;
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
@@ -2169,7 +2186,7 @@ mptscsih_slave_alloc(struct scsi_device *device)
         vdev->raidVolume = 0;
         hd->Targets[device->id] = vdev;
         if (hd->ioc->bus_type == SCSI) {
-                if (hd->ioc->spi_data.isRaid & (1 << device->id)) {
+                if (hd->ioc->raid_data.isRaid & (1 << device->id)) {
                         vdev->raidVolume = 1;
                         ddvtprintk((KERN_INFO
                             "RAID Volume @ id %d\n", device->id));
@@ -2180,22 +2197,7 @@ mptscsih_slave_alloc(struct scsi_device *device)
 
  out:
         vdev->num_luns++;
-        return 0;
-}
-
-static int 
-mptscsih_is_raid_volume(MPT_SCSI_HOST *hd, uint id)
-{
-        int i;
-
-        if (!hd->ioc->spi_data.isRaid || !hd->ioc->spi_data.pIocPg3)
-                return 0;
-
-        for (i = 0; i < hd->ioc->spi_data.pIocPg3->NumPhysDisks; i++) {
-                if (id == hd->ioc->spi_data.pIocPg3->PhysDisk[i].PhysDiskID)
-                        return 1;
-        }
-
+        device->hostdata = vdev;
         return 0;
 }
 
@@ -2226,7 +2228,7 @@ mptscsih_slave_destroy(struct scsi_device *device)
         hd->Targets[target] = NULL;
 
         if (hd->ioc->bus_type == SCSI) {
-                if (mptscsih_is_raid_volume(hd, target)) {
+                if (mptscsih_is_phys_disk(hd->ioc, target)) {
                         hd->ioc->spi_data.forceDv |= MPT_SCSICFG_RELOAD_IOC_PG3;
                 } else {
                         hd->ioc->spi_data.dvStatus[target] =
@@ -2439,6 +2441,7 @@ mptscsih_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
 {
         MPT_SCSI_HOST   *hd;
         unsigned long    flags;
+        int             ii;
 
         dtmprintk((KERN_WARNING MYNAM
                         ": IOC %s_reset routed to SCSI host driver!\n",
@@ -2496,11 +2499,8 @@ mptscsih_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
 
                 /* ScsiLookup initialization
                  */
-                {
-                        int ii;
-                        for (ii=0; ii < hd->ioc->req_depth; ii++)
-                                hd->ScsiLookup[ii] = NULL;
-                }
+                for (ii=0; ii < hd->ioc->req_depth; ii++)
+                        hd->ScsiLookup[ii] = NULL;
 
                 /* 2. Chain Buffer initialization
                  */
@@ -2549,6 +2549,16 @@ mptscsih_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+/* work queue thread to clear the persitency table */
+static void
+mptscsih_sas_persist_clear_table(void * arg)
+{
+        MPT_ADAPTER *ioc = (MPT_ADAPTER *)arg;
+
+        mptbase_sas_persist_operation(ioc, MPI_SAS_OP_CLEAR_NOT_PRESENT);
+}
+
+/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 int
 mptscsih_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
 {
@@ -2558,18 +2568,18 @@ mptscsih_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
         devtprintk((MYIOC_s_INFO_FMT "MPT event (=%02Xh) routed to SCSI host driver!\n",
                         ioc->name, event));
 
+        if (ioc->sh == NULL ||
+                ((hd = (MPT_SCSI_HOST *)ioc->sh->hostdata) == NULL))
+                return 1;
+
         switch (event) {
         case MPI_EVENT_UNIT_ATTENTION:                  /* 03 */
                 /* FIXME! */
                 break;
         case MPI_EVENT_IOC_BUS_RESET:                   /* 04 */
         case MPI_EVENT_EXT_BUS_RESET:                   /* 05 */
-                hd = NULL;
-                if (ioc->sh) {
-                        hd = (MPT_SCSI_HOST *) ioc->sh->hostdata;
-                        if (hd && (ioc->bus_type == SCSI) && (hd->soft_resets < -1))
-                                hd->soft_resets++;
-                }
+                if (hd && (ioc->bus_type == SCSI) && (hd->soft_resets < -1))
+                        hd->soft_resets++;
                 break;
         case MPI_EVENT_LOGOUT:                          /* 09 */
                 /* FIXME! */
@@ -2588,69 +2598,24 @@ mptscsih_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
                 break;
 
         case MPI_EVENT_INTEGRATED_RAID:                 /* 0B */
+        {
+                pMpiEventDataRaid_t pRaidEventData =
+                    (pMpiEventDataRaid_t) pEvReply->Data;
 #ifdef MPTSCSIH_ENABLE_DOMAIN_VALIDATION
-                /* negoNvram set to 0 if DV enabled and to USE_NVRAM if
-                 * if DV disabled. Need to check for target mode.
-                 */
-                hd = NULL;
-                if (ioc->sh)
-                        hd = (MPT_SCSI_HOST *) ioc->sh->hostdata;
-
-                if (hd && (ioc->bus_type == SCSI) && (hd->negoNvram == 0)) {
-                        ScsiCfgData     *pSpi;
-                        Ioc3PhysDisk_t  *pPDisk;
-                        int              numPDisk;
-                        u8               reason;
-                        u8               physDiskNum;
-
-                        reason = (le32_to_cpu(pEvReply->Data[0]) & 0x00FF0000) >> 16;
-                        if (reason == MPI_EVENT_RAID_RC_DOMAIN_VAL_NEEDED) {
-                                /* New or replaced disk.
-                                 * Set DV flag and schedule DV.
-                                 */
-                                pSpi = &ioc->spi_data;
-                                physDiskNum = (le32_to_cpu(pEvReply->Data[0]) & 0xFF000000) >> 24;
-                                ddvtprintk(("DV requested for phys disk id %d\n", physDiskNum));
-                                if (pSpi->pIocPg3) {
-                                        pPDisk =  pSpi->pIocPg3->PhysDisk;
-                                        numPDisk =pSpi->pIocPg3->NumPhysDisks;
-
-                                        while (numPDisk) {
-                                                if (physDiskNum == pPDisk->PhysDiskNum) {
-                                                        pSpi->dvStatus[pPDisk->PhysDiskID] = (MPT_SCSICFG_NEED_DV | MPT_SCSICFG_DV_NOT_DONE);
-                                                        pSpi->forceDv = MPT_SCSICFG_NEED_DV;
-                                                        ddvtprintk(("NEED_DV set for phys disk id %d\n", pPDisk->PhysDiskID));
-                                                        break;
-                                                }
-                                                pPDisk++;
-                                                numPDisk--;
-                                        }
-
-                                        if (numPDisk == 0) {
-                                                /* The physical disk that needs DV was not found
-                                                 * in the stored IOC Page 3. The driver must reload
-                                                 * this page. DV routine will set the NEED_DV flag for
-                                                 * all phys disks that have DV_NOT_DONE set.
-                                                 */
-                                                pSpi->forceDv = MPT_SCSICFG_NEED_DV | MPT_SCSICFG_RELOAD_IOC_PG3;
-                                                ddvtprintk(("phys disk %d not found. Setting reload IOC Pg3 Flag\n", physDiskNum));
-                                        }
-                                }
-                        }
-                }
+                /* Domain Validation Needed */
+                if (ioc->bus_type == SCSI &&
+                    pRaidEventData->ReasonCode ==
+                    MPI_EVENT_RAID_RC_DOMAIN_VAL_NEEDED)
+                        mptscsih_set_dvflags_raid(hd, pRaidEventData->PhysDiskNum);
 #endif
+                break;
+        }
 
-#if defined(MPT_DEBUG_DV) || defined(MPT_DEBUG_DV_TINY)
-                printk("Raid Event RF: ");
-                {
-                        u32 *m = (u32 *)pEvReply;
-                        int ii;
-                        int n = (int)pEvReply->MsgLength;
-                        for (ii=6; ii < n; ii++)
-                                printk(" %08x", le32_to_cpu(m[ii]));
-                        printk("\n");
-                }
-#endif
+        /* Persistent table is full. */
+        case MPI_EVENT_PERSISTENT_TABLE_FULL:
+                INIT_WORK(&mptscsih_persistTask,
+                    mptscsih_sas_persist_clear_table,(void *)ioc);
+                schedule_work(&mptscsih_persistTask);
                 break;
 
         case MPI_EVENT_NONE:                            /* 00 */
@@ -2687,7 +2652,7 @@ mptscsih_initTarget(MPT_SCSI_HOST *hd, int bus_id, int target_id, u8 lun, char *
 {
         int             indexed_lun, lun_index;
         VirtDevice      *vdev;
-        ScsiCfgData     *pSpi;
+        SpiCfgData      *pSpi;
         char            data_56;
 
         dinitprintk((MYIOC_s_INFO_FMT "initTarget bus=%d id=%d lun=%d hd=%p\n",
@@ -2794,7 +2759,7 @@ mptscsih_initTarget(MPT_SCSI_HOST *hd, int bus_id, int target_id, u8 lun, char *
 static void
 mptscsih_setTargetNegoParms(MPT_SCSI_HOST *hd, VirtDevice *target, char byte56)
 {
-        ScsiCfgData *pspi_data = &hd->ioc->spi_data;
+        SpiCfgData *pspi_data = &hd->ioc->spi_data;
         int  id = (int) target->target_id;
         int  nvram;
         VirtDevice      *vdev;
@@ -2973,11 +2938,13 @@ mptscsih_setTargetNegoParms(MPT_SCSI_HOST *hd, VirtDevice *target, char byte56)
 static void
 mptscsih_set_dvflags(MPT_SCSI_HOST *hd, SCSIIORequest_t *pReq)
 {
+        MPT_ADAPTER     *ioc = hd->ioc;
         u8 cmd;
-        ScsiCfgData *pSpi;
+        SpiCfgData      *pSpi;
 
-        ddvtprintk((" set_dvflags: id=%d lun=%d negoNvram=%x cmd=%x\n", 
-                pReq->TargetID, pReq->LUN[1], hd->negoNvram, pReq->CDB[0]));
+        ddvtprintk((MYIOC_s_NOTE_FMT
+                " set_dvflags: id=%d lun=%d negoNvram=%x cmd=%x\n",
+                hd->ioc->name, pReq->TargetID, pReq->LUN[1], hd->negoNvram, pReq->CDB[0]));
 
         if ((pReq->LUN[1] != 0) || (hd->negoNvram != 0))
                 return;
@@ -2985,12 +2952,12 @@ mptscsih_set_dvflags(MPT_SCSI_HOST *hd, SCSIIORequest_t *pReq)
         cmd = pReq->CDB[0];
 
         if ((cmd == READ_CAPACITY) || (cmd == MODE_SENSE)) {
-                pSpi = &hd->ioc->spi_data;
-                if ((pSpi->isRaid & (1 << pReq->TargetID)) && pSpi->pIocPg3) {
+                pSpi = &ioc->spi_data;
+                if ((ioc->raid_data.isRaid & (1 << pReq->TargetID)) && ioc->raid_data.pIocPg3) {
                         /* Set NEED_DV for all hidden disks
                          */
-                        Ioc3PhysDisk_t *pPDisk =  pSpi->pIocPg3->PhysDisk;
-                        int             numPDisk = pSpi->pIocPg3->NumPhysDisks;
+                        Ioc3PhysDisk_t *pPDisk =  ioc->raid_data.pIocPg3->PhysDisk;
+                        int             numPDisk = ioc->raid_data.pIocPg3->NumPhysDisks;
 
                         while (numPDisk) {
                                 pSpi->dvStatus[pPDisk->PhysDiskID] |= MPT_SCSICFG_NEED_DV;
@@ -3004,6 +2971,50 @@ mptscsih_set_dvflags(MPT_SCSI_HOST *hd, SCSIIORequest_t *pReq)
         }
 }
 
+/* mptscsih_raid_set_dv_flags()
+ *
+ * New or replaced disk. Set DV flag and schedule DV.
+ */
+static void
+mptscsih_set_dvflags_raid(MPT_SCSI_HOST *hd, int id)
+{
+        MPT_ADAPTER     *ioc = hd->ioc;
+        SpiCfgData      *pSpi = &ioc->spi_data;
+        Ioc3PhysDisk_t  *pPDisk;
+        int              numPDisk;
+
+        if (hd->negoNvram != 0)
+                return;
+
+        ddvtprintk(("DV requested for phys disk id %d\n", id));
+        if (ioc->raid_data.pIocPg3) {
+                pPDisk =  ioc->raid_data.pIocPg3->PhysDisk;
+                numPDisk = ioc->raid_data.pIocPg3->NumPhysDisks;
+                while (numPDisk) {
+                        if (id == pPDisk->PhysDiskNum) {
+                                pSpi->dvStatus[pPDisk->PhysDiskID] =
+                                    (MPT_SCSICFG_NEED_DV | MPT_SCSICFG_DV_NOT_DONE);
+                                pSpi->forceDv = MPT_SCSICFG_NEED_DV;
+                                ddvtprintk(("NEED_DV set for phys disk id %d\n",
+                                    pPDisk->PhysDiskID));
+                                break;
+                        }
+                        pPDisk++;
+                        numPDisk--;
+                }
+
+                if (numPDisk == 0) {
+                        /* The physical disk that needs DV was not found
+                         * in the stored IOC Page 3. The driver must reload
+                         * this page. DV routine will set the NEED_DV flag for
+                         * all phys disks that have DV_NOT_DONE set.
+                         */
+                        pSpi->forceDv = MPT_SCSICFG_NEED_DV | MPT_SCSICFG_RELOAD_IOC_PG3;
+                        ddvtprintk(("phys disk %d not found. Setting reload IOC Pg3 Flag\n",id));
+                }
+        }
+}
+
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
  * If no Target, bus reset on 1st I/O. Set the flag to
@@ -3091,7 +3102,7 @@ mptscsih_writeSDP1(MPT_SCSI_HOST *hd, int portnum, int target_id, int flags)
         MPT_ADAPTER             *ioc = hd->ioc;
         Config_t                *pReq;
         SCSIDevicePage1_t       *pData;
-        VirtDevice              *pTarget;
+        VirtDevice              *pTarget=NULL;
         MPT_FRAME_HDR           *mf;
         dma_addr_t               dataDma;
         u16                      req_idx;
@@ -3190,7 +3201,7 @@ mptscsih_writeSDP1(MPT_SCSI_HOST *hd, int portnum, int target_id, int flags)
 #endif
 
                 if (flags & MPT_SCSICFG_BLK_NEGO)
-                        negoFlags = MPT_TARGET_NO_NEGO_WIDE | MPT_TARGET_NO_NEGO_SYNC;
+                        negoFlags |= MPT_TARGET_NO_NEGO_WIDE | MPT_TARGET_NO_NEGO_SYNC;
 
                 mptscsih_setDevicePage1Flags(width, factor, offset,
                                         &requested, &configuration, negoFlags);
@@ -4011,7 +4022,7 @@ mptscsih_synchronize_cache(MPT_SCSI_HOST *hd, int portnum)
 
                 /* If target Ptr NULL or if this target is NOT a disk, skip.
                  */
-                if ((pTarget) && (pTarget->tflags & MPT_TARGET_FLAGS_Q_YES)){
+                if ((pTarget) && (pTarget->inq_data[0] == TYPE_DISK)){
                         for (lun=0; lun <= MPT_LAST_LUN; lun++) {
                                 /* If LUN present, issue the command
                                  */
@@ -4106,9 +4117,9 @@ mptscsih_domainValidation(void *arg)
 
                         if ((ioc->spi_data.forceDv & MPT_SCSICFG_RELOAD_IOC_PG3) != 0) {
                                 mpt_read_ioc_pg_3(ioc);
-                                if (ioc->spi_data.pIocPg3) {
-                                        Ioc3PhysDisk_t *pPDisk = ioc->spi_data.pIocPg3->PhysDisk;
-                                        int             numPDisk = ioc->spi_data.pIocPg3->NumPhysDisks;
+                                if (ioc->raid_data.pIocPg3) {
+                                        Ioc3PhysDisk_t *pPDisk = ioc->raid_data.pIocPg3->PhysDisk;
+                                        int             numPDisk = ioc->raid_data.pIocPg3->NumPhysDisks;
 
                                         while (numPDisk) {
                                                 if (ioc->spi_data.dvStatus[pPDisk->PhysDiskID] & MPT_SCSICFG_DV_NOT_DONE)
@@ -4147,7 +4158,7 @@ mptscsih_domainValidation(void *arg)
                                         isPhysDisk = mptscsih_is_phys_disk(ioc, id);
                                         if (isPhysDisk) {
                                                 for (ii=0; ii < MPT_MAX_SCSI_DEVICES; ii++) {
-                                                        if (hd->ioc->spi_data.isRaid & (1 << ii)) {
+                                                        if (hd->ioc->raid_data.isRaid & (1 << ii)) {
                                                                 hd->ioc->spi_data.dvStatus[ii] |= MPT_SCSICFG_DV_PENDING;
                                                         }
                                                 }
@@ -4166,7 +4177,7 @@ mptscsih_domainValidation(void *arg)
 
                                         if (isPhysDisk) {
                                                 for (ii=0; ii < MPT_MAX_SCSI_DEVICES; ii++) {
-                                                        if (hd->ioc->spi_data.isRaid & (1 << ii)) {
+                                                        if (hd->ioc->raid_data.isRaid & (1 << ii)) {
                                                                 hd->ioc->spi_data.dvStatus[ii] &= ~MPT_SCSICFG_DV_PENDING;
                                                         }
                                                 }
@@ -4188,21 +4199,21 @@ mptscsih_domainValidation(void *arg)
 
 /* Search IOC page 3 to determine if this is hidden physical disk
  */
-static int 
+/* Search IOC page 3 to determine if this is hidden physical disk
+ */
+static int
 mptscsih_is_phys_disk(MPT_ADAPTER *ioc, int id)
 {
-        if (ioc->spi_data.pIocPg3) {
-                Ioc3PhysDisk_t *pPDisk =  ioc->spi_data.pIocPg3->PhysDisk;
-                int             numPDisk = ioc->spi_data.pIocPg3->NumPhysDisks;
+        int i;
 
-                while (numPDisk) {
-                        if (pPDisk->PhysDiskID == id) {
-                                return 1;
-                        }
-                        pPDisk++;
-                        numPDisk--;
-                }
+        if (!ioc->raid_data.isRaid || !ioc->raid_data.pIocPg3)
+                return 0;
+
+        for (i = 0; i < ioc->raid_data.pIocPg3->NumPhysDisks; i++) {
+                if (id == ioc->raid_data.pIocPg3->PhysDisk[i].PhysDiskID)
+                        return 1;
         }
+
         return 0;
 }
 
@@ -4408,7 +4419,7 @@ mptscsih_doDv(MPT_SCSI_HOST *hd, int bus_number, int id)
         /* Skip this ID? Set cfg.cfghdr.hdr to force config page write
          */
         {
-                ScsiCfgData *pspi_data = &hd->ioc->spi_data;
+                SpiCfgData *pspi_data = &hd->ioc->spi_data;
                 if (pspi_data->nvram && (pspi_data->nvram[id] != MPT_HOST_NVRAM_INVALID)) {
                         /* Set the factor from nvram */
                         nfactor = (pspi_data->nvram[id] & MPT_NVRAM_SYNC_MASK) >> 8;
@@ -4438,11 +4449,11 @@ mptscsih_doDv(MPT_SCSI_HOST *hd, int bus_number, int id)
         }
 
         /* Finish iocmd inititialization - hidden or visible disk? */
-        if (ioc->spi_data.pIocPg3) {
+        if (ioc->raid_data.pIocPg3) {
                 /* Search IOC page 3 for matching id
                  */
-                Ioc3PhysDisk_t *pPDisk =  ioc->spi_data.pIocPg3->PhysDisk;
-                int             numPDisk = ioc->spi_data.pIocPg3->NumPhysDisks;
+                Ioc3PhysDisk_t *pPDisk =  ioc->raid_data.pIocPg3->PhysDisk;
+                int             numPDisk = ioc->raid_data.pIocPg3->NumPhysDisks;
 
                 while (numPDisk) {
                         if (pPDisk->PhysDiskID == id) {
@@ -4466,7 +4477,7 @@ mptscsih_doDv(MPT_SCSI_HOST *hd, int bus_number, int id)
         /* RAID Volume ID's may double for a physical device. If RAID but
          * not a physical ID as well, skip DV.
          */
-        if ((hd->ioc->spi_data.isRaid & (1 << id)) && !(iocmd.flags & MPT_ICFLAG_PHYS_DISK))
+        if ((hd->ioc->raid_data.isRaid & (1 << id)) && !(iocmd.flags & MPT_ICFLAG_PHYS_DISK))
                 goto target_done;
 
 
@@ -4815,6 +4826,8 @@ mptscsih_doDv(MPT_SCSI_HOST *hd, int bus_number, int id)
                                         notDone = 0;
                                         if (iocmd.flags & MPT_ICFLAG_ECHO) {
                                                 bufsize =  ((pbuf1[2] & 0x1F) <<8) | pbuf1[3];
+                                                if (pbuf1[0] & 0x01)
+                                                        iocmd.flags |= MPT_ICFLAG_EBOS;
                                         } else {
                                                 bufsize =  pbuf1[1]<<16 | pbuf1[2]<<8 | pbuf1[3];
                                         }
@@ -4911,6 +4924,9 @@ mptscsih_doDv(MPT_SCSI_HOST *hd, int bus_number, int id)
                 }
                 iocmd.flags &= ~MPT_ICFLAG_DID_RESET;
 
+                if (iocmd.flags & MPT_ICFLAG_EBOS)
+                        goto skip_Reserve;
+
                 repeat = 5;
                 while (repeat && (!(iocmd.flags & MPT_ICFLAG_RESERVED))) {
                         iocmd.cmd = RESERVE;
@@ -4954,6 +4970,7 @@ mptscsih_doDv(MPT_SCSI_HOST *hd, int bus_number, int id)
                         }
                 }
 
+skip_Reserve:
                 mptscsih_fillbuf(pbuf1, sz, patt, 1);
                 iocmd.cmd = WRITE_BUFFER;
                 iocmd.data_dma = buf1_dma;
@@ -5198,11 +5215,12 @@ mptscsih_dv_parms(MPT_SCSI_HOST *hd, DVPARAMETERS *dv,void *pPage)
                  * If not an LVD bus, the adapter minSyncFactor has been
                  * already throttled back.
                  */
+                negoFlags = hd->ioc->spi_data.noQas;
                 if ((hd->Targets)&&((pTarget = hd->Targets[(int)id]) != NULL) && !pTarget->raidVolume) {
                         width = pTarget->maxWidth;
                         offset = pTarget->maxOffset;
                         factor = pTarget->minSyncFactor;
-                        negoFlags = pTarget->negoFlags;
+                        negoFlags |= pTarget->negoFlags;
                 } else {
                         if (hd->ioc->spi_data.nvram && (hd->ioc->spi_data.nvram[id] != MPT_HOST_NVRAM_INVALID)) {
                                 data = hd->ioc->spi_data.nvram[id];
@@ -5223,7 +5241,6 @@ mptscsih_dv_parms(MPT_SCSI_HOST *hd, DVPARAMETERS *dv,void *pPage)
                         }
 
                         /* Set the negotiation flags */
-                        negoFlags = hd->ioc->spi_data.noQas;
                         if (!width)
                                 negoFlags |= MPT_TARGET_NO_NEGO_WIDE;
 
diff --git a/drivers/message/fusion/mptscsih.h b/drivers/message/fusion/mptscsih.h
index 51c0255ac16e..971fda4b8b57 100644
--- a/drivers/message/fusion/mptscsih.h
+++ b/drivers/message/fusion/mptscsih.h
@@ -1,5 +1,5 @@
 /*
- *  linux/drivers/message/fusion/mptscsi.h
+ *  linux/drivers/message/fusion/mptscsih.h
  *      High performance SCSI / Fibre Channel SCSI Host device driver.
  *      For use with PCI chip/adapter(s):
  *          LSIFC9xx/LSI409xx Fibre Channel
@@ -53,8 +53,8 @@
  *      SCSI Public stuff...
  */
 
-#define MPT_SCSI_CMD_PER_DEV_HIGH       31
-#define MPT_SCSI_CMD_PER_DEV_LOW        7
+#define MPT_SCSI_CMD_PER_DEV_HIGH       64
+#define MPT_SCSI_CMD_PER_DEV_LOW        32
 
 #define MPT_SCSI_CMD_PER_LUN            7
 
@@ -77,6 +77,7 @@
 #define MPTSCSIH_MAX_WIDTH              1
 #define MPTSCSIH_MIN_SYNC               0x08
 #define MPTSCSIH_SAF_TE                 0
+#define MPTSCSIH_PT_CLEAR               0
 
 
 #endif
diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c
index 587d1274fd74..5c0e307d1d5d 100644
--- a/drivers/message/fusion/mptspi.c
+++ b/drivers/message/fusion/mptspi.c
@@ -199,7 +199,7 @@ mptspi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 printk(MYIOC_s_WARN_FMT
                         "Skipping ioc=%p because SCSI Initiator mode is NOT enabled!\n",
                         ioc->name, ioc);
-                return -ENODEV;
+                return 0;
         }
 
         sh = scsi_host_alloc(&mptspi_driver_template, sizeof(MPT_SCSI_HOST));
diff --git a/drivers/message/i2o/config-osm.c b/drivers/message/i2o/config-osm.c
index af32ab4e90cd..10432f665201 100644
--- a/drivers/message/i2o/config-osm.c
+++ b/drivers/message/i2o/config-osm.c
@@ -56,8 +56,11 @@ static int __init i2o_config_init(void)
                 return -EBUSY;
         }
 #ifdef CONFIG_I2O_CONFIG_OLD_IOCTL
-        if (i2o_config_old_init())
+        if (i2o_config_old_init()) {
+                osm_err("old config handler initialization failed\n");
                 i2o_driver_unregister(&i2o_config_driver);
+                return -EBUSY;
+        }
 #endif
 
         return 0;
diff --git a/drivers/mfd/ucb1x00-ts.c b/drivers/mfd/ucb1x00-ts.c
index a851d65c7cfe..a260f83bcb02 100644
--- a/drivers/mfd/ucb1x00-ts.c
+++ b/drivers/mfd/ucb1x00-ts.c
@@ -48,8 +48,8 @@ struct ucb1x00_ts {
         u16                     x_res;
         u16                     y_res;
 
-        int                     restart:1;
-        int                     adcsync:1;
+        unsigned int            restart:1;
+        unsigned int            adcsync:1;
 };
 
 static int adcsync;
diff --git a/drivers/mtd/devices/docecc.c b/drivers/mtd/devices/docecc.c
index 9a087c1fb0b7..24f670b5a4f3 100644
--- a/drivers/mtd/devices/docecc.c
+++ b/drivers/mtd/devices/docecc.c
@@ -40,7 +40,7 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/doc2000.h>
 
-#define DEBUG 0
+#define DEBUG_ECC 0
 /* need to undef it (from asm/termbits.h) */
 #undef B0
 
@@ -249,7 +249,7 @@ eras_dec_rs(dtype Alpha_to[NN + 1], dtype Index_of[NN + 1],
           lambda[j] ^= Alpha_to[modnn(u + tmp)];
       }
     }
-#if DEBUG >= 1
+#if DEBUG_ECC >= 1
     /* Test code that verifies the erasure locator polynomial just constructed
        Needed only for decoder debugging. */
     
@@ -276,7 +276,7 @@ eras_dec_rs(dtype Alpha_to[NN + 1], dtype Index_of[NN + 1],
       count = -1;
       goto finish;
     }
-#if DEBUG >= 2
+#if DEBUG_ECC >= 2
     printf("\n Erasure positions as determined by roots of Eras Loc Poly:\n");
     for (i = 0; i < count; i++)
       printf("%d ", loc[i]);
@@ -409,7 +409,7 @@ eras_dec_rs(dtype Alpha_to[NN + 1], dtype Index_of[NN + 1],
         den ^= Alpha_to[modnn(lambda[i+1] + i * root[j])];
     }
     if (den == 0) {
-#if DEBUG >= 1
+#if DEBUG_ECC >= 1
       printf("\n ERROR: denominator = 0\n");
 #endif
       /* Convert to dual- basis */
diff --git a/drivers/mtd/maps/bast-flash.c b/drivers/mtd/maps/bast-flash.c
index 0c45464e3f7b..0ba0ff7d43b9 100644
--- a/drivers/mtd/maps/bast-flash.c
+++ b/drivers/mtd/maps/bast-flash.c
@@ -39,7 +39,6 @@
 #include <linux/mtd/partitions.h>
 
 #include <asm/io.h>
-#include <asm/mach-types.h>
 #include <asm/mach/flash.h>
 
 #include <asm/arch/map.h>
diff --git a/drivers/mtd/maps/ixp2000.c b/drivers/mtd/maps/ixp2000.c
index 3e94b616743d..a9f86c7fbd52 100644
--- a/drivers/mtd/maps/ixp2000.c
+++ b/drivers/mtd/maps/ixp2000.c
@@ -30,7 +30,6 @@
 
 #include <asm/io.h>
 #include <asm/hardware.h>
-#include <asm/mach-types.h>
 #include <asm/mach/flash.h>
 
 #include <linux/reboot.h>
diff --git a/drivers/mtd/maps/ixp4xx.c b/drivers/mtd/maps/ixp4xx.c
index 5afe660aa2c4..3fcc32884074 100644
--- a/drivers/mtd/maps/ixp4xx.c
+++ b/drivers/mtd/maps/ixp4xx.c
@@ -26,7 +26,6 @@
 #include <linux/ioport.h>
 #include <linux/device.h>
 #include <asm/io.h>
-#include <asm/mach-types.h>
 #include <asm/mach/flash.h>
 
 #include <linux/reboot.h>
@@ -254,6 +253,6 @@ module_init(ixp4xx_flash_init);
 module_exit(ixp4xx_flash_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("MTD map driver for Intel IXP4xx systems")
+MODULE_DESCRIPTION("MTD map driver for Intel IXP4xx systems");
 MODULE_AUTHOR("Deepak Saxena");
 
diff --git a/drivers/mtd/maps/omap_nor.c b/drivers/mtd/maps/omap_nor.c
index 8cc71409a328..b17bca657daf 100644
--- a/drivers/mtd/maps/omap_nor.c
+++ b/drivers/mtd/maps/omap_nor.c
@@ -42,7 +42,6 @@
 
 #include <asm/io.h>
 #include <asm/hardware.h>
-#include <asm/mach-types.h>
 #include <asm/mach/flash.h>
 #include <asm/arch/tc.h>
 
diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
index 52385705da09..8dcaa357b4bb 100644
--- a/drivers/mtd/maps/sa1100-flash.c
+++ b/drivers/mtd/maps/sa1100-flash.c
@@ -21,7 +21,6 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/concat.h>
 
-#include <asm/mach-types.h>
 #include <asm/io.h>
 #include <asm/sizes.h>
 #include <asm/mach/flash.h>
diff --git a/drivers/mtd/maps/sharpsl-flash.c b/drivers/mtd/maps/sharpsl-flash.c
index d15da6fd84c1..b7f093fbf9b0 100644
--- a/drivers/mtd/maps/sharpsl-flash.c
+++ b/drivers/mtd/maps/sharpsl-flash.c
@@ -82,7 +82,7 @@ int __init init_sharpsl(void)
         } else if (machine_is_tosa()) {
                 sharpsl_partitions[0].size=0x006a0000;
                 sharpsl_partitions[0].offset=0x00160000;
-        } else if (machine_is_spitz()) {
+        } else if (machine_is_spitz() || machine_is_akita() || machine_is_borzoi()) {
                 sharpsl_partitions[0].size=0x006b0000;
                 sharpsl_partitions[0].offset=0x00140000;
         } else {
diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
index 891e3a1b9110..b47ebcb31e0f 100644
--- a/drivers/mtd/nand/s3c2410.c
+++ b/drivers/mtd/nand/s3c2410.c
@@ -58,7 +58,6 @@
 #include <linux/mtd/partitions.h>
 
 #include <asm/io.h>
-#include <asm/mach-types.h>
 #include <asm/hardware/clock.h>
 
 #include <asm/arch/regs-nand.h>
diff --git a/drivers/mtd/nand/sharpsl.c b/drivers/mtd/nand/sharpsl.c
index 9853b87bb756..88b5b5b40b43 100644
--- a/drivers/mtd/nand/sharpsl.c
+++ b/drivers/mtd/nand/sharpsl.c
@@ -221,10 +221,16 @@ sharpsl_nand_init(void)
                         sharpsl_partition_info[1].size=25 * 1024 * 1024;
                 } else if (machine_is_husky()) {
                         sharpsl_partition_info[1].size=53 * 1024 * 1024;
-                }               
+                } else if (machine_is_spitz()) {
+                        sharpsl_partition_info[1].size=5 * 1024 * 1024;
+                } else if (machine_is_akita()) {
+                        sharpsl_partition_info[1].size=58 * 1024 * 1024;
+                } else if (machine_is_borzoi()) {
+                        sharpsl_partition_info[1].size=32 * 1024 * 1024;
+                }
         }
 
-        if (machine_is_husky()) {
+        if (machine_is_husky() || machine_is_borzoi()) {
                 /* Need to use small eraseblock size for backward compatibility */
                 sharpsl_mtd->flags |= MTD_NO_VIRTBLOCKS;
         }
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 34b80de34fae..bc537440ca02 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -353,8 +353,6 @@ struct cp_private {
 
         struct net_device_stats net_stats;
         struct cp_extra_stats   cp_stats;
-        struct cp_dma_stats     *nic_stats;
-        dma_addr_t              nic_stats_dma;
 
         unsigned                rx_tail         ____cacheline_aligned;
         struct cp_desc          *rx_ring;
@@ -1143,10 +1141,6 @@ static int cp_alloc_rings (struct cp_private *cp)
         cp->rx_ring = mem;
         cp->tx_ring = &cp->rx_ring[CP_RX_RING_SIZE];
 
-        mem += (CP_RING_BYTES - CP_STATS_SIZE);
-        cp->nic_stats = mem;
-        cp->nic_stats_dma = cp->ring_dma + (CP_RING_BYTES - CP_STATS_SIZE);
-
         return cp_init_rings(cp);
 }
 
@@ -1187,7 +1181,6 @@ static void cp_free_rings (struct cp_private *cp)
         pci_free_consistent(cp->pdev, CP_RING_BYTES, cp->rx_ring, cp->ring_dma);
         cp->rx_ring = NULL;
         cp->tx_ring = NULL;
-        cp->nic_stats = NULL;
 }
 
 static int cp_open (struct net_device *dev)
@@ -1516,13 +1509,17 @@ static void cp_get_ethtool_stats (struct net_device *dev,
                                   struct ethtool_stats *estats, u64 *tmp_stats)
 {
         struct cp_private *cp = netdev_priv(dev);
+        struct cp_dma_stats *nic_stats;
+        dma_addr_t dma;
         int i;
 
-        memset(cp->nic_stats, 0, sizeof(struct cp_dma_stats));
+        nic_stats = pci_alloc_consistent(cp->pdev, sizeof(*nic_stats), &dma);
+        if (!nic_stats)
+                return;
 
         /* begin NIC statistics dump */
-        cpw32(StatsAddr + 4, (cp->nic_stats_dma >> 16) >> 16);
-        cpw32(StatsAddr, (cp->nic_stats_dma & 0xffffffff) | DumpStats);
+        cpw32(StatsAddr + 4, (u64)dma >> 32);
+        cpw32(StatsAddr, ((u64)dma & DMA_32BIT_MASK) | DumpStats);
         cpr32(StatsAddr);
 
         for (i = 0; i < 1000; i++) {
@@ -1532,24 +1529,27 @@ static void cp_get_ethtool_stats (struct net_device *dev,
         }
         cpw32(StatsAddr, 0);
         cpw32(StatsAddr + 4, 0);
+        cpr32(StatsAddr);
 
         i = 0;
-        tmp_stats[i++] = le64_to_cpu(cp->nic_stats->tx_ok);
-        tmp_stats[i++] = le64_to_cpu(cp->nic_stats->rx_ok);
-        tmp_stats[i++] = le64_to_cpu(cp->nic_stats->tx_err);
-        tmp_stats[i++] = le32_to_cpu(cp->nic_stats->rx_err);
-        tmp_stats[i++] = le16_to_cpu(cp->nic_stats->rx_fifo);
-        tmp_stats[i++] = le16_to_cpu(cp->nic_stats->frame_align);
-        tmp_stats[i++] = le32_to_cpu(cp->nic_stats->tx_ok_1col);
-        tmp_stats[i++] = le32_to_cpu(cp->nic_stats->tx_ok_mcol);
-        tmp_stats[i++] = le64_to_cpu(cp->nic_stats->rx_ok_phys);
-        tmp_stats[i++] = le64_to_cpu(cp->nic_stats->rx_ok_bcast);
-        tmp_stats[i++] = le32_to_cpu(cp->nic_stats->rx_ok_mcast);
-        tmp_stats[i++] = le16_to_cpu(cp->nic_stats->tx_abort);
-        tmp_stats[i++] = le16_to_cpu(cp->nic_stats->tx_underrun);
+        tmp_stats[i++] = le64_to_cpu(nic_stats->tx_ok);
+        tmp_stats[i++] = le64_to_cpu(nic_stats->rx_ok);
+        tmp_stats[i++] = le64_to_cpu(nic_stats->tx_err);
+        tmp_stats[i++] = le32_to_cpu(nic_stats->rx_err);
+        tmp_stats[i++] = le16_to_cpu(nic_stats->rx_fifo);
+        tmp_stats[i++] = le16_to_cpu(nic_stats->frame_align);
+        tmp_stats[i++] = le32_to_cpu(nic_stats->tx_ok_1col);
+        tmp_stats[i++] = le32_to_cpu(nic_stats->tx_ok_mcol);
+        tmp_stats[i++] = le64_to_cpu(nic_stats->rx_ok_phys);
+        tmp_stats[i++] = le64_to_cpu(nic_stats->rx_ok_bcast);
+        tmp_stats[i++] = le32_to_cpu(nic_stats->rx_ok_mcast);
+        tmp_stats[i++] = le16_to_cpu(nic_stats->tx_abort);
+        tmp_stats[i++] = le16_to_cpu(nic_stats->tx_underrun);
         tmp_stats[i++] = cp->cp_stats.rx_frags;
         if (i != CP_NUM_STATS)
                 BUG();
+
+        pci_free_consistent(cp->pdev, sizeof(*nic_stats), nic_stats, dma);
 }
 
 static struct ethtool_ops cp_ethtool_ops = {
diff --git a/drivers/net/8390.c b/drivers/net/8390.c
index 6d76f3a99b17..f87027420081 100644
--- a/drivers/net/8390.c
+++ b/drivers/net/8390.c
@@ -1094,7 +1094,7 @@ static void NS8390_trigger_send(struct net_device *dev, unsigned int length,
    
         outb_p(E8390_NODMA+E8390_PAGE0, e8390_base+E8390_CMD);
     
-        if (inb_p(e8390_base) & E8390_TRANS) 
+        if (inb_p(e8390_base + E8390_CMD) & E8390_TRANS) 
         {
                 printk(KERN_WARNING "%s: trigger_send() called with the transmitter busy.\n",
                         dev->name);
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 54fff9c2e802..2a908c4690a7 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -548,6 +548,14 @@ config SUNGEM
           Support for the Sun GEM chip, aka Sun GigabitEthernet/P 2.0.  See also
           <http://www.sun.com/products-n-solutions/hardware/docs/pdf/806-3985-10.pdf>.
 
+config CASSINI
+        tristate "Sun Cassini support"
+        depends on NET_ETHERNET && PCI
+        select CRC32
+        help
+          Support for the Sun Cassini chip, aka Sun GigaSwift Ethernet. See also
+          <http://www.sun.com/products-n-solutions/hardware/docs/pdf/817-4341-10.pdf>
+
 config NET_VENDOR_3COM
         bool "3COM cards"
         depends on NET_ETHERNET && (ISA || EISA || MCA || PCI)
@@ -1951,7 +1959,7 @@ config SKGE
         ---help---
           This driver support the Marvell Yukon or SysKonnect SK-98xx/SK-95xx
           and related Gigabit Ethernet adapters. It is a new smaller driver
-          driver with better performance and more complete ethtool support.
+          with better performance and more complete ethtool support.
 
           It does not support the link failover and network management 
           features that "portable" vendor supplied sk98lin driver does.
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 8645c843cf4d..8aeec9f2495b 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -28,6 +28,7 @@ obj-$(CONFIG_SUNQE) += sunqe.o
 obj-$(CONFIG_SUNBMAC) += sunbmac.o
 obj-$(CONFIG_MYRI_SBUS) += myri_sbus.o
 obj-$(CONFIG_SUNGEM) += sungem.o sungem_phy.o
+obj-$(CONFIG_CASSINI) += cassini.o
 
 obj-$(CONFIG_MACE) += mace.o
 obj-$(CONFIG_BMAC) += bmac.o
diff --git a/drivers/net/arcnet/com90io.c b/drivers/net/arcnet/com90io.c
index 52c77cbe8c62..1f0302735416 100644
--- a/drivers/net/arcnet/com90io.c
+++ b/drivers/net/arcnet/com90io.c
@@ -160,7 +160,7 @@ static int __init com90io_probe(struct net_device *dev)
                 return -ENODEV;
         }
         if (!request_region(ioaddr, ARCNET_TOTAL_SIZE, "com90io probe")) {
-                BUGMSG(D_INIT_REASONS, "IO check_region %x-%x failed.\n",
+                BUGMSG(D_INIT_REASONS, "IO request_region %x-%x failed.\n",
                        ioaddr, ioaddr + ARCNET_TOTAL_SIZE - 1);
                 return -ENXIO;
         }
@@ -242,7 +242,7 @@ static int __init com90io_found(struct net_device *dev)
                 BUGMSG(D_NORMAL, "Can't get IRQ %d!\n", dev->irq);
                 return -ENODEV;
         }
-        /* Reserve the I/O region - guaranteed to work by check_region */
+        /* Reserve the I/O region */
         if (!request_region(dev->base_addr, ARCNET_TOTAL_SIZE, "arcnet (COM90xx-IO)")) {
                 free_irq(dev->irq, dev);
                 return -EBUSY;
diff --git a/drivers/net/arm/am79c961a.c b/drivers/net/arm/am79c961a.c
index 9b659e3c8d67..c56d86d371a9 100644
--- a/drivers/net/arm/am79c961a.c
+++ b/drivers/net/arm/am79c961a.c
@@ -15,16 +15,13 @@
  */
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <linux/fcntl.h>
 #include <linux/interrupt.h>
 #include <linux/ioport.h>
-#include <linux/in.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
-#include <linux/skbuff.h>
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/crc32.h>
@@ -33,7 +30,6 @@
 #include <asm/system.h>
 #include <asm/irq.h>
 #include <asm/io.h>
-#include <asm/dma.h>
 
 #define TX_BUFFERS 15
 #define RX_BUFFERS 25
@@ -85,7 +81,7 @@ static inline unsigned short read_ireg(u_long base_addr, u_int reg)
         u_short v;
         __asm__(
         "str%?h %1, [%2]        @ NAT_RAP\n\t"
-        "str%?h %0, [%2, #8]    @ NET_IDP\n\t"
+        "ldr%?h %0, [%2, #8]    @ NET_IDP\n\t"
         : "=r" (v)
         : "r" (reg), "r" (ISAIO_BASE + 0x0464));
         return v;
@@ -288,7 +284,7 @@ static void am79c961_timer(unsigned long data)
         else if (!lnkstat && carrier)
                 netif_carrier_off(dev);
 
-        mod_timer(&priv->timer, jiffies + 5*HZ);
+        mod_timer(&priv->timer, jiffies + msecs_to_jiffies(500));
 }
 
 /*
@@ -709,13 +705,9 @@ static int __init am79c961_init(void)
                 goto release;
 
         am79c961_banner();
-        printk(KERN_INFO "%s: ether address ", dev->name);
 
-        /* Retrive and print the ethernet address. */
-        for (i = 0; i < 6; i++) {
+        for (i = 0; i < 6; i++)
                 dev->dev_addr[i] = inb(dev->base_addr + i * 2) & 0xff;
-                printk (i == 5 ? "%02x\n" : "%02x:", dev->dev_addr[i]);
-        }
 
         spin_lock_init(&priv->chip_lock);
         init_timer(&priv->timer);
@@ -736,8 +728,14 @@ static int __init am79c961_init(void)
 #endif
 
         ret = register_netdev(dev);
-        if (ret == 0)
+        if (ret == 0) {
+                printk(KERN_INFO "%s: ether address ", dev->name);
+
+                for (i = 0; i < 6; i++)
+                        printk (i == 5 ? "%02x\n" : "%02x:", dev->dev_addr[i]);
+
                 return 0;
+        }
 
 release:
         release_region(dev->base_addr, 0x18);
diff --git a/drivers/net/bmac.c b/drivers/net/bmac.c
index 8dc657fc8afb..60dba4a1ca5c 100644
--- a/drivers/net/bmac.c
+++ b/drivers/net/bmac.c
@@ -218,7 +218,7 @@ void bmwrite(struct net_device *dev, unsigned long reg_offset, unsigned data )
 
 
 static inline
-volatile unsigned short bmread(struct net_device *dev, unsigned long reg_offset )
+unsigned short bmread(struct net_device *dev, unsigned long reg_offset )
 {
         return in_le16((void __iomem *)dev->base_addr + reg_offset);
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 94c9f68dd16b..bf81cd45e4d4 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1653,7 +1653,8 @@ static int bond_enslave(struct net_device *bond_dev, struct net_device *slave_de
         int old_features = bond_dev->features;
         int res = 0;
 
-        if (slave_dev->do_ioctl == NULL) {
+        if (!bond->params.use_carrier && slave_dev->ethtool_ops == NULL &&
+                slave_dev->do_ioctl == NULL) {
                 printk(KERN_WARNING DRV_NAME
                        ": Warning : no link monitoring support for %s\n",
                        slave_dev->name);
@@ -2775,7 +2776,7 @@ static u32 bond_glean_dev_ip(struct net_device *dev)
                 return 0;
 
         rcu_read_lock();
-        idev = __in_dev_get(dev);
+        idev = __in_dev_get_rcu(dev);
         if (!idev)
                 goto out;
 
@@ -2879,6 +2880,7 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
                  * This target is not on a VLAN
                  */
                 if (rt->u.dst.dev == bond->dev) {
+                        ip_rt_put(rt);
                         dprintk("basa: rtdev == bond->dev: arp_send\n");
                         bond_arp_send(slave->dev, ARPOP_REQUEST, targets[i],
                                       bond->master_ip, 0);
@@ -2898,6 +2900,7 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
                 }
 
                 if (vlan_id) {
+                        ip_rt_put(rt);
                         bond_arp_send(slave->dev, ARPOP_REQUEST, targets[i],
                                       vlan->vlan_ip, vlan_id);
                         continue;
@@ -2909,6 +2912,7 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
                                bond->dev->name, NIPQUAD(fl.fl4_dst),
                                rt->u.dst.dev ? rt->u.dst.dev->name : "NULL");
                 }
+                ip_rt_put(rt);
         }
 }
 
@@ -5036,6 +5040,14 @@ static int __init bonding_init(void)
         return 0;
 
 out_err:
+        /*
+         * rtnl_unlock() will run netdev_run_todo(), putting the
+         * thus-far-registered bonding devices into a state which
+         * unregigister_netdevice() will accept
+         */
+        rtnl_unlock();
+        rtnl_lock();
+
         /* free and unregister all bonds that were successfully added */
         bond_free_all();
 
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
new file mode 100644
index 000000000000..2e617424d3fb
--- /dev/null
+++ b/drivers/net/cassini.c
@@ -0,0 +1,5237 @@
+/* cassini.c: Sun Microsystems Cassini(+) ethernet driver.
+ *
+ * Copyright (C) 2004 Sun Microsystems Inc.
+ * Copyright (C) 2003 Adrian Sun (asun@darksunrising.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * This driver uses the sungem driver (c) David Miller
+ * (davem@redhat.com) as its basis.
+ *
+ * The cassini chip has a number of features that distinguish it from
+ * the gem chip:
+ *  4 transmit descriptor rings that are used for either QoS (VLAN) or
+ *      load balancing (non-VLAN mode)
+ *  batching of multiple packets
+ *  multiple CPU dispatching
+ *  page-based RX descriptor engine with separate completion rings
+ *  Gigabit support (GMII and PCS interface)
+ *  MIF link up/down detection works
+ *
+ * RX is handled by page sized buffers that are attached as fragments to
+ * the skb. here's what's done:
+ *  -- driver allocates pages at a time and keeps reference counts
+ *     on them.
+ *  -- the upper protocol layers assume that the header is in the skb
+ *     itself. as a result, cassini will copy a small amount (64 bytes)
+ *     to make them happy.
+ *  -- driver appends the rest of the data pages as frags to skbuffs
+ *     and increments the reference count
+ *  -- on page reclamation, the driver swaps the page with a spare page.
+ *     if that page is still in use, it frees its reference to that page,
+ *     and allocates a new page for use. otherwise, it just recycles the
+ *     the page. 
+ *
+ * NOTE: cassini can parse the header. however, it's not worth it
+ *       as long as the network stack requires a header copy.
+ *
+ * TX has 4 queues. currently these queues are used in a round-robin
+ * fashion for load balancing. They can also be used for QoS. for that
+ * to work, however, QoS information needs to be exposed down to the driver
+ * level so that subqueues get targetted to particular transmit rings.
+ * alternatively, the queues can be configured via use of the all-purpose
+ * ioctl.
+ *
+ * RX DATA: the rx completion ring has all the info, but the rx desc
+ * ring has all of the data. RX can conceivably come in under multiple
+ * interrupts, but the INT# assignment needs to be set up properly by
+ * the BIOS and conveyed to the driver. PCI BIOSes don't know how to do
+ * that. also, the two descriptor rings are designed to distinguish between
+ * encrypted and non-encrypted packets, but we use them for buffering 
+ * instead.
+ *
+ * by default, the selective clear mask is set up to process rx packets.  
+ */
+
+#include <linux/config.h>
+#include <linux/version.h>
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/compiler.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/pci.h>
+#include <linux/mm.h>
+#include <linux/highmem.h>
+#include <linux/list.h>
+#include <linux/dma-mapping.h>
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/ethtool.h>
+#include <linux/crc32.h>
+#include <linux/random.h>
+#include <linux/mii.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+
+#include <net/checksum.h>
+
+#include <asm/atomic.h>
+#include <asm/system.h>
+#include <asm/io.h>
+#include <asm/byteorder.h>
+#include <asm/uaccess.h>
+
+#define cas_page_map(x)      kmap_atomic((x), KM_SKB_DATA_SOFTIRQ)
+#define cas_page_unmap(x)    kunmap_atomic((x), KM_SKB_DATA_SOFTIRQ)
+#define CAS_NCPUS            num_online_cpus()
+
+#if defined(CONFIG_CASSINI_NAPI) && defined(HAVE_NETDEV_POLL)
+#define USE_NAPI
+#define cas_skb_release(x)  netif_receive_skb(x)
+#else
+#define cas_skb_release(x)  netif_rx(x)
+#endif
+
+/* select which firmware to use */
+#define USE_HP_WORKAROUND     
+#define HP_WORKAROUND_DEFAULT /* select which firmware to use as default */
+#define CAS_HP_ALT_FIRMWARE   cas_prog_null /* alternate firmware */
+
+#include "cassini.h"
+
+#define USE_TX_COMPWB      /* use completion writeback registers */
+#define USE_CSMA_CD_PROTO  /* standard CSMA/CD */
+#define USE_RX_BLANK       /* hw interrupt mitigation */
+#undef USE_ENTROPY_DEV     /* don't test for entropy device */
+
+/* NOTE: these aren't useable unless PCI interrupts can be assigned.
+ * also, we need to make cp->lock finer-grained.
+ */
+#undef  USE_PCI_INTB
+#undef  USE_PCI_INTC
+#undef  USE_PCI_INTD
+#undef  USE_QOS
+
+#undef  USE_VPD_DEBUG       /* debug vpd information if defined */
+
+/* rx processing options */
+#define USE_PAGE_ORDER      /* specify to allocate large rx pages */
+#define RX_DONT_BATCH  0    /* if 1, don't batch flows */
+#define RX_COPY_ALWAYS 0    /* if 0, use frags */
+#define RX_COPY_MIN    64   /* copy a little to make upper layers happy */
+#undef  RX_COUNT_BUFFERS    /* define to calculate RX buffer stats */
+
+#define DRV_MODULE_NAME         "cassini"
+#define PFX DRV_MODULE_NAME     ": "
+#define DRV_MODULE_VERSION      "1.4"
+#define DRV_MODULE_RELDATE      "1 July 2004"
+
+#define CAS_DEF_MSG_ENABLE        \
+        (NETIF_MSG_DRV          | \
+         NETIF_MSG_PROBE        | \
+         NETIF_MSG_LINK         | \
+         NETIF_MSG_TIMER        | \
+         NETIF_MSG_IFDOWN       | \
+         NETIF_MSG_IFUP         | \
+         NETIF_MSG_RX_ERR       | \
+         NETIF_MSG_TX_ERR)
+
+/* length of time before we decide the hardware is borked,
+ * and dev->tx_timeout() should be called to fix the problem
+ */
+#define CAS_TX_TIMEOUT                  (HZ)
+#define CAS_LINK_TIMEOUT                (22*HZ/10)
+#define CAS_LINK_FAST_TIMEOUT           (1)
+
+/* timeout values for state changing. these specify the number
+ * of 10us delays to be used before giving up.
+ */
+#define STOP_TRIES_PHY 1000
+#define STOP_TRIES     5000
+
+/* specify a minimum frame size to deal with some fifo issues 
+ * max mtu == 2 * page size - ethernet header - 64 - swivel =
+ *            2 * page_size - 0x50
+ */
+#define CAS_MIN_FRAME                   97
+#define CAS_1000MB_MIN_FRAME            255
+#define CAS_MIN_MTU                     60
+#define CAS_MAX_MTU                     min(((cp->page_size << 1) - 0x50), 9000)
+
+#if 1
+/*
+ * Eliminate these and use separate atomic counters for each, to
+ * avoid a race condition.
+ */
+#else
+#define CAS_RESET_MTU                   1
+#define CAS_RESET_ALL                   2
+#define CAS_RESET_SPARE                 3
+#endif
+
+static char version[] __devinitdata =
+        DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
+
+MODULE_AUTHOR("Adrian Sun (asun@darksunrising.com)");
+MODULE_DESCRIPTION("Sun Cassini(+) ethernet driver");
+MODULE_LICENSE("GPL");
+MODULE_PARM(cassini_debug, "i");
+MODULE_PARM_DESC(cassini_debug, "Cassini bitmapped debugging message enable value");
+MODULE_PARM(link_mode, "i");
+MODULE_PARM_DESC(link_mode, "default link mode");
+
+/*
+ * Work around for a PCS bug in which the link goes down due to the chip
+ * being confused and never showing a link status of "up."
+ */
+#define DEFAULT_LINKDOWN_TIMEOUT 5
+/* 
+ * Value in seconds, for user input.
+ */
+static int linkdown_timeout = DEFAULT_LINKDOWN_TIMEOUT;
+MODULE_PARM(linkdown_timeout, "i");
+MODULE_PARM_DESC(linkdown_timeout,
+"min reset interval in sec. for PCS linkdown issue; disabled if not positive");
+
+/*
+ * value in 'ticks' (units used by jiffies). Set when we init the
+ * module because 'HZ' in actually a function call on some flavors of
+ * Linux.  This will default to DEFAULT_LINKDOWN_TIMEOUT * HZ.
+ */
+static int link_transition_timeout;
+
+
+static int cassini_debug = -1;  /* -1 == use CAS_DEF_MSG_ENABLE as value */
+static int link_mode;
+
+static u16 link_modes[] __devinitdata = {
+        BMCR_ANENABLE,                   /* 0 : autoneg */
+        0,                               /* 1 : 10bt half duplex */
+        BMCR_SPEED100,                   /* 2 : 100bt half duplex */
+        BMCR_FULLDPLX,                   /* 3 : 10bt full duplex */
+        BMCR_SPEED100|BMCR_FULLDPLX,     /* 4 : 100bt full duplex */
+        CAS_BMCR_SPEED1000|BMCR_FULLDPLX /* 5 : 1000bt full duplex */
+};
+
+static struct pci_device_id cas_pci_tbl[] __devinitdata = {
+        { PCI_VENDOR_ID_SUN, PCI_DEVICE_ID_SUN_CASSINI,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
+        { PCI_VENDOR_ID_NS, PCI_DEVICE_ID_NS_SATURN,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
+        { 0, }
+};
+
+MODULE_DEVICE_TABLE(pci, cas_pci_tbl);
+
+static void cas_set_link_modes(struct cas *cp);
+
+static inline void cas_lock_tx(struct cas *cp)
+{
+        int i;
+
+        for (i = 0; i < N_TX_RINGS; i++)  
+                spin_lock(&cp->tx_lock[i]);
+}
+
+static inline void cas_lock_all(struct cas *cp)
+{
+        spin_lock_irq(&cp->lock);
+        cas_lock_tx(cp);
+}
+
+/* WTZ: QA was finding deadlock problems with the previous
+ * versions after long test runs with multiple cards per machine.
+ * See if replacing cas_lock_all with safer versions helps. The
+ * symptoms QA is reporting match those we'd expect if interrupts
+ * aren't being properly restored, and we fixed a previous deadlock
+ * with similar symptoms by using save/restore versions in other
+ * places.
+ */
+#define cas_lock_all_save(cp, flags) \
+do { \
+        struct cas *xxxcp = (cp); \
+        spin_lock_irqsave(&xxxcp->lock, flags); \
+        cas_lock_tx(xxxcp); \
+} while (0)
+
+static inline void cas_unlock_tx(struct cas *cp)
+{
+        int i;
+
+        for (i = N_TX_RINGS; i > 0; i--)  
+                spin_unlock(&cp->tx_lock[i - 1]);  
+}
+
+static inline void cas_unlock_all(struct cas *cp)
+{
+        cas_unlock_tx(cp);
+        spin_unlock_irq(&cp->lock);
+}
+
+#define cas_unlock_all_restore(cp, flags) \
+do { \
+        struct cas *xxxcp = (cp); \
+        cas_unlock_tx(xxxcp); \
+        spin_unlock_irqrestore(&xxxcp->lock, flags); \
+} while (0)
+
+static void cas_disable_irq(struct cas *cp, const int ring)
+{
+        /* Make sure we won't get any more interrupts */
+        if (ring == 0) {
+                writel(0xFFFFFFFF, cp->regs + REG_INTR_MASK);
+                return;
+        }
+
+        /* disable completion interrupts and selectively mask */
+        if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+                switch (ring) {
+#if defined (USE_PCI_INTB) || defined(USE_PCI_INTC) || defined(USE_PCI_INTD)
+#ifdef USE_PCI_INTB
+                case 1:
+#endif
+#ifdef USE_PCI_INTC
+                case 2:
+#endif
+#ifdef USE_PCI_INTD
+                case 3:
+#endif
+                        writel(INTRN_MASK_CLEAR_ALL | INTRN_MASK_RX_EN, 
+                               cp->regs + REG_PLUS_INTRN_MASK(ring));
+                        break;
+#endif
+                default:
+                        writel(INTRN_MASK_CLEAR_ALL, cp->regs +
+                               REG_PLUS_INTRN_MASK(ring));
+                        break;
+                }
+        }
+}
+
+static inline void cas_mask_intr(struct cas *cp)
+{
+        int i;
+
+        for (i = 0; i < N_RX_COMP_RINGS; i++)
+                cas_disable_irq(cp, i);
+}
+
+static void cas_enable_irq(struct cas *cp, const int ring)
+{
+        if (ring == 0) { /* all but TX_DONE */
+                writel(INTR_TX_DONE, cp->regs + REG_INTR_MASK);
+                return;
+        }
+
+        if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+                switch (ring) {
+#if defined (USE_PCI_INTB) || defined(USE_PCI_INTC) || defined(USE_PCI_INTD)
+#ifdef USE_PCI_INTB
+                case 1:
+#endif
+#ifdef USE_PCI_INTC
+                case 2:
+#endif
+#ifdef USE_PCI_INTD
+                case 3:
+#endif
+                        writel(INTRN_MASK_RX_EN, cp->regs +
+                               REG_PLUS_INTRN_MASK(ring));
+                        break;
+#endif
+                default:
+                        break;
+                }
+        }
+}
+
+static inline void cas_unmask_intr(struct cas *cp)
+{
+        int i;
+
+        for (i = 0; i < N_RX_COMP_RINGS; i++)
+                cas_enable_irq(cp, i);
+}
+
+static inline void cas_entropy_gather(struct cas *cp)
+{
+#ifdef USE_ENTROPY_DEV
+        if ((cp->cas_flags & CAS_FLAG_ENTROPY_DEV) == 0)
+                return;
+
+        batch_entropy_store(readl(cp->regs + REG_ENTROPY_IV),
+                            readl(cp->regs + REG_ENTROPY_IV),
+                            sizeof(uint64_t)*8);
+#endif
+}
+
+static inline void cas_entropy_reset(struct cas *cp)
+{
+#ifdef USE_ENTROPY_DEV
+        if ((cp->cas_flags & CAS_FLAG_ENTROPY_DEV) == 0)
+                return;
+
+        writel(BIM_LOCAL_DEV_PAD | BIM_LOCAL_DEV_PROM | BIM_LOCAL_DEV_EXT, 
+               cp->regs + REG_BIM_LOCAL_DEV_EN);
+        writeb(ENTROPY_RESET_STC_MODE, cp->regs + REG_ENTROPY_RESET);
+        writeb(0x55, cp->regs + REG_ENTROPY_RAND_REG);
+
+        /* if we read back 0x0, we don't have an entropy device */
+        if (readb(cp->regs + REG_ENTROPY_RAND_REG) == 0)
+                cp->cas_flags &= ~CAS_FLAG_ENTROPY_DEV;
+#endif
+}
+
+/* access to the phy. the following assumes that we've initialized the MIF to 
+ * be in frame rather than bit-bang mode
+ */
+static u16 cas_phy_read(struct cas *cp, int reg)
+{
+        u32 cmd;
+        int limit = STOP_TRIES_PHY;
+
+        cmd = MIF_FRAME_ST | MIF_FRAME_OP_READ;
+        cmd |= CAS_BASE(MIF_FRAME_PHY_ADDR, cp->phy_addr);
+        cmd |= CAS_BASE(MIF_FRAME_REG_ADDR, reg);
+        cmd |= MIF_FRAME_TURN_AROUND_MSB;
+        writel(cmd, cp->regs + REG_MIF_FRAME);
+        
+        /* poll for completion */
+        while (limit-- > 0) {
+                udelay(10);
+                cmd = readl(cp->regs + REG_MIF_FRAME);
+                if (cmd & MIF_FRAME_TURN_AROUND_LSB)
+                        return (cmd & MIF_FRAME_DATA_MASK);
+        }
+        return 0xFFFF; /* -1 */
+}
+
+static int cas_phy_write(struct cas *cp, int reg, u16 val)
+{
+        int limit = STOP_TRIES_PHY;
+        u32 cmd;
+
+        cmd = MIF_FRAME_ST | MIF_FRAME_OP_WRITE;
+        cmd |= CAS_BASE(MIF_FRAME_PHY_ADDR, cp->phy_addr);
+        cmd |= CAS_BASE(MIF_FRAME_REG_ADDR, reg);
+        cmd |= MIF_FRAME_TURN_AROUND_MSB;
+        cmd |= val & MIF_FRAME_DATA_MASK;
+        writel(cmd, cp->regs + REG_MIF_FRAME);
+        
+        /* poll for completion */
+        while (limit-- > 0) {
+                udelay(10);
+                cmd = readl(cp->regs + REG_MIF_FRAME);
+                if (cmd & MIF_FRAME_TURN_AROUND_LSB)
+                        return 0;
+        }
+        return -1;
+}
+
+static void cas_phy_powerup(struct cas *cp)
+{
+        u16 ctl = cas_phy_read(cp, MII_BMCR);   
+
+        if ((ctl & BMCR_PDOWN) == 0)
+                return;
+        ctl &= ~BMCR_PDOWN;
+        cas_phy_write(cp, MII_BMCR, ctl);
+}
+
+static void cas_phy_powerdown(struct cas *cp)
+{
+        u16 ctl = cas_phy_read(cp, MII_BMCR);   
+
+        if (ctl & BMCR_PDOWN)
+                return;
+        ctl |= BMCR_PDOWN;
+        cas_phy_write(cp, MII_BMCR, ctl);
+}
+
+/* cp->lock held. note: the last put_page will free the buffer */
+static int cas_page_free(struct cas *cp, cas_page_t *page)
+{
+        pci_unmap_page(cp->pdev, page->dma_addr, cp->page_size, 
+                       PCI_DMA_FROMDEVICE);
+        __free_pages(page->buffer, cp->page_order);
+        kfree(page);
+        return 0;
+}
+
+#ifdef RX_COUNT_BUFFERS
+#define RX_USED_ADD(x, y)       ((x)->used += (y))
+#define RX_USED_SET(x, y)       ((x)->used  = (y))
+#else
+#define RX_USED_ADD(x, y) 
+#define RX_USED_SET(x, y)
+#endif
+
+/* local page allocation routines for the receive buffers. jumbo pages
+ * require at least 8K contiguous and 8K aligned buffers.
+ */
+static cas_page_t *cas_page_alloc(struct cas *cp, const int flags)
+{
+        cas_page_t *page;
+
+        page = kmalloc(sizeof(cas_page_t), flags);
+        if (!page)
+                return NULL;
+
+        INIT_LIST_HEAD(&page->list);
+        RX_USED_SET(page, 0);
+        page->buffer = alloc_pages(flags, cp->page_order);
+        if (!page->buffer)
+                goto page_err;
+        page->dma_addr = pci_map_page(cp->pdev, page->buffer, 0,
+                                      cp->page_size, PCI_DMA_FROMDEVICE);
+        return page;
+
+page_err:
+        kfree(page);
+        return NULL;
+}
+
+/* initialize spare pool of rx buffers, but allocate during the open */
+static void cas_spare_init(struct cas *cp)
+{
+        spin_lock(&cp->rx_inuse_lock);
+        INIT_LIST_HEAD(&cp->rx_inuse_list);
+        spin_unlock(&cp->rx_inuse_lock);
+
+        spin_lock(&cp->rx_spare_lock);
+        INIT_LIST_HEAD(&cp->rx_spare_list);
+        cp->rx_spares_needed = RX_SPARE_COUNT;
+        spin_unlock(&cp->rx_spare_lock);
+}
+
+/* used on close. free all the spare buffers. */
+static void cas_spare_free(struct cas *cp)
+{
+        struct list_head list, *elem, *tmp;
+
+        /* free spare buffers */
+        INIT_LIST_HEAD(&list);
+        spin_lock(&cp->rx_spare_lock);
+        list_splice(&cp->rx_spare_list, &list);
+        INIT_LIST_HEAD(&cp->rx_spare_list);
+        spin_unlock(&cp->rx_spare_lock);
+        list_for_each_safe(elem, tmp, &list) {
+                cas_page_free(cp, list_entry(elem, cas_page_t, list));
+        }
+
+        INIT_LIST_HEAD(&list);
+#if 1
+        /*
+         * Looks like Adrian had protected this with a different
+         * lock than used everywhere else to manipulate this list.
+         */
+        spin_lock(&cp->rx_inuse_lock);
+        list_splice(&cp->rx_inuse_list, &list);
+        INIT_LIST_HEAD(&cp->rx_inuse_list);
+        spin_unlock(&cp->rx_inuse_lock);
+#else
+        spin_lock(&cp->rx_spare_lock);
+        list_splice(&cp->rx_inuse_list, &list);
+        INIT_LIST_HEAD(&cp->rx_inuse_list);
+        spin_unlock(&cp->rx_spare_lock);
+#endif
+        list_for_each_safe(elem, tmp, &list) {
+                cas_page_free(cp, list_entry(elem, cas_page_t, list));
+        }
+}
+
+/* replenish spares if needed */
+static void cas_spare_recover(struct cas *cp, const int flags)
+{
+        struct list_head list, *elem, *tmp;
+        int needed, i;
+
+        /* check inuse list. if we don't need any more free buffers,
+         * just free it
+         */
+
+        /* make a local copy of the list */
+        INIT_LIST_HEAD(&list);
+        spin_lock(&cp->rx_inuse_lock);
+        list_splice(&cp->rx_inuse_list, &list);
+        INIT_LIST_HEAD(&cp->rx_inuse_list);
+        spin_unlock(&cp->rx_inuse_lock);
+        
+        list_for_each_safe(elem, tmp, &list) {
+                cas_page_t *page = list_entry(elem, cas_page_t, list);
+
+                if (page_count(page->buffer) > 1) 
+                        continue;
+
+                list_del(elem);
+                spin_lock(&cp->rx_spare_lock);
+                if (cp->rx_spares_needed > 0) {
+                        list_add(elem, &cp->rx_spare_list);
+                        cp->rx_spares_needed--;
+                        spin_unlock(&cp->rx_spare_lock);
+                } else {
+                        spin_unlock(&cp->rx_spare_lock);
+                        cas_page_free(cp, page);
+                }
+        }
+
+        /* put any inuse buffers back on the list */
+        if (!list_empty(&list)) {
+                spin_lock(&cp->rx_inuse_lock);
+                list_splice(&list, &cp->rx_inuse_list);
+                spin_unlock(&cp->rx_inuse_lock);
+        }
+        
+        spin_lock(&cp->rx_spare_lock);
+        needed = cp->rx_spares_needed;
+        spin_unlock(&cp->rx_spare_lock);
+        if (!needed)
+                return;
+
+        /* we still need spares, so try to allocate some */
+        INIT_LIST_HEAD(&list);
+        i = 0;
+        while (i < needed) {
+                cas_page_t *spare = cas_page_alloc(cp, flags);
+                if (!spare) 
+                        break;
+                list_add(&spare->list, &list);
+                i++;
+        }
+
+        spin_lock(&cp->rx_spare_lock);
+        list_splice(&list, &cp->rx_spare_list);
+        cp->rx_spares_needed -= i;
+        spin_unlock(&cp->rx_spare_lock);
+}
+
+/* pull a page from the list. */
+static cas_page_t *cas_page_dequeue(struct cas *cp)
+{
+        struct list_head *entry;
+        int recover;
+
+        spin_lock(&cp->rx_spare_lock);
+        if (list_empty(&cp->rx_spare_list)) {
+                /* try to do a quick recovery */
+                spin_unlock(&cp->rx_spare_lock);
+                cas_spare_recover(cp, GFP_ATOMIC);
+                spin_lock(&cp->rx_spare_lock);
+                if (list_empty(&cp->rx_spare_list)) {
+                        if (netif_msg_rx_err(cp))
+                                printk(KERN_ERR "%s: no spare buffers "
+                                       "available.\n", cp->dev->name);
+                        spin_unlock(&cp->rx_spare_lock);
+                        return NULL;
+                }
+        }
+
+        entry = cp->rx_spare_list.next;
+        list_del(entry);
+        recover = ++cp->rx_spares_needed;
+        spin_unlock(&cp->rx_spare_lock);
+
+        /* trigger the timer to do the recovery */
+        if ((recover & (RX_SPARE_RECOVER_VAL - 1)) == 0) {
+#if 1
+                atomic_inc(&cp->reset_task_pending);
+                atomic_inc(&cp->reset_task_pending_spare);
+                schedule_work(&cp->reset_task);
+#else
+                atomic_set(&cp->reset_task_pending, CAS_RESET_SPARE);
+                schedule_work(&cp->reset_task);
+#endif
+        }
+        return list_entry(entry, cas_page_t, list);
+}
+
+
+static void cas_mif_poll(struct cas *cp, const int enable)
+{
+        u32 cfg;
+        
+        cfg  = readl(cp->regs + REG_MIF_CFG); 
+        cfg &= (MIF_CFG_MDIO_0 | MIF_CFG_MDIO_1);
+
+        if (cp->phy_type & CAS_PHY_MII_MDIO1)
+                cfg |= MIF_CFG_PHY_SELECT; 
+
+        /* poll and interrupt on link status change. */
+        if (enable) {
+                cfg |= MIF_CFG_POLL_EN;
+                cfg |= CAS_BASE(MIF_CFG_POLL_REG, MII_BMSR);
+                cfg |= CAS_BASE(MIF_CFG_POLL_PHY, cp->phy_addr);
+        }
+        writel((enable) ? ~(BMSR_LSTATUS | BMSR_ANEGCOMPLETE) : 0xFFFF, 
+               cp->regs + REG_MIF_MASK); 
+        writel(cfg, cp->regs + REG_MIF_CFG);
+}
+
+/* Must be invoked under cp->lock */
+static void cas_begin_auto_negotiation(struct cas *cp, struct ethtool_cmd *ep)
+{
+        u16 ctl;
+#if 1
+        int lcntl;
+        int changed = 0;
+        int oldstate = cp->lstate;
+        int link_was_not_down = !(oldstate == link_down);
+#endif
+        /* Setup link parameters */
+        if (!ep)
+                goto start_aneg;
+        lcntl = cp->link_cntl;
+        if (ep->autoneg == AUTONEG_ENABLE)
+                cp->link_cntl = BMCR_ANENABLE;
+        else {
+                cp->link_cntl = 0;
+                if (ep->speed == SPEED_100)
+                        cp->link_cntl |= BMCR_SPEED100;
+                else if (ep->speed == SPEED_1000)
+                        cp->link_cntl |= CAS_BMCR_SPEED1000;
+                if (ep->duplex == DUPLEX_FULL)
+                        cp->link_cntl |= BMCR_FULLDPLX;
+        }
+#if 1
+        changed = (lcntl != cp->link_cntl);
+#endif
+start_aneg:
+        if (cp->lstate == link_up) {
+                printk(KERN_INFO "%s: PCS link down.\n",
+                       cp->dev->name);
+        } else {
+                if (changed) {
+                        printk(KERN_INFO "%s: link configuration changed\n",
+                               cp->dev->name);
+                }
+        }
+        cp->lstate = link_down;
+        cp->link_transition = LINK_TRANSITION_LINK_DOWN;
+        if (!cp->hw_running)
+                return;
+#if 1
+        /*
+         * WTZ: If the old state was link_up, we turn off the carrier
+         * to replicate everything we do elsewhere on a link-down
+         * event when we were already in a link-up state..  
+         */
+        if (oldstate == link_up)
+                netif_carrier_off(cp->dev);
+        if (changed  && link_was_not_down) {
+                /*
+                 * WTZ: This branch will simply schedule a full reset after
+                 * we explicitly changed link modes in an ioctl. See if this
+                 * fixes the link-problems we were having for forced mode. 
+                 */
+                atomic_inc(&cp->reset_task_pending);
+                atomic_inc(&cp->reset_task_pending_all);
+                schedule_work(&cp->reset_task);
+                cp->timer_ticks = 0;
+                mod_timer(&cp->link_timer, jiffies + CAS_LINK_TIMEOUT);
+                return;
+        }
+#endif
+        if (cp->phy_type & CAS_PHY_SERDES) {
+                u32 val = readl(cp->regs + REG_PCS_MII_CTRL);
+
+                if (cp->link_cntl & BMCR_ANENABLE) {
+                        val |= (PCS_MII_RESTART_AUTONEG | PCS_MII_AUTONEG_EN);
+                        cp->lstate = link_aneg;
+                } else {
+                        if (cp->link_cntl & BMCR_FULLDPLX)
+                                val |= PCS_MII_CTRL_DUPLEX;
+                        val &= ~PCS_MII_AUTONEG_EN;
+                        cp->lstate = link_force_ok;
+                }
+                cp->link_transition = LINK_TRANSITION_LINK_CONFIG;
+                writel(val, cp->regs + REG_PCS_MII_CTRL);
+
+        } else {
+                cas_mif_poll(cp, 0);
+                ctl = cas_phy_read(cp, MII_BMCR);
+                ctl &= ~(BMCR_FULLDPLX | BMCR_SPEED100 | 
+                         CAS_BMCR_SPEED1000 | BMCR_ANENABLE);
+                ctl |= cp->link_cntl;
+                if (ctl & BMCR_ANENABLE) {
+                        ctl |= BMCR_ANRESTART;
+                        cp->lstate = link_aneg;
+                } else {
+                        cp->lstate = link_force_ok;
+                }
+                cp->link_transition = LINK_TRANSITION_LINK_CONFIG;
+                cas_phy_write(cp, MII_BMCR, ctl);
+                cas_mif_poll(cp, 1);
+        }
+
+        cp->timer_ticks = 0;
+        mod_timer(&cp->link_timer, jiffies + CAS_LINK_TIMEOUT);
+}
+
+/* Must be invoked under cp->lock. */
+static int cas_reset_mii_phy(struct cas *cp)
+{
+        int limit = STOP_TRIES_PHY;
+        u16 val;
+        
+        cas_phy_write(cp, MII_BMCR, BMCR_RESET);
+        udelay(100);
+        while (limit--) {
+                val = cas_phy_read(cp, MII_BMCR);
+                if ((val & BMCR_RESET) == 0)
+                        break;
+                udelay(10);
+        }
+        return (limit <= 0);
+}
+
+static void cas_saturn_firmware_load(struct cas *cp)
+{
+        cas_saturn_patch_t *patch = cas_saturn_patch;
+
+        cas_phy_powerdown(cp);
+
+        /* expanded memory access mode */
+        cas_phy_write(cp, DP83065_MII_MEM, 0x0);
+
+        /* pointer configuration for new firmware */
+        cas_phy_write(cp, DP83065_MII_REGE, 0x8ff9);
+        cas_phy_write(cp, DP83065_MII_REGD, 0xbd);
+        cas_phy_write(cp, DP83065_MII_REGE, 0x8ffa);
+        cas_phy_write(cp, DP83065_MII_REGD, 0x82);
+        cas_phy_write(cp, DP83065_MII_REGE, 0x8ffb);
+        cas_phy_write(cp, DP83065_MII_REGD, 0x0);
+        cas_phy_write(cp, DP83065_MII_REGE, 0x8ffc);
+        cas_phy_write(cp, DP83065_MII_REGD, 0x39);
+
+        /* download new firmware */
+        cas_phy_write(cp, DP83065_MII_MEM, 0x1);
+        cas_phy_write(cp, DP83065_MII_REGE, patch->addr);
+        while (patch->addr) {
+                cas_phy_write(cp, DP83065_MII_REGD, patch->val);
+                patch++;
+        }
+
+        /* enable firmware */
+        cas_phy_write(cp, DP83065_MII_REGE, 0x8ff8);
+        cas_phy_write(cp, DP83065_MII_REGD, 0x1);
+}
+
+
+/* phy initialization */
+static void cas_phy_init(struct cas *cp)
+{
+        u16 val;
+
+        /* if we're in MII/GMII mode, set up phy */
+        if (CAS_PHY_MII(cp->phy_type)) {
+                writel(PCS_DATAPATH_MODE_MII,
+                       cp->regs + REG_PCS_DATAPATH_MODE);
+
+                cas_mif_poll(cp, 0);
+                cas_reset_mii_phy(cp); /* take out of isolate mode */
+
+                if (PHY_LUCENT_B0 == cp->phy_id) {
+                        /* workaround link up/down issue with lucent */
+                        cas_phy_write(cp, LUCENT_MII_REG, 0x8000);
+                        cas_phy_write(cp, MII_BMCR, 0x00f1);
+                        cas_phy_write(cp, LUCENT_MII_REG, 0x0);
+
+                } else if (PHY_BROADCOM_B0 == (cp->phy_id & 0xFFFFFFFC)) {
+                        /* workarounds for broadcom phy */
+                        cas_phy_write(cp, BROADCOM_MII_REG8, 0x0C20);
+                        cas_phy_write(cp, BROADCOM_MII_REG7, 0x0012);
+                        cas_phy_write(cp, BROADCOM_MII_REG5, 0x1804);
+                        cas_phy_write(cp, BROADCOM_MII_REG7, 0x0013);
+                        cas_phy_write(cp, BROADCOM_MII_REG5, 0x1204);
+                        cas_phy_write(cp, BROADCOM_MII_REG7, 0x8006);
+                        cas_phy_write(cp, BROADCOM_MII_REG5, 0x0132);
+                        cas_phy_write(cp, BROADCOM_MII_REG7, 0x8006);
+                        cas_phy_write(cp, BROADCOM_MII_REG5, 0x0232);
+                        cas_phy_write(cp, BROADCOM_MII_REG7, 0x201F);
+                        cas_phy_write(cp, BROADCOM_MII_REG5, 0x0A20);
+
+                } else if (PHY_BROADCOM_5411 == cp->phy_id) {
+                        val = cas_phy_read(cp, BROADCOM_MII_REG4);
+                        val = cas_phy_read(cp, BROADCOM_MII_REG4);
+                        if (val & 0x0080) {
+                                /* link workaround */
+                                cas_phy_write(cp, BROADCOM_MII_REG4, 
+                                              val & ~0x0080);
+                        }
+                        
+                } else if (cp->cas_flags & CAS_FLAG_SATURN) {
+                        writel((cp->phy_type & CAS_PHY_MII_MDIO0) ? 
+                               SATURN_PCFG_FSI : 0x0, 
+                               cp->regs + REG_SATURN_PCFG);
+
+                        /* load firmware to address 10Mbps auto-negotiation
+                         * issue. NOTE: this will need to be changed if the 
+                         * default firmware gets fixed.
+                         */
+                        if (PHY_NS_DP83065 == cp->phy_id) {
+                                cas_saturn_firmware_load(cp);
+                        }
+                        cas_phy_powerup(cp);
+                }
+
+                /* advertise capabilities */
+                val = cas_phy_read(cp, MII_BMCR);
+                val &= ~BMCR_ANENABLE;
+                cas_phy_write(cp, MII_BMCR, val);
+                udelay(10);
+
+                cas_phy_write(cp, MII_ADVERTISE,
+                              cas_phy_read(cp, MII_ADVERTISE) |
+                              (ADVERTISE_10HALF | ADVERTISE_10FULL |
+                               ADVERTISE_100HALF | ADVERTISE_100FULL |
+                               CAS_ADVERTISE_PAUSE | 
+                               CAS_ADVERTISE_ASYM_PAUSE));
+                
+                if (cp->cas_flags & CAS_FLAG_1000MB_CAP) {
+                        /* make sure that we don't advertise half
+                         * duplex to avoid a chip issue
+                         */
+                        val  = cas_phy_read(cp, CAS_MII_1000_CTRL);
+                        val &= ~CAS_ADVERTISE_1000HALF;
+                        val |= CAS_ADVERTISE_1000FULL;
+                        cas_phy_write(cp, CAS_MII_1000_CTRL, val);
+                }
+
+        } else {
+                /* reset pcs for serdes */
+                u32 val;
+                int limit;
+
+                writel(PCS_DATAPATH_MODE_SERDES,
+                       cp->regs + REG_PCS_DATAPATH_MODE);
+
+                /* enable serdes pins on saturn */
+                if (cp->cas_flags & CAS_FLAG_SATURN)
+                        writel(0, cp->regs + REG_SATURN_PCFG);
+
+                /* Reset PCS unit. */
+                val = readl(cp->regs + REG_PCS_MII_CTRL);
+                val |= PCS_MII_RESET;
+                writel(val, cp->regs + REG_PCS_MII_CTRL);
+
+                limit = STOP_TRIES;
+                while (limit-- > 0) {
+                        udelay(10);
+                        if ((readl(cp->regs + REG_PCS_MII_CTRL) & 
+                             PCS_MII_RESET) == 0)
+                                break;
+                }
+                if (limit <= 0)
+                        printk(KERN_WARNING "%s: PCS reset bit would not "
+                               "clear [%08x].\n", cp->dev->name,
+                               readl(cp->regs + REG_PCS_STATE_MACHINE));
+
+                /* Make sure PCS is disabled while changing advertisement
+                 * configuration.
+                 */
+                writel(0x0, cp->regs + REG_PCS_CFG);
+
+                /* Advertise all capabilities except half-duplex. */
+                val  = readl(cp->regs + REG_PCS_MII_ADVERT);
+                val &= ~PCS_MII_ADVERT_HD;
+                val |= (PCS_MII_ADVERT_FD | PCS_MII_ADVERT_SYM_PAUSE | 
+                        PCS_MII_ADVERT_ASYM_PAUSE);
+                writel(val, cp->regs + REG_PCS_MII_ADVERT);
+
+                /* enable PCS */
+                writel(PCS_CFG_EN, cp->regs + REG_PCS_CFG);
+
+                /* pcs workaround: enable sync detect */
+                writel(PCS_SERDES_CTRL_SYNCD_EN,
+                       cp->regs + REG_PCS_SERDES_CTRL);
+        }
+}
+
+
+static int cas_pcs_link_check(struct cas *cp)
+{
+        u32 stat, state_machine;
+        int retval = 0;
+
+        /* The link status bit latches on zero, so you must
+         * read it twice in such a case to see a transition
+         * to the link being up.
+         */
+        stat = readl(cp->regs + REG_PCS_MII_STATUS);
+        if ((stat & PCS_MII_STATUS_LINK_STATUS) == 0)
+                stat = readl(cp->regs + REG_PCS_MII_STATUS);
+
+        /* The remote-fault indication is only valid
+         * when autoneg has completed.
+         */
+        if ((stat & (PCS_MII_STATUS_AUTONEG_COMP |
+                     PCS_MII_STATUS_REMOTE_FAULT)) ==
+            (PCS_MII_STATUS_AUTONEG_COMP | PCS_MII_STATUS_REMOTE_FAULT)) {
+                if (netif_msg_link(cp))
+                        printk(KERN_INFO "%s: PCS RemoteFault\n", 
+                               cp->dev->name);
+        }
+
+        /* work around link detection issue by querying the PCS state
+         * machine directly.
+         */
+        state_machine = readl(cp->regs + REG_PCS_STATE_MACHINE);
+        if ((state_machine & PCS_SM_LINK_STATE_MASK) != SM_LINK_STATE_UP) {
+                stat &= ~PCS_MII_STATUS_LINK_STATUS;
+        } else if (state_machine & PCS_SM_WORD_SYNC_STATE_MASK) {
+                stat |= PCS_MII_STATUS_LINK_STATUS;
+        }
+
+        if (stat & PCS_MII_STATUS_LINK_STATUS) {
+                if (cp->lstate != link_up) {
+                        if (cp->opened) {
+                                cp->lstate = link_up;
+                                cp->link_transition = LINK_TRANSITION_LINK_UP;
+                                
+                                cas_set_link_modes(cp);
+                                netif_carrier_on(cp->dev);
+                        }
+                }
+        } else if (cp->lstate == link_up) {
+                cp->lstate = link_down;
+                if (link_transition_timeout != 0 &&
+                    cp->link_transition != LINK_TRANSITION_REQUESTED_RESET &&
+                    !cp->link_transition_jiffies_valid) {
+                        /*
+                         * force a reset, as a workaround for the 
+                         * link-failure problem. May want to move this to a 
+                         * point a bit earlier in the sequence. If we had
+                         * generated a reset a short time ago, we'll wait for
+                         * the link timer to check the status until a
+                         * timer expires (link_transistion_jiffies_valid is
+                         * true when the timer is running.)  Instead of using
+                         * a system timer, we just do a check whenever the
+                         * link timer is running - this clears the flag after
+                         * a suitable delay.
+                         */
+                        retval = 1;
+                        cp->link_transition = LINK_TRANSITION_REQUESTED_RESET;
+                        cp->link_transition_jiffies = jiffies;
+                        cp->link_transition_jiffies_valid = 1;
+                } else {
+                        cp->link_transition = LINK_TRANSITION_ON_FAILURE;
+                }
+                netif_carrier_off(cp->dev);
+                if (cp->opened && netif_msg_link(cp)) {
+                        printk(KERN_INFO "%s: PCS link down.\n",
+                               cp->dev->name);
+                }
+
+                /* Cassini only: if you force a mode, there can be
+                 * sync problems on link down. to fix that, the following
+                 * things need to be checked:
+                 * 1) read serialink state register
+                 * 2) read pcs status register to verify link down.
+                 * 3) if link down and serial link == 0x03, then you need
+                 *    to global reset the chip.
+                 */
+                if ((cp->cas_flags & CAS_FLAG_REG_PLUS) == 0) {
+                        /* should check to see if we're in a forced mode */
+                        stat = readl(cp->regs + REG_PCS_SERDES_STATE);
+                        if (stat == 0x03)
+                                return 1;
+                }
+        } else if (cp->lstate == link_down) {
+                if (link_transition_timeout != 0 &&
+                    cp->link_transition != LINK_TRANSITION_REQUESTED_RESET &&
+                    !cp->link_transition_jiffies_valid) {
+                        /* force a reset, as a workaround for the
+                         * link-failure problem.  May want to move
+                         * this to a point a bit earlier in the
+                         * sequence.
+                         */
+                        retval = 1;
+                        cp->link_transition = LINK_TRANSITION_REQUESTED_RESET;
+                        cp->link_transition_jiffies = jiffies;
+                        cp->link_transition_jiffies_valid = 1;
+                } else {
+                        cp->link_transition = LINK_TRANSITION_STILL_FAILED;
+                }
+        }
+
+        return retval;
+}
+
+static int cas_pcs_interrupt(struct net_device *dev, 
+                             struct cas *cp, u32 status)
+{
+        u32 stat = readl(cp->regs + REG_PCS_INTR_STATUS);
+
+        if ((stat & PCS_INTR_STATUS_LINK_CHANGE) == 0) 
+                return 0;
+        return cas_pcs_link_check(cp);
+}
+
+static int cas_txmac_interrupt(struct net_device *dev, 
+                               struct cas *cp, u32 status)
+{
+        u32 txmac_stat = readl(cp->regs + REG_MAC_TX_STATUS);
+
+        if (!txmac_stat)
+                return 0;
+
+        if (netif_msg_intr(cp))
+                printk(KERN_DEBUG "%s: txmac interrupt, txmac_stat: 0x%x\n",
+                        cp->dev->name, txmac_stat);
+
+        /* Defer timer expiration is quite normal,
+         * don't even log the event.
+         */
+        if ((txmac_stat & MAC_TX_DEFER_TIMER) &&
+            !(txmac_stat & ~MAC_TX_DEFER_TIMER))
+                return 0;
+
+        spin_lock(&cp->stat_lock[0]);
+        if (txmac_stat & MAC_TX_UNDERRUN) {
+                printk(KERN_ERR "%s: TX MAC xmit underrun.\n",
+                       dev->name);
+                cp->net_stats[0].tx_fifo_errors++;
+        }
+
+        if (txmac_stat & MAC_TX_MAX_PACKET_ERR) {
+                printk(KERN_ERR "%s: TX MAC max packet size error.\n",
+                       dev->name);
+                cp->net_stats[0].tx_errors++;
+        }
+
+        /* The rest are all cases of one of the 16-bit TX
+         * counters expiring.
+         */
+        if (txmac_stat & MAC_TX_COLL_NORMAL)
+                cp->net_stats[0].collisions += 0x10000;
+
+        if (txmac_stat & MAC_TX_COLL_EXCESS) {
+                cp->net_stats[0].tx_aborted_errors += 0x10000;
+                cp->net_stats[0].collisions += 0x10000;
+        }
+
+        if (txmac_stat & MAC_TX_COLL_LATE) {
+                cp->net_stats[0].tx_aborted_errors += 0x10000;
+                cp->net_stats[0].collisions += 0x10000;
+        }
+        spin_unlock(&cp->stat_lock[0]);
+
+        /* We do not keep track of MAC_TX_COLL_FIRST and
+         * MAC_TX_PEAK_ATTEMPTS events.
+         */
+        return 0;
+}
+
+static void cas_load_firmware(struct cas *cp, cas_hp_inst_t *firmware) 
+{
+        cas_hp_inst_t *inst;
+        u32 val;
+        int i;
+
+        i = 0;
+        while ((inst = firmware) && inst->note) {
+                writel(i, cp->regs + REG_HP_INSTR_RAM_ADDR);
+
+                val = CAS_BASE(HP_INSTR_RAM_HI_VAL, inst->val);
+                val |= CAS_BASE(HP_INSTR_RAM_HI_MASK, inst->mask);
+                writel(val, cp->regs + REG_HP_INSTR_RAM_DATA_HI);
+
+                val = CAS_BASE(HP_INSTR_RAM_MID_OUTARG, inst->outarg >> 10);
+                val |= CAS_BASE(HP_INSTR_RAM_MID_OUTOP, inst->outop);
+                val |= CAS_BASE(HP_INSTR_RAM_MID_FNEXT, inst->fnext);
+                val |= CAS_BASE(HP_INSTR_RAM_MID_FOFF, inst->foff);
+                val |= CAS_BASE(HP_INSTR_RAM_MID_SNEXT, inst->snext);
+                val |= CAS_BASE(HP_INSTR_RAM_MID_SOFF, inst->soff);
+                val |= CAS_BASE(HP_INSTR_RAM_MID_OP, inst->op);
+                writel(val, cp->regs + REG_HP_INSTR_RAM_DATA_MID);
+
+                val = CAS_BASE(HP_INSTR_RAM_LOW_OUTMASK, inst->outmask);
+                val |= CAS_BASE(HP_INSTR_RAM_LOW_OUTSHIFT, inst->outshift);
+                val |= CAS_BASE(HP_INSTR_RAM_LOW_OUTEN, inst->outenab);
+                val |= CAS_BASE(HP_INSTR_RAM_LOW_OUTARG, inst->outarg);
+                writel(val, cp->regs + REG_HP_INSTR_RAM_DATA_LOW);
+                ++firmware;
+                ++i;
+        }
+}
+
+static void cas_init_rx_dma(struct cas *cp)
+{
+        u64 desc_dma = cp->block_dvma; 
+        u32 val;
+        int i, size;
+
+        /* rx free descriptors */
+        val = CAS_BASE(RX_CFG_SWIVEL, RX_SWIVEL_OFF_VAL); 
+        val |= CAS_BASE(RX_CFG_DESC_RING, RX_DESC_RINGN_INDEX(0));
+        val |= CAS_BASE(RX_CFG_COMP_RING, RX_COMP_RINGN_INDEX(0));
+        if ((N_RX_DESC_RINGS > 1) &&
+            (cp->cas_flags & CAS_FLAG_REG_PLUS))  /* do desc 2 */
+                val |= CAS_BASE(RX_CFG_DESC_RING1, RX_DESC_RINGN_INDEX(1));
+        writel(val, cp->regs + REG_RX_CFG);
+
+        val = (unsigned long) cp->init_rxds[0] - 
+                (unsigned long) cp->init_block;
+        writel((desc_dma + val) >> 32, cp->regs + REG_RX_DB_HI);
+        writel((desc_dma + val) & 0xffffffff, cp->regs + REG_RX_DB_LOW);
+        writel(RX_DESC_RINGN_SIZE(0) - 4, cp->regs + REG_RX_KICK);
+
+        if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+                /* rx desc 2 is for IPSEC packets. however, 
+                 * we don't it that for that purpose.
+                 */
+                val = (unsigned long) cp->init_rxds[1] - 
+                        (unsigned long) cp->init_block;
+                writel((desc_dma + val) >> 32, cp->regs + REG_PLUS_RX_DB1_HI);
+                writel((desc_dma + val) & 0xffffffff, cp->regs + 
+                       REG_PLUS_RX_DB1_LOW);
+                writel(RX_DESC_RINGN_SIZE(1) - 4, cp->regs + 
+                       REG_PLUS_RX_KICK1);
+        }
+        
+        /* rx completion registers */
+        val = (unsigned long) cp->init_rxcs[0] - 
+                (unsigned long) cp->init_block;
+        writel((desc_dma + val) >> 32, cp->regs + REG_RX_CB_HI);
+        writel((desc_dma + val) & 0xffffffff, cp->regs + REG_RX_CB_LOW);
+
+        if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+                /* rx comp 2-4 */
+                for (i = 1; i < MAX_RX_COMP_RINGS; i++) {
+                        val = (unsigned long) cp->init_rxcs[i] - 
+                                (unsigned long) cp->init_block;
+                        writel((desc_dma + val) >> 32, cp->regs + 
+                               REG_PLUS_RX_CBN_HI(i));
+                        writel((desc_dma + val) & 0xffffffff, cp->regs + 
+                               REG_PLUS_RX_CBN_LOW(i));
+                }
+        }
+
+        /* read selective clear regs to prevent spurious interrupts
+         * on reset because complete == kick.
+         * selective clear set up to prevent interrupts on resets
+         */
+        readl(cp->regs + REG_INTR_STATUS_ALIAS);
+        writel(INTR_RX_DONE | INTR_RX_BUF_UNAVAIL, cp->regs + REG_ALIAS_CLEAR);
+        if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+                for (i = 1; i < N_RX_COMP_RINGS; i++)
+                        readl(cp->regs + REG_PLUS_INTRN_STATUS_ALIAS(i));
+
+                /* 2 is different from 3 and 4 */
+                if (N_RX_COMP_RINGS > 1)
+                        writel(INTR_RX_DONE_ALT | INTR_RX_BUF_UNAVAIL_1, 
+                               cp->regs + REG_PLUS_ALIASN_CLEAR(1));
+
+                for (i = 2; i < N_RX_COMP_RINGS; i++) 
+                        writel(INTR_RX_DONE_ALT, 
+                               cp->regs + REG_PLUS_ALIASN_CLEAR(i));
+        }
+
+        /* set up pause thresholds */
+        val  = CAS_BASE(RX_PAUSE_THRESH_OFF,
+                        cp->rx_pause_off / RX_PAUSE_THRESH_QUANTUM);
+        val |= CAS_BASE(RX_PAUSE_THRESH_ON, 
+                        cp->rx_pause_on / RX_PAUSE_THRESH_QUANTUM);
+        writel(val, cp->regs + REG_RX_PAUSE_THRESH);
+        
+        /* zero out dma reassembly buffers */
+        for (i = 0; i < 64; i++) {
+                writel(i, cp->regs + REG_RX_TABLE_ADDR);
+                writel(0x0, cp->regs + REG_RX_TABLE_DATA_LOW);
+                writel(0x0, cp->regs + REG_RX_TABLE_DATA_MID);
+                writel(0x0, cp->regs + REG_RX_TABLE_DATA_HI);
+        }
+
+        /* make sure address register is 0 for normal operation */
+        writel(0x0, cp->regs + REG_RX_CTRL_FIFO_ADDR);
+        writel(0x0, cp->regs + REG_RX_IPP_FIFO_ADDR);
+
+        /* interrupt mitigation */
+#ifdef USE_RX_BLANK
+        val = CAS_BASE(RX_BLANK_INTR_TIME, RX_BLANK_INTR_TIME_VAL);
+        val |= CAS_BASE(RX_BLANK_INTR_PKT, RX_BLANK_INTR_PKT_VAL);
+        writel(val, cp->regs + REG_RX_BLANK);
+#else
+        writel(0x0, cp->regs + REG_RX_BLANK);
+#endif
+
+        /* interrupt generation as a function of low water marks for
+         * free desc and completion entries. these are used to trigger
+         * housekeeping for rx descs. we don't use the free interrupt
+         * as it's not very useful
+         */
+        /* val = CAS_BASE(RX_AE_THRESH_FREE, RX_AE_FREEN_VAL(0)); */
+        val = CAS_BASE(RX_AE_THRESH_COMP, RX_AE_COMP_VAL);
+        writel(val, cp->regs + REG_RX_AE_THRESH);
+        if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+                val = CAS_BASE(RX_AE1_THRESH_FREE, RX_AE_FREEN_VAL(1));
+                writel(val, cp->regs + REG_PLUS_RX_AE1_THRESH);
+        }
+
+        /* Random early detect registers. useful for congestion avoidance.
+         * this should be tunable.
+         */
+        writel(0x0, cp->regs + REG_RX_RED);
+        
+        /* receive page sizes. default == 2K (0x800) */
+        val = 0;
+        if (cp->page_size == 0x1000)
+                val = 0x1;
+        else if (cp->page_size == 0x2000)
+                val = 0x2;
+        else if (cp->page_size == 0x4000)
+                val = 0x3;
+        
+        /* round mtu + offset. constrain to page size. */
+        size = cp->dev->mtu + 64;
+        if (size > cp->page_size)
+                size = cp->page_size;
+
+        if (size <= 0x400)
+                i = 0x0;
+        else if (size <= 0x800)
+                i = 0x1;
+        else if (size <= 0x1000)
+                i = 0x2;
+        else
+                i = 0x3;
+
+        cp->mtu_stride = 1 << (i + 10);
+        val  = CAS_BASE(RX_PAGE_SIZE, val);
+        val |= CAS_BASE(RX_PAGE_SIZE_MTU_STRIDE, i); 
+        val |= CAS_BASE(RX_PAGE_SIZE_MTU_COUNT, cp->page_size >> (i + 10));
+        val |= CAS_BASE(RX_PAGE_SIZE_MTU_OFF, 0x1);
+        writel(val, cp->regs + REG_RX_PAGE_SIZE);
+        
+        /* enable the header parser if desired */
+        if (CAS_HP_FIRMWARE == cas_prog_null)
+                return;
+
+        val = CAS_BASE(HP_CFG_NUM_CPU, CAS_NCPUS > 63 ? 0 : CAS_NCPUS);
+        val |= HP_CFG_PARSE_EN | HP_CFG_SYN_INC_MASK;
+        val |= CAS_BASE(HP_CFG_TCP_THRESH, HP_TCP_THRESH_VAL);
+        writel(val, cp->regs + REG_HP_CFG);
+}
+
+static inline void cas_rxc_init(struct cas_rx_comp *rxc)
+{
+        memset(rxc, 0, sizeof(*rxc));
+        rxc->word4 = cpu_to_le64(RX_COMP4_ZERO); 
+}
+
+/* NOTE: we use the ENC RX DESC ring for spares. the rx_page[0,1]
+ * flipping is protected by the fact that the chip will not
+ * hand back the same page index while it's being processed.
+ */
+static inline cas_page_t *cas_page_spare(struct cas *cp, const int index)
+{
+        cas_page_t *page = cp->rx_pages[1][index];
+        cas_page_t *new;
+
+        if (page_count(page->buffer) == 1)
+                return page;
+
+        new = cas_page_dequeue(cp);
+        if (new) {
+                spin_lock(&cp->rx_inuse_lock);
+                list_add(&page->list, &cp->rx_inuse_list);
+                spin_unlock(&cp->rx_inuse_lock);
+        }
+        return new;
+}
+                                   
+/* this needs to be changed if we actually use the ENC RX DESC ring */
+static cas_page_t *cas_page_swap(struct cas *cp, const int ring, 
+                                 const int index)
+{
+        cas_page_t **page0 = cp->rx_pages[0];
+        cas_page_t **page1 = cp->rx_pages[1];
+
+        /* swap if buffer is in use */
+        if (page_count(page0[index]->buffer) > 1) {
+                cas_page_t *new = cas_page_spare(cp, index);
+                if (new) {
+                        page1[index] = page0[index];
+                        page0[index] = new;
+                }
+        } 
+        RX_USED_SET(page0[index], 0);
+        return page0[index];
+}
+
+static void cas_clean_rxds(struct cas *cp)
+{
+        /* only clean ring 0 as ring 1 is used for spare buffers */
+        struct cas_rx_desc *rxd = cp->init_rxds[0];
+        int i, size;
+
+        /* release all rx flows */
+        for (i = 0; i < N_RX_FLOWS; i++) {
+                struct sk_buff *skb;
+                while ((skb = __skb_dequeue(&cp->rx_flows[i]))) {
+                        cas_skb_release(skb);
+                }
+        }
+
+        /* initialize descriptors */
+        size = RX_DESC_RINGN_SIZE(0);
+        for (i = 0; i < size; i++) {
+                cas_page_t *page = cas_page_swap(cp, 0, i);
+                rxd[i].buffer = cpu_to_le64(page->dma_addr);
+                rxd[i].index  = cpu_to_le64(CAS_BASE(RX_INDEX_NUM, i) | 
+                                            CAS_BASE(RX_INDEX_RING, 0));
+        }
+
+        cp->rx_old[0]  = RX_DESC_RINGN_SIZE(0) - 4; 
+        cp->rx_last[0] = 0;
+        cp->cas_flags &= ~CAS_FLAG_RXD_POST(0);
+}
+
+static void cas_clean_rxcs(struct cas *cp)
+{
+        int i, j;
+
+        /* take ownership of rx comp descriptors */
+        memset(cp->rx_cur, 0, sizeof(*cp->rx_cur)*N_RX_COMP_RINGS);
+        memset(cp->rx_new, 0, sizeof(*cp->rx_new)*N_RX_COMP_RINGS);
+        for (i = 0; i < N_RX_COMP_RINGS; i++) {
+                struct cas_rx_comp *rxc = cp->init_rxcs[i];
+                for (j = 0; j < RX_COMP_RINGN_SIZE(i); j++) {
+                        cas_rxc_init(rxc + j);
+                }
+        }
+}
+
+#if 0
+/* When we get a RX fifo overflow, the RX unit is probably hung
+ * so we do the following.
+ *
+ * If any part of the reset goes wrong, we return 1 and that causes the
+ * whole chip to be reset.
+ */
+static int cas_rxmac_reset(struct cas *cp)
+{
+        struct net_device *dev = cp->dev;
+        int limit;
+        u32 val;
+
+        /* First, reset MAC RX. */
+        writel(cp->mac_rx_cfg & ~MAC_RX_CFG_EN, cp->regs + REG_MAC_RX_CFG);
+        for (limit = 0; limit < STOP_TRIES; limit++) {
+                if (!(readl(cp->regs + REG_MAC_RX_CFG) & MAC_RX_CFG_EN))
+                        break;
+                udelay(10);
+        }
+        if (limit == STOP_TRIES) {
+                printk(KERN_ERR "%s: RX MAC will not disable, resetting whole "
+                       "chip.\n", dev->name);
+                return 1;
+        }
+
+        /* Second, disable RX DMA. */
+        writel(0, cp->regs + REG_RX_CFG);
+        for (limit = 0; limit < STOP_TRIES; limit++) {
+                if (!(readl(cp->regs + REG_RX_CFG) & RX_CFG_DMA_EN))
+                        break;
+                udelay(10);
+        }
+        if (limit == STOP_TRIES) {
+                printk(KERN_ERR "%s: RX DMA will not disable, resetting whole "
+                       "chip.\n", dev->name);
+                return 1;
+        }
+
+        mdelay(5);
+
+        /* Execute RX reset command. */
+        writel(SW_RESET_RX, cp->regs + REG_SW_RESET);
+        for (limit = 0; limit < STOP_TRIES; limit++) {
+                if (!(readl(cp->regs + REG_SW_RESET) & SW_RESET_RX))
+                        break;
+                udelay(10);
+        }
+        if (limit == STOP_TRIES) {
+                printk(KERN_ERR "%s: RX reset command will not execute, "
+                       "resetting whole chip.\n", dev->name);
+                return 1;
+        }
+
+        /* reset driver rx state */
+        cas_clean_rxds(cp);
+        cas_clean_rxcs(cp);
+
+        /* Now, reprogram the rest of RX unit. */
+        cas_init_rx_dma(cp);
+
+        /* re-enable */
+        val = readl(cp->regs + REG_RX_CFG);
+        writel(val | RX_CFG_DMA_EN, cp->regs + REG_RX_CFG);
+        writel(MAC_RX_FRAME_RECV, cp->regs + REG_MAC_RX_MASK);
+        val = readl(cp->regs + REG_MAC_RX_CFG);
+        writel(val | MAC_RX_CFG_EN, cp->regs + REG_MAC_RX_CFG);
+        return 0;
+}
+#endif
+
+static int cas_rxmac_interrupt(struct net_device *dev, struct cas *cp,
+                               u32 status)
+{
+        u32 stat = readl(cp->regs + REG_MAC_RX_STATUS);
+
+        if (!stat)
+                return 0;
+
+        if (netif_msg_intr(cp))
+                printk(KERN_DEBUG "%s: rxmac interrupt, stat: 0x%x\n",
+                        cp->dev->name, stat);
+
+        /* these are all rollovers */
+        spin_lock(&cp->stat_lock[0]);
+        if (stat & MAC_RX_ALIGN_ERR) 
+                cp->net_stats[0].rx_frame_errors += 0x10000;
+
+        if (stat & MAC_RX_CRC_ERR)
+                cp->net_stats[0].rx_crc_errors += 0x10000;
+
+        if (stat & MAC_RX_LEN_ERR)
+                cp->net_stats[0].rx_length_errors += 0x10000;
+
+        if (stat & MAC_RX_OVERFLOW) {
+                cp->net_stats[0].rx_over_errors++;
+                cp->net_stats[0].rx_fifo_errors++;
+        }
+
+        /* We do not track MAC_RX_FRAME_COUNT and MAC_RX_VIOL_ERR
+         * events.
+         */
+        spin_unlock(&cp->stat_lock[0]);
+        return 0;
+}
+
+static int cas_mac_interrupt(struct net_device *dev, struct cas *cp,
+                             u32 status)
+{
+        u32 stat = readl(cp->regs + REG_MAC_CTRL_STATUS);
+
+        if (!stat)
+                return 0;
+
+        if (netif_msg_intr(cp))
+                printk(KERN_DEBUG "%s: mac interrupt, stat: 0x%x\n",
+                        cp->dev->name, stat);
+
+        /* This interrupt is just for pause frame and pause
+         * tracking.  It is useful for diagnostics and debug
+         * but probably by default we will mask these events.
+         */
+        if (stat & MAC_CTRL_PAUSE_STATE)
+                cp->pause_entered++;
+
+        if (stat & MAC_CTRL_PAUSE_RECEIVED)
+                cp->pause_last_time_recvd = (stat >> 16);
+
+        return 0;
+}
+
+        
+/* Must be invoked under cp->lock. */
+static inline int cas_mdio_link_not_up(struct cas *cp)
+{
+        u16 val;
+        
+        switch (cp->lstate) {
+        case link_force_ret:
+                if (netif_msg_link(cp))
+                        printk(KERN_INFO "%s: Autoneg failed again, keeping"
+                                " forced mode\n", cp->dev->name);
+                cas_phy_write(cp, MII_BMCR, cp->link_fcntl);
+                cp->timer_ticks = 5;
+                cp->lstate = link_force_ok;
+                cp->link_transition = LINK_TRANSITION_LINK_CONFIG;
+                break;
+                
+        case link_aneg:
+                val = cas_phy_read(cp, MII_BMCR);
+
+                /* Try forced modes. we try things in the following order:
+                 * 1000 full -> 100 full/half -> 10 half
+                 */
+                val &= ~(BMCR_ANRESTART | BMCR_ANENABLE);
+                val |= BMCR_FULLDPLX;
+                val |= (cp->cas_flags & CAS_FLAG_1000MB_CAP) ? 
+                        CAS_BMCR_SPEED1000 : BMCR_SPEED100;
+                cas_phy_write(cp, MII_BMCR, val);
+                cp->timer_ticks = 5;
+                cp->lstate = link_force_try;
+                cp->link_transition = LINK_TRANSITION_LINK_CONFIG;
+                break;
+
+        case link_force_try:
+                /* Downgrade from 1000 to 100 to 10 Mbps if necessary. */
+                val = cas_phy_read(cp, MII_BMCR);
+                cp->timer_ticks = 5;
+                if (val & CAS_BMCR_SPEED1000) { /* gigabit */
+                        val &= ~CAS_BMCR_SPEED1000;
+                        val |= (BMCR_SPEED100 | BMCR_FULLDPLX);
+                        cas_phy_write(cp, MII_BMCR, val);
+                        break;
+                }
+
+                if (val & BMCR_SPEED100) {
+                        if (val & BMCR_FULLDPLX) /* fd failed */
+                                val &= ~BMCR_FULLDPLX;
+                        else { /* 100Mbps failed */
+                                val &= ~BMCR_SPEED100;
+                        }
+                        cas_phy_write(cp, MII_BMCR, val);
+                        break;
+                }
+        default:
+                break;
+        }
+        return 0;
+}
+
+
+/* must be invoked with cp->lock held */
+static int cas_mii_link_check(struct cas *cp, const u16 bmsr)
+{
+        int restart;
+
+        if (bmsr & BMSR_LSTATUS) {
+                /* Ok, here we got a link. If we had it due to a forced
+                 * fallback, and we were configured for autoneg, we 
+                 * retry a short autoneg pass. If you know your hub is
+                 * broken, use ethtool ;)
+                 */
+                if ((cp->lstate == link_force_try) && 
+                    (cp->link_cntl & BMCR_ANENABLE)) {
+                        cp->lstate = link_force_ret;
+                        cp->link_transition = LINK_TRANSITION_LINK_CONFIG;
+                        cas_mif_poll(cp, 0);
+                        cp->link_fcntl = cas_phy_read(cp, MII_BMCR);
+                        cp->timer_ticks = 5;
+                        if (cp->opened && netif_msg_link(cp))
+                                printk(KERN_INFO "%s: Got link after fallback, retrying"
+                                       " autoneg once...\n", cp->dev->name);
+                        cas_phy_write(cp, MII_BMCR,
+                                      cp->link_fcntl | BMCR_ANENABLE |
+                                      BMCR_ANRESTART);
+                        cas_mif_poll(cp, 1);
+
+                } else if (cp->lstate != link_up) {
+                        cp->lstate = link_up;
+                        cp->link_transition = LINK_TRANSITION_LINK_UP;
+
+                        if (cp->opened) {
+                                cas_set_link_modes(cp);
+                                netif_carrier_on(cp->dev);
+                        }
+                }
+                return 0;
+        }
+
+        /* link not up. if the link was previously up, we restart the
+         * whole process
+         */
+        restart = 0;
+        if (cp->lstate == link_up) {
+                cp->lstate = link_down;
+                cp->link_transition = LINK_TRANSITION_LINK_DOWN;
+
+                netif_carrier_off(cp->dev);
+                if (cp->opened && netif_msg_link(cp))
+                        printk(KERN_INFO "%s: Link down\n",
+                               cp->dev->name);
+                restart = 1;
+                
+        } else if (++cp->timer_ticks > 10)
+                cas_mdio_link_not_up(cp);
+                
+        return restart;
+}
+
+static int cas_mif_interrupt(struct net_device *dev, struct cas *cp,
+                             u32 status)
+{
+        u32 stat = readl(cp->regs + REG_MIF_STATUS);
+        u16 bmsr;
+
+        /* check for a link change */
+        if (CAS_VAL(MIF_STATUS_POLL_STATUS, stat) == 0)
+                return 0;
+
+        bmsr = CAS_VAL(MIF_STATUS_POLL_DATA, stat);
+        return cas_mii_link_check(cp, bmsr);
+}
+
+static int cas_pci_interrupt(struct net_device *dev, struct cas *cp,
+                             u32 status)
+{
+        u32 stat = readl(cp->regs + REG_PCI_ERR_STATUS);
+
+        if (!stat)
+                return 0;
+
+        printk(KERN_ERR "%s: PCI error [%04x:%04x] ", dev->name, stat,
+               readl(cp->regs + REG_BIM_DIAG));
+
+        /* cassini+ has this reserved */
+        if ((stat & PCI_ERR_BADACK) &&
+            ((cp->cas_flags & CAS_FLAG_REG_PLUS) == 0))
+                printk("<No ACK64# during ABS64 cycle> ");
+
+        if (stat & PCI_ERR_DTRTO)
+                printk("<Delayed transaction timeout> ");
+        if (stat & PCI_ERR_OTHER)
+                printk("<other> ");
+        if (stat & PCI_ERR_BIM_DMA_WRITE)
+                printk("<BIM DMA 0 write req> ");
+        if (stat & PCI_ERR_BIM_DMA_READ)
+                printk("<BIM DMA 0 read req> ");
+        printk("\n");
+
+        if (stat & PCI_ERR_OTHER) {
+                u16 cfg;
+
+                /* Interrogate PCI config space for the
+                 * true cause.
+                 */
+                pci_read_config_word(cp->pdev, PCI_STATUS, &cfg);
+                printk(KERN_ERR "%s: Read PCI cfg space status [%04x]\n",
+                       dev->name, cfg);
+                if (cfg & PCI_STATUS_PARITY)
+                        printk(KERN_ERR "%s: PCI parity error detected.\n",
+                               dev->name);
+                if (cfg & PCI_STATUS_SIG_TARGET_ABORT)
+                        printk(KERN_ERR "%s: PCI target abort.\n",
+                               dev->name);
+                if (cfg & PCI_STATUS_REC_TARGET_ABORT)
+                        printk(KERN_ERR "%s: PCI master acks target abort.\n",
+                               dev->name);
+                if (cfg & PCI_STATUS_REC_MASTER_ABORT)
+                        printk(KERN_ERR "%s: PCI master abort.\n", dev->name);
+                if (cfg & PCI_STATUS_SIG_SYSTEM_ERROR)
+                        printk(KERN_ERR "%s: PCI system error SERR#.\n",
+                               dev->name);
+                if (cfg & PCI_STATUS_DETECTED_PARITY)
+                        printk(KERN_ERR "%s: PCI parity error.\n",
+                               dev->name);
+
+                /* Write the error bits back to clear them. */
+                cfg &= (PCI_STATUS_PARITY |
+                        PCI_STATUS_SIG_TARGET_ABORT |
+                        PCI_STATUS_REC_TARGET_ABORT |
+                        PCI_STATUS_REC_MASTER_ABORT |
+                        PCI_STATUS_SIG_SYSTEM_ERROR |
+                        PCI_STATUS_DETECTED_PARITY);
+                pci_write_config_word(cp->pdev, PCI_STATUS, cfg);
+        }
+
+        /* For all PCI errors, we should reset the chip. */
+        return 1;
+}
+
+/* All non-normal interrupt conditions get serviced here.
+ * Returns non-zero if we should just exit the interrupt
+ * handler right now (ie. if we reset the card which invalidates
+ * all of the other original irq status bits).
+ */
+static int cas_abnormal_irq(struct net_device *dev, struct cas *cp,
+                            u32 status)
+{
+        if (status & INTR_RX_TAG_ERROR) {
+                /* corrupt RX tag framing */
+                if (netif_msg_rx_err(cp))
+                        printk(KERN_DEBUG "%s: corrupt rx tag framing\n",
+                                cp->dev->name);
+                spin_lock(&cp->stat_lock[0]);
+                cp->net_stats[0].rx_errors++;
+                spin_unlock(&cp->stat_lock[0]);
+                goto do_reset;
+        }
+
+        if (status & INTR_RX_LEN_MISMATCH) {
+                /* length mismatch. */
+                if (netif_msg_rx_err(cp))
+                        printk(KERN_DEBUG "%s: length mismatch for rx frame\n",
+                                cp->dev->name);
+                spin_lock(&cp->stat_lock[0]);
+                cp->net_stats[0].rx_errors++;
+                spin_unlock(&cp->stat_lock[0]);
+                goto do_reset;
+        }
+
+        if (status & INTR_PCS_STATUS) {
+                if (cas_pcs_interrupt(dev, cp, status))
+                        goto do_reset;
+        }
+
+        if (status & INTR_TX_MAC_STATUS) {
+                if (cas_txmac_interrupt(dev, cp, status))
+                        goto do_reset;
+        }
+
+        if (status & INTR_RX_MAC_STATUS) {
+                if (cas_rxmac_interrupt(dev, cp, status))
+                        goto do_reset;
+        }
+
+        if (status & INTR_MAC_CTRL_STATUS) {
+                if (cas_mac_interrupt(dev, cp, status))
+                        goto do_reset;
+        }
+
+        if (status & INTR_MIF_STATUS) {
+                if (cas_mif_interrupt(dev, cp, status))
+                        goto do_reset;
+        }
+
+        if (status & INTR_PCI_ERROR_STATUS) {
+                if (cas_pci_interrupt(dev, cp, status))
+                        goto do_reset;
+        }
+        return 0;
+
+do_reset:
+#if 1
+        atomic_inc(&cp->reset_task_pending);
+        atomic_inc(&cp->reset_task_pending_all);
+        printk(KERN_ERR "%s:reset called in cas_abnormal_irq [0x%x]\n",
+               dev->name, status);
+        schedule_work(&cp->reset_task);
+#else
+        atomic_set(&cp->reset_task_pending, CAS_RESET_ALL);
+        printk(KERN_ERR "reset called in cas_abnormal_irq\n");
+        schedule_work(&cp->reset_task);
+#endif
+        return 1;
+}
+
+/* NOTE: CAS_TABORT returns 1 or 2 so that it can be used when
+ *       determining whether to do a netif_stop/wakeup
+ */
+#define CAS_TABORT(x)      (((x)->cas_flags & CAS_FLAG_TARGET_ABORT) ? 2 : 1)
+#define CAS_ROUND_PAGE(x)  (((x) + PAGE_SIZE - 1) & PAGE_MASK)
+static inline int cas_calc_tabort(struct cas *cp, const unsigned long addr,
+                                  const int len)
+{
+        unsigned long off = addr + len;
+
+        if (CAS_TABORT(cp) == 1)
+                return 0;
+        if ((CAS_ROUND_PAGE(off) - off) > TX_TARGET_ABORT_LEN)
+                return 0;
+        return TX_TARGET_ABORT_LEN;
+}
+
+static inline void cas_tx_ringN(struct cas *cp, int ring, int limit)
+{
+        struct cas_tx_desc *txds;
+        struct sk_buff **skbs;
+        struct net_device *dev = cp->dev;
+        int entry, count;
+
+        spin_lock(&cp->tx_lock[ring]);
+        txds = cp->init_txds[ring];
+        skbs = cp->tx_skbs[ring];
+        entry = cp->tx_old[ring];
+
+        count = TX_BUFF_COUNT(ring, entry, limit);
+        while (entry != limit) {
+                struct sk_buff *skb = skbs[entry];
+                dma_addr_t daddr;
+                u32 dlen;
+                int frag;
+
+                if (!skb) {
+                        /* this should never occur */
+                        entry = TX_DESC_NEXT(ring, entry);
+                        continue;
+                }
+
+                /* however, we might get only a partial skb release. */
+                count -= skb_shinfo(skb)->nr_frags +
+                        + cp->tx_tiny_use[ring][entry].nbufs + 1;
+                if (count < 0)
+                        break;
+
+                if (netif_msg_tx_done(cp))
+                        printk(KERN_DEBUG "%s: tx[%d] done, slot %d\n",
+                               cp->dev->name, ring, entry);
+
+                skbs[entry] = NULL;
+                cp->tx_tiny_use[ring][entry].nbufs = 0;
+                
+                for (frag = 0; frag <= skb_shinfo(skb)->nr_frags; frag++) {
+                        struct cas_tx_desc *txd = txds + entry;
+
+                        daddr = le64_to_cpu(txd->buffer);
+                        dlen = CAS_VAL(TX_DESC_BUFLEN,
+                                       le64_to_cpu(txd->control));
+                        pci_unmap_page(cp->pdev, daddr, dlen,
+                                       PCI_DMA_TODEVICE);
+                        entry = TX_DESC_NEXT(ring, entry);
+
+                        /* tiny buffer may follow */
+                        if (cp->tx_tiny_use[ring][entry].used) {
+                                cp->tx_tiny_use[ring][entry].used = 0;
+                                entry = TX_DESC_NEXT(ring, entry);
+                        } 
+                }
+
+                spin_lock(&cp->stat_lock[ring]);
+                cp->net_stats[ring].tx_packets++;
+                cp->net_stats[ring].tx_bytes += skb->len;
+                spin_unlock(&cp->stat_lock[ring]);
+                dev_kfree_skb_irq(skb);
+        }
+        cp->tx_old[ring] = entry;
+
+        /* this is wrong for multiple tx rings. the net device needs
+         * multiple queues for this to do the right thing.  we wait
+         * for 2*packets to be available when using tiny buffers
+         */
+        if (netif_queue_stopped(dev) &&
+            (TX_BUFFS_AVAIL(cp, ring) > CAS_TABORT(cp)*(MAX_SKB_FRAGS + 1)))
+                netif_wake_queue(dev);
+        spin_unlock(&cp->tx_lock[ring]);
+}
+
+static void cas_tx(struct net_device *dev, struct cas *cp,
+                   u32 status)
+{
+        int limit, ring;
+#ifdef USE_TX_COMPWB
+        u64 compwb = le64_to_cpu(cp->init_block->tx_compwb);
+#endif
+        if (netif_msg_intr(cp))
+                printk(KERN_DEBUG "%s: tx interrupt, status: 0x%x, %lx\n",
+                        cp->dev->name, status, compwb);
+        /* process all the rings */
+        for (ring = 0; ring < N_TX_RINGS; ring++) {
+#ifdef USE_TX_COMPWB
+                /* use the completion writeback registers */
+                limit = (CAS_VAL(TX_COMPWB_MSB, compwb) << 8) |
+                        CAS_VAL(TX_COMPWB_LSB, compwb);
+                compwb = TX_COMPWB_NEXT(compwb);
+#else
+                limit = readl(cp->regs + REG_TX_COMPN(ring));
+#endif
+                if (cp->tx_old[ring] != limit) 
+                        cas_tx_ringN(cp, ring, limit);
+        }
+}
+
+
+static int cas_rx_process_pkt(struct cas *cp, struct cas_rx_comp *rxc, 
+                              int entry, const u64 *words, 
+                              struct sk_buff **skbref)
+{
+        int dlen, hlen, len, i, alloclen;
+        int off, swivel = RX_SWIVEL_OFF_VAL;
+        struct cas_page *page;
+        struct sk_buff *skb;
+        void *addr, *crcaddr;
+        char *p; 
+
+        hlen = CAS_VAL(RX_COMP2_HDR_SIZE, words[1]);
+        dlen = CAS_VAL(RX_COMP1_DATA_SIZE, words[0]);
+        len  = hlen + dlen;
+
+        if (RX_COPY_ALWAYS || (words[2] & RX_COMP3_SMALL_PKT)) 
+                alloclen = len;
+        else 
+                alloclen = max(hlen, RX_COPY_MIN);
+
+        skb = dev_alloc_skb(alloclen + swivel + cp->crc_size);
+        if (skb == NULL) 
+                return -1;
+
+        *skbref = skb;
+        skb->dev = cp->dev;
+        skb_reserve(skb, swivel);
+
+        p = skb->data;
+        addr = crcaddr = NULL;
+        if (hlen) { /* always copy header pages */
+                i = CAS_VAL(RX_COMP2_HDR_INDEX, words[1]);
+                page = cp->rx_pages[CAS_VAL(RX_INDEX_RING, i)][CAS_VAL(RX_INDEX_NUM, i)];
+                off = CAS_VAL(RX_COMP2_HDR_OFF, words[1]) * 0x100 + 
+                        swivel;
+
+                i = hlen;
+                if (!dlen) /* attach FCS */
+                        i += cp->crc_size;
+                pci_dma_sync_single_for_cpu(cp->pdev, page->dma_addr + off, i,
+                                    PCI_DMA_FROMDEVICE);
+                addr = cas_page_map(page->buffer);
+                memcpy(p, addr + off, i);
+                pci_dma_sync_single_for_device(cp->pdev, page->dma_addr + off, i,
+                                    PCI_DMA_FROMDEVICE);
+                cas_page_unmap(addr);
+                RX_USED_ADD(page, 0x100);
+                p += hlen;
+                swivel = 0;
+        } 
+
+
+        if (alloclen < (hlen + dlen)) {
+                skb_frag_t *frag = skb_shinfo(skb)->frags;
+
+                /* normal or jumbo packets. we use frags */
+                i = CAS_VAL(RX_COMP1_DATA_INDEX, words[0]);
+                page = cp->rx_pages[CAS_VAL(RX_INDEX_RING, i)][CAS_VAL(RX_INDEX_NUM, i)];
+                off = CAS_VAL(RX_COMP1_DATA_OFF, words[0]) + swivel;
+
+                hlen = min(cp->page_size - off, dlen);
+                if (hlen < 0) {
+                        if (netif_msg_rx_err(cp)) {
+                                printk(KERN_DEBUG "%s: rx page overflow: "
+                                       "%d\n", cp->dev->name, hlen);
+                        }
+                        dev_kfree_skb_irq(skb);
+                        return -1;
+                }
+                i = hlen;
+                if (i == dlen)  /* attach FCS */
+                        i += cp->crc_size;
+                pci_dma_sync_single_for_cpu(cp->pdev, page->dma_addr + off, i,
+                                    PCI_DMA_FROMDEVICE);
+
+                /* make sure we always copy a header */
+                swivel = 0;
+                if (p == (char *) skb->data) { /* not split */
+                        addr = cas_page_map(page->buffer);
+                        memcpy(p, addr + off, RX_COPY_MIN);
+                        pci_dma_sync_single_for_device(cp->pdev, page->dma_addr + off, i,
+                                        PCI_DMA_FROMDEVICE);
+                        cas_page_unmap(addr);
+                        off += RX_COPY_MIN;
+                        swivel = RX_COPY_MIN;
+                        RX_USED_ADD(page, cp->mtu_stride);
+                } else {
+                        RX_USED_ADD(page, hlen);
+                }
+                skb_put(skb, alloclen);
+
+                skb_shinfo(skb)->nr_frags++;
+                skb->data_len += hlen - swivel;
+                skb->len      += hlen - swivel;
+
+                get_page(page->buffer);
+                frag->page = page->buffer;
+                frag->page_offset = off;
+                frag->size = hlen - swivel;
+                
+                /* any more data? */
+                if ((words[0] & RX_COMP1_SPLIT_PKT) && ((dlen -= hlen) > 0)) {
+                        hlen = dlen;
+                        off = 0;
+
+                        i = CAS_VAL(RX_COMP2_NEXT_INDEX, words[1]);
+                        page = cp->rx_pages[CAS_VAL(RX_INDEX_RING, i)][CAS_VAL(RX_INDEX_NUM, i)];
+                        pci_dma_sync_single_for_cpu(cp->pdev, page->dma_addr, 
+                                            hlen + cp->crc_size, 
+                                            PCI_DMA_FROMDEVICE);
+                        pci_dma_sync_single_for_device(cp->pdev, page->dma_addr,
+                                            hlen + cp->crc_size,
+                                            PCI_DMA_FROMDEVICE);
+
+                        skb_shinfo(skb)->nr_frags++;
+                        skb->data_len += hlen;
+                        skb->len      += hlen; 
+                        frag++;
+
+                        get_page(page->buffer);
+                        frag->page = page->buffer;
+                        frag->page_offset = 0;
+                        frag->size = hlen;
+                        RX_USED_ADD(page, hlen + cp->crc_size);
+                }
+
+                if (cp->crc_size) {
+                        addr = cas_page_map(page->buffer);
+                        crcaddr  = addr + off + hlen;
+                }
+
+        } else {
+                /* copying packet */
+                if (!dlen)
+                        goto end_copy_pkt;
+
+                i = CAS_VAL(RX_COMP1_DATA_INDEX, words[0]);
+                page = cp->rx_pages[CAS_VAL(RX_INDEX_RING, i)][CAS_VAL(RX_INDEX_NUM, i)];
+                off = CAS_VAL(RX_COMP1_DATA_OFF, words[0]) + swivel;
+                hlen = min(cp->page_size - off, dlen);
+                if (hlen < 0) {
+                        if (netif_msg_rx_err(cp)) {
+                                printk(KERN_DEBUG "%s: rx page overflow: "
+                                       "%d\n", cp->dev->name, hlen);
+                        }
+                        dev_kfree_skb_irq(skb);
+                        return -1;
+                }
+                i = hlen;
+                if (i == dlen) /* attach FCS */
+                        i += cp->crc_size;
+                pci_dma_sync_single_for_cpu(cp->pdev, page->dma_addr + off, i,
+                                    PCI_DMA_FROMDEVICE);
+                addr = cas_page_map(page->buffer);
+                memcpy(p, addr + off, i);
+                pci_dma_sync_single_for_device(cp->pdev, page->dma_addr + off, i,
+                                    PCI_DMA_FROMDEVICE);
+                cas_page_unmap(addr);
+                if (p == (char *) skb->data) /* not split */
+                        RX_USED_ADD(page, cp->mtu_stride);
+                else
+                        RX_USED_ADD(page, i);
+        
+                /* any more data? */
+                if ((words[0] & RX_COMP1_SPLIT_PKT) && ((dlen -= hlen) > 0)) {
+                        p += hlen;
+                        i = CAS_VAL(RX_COMP2_NEXT_INDEX, words[1]);
+                        page = cp->rx_pages[CAS_VAL(RX_INDEX_RING, i)][CAS_VAL(RX_INDEX_NUM, i)];
+                        pci_dma_sync_single_for_cpu(cp->pdev, page->dma_addr, 
+                                            dlen + cp->crc_size, 
+                                            PCI_DMA_FROMDEVICE);
+                        addr = cas_page_map(page->buffer);
+                        memcpy(p, addr, dlen + cp->crc_size);
+                        pci_dma_sync_single_for_device(cp->pdev, page->dma_addr,
+                                            dlen + cp->crc_size,
+                                            PCI_DMA_FROMDEVICE);
+                        cas_page_unmap(addr);
+                        RX_USED_ADD(page, dlen + cp->crc_size); 
+                }
+end_copy_pkt:
+                if (cp->crc_size) {
+                        addr    = NULL;
+                        crcaddr = skb->data + alloclen;
+                }
+                skb_put(skb, alloclen);
+        }
+
+        i = CAS_VAL(RX_COMP4_TCP_CSUM, words[3]);
+        if (cp->crc_size) {
+                /* checksum includes FCS. strip it out. */
+                i = csum_fold(csum_partial(crcaddr, cp->crc_size, i));
+                if (addr)
+                        cas_page_unmap(addr);
+        }
+        skb->csum = ntohs(i ^ 0xffff);
+        skb->ip_summed = CHECKSUM_HW;
+        skb->protocol = eth_type_trans(skb, cp->dev);
+        return len;
+}
+
+
+/* we can handle up to 64 rx flows at a time. we do the same thing
+ * as nonreassm except that we batch up the buffers. 
+ * NOTE: we currently just treat each flow as a bunch of packets that
+ *       we pass up. a better way would be to coalesce the packets
+ *       into a jumbo packet. to do that, we need to do the following:
+ *       1) the first packet will have a clean split between header and
+ *          data. save both.
+ *       2) each time the next flow packet comes in, extend the
+ *          data length and merge the checksums.
+ *       3) on flow release, fix up the header.
+ *       4) make sure the higher layer doesn't care.
+ * because packets get coalesced, we shouldn't run into fragment count 
+ * issues.
+ */
+static inline void cas_rx_flow_pkt(struct cas *cp, const u64 *words,
+                                   struct sk_buff *skb)
+{
+        int flowid = CAS_VAL(RX_COMP3_FLOWID, words[2]) & (N_RX_FLOWS - 1);
+        struct sk_buff_head *flow = &cp->rx_flows[flowid];
+        
+        /* this is protected at a higher layer, so no need to 
+         * do any additional locking here. stick the buffer
+         * at the end.
+         */
+        __skb_insert(skb, flow->prev, (struct sk_buff *) flow, flow);
+        if (words[0] & RX_COMP1_RELEASE_FLOW) {
+                while ((skb = __skb_dequeue(flow))) {
+                        cas_skb_release(skb);
+                }
+        }
+}
+
+/* put rx descriptor back on ring. if a buffer is in use by a higher
+ * layer, this will need to put in a replacement.
+ */
+static void cas_post_page(struct cas *cp, const int ring, const int index)
+{
+        cas_page_t *new;
+        int entry;
+
+        entry = cp->rx_old[ring];
+
+        new = cas_page_swap(cp, ring, index);
+        cp->init_rxds[ring][entry].buffer = cpu_to_le64(new->dma_addr);
+        cp->init_rxds[ring][entry].index  =
+                cpu_to_le64(CAS_BASE(RX_INDEX_NUM, index) | 
+                            CAS_BASE(RX_INDEX_RING, ring));
+
+        entry = RX_DESC_ENTRY(ring, entry + 1);
+        cp->rx_old[ring] = entry;
+        
+        if (entry % 4)
+                return;
+
+        if (ring == 0)
+                writel(entry, cp->regs + REG_RX_KICK);
+        else if ((N_RX_DESC_RINGS > 1) &&
+                 (cp->cas_flags & CAS_FLAG_REG_PLUS)) 
+                writel(entry, cp->regs + REG_PLUS_RX_KICK1);
+}
+
+
+/* only when things are bad */
+static int cas_post_rxds_ringN(struct cas *cp, int ring, int num)
+{
+        unsigned int entry, last, count, released;
+        int cluster;
+        cas_page_t **page = cp->rx_pages[ring];
+
+        entry = cp->rx_old[ring];
+
+        if (netif_msg_intr(cp))
+                printk(KERN_DEBUG "%s: rxd[%d] interrupt, done: %d\n",
+                       cp->dev->name, ring, entry);
+
+        cluster = -1;
+        count = entry & 0x3; 
+        last = RX_DESC_ENTRY(ring, num ? entry + num - 4: entry - 4);
+        released = 0;
+        while (entry != last) {
+                /* make a new buffer if it's still in use */
+                if (page_count(page[entry]->buffer) > 1) {
+                        cas_page_t *new = cas_page_dequeue(cp);
+                        if (!new) {
+                                /* let the timer know that we need to 
+                                 * do this again
+                                 */
+                                cp->cas_flags |= CAS_FLAG_RXD_POST(ring);
+                                if (!timer_pending(&cp->link_timer))
+                                        mod_timer(&cp->link_timer, jiffies + 
+                                                  CAS_LINK_FAST_TIMEOUT);
+                                cp->rx_old[ring]  = entry;
+                                cp->rx_last[ring] = num ? num - released : 0;
+                                return -ENOMEM;
+                        }
+                        spin_lock(&cp->rx_inuse_lock);
+                        list_add(&page[entry]->list, &cp->rx_inuse_list);
+                        spin_unlock(&cp->rx_inuse_lock);
+                        cp->init_rxds[ring][entry].buffer = 
+                                cpu_to_le64(new->dma_addr);
+                        page[entry] = new;
+                        
+                }
+
+                if (++count == 4) {
+                        cluster = entry;
+                        count = 0;
+                }
+                released++;
+                entry = RX_DESC_ENTRY(ring, entry + 1);
+        }
+        cp->rx_old[ring] = entry;
+
+        if (cluster < 0) 
+                return 0;
+
+        if (ring == 0)
+                writel(cluster, cp->regs + REG_RX_KICK);
+        else if ((N_RX_DESC_RINGS > 1) &&
+                 (cp->cas_flags & CAS_FLAG_REG_PLUS)) 
+                writel(cluster, cp->regs + REG_PLUS_RX_KICK1);
+        return 0;
+}
+
+
+/* process a completion ring. packets are set up in three basic ways:
+ * small packets: should be copied header + data in single buffer.
+ * large packets: header and data in a single buffer.
+ * split packets: header in a separate buffer from data. 
+ *                data may be in multiple pages. data may be > 256
+ *                bytes but in a single page. 
+ *
+ * NOTE: RX page posting is done in this routine as well. while there's
+ *       the capability of using multiple RX completion rings, it isn't
+ *       really worthwhile due to the fact that the page posting will
+ *       force serialization on the single descriptor ring. 
+ */
+static int cas_rx_ringN(struct cas *cp, int ring, int budget)
+{
+        struct cas_rx_comp *rxcs = cp->init_rxcs[ring];
+        int entry, drops;
+        int npackets = 0;
+
+        if (netif_msg_intr(cp))
+                printk(KERN_DEBUG "%s: rx[%d] interrupt, done: %d/%d\n",
+                       cp->dev->name, ring,
+                       readl(cp->regs + REG_RX_COMP_HEAD), 
+                       cp->rx_new[ring]);
+
+        entry = cp->rx_new[ring];
+        drops = 0;
+        while (1) {
+                struct cas_rx_comp *rxc = rxcs + entry;
+                struct sk_buff *skb;
+                int type, len;
+                u64 words[4];
+                int i, dring;
+
+                words[0] = le64_to_cpu(rxc->word1);
+                words[1] = le64_to_cpu(rxc->word2);
+                words[2] = le64_to_cpu(rxc->word3);
+                words[3] = le64_to_cpu(rxc->word4);
+
+                /* don't touch if still owned by hw */
+                type = CAS_VAL(RX_COMP1_TYPE, words[0]);
+                if (type == 0)
+                        break;
+
+                /* hw hasn't cleared the zero bit yet */
+                if (words[3] & RX_COMP4_ZERO) {
+                        break;
+                }
+
+                /* get info on the packet */
+                if (words[3] & (RX_COMP4_LEN_MISMATCH | RX_COMP4_BAD)) {
+                        spin_lock(&cp->stat_lock[ring]);
+                        cp->net_stats[ring].rx_errors++;
+                        if (words[3] & RX_COMP4_LEN_MISMATCH)
+                                cp->net_stats[ring].rx_length_errors++;
+                        if (words[3] & RX_COMP4_BAD)
+                                cp->net_stats[ring].rx_crc_errors++;
+                        spin_unlock(&cp->stat_lock[ring]);
+
+                        /* We'll just return it to Cassini. */
+                drop_it:
+                        spin_lock(&cp->stat_lock[ring]);
+                        ++cp->net_stats[ring].rx_dropped;
+                        spin_unlock(&cp->stat_lock[ring]);
+                        goto next;
+                }
+
+                len = cas_rx_process_pkt(cp, rxc, entry, words, &skb);
+                if (len < 0) {
+                        ++drops;
+                        goto drop_it;
+                }
+
+                /* see if it's a flow re-assembly or not. the driver
+                 * itself handles release back up.
+                 */
+                if (RX_DONT_BATCH || (type == 0x2)) {
+                        /* non-reassm: these always get released */
+                        cas_skb_release(skb); 
+                } else {
+                        cas_rx_flow_pkt(cp, words, skb);
+                }
+
+                spin_lock(&cp->stat_lock[ring]);
+                cp->net_stats[ring].rx_packets++;
+                cp->net_stats[ring].rx_bytes += len;
+                spin_unlock(&cp->stat_lock[ring]);
+                cp->dev->last_rx = jiffies;
+
+        next:
+                npackets++;
+
+                /* should it be released? */
+                if (words[0] & RX_COMP1_RELEASE_HDR) {
+                        i = CAS_VAL(RX_COMP2_HDR_INDEX, words[1]);
+                        dring = CAS_VAL(RX_INDEX_RING, i);
+                        i = CAS_VAL(RX_INDEX_NUM, i);
+                        cas_post_page(cp, dring, i);
+                }
+                
+                if (words[0] & RX_COMP1_RELEASE_DATA) {
+                        i = CAS_VAL(RX_COMP1_DATA_INDEX, words[0]);
+                        dring = CAS_VAL(RX_INDEX_RING, i);
+                        i = CAS_VAL(RX_INDEX_NUM, i);
+                        cas_post_page(cp, dring, i);
+                }
+
+                if (words[0] & RX_COMP1_RELEASE_NEXT) {
+                        i = CAS_VAL(RX_COMP2_NEXT_INDEX, words[1]);
+                        dring = CAS_VAL(RX_INDEX_RING, i);
+                        i = CAS_VAL(RX_INDEX_NUM, i);
+                        cas_post_page(cp, dring, i);
+                }
+
+                /* skip to the next entry */
+                entry = RX_COMP_ENTRY(ring, entry + 1 + 
+                                      CAS_VAL(RX_COMP1_SKIP, words[0]));
+#ifdef USE_NAPI
+                if (budget && (npackets >= budget))
+                        break;
+#endif
+        }
+        cp->rx_new[ring] = entry;
+
+        if (drops)
+                printk(KERN_INFO "%s: Memory squeeze, deferring packet.\n",
+                       cp->dev->name);
+        return npackets;
+}
+
+
+/* put completion entries back on the ring */
+static void cas_post_rxcs_ringN(struct net_device *dev,
+                                struct cas *cp, int ring)
+{
+        struct cas_rx_comp *rxc = cp->init_rxcs[ring];
+        int last, entry;
+
+        last = cp->rx_cur[ring];
+        entry = cp->rx_new[ring]; 
+        if (netif_msg_intr(cp))
+                printk(KERN_DEBUG "%s: rxc[%d] interrupt, done: %d/%d\n",
+                       dev->name, ring, readl(cp->regs + REG_RX_COMP_HEAD),
+                       entry);
+        
+        /* zero and re-mark descriptors */
+        while (last != entry) {
+                cas_rxc_init(rxc + last);
+                last = RX_COMP_ENTRY(ring, last + 1);
+        }
+        cp->rx_cur[ring] = last;
+
+        if (ring == 0)
+                writel(last, cp->regs + REG_RX_COMP_TAIL);
+        else if (cp->cas_flags & CAS_FLAG_REG_PLUS) 
+                writel(last, cp->regs + REG_PLUS_RX_COMPN_TAIL(ring));
+}
+
+
+
+/* cassini can use all four PCI interrupts for the completion ring. 
+ * rings 3 and 4 are identical
+ */
+#if defined(USE_PCI_INTC) || defined(USE_PCI_INTD)
+static inline void cas_handle_irqN(struct net_device *dev, 
+                                   struct cas *cp, const u32 status,
+                                   const int ring)
+{
+        if (status & (INTR_RX_COMP_FULL_ALT | INTR_RX_COMP_AF_ALT)) 
+                cas_post_rxcs_ringN(dev, cp, ring);
+}
+
+static irqreturn_t cas_interruptN(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct net_device *dev = dev_id;
+        struct cas *cp = netdev_priv(dev);
+        unsigned long flags;
+        int ring;
+        u32 status = readl(cp->regs + REG_PLUS_INTRN_STATUS(ring));
+
+        /* check for shared irq */
+        if (status == 0)
+                return IRQ_NONE;
+
+        ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
+        spin_lock_irqsave(&cp->lock, flags);
+        if (status & INTR_RX_DONE_ALT) { /* handle rx separately */
+#ifdef USE_NAPI
+                cas_mask_intr(cp);
+                netif_rx_schedule(dev);
+#else
+                cas_rx_ringN(cp, ring, 0);
+#endif
+                status &= ~INTR_RX_DONE_ALT;
+        }
+
+        if (status)
+                cas_handle_irqN(dev, cp, status, ring);
+        spin_unlock_irqrestore(&cp->lock, flags);
+        return IRQ_HANDLED;
+}
+#endif
+
+#ifdef USE_PCI_INTB
+/* everything but rx packets */
+static inline void cas_handle_irq1(struct cas *cp, const u32 status)
+{
+        if (status & INTR_RX_BUF_UNAVAIL_1) {
+                /* Frame arrived, no free RX buffers available. 
+                 * NOTE: we can get this on a link transition. */
+                cas_post_rxds_ringN(cp, 1, 0);
+                spin_lock(&cp->stat_lock[1]);
+                cp->net_stats[1].rx_dropped++;
+                spin_unlock(&cp->stat_lock[1]);
+        }
+
+        if (status & INTR_RX_BUF_AE_1) 
+                cas_post_rxds_ringN(cp, 1, RX_DESC_RINGN_SIZE(1) - 
+                                    RX_AE_FREEN_VAL(1));
+
+        if (status & (INTR_RX_COMP_AF | INTR_RX_COMP_FULL))
+                cas_post_rxcs_ringN(cp, 1);
+}
+
+/* ring 2 handles a few more events than 3 and 4 */
+static irqreturn_t cas_interrupt1(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct net_device *dev = dev_id;
+        struct cas *cp = netdev_priv(dev);
+        unsigned long flags;
+        u32 status = readl(cp->regs + REG_PLUS_INTRN_STATUS(1));
+
+        /* check for shared interrupt */
+        if (status == 0)
+                return IRQ_NONE;
+
+        spin_lock_irqsave(&cp->lock, flags);
+        if (status & INTR_RX_DONE_ALT) { /* handle rx separately */
+#ifdef USE_NAPI
+                cas_mask_intr(cp);
+                netif_rx_schedule(dev);
+#else
+                cas_rx_ringN(cp, 1, 0);
+#endif
+                status &= ~INTR_RX_DONE_ALT;
+        }
+        if (status)
+                cas_handle_irq1(cp, status);
+        spin_unlock_irqrestore(&cp->lock, flags);
+        return IRQ_HANDLED;
+}
+#endif
+
+static inline void cas_handle_irq(struct net_device *dev,
+                                  struct cas *cp, const u32 status)
+{
+        /* housekeeping interrupts */
+        if (status & INTR_ERROR_MASK)
+                cas_abnormal_irq(dev, cp, status);
+
+        if (status & INTR_RX_BUF_UNAVAIL) {
+                /* Frame arrived, no free RX buffers available. 
+                 * NOTE: we can get this on a link transition.
+                 */
+                cas_post_rxds_ringN(cp, 0, 0);
+                spin_lock(&cp->stat_lock[0]);
+                cp->net_stats[0].rx_dropped++;
+                spin_unlock(&cp->stat_lock[0]);
+        } else if (status & INTR_RX_BUF_AE) {
+                cas_post_rxds_ringN(cp, 0, RX_DESC_RINGN_SIZE(0) -
+                                    RX_AE_FREEN_VAL(0));
+        }
+
+        if (status & (INTR_RX_COMP_AF | INTR_RX_COMP_FULL))
+                cas_post_rxcs_ringN(dev, cp, 0);
+}
+
+static irqreturn_t cas_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct net_device *dev = dev_id;
+        struct cas *cp = netdev_priv(dev);
+        unsigned long flags;
+        u32 status = readl(cp->regs + REG_INTR_STATUS);
+
+        if (status == 0)
+                return IRQ_NONE;
+
+        spin_lock_irqsave(&cp->lock, flags);
+        if (status & (INTR_TX_ALL | INTR_TX_INTME)) {
+                cas_tx(dev, cp, status);
+                status &= ~(INTR_TX_ALL | INTR_TX_INTME);
+        }
+
+        if (status & INTR_RX_DONE) {
+#ifdef USE_NAPI
+                cas_mask_intr(cp);
+                netif_rx_schedule(dev);
+#else
+                cas_rx_ringN(cp, 0, 0);
+#endif
+                status &= ~INTR_RX_DONE;
+        }
+
+        if (status)
+                cas_handle_irq(dev, cp, status);
+        spin_unlock_irqrestore(&cp->lock, flags);
+        return IRQ_HANDLED;
+}
+
+
+#ifdef USE_NAPI
+static int cas_poll(struct net_device *dev, int *budget)
+{
+        struct cas *cp = netdev_priv(dev);
+        int i, enable_intr, todo, credits;
+        u32 status = readl(cp->regs + REG_INTR_STATUS);
+        unsigned long flags;
+
+        spin_lock_irqsave(&cp->lock, flags);
+        cas_tx(dev, cp, status);
+        spin_unlock_irqrestore(&cp->lock, flags);
+
+        /* NAPI rx packets. we spread the credits across all of the
+         * rxc rings
+         */
+        todo = min(*budget, dev->quota);
+
+        /* to make sure we're fair with the work we loop through each
+         * ring N_RX_COMP_RING times with a request of 
+         * todo / N_RX_COMP_RINGS
+         */
+        enable_intr = 1;
+        credits = 0;
+        for (i = 0; i < N_RX_COMP_RINGS; i++) {
+                int j;
+                for (j = 0; j < N_RX_COMP_RINGS; j++) {
+                        credits += cas_rx_ringN(cp, j, todo / N_RX_COMP_RINGS);
+                        if (credits >= todo) {
+                                enable_intr = 0;
+                                goto rx_comp;
+                        }
+                }
+        }
+
+rx_comp:
+        *budget    -= credits;
+        dev->quota -= credits;
+
+        /* final rx completion */
+        spin_lock_irqsave(&cp->lock, flags);
+        if (status)
+                cas_handle_irq(dev, cp, status);
+
+#ifdef USE_PCI_INTB
+        if (N_RX_COMP_RINGS > 1) {
+                status = readl(cp->regs + REG_PLUS_INTRN_STATUS(1));
+                if (status)
+                        cas_handle_irq1(dev, cp, status);
+        }
+#endif
+
+#ifdef USE_PCI_INTC
+        if (N_RX_COMP_RINGS > 2) {
+                status = readl(cp->regs + REG_PLUS_INTRN_STATUS(2));
+                if (status)
+                        cas_handle_irqN(dev, cp, status, 2);
+        }
+#endif
+
+#ifdef USE_PCI_INTD
+        if (N_RX_COMP_RINGS > 3) {
+                status = readl(cp->regs + REG_PLUS_INTRN_STATUS(3));
+                if (status)
+                        cas_handle_irqN(dev, cp, status, 3);
+        }
+#endif
+        spin_unlock_irqrestore(&cp->lock, flags);
+        if (enable_intr) {
+                netif_rx_complete(dev);
+                cas_unmask_intr(cp);
+                return 0;
+        }
+        return 1;
+}
+#endif
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void cas_netpoll(struct net_device *dev)
+{
+        struct cas *cp = netdev_priv(dev);
+
+        cas_disable_irq(cp, 0);
+        cas_interrupt(cp->pdev->irq, dev, NULL);
+        cas_enable_irq(cp, 0);
+
+#ifdef USE_PCI_INTB
+        if (N_RX_COMP_RINGS > 1) {
+                /* cas_interrupt1(); */
+        }
+#endif
+#ifdef USE_PCI_INTC
+        if (N_RX_COMP_RINGS > 2) {
+                /* cas_interruptN(); */
+        }
+#endif
+#ifdef USE_PCI_INTD
+        if (N_RX_COMP_RINGS > 3) {
+                /* cas_interruptN(); */
+        }
+#endif
+}
+#endif
+
+static void cas_tx_timeout(struct net_device *dev)
+{
+        struct cas *cp = netdev_priv(dev);
+
+        printk(KERN_ERR "%s: transmit timed out, resetting\n", dev->name);
+        if (!cp->hw_running) {
+                printk("%s: hrm.. hw not running!\n", dev->name);
+                return;
+        }
+
+        printk(KERN_ERR "%s: MIF_STATE[%08x]\n",
+               dev->name, readl(cp->regs + REG_MIF_STATE_MACHINE));
+
+        printk(KERN_ERR "%s: MAC_STATE[%08x]\n",
+               dev->name, readl(cp->regs + REG_MAC_STATE_MACHINE));
+
+        printk(KERN_ERR "%s: TX_STATE[%08x:%08x:%08x] "
+               "FIFO[%08x:%08x:%08x] SM1[%08x] SM2[%08x]\n",
+               dev->name,
+               readl(cp->regs + REG_TX_CFG),
+               readl(cp->regs + REG_MAC_TX_STATUS),
+               readl(cp->regs + REG_MAC_TX_CFG),
+               readl(cp->regs + REG_TX_FIFO_PKT_CNT),
+               readl(cp->regs + REG_TX_FIFO_WRITE_PTR),
+               readl(cp->regs + REG_TX_FIFO_READ_PTR),
+               readl(cp->regs + REG_TX_SM_1),
+               readl(cp->regs + REG_TX_SM_2));
+
+        printk(KERN_ERR "%s: RX_STATE[%08x:%08x:%08x]\n",
+               dev->name,
+               readl(cp->regs + REG_RX_CFG),
+               readl(cp->regs + REG_MAC_RX_STATUS),
+               readl(cp->regs + REG_MAC_RX_CFG));
+
+        printk(KERN_ERR "%s: HP_STATE[%08x:%08x:%08x:%08x]\n",
+               dev->name,
+               readl(cp->regs + REG_HP_STATE_MACHINE),
+               readl(cp->regs + REG_HP_STATUS0),
+               readl(cp->regs + REG_HP_STATUS1),
+               readl(cp->regs + REG_HP_STATUS2));
+
+#if 1
+        atomic_inc(&cp->reset_task_pending);
+        atomic_inc(&cp->reset_task_pending_all);
+        schedule_work(&cp->reset_task);
+#else
+        atomic_set(&cp->reset_task_pending, CAS_RESET_ALL);
+        schedule_work(&cp->reset_task);
+#endif
+}
+
+static inline int cas_intme(int ring, int entry)
+{
+        /* Algorithm: IRQ every 1/2 of descriptors. */
+        if (!(entry & ((TX_DESC_RINGN_SIZE(ring) >> 1) - 1)))
+                return 1;
+        return 0;
+}
+
+
+static void cas_write_txd(struct cas *cp, int ring, int entry,
+                          dma_addr_t mapping, int len, u64 ctrl, int last)
+{
+        struct cas_tx_desc *txd = cp->init_txds[ring] + entry;
+
+        ctrl |= CAS_BASE(TX_DESC_BUFLEN, len);
+        if (cas_intme(ring, entry))
+                ctrl |= TX_DESC_INTME;
+        if (last)
+                ctrl |= TX_DESC_EOF;
+        txd->control = cpu_to_le64(ctrl);
+        txd->buffer = cpu_to_le64(mapping);
+}
+
+static inline void *tx_tiny_buf(struct cas *cp, const int ring, 
+                                const int entry)
+{
+        return cp->tx_tiny_bufs[ring] + TX_TINY_BUF_LEN*entry;
+}
+
+static inline dma_addr_t tx_tiny_map(struct cas *cp, const int ring, 
+                                     const int entry, const int tentry)
+{
+        cp->tx_tiny_use[ring][tentry].nbufs++;
+        cp->tx_tiny_use[ring][entry].used = 1;
+        return cp->tx_tiny_dvma[ring] + TX_TINY_BUF_LEN*entry;
+}
+
+static inline int cas_xmit_tx_ringN(struct cas *cp, int ring, 
+                                    struct sk_buff *skb)
+{
+        struct net_device *dev = cp->dev;
+        int entry, nr_frags, frag, tabort, tentry;
+        dma_addr_t mapping;
+        unsigned long flags;
+        u64 ctrl;
+        u32 len;
+
+        spin_lock_irqsave(&cp->tx_lock[ring], flags);
+
+        /* This is a hard error, log it. */
+        if (TX_BUFFS_AVAIL(cp, ring) <= 
+            CAS_TABORT(cp)*(skb_shinfo(skb)->nr_frags + 1)) {
+                netif_stop_queue(dev);
+                spin_unlock_irqrestore(&cp->tx_lock[ring], flags);
+                printk(KERN_ERR PFX "%s: BUG! Tx Ring full when "
+                       "queue awake!\n", dev->name);
+                return 1;
+        }
+
+        ctrl = 0;
+        if (skb->ip_summed == CHECKSUM_HW) {
+                u64 csum_start_off, csum_stuff_off;
+
+                csum_start_off = (u64) (skb->h.raw - skb->data);
+                csum_stuff_off = (u64) ((skb->h.raw + skb->csum) - skb->data);
+
+                ctrl =  TX_DESC_CSUM_EN | 
+                        CAS_BASE(TX_DESC_CSUM_START, csum_start_off) |
+                        CAS_BASE(TX_DESC_CSUM_STUFF, csum_stuff_off);
+        }
+
+        entry = cp->tx_new[ring];
+        cp->tx_skbs[ring][entry] = skb;
+
+        nr_frags = skb_shinfo(skb)->nr_frags;
+        len = skb_headlen(skb);
+        mapping = pci_map_page(cp->pdev, virt_to_page(skb->data),
+                               offset_in_page(skb->data), len,
+                               PCI_DMA_TODEVICE);
+
+        tentry = entry;
+        tabort = cas_calc_tabort(cp, (unsigned long) skb->data, len);
+        if (unlikely(tabort)) {
+                /* NOTE: len is always >  tabort */
+                cas_write_txd(cp, ring, entry, mapping, len - tabort, 
+                              ctrl | TX_DESC_SOF, 0);
+                entry = TX_DESC_NEXT(ring, entry);
+
+                memcpy(tx_tiny_buf(cp, ring, entry), skb->data + 
+                       len - tabort, tabort);
+                mapping = tx_tiny_map(cp, ring, entry, tentry);
+                cas_write_txd(cp, ring, entry, mapping, tabort, ctrl,
+                              (nr_frags == 0));
+        } else {
+                cas_write_txd(cp, ring, entry, mapping, len, ctrl | 
+                              TX_DESC_SOF, (nr_frags == 0));
+        }
+        entry = TX_DESC_NEXT(ring, entry);
+
+        for (frag = 0; frag < nr_frags; frag++) {
+                skb_frag_t *fragp = &skb_shinfo(skb)->frags[frag];
+
+                len = fragp->size;
+                mapping = pci_map_page(cp->pdev, fragp->page,
+                                       fragp->page_offset, len,
+                                       PCI_DMA_TODEVICE);
+
+                tabort = cas_calc_tabort(cp, fragp->page_offset, len);
+                if (unlikely(tabort)) {
+                        void *addr;
+
+                        /* NOTE: len is always > tabort */
+                        cas_write_txd(cp, ring, entry, mapping, len - tabort,
+                                      ctrl, 0);
+                        entry = TX_DESC_NEXT(ring, entry);
+                        
+                        addr = cas_page_map(fragp->page);
+                        memcpy(tx_tiny_buf(cp, ring, entry),
+                               addr + fragp->page_offset + len - tabort, 
+                               tabort);
+                        cas_page_unmap(addr);
+                        mapping = tx_tiny_map(cp, ring, entry, tentry);
+                        len     = tabort;
+                }
+
+                cas_write_txd(cp, ring, entry, mapping, len, ctrl,
+                              (frag + 1 == nr_frags));
+                entry = TX_DESC_NEXT(ring, entry);
+        }
+
+        cp->tx_new[ring] = entry;
+        if (TX_BUFFS_AVAIL(cp, ring) <= CAS_TABORT(cp)*(MAX_SKB_FRAGS + 1))
+                netif_stop_queue(dev);
+
+        if (netif_msg_tx_queued(cp))
+                printk(KERN_DEBUG "%s: tx[%d] queued, slot %d, skblen %d, "
+                       "avail %d\n",
+                       dev->name, ring, entry, skb->len, 
+                       TX_BUFFS_AVAIL(cp, ring));
+        writel(entry, cp->regs + REG_TX_KICKN(ring));
+        spin_unlock_irqrestore(&cp->tx_lock[ring], flags);
+        return 0;
+} 
+
+static int cas_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct cas *cp = netdev_priv(dev);
+
+        /* this is only used as a load-balancing hint, so it doesn't
+         * need to be SMP safe
+         */
+        static int ring; 
+
+        skb = skb_padto(skb, cp->min_frame_size);
+        if (!skb)
+                return 0;
+
+        /* XXX: we need some higher-level QoS hooks to steer packets to
+         *      individual queues.
+         */
+        if (cas_xmit_tx_ringN(cp, ring++ & N_TX_RINGS_MASK, skb))
+                return 1;
+        dev->trans_start = jiffies;
+        return 0;
+}
+
+static void cas_init_tx_dma(struct cas *cp)
+{
+        u64 desc_dma = cp->block_dvma;
+        unsigned long off;
+        u32 val;
+        int i;
+
+        /* set up tx completion writeback registers. must be 8-byte aligned */
+#ifdef USE_TX_COMPWB
+        off = offsetof(struct cas_init_block, tx_compwb);
+        writel((desc_dma + off) >> 32, cp->regs + REG_TX_COMPWB_DB_HI);
+        writel((desc_dma + off) & 0xffffffff, cp->regs + REG_TX_COMPWB_DB_LOW);
+#endif
+
+        /* enable completion writebacks, enable paced mode,
+         * disable read pipe, and disable pre-interrupt compwbs
+         */
+        val =   TX_CFG_COMPWB_Q1 | TX_CFG_COMPWB_Q2 | 
+                TX_CFG_COMPWB_Q3 | TX_CFG_COMPWB_Q4 |
+                TX_CFG_DMA_RDPIPE_DIS | TX_CFG_PACED_MODE | 
+                TX_CFG_INTR_COMPWB_DIS;
+
+        /* write out tx ring info and tx desc bases */
+        for (i = 0; i < MAX_TX_RINGS; i++) {
+                off = (unsigned long) cp->init_txds[i] - 
+                        (unsigned long) cp->init_block;
+
+                val |= CAS_TX_RINGN_BASE(i);
+                writel((desc_dma + off) >> 32, cp->regs + REG_TX_DBN_HI(i));
+                writel((desc_dma + off) & 0xffffffff, cp->regs +
+                       REG_TX_DBN_LOW(i));
+                /* don't zero out the kick register here as the system
+                 * will wedge
+                 */
+        }
+        writel(val, cp->regs + REG_TX_CFG);
+
+        /* program max burst sizes. these numbers should be different
+         * if doing QoS.
+         */
+#ifdef USE_QOS
+        writel(0x800, cp->regs + REG_TX_MAXBURST_0);
+        writel(0x1600, cp->regs + REG_TX_MAXBURST_1);
+        writel(0x2400, cp->regs + REG_TX_MAXBURST_2);
+        writel(0x4800, cp->regs + REG_TX_MAXBURST_3);
+#else
+        writel(0x800, cp->regs + REG_TX_MAXBURST_0);
+        writel(0x800, cp->regs + REG_TX_MAXBURST_1);
+        writel(0x800, cp->regs + REG_TX_MAXBURST_2);
+        writel(0x800, cp->regs + REG_TX_MAXBURST_3);
+#endif
+}
+
+/* Must be invoked under cp->lock. */
+static inline void cas_init_dma(struct cas *cp)
+{
+        cas_init_tx_dma(cp);
+        cas_init_rx_dma(cp);
+}
+
+/* Must be invoked under cp->lock. */
+static u32 cas_setup_multicast(struct cas *cp)
+{
+        u32 rxcfg = 0;
+        int i;
+        
+        if (cp->dev->flags & IFF_PROMISC) {
+                rxcfg |= MAC_RX_CFG_PROMISC_EN;
+
+        } else if (cp->dev->flags & IFF_ALLMULTI) {
+                for (i=0; i < 16; i++)
+                        writel(0xFFFF, cp->regs + REG_MAC_HASH_TABLEN(i));
+                rxcfg |= MAC_RX_CFG_HASH_FILTER_EN;
+
+        } else {
+                u16 hash_table[16];
+                u32 crc;
+                struct dev_mc_list *dmi = cp->dev->mc_list;
+                int i;
+
+                /* use the alternate mac address registers for the
+                 * first 15 multicast addresses
+                 */
+                for (i = 1; i <= CAS_MC_EXACT_MATCH_SIZE; i++) {
+                        if (!dmi) {
+                                writel(0x0, cp->regs + REG_MAC_ADDRN(i*3 + 0));
+                                writel(0x0, cp->regs + REG_MAC_ADDRN(i*3 + 1));
+                                writel(0x0, cp->regs + REG_MAC_ADDRN(i*3 + 2));
+                                continue;
+                        }
+                        writel((dmi->dmi_addr[4] << 8) | dmi->dmi_addr[5], 
+                               cp->regs + REG_MAC_ADDRN(i*3 + 0));
+                        writel((dmi->dmi_addr[2] << 8) | dmi->dmi_addr[3], 
+                               cp->regs + REG_MAC_ADDRN(i*3 + 1));
+                        writel((dmi->dmi_addr[0] << 8) | dmi->dmi_addr[1], 
+                               cp->regs + REG_MAC_ADDRN(i*3 + 2));
+                        dmi = dmi->next;
+                }
+
+                /* use hw hash table for the next series of 
+                 * multicast addresses
+                 */
+                memset(hash_table, 0, sizeof(hash_table));
+                while (dmi) {
+                        crc = ether_crc_le(ETH_ALEN, dmi->dmi_addr);
+                        crc >>= 24;
+                        hash_table[crc >> 4] |= 1 << (15 - (crc & 0xf));
+                        dmi = dmi->next;
+                }
+                for (i=0; i < 16; i++)
+                        writel(hash_table[i], cp->regs + 
+                               REG_MAC_HASH_TABLEN(i));
+                rxcfg |= MAC_RX_CFG_HASH_FILTER_EN;
+        }
+
+        return rxcfg;
+}
+
+/* must be invoked under cp->stat_lock[N_TX_RINGS] */
+static void cas_clear_mac_err(struct cas *cp)
+{
+        writel(0, cp->regs + REG_MAC_COLL_NORMAL);
+        writel(0, cp->regs + REG_MAC_COLL_FIRST);
+        writel(0, cp->regs + REG_MAC_COLL_EXCESS);
+        writel(0, cp->regs + REG_MAC_COLL_LATE);
+        writel(0, cp->regs + REG_MAC_TIMER_DEFER);
+        writel(0, cp->regs + REG_MAC_ATTEMPTS_PEAK);
+        writel(0, cp->regs + REG_MAC_RECV_FRAME);
+        writel(0, cp->regs + REG_MAC_LEN_ERR);
+        writel(0, cp->regs + REG_MAC_ALIGN_ERR);
+        writel(0, cp->regs + REG_MAC_FCS_ERR);
+        writel(0, cp->regs + REG_MAC_RX_CODE_ERR);
+}
+
+
+static void cas_mac_reset(struct cas *cp)
+{
+        int i;
+
+        /* do both TX and RX reset */
+        writel(0x1, cp->regs + REG_MAC_TX_RESET);
+        writel(0x1, cp->regs + REG_MAC_RX_RESET);
+
+        /* wait for TX */
+        i = STOP_TRIES;
+        while (i-- > 0) {
+                if (readl(cp->regs + REG_MAC_TX_RESET) == 0)
+                        break;
+                udelay(10);
+        }
+
+        /* wait for RX */
+        i = STOP_TRIES;
+        while (i-- > 0) {
+                if (readl(cp->regs + REG_MAC_RX_RESET) == 0)
+                        break;
+                udelay(10);
+        }
+
+        if (readl(cp->regs + REG_MAC_TX_RESET) |
+            readl(cp->regs + REG_MAC_RX_RESET))
+                printk(KERN_ERR "%s: mac tx[%d]/rx[%d] reset failed [%08x]\n",
+                       cp->dev->name, readl(cp->regs + REG_MAC_TX_RESET),
+                       readl(cp->regs + REG_MAC_RX_RESET),
+                       readl(cp->regs + REG_MAC_STATE_MACHINE));
+}
+
+
+/* Must be invoked under cp->lock. */
+static void cas_init_mac(struct cas *cp)
+{
+        unsigned char *e = &cp->dev->dev_addr[0];
+        int i;
+#ifdef CONFIG_CASSINI_MULTICAST_REG_WRITE
+        u32 rxcfg;
+#endif
+        cas_mac_reset(cp);
+
+        /* setup core arbitration weight register */
+        writel(CAWR_RR_DIS, cp->regs + REG_CAWR);
+
+        /* XXX Use pci_dma_burst_advice() */
+#if !defined(CONFIG_SPARC64) && !defined(CONFIG_ALPHA)
+        /* set the infinite burst register for chips that don't have
+         * pci issues.
+         */
+        if ((cp->cas_flags & CAS_FLAG_TARGET_ABORT) == 0)
+                writel(INF_BURST_EN, cp->regs + REG_INF_BURST);
+#endif
+
+        writel(0x1BF0, cp->regs + REG_MAC_SEND_PAUSE);
+
+        writel(0x00, cp->regs + REG_MAC_IPG0);
+        writel(0x08, cp->regs + REG_MAC_IPG1);
+        writel(0x04, cp->regs + REG_MAC_IPG2);
+        
+        /* change later for 802.3z */
+        writel(0x40, cp->regs + REG_MAC_SLOT_TIME); 
+
+        /* min frame + FCS */
+        writel(ETH_ZLEN + 4, cp->regs + REG_MAC_FRAMESIZE_MIN);
+
+        /* Ethernet payload + header + FCS + optional VLAN tag. NOTE: we
+         * specify the maximum frame size to prevent RX tag errors on 
+         * oversized frames.
+         */
+        writel(CAS_BASE(MAC_FRAMESIZE_MAX_BURST, 0x2000) |
+               CAS_BASE(MAC_FRAMESIZE_MAX_FRAME, 
+                        (CAS_MAX_MTU + ETH_HLEN + 4 + 4)), 
+               cp->regs + REG_MAC_FRAMESIZE_MAX);
+
+        /* NOTE: crc_size is used as a surrogate for half-duplex. 
+         * workaround saturn half-duplex issue by increasing preamble
+         * size to 65 bytes.
+         */
+        if ((cp->cas_flags & CAS_FLAG_SATURN) && cp->crc_size)
+                writel(0x41, cp->regs + REG_MAC_PA_SIZE);
+        else
+                writel(0x07, cp->regs + REG_MAC_PA_SIZE);
+        writel(0x04, cp->regs + REG_MAC_JAM_SIZE);
+        writel(0x10, cp->regs + REG_MAC_ATTEMPT_LIMIT);
+        writel(0x8808, cp->regs + REG_MAC_CTRL_TYPE);
+
+        writel((e[5] | (e[4] << 8)) & 0x3ff, cp->regs + REG_MAC_RANDOM_SEED);
+
+        writel(0, cp->regs + REG_MAC_ADDR_FILTER0);
+        writel(0, cp->regs + REG_MAC_ADDR_FILTER1);
+        writel(0, cp->regs + REG_MAC_ADDR_FILTER2);
+        writel(0, cp->regs + REG_MAC_ADDR_FILTER2_1_MASK);
+        writel(0, cp->regs + REG_MAC_ADDR_FILTER0_MASK);
+
+        /* setup mac address in perfect filter array */
+        for (i = 0; i < 45; i++)
+                writel(0x0, cp->regs + REG_MAC_ADDRN(i));
+
+        writel((e[4] << 8) | e[5], cp->regs + REG_MAC_ADDRN(0));
+        writel((e[2] << 8) | e[3], cp->regs + REG_MAC_ADDRN(1));
+        writel((e[0] << 8) | e[1], cp->regs + REG_MAC_ADDRN(2));
+
+        writel(0x0001, cp->regs + REG_MAC_ADDRN(42));
+        writel(0xc200, cp->regs + REG_MAC_ADDRN(43));
+        writel(0x0180, cp->regs + REG_MAC_ADDRN(44));
+
+#ifndef CONFIG_CASSINI_MULTICAST_REG_WRITE
+        cp->mac_rx_cfg = cas_setup_multicast(cp);
+#else
+        /* WTZ: Do what Adrian did in cas_set_multicast. Doing
+         * a writel does not seem to be necessary because Cassini
+         * seems to preserve the configuration when we do the reset.
+         * If the chip is in trouble, though, it is not clear if we
+         * can really count on this behavior. cas_set_multicast uses
+         * spin_lock_irqsave, but we are called only in cas_init_hw and
+         * cas_init_hw is protected by cas_lock_all, which calls
+         * spin_lock_irq (so it doesn't need to save the flags, and
+         * we should be OK for the writel, as that is the only 
+         * difference).
+         */
+        cp->mac_rx_cfg = rxcfg = cas_setup_multicast(cp);
+        writel(rxcfg, cp->regs + REG_MAC_RX_CFG);
+#endif
+        spin_lock(&cp->stat_lock[N_TX_RINGS]);
+        cas_clear_mac_err(cp);
+        spin_unlock(&cp->stat_lock[N_TX_RINGS]);
+
+        /* Setup MAC interrupts.  We want to get all of the interesting
+         * counter expiration events, but we do not want to hear about
+         * normal rx/tx as the DMA engine tells us that.
+         */
+        writel(MAC_TX_FRAME_XMIT, cp->regs + REG_MAC_TX_MASK);
+        writel(MAC_RX_FRAME_RECV, cp->regs + REG_MAC_RX_MASK);
+
+        /* Don't enable even the PAUSE interrupts for now, we
+         * make no use of those events other than to record them.
+         */
+        writel(0xffffffff, cp->regs + REG_MAC_CTRL_MASK);
+}
+
+/* Must be invoked under cp->lock. */
+static void cas_init_pause_thresholds(struct cas *cp)
+{
+        /* Calculate pause thresholds.  Setting the OFF threshold to the
+         * full RX fifo size effectively disables PAUSE generation
+         */
+        if (cp->rx_fifo_size <= (2 * 1024)) {
+                cp->rx_pause_off = cp->rx_pause_on = cp->rx_fifo_size;
+        } else {
+                int max_frame = (cp->dev->mtu + ETH_HLEN + 4 + 4 + 64) & ~63;
+                if (max_frame * 3 > cp->rx_fifo_size) {
+                        cp->rx_pause_off = 7104;
+                        cp->rx_pause_on  = 960;
+                } else {
+                        int off = (cp->rx_fifo_size - (max_frame * 2));
+                        int on = off - max_frame;
+                        cp->rx_pause_off = off;
+                        cp->rx_pause_on = on;
+                }
+        }
+}
+
+static int cas_vpd_match(const void __iomem *p, const char *str)
+{
+        int len = strlen(str) + 1;
+        int i;
+        
+        for (i = 0; i < len; i++) {
+                if (readb(p + i) != str[i])
+                        return 0;
+        }
+        return 1;
+}
+
+
+/* get the mac address by reading the vpd information in the rom.
+ * also get the phy type and determine if there's an entropy generator.
+ * NOTE: this is a bit convoluted for the following reasons:
+ *  1) vpd info has order-dependent mac addresses for multinic cards
+ *  2) the only way to determine the nic order is to use the slot
+ *     number.
+ *  3) fiber cards don't have bridges, so their slot numbers don't
+ *     mean anything.
+ *  4) we don't actually know we have a fiber card until after 
+ *     the mac addresses are parsed.
+ */
+static int cas_get_vpd_info(struct cas *cp, unsigned char *dev_addr,
+                            const int offset)
+{
+        void __iomem *p = cp->regs + REG_EXPANSION_ROM_RUN_START;
+        void __iomem *base, *kstart;
+        int i, len;
+        int found = 0;
+#define VPD_FOUND_MAC        0x01
+#define VPD_FOUND_PHY        0x02
+
+        int phy_type = CAS_PHY_MII_MDIO0; /* default phy type */
+        int mac_off  = 0;
+
+        /* give us access to the PROM */
+        writel(BIM_LOCAL_DEV_PROM | BIM_LOCAL_DEV_PAD,
+               cp->regs + REG_BIM_LOCAL_DEV_EN);
+
+        /* check for an expansion rom */
+        if (readb(p) != 0x55 || readb(p + 1) != 0xaa)
+                goto use_random_mac_addr;
+
+        /* search for beginning of vpd */
+        base = NULL;
+        for (i = 2; i < EXPANSION_ROM_SIZE; i++) {
+                /* check for PCIR */
+                if ((readb(p + i + 0) == 0x50) &&
+                    (readb(p + i + 1) == 0x43) &&
+                    (readb(p + i + 2) == 0x49) &&
+                    (readb(p + i + 3) == 0x52)) {
+                        base = p + (readb(p + i + 8) | 
+                                    (readb(p + i + 9) << 8));
+                        break;
+                }               
+        }
+
+        if (!base || (readb(base) != 0x82))
+                goto use_random_mac_addr;
+        
+        i = (readb(base + 1) | (readb(base + 2) << 8)) + 3;
+        while (i < EXPANSION_ROM_SIZE) {
+                if (readb(base + i) != 0x90) /* no vpd found */
+                        goto use_random_mac_addr;
+
+                /* found a vpd field */
+                len = readb(base + i + 1) | (readb(base + i + 2) << 8);
+
+                /* extract keywords */
+                kstart = base + i + 3;
+                p = kstart;
+                while ((p - kstart) < len) {
+                        int klen = readb(p + 2);
+                        int j;
+                        char type;
+
+                        p += 3;
+                        
+                        /* look for the following things:
+                         * -- correct length == 29
+                         * 3 (type) + 2 (size) + 
+                         * 18 (strlen("local-mac-address") + 1) + 
+                         * 6 (mac addr) 
+                         * -- VPD Instance 'I'
+                         * -- VPD Type Bytes 'B'
+                         * -- VPD data length == 6
+                         * -- property string == local-mac-address
+                         * 
+                         * -- correct length == 24
+                         * 3 (type) + 2 (size) + 
+                         * 12 (strlen("entropy-dev") + 1) + 
+                         * 7 (strlen("vms110") + 1)
+                         * -- VPD Instance 'I'
+                         * -- VPD Type String 'B'
+                         * -- VPD data length == 7
+                         * -- property string == entropy-dev
+                         *
+                         * -- correct length == 18
+                         * 3 (type) + 2 (size) + 
+                         * 9 (strlen("phy-type") + 1) + 
+                         * 4 (strlen("pcs") + 1)
+                         * -- VPD Instance 'I'
+                         * -- VPD Type String 'S'
+                         * -- VPD data length == 4
+                         * -- property string == phy-type
+                         * 
+                         * -- correct length == 23
+                         * 3 (type) + 2 (size) + 
+                         * 14 (strlen("phy-interface") + 1) + 
+                         * 4 (strlen("pcs") + 1)
+                         * -- VPD Instance 'I'
+                         * -- VPD Type String 'S'
+                         * -- VPD data length == 4
+                         * -- property string == phy-interface
+                         */
+                        if (readb(p) != 'I')
+                                goto next;
+
+                        /* finally, check string and length */
+                        type = readb(p + 3);
+                        if (type == 'B') {
+                                if ((klen == 29) && readb(p + 4) == 6 &&
+                                    cas_vpd_match(p + 5, 
+                                                  "local-mac-address")) {
+                                        if (mac_off++ > offset) 
+                                                goto next;
+
+                                        /* set mac address */
+                                        for (j = 0; j < 6; j++) 
+                                                dev_addr[j] = 
+                                                        readb(p + 23 + j);
+                                        goto found_mac;
+                                }
+                        }
+
+                        if (type != 'S')
+                                goto next;
+
+#ifdef USE_ENTROPY_DEV
+                        if ((klen == 24) && 
+                            cas_vpd_match(p + 5, "entropy-dev") &&
+                            cas_vpd_match(p + 17, "vms110")) {
+                                cp->cas_flags |= CAS_FLAG_ENTROPY_DEV;
+                                goto next;
+                        }
+#endif
+
+                        if (found & VPD_FOUND_PHY)
+                                goto next;
+
+                        if ((klen == 18) && readb(p + 4) == 4 &&
+                            cas_vpd_match(p + 5, "phy-type")) {
+                                if (cas_vpd_match(p + 14, "pcs")) {
+                                        phy_type = CAS_PHY_SERDES;
+                                        goto found_phy;
+                                }
+                        }
+                        
+                        if ((klen == 23) && readb(p + 4) == 4 &&
+                            cas_vpd_match(p + 5, "phy-interface")) {
+                                if (cas_vpd_match(p + 19, "pcs")) {
+                                        phy_type = CAS_PHY_SERDES;
+                                        goto found_phy;
+                                }
+                        }
+found_mac:
+                        found |= VPD_FOUND_MAC;
+                        goto next;
+
+found_phy:
+                        found |= VPD_FOUND_PHY;
+
+next:
+                        p += klen;
+                }
+                i += len + 3;
+        }
+
+use_random_mac_addr:
+        if (found & VPD_FOUND_MAC)
+                goto done;
+
+        /* Sun MAC prefix then 3 random bytes. */
+        printk(PFX "MAC address not found in ROM VPD\n");
+        dev_addr[0] = 0x08;
+        dev_addr[1] = 0x00;
+        dev_addr[2] = 0x20;
+        get_random_bytes(dev_addr + 3, 3);
+
+done:
+        writel(0, cp->regs + REG_BIM_LOCAL_DEV_EN);
+        return phy_type;
+}
+
+/* check pci invariants */
+static void cas_check_pci_invariants(struct cas *cp)
+{
+        struct pci_dev *pdev = cp->pdev;
+        u8 rev;
+
+        cp->cas_flags = 0;
+        pci_read_config_byte(pdev, PCI_REVISION_ID, &rev);
+        if ((pdev->vendor == PCI_VENDOR_ID_SUN) &&
+            (pdev->device == PCI_DEVICE_ID_SUN_CASSINI)) {
+                if (rev >= CAS_ID_REVPLUS)
+                        cp->cas_flags |= CAS_FLAG_REG_PLUS;
+                if (rev < CAS_ID_REVPLUS02u)
+                        cp->cas_flags |= CAS_FLAG_TARGET_ABORT;
+
+                /* Original Cassini supports HW CSUM, but it's not
+                 * enabled by default as it can trigger TX hangs.
+                 */
+                if (rev < CAS_ID_REV2)
+                        cp->cas_flags |= CAS_FLAG_NO_HW_CSUM;
+        } else {
+                /* Only sun has original cassini chips.  */
+                cp->cas_flags |= CAS_FLAG_REG_PLUS;
+
+                /* We use a flag because the same phy might be externally
+                 * connected.
+                 */
+                if ((pdev->vendor == PCI_VENDOR_ID_NS) &&
+                    (pdev->device == PCI_DEVICE_ID_NS_SATURN))
+                        cp->cas_flags |= CAS_FLAG_SATURN;
+        }
+}
+
+
+static int cas_check_invariants(struct cas *cp)
+{
+        struct pci_dev *pdev = cp->pdev;
+        u32 cfg;
+        int i;
+
+        /* get page size for rx buffers. */
+        cp->page_order = 0; 
+#ifdef USE_PAGE_ORDER
+        if (PAGE_SHIFT < CAS_JUMBO_PAGE_SHIFT) {
+                /* see if we can allocate larger pages */
+                struct page *page = alloc_pages(GFP_ATOMIC, 
+                                                CAS_JUMBO_PAGE_SHIFT - 
+                                                PAGE_SHIFT);
+                if (page) {
+                        __free_pages(page, CAS_JUMBO_PAGE_SHIFT - PAGE_SHIFT);
+                        cp->page_order = CAS_JUMBO_PAGE_SHIFT - PAGE_SHIFT;
+                } else {
+                        printk(PFX "MTU limited to %d bytes\n", CAS_MAX_MTU);
+                }
+        }
+#endif
+        cp->page_size = (PAGE_SIZE << cp->page_order);
+
+        /* Fetch the FIFO configurations. */
+        cp->tx_fifo_size = readl(cp->regs + REG_TX_FIFO_SIZE) * 64;
+        cp->rx_fifo_size = RX_FIFO_SIZE;
+
+        /* finish phy determination. MDIO1 takes precedence over MDIO0 if 
+         * they're both connected.
+         */
+        cp->phy_type = cas_get_vpd_info(cp, cp->dev->dev_addr, 
+                                        PCI_SLOT(pdev->devfn));
+        if (cp->phy_type & CAS_PHY_SERDES) {
+                cp->cas_flags |= CAS_FLAG_1000MB_CAP;
+                return 0; /* no more checking needed */
+        } 
+
+        /* MII */
+        cfg = readl(cp->regs + REG_MIF_CFG);
+        if (cfg & MIF_CFG_MDIO_1) {
+                cp->phy_type = CAS_PHY_MII_MDIO1;
+        } else if (cfg & MIF_CFG_MDIO_0) {
+                cp->phy_type = CAS_PHY_MII_MDIO0;
+        }
+
+        cas_mif_poll(cp, 0);
+        writel(PCS_DATAPATH_MODE_MII, cp->regs + REG_PCS_DATAPATH_MODE);
+
+        for (i = 0; i < 32; i++) {
+                u32 phy_id;
+                int j;
+
+                for (j = 0; j < 3; j++) {
+                        cp->phy_addr = i;
+                        phy_id = cas_phy_read(cp, MII_PHYSID1) << 16;
+                        phy_id |= cas_phy_read(cp, MII_PHYSID2);
+                        if (phy_id && (phy_id != 0xFFFFFFFF)) {
+                                cp->phy_id = phy_id;
+                                goto done;
+                        }
+                }
+        }
+        printk(KERN_ERR PFX "MII phy did not respond [%08x]\n",
+               readl(cp->regs + REG_MIF_STATE_MACHINE));
+        return -1;
+
+done:
+        /* see if we can do gigabit */
+        cfg = cas_phy_read(cp, MII_BMSR);
+        if ((cfg & CAS_BMSR_1000_EXTEND) && 
+            cas_phy_read(cp, CAS_MII_1000_EXTEND))
+                cp->cas_flags |= CAS_FLAG_1000MB_CAP;
+        return 0;
+}
+
+/* Must be invoked under cp->lock. */
+static inline void cas_start_dma(struct cas *cp)
+{
+        int i;
+        u32 val;
+        int txfailed = 0;
+        
+        /* enable dma */
+        val = readl(cp->regs + REG_TX_CFG) | TX_CFG_DMA_EN;
+        writel(val, cp->regs + REG_TX_CFG);
+        val = readl(cp->regs + REG_RX_CFG) | RX_CFG_DMA_EN;
+        writel(val, cp->regs + REG_RX_CFG);
+
+        /* enable the mac */
+        val = readl(cp->regs + REG_MAC_TX_CFG) | MAC_TX_CFG_EN;
+        writel(val, cp->regs + REG_MAC_TX_CFG);
+        val = readl(cp->regs + REG_MAC_RX_CFG) | MAC_RX_CFG_EN;
+        writel(val, cp->regs + REG_MAC_RX_CFG);
+
+        i = STOP_TRIES;
+        while (i-- > 0) {
+                val = readl(cp->regs + REG_MAC_TX_CFG);
+                if ((val & MAC_TX_CFG_EN))
+                        break;
+                udelay(10);
+        }
+        if (i < 0) txfailed = 1;
+        i = STOP_TRIES;
+        while (i-- > 0) {
+                val = readl(cp->regs + REG_MAC_RX_CFG);
+                if ((val & MAC_RX_CFG_EN)) {
+                        if (txfailed) {
+                          printk(KERN_ERR 
+                                 "%s: enabling mac failed [tx:%08x:%08x].\n", 
+                                 cp->dev->name,
+                                 readl(cp->regs + REG_MIF_STATE_MACHINE),
+                                 readl(cp->regs + REG_MAC_STATE_MACHINE));
+                        }
+                        goto enable_rx_done;
+                }
+                udelay(10);
+        }
+        printk(KERN_ERR "%s: enabling mac failed [%s:%08x:%08x].\n", 
+               cp->dev->name,
+               (txfailed? "tx,rx":"rx"),
+               readl(cp->regs + REG_MIF_STATE_MACHINE),
+               readl(cp->regs + REG_MAC_STATE_MACHINE));
+
+enable_rx_done:
+        cas_unmask_intr(cp); /* enable interrupts */
+        writel(RX_DESC_RINGN_SIZE(0) - 4, cp->regs + REG_RX_KICK);
+        writel(0, cp->regs + REG_RX_COMP_TAIL);
+
+        if (cp->cas_flags & CAS_FLAG_REG_PLUS) {
+                if (N_RX_DESC_RINGS > 1) 
+                        writel(RX_DESC_RINGN_SIZE(1) - 4, 
+                               cp->regs + REG_PLUS_RX_KICK1);
+
+                for (i = 1; i < N_RX_COMP_RINGS; i++) 
+                        writel(0, cp->regs + REG_PLUS_RX_COMPN_TAIL(i));
+        }
+}
+
+/* Must be invoked under cp->lock. */
+static void cas_read_pcs_link_mode(struct cas *cp, int *fd, int *spd,
+                                   int *pause)
+{
+        u32 val = readl(cp->regs + REG_PCS_MII_LPA);
+        *fd     = (val & PCS_MII_LPA_FD) ? 1 : 0;
+        *pause  = (val & PCS_MII_LPA_SYM_PAUSE) ? 0x01 : 0x00;
+        if (val & PCS_MII_LPA_ASYM_PAUSE)
+                *pause |= 0x10;
+        *spd = 1000;
+}
+
+/* Must be invoked under cp->lock. */
+static void cas_read_mii_link_mode(struct cas *cp, int *fd, int *spd,
+                                   int *pause)
+{
+        u32 val;
+
+        *fd = 0;
+        *spd = 10;
+        *pause = 0;
+        
+        /* use GMII registers */
+        val = cas_phy_read(cp, MII_LPA);
+        if (val & CAS_LPA_PAUSE)
+                *pause = 0x01;
+
+        if (val & CAS_LPA_ASYM_PAUSE)
+                *pause |= 0x10;
+
+        if (val & LPA_DUPLEX)
+                *fd = 1;
+        if (val & LPA_100)
+                *spd = 100;
+
+        if (cp->cas_flags & CAS_FLAG_1000MB_CAP) {
+                val = cas_phy_read(cp, CAS_MII_1000_STATUS);
+                if (val & (CAS_LPA_1000FULL | CAS_LPA_1000HALF))
+                        *spd = 1000;
+                if (val & CAS_LPA_1000FULL)
+                        *fd = 1;
+        }
+}
+
+/* A link-up condition has occurred, initialize and enable the
+ * rest of the chip.
+ *
+ * Must be invoked under cp->lock.
+ */
+static void cas_set_link_modes(struct cas *cp)
+{
+        u32 val;
+        int full_duplex, speed, pause;
+
+        full_duplex = 0;
+        speed = 10;
+        pause = 0;
+
+        if (CAS_PHY_MII(cp->phy_type)) {
+                cas_mif_poll(cp, 0);
+                val = cas_phy_read(cp, MII_BMCR);
+                if (val & BMCR_ANENABLE) {
+                        cas_read_mii_link_mode(cp, &full_duplex, &speed, 
+                                               &pause);
+                } else {
+                        if (val & BMCR_FULLDPLX)
+                                full_duplex = 1;
+
+                        if (val & BMCR_SPEED100)
+                                speed = 100;
+                        else if (val & CAS_BMCR_SPEED1000)
+                                speed = (cp->cas_flags & CAS_FLAG_1000MB_CAP) ?
+                                        1000 : 100;
+                }
+                cas_mif_poll(cp, 1);
+
+        } else {
+                val = readl(cp->regs + REG_PCS_MII_CTRL);
+                cas_read_pcs_link_mode(cp, &full_duplex, &speed, &pause);
+                if ((val & PCS_MII_AUTONEG_EN) == 0) {
+                        if (val & PCS_MII_CTRL_DUPLEX)
+                                full_duplex = 1;
+                }
+        }
+
+        if (netif_msg_link(cp))
+                printk(KERN_INFO "%s: Link up at %d Mbps, %s-duplex.\n",
+                       cp->dev->name, speed, (full_duplex ? "full" : "half"));
+
+        val = MAC_XIF_TX_MII_OUTPUT_EN | MAC_XIF_LINK_LED;
+        if (CAS_PHY_MII(cp->phy_type)) {
+                val |= MAC_XIF_MII_BUFFER_OUTPUT_EN;
+                if (!full_duplex)
+                        val |= MAC_XIF_DISABLE_ECHO;
+        }
+        if (full_duplex) 
+                val |= MAC_XIF_FDPLX_LED;
+        if (speed == 1000)
+                val |= MAC_XIF_GMII_MODE;
+        writel(val, cp->regs + REG_MAC_XIF_CFG);
+
+        /* deal with carrier and collision detect. */
+        val = MAC_TX_CFG_IPG_EN;
+        if (full_duplex) {
+                val |= MAC_TX_CFG_IGNORE_CARRIER;
+                val |= MAC_TX_CFG_IGNORE_COLL;
+        } else {
+#ifndef USE_CSMA_CD_PROTO
+                val |= MAC_TX_CFG_NEVER_GIVE_UP_EN;
+                val |= MAC_TX_CFG_NEVER_GIVE_UP_LIM;
+#endif
+        }
+        /* val now set up for REG_MAC_TX_CFG */
+
+        /* If gigabit and half-duplex, enable carrier extension
+         * mode.  increase slot time to 512 bytes as well. 
+         * else, disable it and make sure slot time is 64 bytes.
+         * also activate checksum bug workaround
+         */
+        if ((speed == 1000) && !full_duplex) {
+                writel(val | MAC_TX_CFG_CARRIER_EXTEND, 
+                       cp->regs + REG_MAC_TX_CFG);
+
+                val = readl(cp->regs + REG_MAC_RX_CFG);
+                val &= ~MAC_RX_CFG_STRIP_FCS; /* checksum workaround */
+                writel(val | MAC_RX_CFG_CARRIER_EXTEND, 
+                       cp->regs + REG_MAC_RX_CFG);
+
+                writel(0x200, cp->regs + REG_MAC_SLOT_TIME);
+
+                cp->crc_size = 4;
+                /* minimum size gigabit frame at half duplex */
+                cp->min_frame_size = CAS_1000MB_MIN_FRAME;
+
+        } else {
+                writel(val, cp->regs + REG_MAC_TX_CFG);
+
+                /* checksum bug workaround. don't strip FCS when in 
+                 * half-duplex mode
+                 */
+                val = readl(cp->regs + REG_MAC_RX_CFG);
+                if (full_duplex) {
+                        val |= MAC_RX_CFG_STRIP_FCS;
+                        cp->crc_size = 0;
+                        cp->min_frame_size = CAS_MIN_MTU;
+                } else {
+                        val &= ~MAC_RX_CFG_STRIP_FCS;
+                        cp->crc_size = 4;
+                        cp->min_frame_size = CAS_MIN_FRAME;
+                }
+                writel(val & ~MAC_RX_CFG_CARRIER_EXTEND, 
+                       cp->regs + REG_MAC_RX_CFG);
+                writel(0x40, cp->regs + REG_MAC_SLOT_TIME);
+        }
+
+        if (netif_msg_link(cp)) {
+                if (pause & 0x01) {
+                        printk(KERN_INFO "%s: Pause is enabled "
+                               "(rxfifo: %d off: %d on: %d)\n",
+                               cp->dev->name,
+                               cp->rx_fifo_size,
+                               cp->rx_pause_off,
+                               cp->rx_pause_on);
+                } else if (pause & 0x10) {
+                        printk(KERN_INFO "%s: TX pause enabled\n",
+                               cp->dev->name);
+                } else {
+                        printk(KERN_INFO "%s: Pause is disabled\n",
+                               cp->dev->name);
+                }
+        }
+
+        val = readl(cp->regs + REG_MAC_CTRL_CFG);
+        val &= ~(MAC_CTRL_CFG_SEND_PAUSE_EN | MAC_CTRL_CFG_RECV_PAUSE_EN);
+        if (pause) { /* symmetric or asymmetric pause */
+                val |= MAC_CTRL_CFG_SEND_PAUSE_EN;
+                if (pause & 0x01) { /* symmetric pause */
+                        val |= MAC_CTRL_CFG_RECV_PAUSE_EN;
+                } 
+        }
+        writel(val, cp->regs + REG_MAC_CTRL_CFG);
+        cas_start_dma(cp);
+}
+
+/* Must be invoked under cp->lock. */
+static void cas_init_hw(struct cas *cp, int restart_link)
+{
+        if (restart_link)
+                cas_phy_init(cp);
+
+        cas_init_pause_thresholds(cp);
+        cas_init_mac(cp);
+        cas_init_dma(cp);
+
+        if (restart_link) {
+                /* Default aneg parameters */
+                cp->timer_ticks = 0;
+                cas_begin_auto_negotiation(cp, NULL);
+        } else if (cp->lstate == link_up) {
+                cas_set_link_modes(cp);
+                netif_carrier_on(cp->dev);
+        }
+}
+
+/* Must be invoked under cp->lock. on earlier cassini boards,
+ * SOFT_0 is tied to PCI reset. we use this to force a pci reset,
+ * let it settle out, and then restore pci state.
+ */
+static void cas_hard_reset(struct cas *cp)
+{
+        writel(BIM_LOCAL_DEV_SOFT_0, cp->regs + REG_BIM_LOCAL_DEV_EN); 
+        udelay(20);
+        pci_restore_state(cp->pdev);
+}
+
+
+static void cas_global_reset(struct cas *cp, int blkflag)
+{
+        int limit;
+
+        /* issue a global reset. don't use RSTOUT. */
+        if (blkflag && !CAS_PHY_MII(cp->phy_type)) {
+                /* For PCS, when the blkflag is set, we should set the
+                 * SW_REST_BLOCK_PCS_SLINK bit to prevent the results of
+                 * the last autonegotiation from being cleared.  We'll
+                 * need some special handling if the chip is set into a
+                 * loopback mode.
+                 */
+                writel((SW_RESET_TX | SW_RESET_RX | SW_RESET_BLOCK_PCS_SLINK), 
+                       cp->regs + REG_SW_RESET);
+        } else {
+                writel(SW_RESET_TX | SW_RESET_RX, cp->regs + REG_SW_RESET);
+        }
+
+        /* need to wait at least 3ms before polling register */
+        mdelay(3);
+
+        limit = STOP_TRIES;
+        while (limit-- > 0) {
+                u32 val = readl(cp->regs + REG_SW_RESET);
+                if ((val & (SW_RESET_TX | SW_RESET_RX)) == 0)
+                        goto done;
+                udelay(10);
+        }
+        printk(KERN_ERR "%s: sw reset failed.\n", cp->dev->name);
+
+done:
+        /* enable various BIM interrupts */
+        writel(BIM_CFG_DPAR_INTR_ENABLE | BIM_CFG_RMA_INTR_ENABLE | 
+               BIM_CFG_RTA_INTR_ENABLE, cp->regs + REG_BIM_CFG);
+
+        /* clear out pci error status mask for handled errors.
+         * we don't deal with DMA counter overflows as they happen
+         * all the time.
+         */
+        writel(0xFFFFFFFFU & ~(PCI_ERR_BADACK | PCI_ERR_DTRTO | 
+                               PCI_ERR_OTHER | PCI_ERR_BIM_DMA_WRITE | 
+                               PCI_ERR_BIM_DMA_READ), cp->regs + 
+               REG_PCI_ERR_STATUS_MASK);
+
+        /* set up for MII by default to address mac rx reset timeout
+         * issue
+         */
+        writel(PCS_DATAPATH_MODE_MII, cp->regs + REG_PCS_DATAPATH_MODE);
+}
+
+static void cas_reset(struct cas *cp, int blkflag)
+{
+        u32 val;
+
+        cas_mask_intr(cp);
+        cas_global_reset(cp, blkflag);
+        cas_mac_reset(cp);
+        cas_entropy_reset(cp);
+
+        /* disable dma engines. */
+        val = readl(cp->regs + REG_TX_CFG);
+        val &= ~TX_CFG_DMA_EN;
+        writel(val, cp->regs + REG_TX_CFG);
+
+        val = readl(cp->regs + REG_RX_CFG);
+        val &= ~RX_CFG_DMA_EN;
+        writel(val, cp->regs + REG_RX_CFG);
+
+        /* program header parser */
+        if ((cp->cas_flags & CAS_FLAG_TARGET_ABORT) ||
+            (CAS_HP_ALT_FIRMWARE == cas_prog_null)) {
+                cas_load_firmware(cp, CAS_HP_FIRMWARE);
+        } else {
+                cas_load_firmware(cp, CAS_HP_ALT_FIRMWARE);
+        }
+
+        /* clear out error registers */
+        spin_lock(&cp->stat_lock[N_TX_RINGS]);
+        cas_clear_mac_err(cp);
+        spin_unlock(&cp->stat_lock[N_TX_RINGS]);
+}
+
+/* Shut down the chip, must be called with pm_sem held.  */
+static void cas_shutdown(struct cas *cp)
+{
+        unsigned long flags;
+
+        /* Make us not-running to avoid timers respawning */
+        cp->hw_running = 0;
+
+        del_timer_sync(&cp->link_timer);
+
+        /* Stop the reset task */
+#if 0
+        while (atomic_read(&cp->reset_task_pending_mtu) ||
+               atomic_read(&cp->reset_task_pending_spare) ||
+               atomic_read(&cp->reset_task_pending_all))
+                schedule();
+
+#else
+        while (atomic_read(&cp->reset_task_pending))
+                schedule();
+#endif  
+        /* Actually stop the chip */
+        cas_lock_all_save(cp, flags);
+        cas_reset(cp, 0);
+        if (cp->cas_flags & CAS_FLAG_SATURN)
+                cas_phy_powerdown(cp);
+        cas_unlock_all_restore(cp, flags);
+}
+
+static int cas_change_mtu(struct net_device *dev, int new_mtu)
+{
+        struct cas *cp = netdev_priv(dev);
+
+        if (new_mtu < CAS_MIN_MTU || new_mtu > CAS_MAX_MTU)
+                return -EINVAL;
+
+        dev->mtu = new_mtu;
+        if (!netif_running(dev) || !netif_device_present(dev))
+                return 0;
+
+        /* let the reset task handle it */
+#if 1
+        atomic_inc(&cp->reset_task_pending);
+        if ((cp->phy_type & CAS_PHY_SERDES)) {
+                atomic_inc(&cp->reset_task_pending_all);
+        } else {
+                atomic_inc(&cp->reset_task_pending_mtu);
+        }
+        schedule_work(&cp->reset_task);
+#else
+        atomic_set(&cp->reset_task_pending, (cp->phy_type & CAS_PHY_SERDES) ? 
+                   CAS_RESET_ALL : CAS_RESET_MTU);
+        printk(KERN_ERR "reset called in cas_change_mtu\n");
+        schedule_work(&cp->reset_task);
+#endif
+
+        flush_scheduled_work();
+        return 0;
+}
+
+static void cas_clean_txd(struct cas *cp, int ring)
+{
+        struct cas_tx_desc *txd = cp->init_txds[ring];
+        struct sk_buff *skb, **skbs = cp->tx_skbs[ring];
+        u64 daddr, dlen;
+        int i, size;
+
+        size = TX_DESC_RINGN_SIZE(ring);
+        for (i = 0; i < size; i++) {
+                int frag;
+
+                if (skbs[i] == NULL)
+                        continue;
+
+                skb = skbs[i];
+                skbs[i] = NULL;
+
+                for (frag = 0; frag <= skb_shinfo(skb)->nr_frags;  frag++) {
+                        int ent = i & (size - 1);
+
+                        /* first buffer is never a tiny buffer and so
+                         * needs to be unmapped.
+                         */
+                        daddr = le64_to_cpu(txd[ent].buffer);
+                        dlen  =  CAS_VAL(TX_DESC_BUFLEN, 
+                                         le64_to_cpu(txd[ent].control));
+                        pci_unmap_page(cp->pdev, daddr, dlen,
+                                       PCI_DMA_TODEVICE);
+
+                        if (frag != skb_shinfo(skb)->nr_frags) {
+                                i++;
+
+                                /* next buffer might by a tiny buffer.
+                                 * skip past it.
+                                 */
+                                ent = i & (size - 1);
+                                if (cp->tx_tiny_use[ring][ent].used)
+                                        i++;
+                        }
+                }
+                dev_kfree_skb_any(skb);
+        }
+
+        /* zero out tiny buf usage */
+        memset(cp->tx_tiny_use[ring], 0, size*sizeof(*cp->tx_tiny_use[ring]));
+}
+
+/* freed on close */
+static inline void cas_free_rx_desc(struct cas *cp, int ring)
+{
+        cas_page_t **page = cp->rx_pages[ring];
+        int i, size;
+
+        size = RX_DESC_RINGN_SIZE(ring);
+        for (i = 0; i < size; i++) {
+                if (page[i]) {
+                        cas_page_free(cp, page[i]);
+                        page[i] = NULL;
+                }
+        }
+}
+
+static void cas_free_rxds(struct cas *cp)
+{
+        int i;
+
+        for (i = 0; i < N_RX_DESC_RINGS; i++)
+                cas_free_rx_desc(cp, i);
+}
+
+/* Must be invoked under cp->lock. */
+static void cas_clean_rings(struct cas *cp)
+{
+        int i;
+
+        /* need to clean all tx rings */
+        memset(cp->tx_old, 0, sizeof(*cp->tx_old)*N_TX_RINGS);
+        memset(cp->tx_new, 0, sizeof(*cp->tx_new)*N_TX_RINGS);
+        for (i = 0; i < N_TX_RINGS; i++)
+                cas_clean_txd(cp, i);
+
+        /* zero out init block */
+        memset(cp->init_block, 0, sizeof(struct cas_init_block));
+        cas_clean_rxds(cp);
+        cas_clean_rxcs(cp);
+}
+
+/* allocated on open */
+static inline int cas_alloc_rx_desc(struct cas *cp, int ring)
+{
+        cas_page_t **page = cp->rx_pages[ring];
+        int size, i = 0;
+
+        size = RX_DESC_RINGN_SIZE(ring);
+        for (i = 0; i < size; i++) {
+                if ((page[i] = cas_page_alloc(cp, GFP_KERNEL)) == NULL) 
+                        return -1;
+        }
+        return 0;
+}
+
+static int cas_alloc_rxds(struct cas *cp)
+{
+        int i;
+
+        for (i = 0; i < N_RX_DESC_RINGS; i++) {
+                if (cas_alloc_rx_desc(cp, i) < 0) {
+                        cas_free_rxds(cp);
+                        return -1;
+                }
+        }
+        return 0;
+}
+
+static void cas_reset_task(void *data)
+{
+        struct cas *cp = (struct cas *) data;
+#if 0
+        int pending = atomic_read(&cp->reset_task_pending);
+#else
+        int pending_all = atomic_read(&cp->reset_task_pending_all);
+        int pending_spare = atomic_read(&cp->reset_task_pending_spare);
+        int pending_mtu = atomic_read(&cp->reset_task_pending_mtu);
+
+        if (pending_all == 0 && pending_spare == 0 && pending_mtu == 0) {
+                /* We can have more tasks scheduled than actually
+                 * needed.
+                 */
+                atomic_dec(&cp->reset_task_pending);
+                return;
+        }
+#endif
+        /* The link went down, we reset the ring, but keep
+         * DMA stopped. Use this function for reset
+         * on error as well.
+         */
+        if (cp->hw_running) {
+                unsigned long flags;
+
+                /* Make sure we don't get interrupts or tx packets */
+                netif_device_detach(cp->dev);
+                cas_lock_all_save(cp, flags);
+
+                if (cp->opened) {
+                        /* We call cas_spare_recover when we call cas_open.
+                         * but we do not initialize the lists cas_spare_recover
+                         * uses until cas_open is called.
+                         */
+                        cas_spare_recover(cp, GFP_ATOMIC);
+                }
+#if 1
+                /* test => only pending_spare set */
+                if (!pending_all && !pending_mtu)
+                        goto done;
+#else
+                if (pending == CAS_RESET_SPARE)
+                        goto done;
+#endif
+                /* when pending == CAS_RESET_ALL, the following
+                 * call to cas_init_hw will restart auto negotiation.
+                 * Setting the second argument of cas_reset to
+                 * !(pending == CAS_RESET_ALL) will set this argument
+                 * to 1 (avoiding reinitializing the PHY for the normal 
+                 * PCS case) when auto negotiation is not restarted.
+                 */
+#if 1
+                cas_reset(cp, !(pending_all > 0));
+                if (cp->opened)
+                        cas_clean_rings(cp);
+                cas_init_hw(cp, (pending_all > 0));
+#else
+                cas_reset(cp, !(pending == CAS_RESET_ALL));
+                if (cp->opened)
+                        cas_clean_rings(cp);
+                cas_init_hw(cp, pending == CAS_RESET_ALL);
+#endif
+
+done:
+                cas_unlock_all_restore(cp, flags);
+                netif_device_attach(cp->dev);
+        }
+#if 1
+        atomic_sub(pending_all, &cp->reset_task_pending_all);
+        atomic_sub(pending_spare, &cp->reset_task_pending_spare);
+        atomic_sub(pending_mtu, &cp->reset_task_pending_mtu);
+        atomic_dec(&cp->reset_task_pending);
+#else
+        atomic_set(&cp->reset_task_pending, 0);
+#endif
+}
+
+static void cas_link_timer(unsigned long data)
+{
+        struct cas *cp = (struct cas *) data;
+        int mask, pending = 0, reset = 0;
+        unsigned long flags;
+
+        if (link_transition_timeout != 0 &&
+            cp->link_transition_jiffies_valid &&
+            ((jiffies - cp->link_transition_jiffies) > 
+              (link_transition_timeout))) {
+                /* One-second counter so link-down workaround doesn't 
+                 * cause resets to occur so fast as to fool the switch
+                 * into thinking the link is down.
+                 */
+                cp->link_transition_jiffies_valid = 0;
+        }
+
+        if (!cp->hw_running)
+                return;
+
+        spin_lock_irqsave(&cp->lock, flags);
+        cas_lock_tx(cp);
+        cas_entropy_gather(cp);
+
+        /* If the link task is still pending, we just
+         * reschedule the link timer
+         */
+#if 1
+        if (atomic_read(&cp->reset_task_pending_all) ||
+            atomic_read(&cp->reset_task_pending_spare) ||
+            atomic_read(&cp->reset_task_pending_mtu)) 
+                goto done;
+#else
+        if (atomic_read(&cp->reset_task_pending)) 
+                goto done;
+#endif
+
+        /* check for rx cleaning */
+        if ((mask = (cp->cas_flags & CAS_FLAG_RXD_POST_MASK))) {
+                int i, rmask;
+
+                for (i = 0; i < MAX_RX_DESC_RINGS; i++) {
+                        rmask = CAS_FLAG_RXD_POST(i);
+                        if ((mask & rmask) == 0)
+                                continue;
+
+                        /* post_rxds will do a mod_timer */
+                        if (cas_post_rxds_ringN(cp, i, cp->rx_last[i]) < 0) {
+                                pending = 1;
+                                continue;
+                        }
+                        cp->cas_flags &= ~rmask;
+                }
+        }
+
+        if (CAS_PHY_MII(cp->phy_type)) {
+                u16 bmsr;
+                cas_mif_poll(cp, 0);
+                bmsr = cas_phy_read(cp, MII_BMSR);
+                /* WTZ: Solaris driver reads this twice, but that
+                 * may be due to the PCS case and the use of a
+                 * common implementation. Read it twice here to be
+                 * safe.
+                 */
+                bmsr = cas_phy_read(cp, MII_BMSR);
+                cas_mif_poll(cp, 1);
+                readl(cp->regs + REG_MIF_STATUS); /* avoid dups */
+                reset = cas_mii_link_check(cp, bmsr);
+        } else {
+                reset = cas_pcs_link_check(cp);
+        }
+
+        if (reset)
+                goto done;
+
+        /* check for tx state machine confusion */
+        if ((readl(cp->regs + REG_MAC_TX_STATUS) & MAC_TX_FRAME_XMIT) == 0) {
+                u32 val = readl(cp->regs + REG_MAC_STATE_MACHINE);
+                u32 wptr, rptr;
+                int tlm  = CAS_VAL(MAC_SM_TLM, val);
+
+                if (((tlm == 0x5) || (tlm == 0x3)) &&
+                    (CAS_VAL(MAC_SM_ENCAP_SM, val) == 0)) {
+                        if (netif_msg_tx_err(cp))
+                                printk(KERN_DEBUG "%s: tx err: "
+                                       "MAC_STATE[%08x]\n",
+                                       cp->dev->name, val);
+                        reset = 1;
+                        goto done;
+                }
+
+                val  = readl(cp->regs + REG_TX_FIFO_PKT_CNT);
+                wptr = readl(cp->regs + REG_TX_FIFO_WRITE_PTR);
+                rptr = readl(cp->regs + REG_TX_FIFO_READ_PTR);
+                if ((val == 0) && (wptr != rptr)) {
+                        if (netif_msg_tx_err(cp))
+                                printk(KERN_DEBUG "%s: tx err: "
+                                       "TX_FIFO[%08x:%08x:%08x]\n",
+                                       cp->dev->name, val, wptr, rptr);
+                        reset = 1;
+                }
+
+                if (reset)
+                        cas_hard_reset(cp);
+        }
+
+done:
+        if (reset) {
+#if 1
+                atomic_inc(&cp->reset_task_pending);
+                atomic_inc(&cp->reset_task_pending_all);
+                schedule_work(&cp->reset_task);
+#else
+                atomic_set(&cp->reset_task_pending, CAS_RESET_ALL);
+                printk(KERN_ERR "reset called in cas_link_timer\n");
+                schedule_work(&cp->reset_task);
+#endif
+        }
+
+        if (!pending)
+                mod_timer(&cp->link_timer, jiffies + CAS_LINK_TIMEOUT);
+        cas_unlock_tx(cp);
+        spin_unlock_irqrestore(&cp->lock, flags);
+}
+
+/* tiny buffers are used to avoid target abort issues with 
+ * older cassini's
+ */
+static void cas_tx_tiny_free(struct cas *cp)
+{
+        struct pci_dev *pdev = cp->pdev;
+        int i;
+
+        for (i = 0; i < N_TX_RINGS; i++) {
+                if (!cp->tx_tiny_bufs[i])
+                        continue;
+
+                pci_free_consistent(pdev, TX_TINY_BUF_BLOCK, 
+                                    cp->tx_tiny_bufs[i],
+                                    cp->tx_tiny_dvma[i]);
+                cp->tx_tiny_bufs[i] = NULL;
+        }
+}
+
+static int cas_tx_tiny_alloc(struct cas *cp)
+{
+        struct pci_dev *pdev = cp->pdev;
+        int i;
+
+        for (i = 0; i < N_TX_RINGS; i++) {
+                cp->tx_tiny_bufs[i] = 
+                        pci_alloc_consistent(pdev, TX_TINY_BUF_BLOCK,
+                                             &cp->tx_tiny_dvma[i]);
+                if (!cp->tx_tiny_bufs[i]) {
+                        cas_tx_tiny_free(cp);
+                        return -1;
+                }
+        }
+        return 0;
+}
+
+
+static int cas_open(struct net_device *dev)
+{
+        struct cas *cp = netdev_priv(dev);
+        int hw_was_up, err;
+        unsigned long flags;
+
+        down(&cp->pm_sem);
+
+        hw_was_up = cp->hw_running;
+
+        /* The power-management semaphore protects the hw_running
+         * etc. state so it is safe to do this bit without cp->lock
+         */
+        if (!cp->hw_running) {
+                /* Reset the chip */
+                cas_lock_all_save(cp, flags);
+                /* We set the second arg to cas_reset to zero
+                 * because cas_init_hw below will have its second 
+                 * argument set to non-zero, which will force
+                 * autonegotiation to start.
+                 */
+                cas_reset(cp, 0);
+                cp->hw_running = 1;
+                cas_unlock_all_restore(cp, flags);
+        }
+
+        if (cas_tx_tiny_alloc(cp) < 0)
+                return -ENOMEM;
+
+        /* alloc rx descriptors */
+        err = -ENOMEM;
+        if (cas_alloc_rxds(cp) < 0)
+                goto err_tx_tiny;
+        
+        /* allocate spares */
+        cas_spare_init(cp);
+        cas_spare_recover(cp, GFP_KERNEL);
+
+        /* We can now request the interrupt as we know it's masked
+         * on the controller. cassini+ has up to 4 interrupts
+         * that can be used, but you need to do explicit pci interrupt 
+         * mapping to expose them
+         */
+        if (request_irq(cp->pdev->irq, cas_interrupt,
+                        SA_SHIRQ, dev->name, (void *) dev)) {
+                printk(KERN_ERR "%s: failed to request irq !\n", 
+                       cp->dev->name);
+                err = -EAGAIN;
+                goto err_spare;
+        }
+
+        /* init hw */
+        cas_lock_all_save(cp, flags);
+        cas_clean_rings(cp);
+        cas_init_hw(cp, !hw_was_up);
+        cp->opened = 1;
+        cas_unlock_all_restore(cp, flags);
+
+        netif_start_queue(dev);
+        up(&cp->pm_sem);
+        return 0;
+
+err_spare:
+        cas_spare_free(cp);
+        cas_free_rxds(cp);
+err_tx_tiny:
+        cas_tx_tiny_free(cp);
+        up(&cp->pm_sem);
+        return err;
+}
+
+static int cas_close(struct net_device *dev)
+{
+        unsigned long flags;
+        struct cas *cp = netdev_priv(dev);
+
+        /* Make sure we don't get distracted by suspend/resume */
+        down(&cp->pm_sem);
+
+        netif_stop_queue(dev);
+
+        /* Stop traffic, mark us closed */
+        cas_lock_all_save(cp, flags);
+        cp->opened = 0; 
+        cas_reset(cp, 0);
+        cas_phy_init(cp); 
+        cas_begin_auto_negotiation(cp, NULL);
+        cas_clean_rings(cp);
+        cas_unlock_all_restore(cp, flags);
+
+        free_irq(cp->pdev->irq, (void *) dev);
+        cas_spare_free(cp);
+        cas_free_rxds(cp);
+        cas_tx_tiny_free(cp);
+        up(&cp->pm_sem);
+        return 0;
+}
+
+static struct {
+        const char name[ETH_GSTRING_LEN];
+} ethtool_cassini_statnames[] = {
+        {"collisions"},
+        {"rx_bytes"},
+        {"rx_crc_errors"},
+        {"rx_dropped"},
+        {"rx_errors"},
+        {"rx_fifo_errors"},
+        {"rx_frame_errors"},
+        {"rx_length_errors"},
+        {"rx_over_errors"},
+        {"rx_packets"},
+        {"tx_aborted_errors"},
+        {"tx_bytes"},
+        {"tx_dropped"},
+        {"tx_errors"},
+        {"tx_fifo_errors"},
+        {"tx_packets"}
+};
+#define CAS_NUM_STAT_KEYS (sizeof(ethtool_cassini_statnames)/ETH_GSTRING_LEN)
+
+static struct {
+        const int offsets;      /* neg. values for 2nd arg to cas_read_phy */
+} ethtool_register_table[] = {
+        {-MII_BMSR},
+        {-MII_BMCR},
+        {REG_CAWR},
+        {REG_INF_BURST},
+        {REG_BIM_CFG},
+        {REG_RX_CFG},
+        {REG_HP_CFG},
+        {REG_MAC_TX_CFG},
+        {REG_MAC_RX_CFG},
+        {REG_MAC_CTRL_CFG},
+        {REG_MAC_XIF_CFG},
+        {REG_MIF_CFG},
+        {REG_PCS_CFG},
+        {REG_SATURN_PCFG},
+        {REG_PCS_MII_STATUS},
+        {REG_PCS_STATE_MACHINE},
+        {REG_MAC_COLL_EXCESS},
+        {REG_MAC_COLL_LATE}
+};
+#define CAS_REG_LEN     (sizeof(ethtool_register_table)/sizeof(int))
+#define CAS_MAX_REGS    (sizeof (u32)*CAS_REG_LEN)
+
+static void cas_read_regs(struct cas *cp, u8 *ptr, int len)
+{
+        u8 *p;
+        int i;
+        unsigned long flags;
+
+        spin_lock_irqsave(&cp->lock, flags);
+        for (i = 0, p = ptr; i < len ; i ++, p += sizeof(u32)) {
+                u16 hval;
+                u32 val;
+                if (ethtool_register_table[i].offsets < 0) {
+                        hval = cas_phy_read(cp,
+                                    -ethtool_register_table[i].offsets);
+                        val = hval;
+                } else {
+                        val= readl(cp->regs+ethtool_register_table[i].offsets);
+                }
+                memcpy(p, (u8 *)&val, sizeof(u32));
+        }
+        spin_unlock_irqrestore(&cp->lock, flags);
+}
+
+static struct net_device_stats *cas_get_stats(struct net_device *dev)
+{
+        struct cas *cp = netdev_priv(dev);
+        struct net_device_stats *stats = cp->net_stats;
+        unsigned long flags;
+        int i;
+        unsigned long tmp;
+
+        /* we collate all of the stats into net_stats[N_TX_RING] */
+        if (!cp->hw_running)
+                return stats + N_TX_RINGS;
+        
+        /* collect outstanding stats */
+        /* WTZ: the Cassini spec gives these as 16 bit counters but
+         * stored in 32-bit words.  Added a mask of 0xffff to be safe,
+         * in case the chip somehow puts any garbage in the other bits.
+         * Also, counter usage didn't seem to mach what Adrian did
+         * in the parts of the code that set these quantities. Made
+         * that consistent.
+         */
+        spin_lock_irqsave(&cp->stat_lock[N_TX_RINGS], flags);
+        stats[N_TX_RINGS].rx_crc_errors += 
+          readl(cp->regs + REG_MAC_FCS_ERR) & 0xffff;
+        stats[N_TX_RINGS].rx_frame_errors += 
+                readl(cp->regs + REG_MAC_ALIGN_ERR) &0xffff;
+        stats[N_TX_RINGS].rx_length_errors += 
+                readl(cp->regs + REG_MAC_LEN_ERR) & 0xffff;
+#if 1
+        tmp = (readl(cp->regs + REG_MAC_COLL_EXCESS) & 0xffff) +
+                (readl(cp->regs + REG_MAC_COLL_LATE) & 0xffff);
+        stats[N_TX_RINGS].tx_aborted_errors += tmp;
+        stats[N_TX_RINGS].collisions +=
+          tmp + (readl(cp->regs + REG_MAC_COLL_NORMAL) & 0xffff);
+#else
+        stats[N_TX_RINGS].tx_aborted_errors += 
+                readl(cp->regs + REG_MAC_COLL_EXCESS);
+        stats[N_TX_RINGS].collisions += readl(cp->regs + REG_MAC_COLL_EXCESS) +
+                readl(cp->regs + REG_MAC_COLL_LATE);
+#endif
+        cas_clear_mac_err(cp);
+
+        /* saved bits that are unique to ring 0 */
+        spin_lock(&cp->stat_lock[0]);
+        stats[N_TX_RINGS].collisions        += stats[0].collisions;
+        stats[N_TX_RINGS].rx_over_errors    += stats[0].rx_over_errors;
+        stats[N_TX_RINGS].rx_frame_errors   += stats[0].rx_frame_errors;
+        stats[N_TX_RINGS].rx_fifo_errors    += stats[0].rx_fifo_errors;
+        stats[N_TX_RINGS].tx_aborted_errors += stats[0].tx_aborted_errors;
+        stats[N_TX_RINGS].tx_fifo_errors    += stats[0].tx_fifo_errors;
+        spin_unlock(&cp->stat_lock[0]);
+
+        for (i = 0; i < N_TX_RINGS; i++) {
+                spin_lock(&cp->stat_lock[i]);
+                stats[N_TX_RINGS].rx_length_errors += 
+                        stats[i].rx_length_errors;
+                stats[N_TX_RINGS].rx_crc_errors += stats[i].rx_crc_errors;
+                stats[N_TX_RINGS].rx_packets    += stats[i].rx_packets;
+                stats[N_TX_RINGS].tx_packets    += stats[i].tx_packets;
+                stats[N_TX_RINGS].rx_bytes      += stats[i].rx_bytes;
+                stats[N_TX_RINGS].tx_bytes      += stats[i].tx_bytes;
+                stats[N_TX_RINGS].rx_errors     += stats[i].rx_errors;
+                stats[N_TX_RINGS].tx_errors     += stats[i].tx_errors;
+                stats[N_TX_RINGS].rx_dropped    += stats[i].rx_dropped;
+                stats[N_TX_RINGS].tx_dropped    += stats[i].tx_dropped;
+                memset(stats + i, 0, sizeof(struct net_device_stats));
+                spin_unlock(&cp->stat_lock[i]);
+        }
+        spin_unlock_irqrestore(&cp->stat_lock[N_TX_RINGS], flags);
+        return stats + N_TX_RINGS;
+}
+
+
+static void cas_set_multicast(struct net_device *dev)
+{
+        struct cas *cp = netdev_priv(dev);
+        u32 rxcfg, rxcfg_new;
+        unsigned long flags;
+        int limit = STOP_TRIES;
+        
+        if (!cp->hw_running)
+                return;
+                
+        spin_lock_irqsave(&cp->lock, flags);
+        rxcfg = readl(cp->regs + REG_MAC_RX_CFG);
+
+        /* disable RX MAC and wait for completion */
+        writel(rxcfg & ~MAC_RX_CFG_EN, cp->regs + REG_MAC_RX_CFG);
+        while (readl(cp->regs + REG_MAC_RX_CFG) & MAC_RX_CFG_EN) {
+                if (!limit--)
+                        break;
+                udelay(10);
+        }
+
+        /* disable hash filter and wait for completion */
+        limit = STOP_TRIES;
+        rxcfg &= ~(MAC_RX_CFG_PROMISC_EN | MAC_RX_CFG_HASH_FILTER_EN);
+        writel(rxcfg & ~MAC_RX_CFG_EN, cp->regs + REG_MAC_RX_CFG);
+        while (readl(cp->regs + REG_MAC_RX_CFG) & MAC_RX_CFG_HASH_FILTER_EN) {
+                if (!limit--)
+                        break;
+                udelay(10);
+        }
+
+        /* program hash filters */
+        cp->mac_rx_cfg = rxcfg_new = cas_setup_multicast(cp);
+        rxcfg |= rxcfg_new;
+        writel(rxcfg, cp->regs + REG_MAC_RX_CFG);
+        spin_unlock_irqrestore(&cp->lock, flags);
+}
+
+static void cas_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
+{
+        struct cas *cp = netdev_priv(dev);
+        strncpy(info->driver, DRV_MODULE_NAME, ETHTOOL_BUSINFO_LEN);
+        strncpy(info->version, DRV_MODULE_VERSION, ETHTOOL_BUSINFO_LEN);
+        info->fw_version[0] = '\0';
+        strncpy(info->bus_info, pci_name(cp->pdev), ETHTOOL_BUSINFO_LEN);
+        info->regdump_len = cp->casreg_len < CAS_MAX_REGS ?
+                cp->casreg_len : CAS_MAX_REGS;
+        info->n_stats = CAS_NUM_STAT_KEYS;
+}
+
+static int cas_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct cas *cp = netdev_priv(dev);
+        u16 bmcr;
+        int full_duplex, speed, pause;
+        unsigned long flags;
+        enum link_state linkstate = link_up;
+
+        cmd->advertising = 0;
+        cmd->supported = SUPPORTED_Autoneg;
+        if (cp->cas_flags & CAS_FLAG_1000MB_CAP) {
+                cmd->supported |= SUPPORTED_1000baseT_Full;
+                cmd->advertising |= ADVERTISED_1000baseT_Full;
+        }
+
+        /* Record PHY settings if HW is on. */
+        spin_lock_irqsave(&cp->lock, flags);
+        bmcr = 0;
+        linkstate = cp->lstate;
+        if (CAS_PHY_MII(cp->phy_type)) {
+                cmd->port = PORT_MII;
+                cmd->transceiver = (cp->cas_flags & CAS_FLAG_SATURN) ?
+                        XCVR_INTERNAL : XCVR_EXTERNAL;
+                cmd->phy_address = cp->phy_addr;
+                cmd->advertising |= ADVERTISED_TP | ADVERTISED_MII |
+                        ADVERTISED_10baseT_Half | 
+                        ADVERTISED_10baseT_Full | 
+                        ADVERTISED_100baseT_Half | 
+                        ADVERTISED_100baseT_Full;
+
+                cmd->supported |=
+                        (SUPPORTED_10baseT_Half | 
+                         SUPPORTED_10baseT_Full |
+                         SUPPORTED_100baseT_Half | 
+                         SUPPORTED_100baseT_Full |
+                         SUPPORTED_TP | SUPPORTED_MII);
+
+                if (cp->hw_running) {
+                        cas_mif_poll(cp, 0);
+                        bmcr = cas_phy_read(cp, MII_BMCR);
+                        cas_read_mii_link_mode(cp, &full_duplex, 
+                                               &speed, &pause);
+                        cas_mif_poll(cp, 1);
+                }
+
+        } else {
+                cmd->port = PORT_FIBRE;
+                cmd->transceiver = XCVR_INTERNAL;
+                cmd->phy_address = 0;
+                cmd->supported   |= SUPPORTED_FIBRE;
+                cmd->advertising |= ADVERTISED_FIBRE;
+
+                if (cp->hw_running) {
+                        /* pcs uses the same bits as mii */ 
+                        bmcr = readl(cp->regs + REG_PCS_MII_CTRL);
+                        cas_read_pcs_link_mode(cp, &full_duplex, 
+                                               &speed, &pause);
+                }
+        }
+        spin_unlock_irqrestore(&cp->lock, flags);
+
+        if (bmcr & BMCR_ANENABLE) {
+                cmd->advertising |= ADVERTISED_Autoneg;
+                cmd->autoneg = AUTONEG_ENABLE;
+                cmd->speed = ((speed == 10) ?
+                              SPEED_10 :
+                              ((speed == 1000) ?
+                               SPEED_1000 : SPEED_100));
+                cmd->duplex = full_duplex ? DUPLEX_FULL : DUPLEX_HALF;
+        } else {
+                cmd->autoneg = AUTONEG_DISABLE;
+                cmd->speed =
+                        (bmcr & CAS_BMCR_SPEED1000) ?
+                        SPEED_1000 : 
+                        ((bmcr & BMCR_SPEED100) ? SPEED_100: 
+                         SPEED_10);
+                cmd->duplex =
+                        (bmcr & BMCR_FULLDPLX) ?
+                        DUPLEX_FULL : DUPLEX_HALF;
+        }
+        if (linkstate != link_up) {
+                /* Force these to "unknown" if the link is not up and
+                 * autonogotiation in enabled. We can set the link 
+                 * speed to 0, but not cmd->duplex,
+                 * because its legal values are 0 and 1.  Ethtool will
+                 * print the value reported in parentheses after the
+                 * word "Unknown" for unrecognized values.
+                 *
+                 * If in forced mode, we report the speed and duplex
+                 * settings that we configured.
+                 */
+                if (cp->link_cntl & BMCR_ANENABLE) {
+                        cmd->speed = 0;
+                        cmd->duplex = 0xff;
+                } else {
+                        cmd->speed = SPEED_10;
+                        if (cp->link_cntl & BMCR_SPEED100) {
+                                cmd->speed = SPEED_100;
+                        } else if (cp->link_cntl & CAS_BMCR_SPEED1000) {
+                                cmd->speed = SPEED_1000;
+                        }
+                        cmd->duplex = (cp->link_cntl & BMCR_FULLDPLX)?
+                                DUPLEX_FULL : DUPLEX_HALF;
+                }
+        }
+        return 0;
+}
+
+static int cas_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct cas *cp = netdev_priv(dev);
+        unsigned long flags;
+
+        /* Verify the settings we care about. */
+        if (cmd->autoneg != AUTONEG_ENABLE &&
+            cmd->autoneg != AUTONEG_DISABLE)
+                return -EINVAL;
+
+        if (cmd->autoneg == AUTONEG_DISABLE &&
+            ((cmd->speed != SPEED_1000 &&
+              cmd->speed != SPEED_100 &&
+              cmd->speed != SPEED_10) ||
+             (cmd->duplex != DUPLEX_HALF &&
+              cmd->duplex != DUPLEX_FULL)))
+                return -EINVAL;
+
+        /* Apply settings and restart link process. */
+        spin_lock_irqsave(&cp->lock, flags);
+        cas_begin_auto_negotiation(cp, cmd);
+        spin_unlock_irqrestore(&cp->lock, flags);
+        return 0;
+}
+
+static int cas_nway_reset(struct net_device *dev)
+{
+        struct cas *cp = netdev_priv(dev);
+        unsigned long flags;
+
+        if ((cp->link_cntl & BMCR_ANENABLE) == 0)
+                return -EINVAL;
+
+        /* Restart link process. */
+        spin_lock_irqsave(&cp->lock, flags);
+        cas_begin_auto_negotiation(cp, NULL);
+        spin_unlock_irqrestore(&cp->lock, flags);
+
+        return 0;
+}
+
+static u32 cas_get_link(struct net_device *dev)
+{
+        struct cas *cp = netdev_priv(dev);
+        return cp->lstate == link_up;
+}
+
+static u32 cas_get_msglevel(struct net_device *dev)
+{
+        struct cas *cp = netdev_priv(dev);
+        return cp->msg_enable;
+}
+
+static void cas_set_msglevel(struct net_device *dev, u32 value)
+{
+        struct cas *cp = netdev_priv(dev);
+        cp->msg_enable = value;
+}
+
+static int cas_get_regs_len(struct net_device *dev)
+{
+        struct cas *cp = netdev_priv(dev);
+        return cp->casreg_len < CAS_MAX_REGS ? cp->casreg_len: CAS_MAX_REGS;
+}
+
+static void cas_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+                             void *p)
+{
+        struct cas *cp = netdev_priv(dev);
+        regs->version = 0;
+        /* cas_read_regs handles locks (cp->lock).  */
+        cas_read_regs(cp, p, regs->len / sizeof(u32));
+}
+
+static int cas_get_stats_count(struct net_device *dev)
+{
+        return CAS_NUM_STAT_KEYS;
+}
+
+static void cas_get_strings(struct net_device *dev, u32 stringset, u8 *data)
+{
+         memcpy(data, &ethtool_cassini_statnames, 
+                                         CAS_NUM_STAT_KEYS * ETH_GSTRING_LEN);
+}
+
+static void cas_get_ethtool_stats(struct net_device *dev,
+                                      struct ethtool_stats *estats, u64 *data)
+{
+        struct cas *cp = netdev_priv(dev);
+        struct net_device_stats *stats = cas_get_stats(cp->dev);
+        int i = 0;
+        data[i++] = stats->collisions;
+        data[i++] = stats->rx_bytes;
+        data[i++] = stats->rx_crc_errors;
+        data[i++] = stats->rx_dropped;
+        data[i++] = stats->rx_errors;
+        data[i++] = stats->rx_fifo_errors;
+        data[i++] = stats->rx_frame_errors;
+        data[i++] = stats->rx_length_errors;
+        data[i++] = stats->rx_over_errors;
+        data[i++] = stats->rx_packets;
+        data[i++] = stats->tx_aborted_errors;
+        data[i++] = stats->tx_bytes;
+        data[i++] = stats->tx_dropped;
+        data[i++] = stats->tx_errors;
+        data[i++] = stats->tx_fifo_errors;
+        data[i++] = stats->tx_packets;
+        BUG_ON(i != CAS_NUM_STAT_KEYS);
+}
+
+static struct ethtool_ops cas_ethtool_ops = {
+        .get_drvinfo            = cas_get_drvinfo,
+        .get_settings           = cas_get_settings,
+        .set_settings           = cas_set_settings,
+        .nway_reset             = cas_nway_reset,
+        .get_link               = cas_get_link,
+        .get_msglevel           = cas_get_msglevel,
+        .set_msglevel           = cas_set_msglevel,
+        .get_regs_len           = cas_get_regs_len,
+        .get_regs               = cas_get_regs,
+        .get_stats_count        = cas_get_stats_count,
+        .get_strings            = cas_get_strings,
+        .get_ethtool_stats      = cas_get_ethtool_stats,
+};
+
+static int cas_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+{
+        struct cas *cp = netdev_priv(dev);
+        struct mii_ioctl_data *data = if_mii(ifr);
+        unsigned long flags;
+        int rc = -EOPNOTSUPP;
+        
+        /* Hold the PM semaphore while doing ioctl's or we may collide
+         * with open/close and power management and oops.
+         */
+        down(&cp->pm_sem);
+        switch (cmd) {
+        case SIOCGMIIPHY:               /* Get address of MII PHY in use. */
+                data->phy_id = cp->phy_addr;
+                /* Fallthrough... */
+
+        case SIOCGMIIREG:               /* Read MII PHY register. */
+                spin_lock_irqsave(&cp->lock, flags);
+                cas_mif_poll(cp, 0);
+                data->val_out = cas_phy_read(cp, data->reg_num & 0x1f);
+                cas_mif_poll(cp, 1);
+                spin_unlock_irqrestore(&cp->lock, flags);
+                rc = 0;
+                break;
+
+        case SIOCSMIIREG:               /* Write MII PHY register. */
+                if (!capable(CAP_NET_ADMIN)) {
+                        rc = -EPERM;
+                        break;
+                }
+                spin_lock_irqsave(&cp->lock, flags);
+                cas_mif_poll(cp, 0);
+                rc = cas_phy_write(cp, data->reg_num & 0x1f, data->val_in);
+                cas_mif_poll(cp, 1);
+                spin_unlock_irqrestore(&cp->lock, flags);
+                break;
+        default:
+                break;
+        };
+
+        up(&cp->pm_sem);
+        return rc;
+}
+
+static int __devinit cas_init_one(struct pci_dev *pdev,
+                                  const struct pci_device_id *ent)
+{
+        static int cas_version_printed = 0;
+        unsigned long casreg_base, casreg_len;
+        struct net_device *dev;
+        struct cas *cp;
+        int i, err, pci_using_dac;
+        u16 pci_cmd;
+        u8 orig_cacheline_size = 0, cas_cacheline_size = 0;
+
+        if (cas_version_printed++ == 0)
+                printk(KERN_INFO "%s", version);
+
+        err = pci_enable_device(pdev);
+        if (err) {
+                printk(KERN_ERR PFX "Cannot enable PCI device, "
+                       "aborting.\n");
+                return err;
+        }
+
+        if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
+                printk(KERN_ERR PFX "Cannot find proper PCI device "
+                       "base address, aborting.\n");
+                err = -ENODEV;
+                goto err_out_disable_pdev;
+        }
+
+        dev = alloc_etherdev(sizeof(*cp));
+        if (!dev) {
+                printk(KERN_ERR PFX "Etherdev alloc failed, aborting.\n");
+                err = -ENOMEM;
+                goto err_out_disable_pdev;
+        }
+        SET_MODULE_OWNER(dev);
+        SET_NETDEV_DEV(dev, &pdev->dev);
+
+        err = pci_request_regions(pdev, dev->name);
+        if (err) {
+                printk(KERN_ERR PFX "Cannot obtain PCI resources, "
+                       "aborting.\n");
+                goto err_out_free_netdev;
+        }
+        pci_set_master(pdev);
+
+        /* we must always turn on parity response or else parity
+         * doesn't get generated properly. disable SERR/PERR as well.
+         * in addition, we want to turn MWI on.
+         */
+        pci_read_config_word(pdev, PCI_COMMAND, &pci_cmd);
+        pci_cmd &= ~PCI_COMMAND_SERR;
+        pci_cmd |= PCI_COMMAND_PARITY;
+        pci_write_config_word(pdev, PCI_COMMAND, pci_cmd);
+        pci_set_mwi(pdev);
+        /*
+         * On some architectures, the default cache line size set
+         * by pci_set_mwi reduces perforamnce.  We have to increase
+         * it for this case.  To start, we'll print some configuration
+         * data.
+         */
+#if 1
+        pci_read_config_byte(pdev, PCI_CACHE_LINE_SIZE,
+                             &orig_cacheline_size);
+        if (orig_cacheline_size < CAS_PREF_CACHELINE_SIZE) {
+                cas_cacheline_size = 
+                        (CAS_PREF_CACHELINE_SIZE < SMP_CACHE_BYTES) ? 
+                        CAS_PREF_CACHELINE_SIZE : SMP_CACHE_BYTES;
+                if (pci_write_config_byte(pdev, 
+                                          PCI_CACHE_LINE_SIZE, 
+                                          cas_cacheline_size)) {
+                        printk(KERN_ERR PFX "Could not set PCI cache "
+                               "line size\n");
+                        goto err_write_cacheline;
+                }
+        }
+#endif
+
+
+        /* Configure DMA attributes. */
+        if (!pci_set_dma_mask(pdev, DMA_64BIT_MASK)) {
+                pci_using_dac = 1;
+                err = pci_set_consistent_dma_mask(pdev,
+                                                  DMA_64BIT_MASK);
+                if (err < 0) {
+                        printk(KERN_ERR PFX "Unable to obtain 64-bit DMA "
+                               "for consistent allocations\n");
+                        goto err_out_free_res;
+                }
+
+        } else {
+                err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
+                if (err) {
+                        printk(KERN_ERR PFX "No usable DMA configuration, "
+                               "aborting.\n");
+                        goto err_out_free_res;
+                }
+                pci_using_dac = 0;
+        }
+
+        casreg_base = pci_resource_start(pdev, 0);
+        casreg_len = pci_resource_len(pdev, 0);
+
+        cp = netdev_priv(dev);
+        cp->pdev = pdev;
+#if 1
+        /* A value of 0 indicates we never explicitly set it */
+        cp->orig_cacheline_size = cas_cacheline_size ? orig_cacheline_size: 0;
+#endif
+        cp->dev = dev;
+        cp->msg_enable = (cassini_debug < 0) ? CAS_DEF_MSG_ENABLE : 
+          cassini_debug;
+
+        cp->link_transition = LINK_TRANSITION_UNKNOWN;
+        cp->link_transition_jiffies_valid = 0;
+
+        spin_lock_init(&cp->lock);
+        spin_lock_init(&cp->rx_inuse_lock);
+        spin_lock_init(&cp->rx_spare_lock);
+        for (i = 0; i < N_TX_RINGS; i++) {
+                spin_lock_init(&cp->stat_lock[i]);
+                spin_lock_init(&cp->tx_lock[i]);
+        }
+        spin_lock_init(&cp->stat_lock[N_TX_RINGS]);
+        init_MUTEX(&cp->pm_sem);
+
+        init_timer(&cp->link_timer);
+        cp->link_timer.function = cas_link_timer;
+        cp->link_timer.data = (unsigned long) cp;
+
+#if 1
+        /* Just in case the implementation of atomic operations
+         * change so that an explicit initialization is necessary.
+         */
+        atomic_set(&cp->reset_task_pending, 0);
+        atomic_set(&cp->reset_task_pending_all, 0);
+        atomic_set(&cp->reset_task_pending_spare, 0);
+        atomic_set(&cp->reset_task_pending_mtu, 0);
+#endif
+        INIT_WORK(&cp->reset_task, cas_reset_task, cp);
+
+        /* Default link parameters */
+        if (link_mode >= 0 && link_mode <= 6)
+                cp->link_cntl = link_modes[link_mode];
+        else
+                cp->link_cntl = BMCR_ANENABLE;
+        cp->lstate = link_down;
+        cp->link_transition = LINK_TRANSITION_LINK_DOWN;
+        netif_carrier_off(cp->dev);
+        cp->timer_ticks = 0;
+
+        /* give us access to cassini registers */
+        cp->regs = ioremap(casreg_base, casreg_len);
+        if (cp->regs == 0UL) {
+                printk(KERN_ERR PFX "Cannot map device registers, "
+                       "aborting.\n");
+                goto err_out_free_res;
+        }
+        cp->casreg_len = casreg_len;
+
+        pci_save_state(pdev);
+        cas_check_pci_invariants(cp);
+        cas_hard_reset(cp);
+        cas_reset(cp, 0);
+        if (cas_check_invariants(cp))
+                goto err_out_iounmap;
+
+        cp->init_block = (struct cas_init_block *)
+                pci_alloc_consistent(pdev, sizeof(struct cas_init_block),
+                                     &cp->block_dvma);
+        if (!cp->init_block) {
+                printk(KERN_ERR PFX "Cannot allocate init block, "
+                       "aborting.\n");
+                goto err_out_iounmap;
+        }
+
+        for (i = 0; i < N_TX_RINGS; i++) 
+                cp->init_txds[i] = cp->init_block->txds[i];
+
+        for (i = 0; i < N_RX_DESC_RINGS; i++) 
+                cp->init_rxds[i] = cp->init_block->rxds[i];
+
+        for (i = 0; i < N_RX_COMP_RINGS; i++) 
+                cp->init_rxcs[i] = cp->init_block->rxcs[i];
+
+        for (i = 0; i < N_RX_FLOWS; i++)
+                skb_queue_head_init(&cp->rx_flows[i]);
+
+        dev->open = cas_open;
+        dev->stop = cas_close;
+        dev->hard_start_xmit = cas_start_xmit;
+        dev->get_stats = cas_get_stats;
+        dev->set_multicast_list = cas_set_multicast;
+        dev->do_ioctl = cas_ioctl;
+        dev->ethtool_ops = &cas_ethtool_ops;
+        dev->tx_timeout = cas_tx_timeout;
+        dev->watchdog_timeo = CAS_TX_TIMEOUT;
+        dev->change_mtu = cas_change_mtu;
+#ifdef USE_NAPI
+        dev->poll = cas_poll;
+        dev->weight = 64;
+#endif
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        dev->poll_controller = cas_netpoll;
+#endif
+        dev->irq = pdev->irq;
+        dev->dma = 0;
+
+        /* Cassini features. */
+        if ((cp->cas_flags & CAS_FLAG_NO_HW_CSUM) == 0)
+                dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
+
+        if (pci_using_dac)
+                dev->features |= NETIF_F_HIGHDMA;
+
+        if (register_netdev(dev)) {
+                printk(KERN_ERR PFX "Cannot register net device, "
+                       "aborting.\n");
+                goto err_out_free_consistent;
+        }
+
+        i = readl(cp->regs + REG_BIM_CFG);
+        printk(KERN_INFO "%s: Sun Cassini%s (%sbit/%sMHz PCI/%s) "
+               "Ethernet[%d] ",  dev->name, 
+               (cp->cas_flags & CAS_FLAG_REG_PLUS) ? "+" : "", 
+               (i & BIM_CFG_32BIT) ? "32" : "64",
+               (i & BIM_CFG_66MHZ) ? "66" : "33",
+               (cp->phy_type == CAS_PHY_SERDES) ? "Fi" : "Cu", pdev->irq); 
+
+        for (i = 0; i < 6; i++)
+                printk("%2.2x%c", dev->dev_addr[i],
+                       i == 5 ? ' ' : ':');
+        printk("\n");
+
+        pci_set_drvdata(pdev, dev);
+        cp->hw_running = 1;
+        cas_entropy_reset(cp);
+        cas_phy_init(cp);
+        cas_begin_auto_negotiation(cp, NULL);
+        return 0;
+
+err_out_free_consistent:
+        pci_free_consistent(pdev, sizeof(struct cas_init_block),
+                            cp->init_block, cp->block_dvma);
+
+err_out_iounmap:
+        down(&cp->pm_sem);
+        if (cp->hw_running)
+                cas_shutdown(cp);
+        up(&cp->pm_sem);
+
+        iounmap(cp->regs);
+
+
+err_out_free_res:
+        pci_release_regions(pdev);
+
+err_write_cacheline:
+        /* Try to restore it in case the error occured after we
+         * set it. 
+         */
+        pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, orig_cacheline_size);
+
+err_out_free_netdev:
+        free_netdev(dev);
+
+err_out_disable_pdev:
+        pci_disable_device(pdev);
+        pci_set_drvdata(pdev, NULL);
+        return -ENODEV;
+}
+
+static void __devexit cas_remove_one(struct pci_dev *pdev)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+        struct cas *cp;
+        if (!dev)
+                return;
+
+        cp = netdev_priv(dev);
+        unregister_netdev(dev);
+
+        down(&cp->pm_sem);
+        flush_scheduled_work();
+        if (cp->hw_running)
+                cas_shutdown(cp);
+        up(&cp->pm_sem);
+
+#if 1
+        if (cp->orig_cacheline_size) {
+                /* Restore the cache line size if we had modified
+                 * it.
+                 */
+                pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, 
+                                      cp->orig_cacheline_size);
+        }
+#endif
+        pci_free_consistent(pdev, sizeof(struct cas_init_block),
+                            cp->init_block, cp->block_dvma);
+        iounmap(cp->regs);
+        free_netdev(dev);
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+        pci_set_drvdata(pdev, NULL);
+}
+
+#ifdef CONFIG_PM
+static int cas_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+        struct cas *cp = netdev_priv(dev);
+        unsigned long flags;
+
+        /* We hold the PM semaphore during entire driver
+         * sleep time
+         */
+        down(&cp->pm_sem);
+        
+        /* If the driver is opened, we stop the DMA */
+        if (cp->opened) {
+                netif_device_detach(dev);
+
+                cas_lock_all_save(cp, flags);
+
+                /* We can set the second arg of cas_reset to 0
+                 * because on resume, we'll call cas_init_hw with
+                 * its second arg set so that autonegotiation is
+                 * restarted.
+                 */
+                cas_reset(cp, 0);
+                cas_clean_rings(cp);
+                cas_unlock_all_restore(cp, flags);
+        }
+
+        if (cp->hw_running)
+                cas_shutdown(cp);
+
+        return 0;
+}
+
+static int cas_resume(struct pci_dev *pdev)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+        struct cas *cp = netdev_priv(dev);
+
+        printk(KERN_INFO "%s: resuming\n", dev->name);
+
+        cas_hard_reset(cp);
+        if (cp->opened) {
+                unsigned long flags;
+                cas_lock_all_save(cp, flags);
+                cas_reset(cp, 0);
+                cp->hw_running = 1;
+                cas_clean_rings(cp);
+                cas_init_hw(cp, 1);
+                cas_unlock_all_restore(cp, flags);
+
+                netif_device_attach(dev);
+        }
+        up(&cp->pm_sem);
+        return 0;
+}
+#endif /* CONFIG_PM */
+
+static struct pci_driver cas_driver = {
+        .name           = DRV_MODULE_NAME,
+        .id_table       = cas_pci_tbl,
+        .probe          = cas_init_one,
+        .remove         = __devexit_p(cas_remove_one),
+#ifdef CONFIG_PM
+        .suspend        = cas_suspend,
+        .resume         = cas_resume
+#endif
+};
+
+static int __init cas_init(void)
+{
+        if (linkdown_timeout > 0)
+                link_transition_timeout = linkdown_timeout * HZ;
+        else
+                link_transition_timeout = 0;
+
+        return pci_module_init(&cas_driver);
+}
+
+static void __exit cas_cleanup(void)
+{
+        pci_unregister_driver(&cas_driver);
+}
+
+module_init(cas_init);
+module_exit(cas_cleanup);
diff --git a/drivers/net/cassini.h b/drivers/net/cassini.h
new file mode 100644
index 000000000000..88063ef16cf6
--- /dev/null
+++ b/drivers/net/cassini.h
@@ -0,0 +1,4425 @@
+/* $Id: cassini.h,v 1.16 2004/08/17 21:15:16 zaumen Exp $
+ * cassini.h: Definitions for Sun Microsystems Cassini(+) ethernet driver.
+ *
+ * Copyright (C) 2004 Sun Microsystems Inc.
+ * Copyright (c) 2003 Adrian Sun (asun@darksunrising.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ *
+ * vendor id: 0x108E (Sun Microsystems, Inc.)
+ * device id: 0xabba (Cassini)
+ * revision ids: 0x01 = Cassini 
+ *               0x02 = Cassini rev 2
+ *               0x10 = Cassini+
+ *               0x11 = Cassini+ 0.2u
+ *
+ * vendor id: 0x100b (National Semiconductor)
+ * device id: 0x0035 (DP83065/Saturn)
+ * revision ids: 0x30 = Saturn B2
+ *
+ * rings are all offset from 0.
+ *
+ * there are two clock domains:
+ * PCI:  33/66MHz clock
+ * chip: 125MHz clock
+ */
+
+#ifndef _CASSINI_H
+#define _CASSINI_H
+
+/* cassini register map: 2M memory mapped in 32-bit memory space accessible as
+ * 32-bit words. there is no i/o port access. REG_ addresses are
+ * shared between cassini and cassini+. REG_PLUS_ addresses only
+ * appear in cassini+. REG_MINUS_ addresses only appear in cassini.
+ */
+#define CAS_ID_REV2          0x02
+#define CAS_ID_REVPLUS       0x10 
+#define CAS_ID_REVPLUS02u    0x11 
+#define CAS_ID_REVSATURNB2   0x30
+
+/** global resources **/
+
+/* this register sets the weights for the weighted round robin arbiter. e.g.,
+ * if rx weight == 1 and tx weight == 0, rx == 2x tx transfer credit
+ * for its next turn to access the pci bus. 
+ * map: 0x0 = x1, 0x1 = x2, 0x2 = x4, 0x3 = x8 
+ * DEFAULT: 0x0, SIZE: 5 bits
+ */
+#define  REG_CAWR                      0x0004  /* core arbitration weight */
+#define    CAWR_RX_DMA_WEIGHT_SHIFT    0
+#define    CAWR_RX_DMA_WEIGHT_MASK     0x03    /* [0:1] */
+#define    CAWR_TX_DMA_WEIGHT_SHIFT    2
+#define    CAWR_TX_DMA_WEIGHT_MASK     0x0C    /* [3:2] */
+#define    CAWR_RR_DIS                 0x10    /* [4] */
+
+/* if enabled, BIM can send bursts across PCI bus > cacheline size. burst
+ * sizes determined by length of packet or descriptor transfer and the 
+ * max length allowed by the target. 
+ * DEFAULT: 0x0, SIZE: 1 bit
+ */
+#define  REG_INF_BURST                 0x0008  /* infinite burst enable reg */
+#define    INF_BURST_EN                0x1     /* enable */
+
+/* top level interrupts [0-9] are auto-cleared to 0 when the status
+ * register is read. second level interrupts [13 - 18] are cleared at
+ * the source. tx completion register 3 is replicated in [19 - 31] 
+ * DEFAULT: 0x00000000, SIZE: 29 bits
+ */
+#define  REG_INTR_STATUS               0x000C  /* interrupt status register */
+#define    INTR_TX_INTME               0x00000001  /* frame w/ INT ME desc bit set 
+                                                      xferred from host queue to
+                                                      TX FIFO */
+#define    INTR_TX_ALL                 0x00000002  /* all xmit frames xferred into
+                                                      TX FIFO. i.e.,
+                                                      TX Kick == TX complete. if 
+                                                      PACED_MODE set, then TX FIFO
+                                                      also empty */
+#define    INTR_TX_DONE                0x00000004  /* any frame xferred into tx 
+                                                      FIFO */
+#define    INTR_TX_TAG_ERROR           0x00000008  /* TX FIFO tag framing 
+                                                      corrupted. FATAL ERROR */
+#define    INTR_RX_DONE                0x00000010  /* at least 1 frame xferred
+                                                      from RX FIFO to host mem.
+                                                      RX completion reg updated.
+                                                      may be delayed by recv
+                                                      intr blanking. */
+#define    INTR_RX_BUF_UNAVAIL         0x00000020  /* no more receive buffers.
+                                                      RX Kick == RX complete */
+#define    INTR_RX_TAG_ERROR           0x00000040  /* RX FIFO tag framing 
+                                                      corrupted. FATAL ERROR */
+#define    INTR_RX_COMP_FULL           0x00000080  /* no more room in completion
+                                                      ring to post descriptors.
+                                                      RX complete head incr to
+                                                      almost reach RX complete
+                                                      tail */
+#define    INTR_RX_BUF_AE              0x00000100  /* less than the 
+                                                      programmable threshold #
+                                                      of free descr avail for
+                                                      hw use */
+#define    INTR_RX_COMP_AF             0x00000200  /* less than the 
+                                                      programmable threshold #
+                                                      of descr spaces for hw
+                                                      use in completion descr
+                                                      ring */
+#define    INTR_RX_LEN_MISMATCH        0x00000400  /* len field from MAC !=
+                                                      len of non-reassembly pkt
+                                                      from fifo during DMA or
+                                                      header parser provides TCP
+                                                      header and payload size >
+                                                      MAC packet size. 
+                                                      FATAL ERROR */
+#define    INTR_SUMMARY                0x00001000  /* summary interrupt bit. this
+                                                      bit will be set if an interrupt 
+                                                      generated on the pci bus. useful
+                                                      when driver is polling for 
+                                                      interrupts */
+#define    INTR_PCS_STATUS             0x00002000  /* PCS interrupt status register */
+#define    INTR_TX_MAC_STATUS          0x00004000  /* TX MAC status register has at 
+                                                      least 1 unmasked interrupt set */
+#define    INTR_RX_MAC_STATUS          0x00008000  /* RX MAC status register has at 
+                                                      least 1 unmasked interrupt set */
+#define    INTR_MAC_CTRL_STATUS        0x00010000  /* MAC control status register has
+                                                      at least 1 unmasked interrupt
+                                                      set */
+#define    INTR_MIF_STATUS             0x00020000  /* MIF status register has at least
+                                                      1 unmasked interrupt set */
+#define    INTR_PCI_ERROR_STATUS       0x00040000  /* PCI error status register in the
+                                                      BIF has at least 1 unmasked 
+                                                      interrupt set */
+#define    INTR_TX_COMP_3_MASK         0xFFF80000  /* mask for TX completion 
+                                                      3 reg data */
+#define    INTR_TX_COMP_3_SHIFT        19
+#define    INTR_ERROR_MASK (INTR_MIF_STATUS | INTR_PCI_ERROR_STATUS | \
+                            INTR_PCS_STATUS | INTR_RX_LEN_MISMATCH | \
+                            INTR_TX_MAC_STATUS | INTR_RX_MAC_STATUS | \
+                            INTR_TX_TAG_ERROR | INTR_RX_TAG_ERROR | \
+                            INTR_MAC_CTRL_STATUS)
+
+/* determines which status events will cause an interrupt. layout same
+ * as REG_INTR_STATUS. 
+ * DEFAULT: 0xFFFFFFFF, SIZE: 16 bits
+ */
+#define  REG_INTR_MASK                 0x0010  /* Interrupt mask */
+
+/* top level interrupt bits that are cleared during read of REG_INTR_STATUS_ALIAS.
+ * useful when driver is polling for interrupts. layout same as REG_INTR_MASK.
+ * DEFAULT: 0x00000000, SIZE: 12 bits
+ */
+#define  REG_ALIAS_CLEAR               0x0014  /* alias clear mask 
+                                                  (used w/ status alias) */
+/* same as REG_INTR_STATUS except that only bits cleared are those selected by
+ * REG_ALIAS_CLEAR 
+ * DEFAULT: 0x00000000, SIZE: 29 bits
+ */
+#define  REG_INTR_STATUS_ALIAS         0x001C  /* interrupt status alias 
+                                                  (selective clear) */
+
+/* DEFAULT: 0x0, SIZE: 3 bits */
+#define  REG_PCI_ERR_STATUS            0x1000  /* PCI error status */
+#define    PCI_ERR_BADACK              0x01    /* reserved in Cassini+. 
+                                                  set if no ACK64# during ABS64 cycle
+                                                  in Cassini. */
+#define    PCI_ERR_DTRTO               0x02    /* delayed xaction timeout. set if
+                                                  no read retry after 2^15 clocks */
+#define    PCI_ERR_OTHER               0x04    /* other PCI errors */
+#define    PCI_ERR_BIM_DMA_WRITE       0x08    /* BIM received 0 count DMA write req.
+                                                  unused in Cassini. */
+#define    PCI_ERR_BIM_DMA_READ        0x10    /* BIM received 0 count DMA read req.
+                                                  unused in Cassini. */
+#define    PCI_ERR_BIM_DMA_TIMEOUT     0x20    /* BIM received 255 retries during 
+                                                  DMA. unused in cassini. */
+
+/* mask for PCI status events that will set PCI_ERR_STATUS. if cleared, event
+ * causes an interrupt to be generated. 
+ * DEFAULT: 0x7, SIZE: 3 bits
+ */
+#define  REG_PCI_ERR_STATUS_MASK       0x1004  /* PCI Error status mask */
+
+/* used to configure PCI related parameters that are not in PCI config space. 
+ * DEFAULT: 0bxx000, SIZE: 5 bits
+ */
+#define  REG_BIM_CFG                0x1008  /* BIM Configuration */
+#define    BIM_CFG_RESERVED0        0x001   /* reserved */
+#define    BIM_CFG_RESERVED1        0x002   /* reserved */
+#define    BIM_CFG_64BIT_DISABLE    0x004   /* disable 64-bit mode */
+#define    BIM_CFG_66MHZ            0x008   /* (ro) 1 = 66MHz, 0 = < 66MHz */
+#define    BIM_CFG_32BIT            0x010   /* (ro) 1 = 32-bit slot, 0 = 64-bit */
+#define    BIM_CFG_DPAR_INTR_ENABLE 0x020   /* detected parity err enable */
+#define    BIM_CFG_RMA_INTR_ENABLE  0x040   /* master abort intr enable */
+#define    BIM_CFG_RTA_INTR_ENABLE  0x080   /* target abort intr enable */
+#define    BIM_CFG_RESERVED2        0x100   /* reserved */
+#define    BIM_CFG_BIM_DISABLE      0x200   /* stop BIM DMA. use before global 
+                                               reset. reserved in Cassini. */
+#define    BIM_CFG_BIM_STATUS       0x400   /* (ro) 1 = BIM DMA suspended.
+                                                  reserved in Cassini. */
+#define    BIM_CFG_PERROR_BLOCK     0x800  /* block PERR# to pci bus. def: 0.
+                                                 reserved in Cassini. */
+
+/* DEFAULT: 0x00000000, SIZE: 32 bits */
+#define  REG_BIM_DIAG                  0x100C  /* BIM Diagnostic */
+#define    BIM_DIAG_MSTR_SM_MASK       0x3FFFFF00 /* PCI master controller state
+                                                     machine bits [21:0] */
+#define    BIM_DIAG_BRST_SM_MASK       0x7F    /* PCI burst controller state 
+                                                  machine bits [6:0] */
+
+/* writing to SW_RESET_TX and SW_RESET_RX will issue a global
+ * reset. poll until TX and RX read back as 0's for completion.
+ */
+#define  REG_SW_RESET                  0x1010  /* Software reset */
+#define    SW_RESET_TX                 0x00000001  /* reset TX DMA engine. poll until
+                                                      cleared to 0.  */
+#define    SW_RESET_RX                 0x00000002  /* reset RX DMA engine. poll until
+                                                      cleared to 0. */
+#define    SW_RESET_RSTOUT             0x00000004  /* force RSTOUT# pin active (low).
+                                                      resets PHY and anything else 
+                                                      connected to RSTOUT#. RSTOUT#
+                                                      is also activated by local PCI
+                                                      reset when hot-swap is being 
+                                                      done. */
+#define    SW_RESET_BLOCK_PCS_SLINK    0x00000008  /* if a global reset is done with 
+                                                      this bit set, PCS and SLINK 
+                                                      modules won't be reset. 
+                                                      i.e., link won't drop. */
+#define    SW_RESET_BREQ_SM_MASK       0x00007F00  /* breq state machine [6:0] */
+#define    SW_RESET_PCIARB_SM_MASK     0x00070000  /* pci arbitration state bits:
+                                                      0b000: ARB_IDLE1
+                                                      0b001: ARB_IDLE2
+                                                      0b010: ARB_WB_ACK
+                                                      0b011: ARB_WB_WAT
+                                                      0b100: ARB_RB_ACK
+                                                      0b101: ARB_RB_WAT
+                                                      0b110: ARB_RB_END
+                                                      0b111: ARB_WB_END */
+#define    SW_RESET_RDPCI_SM_MASK      0x00300000  /* read pci state bits:
+                                                      0b00: RD_PCI_WAT
+                                                      0b01: RD_PCI_RDY
+                                                      0b11: RD_PCI_ACK */
+#define    SW_RESET_RDARB_SM_MASK      0x00C00000  /* read arbitration state bits:
+                                                      0b00: AD_IDL_RX
+                                                      0b01: AD_ACK_RX
+                                                      0b10: AD_ACK_TX
+                                                      0b11: AD_IDL_TX */
+#define    SW_RESET_WRPCI_SM_MASK      0x06000000  /* write pci state bits 
+                                                      0b00: WR_PCI_WAT
+                                                      0b01: WR_PCI_RDY
+                                                      0b11: WR_PCI_ACK */
+#define    SW_RESET_WRARB_SM_MASK      0x38000000  /* write arbitration state bits:
+                                                      0b000: ARB_IDLE1
+                                                      0b001: ARB_IDLE2
+                                                      0b010: ARB_TX_ACK
+                                                      0b011: ARB_TX_WAT
+                                                      0b100: ARB_RX_ACK
+                                                      0b110: ARB_RX_WAT */
+
+/* Cassini only. 64-bit register used to check PCI datapath. when read,
+ * value written has both lower and upper 32-bit halves rotated to the right
+ * one bit position. e.g., FFFFFFFF FFFFFFFF -> 7FFFFFFF 7FFFFFFF
+ */
+#define  REG_MINUS_BIM_DATAPATH_TEST   0x1018  /* Cassini: BIM datapath test 
+                                                  Cassini+: reserved */
+
+/* output enables are provided for each device's chip select and for the rest
+ * of the outputs from cassini to its local bus devices. two sw programmable
+ * bits are connected to general purpus control/status bits.
+ * DEFAULT: 0x7
+ */
+#define  REG_BIM_LOCAL_DEV_EN          0x1020  /* BIM local device 
+                                                  output EN. default: 0x7 */
+#define    BIM_LOCAL_DEV_PAD           0x01    /* address bus, RW signal, and
+                                                  OE signal output enable on the
+                                                  local bus interface. these
+                                                  are shared between both local 
+                                                  bus devices. tristate when 0. */
+#define    BIM_LOCAL_DEV_PROM          0x02    /* PROM chip select */
+#define    BIM_LOCAL_DEV_EXT           0x04    /* secondary local bus device chip
+                                                  select output enable */
+#define    BIM_LOCAL_DEV_SOFT_0        0x08    /* sw programmable ctrl bit 0 */
+#define    BIM_LOCAL_DEV_SOFT_1        0x10    /* sw programmable ctrl bit 1 */
+#define    BIM_LOCAL_DEV_HW_RESET      0x20    /* internal hw reset. Cassini+ only. */
+
+/* access 24 entry BIM read and write buffers. put address in REG_BIM_BUFFER_ADDR
+ * and read/write from/to it REG_BIM_BUFFER_DATA_LOW and _DATA_HI. 
+ * _DATA_HI should be the last access of the sequence. 
+ * DEFAULT: undefined
+ */
+#define  REG_BIM_BUFFER_ADDR           0x1024  /* BIM buffer address. for
+                                                  purposes. */
+#define    BIM_BUFFER_ADDR_MASK        0x3F    /* index (0 - 23) of buffer  */
+#define    BIM_BUFFER_WR_SELECT        0x40    /* write buffer access = 1
+                                                  read buffer access = 0 */
+/* DEFAULT: undefined */
+#define  REG_BIM_BUFFER_DATA_LOW       0x1028  /* BIM buffer data low */
+#define  REG_BIM_BUFFER_DATA_HI        0x102C  /* BIM buffer data high */
+
+/* set BIM_RAM_BIST_START to start built-in self test for BIM read buffer. 
+ * bit auto-clears when done with status read from _SUMMARY and _PASS bits.
+ */
+#define  REG_BIM_RAM_BIST              0x102C  /* BIM RAM (read buffer) BIST 
+                                                  control/status */
+#define    BIM_RAM_BIST_RD_START       0x01    /* start BIST for BIM read buffer */
+#define    BIM_RAM_BIST_WR_START       0x02    /* start BIST for BIM write buffer.
+                                                  Cassini only. reserved in
+                                                  Cassini+. */
+#define    BIM_RAM_BIST_RD_PASS        0x04    /* summary BIST pass status for read
+                                                  buffer. */
+#define    BIM_RAM_BIST_WR_PASS        0x08    /* summary BIST pass status for write
+                                                  buffer. Cassini only. reserved
+                                                  in Cassini+. */
+#define    BIM_RAM_BIST_RD_LOW_PASS    0x10    /* read low bank passes BIST */
+#define    BIM_RAM_BIST_RD_HI_PASS     0x20    /* read high bank passes BIST */
+#define    BIM_RAM_BIST_WR_LOW_PASS    0x40    /* write low bank passes BIST.
+                                                  Cassini only. reserved in 
+                                                  Cassini+. */
+#define    BIM_RAM_BIST_WR_HI_PASS     0x80    /* write high bank passes BIST.
+                                                  Cassini only. reserved in
+                                                  Cassini+. */
+
+/* ASUN: i'm not sure what this does as it's not in the spec.
+ * DEFAULT: 0xFC
+ */
+#define  REG_BIM_DIAG_MUX              0x1030  /* BIM diagnostic probe mux
+                                                  select register */
+
+/* enable probe monitoring mode and select data appearing on the P_A* bus. bit 
+ * values for _SEL_HI_MASK and _SEL_LOW_MASK:
+ * 0x0: internal probe[7:0] (pci arb state, wtc empty w, wtc full w, wtc empty w,
+ *                           wtc empty r, post pci)
+ * 0x1: internal probe[15:8] (pci wbuf comp, pci wpkt comp, pci rbuf comp,
+ *                            pci rpkt comp, txdma wr req, txdma wr ack,
+ *                            txdma wr rdy, txdma wr xfr done)
+ * 0x2: internal probe[23:16] (txdma rd req, txdma rd ack, txdma rd rdy, rxdma rd,
+ *                             rd arb state, rd pci state)
+ * 0x3: internal probe[31:24] (rxdma req, rxdma ack, rxdma rdy, wrarb state,
+ *                             wrpci state)
+ * 0x4: pci io probe[7:0]     0x5: pci io probe[15:8]
+ * 0x6: pci io probe[23:16]   0x7: pci io probe[31:24]
+ * 0x8: pci io probe[39:32]   0x9: pci io probe[47:40]
+ * 0xa: pci io probe[55:48]   0xb: pci io probe[63:56]
+ * the following are not available in Cassini:
+ * 0xc: rx probe[7:0]         0xd: tx probe[7:0]
+ * 0xe: hp probe[7:0]         0xf: mac probe[7:0]
+ */
+#define  REG_PLUS_PROBE_MUX_SELECT     0x1034 /* Cassini+: PROBE MUX SELECT */
+#define    PROBE_MUX_EN                0x80000000 /* allow probe signals to be 
+                                                     driven on local bus P_A[15:0]
+                                                     for debugging */
+#define    PROBE_MUX_SUB_MUX_MASK      0x0000FF00 /* select sub module probe signals:
+                                                     0x03 = mac[1:0]
+                                                     0x0C = rx[1:0]
+                                                     0x30 = tx[1:0]
+                                                     0xC0 = hp[1:0] */
+#define    PROBE_MUX_SEL_HI_MASK       0x000000F0 /* select which module to appear
+                                                     on P_A[15:8]. see above for 
+                                                     values. */
+#define    PROBE_MUX_SEL_LOW_MASK      0x0000000F /* select which module to appear
+                                                     on P_A[7:0]. see above for 
+                                                     values. */
+
+/* values mean the same thing as REG_INTR_MASK excep that it's for INTB. 
+ DEFAULT: 0x1F */
+#define  REG_PLUS_INTR_MASK_1          0x1038 /* Cassini+: interrupt mask
+                                                 register 2 for INTB */
+#define  REG_PLUS_INTRN_MASK(x)       (REG_PLUS_INTR_MASK_1 + ((x) - 1)*16)
+/* bits correspond to both _MASK and _STATUS registers. _ALT corresponds to 
+ * all of the alternate (2-4) INTR registers while _1 corresponds to only 
+ * _MASK_1 and _STATUS_1 registers. 
+ * DEFAULT: 0x7 for MASK registers, 0x0 for ALIAS_CLEAR registers
+ */
+#define    INTR_RX_DONE_ALT              0x01  
+#define    INTR_RX_COMP_FULL_ALT         0x02
+#define    INTR_RX_COMP_AF_ALT           0x04
+#define    INTR_RX_BUF_UNAVAIL_1         0x08
+#define    INTR_RX_BUF_AE_1              0x10 /* almost empty */
+#define    INTRN_MASK_RX_EN              0x80     
+#define    INTRN_MASK_CLEAR_ALL          (INTR_RX_DONE_ALT | \
+                                          INTR_RX_COMP_FULL_ALT | \
+                                          INTR_RX_COMP_AF_ALT | \
+                                          INTR_RX_BUF_UNAVAIL_1 | \
+                                          INTR_RX_BUF_AE_1)
+#define  REG_PLUS_INTR_STATUS_1        0x103C /* Cassini+: interrupt status
+                                                 register 2 for INTB. default: 0x1F */
+#define  REG_PLUS_INTRN_STATUS(x)       (REG_PLUS_INTR_STATUS_1 + ((x) - 1)*16)
+#define    INTR_STATUS_ALT_INTX_EN     0x80   /* generate INTX when one of the
+                                                 flags are set. enables desc ring. */
+
+#define  REG_PLUS_ALIAS_CLEAR_1        0x1040 /* Cassini+: alias clear mask
+                                                 register 2 for INTB */
+#define  REG_PLUS_ALIASN_CLEAR(x)      (REG_PLUS_ALIAS_CLEAR_1 + ((x) - 1)*16)
+
+#define  REG_PLUS_INTR_STATUS_ALIAS_1  0x1044 /* Cassini+: interrupt status 
+                                                 register alias 2 for INTB */
+#define  REG_PLUS_INTRN_STATUS_ALIAS(x) (REG_PLUS_INTR_STATUS_ALIAS_1 + ((x) - 1)*16)
+
+#define REG_SATURN_PCFG               0x106c /* pin configuration register for
+                                                integrated macphy */
+
+#define   SATURN_PCFG_TLA             0x00000001 /* 1 = phy actled */
+#define   SATURN_PCFG_FLA             0x00000002 /* 1 = phy link10led */
+#define   SATURN_PCFG_CLA             0x00000004 /* 1 = phy link100led */
+#define   SATURN_PCFG_LLA             0x00000008 /* 1 = phy link1000led */
+#define   SATURN_PCFG_RLA             0x00000010 /* 1 = phy duplexled */
+#define   SATURN_PCFG_PDS             0x00000020 /* phy debug mode. 
+                                                    0 = normal */
+#define   SATURN_PCFG_MTP             0x00000080 /* test point select */ 
+#define   SATURN_PCFG_GMO             0x00000100 /* GMII observe. 1 = 
+                                                    GMII on SERDES pins for
+                                                    monitoring. */
+#define   SATURN_PCFG_FSI             0x00000200 /* 1 = freeze serdes/gmii. all
+                                                    pins configed as outputs.
+                                                    for power saving when using
+                                                    internal phy. */
+#define   SATURN_PCFG_LAD             0x00000800 /* 0 = mac core led ctrl 
+                                                    polarity from strapping 
+                                                    value.
+                                                    1 = mac core led ctrl
+                                                    polarity active low. */
+
+
+/** transmit dma registers **/
+#define MAX_TX_RINGS_SHIFT            2
+#define MAX_TX_RINGS                  (1 << MAX_TX_RINGS_SHIFT)
+#define MAX_TX_RINGS_MASK             (MAX_TX_RINGS - 1)
+
+/* TX configuration. 
+ * descr ring sizes size = 32 * (1 << n), n < 9. e.g., 0x8 = 8k. default: 0x8 
+ * DEFAULT: 0x3F000001
+ */
+#define  REG_TX_CFG                    0x2004  /* TX config */
+#define    TX_CFG_DMA_EN               0x00000001  /* enable TX DMA. if cleared, DMA
+                                                      will stop after xfer of current
+                                                      buffer has been completed. */
+#define    TX_CFG_FIFO_PIO_SEL         0x00000002  /* TX DMA FIFO can be 
+                                                      accessed w/ FIFO addr 
+                                                      and data registers. 
+                                                      TX DMA should be 
+                                                      disabled. */
+#define    TX_CFG_DESC_RING0_MASK      0x0000003C  /* # desc entries in
+                                                      ring 1. */
+#define    TX_CFG_DESC_RING0_SHIFT     2
+#define    TX_CFG_DESC_RINGN_MASK(a)   (TX_CFG_DESC_RING0_MASK << (a)*4)
+#define    TX_CFG_DESC_RINGN_SHIFT(a)  (TX_CFG_DESC_RING0_SHIFT + (a)*4)
+#define    TX_CFG_PACED_MODE           0x00100000  /* TX_ALL only set after 
+                                                      TX FIFO becomes empty. 
+                                                      if 0, TX_ALL set
+                                                      if descr queue empty. */
+#define    TX_CFG_DMA_RDPIPE_DIS       0x01000000  /* always set to 1 */
+#define    TX_CFG_COMPWB_Q1            0x02000000  /* completion writeback happens at
+                                                      the end of every packet kicked
+                                                      through Q1. */
+#define    TX_CFG_COMPWB_Q2            0x04000000  /* completion writeback happens at
+                                                      the end of every packet kicked
+                                                      through Q2. */
+#define    TX_CFG_COMPWB_Q3            0x08000000  /* completion writeback happens at
+                                                      the end of every packet kicked
+                                                      through Q3 */
+#define    TX_CFG_COMPWB_Q4            0x10000000  /* completion writeback happens at
+                                                      the end of every packet kicked
+                                                      through Q4 */
+#define    TX_CFG_INTR_COMPWB_DIS      0x20000000  /* disable pre-interrupt completion
+                                                      writeback */
+#define    TX_CFG_CTX_SEL_MASK         0xC0000000  /* selects tx test port 
+                                                      connection
+                                                      0b00: tx mac req, 
+                                                            tx mac retry req,
+                                                            tx ack and tx tag.
+                                                      0b01: txdma rd req, 
+                                                            txdma rd ack,
+                                                            txdma rd rdy,
+                                                            txdma rd type0
+                                                      0b11: txdma wr req, 
+                                                            txdma wr ack,
+                                                            txdma wr rdy,
+                                                            txdma wr xfr done. */
+#define    TX_CFG_CTX_SEL_SHIFT        30
+                                                      
+/* 11-bit counters that point to next location in FIFO to be loaded/retrieved.
+ * used for diagnostics only.
+ */
+#define  REG_TX_FIFO_WRITE_PTR         0x2014  /* TX FIFO write pointer */
+#define  REG_TX_FIFO_SHADOW_WRITE_PTR  0x2018  /* TX FIFO shadow write 
+                                                  pointer. temp hold reg.
+                                                  diagnostics only. */
+#define  REG_TX_FIFO_READ_PTR          0x201C  /* TX FIFO read pointer */
+#define  REG_TX_FIFO_SHADOW_READ_PTR   0x2020  /* TX FIFO shadow read
+                                                  pointer */
+
+/* (ro) 11-bit up/down counter w/ # of frames currently in TX FIFO */
+#define  REG_TX_FIFO_PKT_CNT           0x2024  /* TX FIFO packet counter */
+
+/* current state of all state machines in TX */
+#define  REG_TX_SM_1                   0x2028  /* TX state machine reg #1 */
+#define    TX_SM_1_CHAIN_MASK          0x000003FF   /* chaining state machine */
+#define    TX_SM_1_CSUM_MASK           0x00000C00   /* checksum state machine */
+#define    TX_SM_1_FIFO_LOAD_MASK      0x0003F000   /* FIFO load state machine.
+                                                       = 0x01 when TX disabled. */
+#define    TX_SM_1_FIFO_UNLOAD_MASK    0x003C0000   /* FIFO unload state machine */
+#define    TX_SM_1_CACHE_MASK          0x03C00000   /* desc. prefetch cache controller
+                                                       state machine */
+#define    TX_SM_1_CBQ_ARB_MASK        0xF8000000   /* CBQ arbiter state machine */
+                                                         
+#define  REG_TX_SM_2                   0x202C  /* TX state machine reg #2 */
+#define    TX_SM_2_COMP_WB_MASK        0x07    /* completion writeback sm */
+#define    TX_SM_2_SUB_LOAD_MASK       0x38    /* sub load state machine */
+#define    TX_SM_2_KICK_MASK           0xC0    /* kick state machine */
+
+/* 64-bit pointer to the transmit data buffer. only the 50 LSB are incremented
+ * while the upper 23 bits are taken from the TX descriptor
+ */
+#define  REG_TX_DATA_PTR_LOW           0x2030  /* TX data pointer low */
+#define  REG_TX_DATA_PTR_HI            0x2034  /* TX data pointer high */
+
+/* 13 bit registers written by driver w/ descriptor value that follows 
+ * last valid xmit descriptor. kick # and complete # values are used by
+ * the xmit dma engine to control tx descr fetching. if > 1 valid 
+ * tx descr is available within the cache line being read, cassini will
+ * internally cache up to 4 of them. 0 on reset. _KICK = rw, _COMP = ro.
+ */
+#define  REG_TX_KICK0                  0x2038  /* TX kick reg #1 */
+#define  REG_TX_KICKN(x)               (REG_TX_KICK0 + (x)*4)
+#define  REG_TX_COMP0                  0x2048  /* TX completion reg #1 */
+#define  REG_TX_COMPN(x)               (REG_TX_COMP0 + (x)*4)
+
+/* values of TX_COMPLETE_1-4 are written. each completion register 
+ * is 2bytes in size and contiguous. 8B allocation w/ 8B alignment. 
+ * NOTE: completion reg values are only written back prior to TX_INTME and
+ * TX_ALL interrupts. at all other times, the most up-to-date index values 
+ * should be obtained from the REG_TX_COMPLETE_# registers. 
+ * here's the layout: 
+ * offset from base addr      completion # byte
+ *           0                TX_COMPLETE_1_MSB
+ *           1                TX_COMPLETE_1_LSB
+ *           2                TX_COMPLETE_2_MSB
+ *           3                TX_COMPLETE_2_LSB
+ *           4                TX_COMPLETE_3_MSB
+ *           5                TX_COMPLETE_3_LSB
+ *           6                TX_COMPLETE_4_MSB
+ *           7                TX_COMPLETE_4_LSB
+ */
+#define  TX_COMPWB_SIZE             8
+#define  REG_TX_COMPWB_DB_LOW       0x2058  /* TX completion write back
+                                               base low */
+#define  REG_TX_COMPWB_DB_HI        0x205C  /* TX completion write back
+                                               base high */
+#define    TX_COMPWB_MSB_MASK       0x00000000000000FFULL
+#define    TX_COMPWB_MSB_SHIFT      0
+#define    TX_COMPWB_LSB_MASK       0x000000000000FF00ULL
+#define    TX_COMPWB_LSB_SHIFT      8
+#define    TX_COMPWB_NEXT(x)        ((x) >> 16)
+                                                      
+/* 53 MSB used as base address. 11 LSB assumed to be 0. TX desc pointer must
+ * be 2KB-aligned. */
+#define  REG_TX_DB0_LOW         0x2060  /* TX descriptor base low #1 */
+#define  REG_TX_DB0_HI          0x2064  /* TX descriptor base hi #1 */
+#define  REG_TX_DBN_LOW(x)      (REG_TX_DB0_LOW + (x)*8)
+#define  REG_TX_DBN_HI(x)       (REG_TX_DB0_HI + (x)*8)
+
+/* 16-bit registers hold weights for the weighted round-robin of the
+ * four CBQ TX descr rings. weights correspond to # bytes xferred from
+ * host to TXFIFO in a round of WRR arbitration. can be set
+ * dynamically with new weights set upon completion of the current
+ * packet transfer from host memory to TXFIFO. a dummy write to any of
+ * these registers causes a queue1 pre-emption with all historical bw
+ * deficit data reset to 0 (useful when congestion requires a
+ * pre-emption/re-allocation of network bandwidth
+ */
+#define  REG_TX_MAXBURST_0             0x2080  /* TX MaxBurst #1 */
+#define  REG_TX_MAXBURST_1             0x2084  /* TX MaxBurst #2 */
+#define  REG_TX_MAXBURST_2             0x2088  /* TX MaxBurst #3 */
+#define  REG_TX_MAXBURST_3             0x208C  /* TX MaxBurst #4 */
+
+/* diagnostics access to any TX FIFO location. every access is 65
+ * bits.  _DATA_LOW = 32 LSB, _DATA_HI_T1/T0 = 32 MSB. _TAG = tag bit.
+ * writing _DATA_HI_T0 sets tag bit low, writing _DATA_HI_T1 sets tag
+ * bit high.  TX_FIFO_PIO_SEL must be set for TX FIFO PIO access. if
+ * TX FIFO data integrity is desired, TX DMA should be
+ * disabled. _DATA_HI_Tx should be the last access of the sequence.
+ */
+#define  REG_TX_FIFO_ADDR              0x2104  /* TX FIFO address */
+#define  REG_TX_FIFO_TAG               0x2108  /* TX FIFO tag */
+#define  REG_TX_FIFO_DATA_LOW          0x210C  /* TX FIFO data low */
+#define  REG_TX_FIFO_DATA_HI_T1        0x2110  /* TX FIFO data high t1 */
+#define  REG_TX_FIFO_DATA_HI_T0        0x2114  /* TX FIFO data high t0 */
+#define  REG_TX_FIFO_SIZE              0x2118  /* (ro) TX FIFO size = 0x090 = 9KB */
+
+/* 9-bit register controls BIST of TX FIFO. bit set indicates that the BIST 
+ * passed for the specified memory
+ */
+#define  REG_TX_RAMBIST                0x211C /* TX RAMBIST control/status */
+#define    TX_RAMBIST_STATE            0x01C0 /* progress state of RAMBIST 
+                                                 controller state machine */
+#define    TX_RAMBIST_RAM33A_PASS      0x0020 /* RAM33A passed */
+#define    TX_RAMBIST_RAM32A_PASS      0x0010 /* RAM32A passed */
+#define    TX_RAMBIST_RAM33B_PASS      0x0008 /* RAM33B passed */
+#define    TX_RAMBIST_RAM32B_PASS      0x0004 /* RAM32B passed */
+#define    TX_RAMBIST_SUMMARY          0x0002 /* all RAM passed */
+#define    TX_RAMBIST_START            0x0001 /* write 1 to start BIST. self
+                                                 clears on completion. */
+
+/** receive dma registers **/
+#define MAX_RX_DESC_RINGS              2
+#define MAX_RX_COMP_RINGS              4
+
+/* receive DMA channel configuration. default: 0x80910 
+ * free ring size       = (1 << n)*32  -> [32 - 8k]
+ * completion ring size = (1 << n)*128 -> [128 - 32k], n < 9 
+ * DEFAULT: 0x80910
+ */
+#define  REG_RX_CFG                     0x4000  /* RX config */
+#define    RX_CFG_DMA_EN                0x00000001 /* enable RX DMA. 0 stops
+                                                         channel as soon as current
+                                                         frame xfer has completed.
+                                                         driver should disable MAC 
+                                                         for 200ms before disabling 
+                                                         RX */
+#define    RX_CFG_DESC_RING_MASK        0x0000001E /* # desc entries in RX 
+                                                         free desc ring. 
+                                                         def: 0x8 = 8k */
+#define    RX_CFG_DESC_RING_SHIFT       1
+#define    RX_CFG_COMP_RING_MASK        0x000001E0 /* # desc entries in RX complete
+                                                         ring. def: 0x8 = 32k */
+#define    RX_CFG_COMP_RING_SHIFT       5
+#define    RX_CFG_BATCH_DIS             0x00000200 /* disable receive desc 
+                                                      batching. def: 0x0 =
+                                                      enabled */
+#define    RX_CFG_SWIVEL_MASK           0x00001C00 /* byte offset of the 1st 
+                                                      data byte of the packet 
+                                                      w/in 8 byte boundares.
+                                                      this swivels the data 
+                                                      DMA'ed to header 
+                                                      buffers, jumbo buffers
+                                                      when header split is not
+                                                      requested and MTU sized
+                                                      buffers. def: 0x2 */
+#define    RX_CFG_SWIVEL_SHIFT          10
+
+/* cassini+ only */
+#define    RX_CFG_DESC_RING1_MASK       0x000F0000 /* # of desc entries in
+                                                         RX free desc ring 2. 
+                                                         def: 0x8 = 8k */
+#define    RX_CFG_DESC_RING1_SHIFT      16
+
+
+/* the page size register allows cassini chips to do the following with 
+ * received data:
+ * [--------------------------------------------------------------] page
+ * [off][buf1][pad][off][buf2][pad][off][buf3][pad][off][buf4][pad]
+ * |--------------| = PAGE_SIZE_BUFFER_STRIDE
+ * page = PAGE_SIZE 
+ * offset = PAGE_SIZE_MTU_OFF
+ * for the above example, MTU_BUFFER_COUNT = 4.
+ * NOTE: as is apparent, you need to ensure that the following holds:
+ * MTU_BUFFER_COUNT <= PAGE_SIZE/PAGE_SIZE_BUFFER_STRIDE
+ * DEFAULT: 0x48002002 (8k pages)
+ */
+#define  REG_RX_PAGE_SIZE               0x4004  /* RX page size */
+#define    RX_PAGE_SIZE_MASK            0x00000003 /* size of pages pointed to
+                                                      by receive descriptors.
+                                                      if jumbo buffers are 
+                                                      supported the page size 
+                                                      should not be < 8k.
+                                                      0b00 = 2k, 0b01 = 4k
+                                                      0b10 = 8k, 0b11 = 16k
+                                                      DEFAULT: 8k */
+#define    RX_PAGE_SIZE_SHIFT           0
+#define    RX_PAGE_SIZE_MTU_COUNT_MASK  0x00007800 /* # of MTU buffers the hw
+                                                      packs into a page. 
+                                                      DEFAULT: 4 */
+#define    RX_PAGE_SIZE_MTU_COUNT_SHIFT 11
+#define    RX_PAGE_SIZE_MTU_STRIDE_MASK 0x18000000 /* # of bytes that separate
+                                                         each MTU buffer + 
+                                                         offset from each 
+                                                         other.
+                                                         0b00 = 1k, 0b01 = 2k
+                                                         0b10 = 4k, 0b11 = 8k
+                                                         DEFAULT: 0x1 */
+#define    RX_PAGE_SIZE_MTU_STRIDE_SHIFT 27
+#define    RX_PAGE_SIZE_MTU_OFF_MASK    0xC0000000 /* offset in each page that
+                                                      hw writes the MTU buffer
+                                                      into. 
+                                                      0b00 = 0,  
+                                                      0b01 = 64 bytes
+                                                      0b10 = 96, 0b11 = 128
+                                                      DEFAULT: 0x1 */
+#define    RX_PAGE_SIZE_MTU_OFF_SHIFT   30
+                                                         
+/* 11-bit counter points to next location in RX FIFO to be loaded/read. 
+ * shadow write pointers enable retries in case of early receive aborts.
+ * DEFAULT: 0x0. generated on 64-bit boundaries.
+ */
+#define  REG_RX_FIFO_WRITE_PTR             0x4008  /* RX FIFO write pointer */
+#define  REG_RX_FIFO_READ_PTR              0x400C  /* RX FIFO read pointer */
+#define  REG_RX_IPP_FIFO_SHADOW_WRITE_PTR  0x4010  /* RX IPP FIFO shadow write 
+                                                      pointer */
+#define  REG_RX_IPP_FIFO_SHADOW_READ_PTR   0x4014  /* RX IPP FIFO shadow read
+                                                      pointer */
+#define  REG_RX_IPP_FIFO_READ_PTR          0x400C  /* RX IPP FIFO read 
+                                                      pointer. (8-bit counter) */
+
+/* current state of RX DMA state engines + other info
+ * DEFAULT: 0x0
+ */
+#define  REG_RX_DEBUG                      0x401C  /* RX debug */
+#define    RX_DEBUG_LOAD_STATE_MASK        0x0000000F /* load state machine w/ MAC:
+                                                         0x0 = idle,   0x1 = load_bop
+                                                         0x2 = load 1, 0x3 = load 2
+                                                         0x4 = load 3, 0x5 = load 4
+                                                         0x6 = last detect
+                                                         0x7 = wait req
+                                                         0x8 = wait req statuss 1st
+                                                         0x9 = load st
+                                                         0xa = bubble mac
+                                                         0xb = error */
+#define    RX_DEBUG_LM_STATE_MASK          0x00000070 /* load state machine w/ HP and
+                                                         RX FIFO:
+                                                         0x0 = idle,   0x1 = hp xfr
+                                                         0x2 = wait hp ready
+                                                         0x3 = wait flow code
+                                                         0x4 = fifo xfer
+                                                         0x5 = make status
+                                                         0x6 = csum ready
+                                                         0x7 = error */
+#define    RX_DEBUG_FC_STATE_MASK          0x000000180 /* flow control state machine
+                                                         w/ MAC:
+                                                         0x0 = idle
+                                                         0x1 = wait xoff ack
+                                                         0x2 = wait xon
+                                                         0x3 = wait xon ack */
+#define    RX_DEBUG_DATA_STATE_MASK        0x000001E00 /* unload data state machine
+                                                         states: 
+                                                         0x0 = idle data
+                                                         0x1 = header begin
+                                                         0x2 = xfer header
+                                                         0x3 = xfer header ld
+                                                         0x4 = mtu begin
+                                                         0x5 = xfer mtu
+                                                         0x6 = xfer mtu ld
+                                                         0x7 = jumbo begin
+                                                         0x8 = xfer jumbo 
+                                                         0x9 = xfer jumbo ld
+                                                         0xa = reas begin
+                                                         0xb = xfer reas
+                                                         0xc = flush tag
+                                                         0xd = xfer reas ld
+                                                         0xe = error
+                                                         0xf = bubble idle */
+#define    RX_DEBUG_DESC_STATE_MASK        0x0001E000 /* unload desc state machine
+                                                         states:
+                                                         0x0 = idle desc
+                                                         0x1 = wait ack
+                                                         0x9 = wait ack 2
+                                                         0x2 = fetch desc 1
+                                                         0xa = fetch desc 2
+                                                         0x3 = load ptrs
+                                                         0x4 = wait dma
+                                                         0x5 = wait ack batch
+                                                         0x6 = post batch
+                                                         0x7 = xfr done */
+#define    RX_DEBUG_INTR_READ_PTR_MASK     0x30000000 /* interrupt read ptr of the
+                                                         interrupt queue */
+#define    RX_DEBUG_INTR_WRITE_PTR_MASK    0xC0000000 /* interrupt write pointer
+                                                         of the interrupt queue */
+
+/* flow control frames are emmitted using two PAUSE thresholds:
+ * XOFF PAUSE uses pause time value pre-programmed in the Send PAUSE MAC reg
+ * XON PAUSE uses a pause time of 0. granularity of threshold is 64bytes.
+ * PAUSE thresholds defined in terms of FIFO occupancy and may be translated
+ * into FIFO vacancy using RX_FIFO_SIZE. setting ON will trigger XON frames 
+ * when FIFO reaches 0. OFF threshold should not be > size of RX FIFO. max
+ * value is is 0x6F. 
+ * DEFAULT: 0x00078
+ */
+#define  REG_RX_PAUSE_THRESH               0x4020  /* RX pause thresholds */
+#define    RX_PAUSE_THRESH_QUANTUM         64
+#define    RX_PAUSE_THRESH_OFF_MASK        0x000001FF /* XOFF PAUSE emitted when
+                                                         RX FIFO occupancy > 
+                                                         value*64B */
+#define    RX_PAUSE_THRESH_OFF_SHIFT       0
+#define    RX_PAUSE_THRESH_ON_MASK         0x001FF000 /* XON PAUSE emitted after
+                                                         emitting XOFF PAUSE when RX
+                                                         FIFO occupancy falls below
+                                                         this value*64B. must be
+                                                         < XOFF threshold. if =
+                                                         RX_FIFO_SIZE< XON frames are
+                                                         never emitted. */
+#define    RX_PAUSE_THRESH_ON_SHIFT        12
+
+/* 13-bit register used to control RX desc fetching and intr generation. if 4+
+ * valid RX descriptors are available, Cassini will read 4 at a time. 
+ * writing N means that all desc up to *but* excluding N are available. N must
+ * be a multiple of 4 (N % 4 = 0). first desc should be cache-line aligned. 
+ * DEFAULT: 0 on reset
+ */
+#define  REG_RX_KICK                    0x4024  /* RX kick reg */
+
+/* 8KB aligned 64-bit pointer to the base of the RX free/completion rings.
+ * lower 13 bits of the low register are hard-wired to 0.
+ */
+#define  REG_RX_DB_LOW                     0x4028  /* RX descriptor ring 
+                                                         base low */
+#define  REG_RX_DB_HI                      0x402C  /* RX descriptor ring
+                                                         base hi */
+#define  REG_RX_CB_LOW                     0x4030  /* RX completion ring
+                                                         base low */
+#define  REG_RX_CB_HI                      0x4034  /* RX completion ring 
+                                                         base hi */
+/* 13-bit register indicate desc used by cassini for receive frames. used
+ * for diagnostic purposes. 
+ * DEFAULT: 0 on reset
+ */
+#define  REG_RX_COMP                       0x4038  /* (ro) RX completion */
+
+/* HEAD and TAIL are used to control RX desc posting and interrupt
+ * generation.  hw moves the head register to pass ownership to sw. sw
+ * moves the tail register to pass ownership back to hw. to give all
+ * entries to hw, set TAIL = HEAD.  if HEAD and TAIL indicate that no
+ * more entries are available, DMA will pause and an interrupt will be
+ * generated to indicate no more entries are available.  sw can use
+ * this interrupt to reduce the # of times it must update the
+ * completion tail register.
+ * DEFAULT: 0 on reset
+ */
+#define  REG_RX_COMP_HEAD                  0x403C  /* RX completion head */
+#define  REG_RX_COMP_TAIL                  0x4040  /* RX completion tail */
+
+/* values used for receive interrupt blanking. loaded each time the ISR is read
+ * DEFAULT: 0x00000000
+ */
+#define  REG_RX_BLANK                      0x4044  /* RX blanking register 
+                                                         for ISR read */
+#define    RX_BLANK_INTR_PKT_MASK          0x000001FF /* RX_DONE intr asserted if 
+                                                         this many sets of completion
+                                                         writebacks (up to 2 packets)
+                                                         occur since the last time
+                                                         the ISR was read. 0 = no
+                                                         packet blanking */
+#define    RX_BLANK_INTR_PKT_SHIFT         0
+#define    RX_BLANK_INTR_TIME_MASK         0x3FFFF000 /* RX_DONE interrupt asserted
+                                                         if that many clocks were
+                                                         counted since last time the
+                                                         ISR was read. 
+                                                         each count is 512 core
+                                                         clocks (125MHz). 0 = no
+                                                         time blanking */
+#define    RX_BLANK_INTR_TIME_SHIFT        12
+
+/* values used for interrupt generation based on threshold values of how 
+ * many free desc and completion entries are available for hw use.
+ * DEFAULT: 0x00000000
+ */
+#define  REG_RX_AE_THRESH                  0x4048  /* RX almost empty 
+                                                         thresholds */
+#define    RX_AE_THRESH_FREE_MASK          0x00001FFF /* RX_BUF_AE will be 
+                                                         generated if # desc
+                                                         avail for hw use <= 
+                                                         # */
+#define    RX_AE_THRESH_FREE_SHIFT         0
+#define    RX_AE_THRESH_COMP_MASK          0x0FFFE000 /* RX_COMP_AE will be
+                                                         generated if # of 
+                                                         completion entries
+                                                         avail for hw use <= 
+                                                         # */
+#define    RX_AE_THRESH_COMP_SHIFT         13
+
+/* probabilities for random early drop (RED) thresholds on a FIFO threshold 
+ * basis. probability should increase when the FIFO level increases. control 
+ * packets are never dropped and not counted in stats. probability programmed 
+ * on a 12.5% granularity. e.g., 0x1 = 1/8 packets dropped.
+ * DEFAULT: 0x00000000
+ */
+#define  REG_RX_RED                      0x404C  /* RX random early detect enable */
+#define    RX_RED_4K_6K_FIFO_MASK        0x000000FF /*  4KB < FIFO thresh < 6KB */
+#define    RX_RED_6K_8K_FIFO_MASK        0x0000FF00 /*  6KB < FIFO thresh < 8KB */
+#define    RX_RED_8K_10K_FIFO_MASK       0x00FF0000 /*  8KB < FIFO thresh < 10KB */
+#define    RX_RED_10K_12K_FIFO_MASK      0xFF000000 /* 10KB < FIFO thresh < 12KB */
+
+/* FIFO fullness levels for RX FIFO, RX control FIFO, and RX IPP FIFO. 
+ * RX control FIFO = # of packets in RX FIFO. 
+ * DEFAULT: 0x0
+ */
+#define  REG_RX_FIFO_FULLNESS              0x4050  /* (ro) RX FIFO fullness */
+#define    RX_FIFO_FULLNESS_RX_FIFO_MASK   0x3FF80000 /* level w/ 8B granularity */
+#define    RX_FIFO_FULLNESS_IPP_FIFO_MASK  0x0007FF00 /* level w/ 8B granularity */
+#define    RX_FIFO_FULLNESS_RX_PKT_MASK    0x000000FF /* # packets in RX FIFO */
+#define  REG_RX_IPP_PACKET_COUNT           0x4054  /* RX IPP packet counter */
+#define  REG_RX_WORK_DMA_PTR_LOW           0x4058  /* RX working DMA ptr low */
+#define  REG_RX_WORK_DMA_PTR_HI            0x405C  /* RX working DMA ptr 
+                                                      high */
+
+/* BIST testing ro RX FIFO, RX control FIFO, and RX IPP FIFO. only RX BIST
+ * START/COMPLETE is writeable. START will clear when the BIST has completed
+ * checking all 17 RAMS. 
+ * DEFAULT: 0bxxxx xxxxx xxxx xxxx xxxx x000 0000 0000 00x0
+ */
+#define  REG_RX_BIST                       0x4060  /* (ro) RX BIST */
+#define    RX_BIST_32A_PASS                0x80000000 /* RX FIFO 32A passed */
+#define    RX_BIST_33A_PASS                0x40000000 /* RX FIFO 33A passed */
+#define    RX_BIST_32B_PASS                0x20000000 /* RX FIFO 32B passed */
+#define    RX_BIST_33B_PASS                0x10000000 /* RX FIFO 33B passed */
+#define    RX_BIST_32C_PASS                0x08000000 /* RX FIFO 32C passed */
+#define    RX_BIST_33C_PASS                0x04000000 /* RX FIFO 33C passed */
+#define    RX_BIST_IPP_32A_PASS            0x02000000 /* RX IPP FIFO 33B passed */
+#define    RX_BIST_IPP_33A_PASS            0x01000000 /* RX IPP FIFO 33A passed */
+#define    RX_BIST_IPP_32B_PASS            0x00800000 /* RX IPP FIFO 32B passed */
+#define    RX_BIST_IPP_33B_PASS            0x00400000 /* RX IPP FIFO 33B passed */
+#define    RX_BIST_IPP_32C_PASS            0x00200000 /* RX IPP FIFO 32C passed */
+#define    RX_BIST_IPP_33C_PASS            0x00100000 /* RX IPP FIFO 33C passed */
+#define    RX_BIST_CTRL_32_PASS            0x00800000 /* RX CTRL FIFO 32 passed */
+#define    RX_BIST_CTRL_33_PASS            0x00400000 /* RX CTRL FIFO 33 passed */
+#define    RX_BIST_REAS_26A_PASS           0x00200000 /* RX Reas 26A passed */
+#define    RX_BIST_REAS_26B_PASS           0x00100000 /* RX Reas 26B passed */
+#define    RX_BIST_REAS_27_PASS            0x00080000 /* RX Reas 27 passed */
+#define    RX_BIST_STATE_MASK              0x00078000 /* BIST state machine */
+#define    RX_BIST_SUMMARY                 0x00000002 /* when BIST complete,
+                                                         summary pass bit 
+                                                         contains AND of BIST
+                                                         results of all 16
+                                                         RAMS */
+#define    RX_BIST_START                   0x00000001 /* write 1 to start 
+                                                         BIST. self clears
+                                                         on completion. */
+
+/* next location in RX CTRL FIFO that will be loaded w/ data from RX IPP/read
+ * from to retrieve packet control info. 
+ * DEFAULT: 0
+ */
+#define  REG_RX_CTRL_FIFO_WRITE_PTR        0x4064  /* (ro) RX control FIFO 
+                                                      write ptr */
+#define  REG_RX_CTRL_FIFO_READ_PTR         0x4068  /* (ro) RX control FIFO read
+                                                      ptr */
+
+/* receive interrupt blanking. loaded each time interrupt alias register is
+ * read. 
+ * DEFAULT: 0x0
+ */
+#define  REG_RX_BLANK_ALIAS_READ           0x406C  /* RX blanking register for
+                                                      alias read */
+#define    RX_BAR_INTR_PACKET_MASK         0x000001FF /* assert RX_DONE if # 
+                                                         completion writebacks 
+                                                         > # since last ISR 
+                                                         read. 0 = no 
+                                                         blanking. up to 2 
+                                                         packets per 
+                                                         completion wb. */
+#define    RX_BAR_INTR_TIME_MASK           0x3FFFF000 /* assert RX_DONE if #
+                                                         clocks > # since last
+                                                         ISR read. each count
+                                                         is 512 core clocks
+                                                         (125MHz). 0 = no 
+                                                         blanking. */
+
+/* diagnostic access to RX FIFO. 32 LSB accessed via DATA_LOW. 32 MSB accessed
+ * via DATA_HI_T0 or DATA_HI_T1. TAG reads the tag bit. writing HI_T0
+ * will unset the tag bit while writing HI_T1 will set the tag bit. to reset
+ * to normal operation after diagnostics, write to address location 0x0.
+ * RX_DMA_EN bit must be set to 0x0 for RX FIFO PIO access. DATA_HI should
+ * be the last write access of a write sequence.
+ * DEFAULT: undefined
+ */
+#define  REG_RX_FIFO_ADDR                  0x4080  /* RX FIFO address */
+#define  REG_RX_FIFO_TAG                   0x4084  /* RX FIFO tag */
+#define  REG_RX_FIFO_DATA_LOW              0x4088  /* RX FIFO data low */
+#define  REG_RX_FIFO_DATA_HI_T0            0x408C  /* RX FIFO data high T0 */
+#define  REG_RX_FIFO_DATA_HI_T1            0x4090  /* RX FIFO data high T1 */
+
+/* diagnostic assess to RX CTRL FIFO. 8-bit FIFO_ADDR holds address of
+ * 81 bit control entry and 6 bit flow id. LOW and MID are both 32-bit
+ * accesses. HI is 7-bits with 6-bit flow id and 1 bit control
+ * word. RX_DMA_EN must be 0 for RX CTRL FIFO PIO access. DATA_HI
+ * should be last write access of the write sequence.
+ * DEFAULT: undefined
+ */
+#define  REG_RX_CTRL_FIFO_ADDR             0x4094  /* RX Control FIFO and 
+                                                      Batching FIFO addr */
+#define  REG_RX_CTRL_FIFO_DATA_LOW         0x4098  /* RX Control FIFO data 
+                                                      low */
+#define  REG_RX_CTRL_FIFO_DATA_MID         0x409C  /* RX Control FIFO data 
+                                                      mid */
+#define  REG_RX_CTRL_FIFO_DATA_HI          0x4100  /* RX Control FIFO data 
+                                                      hi and flow id */
+#define    RX_CTRL_FIFO_DATA_HI_CTRL       0x0001  /* upper bit of ctrl word */
+#define    RX_CTRL_FIFO_DATA_HI_FLOW_MASK  0x007E  /* flow id */
+
+/* diagnostic access to RX IPP FIFO. same semantics as RX_FIFO.
+ * DEFAULT: undefined
+ */
+#define  REG_RX_IPP_FIFO_ADDR              0x4104  /* RX IPP FIFO address */
+#define  REG_RX_IPP_FIFO_TAG               0x4108  /* RX IPP FIFO tag */
+#define  REG_RX_IPP_FIFO_DATA_LOW          0x410C  /* RX IPP FIFO data low */
+#define  REG_RX_IPP_FIFO_DATA_HI_T0        0x4110  /* RX IPP FIFO data high
+                                                      T0 */
+#define  REG_RX_IPP_FIFO_DATA_HI_T1        0x4114  /* RX IPP FIFO data high
+                                                      T1 */
+
+/* 64-bit pointer to receive data buffer in host memory used for headers and
+ * small packets. MSB in high register. loaded by DMA state machine and 
+ * increments as DMA writes receive data. only 50 LSB are incremented. top
+ * 13 bits taken from RX descriptor.
+ * DEFAULT: undefined
+ */
+#define  REG_RX_HEADER_PAGE_PTR_LOW        0x4118  /* (ro) RX header page ptr
+                                                      low */
+#define  REG_RX_HEADER_PAGE_PTR_HI         0x411C  /* (ro) RX header page ptr
+                                                      high */
+#define  REG_RX_MTU_PAGE_PTR_LOW           0x4120  /* (ro) RX MTU page pointer 
+                                                      low */
+#define  REG_RX_MTU_PAGE_PTR_HI            0x4124  /* (ro) RX MTU page pointer 
+                                                      high */
+
+/* PIO diagnostic access to RX reassembly DMA Table RAM. 6-bit register holds
+ * one of 64 79-bit locations in the RX Reassembly DMA table and the addr of
+ * one of the 64 byte locations in the Batching table. LOW holds 32 LSB. 
+ * MID holds the next 32 LSB. HIGH holds the 15 MSB. RX_DMA_EN must be set
+ * to 0 for PIO access. DATA_HIGH should be last write of write sequence.
+ * layout:  
+ * reassmbl ptr [78:15] | reassmbl index [14:1] | reassmbl entry valid [0]
+ * DEFAULT: undefined
+ */
+#define  REG_RX_TABLE_ADDR             0x4128  /* RX reassembly DMA table
+                                                  address */
+#define    RX_TABLE_ADDR_MASK          0x0000003F /* address mask */
+
+#define  REG_RX_TABLE_DATA_LOW         0x412C  /* RX reassembly DMA table
+                                                  data low */
+#define  REG_RX_TABLE_DATA_MID         0x4130  /* RX reassembly DMA table 
+                                                  data mid */
+#define  REG_RX_TABLE_DATA_HI          0x4134  /* RX reassembly DMA table
+                                                  data high */
+
+/* cassini+ only */
+/* 8KB aligned 64-bit pointer to base of RX rings. lower 13 bits hardwired to
+ * 0. same semantics as primary desc/complete rings.
+ */
+#define  REG_PLUS_RX_DB1_LOW            0x4200  /* RX descriptor ring
+                                                   2 base low */
+#define  REG_PLUS_RX_DB1_HI             0x4204  /* RX descriptor ring
+                                                   2 base high */
+#define  REG_PLUS_RX_CB1_LOW            0x4208  /* RX completion ring
+                                                   2 base low. 4 total */
+#define  REG_PLUS_RX_CB1_HI             0x420C  /* RX completion ring
+                                                   2 base high. 4 total */
+#define  REG_PLUS_RX_CBN_LOW(x)        (REG_PLUS_RX_CB1_LOW + 8*((x) - 1))
+#define  REG_PLUS_RX_CBN_HI(x)         (REG_PLUS_RX_CB1_HI + 8*((x) - 1))
+#define  REG_PLUS_RX_KICK1             0x4220  /* RX Kick 2 register */
+#define  REG_PLUS_RX_COMP1             0x4224  /* (ro) RX completion 2 
+                                                  reg */
+#define  REG_PLUS_RX_COMP1_HEAD        0x4228  /* (ro) RX completion 2 
+                                                  head reg. 4 total. */
+#define  REG_PLUS_RX_COMP1_TAIL        0x422C  /* RX completion 2 
+                                                  tail reg. 4 total. */
+#define  REG_PLUS_RX_COMPN_HEAD(x)    (REG_PLUS_RX_COMP1_HEAD + 8*((x) - 1))
+#define  REG_PLUS_RX_COMPN_TAIL(x)    (REG_PLUS_RX_COMP1_TAIL + 8*((x) - 1))
+#define  REG_PLUS_RX_AE1_THRESH        0x4240  /* RX almost empty 2
+                                                  thresholds */
+#define    RX_AE1_THRESH_FREE_MASK     RX_AE_THRESH_FREE_MASK
+#define    RX_AE1_THRESH_FREE_SHIFT    RX_AE_THRESH_FREE_SHIFT
+
+/** header parser registers **/
+
+/* RX parser configuration register. 
+ * DEFAULT: 0x1651004
+ */
+#define  REG_HP_CFG                       0x4140  /* header parser 
+                                                     configuration reg */
+#define    HP_CFG_PARSE_EN                0x00000001 /* enab header parsing */
+#define    HP_CFG_NUM_CPU_MASK            0x000000FC /* # processors 
+                                                      0 = 64. 0x3f = 63 */
+#define    HP_CFG_NUM_CPU_SHIFT           2
+#define    HP_CFG_SYN_INC_MASK            0x00000100 /* SYN bit won't increment
+                                                        TCP seq # by one when
+                                                        stored in FDBM */
+#define    HP_CFG_TCP_THRESH_MASK         0x000FFE00 /* # bytes of TCP data
+                                                        needed to be considered
+                                                        for reassembly */
+#define    HP_CFG_TCP_THRESH_SHIFT        9
+
+/* access to RX Instruction RAM. 5-bit register/counter holds addr
+ * of 39 bit entry to be read/written. 32 LSB in _DATA_LOW. 7 MSB in _DATA_HI.
+ * RX_DMA_EN must be 0 for RX instr PIO access. DATA_HI should be last access
+ * of sequence. 
+ * DEFAULT: undefined
+ */
+#define  REG_HP_INSTR_RAM_ADDR             0x4144  /* HP instruction RAM
+                                                      address */
+#define    HP_INSTR_RAM_ADDR_MASK          0x01F   /* 5-bit mask */
+#define  REG_HP_INSTR_RAM_DATA_LOW         0x4148  /* HP instruction RAM
+                                                      data low */
+#define    HP_INSTR_RAM_LOW_OUTMASK_MASK   0x0000FFFF
+#define    HP_INSTR_RAM_LOW_OUTMASK_SHIFT  0
+#define    HP_INSTR_RAM_LOW_OUTSHIFT_MASK  0x000F0000
+#define    HP_INSTR_RAM_LOW_OUTSHIFT_SHIFT 16
+#define    HP_INSTR_RAM_LOW_OUTEN_MASK     0x00300000
+#define    HP_INSTR_RAM_LOW_OUTEN_SHIFT    20
+#define    HP_INSTR_RAM_LOW_OUTARG_MASK    0xFFC00000
+#define    HP_INSTR_RAM_LOW_OUTARG_SHIFT   22
+#define  REG_HP_INSTR_RAM_DATA_MID         0x414C  /* HP instruction RAM 
+                                                      data mid */
+#define    HP_INSTR_RAM_MID_OUTARG_MASK    0x00000003
+#define    HP_INSTR_RAM_MID_OUTARG_SHIFT   0
+#define    HP_INSTR_RAM_MID_OUTOP_MASK     0x0000003C
+#define    HP_INSTR_RAM_MID_OUTOP_SHIFT    2
+#define    HP_INSTR_RAM_MID_FNEXT_MASK     0x000007C0
+#define    HP_INSTR_RAM_MID_FNEXT_SHIFT    6
+#define    HP_INSTR_RAM_MID_FOFF_MASK      0x0003F800
+#define    HP_INSTR_RAM_MID_FOFF_SHIFT     11
+#define    HP_INSTR_RAM_MID_SNEXT_MASK     0x007C0000
+#define    HP_INSTR_RAM_MID_SNEXT_SHIFT    18
+#define    HP_INSTR_RAM_MID_SOFF_MASK      0x3F800000
+#define    HP_INSTR_RAM_MID_SOFF_SHIFT     23
+#define    HP_INSTR_RAM_MID_OP_MASK        0xC0000000
+#define    HP_INSTR_RAM_MID_OP_SHIFT       30
+#define  REG_HP_INSTR_RAM_DATA_HI          0x4150  /* HP instruction RAM
+                                                      data high */
+#define    HP_INSTR_RAM_HI_VAL_MASK        0x0000FFFF
+#define    HP_INSTR_RAM_HI_VAL_SHIFT       0
+#define    HP_INSTR_RAM_HI_MASK_MASK       0xFFFF0000
+#define    HP_INSTR_RAM_HI_MASK_SHIFT      16
+
+/* PIO access into RX Header parser data RAM and flow database.
+ * 11-bit register. Data fills the LSB portion of bus if less than 32 bits.
+ * DATA_RAM: write RAM_FDB_DATA with index to access DATA_RAM.
+ * RAM bytes = 4*(x - 1) + [3:0]. e.g., 0 -> [3:0], 31 -> [123:120]
+ * FLOWDB: write DATA_RAM_FDB register and then read/write FDB1-12 to access 
+ * flow database.
+ * RX_DMA_EN must be 0 for RX parser RAM PIO access. RX Parser RAM data reg
+ * should be the last write access of the write sequence.
+ * DEFAULT: undefined
+ */
+#define  REG_HP_DATA_RAM_FDB_ADDR          0x4154  /* HP data and FDB
+                                                      RAM address */
+#define    HP_DATA_RAM_FDB_DATA_MASK       0x001F  /* select 1 of 86 byte 
+                                                      locations in header 
+                                                      parser data ram to 
+                                                      read/write */
+#define    HP_DATA_RAM_FDB_FDB_MASK        0x3F00  /* 1 of 64 353-bit locations
+                                                      in the flow database */
+#define  REG_HP_DATA_RAM_DATA              0x4158  /* HP data RAM data */
+
+/* HP flow database registers: 1 - 12, 0x415C - 0x4188, 4 8-bit bytes 
+ * FLOW_DB(1) = IP_SA[127:96], FLOW_DB(2) = IP_SA[95:64]
+ * FLOW_DB(3) = IP_SA[63:32],  FLOW_DB(4) = IP_SA[31:0] 
+ * FLOW_DB(5) = IP_DA[127:96], FLOW_DB(6) = IP_DA[95:64]
+ * FLOW_DB(7) = IP_DA[63:32],  FLOW_DB(8) = IP_DA[31:0]
+ * FLOW_DB(9) = {TCP_SP[15:0],TCP_DP[15:0]}
+ * FLOW_DB(10) = bit 0 has value for flow valid
+ * FLOW_DB(11) = TCP_SEQ[63:32], FLOW_DB(12) = TCP_SEQ[31:0]
+ */
+#define  REG_HP_FLOW_DB0                   0x415C  /* HP flow database 1 reg */
+#define  REG_HP_FLOW_DBN(x)                (REG_HP_FLOW_DB0 + (x)*4)
+
+/* diagnostics for RX Header Parser block. 
+ * ASUN: the header parser state machine register is used for diagnostics
+ * purposes. however, the spec doesn't have any details on it.
+ */
+#define  REG_HP_STATE_MACHINE              0x418C  /* (ro) HP state machine */
+#define  REG_HP_STATUS0                    0x4190  /* (ro) HP status 1 */
+#define    HP_STATUS0_SAP_MASK             0xFFFF0000 /* SAP */
+#define    HP_STATUS0_L3_OFF_MASK          0x0000FE00 /* L3 offset */
+#define    HP_STATUS0_LB_CPUNUM_MASK       0x000001F8 /* load balancing CPU 
+                                                         number */
+#define    HP_STATUS0_HRP_OPCODE_MASK      0x00000007 /* HRP opcode */
+
+#define  REG_HP_STATUS1                    0x4194  /* (ro) HP status 2 */
+#define    HP_STATUS1_ACCUR2_MASK          0xE0000000 /* accu R2[6:4] */
+#define    HP_STATUS1_FLOWID_MASK          0x1F800000 /* flow id */
+#define    HP_STATUS1_TCP_OFF_MASK         0x007F0000 /* tcp payload offset */
+#define    HP_STATUS1_TCP_SIZE_MASK        0x0000FFFF /* tcp payload size */
+
+#define  REG_HP_STATUS2                    0x4198  /* (ro) HP status 3 */
+#define    HP_STATUS2_ACCUR2_MASK          0xF0000000 /* accu R2[3:0] */
+#define    HP_STATUS2_CSUM_OFF_MASK        0x07F00000 /* checksum start 
+                                                         start offset */
+#define    HP_STATUS2_ACCUR1_MASK          0x000FE000 /* accu R1 */
+#define    HP_STATUS2_FORCE_DROP           0x00001000 /* force drop */
+#define    HP_STATUS2_BWO_REASSM           0x00000800 /* batching w/o 
+                                                         reassembly */
+#define    HP_STATUS2_JH_SPLIT_EN          0x00000400 /* jumbo header split
+                                                         enable */
+#define    HP_STATUS2_FORCE_TCP_NOCHECK    0x00000200 /* force tcp no payload
+                                                         check */
+#define    HP_STATUS2_DATA_MASK_ZERO       0x00000100 /* mask of data length
+                                                         equal to zero */
+#define    HP_STATUS2_FORCE_TCP_CHECK      0x00000080 /* force tcp payload 
+                                                         chk */
+#define    HP_STATUS2_MASK_TCP_THRESH      0x00000040 /* mask of payload 
+                                                         threshold */
+#define    HP_STATUS2_NO_ASSIST            0x00000020 /* no assist */
+#define    HP_STATUS2_CTRL_PACKET_FLAG     0x00000010 /* control packet flag */
+#define    HP_STATUS2_TCP_FLAG_CHECK       0x00000008 /* tcp flag check */
+#define    HP_STATUS2_SYN_FLAG             0x00000004 /* syn flag */
+#define    HP_STATUS2_TCP_CHECK            0x00000002 /* tcp payload chk */
+#define    HP_STATUS2_TCP_NOCHECK          0x00000001 /* tcp no payload chk */
+
+/* BIST for header parser(HP) and flow database memories (FDBM). set _START
+ * to start BIST. controller clears _START on completion. _START can also
+ * be cleared to force termination of BIST. a bit set indicates that that
+ * memory passed its BIST.
+ */
+#define  REG_HP_RAM_BIST                   0x419C  /* HP RAM BIST reg */
+#define    HP_RAM_BIST_HP_DATA_PASS        0x80000000 /* HP data ram */
+#define    HP_RAM_BIST_HP_INSTR0_PASS      0x40000000 /* HP instr ram 0 */
+#define    HP_RAM_BIST_HP_INSTR1_PASS      0x20000000 /* HP instr ram 1 */
+#define    HP_RAM_BIST_HP_INSTR2_PASS      0x10000000 /* HP instr ram 2 */
+#define    HP_RAM_BIST_FDBM_AGE0_PASS      0x08000000 /* FDBM aging RAM0 */
+#define    HP_RAM_BIST_FDBM_AGE1_PASS      0x04000000 /* FDBM aging RAM1 */
+#define    HP_RAM_BIST_FDBM_FLOWID00_PASS  0x02000000 /* FDBM flowid RAM0 
+                                                         bank 0 */
+#define    HP_RAM_BIST_FDBM_FLOWID10_PASS  0x01000000 /* FDBM flowid RAM1
+                                                         bank 0 */
+#define    HP_RAM_BIST_FDBM_FLOWID20_PASS  0x00800000 /* FDBM flowid RAM2
+                                                         bank 0 */
+#define    HP_RAM_BIST_FDBM_FLOWID30_PASS  0x00400000 /* FDBM flowid RAM3
+                                                         bank 0 */
+#define    HP_RAM_BIST_FDBM_FLOWID01_PASS  0x00200000 /* FDBM flowid RAM0
+                                                         bank 1 */
+#define    HP_RAM_BIST_FDBM_FLOWID11_PASS  0x00100000 /* FDBM flowid RAM1
+                                                         bank 2 */
+#define    HP_RAM_BIST_FDBM_FLOWID21_PASS  0x00080000 /* FDBM flowid RAM2
+                                                         bank 1 */
+#define    HP_RAM_BIST_FDBM_FLOWID31_PASS  0x00040000 /* FDBM flowid RAM3
+                                                         bank 1 */
+#define    HP_RAM_BIST_FDBM_TCPSEQ_PASS    0x00020000 /* FDBM tcp sequence
+                                                         RAM */
+#define    HP_RAM_BIST_SUMMARY             0x00000002 /* all BIST tests */
+#define    HP_RAM_BIST_START               0x00000001 /* start/stop BIST */
+
+
+/** MAC registers.  **/
+/* reset bits are set using a PIO write and self-cleared after the command
+ * execution has completed.
+ */
+#define  REG_MAC_TX_RESET                  0x6000  /* TX MAC software reset
+                                                      command (default: 0x0) */
+#define  REG_MAC_RX_RESET                  0x6004  /* RX MAC software reset
+                                                      command (default: 0x0) */
+/* execute a pause flow control frame transmission
+ DEFAULT: 0x0XXXX */
+#define  REG_MAC_SEND_PAUSE                0x6008  /* send pause command reg */
+#define    MAC_SEND_PAUSE_TIME_MASK        0x0000FFFF /* value of pause time 
+                                                         to be sent on network
+                                                         in units of slot 
+                                                         times */
+#define    MAC_SEND_PAUSE_SEND             0x00010000 /* send pause flow ctrl
+                                                         frame on network */
+
+/* bit set indicates that event occurred. auto-cleared when status register
+ * is read and have corresponding mask bits in mask register. events will 
+ * trigger an interrupt if the corresponding mask bit is 0. 
+ * status register default: 0x00000000
+ * mask register default = 0xFFFFFFFF on reset
+ */
+#define  REG_MAC_TX_STATUS                 0x6010  /* TX MAC status reg */
+#define    MAC_TX_FRAME_XMIT               0x0001  /* successful frame 
+                                                      transmision */
+#define    MAC_TX_UNDERRUN                 0x0002  /* terminated frame 
+                                                      transmission due to
+                                                      data starvation in the 
+                                                      xmit data path */
+#define    MAC_TX_MAX_PACKET_ERR           0x0004  /* frame exceeds max allowed
+                                                      length passed to TX MAC
+                                                      by the DMA engine */
+#define    MAC_TX_COLL_NORMAL              0x0008  /* rollover of the normal
+                                                      collision counter */
+#define    MAC_TX_COLL_EXCESS              0x0010  /* rollover of the excessive
+                                                      collision counter */
+#define    MAC_TX_COLL_LATE                0x0020  /* rollover of the late
+                                                      collision counter */
+#define    MAC_TX_COLL_FIRST               0x0040  /* rollover of the first
+                                                      collision counter */
+#define    MAC_TX_DEFER_TIMER              0x0080  /* rollover of the defer
+                                                      timer */
+#define    MAC_TX_PEAK_ATTEMPTS            0x0100  /* rollover of the peak
+                                                      attempts counter */
+
+#define  REG_MAC_RX_STATUS                 0x6014  /* RX MAC status reg */
+#define    MAC_RX_FRAME_RECV               0x0001  /* successful receipt of
+                                                      a frame */
+#define    MAC_RX_OVERFLOW                 0x0002  /* dropped frame due to 
+                                                      RX FIFO overflow */
+#define    MAC_RX_FRAME_COUNT              0x0004  /* rollover of receive frame
+                                                      counter */
+#define    MAC_RX_ALIGN_ERR                0x0008  /* rollover of alignment
+                                                      error counter */
+#define    MAC_RX_CRC_ERR                  0x0010  /* rollover of crc error
+                                                      counter */
+#define    MAC_RX_LEN_ERR                  0x0020  /* rollover of length 
+                                                      error counter */
+#define    MAC_RX_VIOL_ERR                 0x0040  /* rollover of code 
+                                                      violation error */
+
+/* DEFAULT: 0xXXXX0000 on reset */
+#define  REG_MAC_CTRL_STATUS               0x6018  /* MAC control status reg */
+#define    MAC_CTRL_PAUSE_RECEIVED         0x00000001  /* successful 
+                                                          reception of a 
+                                                          pause control 
+                                                          frame */
+#define    MAC_CTRL_PAUSE_STATE            0x00000002  /* MAC has made a 
+                                                          transition from 
+                                                          "not paused" to 
+                                                          "paused" */
+#define    MAC_CTRL_NOPAUSE_STATE          0x00000004  /* MAC has made a 
+                                                          transition from 
+                                                          "paused" to "not
+                                                          paused" */
+#define    MAC_CTRL_PAUSE_TIME_MASK        0xFFFF0000  /* value of pause time
+                                                          operand that was 
+                                                          received in the last
+                                                          pause flow control
+                                                          frame */
+
+/* layout identical to TX MAC[8:0] */
+#define  REG_MAC_TX_MASK                   0x6020  /* TX MAC mask reg */
+/* layout identical to RX MAC[6:0] */
+#define  REG_MAC_RX_MASK                   0x6024  /* RX MAC mask reg */
+/* layout identical to CTRL MAC[2:0] */
+#define  REG_MAC_CTRL_MASK                 0x6028  /* MAC control mask reg */
+
+/* to ensure proper operation, CFG_EN must be cleared to 0 and a delay 
+ * imposed before writes to other bits in the TX_MAC_CFG register or any of
+ * the MAC parameters is performed. delay dependent upon time required to
+ * transmit a maximum size frame (= MAC_FRAMESIZE_MAX*8/Mbps). e.g.,
+ * the delay for a 1518-byte frame on a 100Mbps network is 125us. 
+ * alternatively, just poll TX_CFG_EN until it reads back as 0. 
+ * NOTE: on half-duplex 1Gbps, TX_CFG_CARRIER_EXTEND and 
+ * RX_CFG_CARRIER_EXTEND should be set and the SLOT_TIME register should
+ * be 0x200 (slot time of 512 bytes)
+ */
+#define  REG_MAC_TX_CFG                 0x6030  /* TX MAC config reg */
+#define    MAC_TX_CFG_EN                0x0001  /* enable TX MAC. 0 will
+                                                      force TXMAC state
+                                                      machine to remain in
+                                                      idle state or to 
+                                                      transition to idle state
+                                                      on completion of an
+                                                      ongoing packet. */
+#define    MAC_TX_CFG_IGNORE_CARRIER    0x0002  /* disable CSMA/CD deferral
+                                                   process. set to 1 when 
+                                                   full duplex and 0 when
+                                                   half duplex */
+#define    MAC_TX_CFG_IGNORE_COLL       0x0004  /* disable CSMA/CD backoff
+                                                   algorithm. set to 1 when
+                                                   full duplex and 0 when
+                                                   half duplex */
+#define    MAC_TX_CFG_IPG_EN            0x0008  /* enable extension of the
+                                                   Rx-to-TX IPG. after 
+                                                   receiving a frame, TX 
+                                                   MAC will reset its 
+                                                   deferral process to 
+                                                   carrier sense for the
+                                                   amount of time = IPG0 +
+                                                   IPG1 and commit to 
+                                                   transmission for time
+                                                   specified in IPG2. when
+                                                   0 or when xmitting frames
+                                                   back-to-pack (Tx-to-Tx
+                                                   IPG), TX MAC ignores 
+                                                   IPG0 and will only use
+                                                   IPG1 for deferral time.
+                                                   IPG2 still used. */
+#define    MAC_TX_CFG_NEVER_GIVE_UP_EN  0x0010  /* TX MAC will not easily
+                                                   give up on frame 
+                                                   xmission. if backoff 
+                                                   algorithm reaches the
+                                                   ATTEMPT_LIMIT, it will
+                                                   clear attempts counter
+                                                   and continue trying to
+                                                   send the frame as 
+                                                   specified by 
+                                                   GIVE_UP_LIM. when 0,
+                                                   TX MAC will execute 
+                                                   standard CSMA/CD prot. */
+#define    MAC_TX_CFG_NEVER_GIVE_UP_LIM 0x0020  /* when set, TX MAC will
+                                                   continue to try to xmit
+                                                   until successful. when
+                                                   0, TX MAC will continue
+                                                   to try xmitting until
+                                                   successful or backoff
+                                                   algorithm reaches 
+                                                   ATTEMPT_LIMIT*16 */
+#define    MAC_TX_CFG_NO_BACKOFF        0x0040  /* modify CSMA/CD to disable
+                                                   backoff algorithm. TX
+                                                   MAC will not back off
+                                                   after a xmission attempt
+                                                   that resulted in a 
+                                                   collision. */
+#define    MAC_TX_CFG_SLOW_DOWN         0x0080  /* modify CSMA/CD so that
+                                                   deferral process is reset
+                                                   in response to carrier
+                                                   sense during the entire
+                                                   duration of IPG. TX MAC
+                                                   will only commit to frame
+                                                   xmission after frame
+                                                   xmission has actually
+                                                   begun. */
+#define    MAC_TX_CFG_NO_FCS            0x0100  /* TX MAC will not generate
+                                                   CRC for all xmitted
+                                                   packets. when clear, CRC
+                                                   generation is dependent
+                                                   upon NO_CRC bit in the
+                                                   xmit control word from 
+                                                   TX DMA */
+#define    MAC_TX_CFG_CARRIER_EXTEND    0x0200  /* enables xmit part of the
+                                                   carrier extension 
+                                                   feature. this allows for 
+                                                   longer collision domains
+                                                   by extending the carrier
+                                                   and collision window
+                                                   from the end of FCS until
+                                                   the end of the slot time
+                                                   if necessary. Required
+                                                   for half-duplex at 1Gbps,
+                                                   clear otherwise. */
+
+/* when CRC is not stripped, reassembly packets will not contain the CRC. 
+ * these will be stripped by HRP because it reassembles layer 4 data, and the
+ * CRC is layer 2. however, non-reassembly packets will still contain the CRC 
+ * when passed to the host. to ensure proper operation, need to wait 3.2ms
+ * after clearing RX_CFG_EN before writing to any other RX MAC registers
+ * or other MAC parameters. alternatively, poll RX_CFG_EN until it clears
+ * to 0. similary, HASH_FILTER_EN and ADDR_FILTER_EN have the same 
+ * restrictions as CFG_EN.
+ */
+#define  REG_MAC_RX_CFG                 0x6034  /* RX MAC config reg */
+#define    MAC_RX_CFG_EN                0x0001  /* enable RX MAC */
+#define    MAC_RX_CFG_STRIP_PAD         0x0002  /* always program to 0.
+                                                   feature not supported */
+#define    MAC_RX_CFG_STRIP_FCS         0x0004  /* RX MAC will strip the 
+                                                   last 4 bytes of a 
+                                                   received frame. */
+#define    MAC_RX_CFG_PROMISC_EN        0x0008  /* promiscuous mode */
+#define    MAC_RX_CFG_PROMISC_GROUP_EN  0x0010  /* accept all valid 
+                                                   multicast frames (group
+                                                   bit in DA field set) */
+#define    MAC_RX_CFG_HASH_FILTER_EN    0x0020  /* use hash table to filter
+                                                   multicast addresses */
+#define    MAC_RX_CFG_ADDR_FILTER_EN    0x0040  /* cause RX MAC to use 
+                                                   address filtering regs 
+                                                   to filter both unicast
+                                                   and multicast 
+                                                   addresses */
+#define    MAC_RX_CFG_DISABLE_DISCARD   0x0080  /* pass errored frames to
+                                                   RX DMA by setting BAD
+                                                   bit but not Abort bit
+                                                   in the status. CRC, 
+                                                   framing, and length errs
+                                                   will not increment 
+                                                   error counters. frames
+                                                   which don't match dest
+                                                   addr will be passed up
+                                                   w/ BAD bit set. */
+#define    MAC_RX_CFG_CARRIER_EXTEND    0x0100  /* enable reception of 
+                                                   packet bursts generated
+                                                   by carrier extension
+                                                   with packet bursting
+                                                   senders. only applies
+                                                   to half-duplex 1Gbps */
+
+/* DEFAULT: 0x0 */
+#define  REG_MAC_CTRL_CFG               0x6038  /* MAC control config reg */
+#define    MAC_CTRL_CFG_SEND_PAUSE_EN   0x0001  /* respond to requests for 
+                                                   sending pause flow ctrl 
+                                                   frames */
+#define    MAC_CTRL_CFG_RECV_PAUSE_EN   0x0002  /* respond to received 
+                                                   pause flow ctrl frames */
+#define    MAC_CTRL_CFG_PASS_CTRL       0x0004  /* pass valid MAC ctrl
+                                                   packets to RX DMA */
+
+/* to ensure proper operation, a global initialization sequence should be
+ * performed when a loopback config is entered or exited. if programmed after
+ * a hw or global sw reset, RX/TX MAC software reset and initialization 
+ * should be done to ensure stable clocking. 
+ * DEFAULT: 0x0
+ */
+#define  REG_MAC_XIF_CFG                0x603C  /* XIF config reg */
+#define    MAC_XIF_TX_MII_OUTPUT_EN        0x0001  /* enable output drivers
+                                                      on MII xmit bus */
+#define    MAC_XIF_MII_INT_LOOPBACK        0x0002  /* loopback GMII xmit data
+                                                      path to GMII recv data
+                                                      path. phy mode register
+                                                      clock selection must be
+                                                      set to GMII mode and 
+                                                      GMII_MODE should be set
+                                                      to 1. in loopback mode,
+                                                      REFCLK will drive the
+                                                      entire mac core. 0 for
+                                                      normal operation. */
+#define    MAC_XIF_DISABLE_ECHO            0x0004  /* disables receive data
+                                                      path during packet 
+                                                      xmission. clear to 0
+                                                      in any full duplex mode,
+                                                      in any loopback mode,
+                                                      or in half-duplex SERDES
+                                                      or SLINK modes. set when
+                                                      in half-duplex when 
+                                                      using external phy. */
+#define    MAC_XIF_GMII_MODE               0x0008  /* MAC operates with GMII
+                                                      clocks and datapath */
+#define    MAC_XIF_MII_BUFFER_OUTPUT_EN    0x0010  /* MII_BUF_EN pin. enable
+                                                      external tristate buffer
+                                                      on the MII receive 
+                                                      bus. */
+#define    MAC_XIF_LINK_LED                0x0020  /* LINKLED# active (low) */
+#define    MAC_XIF_FDPLX_LED               0x0040  /* FDPLXLED# active (low) */
+
+#define  REG_MAC_IPG0                      0x6040  /* inter-packet gap0 reg.
+                                                      recommended: 0x00 */
+#define  REG_MAC_IPG1                      0x6044  /* inter-packet gap1 reg
+                                                      recommended: 0x08 */
+#define  REG_MAC_IPG2                      0x6048  /* inter-packet gap2 reg
+                                                      recommended: 0x04 */
+#define  REG_MAC_SLOT_TIME                 0x604C  /* slot time reg
+                                                      recommended: 0x40 */
+#define  REG_MAC_FRAMESIZE_MIN             0x6050  /* min frame size reg 
+                                                      recommended: 0x40 */
+
+/* FRAMESIZE_MAX holds both the max frame size as well as the max burst size.
+ * recommended value:  0x2000.05EE
+ */
+#define  REG_MAC_FRAMESIZE_MAX             0x6054  /* max frame size reg */
+#define    MAC_FRAMESIZE_MAX_BURST_MASK    0x3FFF0000 /* max burst size */
+#define    MAC_FRAMESIZE_MAX_BURST_SHIFT   16
+#define    MAC_FRAMESIZE_MAX_FRAME_MASK    0x00007FFF /* max frame size */
+#define    MAC_FRAMESIZE_MAX_FRAME_SHIFT   0
+#define  REG_MAC_PA_SIZE                   0x6058  /* PA size reg. number of
+                                                      preamble bytes that the
+                                                      TX MAC will xmit at the
+                                                      beginning of each frame
+                                                      value should be 2 or 
+                                                      greater. recommended 
+                                                      value: 0x07 */
+#define  REG_MAC_JAM_SIZE                  0x605C  /* jam size reg. duration 
+                                                      of jam in units of media
+                                                      byte time. recommended
+                                                      value: 0x04 */
+#define  REG_MAC_ATTEMPT_LIMIT             0x6060  /* attempt limit reg. #
+                                                      of attempts TX MAC will
+                                                      make to xmit a frame 
+                                                      before it resets its
+                                                      attempts counter. after
+                                                      the limit has been 
+                                                      reached, TX MAC may or
+                                                      may not drop the frame
+                                                      dependent upon value
+                                                      in TX_MAC_CFG. 
+                                                      recommended 
+                                                      value: 0x10 */
+#define  REG_MAC_CTRL_TYPE                 0x6064  /* MAC control type reg.
+                                                      type field of a MAC 
+                                                      ctrl frame. recommended
+                                                      value: 0x8808 */
+
+/* mac address registers: 0 - 44, 0x6080 - 0x6130, 4 8-bit bytes.
+ * register           contains                   comparison  
+ *    0        16 MSB of primary MAC addr        [47:32] of DA field
+ *    1        16 middle bits ""                 [31:16] of DA field
+ *    2        16 LSB ""                         [15:0] of DA field
+ *    3*x      16MSB of alt MAC addr 1-15        [47:32] of DA field
+ *    4*x      16 middle bits ""                 [31:16]
+ *    5*x      16 LSB ""                         [15:0]
+ *    42       16 MSB of MAC CTRL addr           [47:32] of DA. 
+ *    43       16 middle bits ""                 [31:16]
+ *    44       16 LSB ""                         [15:0]
+ *    MAC CTRL addr must be the reserved multicast addr for MAC CTRL frames.
+ *    if there is a match, MAC will set the bit for alternative address
+ *    filter pass [15]
+
+ *    here is the map of registers given MAC address notation: a:b:c:d:e:f
+ *                     ab             cd             ef
+ *    primary addr     reg 2          reg 1          reg 0
+ *    alt addr 1       reg 5          reg 4          reg 3
+ *    alt addr x       reg 5*x        reg 4*x        reg 3*x
+ *    ctrl addr        reg 44         reg 43         reg 42
+ */
+#define  REG_MAC_ADDR0                     0x6080  /* MAC address 0 reg */
+#define  REG_MAC_ADDRN(x)                  (REG_MAC_ADDR0 + (x)*4)
+#define  REG_MAC_ADDR_FILTER0              0x614C  /* address filter 0 reg
+                                                      [47:32] */
+#define  REG_MAC_ADDR_FILTER1              0x6150  /* address filter 1 reg 
+                                                      [31:16] */
+#define  REG_MAC_ADDR_FILTER2              0x6154  /* address filter 2 reg 
+                                                      [15:0] */
+#define  REG_MAC_ADDR_FILTER2_1_MASK       0x6158  /* address filter 2 and 1
+                                                      mask reg. 8-bit reg
+                                                      contains nibble mask for
+                                                      reg 2 and 1. */
+#define  REG_MAC_ADDR_FILTER0_MASK         0x615C  /* address filter 0 mask 
+                                                      reg */
+
+/* hash table registers: 0 - 15, 0x6160 - 0x619C, 4 8-bit bytes 
+ * 16-bit registers contain bits of the hash table.
+ * reg x  -> [16*(15 - x) + 15 : 16*(15 - x)]. 
+ * e.g., 15 -> [15:0], 0 -> [255:240]
+ */
+#define  REG_MAC_HASH_TABLE0               0x6160  /* hash table 0 reg */
+#define  REG_MAC_HASH_TABLEN(x)            (REG_MAC_HASH_TABLE0 + (x)*4)
+
+/* statistics registers. these registers generate an interrupt on 
+ * overflow. recommended initialization: 0x0000. most are 16-bits except
+ * for PEAK_ATTEMPTS register which is 8 bits.
+ */
+#define  REG_MAC_COLL_NORMAL               0x61A0 /* normal collision 
+                                                     counter. */
+#define  REG_MAC_COLL_FIRST                0x61A4 /* first attempt
+                                                     successful collision 
+                                                     counter */
+#define  REG_MAC_COLL_EXCESS               0x61A8 /* excessive collision 
+                                                     counter */
+#define  REG_MAC_COLL_LATE                 0x61AC /* late collision counter */
+#define  REG_MAC_TIMER_DEFER               0x61B0 /* defer timer. time base 
+                                                     is the media byte 
+                                                     clock/256 */
+#define  REG_MAC_ATTEMPTS_PEAK             0x61B4 /* peak attempts reg */
+#define  REG_MAC_RECV_FRAME                0x61B8 /* receive frame counter */
+#define  REG_MAC_LEN_ERR                   0x61BC /* length error counter */
+#define  REG_MAC_ALIGN_ERR                 0x61C0 /* alignment error counter */
+#define  REG_MAC_FCS_ERR                   0x61C4 /* FCS error counter */
+#define  REG_MAC_RX_CODE_ERR               0x61C8 /* RX code violation
+                                                     error counter */
+
+/* misc registers */
+#define  REG_MAC_RANDOM_SEED               0x61CC /* random number seed reg.
+                                                   10-bit register used as a
+                                                   seed  for the random number
+                                                   generator for the CSMA/CD
+                                                   backoff algorithm. only 
+                                                   programmed after power-on
+                                                   reset and should be a 
+                                                   random value which has a 
+                                                   high likelihood of being 
+                                                   unique for each MAC 
+                                                   attached to a network 
+                                                   segment (e.g., 10 LSB of
+                                                   MAC address) */
+
+/* ASUN: there's a PAUSE_TIMER (ro) described, but it's not in the address
+ *       map
+ */
+
+/* 27-bit register has the current state for key state machines in the MAC */
+#define  REG_MAC_STATE_MACHINE             0x61D0 /* (ro) state machine reg */
+#define    MAC_SM_RLM_MASK                 0x07800000 
+#define    MAC_SM_RLM_SHIFT                23
+#define    MAC_SM_RX_FC_MASK               0x00700000
+#define    MAC_SM_RX_FC_SHIFT              20
+#define    MAC_SM_TLM_MASK                 0x000F0000
+#define    MAC_SM_TLM_SHIFT                16
+#define    MAC_SM_ENCAP_SM_MASK            0x0000F000
+#define    MAC_SM_ENCAP_SM_SHIFT           12
+#define    MAC_SM_TX_REQ_MASK              0x00000C00
+#define    MAC_SM_TX_REQ_SHIFT             10
+#define    MAC_SM_TX_FC_MASK               0x000003C0
+#define    MAC_SM_TX_FC_SHIFT              6
+#define    MAC_SM_FIFO_WRITE_SEL_MASK      0x00000038
+#define    MAC_SM_FIFO_WRITE_SEL_SHIFT     3
+#define    MAC_SM_TX_FIFO_EMPTY_MASK       0x00000007
+#define    MAC_SM_TX_FIFO_EMPTY_SHIFT      0
+
+/** MIF registers. the MIF can be programmed in either bit-bang or 
+ *  frame mode.
+ **/
+#define  REG_MIF_BIT_BANG_CLOCK            0x6200 /* MIF bit-bang clock.
+                                                   1 -> 0 will generate a 
+                                                   rising edge. 0 -> 1 will
+                                                   generate a falling edge. */
+#define  REG_MIF_BIT_BANG_DATA             0x6204 /* MIF bit-bang data. 1-bit
+                                                     register generates data */
+#define  REG_MIF_BIT_BANG_OUTPUT_EN        0x6208 /* MIF bit-bang output 
+                                                     enable. enable when 
+                                                     xmitting data from MIF to
+                                                     transceiver. */
+
+/* 32-bit register serves as an instruction register when the MIF is 
+ * programmed in frame mode. load this register w/ a valid instruction
+ * (as per IEEE 802.3u MII spec). poll this register to check for instruction
+ * execution completion. during a read operation, this register will also
+ * contain the 16-bit data returned by the tranceiver. unless specified 
+ * otherwise, fields are considered "don't care" when polling for 
+ * completion.
+ */
+#define  REG_MIF_FRAME                     0x620C /* MIF frame/output reg */
+#define    MIF_FRAME_START_MASK            0xC0000000 /* start of frame.
+                                                         load w/ 01 when
+                                                         issuing an instr */
+#define    MIF_FRAME_ST                    0x40000000 /* STart of frame */
+#define    MIF_FRAME_OPCODE_MASK           0x30000000 /* opcode. 01 for a 
+                                                         write. 10 for a 
+                                                         read */
+#define    MIF_FRAME_OP_READ               0x20000000 /* read OPcode */
+#define    MIF_FRAME_OP_WRITE              0x10000000 /* write OPcode */
+#define    MIF_FRAME_PHY_ADDR_MASK         0x0F800000 /* phy address. when
+                                                         issuing an instr,
+                                                         this field should be 
+                                                         loaded w/ the XCVR
+                                                         addr */
+#define    MIF_FRAME_PHY_ADDR_SHIFT        23
+#define    MIF_FRAME_REG_ADDR_MASK         0x007C0000 /* register address.
+                                                         when issuing an instr,
+                                                         addr of register
+                                                         to be read/written */
+#define    MIF_FRAME_REG_ADDR_SHIFT        18
+#define    MIF_FRAME_TURN_AROUND_MSB       0x00020000 /* turn around, MSB.
+                                                         when issuing an instr,
+                                                         set this bit to 1 */
+#define    MIF_FRAME_TURN_AROUND_LSB       0x00010000 /* turn around, LSB.
+                                                         when issuing an instr,
+                                                         set this bit to 0.
+                                                         when polling for
+                                                         completion, 1 means
+                                                         that instr execution
+                                                         has been completed */
+#define    MIF_FRAME_DATA_MASK             0x0000FFFF /* instruction payload
+                                                         load with 16-bit data
+                                                         to be written in
+                                                         transceiver reg for a
+                                                         write. doesn't matter
+                                                         in a read. when 
+                                                         polling for 
+                                                         completion, field is
+                                                         "don't care" for write
+                                                         and 16-bit data 
+                                                         returned by the 
+                                                         transceiver for a
+                                                         read (if valid bit
+                                                         is set) */
+#define  REG_MIF_CFG                    0x6210 /* MIF config reg */
+#define    MIF_CFG_PHY_SELECT           0x0001 /* 1 -> select MDIO_1
+                                                  0 -> select MDIO_0 */
+#define    MIF_CFG_POLL_EN              0x0002 /* enable polling
+                                                  mechanism. if set,
+                                                  BB_MODE should be 0 */
+#define    MIF_CFG_BB_MODE              0x0004 /* 1 -> bit-bang mode
+                                                  0 -> frame mode */
+#define    MIF_CFG_POLL_REG_MASK        0x00F8 /* register address to be
+                                                  used by polling mode.
+                                                  only meaningful if POLL_EN
+                                                  is set to 1 */
+#define    MIF_CFG_POLL_REG_SHIFT       3
+#define    MIF_CFG_MDIO_0               0x0100 /* (ro) dual purpose.
+                                                  when MDIO_0 is idle,
+                                                  1 -> tranceiver is 
+                                                  connected to MDIO_0.
+                                                  when MIF is communicating
+                                                  w/ MDIO_0 in bit-bang 
+                                                  mode, this bit indicates
+                                                  the incoming bit stream
+                                                  during a read op */
+#define    MIF_CFG_MDIO_1               0x0200 /* (ro) dual purpose.
+                                                  when MDIO_1 is idle, 
+                                                  1 -> transceiver is 
+                                                  connected to MDIO_1.
+                                                  when MIF is communicating
+                                                  w/ MDIO_1 in bit-bang
+                                                  mode, this bit indicates
+                                                  the incoming bit stream
+                                                  during a read op */
+#define    MIF_CFG_POLL_PHY_MASK        0x7C00 /* tranceiver address to
+                                                  be polled */
+#define    MIF_CFG_POLL_PHY_SHIFT       10
+
+/* 16-bit register used to determine which bits in the POLL_STATUS portion of
+ * the MIF_STATUS register will cause an interrupt. if a mask bit is 0,
+ * corresponding bit of the POLL_STATUS will generate a MIF interrupt when 
+ * set. DEFAULT: 0xFFFF
+ */
+#define  REG_MIF_MASK                      0x6214 /* MIF mask reg */
+
+/* 32-bit register used when in poll mode. auto-cleared after being read */
+#define  REG_MIF_STATUS                    0x6218 /* MIF status reg */
+#define    MIF_STATUS_POLL_DATA_MASK       0xFFFF0000 /* poll data contains
+                                                         the "latest image"
+                                                         update of the XCVR 
+                                                         reg being read */
+#define    MIF_STATUS_POLL_DATA_SHIFT      16
+#define    MIF_STATUS_POLL_STATUS_MASK     0x0000FFFF /* poll status indicates
+                                                         which bits in the
+                                                         POLL_DATA field have
+                                                         changed since the
+                                                         MIF_STATUS reg was
+                                                         last read */
+#define    MIF_STATUS_POLL_STATUS_SHIFT    0
+
+/* 7-bit register has current state for all state machines in the MIF */
+#define  REG_MIF_STATE_MACHINE             0x621C /* MIF state machine reg */
+#define    MIF_SM_CONTROL_MASK             0x07   /* control state machine 
+                                                     state */
+#define    MIF_SM_EXECUTION_MASK           0x60   /* execution state machine
+                                                     state */
+
+/** PCS/Serialink. the following registers are equivalent to the standard
+ *  MII management registers except that they're directly mapped in 
+ *  Cassini's register space.
+ **/
+
+/* the auto-negotiation enable bit should be programmed the same at
+ * the link partner as in the local device to enable auto-negotiation to
+ * complete. when that bit is reprogrammed, auto-neg/manual config is 
+ * restarted automatically.
+ * DEFAULT: 0x1040
+ */
+#define  REG_PCS_MII_CTRL                  0x9000 /* PCS MII control reg */
+#define    PCS_MII_CTRL_1000_SEL           0x0040 /* reads 1. ignored on
+                                                     writes */
+#define    PCS_MII_CTRL_COLLISION_TEST     0x0080 /* COL signal at the PCS
+                                                     to MAC interface is
+                                                     activated regardless
+                                                     of activity */
+#define    PCS_MII_CTRL_DUPLEX             0x0100 /* forced 0x0. PCS 
+                                                     behaviour same for
+                                                     half and full dplx */
+#define    PCS_MII_RESTART_AUTONEG         0x0200 /* self clearing. 
+                                                     restart auto-
+                                                     negotiation */
+#define    PCS_MII_ISOLATE                 0x0400 /* read as 0. ignored
+                                                     on writes */
+#define    PCS_MII_POWER_DOWN              0x0800 /* read as 0. ignored
+                                                     on writes */
+#define    PCS_MII_AUTONEG_EN              0x1000 /* default 1. PCS goes
+                                                     through automatic
+                                                     link config before it
+                                                     can be used. when 0,
+                                                     link can be used 
+                                                     w/out any link config
+                                                     phase */
+#define    PCS_MII_10_100_SEL              0x2000 /* read as 0. ignored on 
+                                                     writes */
+#define    PCS_MII_RESET                   0x8000 /* reset PCS. self-clears
+                                                     when done */
+
+/* DEFAULT: 0x0108 */
+#define  REG_PCS_MII_STATUS                0x9004 /* PCS MII status reg */
+#define    PCS_MII_STATUS_EXTEND_CAP       0x0001 /* reads 0 */
+#define    PCS_MII_STATUS_JABBER_DETECT    0x0002 /* reads 0 */
+#define    PCS_MII_STATUS_LINK_STATUS      0x0004 /* 1 -> link up. 
+                                                     0 -> link down. 0 is
+                                                     latched so that 0 is
+                                                     kept until read. read
+                                                     2x to determine if the
+                                                     link has gone up again */
+#define    PCS_MII_STATUS_AUTONEG_ABLE     0x0008 /* reads 1 (able to perform
+                                                     auto-neg) */
+#define    PCS_MII_STATUS_REMOTE_FAULT     0x0010 /* 1 -> remote fault detected
+                                                     from received link code
+                                                     word. only valid after
+                                                     auto-neg completed */
+#define    PCS_MII_STATUS_AUTONEG_COMP     0x0020 /* 1 -> auto-negotiation 
+                                                          completed
+                                                     0 -> auto-negotiation not
+                                                     completed */
+#define    PCS_MII_STATUS_EXTEND_STATUS    0x0100 /* reads as 1. used as an
+                                                     indication that this is
+                                                     a 1000 Base-X PHY. writes
+                                                     to it are ignored */
+
+/* used during auto-negotiation. 
+ * DEFAULT: 0x00E0
+ */
+#define  REG_PCS_MII_ADVERT                0x9008 /* PCS MII advertisement
+                                                     reg */
+#define    PCS_MII_ADVERT_FD               0x0020  /* advertise full duplex
+                                                      1000 Base-X */
+#define    PCS_MII_ADVERT_HD               0x0040  /* advertise half-duplex
+                                                      1000 Base-X */
+#define    PCS_MII_ADVERT_SYM_PAUSE        0x0080  /* advertise PAUSE
+                                                      symmetric capability */
+#define    PCS_MII_ADVERT_ASYM_PAUSE       0x0100  /* advertises PAUSE 
+                                                      asymmetric capability */
+#define    PCS_MII_ADVERT_RF_MASK          0x3000 /* remote fault. write bit13
+                                                     to optionally indicate to
+                                                     link partner that chip is
+                                                     going off-line. bit12 will
+                                                     get set when signal
+                                                     detect == FAIL and will
+                                                     remain set until 
+                                                     successful negotiation */
+#define    PCS_MII_ADVERT_ACK              0x4000 /* (ro) */
+#define    PCS_MII_ADVERT_NEXT_PAGE        0x8000 /* (ro) forced 0x0 */
+
+/* contents updated as a result of autonegotiation. layout and definitions
+ * identical to PCS_MII_ADVERT
+ */
+#define  REG_PCS_MII_LPA                   0x900C /* PCS MII link partner
+                                                     ability reg */
+#define    PCS_MII_LPA_FD             PCS_MII_ADVERT_FD
+#define    PCS_MII_LPA_HD             PCS_MII_ADVERT_HD
+#define    PCS_MII_LPA_SYM_PAUSE      PCS_MII_ADVERT_SYM_PAUSE
+#define    PCS_MII_LPA_ASYM_PAUSE     PCS_MII_ADVERT_ASYM_PAUSE
+#define    PCS_MII_LPA_RF_MASK        PCS_MII_ADVERT_RF_MASK
+#define    PCS_MII_LPA_ACK            PCS_MII_ADVERT_ACK
+#define    PCS_MII_LPA_NEXT_PAGE      PCS_MII_ADVERT_NEXT_PAGE
+
+/* DEFAULT: 0x0 */
+#define  REG_PCS_CFG                       0x9010 /* PCS config reg */
+#define    PCS_CFG_EN                      0x01   /* enable PCS. must be
+                                                     0 when modifying
+                                                     PCS_MII_ADVERT */
+#define    PCS_CFG_SD_OVERRIDE             0x02   /* sets signal detect to
+                                                     OK. bit is 
+                                                     non-resettable */
+#define    PCS_CFG_SD_ACTIVE_LOW           0x04   /* changes interpretation
+                                                     of optical signal to make
+                                                     signal detect okay when
+                                                     signal is low */
+#define    PCS_CFG_JITTER_STUDY_MASK       0x18   /* used to make jitter
+                                                     measurements. a single
+                                                     code group is xmitted
+                                                     regularly. 
+                                                     0x0 = normal operation
+                                                     0x1 = high freq test 
+                                                           pattern, D21.5
+                                                     0x2 = low freq test
+                                                           pattern, K28.7
+                                                     0x3 = reserved */
+#define    PCS_CFG_10MS_TIMER_OVERRIDE     0x20   /* shortens 10-20ms auto-
+                                                     negotiation timer to 
+                                                     a few cycles for test
+                                                     purposes */
+
+/* used for diagnostic purposes. bits 20-22 autoclear on read */
+#define  REG_PCS_STATE_MACHINE             0x9014 /* (ro) PCS state machine 
+                                                     and diagnostic reg */
+#define    PCS_SM_TX_STATE_MASK            0x0000000F /* 0 and 1 indicate 
+                                                         xmission of idle. 
+                                                         otherwise, xmission of
+                                                         a packet */
+#define    PCS_SM_RX_STATE_MASK            0x000000F0 /* 0 indicates reception
+                                                         of idle. otherwise,
+                                                         reception of packet */
+#define    PCS_SM_WORD_SYNC_STATE_MASK     0x00000700 /* 0 indicates loss of
+                                                         sync */
+#define    PCS_SM_SEQ_DETECT_STATE_MASK    0x00001800 /* cycling through 0-3
+                                                         indicates reception of
+                                                         Config codes. cycling
+                                                         through 0-1 indicates
+                                                         reception of idles */
+#define    PCS_SM_LINK_STATE_MASK          0x0001E000 
+#define        SM_LINK_STATE_UP            0x00016000 /* link state is up */
+
+#define    PCS_SM_LOSS_LINK_C              0x00100000 /* loss of link due to
+                                                         recept of Config 
+                                                         codes */
+#define    PCS_SM_LOSS_LINK_SYNC           0x00200000 /* loss of link due to
+                                                         loss of sync */
+#define    PCS_SM_LOSS_SIGNAL_DETECT       0x00400000 /* signal detect goes 
+                                                         from OK to FAIL. bit29
+                                                         will also be set if 
+                                                         this is set */
+#define    PCS_SM_NO_LINK_BREAKLINK        0x01000000 /* link not up due to
+                                                        receipt of breaklink
+                                                        C codes from partner.
+                                                        C codes w/ 0 content
+                                                        received triggering
+                                                        start/restart of 
+                                                        autonegotiation. 
+                                                        should be sent for
+                                                        no longer than 20ms */
+#define    PCS_SM_NO_LINK_SERDES           0x02000000 /* serdes being 
+                                                        initialized. see serdes
+                                                        state reg */
+#define    PCS_SM_NO_LINK_C                0x04000000 /* C codes not stable or
+                                                         not received */
+#define    PCS_SM_NO_LINK_SYNC             0x08000000 /* word sync not 
+                                                         achieved */
+#define    PCS_SM_NO_LINK_WAIT_C           0x10000000 /* waiting for C codes 
+                                                         w/ ack bit set */
+#define    PCS_SM_NO_LINK_NO_IDLE          0x20000000 /* link partner continues
+                                                         to send C codes 
+                                                         instead of idle 
+                                                         symbols or pkt data */
+
+/* this register indicates interrupt changes in specific PCS MII status bits.
+ * PCS_INT may be masked at the ISR level. only a single bit is implemented
+ * for link status change.
+ */
+#define  REG_PCS_INTR_STATUS               0x9018 /* PCS interrupt status */
+#define    PCS_INTR_STATUS_LINK_CHANGE     0x04   /* link status has changed
+                                                     since last read */
+
+/* control which network interface is used. no more than one bit should
+ * be set.
+ * DEFAULT: none
+ */
+#define  REG_PCS_DATAPATH_MODE             0x9050 /* datapath mode reg */
+#define    PCS_DATAPATH_MODE_MII           0x00 /* PCS is not used and 
+                                                   MII/GMII is selected. 
+                                                   selection between MII and
+                                                   GMII is controlled by 
+                                                   XIF_CFG */
+#define    PCS_DATAPATH_MODE_SERDES        0x02 /* PCS is used via the
+                                                   10-bit interface */
+
+/* input to serdes chip or serialink block */
+#define  REG_PCS_SERDES_CTRL              0x9054 /* serdes control reg */
+#define    PCS_SERDES_CTRL_LOOPBACK       0x01   /* enable loopback on 
+                                                    serdes interface */
+#define    PCS_SERDES_CTRL_SYNCD_EN       0x02   /* enable sync carrier
+                                                    detection. should be
+                                                    0x0 for normal 
+                                                    operation */
+#define    PCS_SERDES_CTRL_LOCKREF       0x04   /* frequency-lock RBC[0:1]
+                                                   to REFCLK when set.
+                                                   when clear, receiver
+                                                   clock locks to incoming
+                                                   serial data */
+
+/* multiplex test outputs into the PROM address (PA_3 through PA_0) pins.
+ * should be 0x0 for normal operations. 
+ * 0b000          normal operation, PROM address[3:0] selected
+ * 0b001          rxdma req, rxdma ack, rxdma ready, rxdma read 
+ * 0b010          rxmac req, rx ack, rx tag, rx clk shared 
+ * 0b011          txmac req, tx ack, tx tag, tx retry req 
+ * 0b100          tx tp3, tx tp2, tx tp1, tx tp0 
+ * 0b101          R period RX, R period TX, R period HP, R period BIM
+ * DEFAULT: 0x0
+ */
+#define  REG_PCS_SHARED_OUTPUT_SEL         0x9058 /* shared output select */
+#define    PCS_SOS_PROM_ADDR_MASK          0x0007
+
+/* used for diagnostics. this register indicates progress of the SERDES 
+ * boot up. 
+ * 0b00       undergoing reset
+ * 0b01       waiting 500us while lockrefn is asserted
+ * 0b10       waiting for comma detect
+ * 0b11       receive data is synchronized 
+ * DEFAULT: 0x0
+ */
+#define  REG_PCS_SERDES_STATE              0x905C /* (ro) serdes state */
+#define    PCS_SERDES_STATE_MASK           0x03   
+
+/* used for diagnostics. indicates number of packets transmitted or received.
+ * counters rollover w/out generating an interrupt.
+ * DEFAULT: 0x0
+ */
+#define  REG_PCS_PACKET_COUNT              0x9060 /* (ro) PCS packet counter */
+#define    PCS_PACKET_COUNT_TX             0x000007FF /* pkts xmitted by PCS */
+#define    PCS_PACKET_COUNT_RX             0x07FF0000 /* pkts recvd by PCS
+                                                         whether they 
+                                                         encountered an error
+                                                         or not */
+
+/** LocalBus Devices. the following provides run-time access to the 
+ *  Cassini's PROM
+ ***/
+#define  REG_EXPANSION_ROM_RUN_START       0x100000 /* expansion rom run time
+                                                       access */
+#define  REG_EXPANSION_ROM_RUN_END         0x17FFFF
+
+#define  REG_SECOND_LOCALBUS_START         0x180000 /* secondary local bus 
+                                                       device */
+#define  REG_SECOND_LOCALBUS_END           0x1FFFFF
+
+/* entropy device */
+#define  REG_ENTROPY_START                 REG_SECOND_LOCALBUS_START
+#define  REG_ENTROPY_DATA                  (REG_ENTROPY_START + 0x00)
+#define  REG_ENTROPY_STATUS                (REG_ENTROPY_START + 0x04)
+#define      ENTROPY_STATUS_DRDY           0x01
+#define      ENTROPY_STATUS_BUSY           0x02
+#define      ENTROPY_STATUS_CIPHER         0x04
+#define      ENTROPY_STATUS_BYPASS_MASK    0x18
+#define  REG_ENTROPY_MODE                  (REG_ENTROPY_START + 0x05)
+#define      ENTROPY_MODE_KEY_MASK         0x07
+#define      ENTROPY_MODE_ENCRYPT          0x40
+#define  REG_ENTROPY_RAND_REG              (REG_ENTROPY_START + 0x06)
+#define  REG_ENTROPY_RESET                 (REG_ENTROPY_START + 0x07)
+#define      ENTROPY_RESET_DES_IO          0x01
+#define      ENTROPY_RESET_STC_MODE        0x02
+#define      ENTROPY_RESET_KEY_CACHE       0x04
+#define      ENTROPY_RESET_IV              0x08
+#define  REG_ENTROPY_IV                    (REG_ENTROPY_START + 0x08)
+#define  REG_ENTROPY_KEY0                  (REG_ENTROPY_START + 0x10)
+#define  REG_ENTROPY_KEYN(x)               (REG_ENTROPY_KEY0 + 4*(x))
+
+/* phys of interest w/ their special mii registers */
+#define PHY_LUCENT_B0     0x00437421
+#define   LUCENT_MII_REG      0x1F
+
+#define PHY_NS_DP83065    0x20005c78
+#define   DP83065_MII_MEM     0x16
+#define   DP83065_MII_REGD    0x1D
+#define   DP83065_MII_REGE    0x1E
+
+#define PHY_BROADCOM_5411 0x00206071
+#define PHY_BROADCOM_B0   0x00206050
+#define   BROADCOM_MII_REG4   0x14
+#define   BROADCOM_MII_REG5   0x15
+#define   BROADCOM_MII_REG7   0x17
+#define   BROADCOM_MII_REG8   0x18
+
+#define   CAS_MII_ANNPTR          0x07
+#define   CAS_MII_ANNPRR          0x08
+#define   CAS_MII_1000_CTRL       0x09
+#define   CAS_MII_1000_STATUS     0x0A
+#define   CAS_MII_1000_EXTEND     0x0F
+
+#define   CAS_BMSR_1000_EXTEND    0x0100 /* supports 1000Base-T extended status */
+/* 
+ * if autoneg is disabled, here's the table:
+ * BMCR_SPEED100 = 100Mbps
+ * BMCR_SPEED1000 = 1000Mbps
+ * ~(BMCR_SPEED100 | BMCR_SPEED1000) = 10Mbps
+ */
+#define   CAS_BMCR_SPEED1000      0x0040  /* Select 1000Mbps */
+
+#define   CAS_ADVERTISE_1000HALF   0x0100
+#define   CAS_ADVERTISE_1000FULL   0x0200
+#define   CAS_ADVERTISE_PAUSE      0x0400
+#define   CAS_ADVERTISE_ASYM_PAUSE 0x0800
+
+/* regular lpa register */
+#define   CAS_LPA_PAUSE            CAS_ADVERTISE_PAUSE
+#define   CAS_LPA_ASYM_PAUSE       CAS_ADVERTISE_ASYM_PAUSE
+
+/* 1000_STATUS register */
+#define   CAS_LPA_1000HALF        0x0400
+#define   CAS_LPA_1000FULL        0x0800
+
+#define   CAS_EXTEND_1000XFULL    0x8000
+#define   CAS_EXTEND_1000XHALF    0x4000
+#define   CAS_EXTEND_1000TFULL    0x2000
+#define   CAS_EXTEND_1000THALF    0x1000
+
+/* cassini header parser firmware */
+typedef struct cas_hp_inst {
+        const char *note;
+
+        u16 mask, val;
+
+        u8 op;
+        u8 soff, snext; /* if match succeeds, new offset and match */
+        u8 foff, fnext; /* if match fails, new offset and match */
+        /* output info */
+        u8 outop;    /* output opcode */
+
+        u16 outarg;  /* output argument */
+        u8 outenab;  /* output enable: 0 = not, 1 = if match
+                         2 = if !match, 3 = always */
+        u8 outshift; /* barrel shift right, 4 bits */
+        u16 outmask; 
+} cas_hp_inst_t;
+
+/* comparison */
+#define OP_EQ     0 /* packet == value */
+#define OP_LT     1 /* packet < value */
+#define OP_GT     2 /* packet > value */
+#define OP_NP     3 /* new packet */
+
+/* output opcodes */
+#define CL_REG  0
+#define LD_FID  1
+#define LD_SEQ  2
+#define LD_CTL  3
+#define LD_SAP  4
+#define LD_R1   5
+#define LD_L3   6
+#define LD_SUM  7
+#define LD_HDR  8
+#define IM_FID  9
+#define IM_SEQ  10
+#define IM_SAP  11
+#define IM_R1   12
+#define IM_CTL  13
+#define LD_LEN  14
+#define ST_FLG  15
+
+/* match setp #s for IP4TCP4 */
+#define S1_PCKT         0
+#define S1_VLAN         1
+#define S1_CFI          2
+#define S1_8023         3
+#define S1_LLC          4
+#define S1_LLCc         5
+#define S1_IPV4         6
+#define S1_IPV4c        7
+#define S1_IPV4F        8
+#define S1_TCP44        9
+#define S1_IPV6         10
+#define S1_IPV6L        11
+#define S1_IPV6c        12
+#define S1_TCP64        13
+#define S1_TCPSQ        14
+#define S1_TCPFG        15
+#define S1_TCPHL        16
+#define S1_TCPHc        17
+#define S1_CLNP         18
+#define S1_CLNP2        19
+#define S1_DROP         20
+#define S2_HTTP         21
+#define S1_ESP4         22
+#define S1_AH4          23
+#define S1_ESP6         24
+#define S1_AH6          25
+
+#define CAS_PROG_IP46TCP4_PREAMBLE \
+{ "packet arrival?", 0xffff, 0x0000, OP_NP,  6, S1_VLAN,  0, S1_PCKT,  \
+  CL_REG, 0x3ff, 1, 0x0, 0x0000}, \
+{ "VLAN?", 0xffff, 0x8100, OP_EQ,  1, S1_CFI,   0, S1_8023,  \
+  IM_CTL, 0x00a,  3, 0x0, 0xffff}, \
+{ "CFI?", 0x1000, 0x1000, OP_EQ,  0, S1_DROP,  1, S1_8023, \
+  CL_REG, 0x000,  0, 0x0, 0x0000}, \
+{ "8023?", 0xffff, 0x0600, OP_LT,  1, S1_LLC,   0, S1_IPV4, \
+  CL_REG, 0x000,  0, 0x0, 0x0000}, \
+{ "LLC?", 0xffff, 0xaaaa, OP_EQ,  1, S1_LLCc,  0, S1_CLNP, \
+  CL_REG, 0x000,  0, 0x0, 0x0000}, \
+{ "LLCc?", 0xff00, 0x0300, OP_EQ,  2, S1_IPV4,  0, S1_CLNP, \
+  CL_REG, 0x000,  0, 0x0, 0x0000}, \
+{ "IPV4?", 0xffff, 0x0800, OP_EQ,  1, S1_IPV4c, 0, S1_IPV6, \
+  LD_SAP, 0x100,  3, 0x0, 0xffff}, \
+{ "IPV4 cont?", 0xff00, 0x4500, OP_EQ,  3, S1_IPV4F, 0, S1_CLNP, \
+  LD_SUM, 0x00a,  1, 0x0, 0x0000}, \
+{ "IPV4 frag?", 0x3fff, 0x0000, OP_EQ,  1, S1_TCP44, 0, S1_CLNP, \
+  LD_LEN, 0x03e,  1, 0x0, 0xffff}, \
+{ "TCP44?", 0x00ff, 0x0006, OP_EQ,  7, S1_TCPSQ, 0, S1_CLNP, \
+  LD_FID, 0x182,  1, 0x0, 0xffff}, /* FID IP4&TCP src+dst */ \
+{ "IPV6?", 0xffff, 0x86dd, OP_EQ,  1, S1_IPV6L, 0, S1_CLNP,  \
+  LD_SUM, 0x015,  1, 0x0, 0x0000}, \
+{ "IPV6 len", 0xf000, 0x6000, OP_EQ,  0, S1_IPV6c, 0, S1_CLNP, \
+  IM_R1,  0x128,  1, 0x0, 0xffff}, \
+{ "IPV6 cont?", 0x0000, 0x0000, OP_EQ,  3, S1_TCP64, 0, S1_CLNP, \
+  LD_FID, 0x484,  1, 0x0, 0xffff}, /* FID IP6&TCP src+dst */ \
+{ "TCP64?", 0xff00, 0x0600, OP_EQ, 18, S1_TCPSQ, 0, S1_CLNP, \
+  LD_LEN, 0x03f,  1, 0x0, 0xffff}
+
+#ifdef USE_HP_IP46TCP4
+static cas_hp_inst_t cas_prog_ip46tcp4tab[] = {
+        CAS_PROG_IP46TCP4_PREAMBLE, 
+        { "TCP seq", /* DADDR should point to dest port */ 
+          0x0000, 0x0000, OP_EQ, 0, S1_TCPFG, 4, S1_TCPFG, LD_SEQ, 
+          0x081,  3, 0x0, 0xffff}, /* Load TCP seq # */
+        { "TCP control flags", 0x0000, 0x0000, OP_EQ,  0, S1_TCPHL, 0,
+          S1_TCPHL, ST_FLG, 0x045,  3, 0x0, 0x002f}, /* Load TCP flags */
+        { "TCP length", 0x0000, 0x0000, OP_EQ,  0, S1_TCPHc, 0,
+          S1_TCPHc, LD_R1,  0x205,  3, 0xB, 0xf000},
+        { "TCP length cont", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0,
+          S1_PCKT,  LD_HDR, 0x0ff,  3, 0x0, 0xffff},
+        { "Cleanup", 0x0000, 0x0000, OP_EQ,  0, S1_CLNP2,  0, S1_CLNP2,
+          IM_CTL, 0x001,  3, 0x0, 0x0001},
+        { "Cleanup 2", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          IM_CTL, 0x000,  0, 0x0, 0x0000},
+        { "Drop packet", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          IM_CTL, 0x080,  3, 0x0, 0xffff},
+        { NULL },
+};
+#ifdef HP_IP46TCP4_DEFAULT
+#define CAS_HP_FIRMWARE               cas_prog_ip46tcp4tab
+#endif
+#endif
+
+/*
+ * Alternate table load which excludes HTTP server traffic from reassembly.
+ * It is substantially similar to the basic table, with one extra state
+ * and a few extra compares. */
+#ifdef USE_HP_IP46TCP4NOHTTP
+static cas_hp_inst_t cas_prog_ip46tcp4nohttptab[] = {
+        CAS_PROG_IP46TCP4_PREAMBLE,
+        { "TCP seq", /* DADDR should point to dest port */
+          0xFFFF, 0x0080, OP_EQ,  0, S2_HTTP,  0, S1_TCPFG, LD_SEQ, 
+          0x081,  3, 0x0, 0xffff} , /* Load TCP seq # */
+        { "TCP control flags", 0xFFFF, 0x8080, OP_EQ,  0, S2_HTTP,  0,
+          S1_TCPHL, ST_FLG, 0x145,  2, 0x0, 0x002f, }, /* Load TCP flags */
+        { "TCP length", 0x0000, 0x0000, OP_EQ,  0, S1_TCPHc, 0, S1_TCPHc,
+          LD_R1,  0x205,  3, 0xB, 0xf000},
+        { "TCP length cont", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          LD_HDR, 0x0ff,  3, 0x0, 0xffff},
+        { "Cleanup", 0x0000, 0x0000, OP_EQ,  0, S1_CLNP2,  0, S1_CLNP2,
+          IM_CTL, 0x001,  3, 0x0, 0x0001},
+        { "Cleanup 2", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          CL_REG, 0x002,  3, 0x0, 0x0000},
+        { "Drop packet", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          IM_CTL, 0x080,  3, 0x0, 0xffff},
+        { "No HTTP", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          IM_CTL, 0x044,  3, 0x0, 0xffff},
+        { NULL },
+};
+#ifdef HP_IP46TCP4NOHTTP_DEFAULT
+#define CAS_HP_FIRMWARE               cas_prog_ip46tcp4nohttptab
+#endif
+#endif
+
+/* match step #s for IP4FRAG */
+#define S3_IPV6c        11
+#define S3_TCP64        12
+#define S3_TCPSQ        13
+#define S3_TCPFG        14
+#define S3_TCPHL        15
+#define S3_TCPHc        16
+#define S3_FRAG         17
+#define S3_FOFF         18
+#define S3_CLNP         19
+
+#ifdef USE_HP_IP4FRAG
+static cas_hp_inst_t cas_prog_ip4fragtab[] = {
+        { "packet arrival?", 0xffff, 0x0000, OP_NP,  6, S1_VLAN,  0, S1_PCKT,
+          CL_REG, 0x3ff, 1, 0x0, 0x0000},
+        { "VLAN?", 0xffff, 0x8100, OP_EQ,  1, S1_CFI,   0, S1_8023,
+          IM_CTL, 0x00a,  3, 0x0, 0xffff},
+        { "CFI?", 0x1000, 0x1000, OP_EQ,  0, S3_CLNP,  1, S1_8023,
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "8023?", 0xffff, 0x0600, OP_LT,  1, S1_LLC,   0, S1_IPV4,
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "LLC?", 0xffff, 0xaaaa, OP_EQ,  1, S1_LLCc,  0, S3_CLNP,
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "LLCc?",0xff00, 0x0300, OP_EQ,  2, S1_IPV4,  0, S3_CLNP,
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "IPV4?", 0xffff, 0x0800, OP_EQ,  1, S1_IPV4c, 0, S1_IPV6,
+          LD_SAP, 0x100,  3, 0x0, 0xffff},
+        { "IPV4 cont?", 0xff00, 0x4500, OP_EQ,  3, S1_IPV4F, 0, S3_CLNP,
+          LD_SUM, 0x00a,  1, 0x0, 0x0000},
+        { "IPV4 frag?", 0x3fff, 0x0000, OP_EQ,  1, S1_TCP44, 0, S3_FRAG,
+          LD_LEN, 0x03e,  3, 0x0, 0xffff},
+        { "TCP44?", 0x00ff, 0x0006, OP_EQ,  7, S3_TCPSQ, 0, S3_CLNP,
+          LD_FID, 0x182,  3, 0x0, 0xffff}, /* FID IP4&TCP src+dst */
+        { "IPV6?", 0xffff, 0x86dd, OP_EQ,  1, S3_IPV6c, 0, S3_CLNP,
+          LD_SUM, 0x015,  1, 0x0, 0x0000},
+        { "IPV6 cont?", 0xf000, 0x6000, OP_EQ,  3, S3_TCP64, 0, S3_CLNP,
+          LD_FID, 0x484,  1, 0x0, 0xffff}, /* FID IP6&TCP src+dst */
+        { "TCP64?", 0xff00, 0x0600, OP_EQ, 18, S3_TCPSQ, 0, S3_CLNP,
+          LD_LEN, 0x03f,  1, 0x0, 0xffff},
+        { "TCP seq",    /* DADDR should point to dest port */
+          0x0000, 0x0000, OP_EQ,  0, S3_TCPFG, 4, S3_TCPFG, LD_SEQ,
+          0x081,  3, 0x0, 0xffff}, /* Load TCP seq # */
+        { "TCP control flags", 0x0000, 0x0000, OP_EQ,  0, S3_TCPHL, 0, 
+          S3_TCPHL, ST_FLG, 0x045,  3, 0x0, 0x002f}, /* Load TCP flags */
+        { "TCP length", 0x0000, 0x0000, OP_EQ,  0, S3_TCPHc, 0, S3_TCPHc,
+          LD_R1,  0x205,  3, 0xB, 0xf000},
+        { "TCP length cont", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          LD_HDR, 0x0ff,  3, 0x0, 0xffff},
+        { "IP4 Fragment", 0x0000, 0x0000, OP_EQ,  0, S3_FOFF,  0, S3_FOFF,
+          LD_FID, 0x103,  3, 0x0, 0xffff}, /* FID IP4 src+dst */
+        { "IP4 frag offset", 0x0000, 0x0000, OP_EQ,  0, S3_FOFF,  0, S3_FOFF,
+          LD_SEQ, 0x040,  1, 0xD, 0xfff8},
+        { "Cleanup", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,  
+          IM_CTL, 0x001,  3, 0x0, 0x0001},
+        { NULL },
+};
+#ifdef HP_IP4FRAG_DEFAULT
+#define CAS_HP_FIRMWARE               cas_prog_ip4fragtab
+#endif
+#endif
+
+/*
+ * Alternate table which does batching without reassembly
+ */
+#ifdef USE_HP_IP46TCP4BATCH
+static cas_hp_inst_t cas_prog_ip46tcp4batchtab[] = {
+        CAS_PROG_IP46TCP4_PREAMBLE,
+        { "TCP seq",    /* DADDR should point to dest port */
+          0x0000, 0x0000, OP_EQ,  0, S1_TCPFG, 0, S1_TCPFG, LD_SEQ,
+          0x081,  3, 0x0, 0xffff}, /* Load TCP seq # */
+        { "TCP control flags", 0x0000, 0x0000, OP_EQ,  0, S1_TCPHL, 0, 
+          S1_TCPHL, ST_FLG, 0x000,  3, 0x0, 0x0000}, /* Load TCP flags */
+        { "TCP length", 0x0000, 0x0000, OP_EQ,  0, S1_TCPHc, 0, 
+          S1_TCPHc, LD_R1,  0x205,  3, 0xB, 0xf000},
+        { "TCP length cont", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, 
+          S1_PCKT,  IM_CTL, 0x040,  3, 0x0, 0xffff}, /* set batch bit */
+        { "Cleanup", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          IM_CTL, 0x001,  3, 0x0, 0x0001},
+        { "Drop packet", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0,
+          S1_PCKT,  IM_CTL, 0x080,  3, 0x0, 0xffff},
+        { NULL },
+};
+#ifdef HP_IP46TCP4BATCH_DEFAULT
+#define CAS_HP_FIRMWARE               cas_prog_ip46tcp4batchtab
+#endif
+#endif
+
+/* Workaround for Cassini rev2 descriptor corruption problem.
+ * Does batching without reassembly, and sets the SAP to a known
+ * data pattern for all packets.
+ */
+#ifdef USE_HP_WORKAROUND
+static cas_hp_inst_t  cas_prog_workaroundtab[] = {
+        { "packet arrival?", 0xffff, 0x0000, OP_NP,  6, S1_VLAN,  0,
+          S1_PCKT,  CL_REG, 0x3ff,  1, 0x0, 0x0000} ,
+        { "VLAN?", 0xffff, 0x8100, OP_EQ,  1, S1_CFI, 0, S1_8023, 
+          IM_CTL, 0x04a,  3, 0x0, 0xffff},
+        { "CFI?", 0x1000, 0x1000, OP_EQ,  0, S1_CLNP,  1, S1_8023,
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "8023?", 0xffff, 0x0600, OP_LT,  1, S1_LLC,   0, S1_IPV4,
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "LLC?", 0xffff, 0xaaaa, OP_EQ,  1, S1_LLCc,  0, S1_CLNP,
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "LLCc?", 0xff00, 0x0300, OP_EQ,  2, S1_IPV4,  0, S1_CLNP,
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "IPV4?", 0xffff, 0x0800, OP_EQ,  1, S1_IPV4c, 0, S1_IPV6,
+          IM_SAP, 0x6AE,  3, 0x0, 0xffff},
+        { "IPV4 cont?", 0xff00, 0x4500, OP_EQ,  3, S1_IPV4F, 0, S1_CLNP,
+          LD_SUM, 0x00a,  1, 0x0, 0x0000},
+        { "IPV4 frag?", 0x3fff, 0x0000, OP_EQ,  1, S1_TCP44, 0, S1_CLNP,  
+          LD_LEN, 0x03e,  1, 0x0, 0xffff},
+        { "TCP44?", 0x00ff, 0x0006, OP_EQ,  7, S1_TCPSQ, 0, S1_CLNP,
+          LD_FID, 0x182,  3, 0x0, 0xffff}, /* FID IP4&TCP src+dst */
+        { "IPV6?", 0xffff, 0x86dd, OP_EQ,  1, S1_IPV6L, 0, S1_CLNP,
+          LD_SUM, 0x015,  1, 0x0, 0x0000},
+        { "IPV6 len", 0xf000, 0x6000, OP_EQ,  0, S1_IPV6c, 0, S1_CLNP,
+          IM_R1,  0x128,  1, 0x0, 0xffff},
+        { "IPV6 cont?", 0x0000, 0x0000, OP_EQ,  3, S1_TCP64, 0, S1_CLNP,
+          LD_FID, 0x484,  1, 0x0, 0xffff}, /* FID IP6&TCP src+dst */
+        { "TCP64?", 0xff00, 0x0600, OP_EQ, 18, S1_TCPSQ, 0, S1_CLNP,
+          LD_LEN, 0x03f,  1, 0x0, 0xffff},
+        { "TCP seq",      /* DADDR should point to dest port */
+          0x0000, 0x0000, OP_EQ,  0, S1_TCPFG, 4, S1_TCPFG, LD_SEQ, 
+          0x081,  3, 0x0, 0xffff}, /* Load TCP seq # */
+        { "TCP control flags", 0x0000, 0x0000, OP_EQ,  0, S1_TCPHL, 0,
+          S1_TCPHL, ST_FLG, 0x045,  3, 0x0, 0x002f}, /* Load TCP flags */
+        { "TCP length", 0x0000, 0x0000, OP_EQ,  0, S1_TCPHc, 0, S1_TCPHc,
+          LD_R1,  0x205,  3, 0xB, 0xf000},
+        { "TCP length cont", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0,
+          S1_PCKT,  LD_HDR, 0x0ff,  3, 0x0, 0xffff},
+        { "Cleanup", 0x0000, 0x0000, OP_EQ,  0, S1_CLNP2, 0, S1_CLNP2,
+          IM_SAP, 0x6AE,  3, 0x0, 0xffff} ,
+        { "Cleanup 2", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          IM_CTL, 0x001,  3, 0x0, 0x0001},
+        { NULL },
+};
+#ifdef HP_WORKAROUND_DEFAULT
+#define CAS_HP_FIRMWARE               cas_prog_workaroundtab
+#endif
+#endif
+
+#ifdef USE_HP_ENCRYPT
+static cas_hp_inst_t  cas_prog_encryptiontab[] = {
+        { "packet arrival?", 0xffff, 0x0000, OP_NP,  6, S1_VLAN,  0, 
+          S1_PCKT,  CL_REG, 0x3ff,  1, 0x0, 0x0000},
+        { "VLAN?", 0xffff, 0x8100, OP_EQ,  1, S1_CFI,   0, S1_8023,
+          IM_CTL, 0x00a,  3, 0x0, 0xffff},
+#if 0
+//"CFI?", /* 02 FIND CFI and If FIND go to S1_DROP */
+//0x1000, 0x1000, OP_EQ,  0, S1_DROP,  1, S1_8023,  CL_REG, 0x000,  0, 0x0, 0x00
+        00,
+#endif
+        { "CFI?", /* FIND CFI and If FIND go to CleanUP1 (ignore and send to host) */
+          0x1000, 0x1000, OP_EQ,  0, S1_CLNP,  1, S1_8023,  
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "8023?", 0xffff, 0x0600, OP_LT,  1, S1_LLC,   0, S1_IPV4, 
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "LLC?", 0xffff, 0xaaaa, OP_EQ,  1, S1_LLCc,  0, S1_CLNP, 
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "LLCc?", 0xff00, 0x0300, OP_EQ,  2, S1_IPV4,  0, S1_CLNP,
+          CL_REG, 0x000,  0, 0x0, 0x0000},
+        { "IPV4?", 0xffff, 0x0800, OP_EQ,  1, S1_IPV4c, 0, S1_IPV6,  
+          LD_SAP, 0x100,  3, 0x0, 0xffff},
+        { "IPV4 cont?", 0xff00, 0x4500, OP_EQ,  3, S1_IPV4F, 0, S1_CLNP,  
+          LD_SUM, 0x00a,  1, 0x0, 0x0000},
+        { "IPV4 frag?", 0x3fff, 0x0000, OP_EQ,  1, S1_TCP44, 0, S1_CLNP, 
+          LD_LEN, 0x03e,  1, 0x0, 0xffff},
+        { "TCP44?", 0x00ff, 0x0006, OP_EQ,  7, S1_TCPSQ, 0, S1_ESP4,
+          LD_FID, 0x182,  1, 0x0, 0xffff}, /* FID IP4&TCP src+dst */
+        { "IPV6?", 0xffff, 0x86dd, OP_EQ,  1, S1_IPV6L, 0, S1_CLNP,
+          LD_SUM, 0x015,  1, 0x0, 0x0000},
+        { "IPV6 len", 0xf000, 0x6000, OP_EQ,  0, S1_IPV6c, 0, S1_CLNP,
+          IM_R1,  0x128,  1, 0x0, 0xffff},
+        { "IPV6 cont?", 0x0000, 0x0000, OP_EQ,  3, S1_TCP64, 0, S1_CLNP, 
+          LD_FID, 0x484,  1, 0x0, 0xffff}, /*  FID IP6&TCP src+dst */
+        { "TCP64?", 
+#if 0
+//@@@0xff00, 0x0600, OP_EQ, 18, S1_TCPSQ, 0, S1_ESP6,  LD_LEN, 0x03f,  1, 0x0, 0xffff,
+#endif
+          0xff00, 0x0600, OP_EQ, 12, S1_TCPSQ, 0, S1_ESP6,  LD_LEN,
+          0x03f,  1, 0x0, 0xffff},
+        { "TCP seq", /* 14:DADDR should point to dest port */
+          0xFFFF, 0x0080, OP_EQ,  0, S2_HTTP,  0, S1_TCPFG, LD_SEQ,
+          0x081,  3, 0x0, 0xffff}, /* Load TCP seq # */
+        { "TCP control flags", 0xFFFF, 0x8080, OP_EQ,  0, S2_HTTP,  0,
+          S1_TCPHL, ST_FLG, 0x145,  2, 0x0, 0x002f}, /* Load TCP flags */
+        { "TCP length", 0x0000, 0x0000, OP_EQ,  0, S1_TCPHc, 0, S1_TCPHc, 
+          LD_R1,  0x205,  3, 0xB, 0xf000} ,
+        { "TCP length cont", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0,
+          S1_PCKT,  LD_HDR, 0x0ff,  3, 0x0, 0xffff}, 
+        { "Cleanup", 0x0000, 0x0000, OP_EQ,  0, S1_CLNP2,  0, S1_CLNP2,
+          IM_CTL, 0x001,  3, 0x0, 0x0001},
+        { "Cleanup 2", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          CL_REG, 0x002,  3, 0x0, 0x0000},
+        { "Drop packet", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          IM_CTL, 0x080,  3, 0x0, 0xffff},
+        { "No HTTP", 0x0000, 0x0000, OP_EQ,  0, S1_PCKT,  0, S1_PCKT,
+          IM_CTL, 0x044,  3, 0x0, 0xffff}, 
+        { "IPV4 ESP encrypted?",  /* S1_ESP4 */
+          0x00ff, 0x0032, OP_EQ,  0, S1_CLNP2, 0, S1_AH4, IM_CTL,
+          0x021, 1,  0x0, 0xffff},
+        { "IPV4 AH encrypted?",   /* S1_AH4 */
+          0x00ff, 0x0033, OP_EQ,  0, S1_CLNP2, 0, S1_CLNP, IM_CTL,
+          0x021, 1,  0x0, 0xffff},
+        { "IPV6 ESP encrypted?",  /* S1_ESP6 */
+#if 0
+//@@@0x00ff, 0x0032, OP_EQ,  0, S1_CLNP2, 0, S1_AH6, IM_CTL, 0x021, 1,  0x0, 0xffff,
+#endif
+          0xff00, 0x3200, OP_EQ,  0, S1_CLNP2, 0, S1_AH6, IM_CTL,
+          0x021, 1,  0x0, 0xffff},
+        { "IPV6 AH encrypted?",   /* S1_AH6 */
+#if 0
+//@@@0x00ff, 0x0033, OP_EQ,  0, S1_CLNP2, 0, S1_CLNP, IM_CTL, 0x021, 1,  0x0, 0xffff,
+#endif
+          0xff00, 0x3300, OP_EQ,  0, S1_CLNP2, 0, S1_CLNP, IM_CTL,
+          0x021, 1,  0x0, 0xffff},
+        { NULL },
+};
+#ifdef HP_ENCRYPT_DEFAULT
+#define CAS_HP_FIRMWARE               cas_prog_encryptiontab
+#endif
+#endif
+
+static cas_hp_inst_t cas_prog_null[] = { {NULL} };
+#ifdef HP_NULL_DEFAULT
+#define CAS_HP_FIRMWARE               cas_prog_null
+#endif
+
+/* firmware patch for NS_DP83065 */
+typedef struct cas_saturn_patch {
+        u16 addr;
+        u16 val;
+} cas_saturn_patch_t;
+
+#if 1
+cas_saturn_patch_t cas_saturn_patch[] = {
+{0x8200,    0x007e}, {0x8201,    0x0082}, {0x8202,    0x0009},
+{0x8203,    0x0000}, {0x8204,    0x0000}, {0x8205,    0x0000},
+{0x8206,    0x0000}, {0x8207,    0x0000}, {0x8208,    0x0000},
+{0x8209,    0x008e}, {0x820a,    0x008e}, {0x820b,    0x00ff},
+{0x820c,    0x00ce}, {0x820d,    0x0082}, {0x820e,    0x0025},
+{0x820f,    0x00ff}, {0x8210,    0x0001}, {0x8211,    0x000f},
+{0x8212,    0x00ce}, {0x8213,    0x0084}, {0x8214,    0x0026},
+{0x8215,    0x00ff}, {0x8216,    0x0001}, {0x8217,    0x0011},
+{0x8218,    0x00ce}, {0x8219,    0x0085}, {0x821a,    0x003d},
+{0x821b,    0x00df}, {0x821c,    0x00e5}, {0x821d,    0x0086},
+{0x821e,    0x0039}, {0x821f,    0x00b7}, {0x8220,    0x008f},
+{0x8221,    0x00f8}, {0x8222,    0x007e}, {0x8223,    0x00c3},
+{0x8224,    0x00c2}, {0x8225,    0x0096}, {0x8226,    0x0047},
+{0x8227,    0x0084}, {0x8228,    0x00f3}, {0x8229,    0x008a},
+{0x822a,    0x0000}, {0x822b,    0x0097}, {0x822c,    0x0047},
+{0x822d,    0x00ce}, {0x822e,    0x0082}, {0x822f,    0x0033},
+{0x8230,    0x00ff}, {0x8231,    0x0001}, {0x8232,    0x000f},
+{0x8233,    0x0096}, {0x8234,    0x0046}, {0x8235,    0x0084},
+{0x8236,    0x000c}, {0x8237,    0x0081}, {0x8238,    0x0004},
+{0x8239,    0x0027}, {0x823a,    0x000b}, {0x823b,    0x0096},
+{0x823c,    0x0046}, {0x823d,    0x0084}, {0x823e,    0x000c},
+{0x823f,    0x0081}, {0x8240,    0x0008}, {0x8241,    0x0027},
+{0x8242,    0x0057}, {0x8243,    0x007e}, {0x8244,    0x0084},
+{0x8245,    0x0025}, {0x8246,    0x0096}, {0x8247,    0x0047},
+{0x8248,    0x0084}, {0x8249,    0x00f3}, {0x824a,    0x008a},
+{0x824b,    0x0004}, {0x824c,    0x0097}, {0x824d,    0x0047},
+{0x824e,    0x00ce}, {0x824f,    0x0082}, {0x8250,    0x0054},
+{0x8251,    0x00ff}, {0x8252,    0x0001}, {0x8253,    0x000f},
+{0x8254,    0x0096}, {0x8255,    0x0046}, {0x8256,    0x0084},
+{0x8257,    0x000c}, {0x8258,    0x0081}, {0x8259,    0x0004},
+{0x825a,    0x0026}, {0x825b,    0x0038}, {0x825c,    0x00b6},
+{0x825d,    0x0012}, {0x825e,    0x0020}, {0x825f,    0x0084},
+{0x8260,    0x0020}, {0x8261,    0x0026}, {0x8262,    0x0003},
+{0x8263,    0x007e}, {0x8264,    0x0084}, {0x8265,    0x0025},
+{0x8266,    0x0096}, {0x8267,    0x007b}, {0x8268,    0x00d6},
+{0x8269,    0x007c}, {0x826a,    0x00fe}, {0x826b,    0x008f},
+{0x826c,    0x0056}, {0x826d,    0x00bd}, {0x826e,    0x00f7},
+{0x826f,    0x00b6}, {0x8270,    0x00fe}, {0x8271,    0x008f},
+{0x8272,    0x004e}, {0x8273,    0x00bd}, {0x8274,    0x00ec},
+{0x8275,    0x008e}, {0x8276,    0x00bd}, {0x8277,    0x00fa},
+{0x8278,    0x00f7}, {0x8279,    0x00bd}, {0x827a,    0x00f7},
+{0x827b,    0x0028}, {0x827c,    0x00ce}, {0x827d,    0x0082},
+{0x827e,    0x0082}, {0x827f,    0x00ff}, {0x8280,    0x0001},
+{0x8281,    0x000f}, {0x8282,    0x0096}, {0x8283,    0x0046},
+{0x8284,    0x0084}, {0x8285,    0x000c}, {0x8286,    0x0081},
+{0x8287,    0x0004}, {0x8288,    0x0026}, {0x8289,    0x000a},
+{0x828a,    0x00b6}, {0x828b,    0x0012}, {0x828c,    0x0020},
+{0x828d,    0x0084}, {0x828e,    0x0020}, {0x828f,    0x0027},
+{0x8290,    0x00b5}, {0x8291,    0x007e}, {0x8292,    0x0084},
+{0x8293,    0x0025}, {0x8294,    0x00bd}, {0x8295,    0x00f7},
+{0x8296,    0x001f}, {0x8297,    0x007e}, {0x8298,    0x0084},
+{0x8299,    0x001f}, {0x829a,    0x0096}, {0x829b,    0x0047},
+{0x829c,    0x0084}, {0x829d,    0x00f3}, {0x829e,    0x008a},
+{0x829f,    0x0008}, {0x82a0,    0x0097}, {0x82a1,    0x0047},
+{0x82a2,    0x00de}, {0x82a3,    0x00e1}, {0x82a4,    0x00ad},
+{0x82a5,    0x0000}, {0x82a6,    0x00ce}, {0x82a7,    0x0082},
+{0x82a8,    0x00af}, {0x82a9,    0x00ff}, {0x82aa,    0x0001},
+{0x82ab,    0x000f}, {0x82ac,    0x007e}, {0x82ad,    0x0084},
+{0x82ae,    0x0025}, {0x82af,    0x0096}, {0x82b0,    0x0041},
+{0x82b1,    0x0085}, {0x82b2,    0x0010}, {0x82b3,    0x0026},
+{0x82b4,    0x0006}, {0x82b5,    0x0096}, {0x82b6,    0x0023},
+{0x82b7,    0x0085}, {0x82b8,    0x0040}, {0x82b9,    0x0027},
+{0x82ba,    0x0006}, {0x82bb,    0x00bd}, {0x82bc,    0x00ed},
+{0x82bd,    0x0000}, {0x82be,    0x007e}, {0x82bf,    0x0083},
+{0x82c0,    0x00a2}, {0x82c1,    0x00de}, {0x82c2,    0x0042},
+{0x82c3,    0x00bd}, {0x82c4,    0x00eb}, {0x82c5,    0x008e},
+{0x82c6,    0x0096}, {0x82c7,    0x0024}, {0x82c8,    0x0084},
+{0x82c9,    0x0008}, {0x82ca,    0x0027}, {0x82cb,    0x0003},
+{0x82cc,    0x007e}, {0x82cd,    0x0083}, {0x82ce,    0x00df},
+{0x82cf,    0x0096}, {0x82d0,    0x007b}, {0x82d1,    0x00d6},
+{0x82d2,    0x007c}, {0x82d3,    0x00fe}, {0x82d4,    0x008f},
+{0x82d5,    0x0056}, {0x82d6,    0x00bd}, {0x82d7,    0x00f7},
+{0x82d8,    0x00b6}, {0x82d9,    0x00fe}, {0x82da,    0x008f},
+{0x82db,    0x0050}, {0x82dc,    0x00bd}, {0x82dd,    0x00ec},
+{0x82de,    0x008e}, {0x82df,    0x00bd}, {0x82e0,    0x00fa},
+{0x82e1,    0x00f7}, {0x82e2,    0x0086}, {0x82e3,    0x0011},
+{0x82e4,    0x00c6}, {0x82e5,    0x0049}, {0x82e6,    0x00bd},
+{0x82e7,    0x00e4}, {0x82e8,    0x0012}, {0x82e9,    0x00ce},
+{0x82ea,    0x0082}, {0x82eb,    0x00ef}, {0x82ec,    0x00ff},
+{0x82ed,    0x0001}, {0x82ee,    0x000f}, {0x82ef,    0x0096},
+{0x82f0,    0x0046}, {0x82f1,    0x0084}, {0x82f2,    0x000c},
+{0x82f3,    0x0081}, {0x82f4,    0x0000}, {0x82f5,    0x0027},
+{0x82f6,    0x0017}, {0x82f7,    0x00c6}, {0x82f8,    0x0049},
+{0x82f9,    0x00bd}, {0x82fa,    0x00e4}, {0x82fb,    0x0091},
+{0x82fc,    0x0024}, {0x82fd,    0x000d}, {0x82fe,    0x00b6},
+{0x82ff,    0x0012}, {0x8300,    0x0020}, {0x8301,    0x0085},
+{0x8302,    0x0020}, {0x8303,    0x0026}, {0x8304,    0x000c},
+{0x8305,    0x00ce}, {0x8306,    0x0082}, {0x8307,    0x00c1},
+{0x8308,    0x00ff}, {0x8309,    0x0001}, {0x830a,    0x000f},
+{0x830b,    0x007e}, {0x830c,    0x0084}, {0x830d,    0x0025},
+{0x830e,    0x007e}, {0x830f,    0x0084}, {0x8310,    0x0016},
+{0x8311,    0x00fe}, {0x8312,    0x008f}, {0x8313,    0x0052},
+{0x8314,    0x00bd}, {0x8315,    0x00ec}, {0x8316,    0x008e},
+{0x8317,    0x00bd}, {0x8318,    0x00fa}, {0x8319,    0x00f7},
+{0x831a,    0x0086}, {0x831b,    0x006a}, {0x831c,    0x00c6},
+{0x831d,    0x0049}, {0x831e,    0x00bd}, {0x831f,    0x00e4},
+{0x8320,    0x0012}, {0x8321,    0x00ce}, {0x8322,    0x0083},
+{0x8323,    0x0027}, {0x8324,    0x00ff}, {0x8325,    0x0001},
+{0x8326,    0x000f}, {0x8327,    0x0096}, {0x8328,    0x0046},
+{0x8329,    0x0084}, {0x832a,    0x000c}, {0x832b,    0x0081},
+{0x832c,    0x0000}, {0x832d,    0x0027}, {0x832e,    0x000a},
+{0x832f,    0x00c6}, {0x8330,    0x0049}, {0x8331,    0x00bd},
+{0x8332,    0x00e4}, {0x8333,    0x0091}, {0x8334,    0x0025},
+{0x8335,    0x0006}, {0x8336,    0x007e}, {0x8337,    0x0084},
+{0x8338,    0x0025}, {0x8339,    0x007e}, {0x833a,    0x0084},
+{0x833b,    0x0016}, {0x833c,    0x00b6}, {0x833d,    0x0018},
+{0x833e,    0x0070}, {0x833f,    0x00bb}, {0x8340,    0x0019},
+{0x8341,    0x0070}, {0x8342,    0x002a}, {0x8343,    0x0004},
+{0x8344,    0x0081}, {0x8345,    0x00af}, {0x8346,    0x002e},
+{0x8347,    0x0019}, {0x8348,    0x0096}, {0x8349,    0x007b},
+{0x834a,    0x00f6}, {0x834b,    0x0020}, {0x834c,    0x0007},
+{0x834d,    0x00fa}, {0x834e,    0x0020}, {0x834f,    0x0027},
+{0x8350,    0x00c4}, {0x8351,    0x0038}, {0x8352,    0x0081},
+{0x8353,    0x0038}, {0x8354,    0x0027}, {0x8355,    0x000b},
+{0x8356,    0x00f6}, {0x8357,    0x0020}, {0x8358,    0x0007},
+{0x8359,    0x00fa}, {0x835a,    0x0020}, {0x835b,    0x0027},
+{0x835c,    0x00cb}, {0x835d,    0x0008}, {0x835e,    0x007e},
+{0x835f,    0x0082}, {0x8360,    0x00d3}, {0x8361,    0x00bd},
+{0x8362,    0x00f7}, {0x8363,    0x0066}, {0x8364,    0x0086},
+{0x8365,    0x0074}, {0x8366,    0x00c6}, {0x8367,    0x0049},
+{0x8368,    0x00bd}, {0x8369,    0x00e4}, {0x836a,    0x0012},
+{0x836b,    0x00ce}, {0x836c,    0x0083}, {0x836d,    0x0071},
+{0x836e,    0x00ff}, {0x836f,    0x0001}, {0x8370,    0x000f},
+{0x8371,    0x0096}, {0x8372,    0x0046}, {0x8373,    0x0084},
+{0x8374,    0x000c}, {0x8375,    0x0081}, {0x8376,    0x0008},
+{0x8377,    0x0026}, {0x8378,    0x000a}, {0x8379,    0x00c6},
+{0x837a,    0x0049}, {0x837b,    0x00bd}, {0x837c,    0x00e4},
+{0x837d,    0x0091}, {0x837e,    0x0025}, {0x837f,    0x0006},
+{0x8380,    0x007e}, {0x8381,    0x0084}, {0x8382,    0x0025},
+{0x8383,    0x007e}, {0x8384,    0x0084}, {0x8385,    0x0016},
+{0x8386,    0x00bd}, {0x8387,    0x00f7}, {0x8388,    0x003e},
+{0x8389,    0x0026}, {0x838a,    0x000e}, {0x838b,    0x00bd},
+{0x838c,    0x00e5}, {0x838d,    0x0009}, {0x838e,    0x0026},
+{0x838f,    0x0006}, {0x8390,    0x00ce}, {0x8391,    0x0082},
+{0x8392,    0x00c1}, {0x8393,    0x00ff}, {0x8394,    0x0001},
+{0x8395,    0x000f}, {0x8396,    0x007e}, {0x8397,    0x0084},
+{0x8398,    0x0025}, {0x8399,    0x00fe}, {0x839a,    0x008f},
+{0x839b,    0x0054}, {0x839c,    0x00bd}, {0x839d,    0x00ec},
+{0x839e,    0x008e}, {0x839f,    0x00bd}, {0x83a0,    0x00fa},
+{0x83a1,    0x00f7}, {0x83a2,    0x00bd}, {0x83a3,    0x00f7},
+{0x83a4,    0x0033}, {0x83a5,    0x0086}, {0x83a6,    0x000f},
+{0x83a7,    0x00c6}, {0x83a8,    0x0051}, {0x83a9,    0x00bd},
+{0x83aa,    0x00e4}, {0x83ab,    0x0012}, {0x83ac,    0x00ce},
+{0x83ad,    0x0083}, {0x83ae,    0x00b2}, {0x83af,    0x00ff},
+{0x83b0,    0x0001}, {0x83b1,    0x000f}, {0x83b2,    0x0096},
+{0x83b3,    0x0046}, {0x83b4,    0x0084}, {0x83b5,    0x000c},
+{0x83b6,    0x0081}, {0x83b7,    0x0008}, {0x83b8,    0x0026},
+{0x83b9,    0x005c}, {0x83ba,    0x00b6}, {0x83bb,    0x0012},
+{0x83bc,    0x0020}, {0x83bd,    0x0084}, {0x83be,    0x003f},
+{0x83bf,    0x0081}, {0x83c0,    0x003a}, {0x83c1,    0x0027},
+{0x83c2,    0x001c}, {0x83c3,    0x0096}, {0x83c4,    0x0023},
+{0x83c5,    0x0085}, {0x83c6,    0x0040}, {0x83c7,    0x0027},
+{0x83c8,    0x0003}, {0x83c9,    0x007e}, {0x83ca,    0x0084},
+{0x83cb,    0x0025}, {0x83cc,    0x00c6}, {0x83cd,    0x0051},
+{0x83ce,    0x00bd}, {0x83cf,    0x00e4}, {0x83d0,    0x0091},
+{0x83d1,    0x0025}, {0x83d2,    0x0003}, {0x83d3,    0x007e},
+{0x83d4,    0x0084}, {0x83d5,    0x0025}, {0x83d6,    0x00ce},
+{0x83d7,    0x0082}, {0x83d8,    0x00c1}, {0x83d9,    0x00ff},
+{0x83da,    0x0001}, {0x83db,    0x000f}, {0x83dc,    0x007e},
+{0x83dd,    0x0084}, {0x83de,    0x0025}, {0x83df,    0x00bd},
+{0x83e0,    0x00f8}, {0x83e1,    0x0037}, {0x83e2,    0x007c},
+{0x83e3,    0x0000}, {0x83e4,    0x007a}, {0x83e5,    0x00ce},
+{0x83e6,    0x0083}, {0x83e7,    0x00ee}, {0x83e8,    0x00ff},
+{0x83e9,    0x0001}, {0x83ea,    0x000f}, {0x83eb,    0x007e},
+{0x83ec,    0x0084}, {0x83ed,    0x0025}, {0x83ee,    0x0096},
+{0x83ef,    0x0046}, {0x83f0,    0x0084}, {0x83f1,    0x000c},
+{0x83f2,    0x0081}, {0x83f3,    0x0008}, {0x83f4,    0x0026},
+{0x83f5,    0x0020}, {0x83f6,    0x0096}, {0x83f7,    0x0024},
+{0x83f8,    0x0084}, {0x83f9,    0x0008}, {0x83fa,    0x0026},
+{0x83fb,    0x0029}, {0x83fc,    0x00b6}, {0x83fd,    0x0018},
+{0x83fe,    0x0082}, {0x83ff,    0x00bb}, {0x8400,    0x0019},
+{0x8401,    0x0082}, {0x8402,    0x00b1}, {0x8403,    0x0001},
+{0x8404,    0x003b}, {0x8405,    0x0022}, {0x8406,    0x0009},
+{0x8407,    0x00b6}, {0x8408,    0x0012}, {0x8409,    0x0020},
+{0x840a,    0x0084}, {0x840b,    0x0037}, {0x840c,    0x0081},
+{0x840d,    0x0032}, {0x840e,    0x0027}, {0x840f,    0x0015},
+{0x8410,    0x00bd}, {0x8411,    0x00f8}, {0x8412,    0x0044},
+{0x8413,    0x007e}, {0x8414,    0x0082}, {0x8415,    0x00c1},
+{0x8416,    0x00bd}, {0x8417,    0x00f7}, {0x8418,    0x001f},
+{0x8419,    0x00bd}, {0x841a,    0x00f8}, {0x841b,    0x0044},
+{0x841c,    0x00bd}, {0x841d,    0x00fc}, {0x841e,    0x0029},
+{0x841f,    0x00ce}, {0x8420,    0x0082}, {0x8421,    0x0025},
+{0x8422,    0x00ff}, {0x8423,    0x0001}, {0x8424,    0x000f},
+{0x8425,    0x0039}, {0x8426,    0x0096}, {0x8427,    0x0047},
+{0x8428,    0x0084}, {0x8429,    0x00fc}, {0x842a,    0x008a},
+{0x842b,    0x0000}, {0x842c,    0x0097}, {0x842d,    0x0047},
+{0x842e,    0x00ce}, {0x842f,    0x0084}, {0x8430,    0x0034},
+{0x8431,    0x00ff}, {0x8432,    0x0001}, {0x8433,    0x0011},
+{0x8434,    0x0096}, {0x8435,    0x0046}, {0x8436,    0x0084},
+{0x8437,    0x0003}, {0x8438,    0x0081}, {0x8439,    0x0002},
+{0x843a,    0x0027}, {0x843b,    0x0003}, {0x843c,    0x007e},
+{0x843d,    0x0085}, {0x843e,    0x001e}, {0x843f,    0x0096},
+{0x8440,    0x0047}, {0x8441,    0x0084}, {0x8442,    0x00fc},
+{0x8443,    0x008a}, {0x8444,    0x0002}, {0x8445,    0x0097},
+{0x8446,    0x0047}, {0x8447,    0x00de}, {0x8448,    0x00e1},
+{0x8449,    0x00ad}, {0x844a,    0x0000}, {0x844b,    0x0086},
+{0x844c,    0x0001}, {0x844d,    0x00b7}, {0x844e,    0x0012},
+{0x844f,    0x0051}, {0x8450,    0x00bd}, {0x8451,    0x00f7},
+{0x8452,    0x0014}, {0x8453,    0x00b6}, {0x8454,    0x0010},
+{0x8455,    0x0031}, {0x8456,    0x0084}, {0x8457,    0x00fd},
+{0x8458,    0x00b7}, {0x8459,    0x0010}, {0x845a,    0x0031},
+{0x845b,    0x00bd}, {0x845c,    0x00f8}, {0x845d,    0x001e},
+{0x845e,    0x0096}, {0x845f,    0x0081}, {0x8460,    0x00d6},
+{0x8461,    0x0082}, {0x8462,    0x00fe}, {0x8463,    0x008f},
+{0x8464,    0x005a}, {0x8465,    0x00bd}, {0x8466,    0x00f7},
+{0x8467,    0x00b6}, {0x8468,    0x00fe}, {0x8469,    0x008f},
+{0x846a,    0x005c}, {0x846b,    0x00bd}, {0x846c,    0x00ec},
+{0x846d,    0x008e}, {0x846e,    0x00bd}, {0x846f,    0x00fa},
+{0x8470,    0x00f7}, {0x8471,    0x0086}, {0x8472,    0x0008},
+{0x8473,    0x00d6}, {0x8474,    0x0000}, {0x8475,    0x00c5},
+{0x8476,    0x0010}, {0x8477,    0x0026}, {0x8478,    0x0002},
+{0x8479,    0x008b}, {0x847a,    0x0020}, {0x847b,    0x00c6},
+{0x847c,    0x0051}, {0x847d,    0x00bd}, {0x847e,    0x00e4},
+{0x847f,    0x0012}, {0x8480,    0x00ce}, {0x8481,    0x0084},
+{0x8482,    0x0086}, {0x8483,    0x00ff}, {0x8484,    0x0001},
+{0x8485,    0x0011}, {0x8486,    0x0096}, {0x8487,    0x0046},
+{0x8488,    0x0084}, {0x8489,    0x0003}, {0x848a,    0x0081},
+{0x848b,    0x0002}, {0x848c,    0x0027}, {0x848d,    0x0003},
+{0x848e,    0x007e}, {0x848f,    0x0085}, {0x8490,    0x000f},
+{0x8491,    0x00c6}, {0x8492,    0x0051}, {0x8493,    0x00bd},
+{0x8494,    0x00e4}, {0x8495,    0x0091}, {0x8496,    0x0025},
+{0x8497,    0x0003}, {0x8498,    0x007e}, {0x8499,    0x0085},
+{0x849a,    0x001e}, {0x849b,    0x0096}, {0x849c,    0x0044},
+{0x849d,    0x0085}, {0x849e,    0x0010}, {0x849f,    0x0026},
+{0x84a0,    0x000a}, {0x84a1,    0x00b6}, {0x84a2,    0x0012},
+{0x84a3,    0x0050}, {0x84a4,    0x00ba}, {0x84a5,    0x0001},
+{0x84a6,    0x003c}, {0x84a7,    0x0085}, {0x84a8,    0x0010},
+{0x84a9,    0x0027}, {0x84aa,    0x00a8}, {0x84ab,    0x00bd},
+{0x84ac,    0x00f7}, {0x84ad,    0x0066}, {0x84ae,    0x00ce},
+{0x84af,    0x0084}, {0x84b0,    0x00b7}, {0x84b1,    0x00ff},
+{0x84b2,    0x0001}, {0x84b3,    0x0011}, {0x84b4,    0x007e},
+{0x84b5,    0x0085}, {0x84b6,    0x001e}, {0x84b7,    0x0096},
+{0x84b8,    0x0046}, {0x84b9,    0x0084}, {0x84ba,    0x0003},
+{0x84bb,    0x0081}, {0x84bc,    0x0002}, {0x84bd,    0x0026},
+{0x84be,    0x0050}, {0x84bf,    0x00b6}, {0x84c0,    0x0012},
+{0x84c1,    0x0030}, {0x84c2,    0x0084}, {0x84c3,    0x0003},
+{0x84c4,    0x0081}, {0x84c5,    0x0001}, {0x84c6,    0x0027},
+{0x84c7,    0x0003}, {0x84c8,    0x007e}, {0x84c9,    0x0085},
+{0x84ca,    0x001e}, {0x84cb,    0x0096}, {0x84cc,    0x0044},
+{0x84cd,    0x0085}, {0x84ce,    0x0010}, {0x84cf,    0x0026},
+{0x84d0,    0x0013}, {0x84d1,    0x00b6}, {0x84d2,    0x0012},
+{0x84d3,    0x0050}, {0x84d4,    0x00ba}, {0x84d5,    0x0001},
+{0x84d6,    0x003c}, {0x84d7,    0x0085}, {0x84d8,    0x0010},
+{0x84d9,    0x0026}, {0x84da,    0x0009}, {0x84db,    0x00ce},
+{0x84dc,    0x0084}, {0x84dd,    0x0053}, {0x84de,    0x00ff},
+{0x84df,    0x0001}, {0x84e0,    0x0011}, {0x84e1,    0x007e},
+{0x84e2,    0x0085}, {0x84e3,    0x001e}, {0x84e4,    0x00b6},
+{0x84e5,    0x0010}, {0x84e6,    0x0031}, {0x84e7,    0x008a},
+{0x84e8,    0x0002}, {0x84e9,    0x00b7}, {0x84ea,    0x0010},
+{0x84eb,    0x0031}, {0x84ec,    0x00bd}, {0x84ed,    0x0085},
+{0x84ee,    0x001f}, {0x84ef,    0x00bd}, {0x84f0,    0x00f8},
+{0x84f1,    0x0037}, {0x84f2,    0x007c}, {0x84f3,    0x0000},
+{0x84f4,    0x0080}, {0x84f5,    0x00ce}, {0x84f6,    0x0084},
+{0x84f7,    0x00fe}, {0x84f8,    0x00ff}, {0x84f9,    0x0001},
+{0x84fa,    0x0011}, {0x84fb,    0x007e}, {0x84fc,    0x0085},
+{0x84fd,    0x001e}, {0x84fe,    0x0096}, {0x84ff,    0x0046},
+{0x8500,    0x0084}, {0x8501,    0x0003}, {0x8502,    0x0081},
+{0x8503,    0x0002}, {0x8504,    0x0026}, {0x8505,    0x0009},
+{0x8506,    0x00b6}, {0x8507,    0x0012}, {0x8508,    0x0030},
+{0x8509,    0x0084}, {0x850a,    0x0003}, {0x850b,    0x0081},
+{0x850c,    0x0001}, {0x850d,    0x0027}, {0x850e,    0x000f},
+{0x850f,    0x00bd}, {0x8510,    0x00f8}, {0x8511,    0x0044},
+{0x8512,    0x00bd}, {0x8513,    0x00f7}, {0x8514,    0x000b},
+{0x8515,    0x00bd}, {0x8516,    0x00fc}, {0x8517,    0x0029},
+{0x8518,    0x00ce}, {0x8519,    0x0084}, {0x851a,    0x0026},
+{0x851b,    0x00ff}, {0x851c,    0x0001}, {0x851d,    0x0011},
+{0x851e,    0x0039}, {0x851f,    0x00d6}, {0x8520,    0x0022},
+{0x8521,    0x00c4}, {0x8522,    0x000f}, {0x8523,    0x00b6},
+{0x8524,    0x0012}, {0x8525,    0x0030}, {0x8526,    0x00ba},
+{0x8527,    0x0012}, {0x8528,    0x0032}, {0x8529,    0x0084},
+{0x852a,    0x0004}, {0x852b,    0x0027}, {0x852c,    0x000d},
+{0x852d,    0x0096}, {0x852e,    0x0022}, {0x852f,    0x0085},
+{0x8530,    0x0004}, {0x8531,    0x0027}, {0x8532,    0x0005},
+{0x8533,    0x00ca}, {0x8534,    0x0010}, {0x8535,    0x007e},
+{0x8536,    0x0085}, {0x8537,    0x003a}, {0x8538,    0x00ca},
+{0x8539,    0x0020}, {0x853a,    0x00d7}, {0x853b,    0x0022},
+{0x853c,    0x0039}, {0x853d,    0x0086}, {0x853e,    0x0000},
+{0x853f,    0x0097}, {0x8540,    0x0083}, {0x8541,    0x0018},
+{0x8542,    0x00ce}, {0x8543,    0x001c}, {0x8544,    0x0000},
+{0x8545,    0x00bd}, {0x8546,    0x00eb}, {0x8547,    0x0046},
+{0x8548,    0x0096}, {0x8549,    0x0057}, {0x854a,    0x0085},
+{0x854b,    0x0001}, {0x854c,    0x0027}, {0x854d,    0x0002},
+{0x854e,    0x004f}, {0x854f,    0x0039}, {0x8550,    0x0085},
+{0x8551,    0x0002}, {0x8552,    0x0027}, {0x8553,    0x0001},
+{0x8554,    0x0039}, {0x8555,    0x007f}, {0x8556,    0x008f},
+{0x8557,    0x007d}, {0x8558,    0x0086}, {0x8559,    0x0004},
+{0x855a,    0x00b7}, {0x855b,    0x0012}, {0x855c,    0x0004},
+{0x855d,    0x0086}, {0x855e,    0x0008}, {0x855f,    0x00b7},
+{0x8560,    0x0012}, {0x8561,    0x0007}, {0x8562,    0x0086},
+{0x8563,    0x0010}, {0x8564,    0x00b7}, {0x8565,    0x0012},
+{0x8566,    0x000c}, {0x8567,    0x0086}, {0x8568,    0x0007},
+{0x8569,    0x00b7}, {0x856a,    0x0012}, {0x856b,    0x0006},
+{0x856c,    0x00b6}, {0x856d,    0x008f}, {0x856e,    0x007d},
+{0x856f,    0x00b7}, {0x8570,    0x0012}, {0x8571,    0x0070},
+{0x8572,    0x0086}, {0x8573,    0x0001}, {0x8574,    0x00ba},
+{0x8575,    0x0012}, {0x8576,    0x0004}, {0x8577,    0x00b7},
+{0x8578,    0x0012}, {0x8579,    0x0004}, {0x857a,    0x0001},
+{0x857b,    0x0001}, {0x857c,    0x0001}, {0x857d,    0x0001},
+{0x857e,    0x0001}, {0x857f,    0x0001}, {0x8580,    0x00b6},
+{0x8581,    0x0012}, {0x8582,    0x0004}, {0x8583,    0x0084},
+{0x8584,    0x00fe}, {0x8585,    0x008a}, {0x8586,    0x0002},
+{0x8587,    0x00b7}, {0x8588,    0x0012}, {0x8589,    0x0004},
+{0x858a,    0x0001}, {0x858b,    0x0001}, {0x858c,    0x0001},
+{0x858d,    0x0001}, {0x858e,    0x0001}, {0x858f,    0x0001},
+{0x8590,    0x0086}, {0x8591,    0x00fd}, {0x8592,    0x00b4},
+{0x8593,    0x0012}, {0x8594,    0x0004}, {0x8595,    0x00b7},
+{0x8596,    0x0012}, {0x8597,    0x0004}, {0x8598,    0x00b6},
+{0x8599,    0x0012}, {0x859a,    0x0000}, {0x859b,    0x0084},
+{0x859c,    0x0008}, {0x859d,    0x0081}, {0x859e,    0x0008},
+{0x859f,    0x0027}, {0x85a0,    0x0016}, {0x85a1,    0x00b6},
+{0x85a2,    0x008f}, {0x85a3,    0x007d}, {0x85a4,    0x0081},
+{0x85a5,    0x000c}, {0x85a6,    0x0027}, {0x85a7,    0x0008},
+{0x85a8,    0x008b}, {0x85a9,    0x0004}, {0x85aa,    0x00b7},
+{0x85ab,    0x008f}, {0x85ac,    0x007d}, {0x85ad,    0x007e},
+{0x85ae,    0x0085}, {0x85af,    0x006c}, {0x85b0,    0x0086},
+{0x85b1,    0x0003}, {0x85b2,    0x0097}, {0x85b3,    0x0040},
+{0x85b4,    0x007e}, {0x85b5,    0x0089}, {0x85b6,    0x006e},
+{0x85b7,    0x0086}, {0x85b8,    0x0007}, {0x85b9,    0x00b7},
+{0x85ba,    0x0012}, {0x85bb,    0x0006}, {0x85bc,    0x005f},
+{0x85bd,    0x00f7}, {0x85be,    0x008f}, {0x85bf,    0x0082},
+{0x85c0,    0x005f}, {0x85c1,    0x00f7}, {0x85c2,    0x008f},
+{0x85c3,    0x007f}, {0x85c4,    0x00f7}, {0x85c5,    0x008f},
+{0x85c6,    0x0070}, {0x85c7,    0x00f7}, {0x85c8,    0x008f},
+{0x85c9,    0x0071}, {0x85ca,    0x00f7}, {0x85cb,    0x008f},
+{0x85cc,    0x0072}, {0x85cd,    0x00f7}, {0x85ce,    0x008f},
+{0x85cf,    0x0073}, {0x85d0,    0x00f7}, {0x85d1,    0x008f},
+{0x85d2,    0x0074}, {0x85d3,    0x00f7}, {0x85d4,    0x008f},
+{0x85d5,    0x0075}, {0x85d6,    0x00f7}, {0x85d7,    0x008f},
+{0x85d8,    0x0076}, {0x85d9,    0x00f7}, {0x85da,    0x008f},
+{0x85db,    0x0077}, {0x85dc,    0x00f7}, {0x85dd,    0x008f},
+{0x85de,    0x0078}, {0x85df,    0x00f7}, {0x85e0,    0x008f},
+{0x85e1,    0x0079}, {0x85e2,    0x00f7}, {0x85e3,    0x008f},
+{0x85e4,    0x007a}, {0x85e5,    0x00f7}, {0x85e6,    0x008f},
+{0x85e7,    0x007b}, {0x85e8,    0x00b6}, {0x85e9,    0x0012},
+{0x85ea,    0x0004}, {0x85eb,    0x008a}, {0x85ec,    0x0010},
+{0x85ed,    0x00b7}, {0x85ee,    0x0012}, {0x85ef,    0x0004},
+{0x85f0,    0x0086}, {0x85f1,    0x00e4}, {0x85f2,    0x00b7},
+{0x85f3,    0x0012}, {0x85f4,    0x0070}, {0x85f5,    0x00b7},
+{0x85f6,    0x0012}, {0x85f7,    0x0007}, {0x85f8,    0x00f7},
+{0x85f9,    0x0012}, {0x85fa,    0x0005}, {0x85fb,    0x00f7},
+{0x85fc,    0x0012}, {0x85fd,    0x0009}, {0x85fe,    0x0086},
+{0x85ff,    0x0008}, {0x8600,    0x00ba}, {0x8601,    0x0012},
+{0x8602,    0x0004}, {0x8603,    0x00b7}, {0x8604,    0x0012},
+{0x8605,    0x0004}, {0x8606,    0x0086}, {0x8607,    0x00f7},
+{0x8608,    0x00b4}, {0x8609,    0x0012}, {0x860a,    0x0004},
+{0x860b,    0x00b7}, {0x860c,    0x0012}, {0x860d,    0x0004},
+{0x860e,    0x0001}, {0x860f,    0x0001}, {0x8610,    0x0001},
+{0x8611,    0x0001}, {0x8612,    0x0001}, {0x8613,    0x0001},
+{0x8614,    0x00b6}, {0x8615,    0x0012}, {0x8616,    0x0008},
+{0x8617,    0x0027}, {0x8618,    0x007f}, {0x8619,    0x0081},
+{0x861a,    0x0080}, {0x861b,    0x0026}, {0x861c,    0x000b},
+{0x861d,    0x0086}, {0x861e,    0x0008}, {0x861f,    0x00ce},
+{0x8620,    0x008f}, {0x8621,    0x0079}, {0x8622,    0x00bd},
+{0x8623,    0x0089}, {0x8624,    0x007b}, {0x8625,    0x007e},
+{0x8626,    0x0086}, {0x8627,    0x008e}, {0x8628,    0x0081},
+{0x8629,    0x0040}, {0x862a,    0x0026}, {0x862b,    0x000b},
+{0x862c,    0x0086}, {0x862d,    0x0004}, {0x862e,    0x00ce},
+{0x862f,    0x008f}, {0x8630,    0x0076}, {0x8631,    0x00bd},
+{0x8632,    0x0089}, {0x8633,    0x007b}, {0x8634,    0x007e},
+{0x8635,    0x0086}, {0x8636,    0x008e}, {0x8637,    0x0081},
+{0x8638,    0x0020}, {0x8639,    0x0026}, {0x863a,    0x000b},
+{0x863b,    0x0086}, {0x863c,    0x0002}, {0x863d,    0x00ce},
+{0x863e,    0x008f}, {0x863f,    0x0073}, {0x8640,    0x00bd},
+{0x8641,    0x0089}, {0x8642,    0x007b}, {0x8643,    0x007e},
+{0x8644,    0x0086}, {0x8645,    0x008e}, {0x8646,    0x0081},
+{0x8647,    0x0010}, {0x8648,    0x0026}, {0x8649,    0x000b},
+{0x864a,    0x0086}, {0x864b,    0x0001}, {0x864c,    0x00ce},
+{0x864d,    0x008f}, {0x864e,    0x0070}, {0x864f,    0x00bd},
+{0x8650,    0x0089}, {0x8651,    0x007b}, {0x8652,    0x007e},
+{0x8653,    0x0086}, {0x8654,    0x008e}, {0x8655,    0x0081},
+{0x8656,    0x0008}, {0x8657,    0x0026}, {0x8658,    0x000b},
+{0x8659,    0x0086}, {0x865a,    0x0008}, {0x865b,    0x00ce},
+{0x865c,    0x008f}, {0x865d,    0x0079}, {0x865e,    0x00bd},
+{0x865f,    0x0089}, {0x8660,    0x007f}, {0x8661,    0x007e},
+{0x8662,    0x0086}, {0x8663,    0x008e}, {0x8664,    0x0081},
+{0x8665,    0x0004}, {0x8666,    0x0026}, {0x8667,    0x000b},
+{0x8668,    0x0086}, {0x8669,    0x0004}, {0x866a,    0x00ce},
+{0x866b,    0x008f}, {0x866c,    0x0076}, {0x866d,    0x00bd},
+{0x866e,    0x0089}, {0x866f,    0x007f}, {0x8670,    0x007e},
+{0x8671,    0x0086}, {0x8672,    0x008e}, {0x8673,    0x0081},
+{0x8674,    0x0002}, {0x8675,    0x0026}, {0x8676,    0x000b},
+{0x8677,    0x008a}, {0x8678,    0x0002}, {0x8679,    0x00ce},
+{0x867a,    0x008f}, {0x867b,    0x0073}, {0x867c,    0x00bd},
+{0x867d,    0x0089}, {0x867e,    0x007f}, {0x867f,    0x007e},
+{0x8680,    0x0086}, {0x8681,    0x008e}, {0x8682,    0x0081},
+{0x8683,    0x0001}, {0x8684,    0x0026}, {0x8685,    0x0008},
+{0x8686,    0x0086}, {0x8687,    0x0001}, {0x8688,    0x00ce},
+{0x8689,    0x008f}, {0x868a,    0x0070}, {0x868b,    0x00bd},
+{0x868c,    0x0089}, {0x868d,    0x007f}, {0x868e,    0x00b6},
+{0x868f,    0x008f}, {0x8690,    0x007f}, {0x8691,    0x0081},
+{0x8692,    0x000f}, {0x8693,    0x0026}, {0x8694,    0x0003},
+{0x8695,    0x007e}, {0x8696,    0x0087}, {0x8697,    0x0047},
+{0x8698,    0x00b6}, {0x8699,    0x0012}, {0x869a,    0x0009},
+{0x869b,    0x0084}, {0x869c,    0x0003}, {0x869d,    0x0081},
+{0x869e,    0x0003}, {0x869f,    0x0027}, {0x86a0,    0x0006},
+{0x86a1,    0x007c}, {0x86a2,    0x0012}, {0x86a3,    0x0009},
+{0x86a4,    0x007e}, {0x86a5,    0x0085}, {0x86a6,    0x00fe},
+{0x86a7,    0x00b6}, {0x86a8,    0x0012}, {0x86a9,    0x0006},
+{0x86aa,    0x0084}, {0x86ab,    0x0007}, {0x86ac,    0x0081},
+{0x86ad,    0x0007}, {0x86ae,    0x0027}, {0x86af,    0x0008},
+{0x86b0,    0x008b}, {0x86b1,    0x0001}, {0x86b2,    0x00b7},
+{0x86b3,    0x0012}, {0x86b4,    0x0006}, {0x86b5,    0x007e},
+{0x86b6,    0x0086}, {0x86b7,    0x00d5}, {0x86b8,    0x00b6},
+{0x86b9,    0x008f}, {0x86ba,    0x0082}, {0x86bb,    0x0026},
+{0x86bc,    0x000a}, {0x86bd,    0x007c}, {0x86be,    0x008f},
+{0x86bf,    0x0082}, {0x86c0,    0x004f}, {0x86c1,    0x00b7},
+{0x86c2,    0x0012}, {0x86c3,    0x0006}, {0x86c4,    0x007e},
+{0x86c5,    0x0085}, {0x86c6,    0x00c0}, {0x86c7,    0x00b6},
+{0x86c8,    0x0012}, {0x86c9,    0x0006}, {0x86ca,    0x0084},
+{0x86cb,    0x003f}, {0x86cc,    0x0081}, {0x86cd,    0x003f},
+{0x86ce,    0x0027}, {0x86cf,    0x0010}, {0x86d0,    0x008b},
+{0x86d1,    0x0008}, {0x86d2,    0x00b7}, {0x86d3,    0x0012},
+{0x86d4,    0x0006}, {0x86d5,    0x00b6}, {0x86d6,    0x0012},
+{0x86d7,    0x0009}, {0x86d8,    0x0084}, {0x86d9,    0x00fc},
+{0x86da,    0x00b7}, {0x86db,    0x0012}, {0x86dc,    0x0009},
+{0x86dd,    0x007e}, {0x86de,    0x0085}, {0x86df,    0x00fe},
+{0x86e0,    0x00ce}, {0x86e1,    0x008f}, {0x86e2,    0x0070},
+{0x86e3,    0x0018}, {0x86e4,    0x00ce}, {0x86e5,    0x008f},
+{0x86e6,    0x0084}, {0x86e7,    0x00c6}, {0x86e8,    0x000c},
+{0x86e9,    0x00bd}, {0x86ea,    0x0089}, {0x86eb,    0x006f},
+{0x86ec,    0x00ce}, {0x86ed,    0x008f}, {0x86ee,    0x0084},
+{0x86ef,    0x0018}, {0x86f0,    0x00ce}, {0x86f1,    0x008f},
+{0x86f2,    0x0070}, {0x86f3,    0x00c6}, {0x86f4,    0x000c},
+{0x86f5,    0x00bd}, {0x86f6,    0x0089}, {0x86f7,    0x006f},
+{0x86f8,    0x00d6}, {0x86f9,    0x0083}, {0x86fa,    0x00c1},
+{0x86fb,    0x004f}, {0x86fc,    0x002d}, {0x86fd,    0x0003},
+{0x86fe,    0x007e}, {0x86ff,    0x0087}, {0x8700,    0x0040},
+{0x8701,    0x00b6}, {0x8702,    0x008f}, {0x8703,    0x007f},
+{0x8704,    0x0081}, {0x8705,    0x0007}, {0x8706,    0x0027},
+{0x8707,    0x000f}, {0x8708,    0x0081}, {0x8709,    0x000b},
+{0x870a,    0x0027}, {0x870b,    0x0015}, {0x870c,    0x0081},
+{0x870d,    0x000d}, {0x870e,    0x0027}, {0x870f,    0x001b},
+{0x8710,    0x0081}, {0x8711,    0x000e}, {0x8712,    0x0027},
+{0x8713,    0x0021}, {0x8714,    0x007e}, {0x8715,    0x0087},
+{0x8716,    0x0040}, {0x8717,    0x00f7}, {0x8718,    0x008f},
+{0x8719,    0x007b}, {0x871a,    0x0086}, {0x871b,    0x0002},
+{0x871c,    0x00b7}, {0x871d,    0x008f}, {0x871e,    0x007a},
+{0x871f,    0x0020}, {0x8720,    0x001c}, {0x8721,    0x00f7},
+{0x8722,    0x008f}, {0x8723,    0x0078}, {0x8724,    0x0086},
+{0x8725,    0x0002}, {0x8726,    0x00b7}, {0x8727,    0x008f},
+{0x8728,    0x0077}, {0x8729,    0x0020}, {0x872a,    0x0012},
+{0x872b,    0x00f7}, {0x872c,    0x008f}, {0x872d,    0x0075},
+{0x872e,    0x0086}, {0x872f,    0x0002}, {0x8730,    0x00b7},
+{0x8731,    0x008f}, {0x8732,    0x0074}, {0x8733,    0x0020},
+{0x8734,    0x0008}, {0x8735,    0x00f7}, {0x8736,    0x008f},
+{0x8737,    0x0072}, {0x8738,    0x0086}, {0x8739,    0x0002},
+{0x873a,    0x00b7}, {0x873b,    0x008f}, {0x873c,    0x0071},
+{0x873d,    0x007e}, {0x873e,    0x0087}, {0x873f,    0x0047},
+{0x8740,    0x0086}, {0x8741,    0x0004}, {0x8742,    0x0097},
+{0x8743,    0x0040}, {0x8744,    0x007e}, {0x8745,    0x0089},
+{0x8746,    0x006e}, {0x8747,    0x00ce}, {0x8748,    0x008f},
+{0x8749,    0x0072}, {0x874a,    0x00bd}, {0x874b,    0x0089},
+{0x874c,    0x00f7}, {0x874d,    0x00ce}, {0x874e,    0x008f},
+{0x874f,    0x0075}, {0x8750,    0x00bd}, {0x8751,    0x0089},
+{0x8752,    0x00f7}, {0x8753,    0x00ce}, {0x8754,    0x008f},
+{0x8755,    0x0078}, {0x8756,    0x00bd}, {0x8757,    0x0089},
+{0x8758,    0x00f7}, {0x8759,    0x00ce}, {0x875a,    0x008f},
+{0x875b,    0x007b}, {0x875c,    0x00bd}, {0x875d,    0x0089},
+{0x875e,    0x00f7}, {0x875f,    0x004f}, {0x8760,    0x00b7},
+{0x8761,    0x008f}, {0x8762,    0x007d}, {0x8763,    0x00b7},
+{0x8764,    0x008f}, {0x8765,    0x0081}, {0x8766,    0x00b6},
+{0x8767,    0x008f}, {0x8768,    0x0072}, {0x8769,    0x0027},
+{0x876a,    0x0047}, {0x876b,    0x007c}, {0x876c,    0x008f},
+{0x876d,    0x007d}, {0x876e,    0x00b6}, {0x876f,    0x008f},
+{0x8770,    0x0075}, {0x8771,    0x0027}, {0x8772,    0x003f},
+{0x8773,    0x007c}, {0x8774,    0x008f}, {0x8775,    0x007d},
+{0x8776,    0x00b6}, {0x8777,    0x008f}, {0x8778,    0x0078},
+{0x8779,    0x0027}, {0x877a,    0x0037}, {0x877b,    0x007c},
+{0x877c,    0x008f}, {0x877d,    0x007d}, {0x877e,    0x00b6},
+{0x877f,    0x008f}, {0x8780,    0x007b}, {0x8781,    0x0027},
+{0x8782,    0x002f}, {0x8783,    0x007f}, {0x8784,    0x008f},
+{0x8785,    0x007d}, {0x8786,    0x007c}, {0x8787,    0x008f},
+{0x8788,    0x0081}, {0x8789,    0x007a}, {0x878a,    0x008f},
+{0x878b,    0x0072}, {0x878c,    0x0027}, {0x878d,    0x001b},
+{0x878e,    0x007c}, {0x878f,    0x008f}, {0x8790,    0x007d},
+{0x8791,    0x007a}, {0x8792,    0x008f}, {0x8793,    0x0075},
+{0x8794,    0x0027}, {0x8795,    0x0016}, {0x8796,    0x007c},
+{0x8797,    0x008f}, {0x8798,    0x007d}, {0x8799,    0x007a},
+{0x879a,    0x008f}, {0x879b,    0x0078}, {0x879c,    0x0027},
+{0x879d,    0x0011}, {0x879e,    0x007c}, {0x879f,    0x008f},
+{0x87a0,    0x007d}, {0x87a1,    0x007a}, {0x87a2,    0x008f},
+{0x87a3,    0x007b}, {0x87a4,    0x0027}, {0x87a5,    0x000c},
+{0x87a6,    0x007e}, {0x87a7,    0x0087}, {0x87a8,    0x0083},
+{0x87a9,    0x007a}, {0x87aa,    0x008f}, {0x87ab,    0x0075},
+{0x87ac,    0x007a}, {0x87ad,    0x008f}, {0x87ae,    0x0078},
+{0x87af,    0x007a}, {0x87b0,    0x008f}, {0x87b1,    0x007b},
+{0x87b2,    0x00ce}, {0x87b3,    0x00c1}, {0x87b4,    0x00fc},
+{0x87b5,    0x00f6}, {0x87b6,    0x008f}, {0x87b7,    0x007d},
+{0x87b8,    0x003a}, {0x87b9,    0x00a6}, {0x87ba,    0x0000},
+{0x87bb,    0x00b7}, {0x87bc,    0x0012}, {0x87bd,    0x0070},
+{0x87be,    0x00b6}, {0x87bf,    0x008f}, {0x87c0,    0x0072},
+{0x87c1,    0x0026}, {0x87c2,    0x0003}, {0x87c3,    0x007e},
+{0x87c4,    0x0087}, {0x87c5,    0x00fa}, {0x87c6,    0x00b6},
+{0x87c7,    0x008f}, {0x87c8,    0x0075}, {0x87c9,    0x0026},
+{0x87ca,    0x000a}, {0x87cb,    0x0018}, {0x87cc,    0x00ce},
+{0x87cd,    0x008f}, {0x87ce,    0x0073}, {0x87cf,    0x00bd},
+{0x87d0,    0x0089}, {0x87d1,    0x00d5}, {0x87d2,    0x007e},
+{0x87d3,    0x0087}, {0x87d4,    0x00fa}, {0x87d5,    0x00b6},
+{0x87d6,    0x008f}, {0x87d7,    0x0078}, {0x87d8,    0x0026},
+{0x87d9,    0x000a}, {0x87da,    0x0018}, {0x87db,    0x00ce},
+{0x87dc,    0x008f}, {0x87dd,    0x0076}, {0x87de,    0x00bd},
+{0x87df,    0x0089}, {0x87e0,    0x00d5}, {0x87e1,    0x007e},
+{0x87e2,    0x0087}, {0x87e3,    0x00fa}, {0x87e4,    0x00b6},
+{0x87e5,    0x008f}, {0x87e6,    0x007b}, {0x87e7,    0x0026},
+{0x87e8,    0x000a}, {0x87e9,    0x0018}, {0x87ea,    0x00ce},
+{0x87eb,    0x008f}, {0x87ec,    0x0079}, {0x87ed,    0x00bd},
+{0x87ee,    0x0089}, {0x87ef,    0x00d5}, {0x87f0,    0x007e},
+{0x87f1,    0x0087}, {0x87f2,    0x00fa}, {0x87f3,    0x0086},
+{0x87f4,    0x0005}, {0x87f5,    0x0097}, {0x87f6,    0x0040},
+{0x87f7,    0x007e}, {0x87f8,    0x0089}, {0x87f9,    0x0000},
+{0x87fa,    0x00b6}, {0x87fb,    0x008f}, {0x87fc,    0x0075},
+{0x87fd,    0x0081}, {0x87fe,    0x0007}, {0x87ff,    0x002e},
+{0x8800,    0x00f2}, {0x8801,    0x00f6}, {0x8802,    0x0012},
+{0x8803,    0x0006}, {0x8804,    0x00c4}, {0x8805,    0x00f8},
+{0x8806,    0x001b}, {0x8807,    0x00b7}, {0x8808,    0x0012},
+{0x8809,    0x0006}, {0x880a,    0x00b6}, {0x880b,    0x008f},
+{0x880c,    0x0078}, {0x880d,    0x0081}, {0x880e,    0x0007},
+{0x880f,    0x002e}, {0x8810,    0x00e2}, {0x8811,    0x0048},
+{0x8812,    0x0048}, {0x8813,    0x0048}, {0x8814,    0x00f6},
+{0x8815,    0x0012}, {0x8816,    0x0006}, {0x8817,    0x00c4},
+{0x8818,    0x00c7}, {0x8819,    0x001b}, {0x881a,    0x00b7},
+{0x881b,    0x0012}, {0x881c,    0x0006}, {0x881d,    0x00b6},
+{0x881e,    0x008f}, {0x881f,    0x007b}, {0x8820,    0x0081},
+{0x8821,    0x0007}, {0x8822,    0x002e}, {0x8823,    0x00cf},
+{0x8824,    0x00f6}, {0x8825,    0x0012}, {0x8826,    0x0005},
+{0x8827,    0x00c4}, {0x8828,    0x00f8}, {0x8829,    0x001b},
+{0x882a,    0x00b7}, {0x882b,    0x0012}, {0x882c,    0x0005},
+{0x882d,    0x0086}, {0x882e,    0x0000}, {0x882f,    0x00f6},
+{0x8830,    0x008f}, {0x8831,    0x0071}, {0x8832,    0x00bd},
+{0x8833,    0x0089}, {0x8834,    0x0094}, {0x8835,    0x0086},
+{0x8836,    0x0001}, {0x8837,    0x00f6}, {0x8838,    0x008f},
+{0x8839,    0x0074}, {0x883a,    0x00bd}, {0x883b,    0x0089},
+{0x883c,    0x0094}, {0x883d,    0x0086}, {0x883e,    0x0002},
+{0x883f,    0x00f6}, {0x8840,    0x008f}, {0x8841,    0x0077},
+{0x8842,    0x00bd}, {0x8843,    0x0089}, {0x8844,    0x0094},
+{0x8845,    0x0086}, {0x8846,    0x0003}, {0x8847,    0x00f6},
+{0x8848,    0x008f}, {0x8849,    0x007a}, {0x884a,    0x00bd},
+{0x884b,    0x0089}, {0x884c,    0x0094}, {0x884d,    0x00ce},
+{0x884e,    0x008f}, {0x884f,    0x0070}, {0x8850,    0x00a6},
+{0x8851,    0x0001}, {0x8852,    0x0081}, {0x8853,    0x0001},
+{0x8854,    0x0027}, {0x8855,    0x0007}, {0x8856,    0x0081},
+{0x8857,    0x0003}, {0x8858,    0x0027}, {0x8859,    0x0003},
+{0x885a,    0x007e}, {0x885b,    0x0088}, {0x885c,    0x0066},
+{0x885d,    0x00a6}, {0x885e,    0x0000}, {0x885f,    0x00b8},
+{0x8860,    0x008f}, {0x8861,    0x0081}, {0x8862,    0x0084},
+{0x8863,    0x0001}, {0x8864,    0x0026}, {0x8865,    0x000b},
+{0x8866,    0x008c}, {0x8867,    0x008f}, {0x8868,    0x0079},
+{0x8869,    0x002c}, {0x886a,    0x000e}, {0x886b,    0x0008},
+{0x886c,    0x0008}, {0x886d,    0x0008}, {0x886e,    0x007e},
+{0x886f,    0x0088}, {0x8870,    0x0050}, {0x8871,    0x00b6},
+{0x8872,    0x0012}, {0x8873,    0x0004}, {0x8874,    0x008a},
+{0x8875,    0x0040}, {0x8876,    0x00b7}, {0x8877,    0x0012},
+{0x8878,    0x0004}, {0x8879,    0x00b6}, {0x887a,    0x0012},
+{0x887b,    0x0004}, {0x887c,    0x0084}, {0x887d,    0x00fb},
+{0x887e,    0x0084}, {0x887f,    0x00ef}, {0x8880,    0x00b7},
+{0x8881,    0x0012}, {0x8882,    0x0004}, {0x8883,    0x00b6},
+{0x8884,    0x0012}, {0x8885,    0x0007}, {0x8886,    0x0036},
+{0x8887,    0x00b6}, {0x8888,    0x008f}, {0x8889,    0x007c},
+{0x888a,    0x0048}, {0x888b,    0x0048}, {0x888c,    0x00b7},
+{0x888d,    0x0012}, {0x888e,    0x0007}, {0x888f,    0x0086},
+{0x8890,    0x0001}, {0x8891,    0x00ba}, {0x8892,    0x0012},
+{0x8893,    0x0004}, {0x8894,    0x00b7}, {0x8895,    0x0012},
+{0x8896,    0x0004}, {0x8897,    0x0001}, {0x8898,    0x0001},
+{0x8899,    0x0001}, {0x889a,    0x0001}, {0x889b,    0x0001},
+{0x889c,    0x0001}, {0x889d,    0x0086}, {0x889e,    0x00fe},
+{0x889f,    0x00b4}, {0x88a0,    0x0012}, {0x88a1,    0x0004},
+{0x88a2,    0x00b7}, {0x88a3,    0x0012}, {0x88a4,    0x0004},
+{0x88a5,    0x0086}, {0x88a6,    0x0002}, {0x88a7,    0x00ba},
+{0x88a8,    0x0012}, {0x88a9,    0x0004}, {0x88aa,    0x00b7},
+{0x88ab,    0x0012}, {0x88ac,    0x0004}, {0x88ad,    0x0086},
+{0x88ae,    0x00fd}, {0x88af,    0x00b4}, {0x88b0,    0x0012},
+{0x88b1,    0x0004}, {0x88b2,    0x00b7}, {0x88b3,    0x0012},
+{0x88b4,    0x0004}, {0x88b5,    0x0032}, {0x88b6,    0x00b7},
+{0x88b7,    0x0012}, {0x88b8,    0x0007}, {0x88b9,    0x00b6},
+{0x88ba,    0x0012}, {0x88bb,    0x0000}, {0x88bc,    0x0084},
+{0x88bd,    0x0008}, {0x88be,    0x0081}, {0x88bf,    0x0008},
+{0x88c0,    0x0027}, {0x88c1,    0x000f}, {0x88c2,    0x007c},
+{0x88c3,    0x0082}, {0x88c4,    0x0008}, {0x88c5,    0x0026},
+{0x88c6,    0x0007}, {0x88c7,    0x0086}, {0x88c8,    0x0076},
+{0x88c9,    0x0097}, {0x88ca,    0x0040}, {0x88cb,    0x007e},
+{0x88cc,    0x0089}, {0x88cd,    0x006e}, {0x88ce,    0x007e},
+{0x88cf,    0x0086}, {0x88d0,    0x00ec}, {0x88d1,    0x00b6},
+{0x88d2,    0x008f}, {0x88d3,    0x007f}, {0x88d4,    0x0081},
+{0x88d5,    0x000f}, {0x88d6,    0x0027}, {0x88d7,    0x003c},
+{0x88d8,    0x00bd}, {0x88d9,    0x00e6}, {0x88da,    0x00c7},
+{0x88db,    0x00b7}, {0x88dc,    0x0012}, {0x88dd,    0x000d},
+{0x88de,    0x00bd}, {0x88df,    0x00e6}, {0x88e0,    0x00cb},
+{0x88e1,    0x00b6}, {0x88e2,    0x0012}, {0x88e3,    0x0004},
+{0x88e4,    0x008a}, {0x88e5,    0x0020}, {0x88e6,    0x00b7},
+{0x88e7,    0x0012}, {0x88e8,    0x0004}, {0x88e9,    0x00ce},
+{0x88ea,    0x00ff}, {0x88eb,    0x00ff}, {0x88ec,    0x00b6},
+{0x88ed,    0x0012}, {0x88ee,    0x0000}, {0x88ef,    0x0081},
+{0x88f0,    0x000c}, {0x88f1,    0x0026}, {0x88f2,    0x0005},
+{0x88f3,    0x0009}, {0x88f4,    0x0026}, {0x88f5,    0x00f6},
+{0x88f6,    0x0027}, {0x88f7,    0x001c}, {0x88f8,    0x00b6},
+{0x88f9,    0x0012}, {0x88fa,    0x0004}, {0x88fb,    0x0084},
+{0x88fc,    0x00df}, {0x88fd,    0x00b7}, {0x88fe,    0x0012},
+{0x88ff,    0x0004}, {0x8900,    0x0096}, {0x8901,    0x0083},
+{0x8902,    0x0081}, {0x8903,    0x0007}, {0x8904,    0x002c},
+{0x8905,    0x0005}, {0x8906,    0x007c}, {0x8907,    0x0000},
+{0x8908,    0x0083}, {0x8909,    0x0020}, {0x890a,    0x0006},
+{0x890b,    0x0096}, {0x890c,    0x0083}, {0x890d,    0x008b},
+{0x890e,    0x0008}, {0x890f,    0x0097}, {0x8910,    0x0083},
+{0x8911,    0x007e}, {0x8912,    0x0085}, {0x8913,    0x0041},
+{0x8914,    0x007f}, {0x8915,    0x008f}, {0x8916,    0x007e},
+{0x8917,    0x0086}, {0x8918,    0x0080}, {0x8919,    0x00b7},
+{0x891a,    0x0012}, {0x891b,    0x000c}, {0x891c,    0x0086},
+{0x891d,    0x0001}, {0x891e,    0x00b7}, {0x891f,    0x008f},
+{0x8920,    0x007d}, {0x8921,    0x00b6}, {0x8922,    0x0012},
+{0x8923,    0x000c}, {0x8924,    0x0084}, {0x8925,    0x007f},
+{0x8926,    0x00b7}, {0x8927,    0x0012}, {0x8928,    0x000c},
+{0x8929,    0x008a}, {0x892a,    0x0080}, {0x892b,    0x00b7},
+{0x892c,    0x0012}, {0x892d,    0x000c}, {0x892e,    0x0086},
+{0x892f,    0x000a}, {0x8930,    0x00bd}, {0x8931,    0x008a},
+{0x8932,    0x0006}, {0x8933,    0x00b6}, {0x8934,    0x0012},
+{0x8935,    0x000a}, {0x8936,    0x002a}, {0x8937,    0x0009},
+{0x8938,    0x00b6}, {0x8939,    0x0012}, {0x893a,    0x000c},
+{0x893b,    0x00ba}, {0x893c,    0x008f}, {0x893d,    0x007d},
+{0x893e,    0x00b7}, {0x893f,    0x0012}, {0x8940,    0x000c},
+{0x8941,    0x00b6}, {0x8942,    0x008f}, {0x8943,    0x007e},
+{0x8944,    0x0081}, {0x8945,    0x0060}, {0x8946,    0x0027},
+{0x8947,    0x001a}, {0x8948,    0x008b}, {0x8949,    0x0020},
+{0x894a,    0x00b7}, {0x894b,    0x008f}, {0x894c,    0x007e},
+{0x894d,    0x00b6}, {0x894e,    0x0012}, {0x894f,    0x000c},
+{0x8950,    0x0084}, {0x8951,    0x009f}, {0x8952,    0x00ba},
+{0x8953,    0x008f}, {0x8954,    0x007e}, {0x8955,    0x00b7},
+{0x8956,    0x0012}, {0x8957,    0x000c}, {0x8958,    0x00b6},
+{0x8959,    0x008f}, {0x895a,    0x007d}, {0x895b,    0x0048},
+{0x895c,    0x00b7}, {0x895d,    0x008f}, {0x895e,    0x007d},
+{0x895f,    0x007e}, {0x8960,    0x0089}, {0x8961,    0x0021},
+{0x8962,    0x00b6}, {0x8963,    0x0012}, {0x8964,    0x0004},
+{0x8965,    0x008a}, {0x8966,    0x0020}, {0x8967,    0x00b7},
+{0x8968,    0x0012}, {0x8969,    0x0004}, {0x896a,    0x00bd},
+{0x896b,    0x008a}, {0x896c,    0x000a}, {0x896d,    0x004f},
+{0x896e,    0x0039}, {0x896f,    0x00a6}, {0x8970,    0x0000},
+{0x8971,    0x0018}, {0x8972,    0x00a7}, {0x8973,    0x0000},
+{0x8974,    0x0008}, {0x8975,    0x0018}, {0x8976,    0x0008},
+{0x8977,    0x005a}, {0x8978,    0x0026}, {0x8979,    0x00f5},
+{0x897a,    0x0039}, {0x897b,    0x0036}, {0x897c,    0x006c},
+{0x897d,    0x0000}, {0x897e,    0x0032}, {0x897f,    0x00ba},
+{0x8980,    0x008f}, {0x8981,    0x007f}, {0x8982,    0x00b7},
+{0x8983,    0x008f}, {0x8984,    0x007f}, {0x8985,    0x00b6},
+{0x8986,    0x0012}, {0x8987,    0x0009}, {0x8988,    0x0084},
+{0x8989,    0x0003}, {0x898a,    0x00a7}, {0x898b,    0x0001},
+{0x898c,    0x00b6}, {0x898d,    0x0012}, {0x898e,    0x0006},
+{0x898f,    0x0084}, {0x8990,    0x003f}, {0x8991,    0x00a7},
+{0x8992,    0x0002}, {0x8993,    0x0039}, {0x8994,    0x0036},
+{0x8995,    0x0086}, {0x8996,    0x0003}, {0x8997,    0x00b7},
+{0x8998,    0x008f}, {0x8999,    0x0080}, {0x899a,    0x0032},
+{0x899b,    0x00c1}, {0x899c,    0x0000}, {0x899d,    0x0026},
+{0x899e,    0x0006}, {0x899f,    0x00b7}, {0x89a0,    0x008f},
+{0x89a1,    0x007c}, {0x89a2,    0x007e}, {0x89a3,    0x0089},
+{0x89a4,    0x00c9}, {0x89a5,    0x00c1}, {0x89a6,    0x0001},
+{0x89a7,    0x0027}, {0x89a8,    0x0018}, {0x89a9,    0x00c1},
+{0x89aa,    0x0002}, {0x89ab,    0x0027}, {0x89ac,    0x000c},
+{0x89ad,    0x00c1}, {0x89ae,    0x0003}, {0x89af,    0x0027},
+{0x89b0,    0x0000}, {0x89b1,    0x00f6}, {0x89b2,    0x008f},
+{0x89b3,    0x0080}, {0x89b4,    0x0005}, {0x89b5,    0x0005},
+{0x89b6,    0x00f7}, {0x89b7,    0x008f}, {0x89b8,    0x0080},
+{0x89b9,    0x00f6}, {0x89ba,    0x008f}, {0x89bb,    0x0080},
+{0x89bc,    0x0005}, {0x89bd,    0x0005}, {0x89be,    0x00f7},
+{0x89bf,    0x008f}, {0x89c0,    0x0080}, {0x89c1,    0x00f6},
+{0x89c2,    0x008f}, {0x89c3,    0x0080}, {0x89c4,    0x0005},
+{0x89c5,    0x0005}, {0x89c6,    0x00f7}, {0x89c7,    0x008f},
+{0x89c8,    0x0080}, {0x89c9,    0x00f6}, {0x89ca,    0x008f},
+{0x89cb,    0x0080}, {0x89cc,    0x0053}, {0x89cd,    0x00f4},
+{0x89ce,    0x0012}, {0x89cf,    0x0007}, {0x89d0,    0x001b},
+{0x89d1,    0x00b7}, {0x89d2,    0x0012}, {0x89d3,    0x0007},
+{0x89d4,    0x0039}, {0x89d5,    0x00ce}, {0x89d6,    0x008f},
+{0x89d7,    0x0070}, {0x89d8,    0x00a6}, {0x89d9,    0x0000},
+{0x89da,    0x0018}, {0x89db,    0x00e6}, {0x89dc,    0x0000},
+{0x89dd,    0x0018}, {0x89de,    0x00a7}, {0x89df,    0x0000},
+{0x89e0,    0x00e7}, {0x89e1,    0x0000}, {0x89e2,    0x00a6},
+{0x89e3,    0x0001}, {0x89e4,    0x0018}, {0x89e5,    0x00e6},
+{0x89e6,    0x0001}, {0x89e7,    0x0018}, {0x89e8,    0x00a7},
+{0x89e9,    0x0001}, {0x89ea,    0x00e7}, {0x89eb,    0x0001},
+{0x89ec,    0x00a6}, {0x89ed,    0x0002}, {0x89ee,    0x0018},
+{0x89ef,    0x00e6}, {0x89f0,    0x0002}, {0x89f1,    0x0018},
+{0x89f2,    0x00a7}, {0x89f3,    0x0002}, {0x89f4,    0x00e7},
+{0x89f5,    0x0002}, {0x89f6,    0x0039}, {0x89f7,    0x00a6},
+{0x89f8,    0x0000}, {0x89f9,    0x0084}, {0x89fa,    0x0007},
+{0x89fb,    0x00e6}, {0x89fc,    0x0000}, {0x89fd,    0x00c4},
+{0x89fe,    0x0038}, {0x89ff,    0x0054}, {0x8a00,    0x0054},
+{0x8a01,    0x0054}, {0x8a02,    0x001b}, {0x8a03,    0x00a7},
+{0x8a04,    0x0000}, {0x8a05,    0x0039}, {0x8a06,    0x004a},
+{0x8a07,    0x0026}, {0x8a08,    0x00fd}, {0x8a09,    0x0039},
+{0x8a0a,    0x0096}, {0x8a0b,    0x0022}, {0x8a0c,    0x0084},
+{0x8a0d,    0x000f}, {0x8a0e,    0x0097}, {0x8a0f,    0x0022},
+{0x8a10,    0x0086}, {0x8a11,    0x0001}, {0x8a12,    0x00b7},
+{0x8a13,    0x008f}, {0x8a14,    0x0070}, {0x8a15,    0x00b6},
+{0x8a16,    0x0012}, {0x8a17,    0x0007}, {0x8a18,    0x00b7},
+{0x8a19,    0x008f}, {0x8a1a,    0x0071}, {0x8a1b,    0x00f6},
+{0x8a1c,    0x0012}, {0x8a1d,    0x000c}, {0x8a1e,    0x00c4},
+{0x8a1f,    0x000f}, {0x8a20,    0x00c8}, {0x8a21,    0x000f},
+{0x8a22,    0x00f7}, {0x8a23,    0x008f}, {0x8a24,    0x0072},
+{0x8a25,    0x00f6}, {0x8a26,    0x008f}, {0x8a27,    0x0072},
+{0x8a28,    0x00b6}, {0x8a29,    0x008f}, {0x8a2a,    0x0071},
+{0x8a2b,    0x0084}, {0x8a2c,    0x0003}, {0x8a2d,    0x0027},
+{0x8a2e,    0x0014}, {0x8a2f,    0x0081}, {0x8a30,    0x0001},
+{0x8a31,    0x0027}, {0x8a32,    0x001c}, {0x8a33,    0x0081},
+{0x8a34,    0x0002}, {0x8a35,    0x0027}, {0x8a36,    0x0024},
+{0x8a37,    0x00f4}, {0x8a38,    0x008f}, {0x8a39,    0x0070},
+{0x8a3a,    0x0027}, {0x8a3b,    0x002a}, {0x8a3c,    0x0096},
+{0x8a3d,    0x0022}, {0x8a3e,    0x008a}, {0x8a3f,    0x0080},
+{0x8a40,    0x007e}, {0x8a41,    0x008a}, {0x8a42,    0x0064},
+{0x8a43,    0x00f4}, {0x8a44,    0x008f}, {0x8a45,    0x0070},
+{0x8a46,    0x0027}, {0x8a47,    0x001e}, {0x8a48,    0x0096},
+{0x8a49,    0x0022}, {0x8a4a,    0x008a}, {0x8a4b,    0x0010},
+{0x8a4c,    0x007e}, {0x8a4d,    0x008a}, {0x8a4e,    0x0064},
+{0x8a4f,    0x00f4}, {0x8a50,    0x008f}, {0x8a51,    0x0070},
+{0x8a52,    0x0027}, {0x8a53,    0x0012}, {0x8a54,    0x0096},
+{0x8a55,    0x0022}, {0x8a56,    0x008a}, {0x8a57,    0x0020},
+{0x8a58,    0x007e}, {0x8a59,    0x008a}, {0x8a5a,    0x0064},
+{0x8a5b,    0x00f4}, {0x8a5c,    0x008f}, {0x8a5d,    0x0070},
+{0x8a5e,    0x0027}, {0x8a5f,    0x0006}, {0x8a60,    0x0096},
+{0x8a61,    0x0022}, {0x8a62,    0x008a}, {0x8a63,    0x0040},
+{0x8a64,    0x0097}, {0x8a65,    0x0022}, {0x8a66,    0x0074},
+{0x8a67,    0x008f}, {0x8a68,    0x0071}, {0x8a69,    0x0074},
+{0x8a6a,    0x008f}, {0x8a6b,    0x0071}, {0x8a6c,    0x0078},
+{0x8a6d,    0x008f}, {0x8a6e,    0x0070}, {0x8a6f,    0x00b6},
+{0x8a70,    0x008f}, {0x8a71,    0x0070}, {0x8a72,    0x0085},
+{0x8a73,    0x0010}, {0x8a74,    0x0027}, {0x8a75,    0x00af},
+{0x8a76,    0x00d6}, {0x8a77,    0x0022}, {0x8a78,    0x00c4},
+{0x8a79,    0x0010}, {0x8a7a,    0x0058}, {0x8a7b,    0x00b6},
+{0x8a7c,    0x0012}, {0x8a7d,    0x0070}, {0x8a7e,    0x0081},
+{0x8a7f,    0x00e4}, {0x8a80,    0x0027}, {0x8a81,    0x0036},
+{0x8a82,    0x0081}, {0x8a83,    0x00e1}, {0x8a84,    0x0026},
+{0x8a85,    0x000c}, {0x8a86,    0x0096}, {0x8a87,    0x0022},
+{0x8a88,    0x0084}, {0x8a89,    0x0020}, {0x8a8a,    0x0044},
+{0x8a8b,    0x001b}, {0x8a8c,    0x00d6}, {0x8a8d,    0x0022},
+{0x8a8e,    0x00c4}, {0x8a8f,    0x00cf}, {0x8a90,    0x0020},
+{0x8a91,    0x0023}, {0x8a92,    0x0058}, {0x8a93,    0x0081},
+{0x8a94,    0x00c6}, {0x8a95,    0x0026}, {0x8a96,    0x000d},
+{0x8a97,    0x0096}, {0x8a98,    0x0022}, {0x8a99,    0x0084},
+{0x8a9a,    0x0040}, {0x8a9b,    0x0044}, {0x8a9c,    0x0044},
+{0x8a9d,    0x001b}, {0x8a9e,    0x00d6}, {0x8a9f,    0x0022},
+{0x8aa0,    0x00c4}, {0x8aa1,    0x00af}, {0x8aa2,    0x0020},
+{0x8aa3,    0x0011}, {0x8aa4,    0x0058}, {0x8aa5,    0x0081},
+{0x8aa6,    0x0027}, {0x8aa7,    0x0026}, {0x8aa8,    0x000f},
+{0x8aa9,    0x0096}, {0x8aaa,    0x0022}, {0x8aab,    0x0084},
+{0x8aac,    0x0080}, {0x8aad,    0x0044}, {0x8aae,    0x0044},
+{0x8aaf,    0x0044}, {0x8ab0,    0x001b}, {0x8ab1,    0x00d6},
+{0x8ab2,    0x0022}, {0x8ab3,    0x00c4}, {0x8ab4,    0x006f},
+{0x8ab5,    0x001b}, {0x8ab6,    0x0097}, {0x8ab7,    0x0022},
+{0x8ab8,    0x0039}, {0x8ab9,    0x0027}, {0x8aba,    0x000c},
+{0x8abb,    0x007c}, {0x8abc,    0x0082}, {0x8abd,    0x0006},
+{0x8abe,    0x00bd}, {0x8abf,    0x00d9}, {0x8ac0,    0x00ed},
+{0x8ac1,    0x00b6}, {0x8ac2,    0x0082}, {0x8ac3,    0x0007},
+{0x8ac4,    0x007e}, {0x8ac5,    0x008a}, {0x8ac6,    0x00b9},
+{0x8ac7,    0x007f}, {0x8ac8,    0x0082}, {0x8ac9,    0x0006},
+{0x8aca,    0x0039}, { 0x0, 0x0 }
+};
+#else
+cas_saturn_patch_t cas_saturn_patch[] = {
+{0x8200,    0x007e}, {0x8201,    0x0082}, {0x8202,    0x0009},
+{0x8203,    0x0000}, {0x8204,    0x0000}, {0x8205,    0x0000},
+{0x8206,    0x0000}, {0x8207,    0x0000}, {0x8208,    0x0000},
+{0x8209,    0x008e}, {0x820a,    0x008e}, {0x820b,    0x00ff},
+{0x820c,    0x00ce}, {0x820d,    0x0082}, {0x820e,    0x0025},
+{0x820f,    0x00ff}, {0x8210,    0x0001}, {0x8211,    0x000f},
+{0x8212,    0x00ce}, {0x8213,    0x0084}, {0x8214,    0x0026},
+{0x8215,    0x00ff}, {0x8216,    0x0001}, {0x8217,    0x0011},
+{0x8218,    0x00ce}, {0x8219,    0x0085}, {0x821a,    0x003d},
+{0x821b,    0x00df}, {0x821c,    0x00e5}, {0x821d,    0x0086},
+{0x821e,    0x0039}, {0x821f,    0x00b7}, {0x8220,    0x008f},
+{0x8221,    0x00f8}, {0x8222,    0x007e}, {0x8223,    0x00c3},
+{0x8224,    0x00c2}, {0x8225,    0x0096}, {0x8226,    0x0047},
+{0x8227,    0x0084}, {0x8228,    0x00f3}, {0x8229,    0x008a},
+{0x822a,    0x0000}, {0x822b,    0x0097}, {0x822c,    0x0047},
+{0x822d,    0x00ce}, {0x822e,    0x0082}, {0x822f,    0x0033},
+{0x8230,    0x00ff}, {0x8231,    0x0001}, {0x8232,    0x000f},
+{0x8233,    0x0096}, {0x8234,    0x0046}, {0x8235,    0x0084},
+{0x8236,    0x000c}, {0x8237,    0x0081}, {0x8238,    0x0004},
+{0x8239,    0x0027}, {0x823a,    0x000b}, {0x823b,    0x0096},
+{0x823c,    0x0046}, {0x823d,    0x0084}, {0x823e,    0x000c},
+{0x823f,    0x0081}, {0x8240,    0x0008}, {0x8241,    0x0027},
+{0x8242,    0x0057}, {0x8243,    0x007e}, {0x8244,    0x0084},
+{0x8245,    0x0025}, {0x8246,    0x0096}, {0x8247,    0x0047},
+{0x8248,    0x0084}, {0x8249,    0x00f3}, {0x824a,    0x008a},
+{0x824b,    0x0004}, {0x824c,    0x0097}, {0x824d,    0x0047},
+{0x824e,    0x00ce}, {0x824f,    0x0082}, {0x8250,    0x0054},
+{0x8251,    0x00ff}, {0x8252,    0x0001}, {0x8253,    0x000f},
+{0x8254,    0x0096}, {0x8255,    0x0046}, {0x8256,    0x0084},
+{0x8257,    0x000c}, {0x8258,    0x0081}, {0x8259,    0x0004},
+{0x825a,    0x0026}, {0x825b,    0x0038}, {0x825c,    0x00b6},
+{0x825d,    0x0012}, {0x825e,    0x0020}, {0x825f,    0x0084},
+{0x8260,    0x0020}, {0x8261,    0x0026}, {0x8262,    0x0003},
+{0x8263,    0x007e}, {0x8264,    0x0084}, {0x8265,    0x0025},
+{0x8266,    0x0096}, {0x8267,    0x007b}, {0x8268,    0x00d6},
+{0x8269,    0x007c}, {0x826a,    0x00fe}, {0x826b,    0x008f},
+{0x826c,    0x0056}, {0x826d,    0x00bd}, {0x826e,    0x00f7},
+{0x826f,    0x00b6}, {0x8270,    0x00fe}, {0x8271,    0x008f},
+{0x8272,    0x004e}, {0x8273,    0x00bd}, {0x8274,    0x00ec},
+{0x8275,    0x008e}, {0x8276,    0x00bd}, {0x8277,    0x00fa},
+{0x8278,    0x00f7}, {0x8279,    0x00bd}, {0x827a,    0x00f7},
+{0x827b,    0x0028}, {0x827c,    0x00ce}, {0x827d,    0x0082},
+{0x827e,    0x0082}, {0x827f,    0x00ff}, {0x8280,    0x0001},
+{0x8281,    0x000f}, {0x8282,    0x0096}, {0x8283,    0x0046},
+{0x8284,    0x0084}, {0x8285,    0x000c}, {0x8286,    0x0081},
+{0x8287,    0x0004}, {0x8288,    0x0026}, {0x8289,    0x000a},
+{0x828a,    0x00b6}, {0x828b,    0x0012}, {0x828c,    0x0020},
+{0x828d,    0x0084}, {0x828e,    0x0020}, {0x828f,    0x0027},
+{0x8290,    0x00b5}, {0x8291,    0x007e}, {0x8292,    0x0084},
+{0x8293,    0x0025}, {0x8294,    0x00bd}, {0x8295,    0x00f7},
+{0x8296,    0x001f}, {0x8297,    0x007e}, {0x8298,    0x0084},
+{0x8299,    0x001f}, {0x829a,    0x0096}, {0x829b,    0x0047},
+{0x829c,    0x0084}, {0x829d,    0x00f3}, {0x829e,    0x008a},
+{0x829f,    0x0008}, {0x82a0,    0x0097}, {0x82a1,    0x0047},
+{0x82a2,    0x00de}, {0x82a3,    0x00e1}, {0x82a4,    0x00ad},
+{0x82a5,    0x0000}, {0x82a6,    0x00ce}, {0x82a7,    0x0082},
+{0x82a8,    0x00af}, {0x82a9,    0x00ff}, {0x82aa,    0x0001},
+{0x82ab,    0x000f}, {0x82ac,    0x007e}, {0x82ad,    0x0084},
+{0x82ae,    0x0025}, {0x82af,    0x0096}, {0x82b0,    0x0041},
+{0x82b1,    0x0085}, {0x82b2,    0x0010}, {0x82b3,    0x0026},
+{0x82b4,    0x0006}, {0x82b5,    0x0096}, {0x82b6,    0x0023},
+{0x82b7,    0x0085}, {0x82b8,    0x0040}, {0x82b9,    0x0027},
+{0x82ba,    0x0006}, {0x82bb,    0x00bd}, {0x82bc,    0x00ed},
+{0x82bd,    0x0000}, {0x82be,    0x007e}, {0x82bf,    0x0083},
+{0x82c0,    0x00a2}, {0x82c1,    0x00de}, {0x82c2,    0x0042},
+{0x82c3,    0x00bd}, {0x82c4,    0x00eb}, {0x82c5,    0x008e},
+{0x82c6,    0x0096}, {0x82c7,    0x0024}, {0x82c8,    0x0084},
+{0x82c9,    0x0008}, {0x82ca,    0x0027}, {0x82cb,    0x0003},
+{0x82cc,    0x007e}, {0x82cd,    0x0083}, {0x82ce,    0x00df},
+{0x82cf,    0x0096}, {0x82d0,    0x007b}, {0x82d1,    0x00d6},
+{0x82d2,    0x007c}, {0x82d3,    0x00fe}, {0x82d4,    0x008f},
+{0x82d5,    0x0056}, {0x82d6,    0x00bd}, {0x82d7,    0x00f7},
+{0x82d8,    0x00b6}, {0x82d9,    0x00fe}, {0x82da,    0x008f},
+{0x82db,    0x0050}, {0x82dc,    0x00bd}, {0x82dd,    0x00ec},
+{0x82de,    0x008e}, {0x82df,    0x00bd}, {0x82e0,    0x00fa},
+{0x82e1,    0x00f7}, {0x82e2,    0x0086}, {0x82e3,    0x0011},
+{0x82e4,    0x00c6}, {0x82e5,    0x0049}, {0x82e6,    0x00bd},
+{0x82e7,    0x00e4}, {0x82e8,    0x0012}, {0x82e9,    0x00ce},
+{0x82ea,    0x0082}, {0x82eb,    0x00ef}, {0x82ec,    0x00ff},
+{0x82ed,    0x0001}, {0x82ee,    0x000f}, {0x82ef,    0x0096},
+{0x82f0,    0x0046}, {0x82f1,    0x0084}, {0x82f2,    0x000c},
+{0x82f3,    0x0081}, {0x82f4,    0x0000}, {0x82f5,    0x0027},
+{0x82f6,    0x0017}, {0x82f7,    0x00c6}, {0x82f8,    0x0049},
+{0x82f9,    0x00bd}, {0x82fa,    0x00e4}, {0x82fb,    0x0091},
+{0x82fc,    0x0024}, {0x82fd,    0x000d}, {0x82fe,    0x00b6},
+{0x82ff,    0x0012}, {0x8300,    0x0020}, {0x8301,    0x0085},
+{0x8302,    0x0020}, {0x8303,    0x0026}, {0x8304,    0x000c},
+{0x8305,    0x00ce}, {0x8306,    0x0082}, {0x8307,    0x00c1},
+{0x8308,    0x00ff}, {0x8309,    0x0001}, {0x830a,    0x000f},
+{0x830b,    0x007e}, {0x830c,    0x0084}, {0x830d,    0x0025},
+{0x830e,    0x007e}, {0x830f,    0x0084}, {0x8310,    0x0016},
+{0x8311,    0x00fe}, {0x8312,    0x008f}, {0x8313,    0x0052},
+{0x8314,    0x00bd}, {0x8315,    0x00ec}, {0x8316,    0x008e},
+{0x8317,    0x00bd}, {0x8318,    0x00fa}, {0x8319,    0x00f7},
+{0x831a,    0x0086}, {0x831b,    0x006a}, {0x831c,    0x00c6},
+{0x831d,    0x0049}, {0x831e,    0x00bd}, {0x831f,    0x00e4},
+{0x8320,    0x0012}, {0x8321,    0x00ce}, {0x8322,    0x0083},
+{0x8323,    0x0027}, {0x8324,    0x00ff}, {0x8325,    0x0001},
+{0x8326,    0x000f}, {0x8327,    0x0096}, {0x8328,    0x0046},
+{0x8329,    0x0084}, {0x832a,    0x000c}, {0x832b,    0x0081},
+{0x832c,    0x0000}, {0x832d,    0x0027}, {0x832e,    0x000a},
+{0x832f,    0x00c6}, {0x8330,    0x0049}, {0x8331,    0x00bd},
+{0x8332,    0x00e4}, {0x8333,    0x0091}, {0x8334,    0x0025},
+{0x8335,    0x0006}, {0x8336,    0x007e}, {0x8337,    0x0084},
+{0x8338,    0x0025}, {0x8339,    0x007e}, {0x833a,    0x0084},
+{0x833b,    0x0016}, {0x833c,    0x00b6}, {0x833d,    0x0018},
+{0x833e,    0x0070}, {0x833f,    0x00bb}, {0x8340,    0x0019},
+{0x8341,    0x0070}, {0x8342,    0x002a}, {0x8343,    0x0004},
+{0x8344,    0x0081}, {0x8345,    0x00af}, {0x8346,    0x002e},
+{0x8347,    0x0019}, {0x8348,    0x0096}, {0x8349,    0x007b},
+{0x834a,    0x00f6}, {0x834b,    0x0020}, {0x834c,    0x0007},
+{0x834d,    0x00fa}, {0x834e,    0x0020}, {0x834f,    0x0027},
+{0x8350,    0x00c4}, {0x8351,    0x0038}, {0x8352,    0x0081},
+{0x8353,    0x0038}, {0x8354,    0x0027}, {0x8355,    0x000b},
+{0x8356,    0x00f6}, {0x8357,    0x0020}, {0x8358,    0x0007},
+{0x8359,    0x00fa}, {0x835a,    0x0020}, {0x835b,    0x0027},
+{0x835c,    0x00cb}, {0x835d,    0x0008}, {0x835e,    0x007e},
+{0x835f,    0x0082}, {0x8360,    0x00d3}, {0x8361,    0x00bd},
+{0x8362,    0x00f7}, {0x8363,    0x0066}, {0x8364,    0x0086},
+{0x8365,    0x0074}, {0x8366,    0x00c6}, {0x8367,    0x0049},
+{0x8368,    0x00bd}, {0x8369,    0x00e4}, {0x836a,    0x0012},
+{0x836b,    0x00ce}, {0x836c,    0x0083}, {0x836d,    0x0071},
+{0x836e,    0x00ff}, {0x836f,    0x0001}, {0x8370,    0x000f},
+{0x8371,    0x0096}, {0x8372,    0x0046}, {0x8373,    0x0084},
+{0x8374,    0x000c}, {0x8375,    0x0081}, {0x8376,    0x0008},
+{0x8377,    0x0026}, {0x8378,    0x000a}, {0x8379,    0x00c6},
+{0x837a,    0x0049}, {0x837b,    0x00bd}, {0x837c,    0x00e4},
+{0x837d,    0x0091}, {0x837e,    0x0025}, {0x837f,    0x0006},
+{0x8380,    0x007e}, {0x8381,    0x0084}, {0x8382,    0x0025},
+{0x8383,    0x007e}, {0x8384,    0x0084}, {0x8385,    0x0016},
+{0x8386,    0x00bd}, {0x8387,    0x00f7}, {0x8388,    0x003e},
+{0x8389,    0x0026}, {0x838a,    0x000e}, {0x838b,    0x00bd},
+{0x838c,    0x00e5}, {0x838d,    0x0009}, {0x838e,    0x0026},
+{0x838f,    0x0006}, {0x8390,    0x00ce}, {0x8391,    0x0082},
+{0x8392,    0x00c1}, {0x8393,    0x00ff}, {0x8394,    0x0001},
+{0x8395,    0x000f}, {0x8396,    0x007e}, {0x8397,    0x0084},
+{0x8398,    0x0025}, {0x8399,    0x00fe}, {0x839a,    0x008f},
+{0x839b,    0x0054}, {0x839c,    0x00bd}, {0x839d,    0x00ec},
+{0x839e,    0x008e}, {0x839f,    0x00bd}, {0x83a0,    0x00fa},
+{0x83a1,    0x00f7}, {0x83a2,    0x00bd}, {0x83a3,    0x00f7},
+{0x83a4,    0x0033}, {0x83a5,    0x0086}, {0x83a6,    0x000f},
+{0x83a7,    0x00c6}, {0x83a8,    0x0051}, {0x83a9,    0x00bd},
+{0x83aa,    0x00e4}, {0x83ab,    0x0012}, {0x83ac,    0x00ce},
+{0x83ad,    0x0083}, {0x83ae,    0x00b2}, {0x83af,    0x00ff},
+{0x83b0,    0x0001}, {0x83b1,    0x000f}, {0x83b2,    0x0096},
+{0x83b3,    0x0046}, {0x83b4,    0x0084}, {0x83b5,    0x000c},
+{0x83b6,    0x0081}, {0x83b7,    0x0008}, {0x83b8,    0x0026},
+{0x83b9,    0x005c}, {0x83ba,    0x00b6}, {0x83bb,    0x0012},
+{0x83bc,    0x0020}, {0x83bd,    0x0084}, {0x83be,    0x003f},
+{0x83bf,    0x0081}, {0x83c0,    0x003a}, {0x83c1,    0x0027},
+{0x83c2,    0x001c}, {0x83c3,    0x0096}, {0x83c4,    0x0023},
+{0x83c5,    0x0085}, {0x83c6,    0x0040}, {0x83c7,    0x0027},
+{0x83c8,    0x0003}, {0x83c9,    0x007e}, {0x83ca,    0x0084},
+{0x83cb,    0x0025}, {0x83cc,    0x00c6}, {0x83cd,    0x0051},
+{0x83ce,    0x00bd}, {0x83cf,    0x00e4}, {0x83d0,    0x0091},
+{0x83d1,    0x0025}, {0x83d2,    0x0003}, {0x83d3,    0x007e},
+{0x83d4,    0x0084}, {0x83d5,    0x0025}, {0x83d6,    0x00ce},
+{0x83d7,    0x0082}, {0x83d8,    0x00c1}, {0x83d9,    0x00ff},
+{0x83da,    0x0001}, {0x83db,    0x000f}, {0x83dc,    0x007e},
+{0x83dd,    0x0084}, {0x83de,    0x0025}, {0x83df,    0x00bd},
+{0x83e0,    0x00f8}, {0x83e1,    0x0037}, {0x83e2,    0x007c},
+{0x83e3,    0x0000}, {0x83e4,    0x007a}, {0x83e5,    0x00ce},
+{0x83e6,    0x0083}, {0x83e7,    0x00ee}, {0x83e8,    0x00ff},
+{0x83e9,    0x0001}, {0x83ea,    0x000f}, {0x83eb,    0x007e},
+{0x83ec,    0x0084}, {0x83ed,    0x0025}, {0x83ee,    0x0096},
+{0x83ef,    0x0046}, {0x83f0,    0x0084}, {0x83f1,    0x000c},
+{0x83f2,    0x0081}, {0x83f3,    0x0008}, {0x83f4,    0x0026},
+{0x83f5,    0x0020}, {0x83f6,    0x0096}, {0x83f7,    0x0024},
+{0x83f8,    0x0084}, {0x83f9,    0x0008}, {0x83fa,    0x0026},
+{0x83fb,    0x0029}, {0x83fc,    0x00b6}, {0x83fd,    0x0018},
+{0x83fe,    0x0082}, {0x83ff,    0x00bb}, {0x8400,    0x0019},
+{0x8401,    0x0082}, {0x8402,    0x00b1}, {0x8403,    0x0001},
+{0x8404,    0x003b}, {0x8405,    0x0022}, {0x8406,    0x0009},
+{0x8407,    0x00b6}, {0x8408,    0x0012}, {0x8409,    0x0020},
+{0x840a,    0x0084}, {0x840b,    0x0037}, {0x840c,    0x0081},
+{0x840d,    0x0032}, {0x840e,    0x0027}, {0x840f,    0x0015},
+{0x8410,    0x00bd}, {0x8411,    0x00f8}, {0x8412,    0x0044},
+{0x8413,    0x007e}, {0x8414,    0x0082}, {0x8415,    0x00c1},
+{0x8416,    0x00bd}, {0x8417,    0x00f7}, {0x8418,    0x001f},
+{0x8419,    0x00bd}, {0x841a,    0x00f8}, {0x841b,    0x0044},
+{0x841c,    0x00bd}, {0x841d,    0x00fc}, {0x841e,    0x0029},
+{0x841f,    0x00ce}, {0x8420,    0x0082}, {0x8421,    0x0025},
+{0x8422,    0x00ff}, {0x8423,    0x0001}, {0x8424,    0x000f},
+{0x8425,    0x0039}, {0x8426,    0x0096}, {0x8427,    0x0047},
+{0x8428,    0x0084}, {0x8429,    0x00fc}, {0x842a,    0x008a},
+{0x842b,    0x0000}, {0x842c,    0x0097}, {0x842d,    0x0047},
+{0x842e,    0x00ce}, {0x842f,    0x0084}, {0x8430,    0x0034},
+{0x8431,    0x00ff}, {0x8432,    0x0001}, {0x8433,    0x0011},
+{0x8434,    0x0096}, {0x8435,    0x0046}, {0x8436,    0x0084},
+{0x8437,    0x0003}, {0x8438,    0x0081}, {0x8439,    0x0002},
+{0x843a,    0x0027}, {0x843b,    0x0003}, {0x843c,    0x007e},
+{0x843d,    0x0085}, {0x843e,    0x001e}, {0x843f,    0x0096},
+{0x8440,    0x0047}, {0x8441,    0x0084}, {0x8442,    0x00fc},
+{0x8443,    0x008a}, {0x8444,    0x0002}, {0x8445,    0x0097},
+{0x8446,    0x0047}, {0x8447,    0x00de}, {0x8448,    0x00e1},
+{0x8449,    0x00ad}, {0x844a,    0x0000}, {0x844b,    0x0086},
+{0x844c,    0x0001}, {0x844d,    0x00b7}, {0x844e,    0x0012},
+{0x844f,    0x0051}, {0x8450,    0x00bd}, {0x8451,    0x00f7},
+{0x8452,    0x0014}, {0x8453,    0x00b6}, {0x8454,    0x0010},
+{0x8455,    0x0031}, {0x8456,    0x0084}, {0x8457,    0x00fd},
+{0x8458,    0x00b7}, {0x8459,    0x0010}, {0x845a,    0x0031},
+{0x845b,    0x00bd}, {0x845c,    0x00f8}, {0x845d,    0x001e},
+{0x845e,    0x0096}, {0x845f,    0x0081}, {0x8460,    0x00d6},
+{0x8461,    0x0082}, {0x8462,    0x00fe}, {0x8463,    0x008f},
+{0x8464,    0x005a}, {0x8465,    0x00bd}, {0x8466,    0x00f7},
+{0x8467,    0x00b6}, {0x8468,    0x00fe}, {0x8469,    0x008f},
+{0x846a,    0x005c}, {0x846b,    0x00bd}, {0x846c,    0x00ec},
+{0x846d,    0x008e}, {0x846e,    0x00bd}, {0x846f,    0x00fa},
+{0x8470,    0x00f7}, {0x8471,    0x0086}, {0x8472,    0x0008},
+{0x8473,    0x00d6}, {0x8474,    0x0000}, {0x8475,    0x00c5},
+{0x8476,    0x0010}, {0x8477,    0x0026}, {0x8478,    0x0002},
+{0x8479,    0x008b}, {0x847a,    0x0020}, {0x847b,    0x00c6},
+{0x847c,    0x0051}, {0x847d,    0x00bd}, {0x847e,    0x00e4},
+{0x847f,    0x0012}, {0x8480,    0x00ce}, {0x8481,    0x0084},
+{0x8482,    0x0086}, {0x8483,    0x00ff}, {0x8484,    0x0001},
+{0x8485,    0x0011}, {0x8486,    0x0096}, {0x8487,    0x0046},
+{0x8488,    0x0084}, {0x8489,    0x0003}, {0x848a,    0x0081},
+{0x848b,    0x0002}, {0x848c,    0x0027}, {0x848d,    0x0003},
+{0x848e,    0x007e}, {0x848f,    0x0085}, {0x8490,    0x000f},
+{0x8491,    0x00c6}, {0x8492,    0x0051}, {0x8493,    0x00bd},
+{0x8494,    0x00e4}, {0x8495,    0x0091}, {0x8496,    0x0025},
+{0x8497,    0x0003}, {0x8498,    0x007e}, {0x8499,    0x0085},
+{0x849a,    0x001e}, {0x849b,    0x0096}, {0x849c,    0x0044},
+{0x849d,    0x0085}, {0x849e,    0x0010}, {0x849f,    0x0026},
+{0x84a0,    0x000a}, {0x84a1,    0x00b6}, {0x84a2,    0x0012},
+{0x84a3,    0x0050}, {0x84a4,    0x00ba}, {0x84a5,    0x0001},
+{0x84a6,    0x003c}, {0x84a7,    0x0085}, {0x84a8,    0x0010},
+{0x84a9,    0x0027}, {0x84aa,    0x00a8}, {0x84ab,    0x00bd},
+{0x84ac,    0x00f7}, {0x84ad,    0x0066}, {0x84ae,    0x00ce},
+{0x84af,    0x0084}, {0x84b0,    0x00b7}, {0x84b1,    0x00ff},
+{0x84b2,    0x0001}, {0x84b3,    0x0011}, {0x84b4,    0x007e},
+{0x84b5,    0x0085}, {0x84b6,    0x001e}, {0x84b7,    0x0096},
+{0x84b8,    0x0046}, {0x84b9,    0x0084}, {0x84ba,    0x0003},
+{0x84bb,    0x0081}, {0x84bc,    0x0002}, {0x84bd,    0x0026},
+{0x84be,    0x0050}, {0x84bf,    0x00b6}, {0x84c0,    0x0012},
+{0x84c1,    0x0030}, {0x84c2,    0x0084}, {0x84c3,    0x0003},
+{0x84c4,    0x0081}, {0x84c5,    0x0001}, {0x84c6,    0x0027},
+{0x84c7,    0x0003}, {0x84c8,    0x007e}, {0x84c9,    0x0085},
+{0x84ca,    0x001e}, {0x84cb,    0x0096}, {0x84cc,    0x0044},
+{0x84cd,    0x0085}, {0x84ce,    0x0010}, {0x84cf,    0x0026},
+{0x84d0,    0x0013}, {0x84d1,    0x00b6}, {0x84d2,    0x0012},
+{0x84d3,    0x0050}, {0x84d4,    0x00ba}, {0x84d5,    0x0001},
+{0x84d6,    0x003c}, {0x84d7,    0x0085}, {0x84d8,    0x0010},
+{0x84d9,    0x0026}, {0x84da,    0x0009}, {0x84db,    0x00ce},
+{0x84dc,    0x0084}, {0x84dd,    0x0053}, {0x84de,    0x00ff},
+{0x84df,    0x0001}, {0x84e0,    0x0011}, {0x84e1,    0x007e},
+{0x84e2,    0x0085}, {0x84e3,    0x001e}, {0x84e4,    0x00b6},
+{0x84e5,    0x0010}, {0x84e6,    0x0031}, {0x84e7,    0x008a},
+{0x84e8,    0x0002}, {0x84e9,    0x00b7}, {0x84ea,    0x0010},
+{0x84eb,    0x0031}, {0x84ec,    0x00bd}, {0x84ed,    0x0085},
+{0x84ee,    0x001f}, {0x84ef,    0x00bd}, {0x84f0,    0x00f8},
+{0x84f1,    0x0037}, {0x84f2,    0x007c}, {0x84f3,    0x0000},
+{0x84f4,    0x0080}, {0x84f5,    0x00ce}, {0x84f6,    0x0084},
+{0x84f7,    0x00fe}, {0x84f8,    0x00ff}, {0x84f9,    0x0001},
+{0x84fa,    0x0011}, {0x84fb,    0x007e}, {0x84fc,    0x0085},
+{0x84fd,    0x001e}, {0x84fe,    0x0096}, {0x84ff,    0x0046},
+{0x8500,    0x0084}, {0x8501,    0x0003}, {0x8502,    0x0081},
+{0x8503,    0x0002}, {0x8504,    0x0026}, {0x8505,    0x0009},
+{0x8506,    0x00b6}, {0x8507,    0x0012}, {0x8508,    0x0030},
+{0x8509,    0x0084}, {0x850a,    0x0003}, {0x850b,    0x0081},
+{0x850c,    0x0001}, {0x850d,    0x0027}, {0x850e,    0x000f},
+{0x850f,    0x00bd}, {0x8510,    0x00f8}, {0x8511,    0x0044},
+{0x8512,    0x00bd}, {0x8513,    0x00f7}, {0x8514,    0x000b},
+{0x8515,    0x00bd}, {0x8516,    0x00fc}, {0x8517,    0x0029},
+{0x8518,    0x00ce}, {0x8519,    0x0084}, {0x851a,    0x0026},
+{0x851b,    0x00ff}, {0x851c,    0x0001}, {0x851d,    0x0011},
+{0x851e,    0x0039}, {0x851f,    0x00d6}, {0x8520,    0x0022},
+{0x8521,    0x00c4}, {0x8522,    0x000f}, {0x8523,    0x00b6},
+{0x8524,    0x0012}, {0x8525,    0x0030}, {0x8526,    0x00ba},
+{0x8527,    0x0012}, {0x8528,    0x0032}, {0x8529,    0x0084},
+{0x852a,    0x0004}, {0x852b,    0x0027}, {0x852c,    0x000d},
+{0x852d,    0x0096}, {0x852e,    0x0022}, {0x852f,    0x0085},
+{0x8530,    0x0004}, {0x8531,    0x0027}, {0x8532,    0x0005},
+{0x8533,    0x00ca}, {0x8534,    0x0010}, {0x8535,    0x007e},
+{0x8536,    0x0085}, {0x8537,    0x003a}, {0x8538,    0x00ca},
+{0x8539,    0x0020}, {0x853a,    0x00d7}, {0x853b,    0x0022},
+{0x853c,    0x0039}, {0x853d,    0x0086}, {0x853e,    0x0000},
+{0x853f,    0x0097}, {0x8540,    0x0083}, {0x8541,    0x0018},
+{0x8542,    0x00ce}, {0x8543,    0x001c}, {0x8544,    0x0000},
+{0x8545,    0x00bd}, {0x8546,    0x00eb}, {0x8547,    0x0046},
+{0x8548,    0x0096}, {0x8549,    0x0057}, {0x854a,    0x0085},
+{0x854b,    0x0001}, {0x854c,    0x0027}, {0x854d,    0x0002},
+{0x854e,    0x004f}, {0x854f,    0x0039}, {0x8550,    0x0085},
+{0x8551,    0x0002}, {0x8552,    0x0027}, {0x8553,    0x0001},
+{0x8554,    0x0039}, {0x8555,    0x007f}, {0x8556,    0x008f},
+{0x8557,    0x007d}, {0x8558,    0x0086}, {0x8559,    0x0004},
+{0x855a,    0x00b7}, {0x855b,    0x0012}, {0x855c,    0x0004},
+{0x855d,    0x0086}, {0x855e,    0x0008}, {0x855f,    0x00b7},
+{0x8560,    0x0012}, {0x8561,    0x0007}, {0x8562,    0x0086},
+{0x8563,    0x0010}, {0x8564,    0x00b7}, {0x8565,    0x0012},
+{0x8566,    0x000c}, {0x8567,    0x0086}, {0x8568,    0x0007},
+{0x8569,    0x00b7}, {0x856a,    0x0012}, {0x856b,    0x0006},
+{0x856c,    0x00b6}, {0x856d,    0x008f}, {0x856e,    0x007d},
+{0x856f,    0x00b7}, {0x8570,    0x0012}, {0x8571,    0x0070},
+{0x8572,    0x0086}, {0x8573,    0x0001}, {0x8574,    0x00ba},
+{0x8575,    0x0012}, {0x8576,    0x0004}, {0x8577,    0x00b7},
+{0x8578,    0x0012}, {0x8579,    0x0004}, {0x857a,    0x0001},
+{0x857b,    0x0001}, {0x857c,    0x0001}, {0x857d,    0x0001},
+{0x857e,    0x0001}, {0x857f,    0x0001}, {0x8580,    0x00b6},
+{0x8581,    0x0012}, {0x8582,    0x0004}, {0x8583,    0x0084},
+{0x8584,    0x00fe}, {0x8585,    0x008a}, {0x8586,    0x0002},
+{0x8587,    0x00b7}, {0x8588,    0x0012}, {0x8589,    0x0004},
+{0x858a,    0x0001}, {0x858b,    0x0001}, {0x858c,    0x0001},
+{0x858d,    0x0001}, {0x858e,    0x0001}, {0x858f,    0x0001},
+{0x8590,    0x0086}, {0x8591,    0x00fd}, {0x8592,    0x00b4},
+{0x8593,    0x0012}, {0x8594,    0x0004}, {0x8595,    0x00b7},
+{0x8596,    0x0012}, {0x8597,    0x0004}, {0x8598,    0x00b6},
+{0x8599,    0x0012}, {0x859a,    0x0000}, {0x859b,    0x0084},
+{0x859c,    0x0008}, {0x859d,    0x0081}, {0x859e,    0x0008},
+{0x859f,    0x0027}, {0x85a0,    0x0016}, {0x85a1,    0x00b6},
+{0x85a2,    0x008f}, {0x85a3,    0x007d}, {0x85a4,    0x0081},
+{0x85a5,    0x000c}, {0x85a6,    0x0027}, {0x85a7,    0x0008},
+{0x85a8,    0x008b}, {0x85a9,    0x0004}, {0x85aa,    0x00b7},
+{0x85ab,    0x008f}, {0x85ac,    0x007d}, {0x85ad,    0x007e},
+{0x85ae,    0x0085}, {0x85af,    0x006c}, {0x85b0,    0x0086},
+{0x85b1,    0x0003}, {0x85b2,    0x0097}, {0x85b3,    0x0040},
+{0x85b4,    0x007e}, {0x85b5,    0x0089}, {0x85b6,    0x006e},
+{0x85b7,    0x0086}, {0x85b8,    0x0007}, {0x85b9,    0x00b7},
+{0x85ba,    0x0012}, {0x85bb,    0x0006}, {0x85bc,    0x005f},
+{0x85bd,    0x00f7}, {0x85be,    0x008f}, {0x85bf,    0x0082},
+{0x85c0,    0x005f}, {0x85c1,    0x00f7}, {0x85c2,    0x008f},
+{0x85c3,    0x007f}, {0x85c4,    0x00f7}, {0x85c5,    0x008f},
+{0x85c6,    0x0070}, {0x85c7,    0x00f7}, {0x85c8,    0x008f},
+{0x85c9,    0x0071}, {0x85ca,    0x00f7}, {0x85cb,    0x008f},
+{0x85cc,    0x0072}, {0x85cd,    0x00f7}, {0x85ce,    0x008f},
+{0x85cf,    0x0073}, {0x85d0,    0x00f7}, {0x85d1,    0x008f},
+{0x85d2,    0x0074}, {0x85d3,    0x00f7}, {0x85d4,    0x008f},
+{0x85d5,    0x0075}, {0x85d6,    0x00f7}, {0x85d7,    0x008f},
+{0x85d8,    0x0076}, {0x85d9,    0x00f7}, {0x85da,    0x008f},
+{0x85db,    0x0077}, {0x85dc,    0x00f7}, {0x85dd,    0x008f},
+{0x85de,    0x0078}, {0x85df,    0x00f7}, {0x85e0,    0x008f},
+{0x85e1,    0x0079}, {0x85e2,    0x00f7}, {0x85e3,    0x008f},
+{0x85e4,    0x007a}, {0x85e5,    0x00f7}, {0x85e6,    0x008f},
+{0x85e7,    0x007b}, {0x85e8,    0x00b6}, {0x85e9,    0x0012},
+{0x85ea,    0x0004}, {0x85eb,    0x008a}, {0x85ec,    0x0010},
+{0x85ed,    0x00b7}, {0x85ee,    0x0012}, {0x85ef,    0x0004},
+{0x85f0,    0x0086}, {0x85f1,    0x00e4}, {0x85f2,    0x00b7},
+{0x85f3,    0x0012}, {0x85f4,    0x0070}, {0x85f5,    0x00b7},
+{0x85f6,    0x0012}, {0x85f7,    0x0007}, {0x85f8,    0x00f7},
+{0x85f9,    0x0012}, {0x85fa,    0x0005}, {0x85fb,    0x00f7},
+{0x85fc,    0x0012}, {0x85fd,    0x0009}, {0x85fe,    0x0086},
+{0x85ff,    0x0008}, {0x8600,    0x00ba}, {0x8601,    0x0012},
+{0x8602,    0x0004}, {0x8603,    0x00b7}, {0x8604,    0x0012},
+{0x8605,    0x0004}, {0x8606,    0x0086}, {0x8607,    0x00f7},
+{0x8608,    0x00b4}, {0x8609,    0x0012}, {0x860a,    0x0004},
+{0x860b,    0x00b7}, {0x860c,    0x0012}, {0x860d,    0x0004},
+{0x860e,    0x0001}, {0x860f,    0x0001}, {0x8610,    0x0001},
+{0x8611,    0x0001}, {0x8612,    0x0001}, {0x8613,    0x0001},
+{0x8614,    0x00b6}, {0x8615,    0x0012}, {0x8616,    0x0008},
+{0x8617,    0x0027}, {0x8618,    0x007f}, {0x8619,    0x0081},
+{0x861a,    0x0080}, {0x861b,    0x0026}, {0x861c,    0x000b},
+{0x861d,    0x0086}, {0x861e,    0x0008}, {0x861f,    0x00ce},
+{0x8620,    0x008f}, {0x8621,    0x0079}, {0x8622,    0x00bd},
+{0x8623,    0x0089}, {0x8624,    0x007b}, {0x8625,    0x007e},
+{0x8626,    0x0086}, {0x8627,    0x008e}, {0x8628,    0x0081},
+{0x8629,    0x0040}, {0x862a,    0x0026}, {0x862b,    0x000b},
+{0x862c,    0x0086}, {0x862d,    0x0004}, {0x862e,    0x00ce},
+{0x862f,    0x008f}, {0x8630,    0x0076}, {0x8631,    0x00bd},
+{0x8632,    0x0089}, {0x8633,    0x007b}, {0x8634,    0x007e},
+{0x8635,    0x0086}, {0x8636,    0x008e}, {0x8637,    0x0081},
+{0x8638,    0x0020}, {0x8639,    0x0026}, {0x863a,    0x000b},
+{0x863b,    0x0086}, {0x863c,    0x0002}, {0x863d,    0x00ce},
+{0x863e,    0x008f}, {0x863f,    0x0073}, {0x8640,    0x00bd},
+{0x8641,    0x0089}, {0x8642,    0x007b}, {0x8643,    0x007e},
+{0x8644,    0x0086}, {0x8645,    0x008e}, {0x8646,    0x0081},
+{0x8647,    0x0010}, {0x8648,    0x0026}, {0x8649,    0x000b},
+{0x864a,    0x0086}, {0x864b,    0x0001}, {0x864c,    0x00ce},
+{0x864d,    0x008f}, {0x864e,    0x0070}, {0x864f,    0x00bd},
+{0x8650,    0x0089}, {0x8651,    0x007b}, {0x8652,    0x007e},
+{0x8653,    0x0086}, {0x8654,    0x008e}, {0x8655,    0x0081},
+{0x8656,    0x0008}, {0x8657,    0x0026}, {0x8658,    0x000b},
+{0x8659,    0x0086}, {0x865a,    0x0008}, {0x865b,    0x00ce},
+{0x865c,    0x008f}, {0x865d,    0x0079}, {0x865e,    0x00bd},
+{0x865f,    0x0089}, {0x8660,    0x007f}, {0x8661,    0x007e},
+{0x8662,    0x0086}, {0x8663,    0x008e}, {0x8664,    0x0081},
+{0x8665,    0x0004}, {0x8666,    0x0026}, {0x8667,    0x000b},
+{0x8668,    0x0086}, {0x8669,    0x0004}, {0x866a,    0x00ce},
+{0x866b,    0x008f}, {0x866c,    0x0076}, {0x866d,    0x00bd},
+{0x866e,    0x0089}, {0x866f,    0x007f}, {0x8670,    0x007e},
+{0x8671,    0x0086}, {0x8672,    0x008e}, {0x8673,    0x0081},
+{0x8674,    0x0002}, {0x8675,    0x0026}, {0x8676,    0x000b},
+{0x8677,    0x008a}, {0x8678,    0x0002}, {0x8679,    0x00ce},
+{0x867a,    0x008f}, {0x867b,    0x0073}, {0x867c,    0x00bd},
+{0x867d,    0x0089}, {0x867e,    0x007f}, {0x867f,    0x007e},
+{0x8680,    0x0086}, {0x8681,    0x008e}, {0x8682,    0x0081},
+{0x8683,    0x0001}, {0x8684,    0x0026}, {0x8685,    0x0008},
+{0x8686,    0x0086}, {0x8687,    0x0001}, {0x8688,    0x00ce},
+{0x8689,    0x008f}, {0x868a,    0x0070}, {0x868b,    0x00bd},
+{0x868c,    0x0089}, {0x868d,    0x007f}, {0x868e,    0x00b6},
+{0x868f,    0x008f}, {0x8690,    0x007f}, {0x8691,    0x0081},
+{0x8692,    0x000f}, {0x8693,    0x0026}, {0x8694,    0x0003},
+{0x8695,    0x007e}, {0x8696,    0x0087}, {0x8697,    0x0047},
+{0x8698,    0x00b6}, {0x8699,    0x0012}, {0x869a,    0x0009},
+{0x869b,    0x0084}, {0x869c,    0x0003}, {0x869d,    0x0081},
+{0x869e,    0x0003}, {0x869f,    0x0027}, {0x86a0,    0x0006},
+{0x86a1,    0x007c}, {0x86a2,    0x0012}, {0x86a3,    0x0009},
+{0x86a4,    0x007e}, {0x86a5,    0x0085}, {0x86a6,    0x00fe},
+{0x86a7,    0x00b6}, {0x86a8,    0x0012}, {0x86a9,    0x0006},
+{0x86aa,    0x0084}, {0x86ab,    0x0007}, {0x86ac,    0x0081},
+{0x86ad,    0x0007}, {0x86ae,    0x0027}, {0x86af,    0x0008},
+{0x86b0,    0x008b}, {0x86b1,    0x0001}, {0x86b2,    0x00b7},
+{0x86b3,    0x0012}, {0x86b4,    0x0006}, {0x86b5,    0x007e},
+{0x86b6,    0x0086}, {0x86b7,    0x00d5}, {0x86b8,    0x00b6},
+{0x86b9,    0x008f}, {0x86ba,    0x0082}, {0x86bb,    0x0026},
+{0x86bc,    0x000a}, {0x86bd,    0x007c}, {0x86be,    0x008f},
+{0x86bf,    0x0082}, {0x86c0,    0x004f}, {0x86c1,    0x00b7},
+{0x86c2,    0x0012}, {0x86c3,    0x0006}, {0x86c4,    0x007e},
+{0x86c5,    0x0085}, {0x86c6,    0x00c0}, {0x86c7,    0x00b6},
+{0x86c8,    0x0012}, {0x86c9,    0x0006}, {0x86ca,    0x0084},
+{0x86cb,    0x003f}, {0x86cc,    0x0081}, {0x86cd,    0x003f},
+{0x86ce,    0x0027}, {0x86cf,    0x0010}, {0x86d0,    0x008b},
+{0x86d1,    0x0008}, {0x86d2,    0x00b7}, {0x86d3,    0x0012},
+{0x86d4,    0x0006}, {0x86d5,    0x00b6}, {0x86d6,    0x0012},
+{0x86d7,    0x0009}, {0x86d8,    0x0084}, {0x86d9,    0x00fc},
+{0x86da,    0x00b7}, {0x86db,    0x0012}, {0x86dc,    0x0009},
+{0x86dd,    0x007e}, {0x86de,    0x0085}, {0x86df,    0x00fe},
+{0x86e0,    0x00ce}, {0x86e1,    0x008f}, {0x86e2,    0x0070},
+{0x86e3,    0x0018}, {0x86e4,    0x00ce}, {0x86e5,    0x008f},
+{0x86e6,    0x0084}, {0x86e7,    0x00c6}, {0x86e8,    0x000c},
+{0x86e9,    0x00bd}, {0x86ea,    0x0089}, {0x86eb,    0x006f},
+{0x86ec,    0x00ce}, {0x86ed,    0x008f}, {0x86ee,    0x0084},
+{0x86ef,    0x0018}, {0x86f0,    0x00ce}, {0x86f1,    0x008f},
+{0x86f2,    0x0070}, {0x86f3,    0x00c6}, {0x86f4,    0x000c},
+{0x86f5,    0x00bd}, {0x86f6,    0x0089}, {0x86f7,    0x006f},
+{0x86f8,    0x00d6}, {0x86f9,    0x0083}, {0x86fa,    0x00c1},
+{0x86fb,    0x004f}, {0x86fc,    0x002d}, {0x86fd,    0x0003},
+{0x86fe,    0x007e}, {0x86ff,    0x0087}, {0x8700,    0x0040},
+{0x8701,    0x00b6}, {0x8702,    0x008f}, {0x8703,    0x007f},
+{0x8704,    0x0081}, {0x8705,    0x0007}, {0x8706,    0x0027},
+{0x8707,    0x000f}, {0x8708,    0x0081}, {0x8709,    0x000b},
+{0x870a,    0x0027}, {0x870b,    0x0015}, {0x870c,    0x0081},
+{0x870d,    0x000d}, {0x870e,    0x0027}, {0x870f,    0x001b},
+{0x8710,    0x0081}, {0x8711,    0x000e}, {0x8712,    0x0027},
+{0x8713,    0x0021}, {0x8714,    0x007e}, {0x8715,    0x0087},
+{0x8716,    0x0040}, {0x8717,    0x00f7}, {0x8718,    0x008f},
+{0x8719,    0x007b}, {0x871a,    0x0086}, {0x871b,    0x0002},
+{0x871c,    0x00b7}, {0x871d,    0x008f}, {0x871e,    0x007a},
+{0x871f,    0x0020}, {0x8720,    0x001c}, {0x8721,    0x00f7},
+{0x8722,    0x008f}, {0x8723,    0x0078}, {0x8724,    0x0086},
+{0x8725,    0x0002}, {0x8726,    0x00b7}, {0x8727,    0x008f},
+{0x8728,    0x0077}, {0x8729,    0x0020}, {0x872a,    0x0012},
+{0x872b,    0x00f7}, {0x872c,    0x008f}, {0x872d,    0x0075},
+{0x872e,    0x0086}, {0x872f,    0x0002}, {0x8730,    0x00b7},
+{0x8731,    0x008f}, {0x8732,    0x0074}, {0x8733,    0x0020},
+{0x8734,    0x0008}, {0x8735,    0x00f7}, {0x8736,    0x008f},
+{0x8737,    0x0072}, {0x8738,    0x0086}, {0x8739,    0x0002},
+{0x873a,    0x00b7}, {0x873b,    0x008f}, {0x873c,    0x0071},
+{0x873d,    0x007e}, {0x873e,    0x0087}, {0x873f,    0x0047},
+{0x8740,    0x0086}, {0x8741,    0x0004}, {0x8742,    0x0097},
+{0x8743,    0x0040}, {0x8744,    0x007e}, {0x8745,    0x0089},
+{0x8746,    0x006e}, {0x8747,    0x00ce}, {0x8748,    0x008f},
+{0x8749,    0x0072}, {0x874a,    0x00bd}, {0x874b,    0x0089},
+{0x874c,    0x00f7}, {0x874d,    0x00ce}, {0x874e,    0x008f},
+{0x874f,    0x0075}, {0x8750,    0x00bd}, {0x8751,    0x0089},
+{0x8752,    0x00f7}, {0x8753,    0x00ce}, {0x8754,    0x008f},
+{0x8755,    0x0078}, {0x8756,    0x00bd}, {0x8757,    0x0089},
+{0x8758,    0x00f7}, {0x8759,    0x00ce}, {0x875a,    0x008f},
+{0x875b,    0x007b}, {0x875c,    0x00bd}, {0x875d,    0x0089},
+{0x875e,    0x00f7}, {0x875f,    0x004f}, {0x8760,    0x00b7},
+{0x8761,    0x008f}, {0x8762,    0x007d}, {0x8763,    0x00b7},
+{0x8764,    0x008f}, {0x8765,    0x0081}, {0x8766,    0x00b6},
+{0x8767,    0x008f}, {0x8768,    0x0072}, {0x8769,    0x0027},
+{0x876a,    0x0047}, {0x876b,    0x007c}, {0x876c,    0x008f},
+{0x876d,    0x007d}, {0x876e,    0x00b6}, {0x876f,    0x008f},
+{0x8770,    0x0075}, {0x8771,    0x0027}, {0x8772,    0x003f},
+{0x8773,    0x007c}, {0x8774,    0x008f}, {0x8775,    0x007d},
+{0x8776,    0x00b6}, {0x8777,    0x008f}, {0x8778,    0x0078},
+{0x8779,    0x0027}, {0x877a,    0x0037}, {0x877b,    0x007c},
+{0x877c,    0x008f}, {0x877d,    0x007d}, {0x877e,    0x00b6},
+{0x877f,    0x008f}, {0x8780,    0x007b}, {0x8781,    0x0027},
+{0x8782,    0x002f}, {0x8783,    0x007f}, {0x8784,    0x008f},
+{0x8785,    0x007d}, {0x8786,    0x007c}, {0x8787,    0x008f},
+{0x8788,    0x0081}, {0x8789,    0x007a}, {0x878a,    0x008f},
+{0x878b,    0x0072}, {0x878c,    0x0027}, {0x878d,    0x001b},
+{0x878e,    0x007c}, {0x878f,    0x008f}, {0x8790,    0x007d},
+{0x8791,    0x007a}, {0x8792,    0x008f}, {0x8793,    0x0075},
+{0x8794,    0x0027}, {0x8795,    0x0016}, {0x8796,    0x007c},
+{0x8797,    0x008f}, {0x8798,    0x007d}, {0x8799,    0x007a},
+{0x879a,    0x008f}, {0x879b,    0x0078}, {0x879c,    0x0027},
+{0x879d,    0x0011}, {0x879e,    0x007c}, {0x879f,    0x008f},
+{0x87a0,    0x007d}, {0x87a1,    0x007a}, {0x87a2,    0x008f},
+{0x87a3,    0x007b}, {0x87a4,    0x0027}, {0x87a5,    0x000c},
+{0x87a6,    0x007e}, {0x87a7,    0x0087}, {0x87a8,    0x0083},
+{0x87a9,    0x007a}, {0x87aa,    0x008f}, {0x87ab,    0x0075},
+{0x87ac,    0x007a}, {0x87ad,    0x008f}, {0x87ae,    0x0078},
+{0x87af,    0x007a}, {0x87b0,    0x008f}, {0x87b1,    0x007b},
+{0x87b2,    0x00ce}, {0x87b3,    0x00c1}, {0x87b4,    0x00fc},
+{0x87b5,    0x00f6}, {0x87b6,    0x008f}, {0x87b7,    0x007d},
+{0x87b8,    0x003a}, {0x87b9,    0x00a6}, {0x87ba,    0x0000},
+{0x87bb,    0x00b7}, {0x87bc,    0x0012}, {0x87bd,    0x0070},
+{0x87be,    0x00b6}, {0x87bf,    0x008f}, {0x87c0,    0x0072},
+{0x87c1,    0x0026}, {0x87c2,    0x0003}, {0x87c3,    0x007e},
+{0x87c4,    0x0087}, {0x87c5,    0x00fa}, {0x87c6,    0x00b6},
+{0x87c7,    0x008f}, {0x87c8,    0x0075}, {0x87c9,    0x0026},
+{0x87ca,    0x000a}, {0x87cb,    0x0018}, {0x87cc,    0x00ce},
+{0x87cd,    0x008f}, {0x87ce,    0x0073}, {0x87cf,    0x00bd},
+{0x87d0,    0x0089}, {0x87d1,    0x00d5}, {0x87d2,    0x007e},
+{0x87d3,    0x0087}, {0x87d4,    0x00fa}, {0x87d5,    0x00b6},
+{0x87d6,    0x008f}, {0x87d7,    0x0078}, {0x87d8,    0x0026},
+{0x87d9,    0x000a}, {0x87da,    0x0018}, {0x87db,    0x00ce},
+{0x87dc,    0x008f}, {0x87dd,    0x0076}, {0x87de,    0x00bd},
+{0x87df,    0x0089}, {0x87e0,    0x00d5}, {0x87e1,    0x007e},
+{0x87e2,    0x0087}, {0x87e3,    0x00fa}, {0x87e4,    0x00b6},
+{0x87e5,    0x008f}, {0x87e6,    0x007b}, {0x87e7,    0x0026},
+{0x87e8,    0x000a}, {0x87e9,    0x0018}, {0x87ea,    0x00ce},
+{0x87eb,    0x008f}, {0x87ec,    0x0079}, {0x87ed,    0x00bd},
+{0x87ee,    0x0089}, {0x87ef,    0x00d5}, {0x87f0,    0x007e},
+{0x87f1,    0x0087}, {0x87f2,    0x00fa}, {0x87f3,    0x0086},
+{0x87f4,    0x0005}, {0x87f5,    0x0097}, {0x87f6,    0x0040},
+{0x87f7,    0x007e}, {0x87f8,    0x0089}, {0x87f9,    0x006e},
+{0x87fa,    0x00b6}, {0x87fb,    0x008f}, {0x87fc,    0x0075},
+{0x87fd,    0x0081}, {0x87fe,    0x0007}, {0x87ff,    0x002e},
+{0x8800,    0x00f2}, {0x8801,    0x00f6}, {0x8802,    0x0012},
+{0x8803,    0x0006}, {0x8804,    0x00c4}, {0x8805,    0x00f8},
+{0x8806,    0x001b}, {0x8807,    0x00b7}, {0x8808,    0x0012},
+{0x8809,    0x0006}, {0x880a,    0x00b6}, {0x880b,    0x008f},
+{0x880c,    0x0078}, {0x880d,    0x0081}, {0x880e,    0x0007},
+{0x880f,    0x002e}, {0x8810,    0x00e2}, {0x8811,    0x0048},
+{0x8812,    0x0048}, {0x8813,    0x0048}, {0x8814,    0x00f6},
+{0x8815,    0x0012}, {0x8816,    0x0006}, {0x8817,    0x00c4},
+{0x8818,    0x00c7}, {0x8819,    0x001b}, {0x881a,    0x00b7},
+{0x881b,    0x0012}, {0x881c,    0x0006}, {0x881d,    0x00b6},
+{0x881e,    0x008f}, {0x881f,    0x007b}, {0x8820,    0x0081},
+{0x8821,    0x0007}, {0x8822,    0x002e}, {0x8823,    0x00cf},
+{0x8824,    0x00f6}, {0x8825,    0x0012}, {0x8826,    0x0005},
+{0x8827,    0x00c4}, {0x8828,    0x00f8}, {0x8829,    0x001b},
+{0x882a,    0x00b7}, {0x882b,    0x0012}, {0x882c,    0x0005},
+{0x882d,    0x0086}, {0x882e,    0x0000}, {0x882f,    0x00f6},
+{0x8830,    0x008f}, {0x8831,    0x0071}, {0x8832,    0x00bd},
+{0x8833,    0x0089}, {0x8834,    0x0094}, {0x8835,    0x0086},
+{0x8836,    0x0001}, {0x8837,    0x00f6}, {0x8838,    0x008f},
+{0x8839,    0x0074}, {0x883a,    0x00bd}, {0x883b,    0x0089},
+{0x883c,    0x0094}, {0x883d,    0x0086}, {0x883e,    0x0002},
+{0x883f,    0x00f6}, {0x8840,    0x008f}, {0x8841,    0x0077},
+{0x8842,    0x00bd}, {0x8843,    0x0089}, {0x8844,    0x0094},
+{0x8845,    0x0086}, {0x8846,    0x0003}, {0x8847,    0x00f6},
+{0x8848,    0x008f}, {0x8849,    0x007a}, {0x884a,    0x00bd},
+{0x884b,    0x0089}, {0x884c,    0x0094}, {0x884d,    0x00ce},
+{0x884e,    0x008f}, {0x884f,    0x0070}, {0x8850,    0x00a6},
+{0x8851,    0x0001}, {0x8852,    0x0081}, {0x8853,    0x0001},
+{0x8854,    0x0027}, {0x8855,    0x0007}, {0x8856,    0x0081},
+{0x8857,    0x0003}, {0x8858,    0x0027}, {0x8859,    0x0003},
+{0x885a,    0x007e}, {0x885b,    0x0088}, {0x885c,    0x0066},
+{0x885d,    0x00a6}, {0x885e,    0x0000}, {0x885f,    0x00b8},
+{0x8860,    0x008f}, {0x8861,    0x0081}, {0x8862,    0x0084},
+{0x8863,    0x0001}, {0x8864,    0x0026}, {0x8865,    0x000b},
+{0x8866,    0x008c}, {0x8867,    0x008f}, {0x8868,    0x0079},
+{0x8869,    0x002c}, {0x886a,    0x000e}, {0x886b,    0x0008},
+{0x886c,    0x0008}, {0x886d,    0x0008}, {0x886e,    0x007e},
+{0x886f,    0x0088}, {0x8870,    0x0050}, {0x8871,    0x00b6},
+{0x8872,    0x0012}, {0x8873,    0x0004}, {0x8874,    0x008a},
+{0x8875,    0x0040}, {0x8876,    0x00b7}, {0x8877,    0x0012},
+{0x8878,    0x0004}, {0x8879,    0x00b6}, {0x887a,    0x0012},
+{0x887b,    0x0004}, {0x887c,    0x0084}, {0x887d,    0x00fb},
+{0x887e,    0x0084}, {0x887f,    0x00ef}, {0x8880,    0x00b7},
+{0x8881,    0x0012}, {0x8882,    0x0004}, {0x8883,    0x00b6},
+{0x8884,    0x0012}, {0x8885,    0x0007}, {0x8886,    0x0036},
+{0x8887,    0x00b6}, {0x8888,    0x008f}, {0x8889,    0x007c},
+{0x888a,    0x0048}, {0x888b,    0x0048}, {0x888c,    0x00b7},
+{0x888d,    0x0012}, {0x888e,    0x0007}, {0x888f,    0x0086},
+{0x8890,    0x0001}, {0x8891,    0x00ba}, {0x8892,    0x0012},
+{0x8893,    0x0004}, {0x8894,    0x00b7}, {0x8895,    0x0012},
+{0x8896,    0x0004}, {0x8897,    0x0001}, {0x8898,    0x0001},
+{0x8899,    0x0001}, {0x889a,    0x0001}, {0x889b,    0x0001},
+{0x889c,    0x0001}, {0x889d,    0x0086}, {0x889e,    0x00fe},
+{0x889f,    0x00b4}, {0x88a0,    0x0012}, {0x88a1,    0x0004},
+{0x88a2,    0x00b7}, {0x88a3,    0x0012}, {0x88a4,    0x0004},
+{0x88a5,    0x0086}, {0x88a6,    0x0002}, {0x88a7,    0x00ba},
+{0x88a8,    0x0012}, {0x88a9,    0x0004}, {0x88aa,    0x00b7},
+{0x88ab,    0x0012}, {0x88ac,    0x0004}, {0x88ad,    0x0086},
+{0x88ae,    0x00fd}, {0x88af,    0x00b4}, {0x88b0,    0x0012},
+{0x88b1,    0x0004}, {0x88b2,    0x00b7}, {0x88b3,    0x0012},
+{0x88b4,    0x0004}, {0x88b5,    0x0032}, {0x88b6,    0x00b7},
+{0x88b7,    0x0012}, {0x88b8,    0x0007}, {0x88b9,    0x00b6},
+{0x88ba,    0x0012}, {0x88bb,    0x0000}, {0x88bc,    0x0084},
+{0x88bd,    0x0008}, {0x88be,    0x0081}, {0x88bf,    0x0008},
+{0x88c0,    0x0027}, {0x88c1,    0x000f}, {0x88c2,    0x007c},
+{0x88c3,    0x0082}, {0x88c4,    0x0008}, {0x88c5,    0x0026},
+{0x88c6,    0x0007}, {0x88c7,    0x0086}, {0x88c8,    0x0076},
+{0x88c9,    0x0097}, {0x88ca,    0x0040}, {0x88cb,    0x007e},
+{0x88cc,    0x0089}, {0x88cd,    0x006e}, {0x88ce,    0x007e},
+{0x88cf,    0x0086}, {0x88d0,    0x00ec}, {0x88d1,    0x00b6},
+{0x88d2,    0x008f}, {0x88d3,    0x007f}, {0x88d4,    0x0081},
+{0x88d5,    0x000f}, {0x88d6,    0x0027}, {0x88d7,    0x003c},
+{0x88d8,    0x00bd}, {0x88d9,    0x00e6}, {0x88da,    0x00c7},
+{0x88db,    0x00b7}, {0x88dc,    0x0012}, {0x88dd,    0x000d},
+{0x88de,    0x00bd}, {0x88df,    0x00e6}, {0x88e0,    0x00cb},
+{0x88e1,    0x00b6}, {0x88e2,    0x0012}, {0x88e3,    0x0004},
+{0x88e4,    0x008a}, {0x88e5,    0x0020}, {0x88e6,    0x00b7},
+{0x88e7,    0x0012}, {0x88e8,    0x0004}, {0x88e9,    0x00ce},
+{0x88ea,    0x00ff}, {0x88eb,    0x00ff}, {0x88ec,    0x00b6},
+{0x88ed,    0x0012}, {0x88ee,    0x0000}, {0x88ef,    0x0081},
+{0x88f0,    0x000c}, {0x88f1,    0x0026}, {0x88f2,    0x0005},
+{0x88f3,    0x0009}, {0x88f4,    0x0026}, {0x88f5,    0x00f6},
+{0x88f6,    0x0027}, {0x88f7,    0x001c}, {0x88f8,    0x00b6},
+{0x88f9,    0x0012}, {0x88fa,    0x0004}, {0x88fb,    0x0084},
+{0x88fc,    0x00df}, {0x88fd,    0x00b7}, {0x88fe,    0x0012},
+{0x88ff,    0x0004}, {0x8900,    0x0096}, {0x8901,    0x0083},
+{0x8902,    0x0081}, {0x8903,    0x0007}, {0x8904,    0x002c},
+{0x8905,    0x0005}, {0x8906,    0x007c}, {0x8907,    0x0000},
+{0x8908,    0x0083}, {0x8909,    0x0020}, {0x890a,    0x0006},
+{0x890b,    0x0096}, {0x890c,    0x0083}, {0x890d,    0x008b},
+{0x890e,    0x0008}, {0x890f,    0x0097}, {0x8910,    0x0083},
+{0x8911,    0x007e}, {0x8912,    0x0085}, {0x8913,    0x0041},
+{0x8914,    0x007f}, {0x8915,    0x008f}, {0x8916,    0x007e},
+{0x8917,    0x0086}, {0x8918,    0x0080}, {0x8919,    0x00b7},
+{0x891a,    0x0012}, {0x891b,    0x000c}, {0x891c,    0x0086},
+{0x891d,    0x0001}, {0x891e,    0x00b7}, {0x891f,    0x008f},
+{0x8920,    0x007d}, {0x8921,    0x00b6}, {0x8922,    0x0012},
+{0x8923,    0x000c}, {0x8924,    0x0084}, {0x8925,    0x007f},
+{0x8926,    0x00b7}, {0x8927,    0x0012}, {0x8928,    0x000c},
+{0x8929,    0x008a}, {0x892a,    0x0080}, {0x892b,    0x00b7},
+{0x892c,    0x0012}, {0x892d,    0x000c}, {0x892e,    0x0086},
+{0x892f,    0x000a}, {0x8930,    0x00bd}, {0x8931,    0x008a},
+{0x8932,    0x0006}, {0x8933,    0x00b6}, {0x8934,    0x0012},
+{0x8935,    0x000a}, {0x8936,    0x002a}, {0x8937,    0x0009},
+{0x8938,    0x00b6}, {0x8939,    0x0012}, {0x893a,    0x000c},
+{0x893b,    0x00ba}, {0x893c,    0x008f}, {0x893d,    0x007d},
+{0x893e,    0x00b7}, {0x893f,    0x0012}, {0x8940,    0x000c},
+{0x8941,    0x00b6}, {0x8942,    0x008f}, {0x8943,    0x007e},
+{0x8944,    0x0081}, {0x8945,    0x0060}, {0x8946,    0x0027},
+{0x8947,    0x001a}, {0x8948,    0x008b}, {0x8949,    0x0020},
+{0x894a,    0x00b7}, {0x894b,    0x008f}, {0x894c,    0x007e},
+{0x894d,    0x00b6}, {0x894e,    0x0012}, {0x894f,    0x000c},
+{0x8950,    0x0084}, {0x8951,    0x009f}, {0x8952,    0x00ba},
+{0x8953,    0x008f}, {0x8954,    0x007e}, {0x8955,    0x00b7},
+{0x8956,    0x0012}, {0x8957,    0x000c}, {0x8958,    0x00b6},
+{0x8959,    0x008f}, {0x895a,    0x007d}, {0x895b,    0x0048},
+{0x895c,    0x00b7}, {0x895d,    0x008f}, {0x895e,    0x007d},
+{0x895f,    0x007e}, {0x8960,    0x0089}, {0x8961,    0x0021},
+{0x8962,    0x00b6}, {0x8963,    0x0012}, {0x8964,    0x0004},
+{0x8965,    0x008a}, {0x8966,    0x0020}, {0x8967,    0x00b7},
+{0x8968,    0x0012}, {0x8969,    0x0004}, {0x896a,    0x00bd},
+{0x896b,    0x008a}, {0x896c,    0x000a}, {0x896d,    0x004f},
+{0x896e,    0x0039}, {0x896f,    0x00a6}, {0x8970,    0x0000},
+{0x8971,    0x0018}, {0x8972,    0x00a7}, {0x8973,    0x0000},
+{0x8974,    0x0008}, {0x8975,    0x0018}, {0x8976,    0x0008},
+{0x8977,    0x005a}, {0x8978,    0x0026}, {0x8979,    0x00f5},
+{0x897a,    0x0039}, {0x897b,    0x0036}, {0x897c,    0x006c},
+{0x897d,    0x0000}, {0x897e,    0x0032}, {0x897f,    0x00ba},
+{0x8980,    0x008f}, {0x8981,    0x007f}, {0x8982,    0x00b7},
+{0x8983,    0x008f}, {0x8984,    0x007f}, {0x8985,    0x00b6},
+{0x8986,    0x0012}, {0x8987,    0x0009}, {0x8988,    0x0084},
+{0x8989,    0x0003}, {0x898a,    0x00a7}, {0x898b,    0x0001},
+{0x898c,    0x00b6}, {0x898d,    0x0012}, {0x898e,    0x0006},
+{0x898f,    0x0084}, {0x8990,    0x003f}, {0x8991,    0x00a7},
+{0x8992,    0x0002}, {0x8993,    0x0039}, {0x8994,    0x0036},
+{0x8995,    0x0086}, {0x8996,    0x0003}, {0x8997,    0x00b7},
+{0x8998,    0x008f}, {0x8999,    0x0080}, {0x899a,    0x0032},
+{0x899b,    0x00c1}, {0x899c,    0x0000}, {0x899d,    0x0026},
+{0x899e,    0x0006}, {0x899f,    0x00b7}, {0x89a0,    0x008f},
+{0x89a1,    0x007c}, {0x89a2,    0x007e}, {0x89a3,    0x0089},
+{0x89a4,    0x00c9}, {0x89a5,    0x00c1}, {0x89a6,    0x0001},
+{0x89a7,    0x0027}, {0x89a8,    0x0018}, {0x89a9,    0x00c1},
+{0x89aa,    0x0002}, {0x89ab,    0x0027}, {0x89ac,    0x000c},
+{0x89ad,    0x00c1}, {0x89ae,    0x0003}, {0x89af,    0x0027},
+{0x89b0,    0x0000}, {0x89b1,    0x00f6}, {0x89b2,    0x008f},
+{0x89b3,    0x0080}, {0x89b4,    0x0005}, {0x89b5,    0x0005},
+{0x89b6,    0x00f7}, {0x89b7,    0x008f}, {0x89b8,    0x0080},
+{0x89b9,    0x00f6}, {0x89ba,    0x008f}, {0x89bb,    0x0080},
+{0x89bc,    0x0005}, {0x89bd,    0x0005}, {0x89be,    0x00f7},
+{0x89bf,    0x008f}, {0x89c0,    0x0080}, {0x89c1,    0x00f6},
+{0x89c2,    0x008f}, {0x89c3,    0x0080}, {0x89c4,    0x0005},
+{0x89c5,    0x0005}, {0x89c6,    0x00f7}, {0x89c7,    0x008f},
+{0x89c8,    0x0080}, {0x89c9,    0x00f6}, {0x89ca,    0x008f},
+{0x89cb,    0x0080}, {0x89cc,    0x0053}, {0x89cd,    0x00f4},
+{0x89ce,    0x0012}, {0x89cf,    0x0007}, {0x89d0,    0x001b},
+{0x89d1,    0x00b7}, {0x89d2,    0x0012}, {0x89d3,    0x0007},
+{0x89d4,    0x0039}, {0x89d5,    0x00ce}, {0x89d6,    0x008f},
+{0x89d7,    0x0070}, {0x89d8,    0x00a6}, {0x89d9,    0x0000},
+{0x89da,    0x0018}, {0x89db,    0x00e6}, {0x89dc,    0x0000},
+{0x89dd,    0x0018}, {0x89de,    0x00a7}, {0x89df,    0x0000},
+{0x89e0,    0x00e7}, {0x89e1,    0x0000}, {0x89e2,    0x00a6},
+{0x89e3,    0x0001}, {0x89e4,    0x0018}, {0x89e5,    0x00e6},
+{0x89e6,    0x0001}, {0x89e7,    0x0018}, {0x89e8,    0x00a7},
+{0x89e9,    0x0001}, {0x89ea,    0x00e7}, {0x89eb,    0x0001},
+{0x89ec,    0x00a6}, {0x89ed,    0x0002}, {0x89ee,    0x0018},
+{0x89ef,    0x00e6}, {0x89f0,    0x0002}, {0x89f1,    0x0018},
+{0x89f2,    0x00a7}, {0x89f3,    0x0002}, {0x89f4,    0x00e7},
+{0x89f5,    0x0002}, {0x89f6,    0x0039}, {0x89f7,    0x00a6},
+{0x89f8,    0x0000}, {0x89f9,    0x0084}, {0x89fa,    0x0007},
+{0x89fb,    0x00e6}, {0x89fc,    0x0000}, {0x89fd,    0x00c4},
+{0x89fe,    0x0038}, {0x89ff,    0x0054}, {0x8a00,    0x0054},
+{0x8a01,    0x0054}, {0x8a02,    0x001b}, {0x8a03,    0x00a7},
+{0x8a04,    0x0000}, {0x8a05,    0x0039}, {0x8a06,    0x004a},
+{0x8a07,    0x0026}, {0x8a08,    0x00fd}, {0x8a09,    0x0039},
+{0x8a0a,    0x0096}, {0x8a0b,    0x0022}, {0x8a0c,    0x0084},
+{0x8a0d,    0x000f}, {0x8a0e,    0x0097}, {0x8a0f,    0x0022},
+{0x8a10,    0x0086}, {0x8a11,    0x0001}, {0x8a12,    0x00b7},
+{0x8a13,    0x008f}, {0x8a14,    0x0070}, {0x8a15,    0x00b6},
+{0x8a16,    0x0012}, {0x8a17,    0x0007}, {0x8a18,    0x00b7},
+{0x8a19,    0x008f}, {0x8a1a,    0x0071}, {0x8a1b,    0x00f6},
+{0x8a1c,    0x0012}, {0x8a1d,    0x000c}, {0x8a1e,    0x00c4},
+{0x8a1f,    0x000f}, {0x8a20,    0x00c8}, {0x8a21,    0x000f},
+{0x8a22,    0x00f7}, {0x8a23,    0x008f}, {0x8a24,    0x0072},
+{0x8a25,    0x00f6}, {0x8a26,    0x008f}, {0x8a27,    0x0072},
+{0x8a28,    0x00b6}, {0x8a29,    0x008f}, {0x8a2a,    0x0071},
+{0x8a2b,    0x0084}, {0x8a2c,    0x0003}, {0x8a2d,    0x0027},
+{0x8a2e,    0x0014}, {0x8a2f,    0x0081}, {0x8a30,    0x0001},
+{0x8a31,    0x0027}, {0x8a32,    0x001c}, {0x8a33,    0x0081},
+{0x8a34,    0x0002}, {0x8a35,    0x0027}, {0x8a36,    0x0024},
+{0x8a37,    0x00f4}, {0x8a38,    0x008f}, {0x8a39,    0x0070},
+{0x8a3a,    0x0027}, {0x8a3b,    0x002a}, {0x8a3c,    0x0096},
+{0x8a3d,    0x0022}, {0x8a3e,    0x008a}, {0x8a3f,    0x0080},
+{0x8a40,    0x007e}, {0x8a41,    0x008a}, {0x8a42,    0x0064},
+{0x8a43,    0x00f4}, {0x8a44,    0x008f}, {0x8a45,    0x0070},
+{0x8a46,    0x0027}, {0x8a47,    0x001e}, {0x8a48,    0x0096},
+{0x8a49,    0x0022}, {0x8a4a,    0x008a}, {0x8a4b,    0x0010},
+{0x8a4c,    0x007e}, {0x8a4d,    0x008a}, {0x8a4e,    0x0064},
+{0x8a4f,    0x00f4}, {0x8a50,    0x008f}, {0x8a51,    0x0070},
+{0x8a52,    0x0027}, {0x8a53,    0x0012}, {0x8a54,    0x0096},
+{0x8a55,    0x0022}, {0x8a56,    0x008a}, {0x8a57,    0x0020},
+{0x8a58,    0x007e}, {0x8a59,    0x008a}, {0x8a5a,    0x0064},
+{0x8a5b,    0x00f4}, {0x8a5c,    0x008f}, {0x8a5d,    0x0070},
+{0x8a5e,    0x0027}, {0x8a5f,    0x0006}, {0x8a60,    0x0096},
+{0x8a61,    0x0022}, {0x8a62,    0x008a}, {0x8a63,    0x0040},
+{0x8a64,    0x0097}, {0x8a65,    0x0022}, {0x8a66,    0x0074},
+{0x8a67,    0x008f}, {0x8a68,    0x0071}, {0x8a69,    0x0074},
+{0x8a6a,    0x008f}, {0x8a6b,    0x0071}, {0x8a6c,    0x0078},
+{0x8a6d,    0x008f}, {0x8a6e,    0x0070}, {0x8a6f,    0x00b6},
+{0x8a70,    0x008f}, {0x8a71,    0x0070}, {0x8a72,    0x0085},
+{0x8a73,    0x0010}, {0x8a74,    0x0027}, {0x8a75,    0x00af},
+{0x8a76,    0x00d6}, {0x8a77,    0x0022}, {0x8a78,    0x00c4},
+{0x8a79,    0x0010}, {0x8a7a,    0x0058}, {0x8a7b,    0x00b6},
+{0x8a7c,    0x0012}, {0x8a7d,    0x0070}, {0x8a7e,    0x0081},
+{0x8a7f,    0x00e4}, {0x8a80,    0x0027}, {0x8a81,    0x0036},
+{0x8a82,    0x0081}, {0x8a83,    0x00e1}, {0x8a84,    0x0026},
+{0x8a85,    0x000c}, {0x8a86,    0x0096}, {0x8a87,    0x0022},
+{0x8a88,    0x0084}, {0x8a89,    0x0020}, {0x8a8a,    0x0044},
+{0x8a8b,    0x001b}, {0x8a8c,    0x00d6}, {0x8a8d,    0x0022},
+{0x8a8e,    0x00c4}, {0x8a8f,    0x00cf}, {0x8a90,    0x0020},
+{0x8a91,    0x0023}, {0x8a92,    0x0058}, {0x8a93,    0x0081},
+{0x8a94,    0x00c6}, {0x8a95,    0x0026}, {0x8a96,    0x000d},
+{0x8a97,    0x0096}, {0x8a98,    0x0022}, {0x8a99,    0x0084},
+{0x8a9a,    0x0040}, {0x8a9b,    0x0044}, {0x8a9c,    0x0044},
+{0x8a9d,    0x001b}, {0x8a9e,    0x00d6}, {0x8a9f,    0x0022},
+{0x8aa0,    0x00c4}, {0x8aa1,    0x00af}, {0x8aa2,    0x0020},
+{0x8aa3,    0x0011}, {0x8aa4,    0x0058}, {0x8aa5,    0x0081},
+{0x8aa6,    0x0027}, {0x8aa7,    0x0026}, {0x8aa8,    0x000f},
+{0x8aa9,    0x0096}, {0x8aaa,    0x0022}, {0x8aab,    0x0084},
+{0x8aac,    0x0080}, {0x8aad,    0x0044}, {0x8aae,    0x0044},
+{0x8aaf,    0x0044}, {0x8ab0,    0x001b}, {0x8ab1,    0x00d6},
+{0x8ab2,    0x0022}, {0x8ab3,    0x00c4}, {0x8ab4,    0x006f},
+{0x8ab5,    0x001b}, {0x8ab6,    0x0097}, {0x8ab7,    0x0022},
+{0x8ab8,    0x0039}, {0x8ab9,    0x0027}, {0x8aba,    0x000c},
+{0x8abb,    0x007c}, {0x8abc,    0x0082}, {0x8abd,    0x0006},
+{0x8abe,    0x00bd}, {0x8abf,    0x00d9}, {0x8ac0,    0x00ed},
+{0x8ac1,    0x00b6}, {0x8ac2,    0x0082}, {0x8ac3,    0x0007},
+{0x8ac4,    0x007e}, {0x8ac5,    0x008a}, {0x8ac6,    0x00b9},
+{0x8ac7,    0x007f}, {0x8ac8,    0x0082}, {0x8ac9,    0x0006},
+{0x8aca,    0x0039}, { 0x0, 0x0 }
+};
+#endif
+
+
+/* phy types */
+#define   CAS_PHY_UNKNOWN       0x00
+#define   CAS_PHY_SERDES        0x01
+#define   CAS_PHY_MII_MDIO0     0x02
+#define   CAS_PHY_MII_MDIO1     0x04
+#define   CAS_PHY_MII(x)        ((x) & (CAS_PHY_MII_MDIO0 | CAS_PHY_MII_MDIO1))
+
+/* _RING_INDEX is the index for the ring sizes to be used.  _RING_SIZE
+ * is the actual size. the default index for the various rings is
+ * 8. NOTE: there a bunch of alignment constraints for the rings. to
+ * deal with that, i just allocate rings to create the desired
+ * alignment. here are the constraints:
+ *   RX DESC and COMP rings must be 8KB aligned
+ *   TX DESC must be 2KB aligned. 
+ * if you change the numbers, be cognizant of how the alignment will change
+ * in INIT_BLOCK as well.
+ */
+
+#define DESC_RING_I_TO_S(x)  (32*(1 << (x)))
+#define COMP_RING_I_TO_S(x)  (128*(1 << (x)))
+#define TX_DESC_RING_INDEX 4  /* 512 = 8k */
+#define RX_DESC_RING_INDEX 4  /* 512 = 8k */
+#define RX_COMP_RING_INDEX 4  /* 2048 = 64k: should be 4x rx ring size */
+
+#if (TX_DESC_RING_INDEX > 8) || (TX_DESC_RING_INDEX < 0)
+#error TX_DESC_RING_INDEX must be between 0 and 8
+#endif
+
+#if (RX_DESC_RING_INDEX > 8) || (RX_DESC_RING_INDEX < 0)
+#error RX_DESC_RING_INDEX must be between 0 and 8
+#endif
+
+#if (RX_COMP_RING_INDEX > 8) || (RX_COMP_RING_INDEX < 0)
+#error RX_COMP_RING_INDEX must be between 0 and 8
+#endif
+
+#define N_TX_RINGS                    MAX_TX_RINGS      /* for QoS */
+#define N_TX_RINGS_MASK               MAX_TX_RINGS_MASK
+#define N_RX_DESC_RINGS               MAX_RX_DESC_RINGS /* 1 for ipsec */
+#define N_RX_COMP_RINGS               0x1 /* for mult. PCI interrupts */
+
+/* number of flows that can go through re-assembly */
+#define N_RX_FLOWS                    64
+
+#define TX_DESC_RING_SIZE  DESC_RING_I_TO_S(TX_DESC_RING_INDEX)
+#define RX_DESC_RING_SIZE  DESC_RING_I_TO_S(RX_DESC_RING_INDEX)
+#define RX_COMP_RING_SIZE  COMP_RING_I_TO_S(RX_COMP_RING_INDEX)
+#define TX_DESC_RINGN_INDEX(x) TX_DESC_RING_INDEX
+#define RX_DESC_RINGN_INDEX(x) RX_DESC_RING_INDEX
+#define RX_COMP_RINGN_INDEX(x) RX_COMP_RING_INDEX
+#define TX_DESC_RINGN_SIZE(x)  TX_DESC_RING_SIZE
+#define RX_DESC_RINGN_SIZE(x)  RX_DESC_RING_SIZE
+#define RX_COMP_RINGN_SIZE(x)  RX_COMP_RING_SIZE
+
+/* convert values */
+#define CAS_BASE(x, y)                (((y) << (x ## _SHIFT)) & (x ## _MASK))
+#define CAS_VAL(x, y)                 (((y) & (x ## _MASK)) >> (x ## _SHIFT))
+#define CAS_TX_RINGN_BASE(y)          ((TX_DESC_RINGN_INDEX(y) << \
+                                        TX_CFG_DESC_RINGN_SHIFT(y)) & \
+                                        TX_CFG_DESC_RINGN_MASK(y))
+
+/* min is 2k, but we can't do jumbo frames unless it's at least 8k */
+#define CAS_MIN_PAGE_SHIFT            11 /* 2048 */
+#define CAS_JUMBO_PAGE_SHIFT          13 /* 8192 */
+#define CAS_MAX_PAGE_SHIFT            14 /* 16384 */             
+
+#define TX_DESC_BUFLEN_MASK         0x0000000000003FFFULL /* buffer length in
+                                                             bytes. 0 - 9256 */
+#define TX_DESC_BUFLEN_SHIFT        0
+#define TX_DESC_CSUM_START_MASK     0x00000000001F8000ULL /* checksum start. #
+                                                             of bytes to be 
+                                                             skipped before
+                                                             csum calc begins.
+                                                             value must be
+                                                             even */
+#define TX_DESC_CSUM_START_SHIFT    15
+#define TX_DESC_CSUM_STUFF_MASK     0x000000001FE00000ULL /* checksum stuff.
+                                                             byte offset w/in 
+                                                             the pkt for the
+                                                             1st csum byte.
+                                                             must be > 8 */
+#define TX_DESC_CSUM_STUFF_SHIFT    21
+#define TX_DESC_CSUM_EN             0x0000000020000000ULL /* enable checksum */
+#define TX_DESC_EOF                 0x0000000040000000ULL /* end of frame */
+#define TX_DESC_SOF                 0x0000000080000000ULL /* start of frame */
+#define TX_DESC_INTME               0x0000000100000000ULL /* interrupt me */
+#define TX_DESC_NO_CRC              0x0000000200000000ULL /* debugging only.
+                                                             CRC will not be
+                                                             inserted into
+                                                             outgoing frame. */
+struct cas_tx_desc {
+        u64     control;
+        u64     buffer;
+};
+
+/* descriptor ring for free buffers contains page-sized buffers. the index
+ * value is not used by the hw in any way. it's just stored and returned in
+ * the completion ring.
+ */
+struct cas_rx_desc {
+        u64     index;
+        u64     buffer;
+};
+
+/* received packets are put on the completion ring. */
+/* word 1 */
+#define RX_COMP1_DATA_SIZE_MASK           0x0000000007FFE000ULL   
+#define RX_COMP1_DATA_SIZE_SHIFT          13
+#define RX_COMP1_DATA_OFF_MASK            0x000001FFF8000000ULL
+#define RX_COMP1_DATA_OFF_SHIFT           27
+#define RX_COMP1_DATA_INDEX_MASK          0x007FFE0000000000ULL
+#define RX_COMP1_DATA_INDEX_SHIFT         41
+#define RX_COMP1_SKIP_MASK                0x0180000000000000ULL
+#define RX_COMP1_SKIP_SHIFT               55
+#define RX_COMP1_RELEASE_NEXT             0x0200000000000000ULL
+#define RX_COMP1_SPLIT_PKT                0x0400000000000000ULL
+#define RX_COMP1_RELEASE_FLOW             0x0800000000000000ULL  
+#define RX_COMP1_RELEASE_DATA             0x1000000000000000ULL  
+#define RX_COMP1_RELEASE_HDR              0x2000000000000000ULL
+#define RX_COMP1_TYPE_MASK                0xC000000000000000ULL
+#define RX_COMP1_TYPE_SHIFT               62
+
+/* word 2 */
+#define RX_COMP2_NEXT_INDEX_MASK          0x00000007FFE00000ULL
+#define RX_COMP2_NEXT_INDEX_SHIFT         21
+#define RX_COMP2_HDR_SIZE_MASK            0x00000FF800000000ULL
+#define RX_COMP2_HDR_SIZE_SHIFT           35
+#define RX_COMP2_HDR_OFF_MASK             0x0003F00000000000ULL
+#define RX_COMP2_HDR_OFF_SHIFT            44
+#define RX_COMP2_HDR_INDEX_MASK           0xFFFC000000000000ULL
+#define RX_COMP2_HDR_INDEX_SHIFT          50
+
+/* word 3 */
+#define RX_COMP3_SMALL_PKT                0x0000000000000001ULL
+#define RX_COMP3_JUMBO_PKT                0x0000000000000002ULL
+#define RX_COMP3_JUMBO_HDR_SPLIT_EN       0x0000000000000004ULL
+#define RX_COMP3_CSUM_START_MASK          0x000000000007F000ULL
+#define RX_COMP3_CSUM_START_SHIFT         12
+#define RX_COMP3_FLOWID_MASK              0x0000000001F80000ULL
+#define RX_COMP3_FLOWID_SHIFT             19
+#define RX_COMP3_OPCODE_MASK              0x000000000E000000ULL
+#define RX_COMP3_OPCODE_SHIFT             25
+#define RX_COMP3_FORCE_FLAG               0x0000000010000000ULL
+#define RX_COMP3_NO_ASSIST                0x0000000020000000ULL
+#define RX_COMP3_LOAD_BAL_MASK            0x000001F800000000ULL
+#define RX_COMP3_LOAD_BAL_SHIFT           35
+#define RX_PLUS_COMP3_ENC_PKT             0x0000020000000000ULL /* cas+ */
+#define RX_COMP3_L3_HEAD_OFF_MASK         0x0000FE0000000000ULL /* cas */
+#define RX_COMP3_L3_HEAD_OFF_SHIFT        41
+#define RX_PLUS_COMP_L3_HEAD_OFF_MASK     0x0000FC0000000000ULL /* cas+ */
+#define RX_PLUS_COMP_L3_HEAD_OFF_SHIFT    42
+#define RX_COMP3_SAP_MASK                 0xFFFF000000000000ULL
+#define RX_COMP3_SAP_SHIFT                48
+
+/* word 4 */
+#define RX_COMP4_TCP_CSUM_MASK            0x000000000000FFFFULL
+#define RX_COMP4_TCP_CSUM_SHIFT           0
+#define RX_COMP4_PKT_LEN_MASK             0x000000003FFF0000ULL
+#define RX_COMP4_PKT_LEN_SHIFT            16
+#define RX_COMP4_PERFECT_MATCH_MASK       0x00000003C0000000ULL
+#define RX_COMP4_PERFECT_MATCH_SHIFT      30
+#define RX_COMP4_ZERO                     0x0000080000000000ULL
+#define RX_COMP4_HASH_VAL_MASK            0x0FFFF00000000000ULL
+#define RX_COMP4_HASH_VAL_SHIFT           44
+#define RX_COMP4_HASH_PASS                0x1000000000000000ULL
+#define RX_COMP4_BAD                      0x4000000000000000ULL
+#define RX_COMP4_LEN_MISMATCH             0x8000000000000000ULL
+
+/* we encode the following: ring/index/release. only 14 bits
+ * are usable.
+ * NOTE: the encoding is dependent upon RX_DESC_RING_SIZE and 
+ *       MAX_RX_DESC_RINGS. */
+#define RX_INDEX_NUM_MASK                 0x0000000000000FFFULL
+#define RX_INDEX_NUM_SHIFT                0
+#define RX_INDEX_RING_MASK                0x0000000000001000ULL
+#define RX_INDEX_RING_SHIFT               12
+#define RX_INDEX_RELEASE                  0x0000000000002000ULL
+
+struct cas_rx_comp {
+        u64     word1;
+        u64     word2;
+        u64     word3;
+        u64     word4;
+}; 
+
+enum link_state {
+        link_down = 0,  /* No link, will retry */
+        link_aneg,      /* Autoneg in progress */
+        link_force_try, /* Try Forced link speed */
+        link_force_ret, /* Forced mode worked, retrying autoneg */
+        link_force_ok,  /* Stay in forced mode */
+        link_up         /* Link is up */
+};
+
+typedef struct cas_page {
+        struct list_head list;
+        struct page *buffer;
+        dma_addr_t dma_addr;
+        int used;
+} cas_page_t;
+
+
+/* some alignment constraints:
+ * TX DESC, RX DESC, and RX COMP must each be 8K aligned.
+ * TX COMPWB must be 8-byte aligned. 
+ * to accomplish this, here's what we do:
+ * 
+ * INIT_BLOCK_RX_COMP  = 64k (already aligned)
+ * INIT_BLOCK_RX_DESC  = 8k
+ * INIT_BLOCK_TX       = 8k
+ * INIT_BLOCK_RX1_DESC = 8k
+ * TX COMPWB
+ */
+#define INIT_BLOCK_TX           (TX_DESC_RING_SIZE)
+#define INIT_BLOCK_RX_DESC      (RX_DESC_RING_SIZE)
+#define INIT_BLOCK_RX_COMP      (RX_COMP_RING_SIZE)
+
+struct cas_init_block {
+        struct cas_rx_comp rxcs[N_RX_COMP_RINGS][INIT_BLOCK_RX_COMP];
+        struct cas_rx_desc rxds[N_RX_DESC_RINGS][INIT_BLOCK_RX_DESC]; 
+        struct cas_tx_desc txds[N_TX_RINGS][INIT_BLOCK_TX];
+        u64 tx_compwb; 
+};
+
+/* tiny buffers to deal with target abort issue. we allocate a bit
+ * over so that we don't have target abort issues with these buffers
+ * as well.
+ */
+#define TX_TINY_BUF_LEN    0x100
+#define TX_TINY_BUF_BLOCK  ((INIT_BLOCK_TX + 1)*TX_TINY_BUF_LEN)
+
+struct cas_tiny_count {
+        int nbufs;
+        int used;
+};
+
+struct cas {
+        spinlock_t lock; /* for most bits */
+        spinlock_t tx_lock[N_TX_RINGS]; /* tx bits */
+        spinlock_t stat_lock[N_TX_RINGS + 1]; /* for stat gathering */
+        spinlock_t rx_inuse_lock; /* rx inuse list */
+        spinlock_t rx_spare_lock; /* rx spare list */
+
+        void __iomem *regs;
+        int tx_new[N_TX_RINGS], tx_old[N_TX_RINGS];
+        int rx_old[N_RX_DESC_RINGS];
+        int rx_cur[N_RX_COMP_RINGS], rx_new[N_RX_COMP_RINGS];
+        int rx_last[N_RX_DESC_RINGS]; 
+
+        /* Set when chip is actually in operational state
+         * (ie. not power managed) */
+        int hw_running;
+        int opened;
+        struct semaphore pm_sem; /* open/close/suspend/resume */
+
+        struct cas_init_block *init_block;
+        struct cas_tx_desc *init_txds[MAX_TX_RINGS];
+        struct cas_rx_desc *init_rxds[MAX_RX_DESC_RINGS];
+        struct cas_rx_comp *init_rxcs[MAX_RX_COMP_RINGS];
+
+        /* we use sk_buffs for tx and pages for rx. the rx skbuffs
+         * are there for flow re-assembly. */
+        struct sk_buff      *tx_skbs[N_TX_RINGS][TX_DESC_RING_SIZE];
+        struct sk_buff_head  rx_flows[N_RX_FLOWS];
+        cas_page_t          *rx_pages[N_RX_DESC_RINGS][RX_DESC_RING_SIZE];
+        struct list_head     rx_spare_list, rx_inuse_list;
+        int                  rx_spares_needed;
+
+        /* for small packets when copying would be quicker than
+           mapping */
+        struct cas_tiny_count tx_tiny_use[N_TX_RINGS][TX_DESC_RING_SIZE];
+        u8 *tx_tiny_bufs[N_TX_RINGS];
+
+        u32                     msg_enable;
+
+        /* N_TX_RINGS must be >= N_RX_DESC_RINGS */
+        struct net_device_stats net_stats[N_TX_RINGS + 1];
+
+        u32                     pci_cfg[64 >> 2];
+        u8                      pci_revision;
+
+        int                     phy_type;
+        int                     phy_addr;
+        u32                     phy_id;
+#define CAS_FLAG_1000MB_CAP     0x00000001
+#define CAS_FLAG_REG_PLUS       0x00000002
+#define CAS_FLAG_TARGET_ABORT   0x00000004
+#define CAS_FLAG_SATURN         0x00000008
+#define CAS_FLAG_RXD_POST_MASK  0x000000F0
+#define CAS_FLAG_RXD_POST_SHIFT 4
+#define CAS_FLAG_RXD_POST(x)    ((1 << (CAS_FLAG_RXD_POST_SHIFT + (x))) & \
+                                 CAS_FLAG_RXD_POST_MASK)
+#define CAS_FLAG_ENTROPY_DEV    0x00000100
+#define CAS_FLAG_NO_HW_CSUM     0x00000200
+        u32                     cas_flags;
+        int                     packet_min; /* minimum packet size */
+        int                     tx_fifo_size;
+        int                     rx_fifo_size;
+        int                     rx_pause_off;
+        int                     rx_pause_on;
+        int                     crc_size;      /* 4 if half-duplex */
+
+        int                     pci_irq_INTC;
+        int                     min_frame_size; /* for tx fifo workaround */
+
+        /* page size allocation */
+        int                     page_size; 
+        int                     page_order;
+        int                     mtu_stride;
+
+        u32                     mac_rx_cfg;
+
+        /* Autoneg & PHY control */
+        int                     link_cntl;
+        int                     link_fcntl;
+        enum link_state         lstate;
+        struct timer_list       link_timer;
+        int                     timer_ticks;
+        struct work_struct      reset_task;
+#if 0
+        atomic_t                reset_task_pending;
+#else
+        atomic_t                reset_task_pending;
+        atomic_t                reset_task_pending_mtu;
+        atomic_t                reset_task_pending_spare;
+        atomic_t                reset_task_pending_all;
+#endif
+
+#ifdef CONFIG_CASSINI_QGE_DEBUG
+        atomic_t interrupt_seen; /* 1 if any interrupts are getting through */
+#endif
+        
+        /* Link-down problem workaround */
+#define LINK_TRANSITION_UNKNOWN         0
+#define LINK_TRANSITION_ON_FAILURE      1
+#define LINK_TRANSITION_STILL_FAILED    2
+#define LINK_TRANSITION_LINK_UP         3
+#define LINK_TRANSITION_LINK_CONFIG     4
+#define LINK_TRANSITION_LINK_DOWN       5
+#define LINK_TRANSITION_REQUESTED_RESET 6
+        int                     link_transition;
+        int                     link_transition_jiffies_valid;
+        unsigned long           link_transition_jiffies;
+
+        /* Tuning */
+        u8 orig_cacheline_size; /* value when loaded */
+#define CAS_PREF_CACHELINE_SIZE  0x20   /* Minimum desired */
+
+        /* Diagnostic counters and state. */
+        int                     casreg_len; /* reg-space size for dumping */
+        u64                     pause_entered;
+        u16                     pause_last_time_recvd;
+  
+        dma_addr_t block_dvma, tx_tiny_dvma[N_TX_RINGS];
+        struct pci_dev *pdev;
+        struct net_device *dev;
+};
+
+#define TX_DESC_NEXT(r, x)  (((x) + 1) & (TX_DESC_RINGN_SIZE(r) - 1))
+#define RX_DESC_ENTRY(r, x) ((x) & (RX_DESC_RINGN_SIZE(r) - 1))
+#define RX_COMP_ENTRY(r, x) ((x) & (RX_COMP_RINGN_SIZE(r) - 1))
+
+#define TX_BUFF_COUNT(r, x, y)    ((x) <= (y) ? ((y) - (x)) : \
+        (TX_DESC_RINGN_SIZE(r) - (x) + (y)))    
+
+#define TX_BUFFS_AVAIL(cp, i)   ((cp)->tx_old[(i)] <= (cp)->tx_new[(i)] ? \
+        (cp)->tx_old[(i)] + (TX_DESC_RINGN_SIZE(i) - 1) - (cp)->tx_new[(i)] : \
+        (cp)->tx_old[(i)] - (cp)->tx_new[(i)] - 1)
+
+#define CAS_ALIGN(addr, align) \
+     (((unsigned long) (addr) + ((align) - 1UL)) & ~((align) - 1))
+
+#define RX_FIFO_SIZE                  16384
+#define EXPANSION_ROM_SIZE            65536
+
+#define CAS_MC_EXACT_MATCH_SIZE       15
+#define CAS_MC_HASH_SIZE              256
+#define CAS_MC_HASH_MAX              (CAS_MC_EXACT_MATCH_SIZE + \
+                                      CAS_MC_HASH_SIZE)
+
+#define TX_TARGET_ABORT_LEN           0x20
+#define RX_SWIVEL_OFF_VAL             0x2
+#define RX_AE_FREEN_VAL(x)            (RX_DESC_RINGN_SIZE(x) >> 1)
+#define RX_AE_COMP_VAL                (RX_COMP_RING_SIZE >> 1)
+#define RX_BLANK_INTR_PKT_VAL         0x05
+#define RX_BLANK_INTR_TIME_VAL        0x0F
+#define HP_TCP_THRESH_VAL             1530 /* reduce to enable reassembly */
+
+#define RX_SPARE_COUNT                (RX_DESC_RING_SIZE >> 1)
+#define RX_SPARE_RECOVER_VAL          (RX_SPARE_COUNT >> 2)
+
+#endif /* _CASSINI_H */
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index cdc07ccd7332..a6078ad9b654 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -140,6 +140,7 @@
 
 #include <asm/system.h>
 #include <asm/io.h>
+#include <asm/irq.h>
 #if ALLOW_DMA
 #include <asm/dma.h>
 #endif
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 25cc20e415da..fbf1c06ec5c1 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1387,13 +1387,13 @@ static void e100_update_stats(struct nic *nic)
                 ns->collisions += nic->tx_collisions;
                 ns->tx_errors += le32_to_cpu(s->tx_max_collisions) +
                         le32_to_cpu(s->tx_lost_crs);
-                ns->rx_dropped += le32_to_cpu(s->rx_resource_errors);
                 ns->rx_length_errors += le32_to_cpu(s->rx_short_frame_errors) +
                         nic->rx_over_length_errors;
                 ns->rx_crc_errors += le32_to_cpu(s->rx_crc_errors);
                 ns->rx_frame_errors += le32_to_cpu(s->rx_alignment_errors);
                 ns->rx_over_errors += le32_to_cpu(s->rx_overrun_errors);
                 ns->rx_fifo_errors += le32_to_cpu(s->rx_overrun_errors);
+                ns->rx_missed_errors += le32_to_cpu(s->rx_resource_errors);
                 ns->rx_errors += le32_to_cpu(s->rx_crc_errors) +
                         le32_to_cpu(s->rx_alignment_errors) +
                         le32_to_cpu(s->rx_short_frame_errors) +
@@ -1727,12 +1727,10 @@ static inline int e100_rx_indicate(struct nic *nic, struct rx *rx,
 
         if(unlikely(!(rfd_status & cb_ok))) {
                 /* Don't indicate if hardware indicates errors */
-                nic->net_stats.rx_dropped++;
                 dev_kfree_skb_any(skb);
         } else if(actual_size > ETH_DATA_LEN + VLAN_ETH_HLEN) {
                 /* Don't indicate oversized frames */
                 nic->rx_over_length_errors++;
-                nic->net_stats.rx_dropped++;
                 dev_kfree_skb_any(skb);
         } else {
                 nic->net_stats.rx_packets++;
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 7c8a0a22dcd5..ee687c902a20 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -2544,7 +2544,6 @@ e1000_update_stats(struct e1000_adapter *adapter)
                 adapter->stats.crcerrs + adapter->stats.algnerrc +
                 adapter->stats.rlec + adapter->stats.mpc + 
                 adapter->stats.cexterr;
-        adapter->net_stats.rx_dropped = adapter->stats.mpc;
         adapter->net_stats.rx_length_errors = adapter->stats.rlec;
         adapter->net_stats.rx_crc_errors = adapter->stats.crcerrs;
         adapter->net_stats.rx_frame_errors = adapter->stats.algnerrc;
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index 32d5fabd4b10..a2c4dd4fb221 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -99,7 +99,7 @@ static irqreturn_t ibmveth_interrupt(int irq, void *dev_instance, struct pt_regs
 static inline void ibmveth_schedule_replenishing(struct ibmveth_adapter*);
 
 #ifdef CONFIG_PROC_FS
-#define IBMVETH_PROC_DIR "ibmveth"
+#define IBMVETH_PROC_DIR "net/ibmveth"
 static struct proc_dir_entry *ibmveth_proc_dir;
 #endif
 
@@ -1010,7 +1010,7 @@ static int __devexit ibmveth_remove(struct vio_dev *dev)
 #ifdef CONFIG_PROC_FS
 static void ibmveth_proc_register_driver(void)
 {
-        ibmveth_proc_dir = create_proc_entry(IBMVETH_PROC_DIR, S_IFDIR, proc_net);
+        ibmveth_proc_dir = proc_mkdir(IBMVETH_PROC_DIR, NULL);
         if (ibmveth_proc_dir) {
                 SET_MODULE_OWNER(ibmveth_proc_dir);
         }
@@ -1018,7 +1018,7 @@ static void ibmveth_proc_register_driver(void)
 
 static void ibmveth_proc_unregister_driver(void)
 {
-        remove_proc_entry(IBMVETH_PROC_DIR, proc_net);
+        remove_proc_entry(IBMVETH_PROC_DIR, NULL);
 }
 
 static void *ibmveth_seq_start(struct seq_file *seq, loff_t *pos) 
diff --git a/drivers/net/irda/vlsi_ir.c b/drivers/net/irda/vlsi_ir.c
index 6d9de626c967..651c5a6578fd 100644
--- a/drivers/net/irda/vlsi_ir.c
+++ b/drivers/net/irda/vlsi_ir.c
@@ -1875,11 +1875,11 @@ static int __init vlsi_mod_init(void)
 
         sirpulse = !!sirpulse;
 
-        /* create_proc_entry returns NULL if !CONFIG_PROC_FS.
+        /* proc_mkdir returns NULL if !CONFIG_PROC_FS.
          * Failure to create the procfs entry is handled like running
          * without procfs - it's not required for the driver to work.
          */
-        vlsi_proc_root = create_proc_entry(PROC_DIR, S_IFDIR, NULL);
+        vlsi_proc_root = proc_mkdir(PROC_DIR, NULL);
         if (vlsi_proc_root) {
                 /* protect registered procdir against module removal.
                  * Because we are in the module init path there's no race
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index 5c555373adbe..89d6d69be382 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -1616,8 +1616,6 @@ ixgb_update_stats(struct ixgb_adapter *adapter)
             adapter->stats.icbc +
             adapter->stats.ecbc + adapter->stats.mpc;
 
-        adapter->net_stats.rx_dropped = adapter->stats.mpc;
-
         /* see above
          * adapter->net_stats.rx_length_errors = adapter->stats.rlec;
          */
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 82f236cc3b9b..a842ecc60a34 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -1070,7 +1070,7 @@ static int __init pppoe_proc_init(void)
 {
         struct proc_dir_entry *p;
 
-        p = create_proc_entry("pppoe", S_IRUGO, proc_net);
+        p = create_proc_entry("net/pppoe", S_IRUGO, NULL);
         if (!p)
                 return -ENOMEM;
 
@@ -1142,7 +1142,7 @@ static void __exit pppoe_exit(void)
         dev_remove_pack(&pppoes_ptype);
         dev_remove_pack(&pppoed_ptype);
         unregister_netdevice_notifier(&pppoe_notifier);
-        remove_proc_entry("pppoe", proc_net);
+        remove_proc_entry("net/pppoe", NULL);
         proto_unregister(&pppoe_sk_proto);
 }
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index f0471d102e3c..afb3f186b884 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -92,19 +92,18 @@ VERSION 2.2LK	<2005/01/25>
 #endif /* RTL8169_DEBUG */
 
 #define R8169_MSG_DEFAULT \
-        (NETIF_MSG_DRV | NETIF_MSG_PROBE | NETIF_MSG_LINK | NETIF_MSG_IFUP | \
-         NETIF_MSG_IFDOWN)
+        (NETIF_MSG_DRV | NETIF_MSG_PROBE | NETIF_MSG_IFUP | NETIF_MSG_IFDOWN)
 
 #define TX_BUFFS_AVAIL(tp) \
         (tp->dirty_tx + NUM_TX_DESC - tp->cur_tx - 1)
 
 #ifdef CONFIG_R8169_NAPI
 #define rtl8169_rx_skb                  netif_receive_skb
-#define rtl8169_rx_hwaccel_skb          vlan_hwaccel_rx
+#define rtl8169_rx_hwaccel_skb          vlan_hwaccel_receive_skb
 #define rtl8169_rx_quota(count, quota)  min(count, quota)
 #else
 #define rtl8169_rx_skb                  netif_rx
-#define rtl8169_rx_hwaccel_skb          vlan_hwaccel_receive_skb
+#define rtl8169_rx_hwaccel_skb          vlan_hwaccel_rx
 #define rtl8169_rx_quota(count, quota)  count
 #endif
 
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index c829e6a2e8a6..dd451e099a4c 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -428,7 +428,7 @@ static int init_shared_mem(struct s2io_nic *nic)
                                 DBG_PRINT(INIT_DBG, 
                                 "%s: Zero DMA address for TxDL. ", dev->name);
                                 DBG_PRINT(INIT_DBG, 
-                                "Virtual address %llx\n", (u64)tmp_v);
+                                "Virtual address %p\n", tmp_v);
                                 tmp_v = pci_alloc_consistent(nic->pdev,
                                                      PAGE_SIZE, &tmp_p);
                                 if (!tmp_v) {
@@ -657,9 +657,10 @@ static void free_shared_mem(struct s2io_nic *nic)
                                             mac_control->zerodma_virt_addr,
                                             (dma_addr_t)0);
                         DBG_PRINT(INIT_DBG, 
-                        "%s: Freeing TxDL with zero DMA addr. ", dev->name);
-                        DBG_PRINT(INIT_DBG, "Virtual address %llx\n",
-                        (u64)(mac_control->zerodma_virt_addr));
+                                "%s: Freeing TxDL with zero DMA addr. ",
+                                dev->name);
+                        DBG_PRINT(INIT_DBG, "Virtual address %p\n",
+                                mac_control->zerodma_virt_addr);
                 }
                 kfree(mac_control->fifos[i].list_info);
         }
diff --git a/drivers/net/sk98lin/skge.c b/drivers/net/sk98lin/skge.c
index 6ee4771addf1..b18c92cb629e 100644
--- a/drivers/net/sk98lin/skge.c
+++ b/drivers/net/sk98lin/skge.c
@@ -235,7 +235,7 @@ static int      SkDrvDeInitAdapter(SK_AC *pAC, int devNbr);
  * Extern Function Prototypes
  *
  ******************************************************************************/
-static const char       SKRootName[] = "sk98lin";
+static const char       SKRootName[] = "net/sk98lin";
 static struct           proc_dir_entry *pSkRootDir;
 extern struct   file_operations sk_proc_fops;
 
@@ -5216,17 +5216,15 @@ static struct pci_device_id skge_pci_tbl[] = {
         { PCI_VENDOR_ID_3COM, 0x80eb, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
         { PCI_VENDOR_ID_SYSKONNECT, 0x4300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
         { PCI_VENDOR_ID_SYSKONNECT, 0x4320, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-        { PCI_VENDOR_ID_DLINK, 0x4c00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+/* DLink card does not have valid VPD so this driver gags
+ *      { PCI_VENDOR_ID_DLINK, 0x4c00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+ */
         { PCI_VENDOR_ID_MARVELL, 0x4320, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-#if 0   /* don't handle Yukon2 cards at the moment -- mlindner@syskonnect.de */
-        { PCI_VENDOR_ID_MARVELL, 0x4360, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-        { PCI_VENDOR_ID_MARVELL, 0x4361, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-#endif
         { PCI_VENDOR_ID_MARVELL, 0x5005, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
         { PCI_VENDOR_ID_CNET, 0x434e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-        { PCI_VENDOR_ID_LINKSYS, 0x1032, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+        { PCI_VENDOR_ID_LINKSYS, 0x1032, PCI_ANY_ID, 0x0015, },
         { PCI_VENDOR_ID_LINKSYS, 0x1064, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
-        { 0, }
+        { 0 }
 };
 
 MODULE_DEVICE_TABLE(pci, skge_pci_tbl);
@@ -5244,20 +5242,20 @@ static int __init skge_init(void)
 {
         int error;
 
-        pSkRootDir = proc_mkdir(SKRootName, proc_net);
+        pSkRootDir = proc_mkdir(SKRootName, NULL);
         if (pSkRootDir) 
                 pSkRootDir->owner = THIS_MODULE;
         
         error = pci_register_driver(&skge_driver);
         if (error)
-                proc_net_remove(SKRootName);
+                remove_proc_entry(SKRootName, NULL);
         return error;
 }
 
 static void __exit skge_exit(void)
 {
         pci_unregister_driver(&skge_driver);
-        proc_net_remove(SKRootName);
+        remove_proc_entry(SKRootName, NULL);
 
 }
 
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index d7c98515fdfd..fd398da4993b 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -42,7 +42,7 @@
 #include "skge.h"
 
 #define DRV_NAME                "skge"
-#define DRV_VERSION             "0.9"
+#define DRV_VERSION             "1.1"
 #define PFX                     DRV_NAME " "
 
 #define DEFAULT_TX_RING_SIZE    128
@@ -105,41 +105,28 @@ static const u32 rxirqmask[] = { IS_R1_F, IS_R2_F };
 static const u32 txirqmask[] = { IS_XA1_F, IS_XA2_F };
 static const u32 portirqmask[] = { IS_PORT_1, IS_PORT_2 };
 
-/* Don't need to look at whole 16K.
- * last interesting register is descriptor poll timer.
- */
-#define SKGE_REGS_LEN   (29*128)
-
 static int skge_get_regs_len(struct net_device *dev)
 {
-        return SKGE_REGS_LEN;
+        return 0x4000;
 }
 
 /*
- * Returns copy of control register region
- * I/O region is divided into banks and certain regions are unreadable
+ * Returns copy of whole control register region
+ * Note: skip RAM address register because accessing it will
+ *       cause bus hangs!
  */
 static void skge_get_regs(struct net_device *dev, struct ethtool_regs *regs,
                           void *p)
 {
         const struct skge_port *skge = netdev_priv(dev);
-        unsigned long offs;
         const void __iomem *io = skge->hw->regs;
-        static const unsigned long bankmap
-                = (1<<0) | (1<<2) | (1<<8) | (1<<9)
-                  | (1<<12) | (1<<13) | (1<<14) | (1<<15) | (1<<16)
-                  | (1<<17) | (1<<20) | (1<<21) | (1<<22) | (1<<23)
-                  | (1<<24)  | (1<<25) | (1<<26) | (1<<27) | (1<<28);
 
         regs->version = 1;
-        for (offs = 0; offs < regs->len; offs += 128) {
-                u32 len = min_t(u32, 128, regs->len - offs);
+        memset(p, 0, regs->len);
+        memcpy_fromio(p, io, B3_RAM_ADDR);
 
-                if (bankmap & (1<<(offs/128)))
-                        memcpy_fromio(p + offs, io + offs, len);
-                else
-                        memset(p + offs, 0, len);
-        }
+        memcpy_fromio(p + B3_RI_WTO_R1, io + B3_RI_WTO_R1,
+                      regs->len - B3_RI_WTO_R1);
 }
 
 /* Wake on Lan only supported on Yukon chps with rev 1 or above */
@@ -669,7 +656,7 @@ static void skge_led(struct skge_port *skge, enum led_mode mode)
                                      PHY_M_LED_BLINK_RT(BLINK_84MS) |
                                      PHY_M_LEDC_TX_CTRL |
                                      PHY_M_LEDC_DP_CTRL);
-                
+
                         gm_phy_write(hw, port, PHY_MARV_LED_OVER,
                                      PHY_M_LED_MO_RX(MO_LED_OFF) |
                                      (skge->speed == SPEED_100 ?
@@ -775,17 +762,6 @@ static int skge_ring_alloc(struct skge_ring *ring, void *vaddr, u64 base)
         return 0;
 }
 
-static struct sk_buff *skge_rx_alloc(struct net_device *dev, unsigned int size)
-{
-        struct sk_buff *skb = dev_alloc_skb(size);
-
-        if (likely(skb)) {
-                skb->dev = dev;
-                skb_reserve(skb, NET_IP_ALIGN);
-        }
-        return skb;
-}
-
 /* Allocate and setup a new buffer for receiving */
 static void skge_rx_setup(struct skge_port *skge, struct skge_element *e,
                           struct sk_buff *skb, unsigned int bufsize)
@@ -858,16 +834,17 @@ static int skge_rx_fill(struct skge_port *skge)
 {
         struct skge_ring *ring = &skge->rx_ring;
         struct skge_element *e;
-        unsigned int bufsize = skge->rx_buf_size;
 
         e = ring->start;
         do {
-                struct sk_buff *skb = skge_rx_alloc(skge->netdev, bufsize);
+                struct sk_buff *skb;
 
+                skb = dev_alloc_skb(skge->rx_buf_size + NET_IP_ALIGN);
                 if (!skb)
                         return -ENOMEM;
 
-                skge_rx_setup(skge, e, skb, bufsize);
+                skb_reserve(skb, NET_IP_ALIGN);
+                skge_rx_setup(skge, e, skb, skge->rx_buf_size);
         } while ( (e = e->next) != ring->start);
 
         ring->to_clean = ring->start;
@@ -876,7 +853,7 @@ static int skge_rx_fill(struct skge_port *skge)
 
 static void skge_link_up(struct skge_port *skge)
 {
-        skge_write8(skge->hw, SK_REG(skge->port, LNK_LED_REG), 
+        skge_write8(skge->hw, SK_REG(skge->port, LNK_LED_REG),
                     LED_BLK_OFF|LED_SYNC_OFF|LED_ON);
 
         netif_carrier_on(skge->netdev);
@@ -987,6 +964,8 @@ static void genesis_reset(struct skge_hw *hw, int port)
 {
         const u8 zero[8]  = { 0 };
 
+        skge_write8(hw, SK_REG(port, GMAC_IRQ_MSK), 0);
+
         /* reset the statistics module */
         xm_write32(hw, port, XM_GP_PORT, XM_GP_RES_STAT);
         xm_write16(hw, port, XM_IMSK, 0xffff);  /* disable XMAC IRQs */
@@ -1021,8 +1000,6 @@ static void bcom_check_link(struct skge_hw *hw, int port)
         (void) xm_phy_read(hw, port, PHY_BCOM_STAT);
         status = xm_phy_read(hw, port, PHY_BCOM_STAT);
 
-        pr_debug("bcom_check_link status=0x%x\n", status);
-
         if ((status & PHY_ST_LSYNC) == 0) {
                 u16 cmd = xm_read16(hw, port, XM_MMU_CMD);
                 cmd &= ~(XM_MMU_ENA_RX | XM_MMU_ENA_TX);
@@ -1106,8 +1083,6 @@ static void bcom_phy_init(struct skge_port *skge, int jumbo)
                 { 0x17, 0x0013 }, { 0x15, 0x0A04 }, { 0x18, 0x0420 },
         };
 
-        pr_debug("bcom_phy_init\n");
-
         /* read Id from external PHY (all have the same address) */
         id1 = xm_phy_read(hw, port, PHY_XMAC_ID1);
 
@@ -1340,6 +1315,8 @@ static void genesis_stop(struct skge_port *skge)
         int port = skge->port;
         u32 reg;
 
+        genesis_reset(hw, port);
+
         /* Clear Tx packet arbiter timeout IRQ */
         skge_write16(hw, B3_PA_CTRL,
                      port == 0 ? PA_CLR_TO_TX1 : PA_CLR_TO_TX2);
@@ -1465,7 +1442,6 @@ static void genesis_link_up(struct skge_port *skge)
         u16 cmd;
         u32 mode, msk;
 
-        pr_debug("genesis_link_up\n");
         cmd = xm_read16(hw, port, XM_MMU_CMD);
 
         /*
@@ -1578,7 +1554,6 @@ static void yukon_init(struct skge_hw *hw, int port)
         struct skge_port *skge = netdev_priv(hw->dev[port]);
         u16 ctrl, ct1000, adv;
 
-        pr_debug("yukon_init\n");
         if (skge->autoneg == AUTONEG_ENABLE) {
                 u16 ectrl = gm_phy_read(hw, port, PHY_MARV_EXT_CTRL);
 
@@ -1668,6 +1643,22 @@ static void yukon_reset(struct skge_hw *hw, int port)
                          | GM_RXCR_UCF_ENA | GM_RXCR_MCF_ENA);
 }
 
+/* Apparently, early versions of Yukon-Lite had wrong chip_id? */
+static int is_yukon_lite_a0(struct skge_hw *hw)
+{
+        u32 reg;
+        int ret;
+
+        if (hw->chip_id != CHIP_ID_YUKON)
+                return 0;
+
+        reg = skge_read32(hw, B2_FAR);
+        skge_write8(hw, B2_FAR + 3, 0xff);
+        ret = (skge_read8(hw, B2_FAR + 3) != 0);
+        skge_write32(hw, B2_FAR, reg);
+        return ret;
+}
+
 static void yukon_mac_init(struct skge_hw *hw, int port)
 {
         struct skge_port *skge = netdev_priv(hw->dev[port]);
@@ -1677,9 +1668,11 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
 
         /* WA code for COMA mode -- set PHY reset */
         if (hw->chip_id == CHIP_ID_YUKON_LITE &&
-            hw->chip_rev >= CHIP_REV_YU_LITE_A3)
-                skge_write32(hw, B2_GP_IO,
-                             (skge_read32(hw, B2_GP_IO) | GP_DIR_9 | GP_IO_9));
+            hw->chip_rev >= CHIP_REV_YU_LITE_A3) {
+                reg = skge_read32(hw, B2_GP_IO);
+                reg |= GP_DIR_9 | GP_IO_9;
+                skge_write32(hw, B2_GP_IO, reg);
+        }
 
         /* hard reset */
         skge_write32(hw, SK_REG(port, GPHY_CTRL), GPC_RST_SET);
@@ -1687,10 +1680,12 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
 
         /* WA code for COMA mode -- clear PHY reset */
         if (hw->chip_id == CHIP_ID_YUKON_LITE &&
-            hw->chip_rev >= CHIP_REV_YU_LITE_A3)
-                skge_write32(hw, B2_GP_IO,
-                             (skge_read32(hw, B2_GP_IO) | GP_DIR_9)
-                             & ~GP_IO_9);
+            hw->chip_rev >= CHIP_REV_YU_LITE_A3) {
+                reg = skge_read32(hw, B2_GP_IO);
+                reg |= GP_DIR_9;
+                reg &= ~GP_IO_9;
+                skge_write32(hw, B2_GP_IO, reg);
+        }
 
         /* Set hardware config mode */
         reg = GPC_INT_POL_HI | GPC_DIS_FC | GPC_DIS_SLEEP |
@@ -1729,7 +1724,7 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
         }
 
         gma_write16(hw, port, GM_GP_CTRL, reg);
-        skge_read16(hw, GMAC_IRQ_SRC);
+        skge_read16(hw, SK_REG(port, GMAC_IRQ_SRC));
 
         yukon_init(hw, port);
 
@@ -1779,9 +1774,11 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
         /* Configure Rx MAC FIFO */
         skge_write16(hw, SK_REG(port, RX_GMF_FL_MSK), RX_FF_FL_DEF_MSK);
         reg = GMF_OPER_ON | GMF_RX_F_FL_ON;
-        if (hw->chip_id == CHIP_ID_YUKON_LITE &&
-            hw->chip_rev >= CHIP_REV_YU_LITE_A3)
+
+        /* disable Rx GMAC FIFO Flush for YUKON-Lite Rev. A0 only */
+        if (is_yukon_lite_a0(hw))
                 reg &= ~GMF_RX_F_FL_ON;
+
         skge_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_CLR);
         skge_write16(hw, SK_REG(port, RX_GMF_CTRL_T), reg);
         /*
@@ -1801,20 +1798,26 @@ static void yukon_stop(struct skge_port *skge)
         struct skge_hw *hw = skge->hw;
         int port = skge->port;
 
-        if (hw->chip_id == CHIP_ID_YUKON_LITE &&
-            hw->chip_rev >= CHIP_REV_YU_LITE_A3) {
-                skge_write32(hw, B2_GP_IO,
-                             skge_read32(hw, B2_GP_IO) | GP_DIR_9 | GP_IO_9);
-        }
+        skge_write8(hw, SK_REG(port, GMAC_IRQ_MSK), 0);
+        yukon_reset(hw, port);
 
         gma_write16(hw, port, GM_GP_CTRL,
                          gma_read16(hw, port, GM_GP_CTRL)
                          & ~(GM_GPCR_TX_ENA|GM_GPCR_RX_ENA));
         gma_read16(hw, port, GM_GP_CTRL);
 
+        if (hw->chip_id == CHIP_ID_YUKON_LITE &&
+            hw->chip_rev >= CHIP_REV_YU_LITE_A3) {
+                u32 io = skge_read32(hw, B2_GP_IO);
+
+                io |= GP_DIR_9 | GP_IO_9;
+                skge_write32(hw, B2_GP_IO, io);
+                skge_read32(hw, B2_GP_IO);
+        }
+
         /* set GPHY Control reset */
-        skge_write32(hw, SK_REG(port, GPHY_CTRL), GPC_RST_SET);
-        skge_write32(hw, SK_REG(port, GMAC_CTRL), GMC_RST_SET);
+        skge_write8(hw, SK_REG(port, GPHY_CTRL), GPC_RST_SET);
+        skge_write8(hw, SK_REG(port, GMAC_CTRL), GMC_RST_SET);
 }
 
 static void yukon_get_stats(struct skge_port *skge, u64 *data)
@@ -1873,10 +1876,8 @@ static void yukon_link_up(struct skge_port *skge)
         int port = skge->port;
         u16 reg;
 
-        pr_debug("yukon_link_up\n");
-
         /* Enable Transmit FIFO Underrun */
-        skge_write8(hw, GMAC_IRQ_MSK, GMAC_DEF_MSK);
+        skge_write8(hw, SK_REG(port, GMAC_IRQ_MSK), GMAC_DEF_MSK);
 
         reg = gma_read16(hw, port, GM_GP_CTRL);
         if (skge->duplex == DUPLEX_FULL || skge->autoneg == AUTONEG_ENABLE)
@@ -1896,7 +1897,6 @@ static void yukon_link_down(struct skge_port *skge)
         int port = skge->port;
         u16 ctrl;
 
-        pr_debug("yukon_link_down\n");
         gm_phy_write(hw, port, PHY_MARV_INT_MASK, 0);
 
         ctrl = gma_read16(hw, port, GM_GP_CTRL);
@@ -2112,7 +2112,6 @@ static int skge_up(struct net_device *dev)
         skge_write8(hw, Q_ADDR(rxqaddr[port], Q_CSR), CSR_START | CSR_IRQ_CL_F);
         skge_led(skge, LED_MODE_ON);
 
-        pr_debug("skge_up completed\n");
         return 0;
 
  free_rx_ring:
@@ -2135,15 +2134,20 @@ static int skge_down(struct net_device *dev)
 
         netif_stop_queue(dev);
 
+        skge_write8(skge->hw, SK_REG(skge->port, LNK_LED_REG), LED_OFF);
+        if (hw->chip_id == CHIP_ID_GENESIS)
+                genesis_stop(skge);
+        else
+                yukon_stop(skge);
+
+        hw->intr_mask &= ~portirqmask[skge->port];
+        skge_write32(hw, B0_IMSK, hw->intr_mask);
+
         /* Stop transmitter */
         skge_write8(hw, Q_ADDR(txqaddr[port], Q_CSR), CSR_STOP);
         skge_write32(hw, RB_ADDR(txqaddr[port], RB_CTRL),
                      RB_RST_SET|RB_DIS_OP_MD);
 
-        if (hw->chip_id == CHIP_ID_GENESIS)
-                genesis_stop(skge);
-        else
-                yukon_stop(skge);
 
         /* Disable Force Sync bit and Enable Alloc bit */
         skge_write8(hw, SK_REG(port, TXA_CTRL),
@@ -2367,8 +2371,6 @@ static void genesis_set_multicast(struct net_device *dev)
         u32 mode;
         u8 filter[8];
 
-        pr_debug("genesis_set_multicast flags=%x count=%d\n", dev->flags, dev->mc_count);
-
         mode = xm_read32(hw, port, XM_MODE);
         mode |= XM_MD_ENA_HASH;
         if (dev->flags & IFF_PROMISC)
@@ -2435,6 +2437,14 @@ static void yukon_set_multicast(struct net_device *dev)
         gma_write16(hw, port, GM_RX_CTRL, reg);
 }
 
+static inline u16 phy_length(const struct skge_hw *hw, u32 status)
+{
+        if (hw->chip_id == CHIP_ID_GENESIS)
+                return status >> XMR_FS_LEN_SHIFT;
+        else
+                return status >> GMR_FS_LEN_SHIFT;
+}
+
 static inline int bad_phy_status(const struct skge_hw *hw, u32 status)
 {
         if (hw->chip_id == CHIP_ID_GENESIS)
@@ -2444,80 +2454,99 @@ static inline int bad_phy_status(const struct skge_hw *hw, u32 status)
                         (status & GMR_FS_RX_OK) == 0;
 }
 
-static void skge_rx_error(struct skge_port *skge, int slot,
-                          u32 control, u32 status)
-{
-        if (netif_msg_rx_err(skge))
-                printk(KERN_DEBUG PFX "%s: rx err, slot %d control 0x%x status 0x%x\n",
-                       skge->netdev->name, slot, control, status);
-
-        if ((control & (BMU_EOF|BMU_STF)) != (BMU_STF|BMU_EOF))
-                skge->net_stats.rx_length_errors++;
-        else if (skge->hw->chip_id == CHIP_ID_GENESIS) {
-                if (status & (XMR_FS_RUNT|XMR_FS_LNG_ERR))
-                        skge->net_stats.rx_length_errors++;
-                if (status & XMR_FS_FRA_ERR)
-                        skge->net_stats.rx_frame_errors++;
-                if (status & XMR_FS_FCS_ERR)
-                        skge->net_stats.rx_crc_errors++;
-        } else {
-                if (status & (GMR_FS_LONG_ERR|GMR_FS_UN_SIZE))
-                        skge->net_stats.rx_length_errors++;
-                if (status & GMR_FS_FRAGMENT)
-                        skge->net_stats.rx_frame_errors++;
-                if (status & GMR_FS_CRC_ERR)
-                        skge->net_stats.rx_crc_errors++;
-        }
-}
 
 /* Get receive buffer from descriptor.
  * Handles copy of small buffers and reallocation failures
  */
 static inline struct sk_buff *skge_rx_get(struct skge_port *skge,
                                           struct skge_element *e,
-                                          unsigned int len)
+                                          u32 control, u32 status, u16 csum)
 {
-        struct sk_buff *nskb, *skb;
+        struct sk_buff *skb;
+        u16 len = control & BMU_BBC;
+
+        if (unlikely(netif_msg_rx_status(skge)))
+                printk(KERN_DEBUG PFX "%s: rx slot %td status 0x%x len %d\n",
+                       skge->netdev->name, e - skge->rx_ring.start,
+                       status, len);
+
+        if (len > skge->rx_buf_size)
+                goto error;
+
+        if ((control & (BMU_EOF|BMU_STF)) != (BMU_STF|BMU_EOF))
+                goto error;
+
+        if (bad_phy_status(skge->hw, status))
+                goto error;
+
+        if (phy_length(skge->hw, status) != len)
+                goto error;
 
         if (len < RX_COPY_THRESHOLD) {
-                nskb = skge_rx_alloc(skge->netdev, len + NET_IP_ALIGN);
-                if (unlikely(!nskb))
-                        return NULL;
+                skb = dev_alloc_skb(len + 2);
+                if (!skb)
+                        goto resubmit;
 
+                skb_reserve(skb, 2);
                 pci_dma_sync_single_for_cpu(skge->hw->pdev,
                                             pci_unmap_addr(e, mapaddr),
                                             len, PCI_DMA_FROMDEVICE);
-                memcpy(nskb->data, e->skb->data, len);
+                memcpy(skb->data, e->skb->data, len);
                 pci_dma_sync_single_for_device(skge->hw->pdev,
                                                pci_unmap_addr(e, mapaddr),
                                                len, PCI_DMA_FROMDEVICE);
-
-                if (skge->rx_csum) {
-                        struct skge_rx_desc *rd = e->desc;
-                        nskb->csum = le16_to_cpu(rd->csum2);
-                        nskb->ip_summed = CHECKSUM_HW;
-                }
                 skge_rx_reuse(e, skge->rx_buf_size);
-                return nskb;
         } else {
-                nskb = skge_rx_alloc(skge->netdev, skge->rx_buf_size);
-                if (unlikely(!nskb))
-                        return NULL;
+                struct sk_buff *nskb;
+                nskb = dev_alloc_skb(skge->rx_buf_size + NET_IP_ALIGN);
+                if (!nskb)
+                        goto resubmit;
 
                 pci_unmap_single(skge->hw->pdev,
                                  pci_unmap_addr(e, mapaddr),
                                  pci_unmap_len(e, maplen),
                                  PCI_DMA_FROMDEVICE);
                 skb = e->skb;
-                if (skge->rx_csum) {
-                        struct skge_rx_desc *rd = e->desc;
-                        skb->csum = le16_to_cpu(rd->csum2);
-                        skb->ip_summed = CHECKSUM_HW;
-                }
-
+                prefetch(skb->data);
                 skge_rx_setup(skge, e, nskb, skge->rx_buf_size);
-                return skb;
         }
+
+        skb_put(skb, len);
+        skb->dev = skge->netdev;
+        if (skge->rx_csum) {
+                skb->csum = csum;
+                skb->ip_summed = CHECKSUM_HW;
+        }
+
+        skb->protocol = eth_type_trans(skb, skge->netdev);
+
+        return skb;
+error:
+
+        if (netif_msg_rx_err(skge))
+                printk(KERN_DEBUG PFX "%s: rx err, slot %td control 0x%x status 0x%x\n",
+                       skge->netdev->name, e - skge->rx_ring.start,
+                       control, status);
+
+        if (skge->hw->chip_id == CHIP_ID_GENESIS) {
+                if (status & (XMR_FS_RUNT|XMR_FS_LNG_ERR))
+                        skge->net_stats.rx_length_errors++;
+                if (status & XMR_FS_FRA_ERR)
+                        skge->net_stats.rx_frame_errors++;
+                if (status & XMR_FS_FCS_ERR)
+                        skge->net_stats.rx_crc_errors++;
+        } else {
+                if (status & (GMR_FS_LONG_ERR|GMR_FS_UN_SIZE))
+                        skge->net_stats.rx_length_errors++;
+                if (status & GMR_FS_FRAGMENT)
+                        skge->net_stats.rx_frame_errors++;
+                if (status & GMR_FS_CRC_ERR)
+                        skge->net_stats.rx_crc_errors++;
+        }
+
+resubmit:
+        skge_rx_reuse(e, skge->rx_buf_size);
+        return NULL;
 }
 
 
@@ -2530,37 +2559,19 @@ static int skge_poll(struct net_device *dev, int *budget)
         unsigned int to_do = min(dev->quota, *budget);
         unsigned int work_done = 0;
 
-        pr_debug("skge_poll\n");
-
         for (e = ring->to_clean; work_done < to_do; e = e->next) {
                 struct skge_rx_desc *rd = e->desc;
                 struct sk_buff *skb;
-                u32 control, len, status;
+                u32 control;
 
                 rmb();
                 control = rd->control;
                 if (control & BMU_OWN)
                         break;
 
-                len = control & BMU_BBC;
-                status = rd->status;
-
-                if (unlikely((control & (BMU_EOF|BMU_STF)) != (BMU_STF|BMU_EOF)
-                             || bad_phy_status(hw, status))) {
-                        skge_rx_error(skge, e - ring->start, control, status);
-                        skge_rx_reuse(e, skge->rx_buf_size);
-                        continue;
-                }
-
-                if (netif_msg_rx_status(skge))
-                    printk(KERN_DEBUG PFX "%s: rx slot %td status 0x%x len %d\n",
-                           dev->name, e - ring->start, rd->status, len);
-
-                skb = skge_rx_get(skge, e, len);
+                skb = skge_rx_get(skge, e, control, rd->status,
+                                  le16_to_cpu(rd->csum2));
                 if (likely(skb)) {
-                        skb_put(skb, len);
-                        skb->protocol = eth_type_trans(skb, dev);
-
                         dev->last_rx = jiffies;
                         netif_receive_skb(skb);
 
@@ -2672,9 +2683,9 @@ static void skge_error_irq(struct skge_hw *hw)
         if (hw->chip_id == CHIP_ID_GENESIS) {
                 /* clear xmac errors */
                 if (hwstatus & (IS_NO_STAT_M1|IS_NO_TIST_M1))
-                        skge_write16(hw, SK_REG(0, RX_MFF_CTRL1), MFF_CLR_INSTAT);
+                        skge_write16(hw, RX_MFF_CTRL1, MFF_CLR_INSTAT);
                 if (hwstatus & (IS_NO_STAT_M2|IS_NO_TIST_M2))
-                        skge_write16(hw, SK_REG(0, RX_MFF_CTRL2), MFF_CLR_INSTAT);
+                        skge_write16(hw, RX_MFF_CTRL2, MFF_CLR_INSTAT);
         } else {
                 /* Timestamp (unused) overflow */
                 if (hwstatus & IS_IRQ_TIST_OV)
@@ -3000,9 +3011,6 @@ static int skge_reset(struct skge_hw *hw)
 
         skge_write32(hw, B0_IMSK, hw->intr_mask);
 
-        if (hw->chip_id != CHIP_ID_GENESIS)
-                skge_write8(hw, GMAC_IRQ_MSK, 0);
-
         spin_lock_bh(&hw->phy_lock);
         for (i = 0; i < hw->ports; i++) {
                 if (hw->chip_id == CHIP_ID_GENESIS)
@@ -3230,6 +3238,11 @@ static void __devexit skge_remove(struct pci_dev *pdev)
         dev0 = hw->dev[0];
         unregister_netdev(dev0);
 
+        skge_write32(hw, B0_IMSK, 0);
+        skge_write16(hw, B0_LED, LED_STAT_OFF);
+        skge_pci_clear(hw);
+        skge_write8(hw, B0_CTST, CS_RST_SET);
+
         tasklet_kill(&hw->ext_tasklet);
 
         free_irq(pdev->irq, hw);
@@ -3238,7 +3251,7 @@ static void __devexit skge_remove(struct pci_dev *pdev)
         if (dev1)
                 free_netdev(dev1);
         free_netdev(dev0);
-        skge_write16(hw, B0_LED, LED_STAT_OFF);
+
         iounmap(hw->regs);
         kfree(hw);
         pci_set_drvdata(pdev, NULL);
@@ -3257,7 +3270,10 @@ static int skge_suspend(struct pci_dev *pdev, pm_message_t state)
                         struct skge_port *skge = netdev_priv(dev);
                         if (netif_running(dev)) {
                                 netif_carrier_off(dev);
-                                skge_down(dev);
+                                if (skge->wol)
+                                        netif_stop_queue(dev);
+                                else
+                                        skge_down(dev);
                         }
                         netif_device_detach(dev);
                         wol |= skge->wol;
diff --git a/drivers/net/skge.h b/drivers/net/skge.h
index f1680beb8e68..72c175b87a5a 100644
--- a/drivers/net/skge.h
+++ b/drivers/net/skge.h
@@ -953,6 +953,7 @@ enum {
  */
 enum {
         XMR_FS_LEN      = 0x3fff<<18,   /* Bit 31..18:  Rx Frame Length */
+        XMR_FS_LEN_SHIFT = 18,
         XMR_FS_2L_VLAN  = 1<<17, /* Bit 17:     tagged wh 2Lev VLAN ID*/
         XMR_FS_1_VLAN   = 1<<16, /* Bit 16:     tagged wh 1ev VLAN ID*/
         XMR_FS_BC       = 1<<15, /* Bit 15:     Broadcast Frame */
@@ -1868,6 +1869,7 @@ enum {
 /* Receive Frame Status Encoding */
 enum {
         GMR_FS_LEN      = 0xffff<<16, /* Bit 31..16:    Rx Frame Length */
+        GMR_FS_LEN_SHIFT = 16,
         GMR_FS_VLAN     = 1<<13, /* Bit 13:     VLAN Packet */
         GMR_FS_JABBER   = 1<<12, /* Bit 12:     Jabber Packet */
         GMR_FS_UN_SIZE  = 1<<11, /* Bit 11:     Undersize Packet */
@@ -2008,7 +2010,7 @@ enum {
         GM_IS_RX_FF_OR  = 1<<1, /* Receive FIFO Overrun */
         GM_IS_RX_COMPL  = 1<<0, /* Frame Reception Complete */
 
-#define GMAC_DEF_MSK    (GM_IS_TX_CO_OV | GM_IS_RX_CO_OV | GM_IS_TX_FF_UR)
+#define GMAC_DEF_MSK    (GM_IS_RX_FF_OR | GM_IS_TX_FF_UR)
 
 /*      GMAC_LINK_CTRL  16 bit  GMAC Link Control Reg (YUKON only) */
                                                 /* Bits 15.. 2: reserved */
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index 4e19220473d0..c796f41b4a52 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -1817,6 +1817,10 @@ spider_net_setup_phy(struct spider_net_card *card)
         /* LEDs active in both modes, autosense prio = fiber */
         spider_net_write_phy(card->netdev, 1, MII_NCONFIG, 0x945f);
 
+        /* switch off fibre autoneg */
+        spider_net_write_phy(card->netdev, 1, MII_NCONFIG, 0xfc01);
+        spider_net_write_phy(card->netdev, 1, 0x0b, 0x0004);
+
         phy->def->ops->read_link(phy);
         pr_info("Found %s with %i Mbps, %s-duplex.\n", phy->def->name,
                 phy->speed, phy->duplex==1 ? "Full" : "Half");
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 7599f52e15b3..1802c3b48799 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -67,8 +67,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.39"
-#define DRV_MODULE_RELDATE      "September 5, 2005"
+#define DRV_MODULE_VERSION      "3.42"
+#define DRV_MODULE_RELDATE      "Oct 3, 2005"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -3389,7 +3389,8 @@ static irqreturn_t tg3_test_isr(int irq, void *dev_id,
         struct tg3 *tp = netdev_priv(dev);
         struct tg3_hw_status *sblk = tp->hw_status;
 
-        if (sblk->status & SD_STATUS_UPDATED) {
+        if ((sblk->status & SD_STATUS_UPDATED) ||
+            !(tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
                 tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
                              0x00000001);
                 return IRQ_RETVAL(1);
@@ -3442,31 +3443,47 @@ static void tg3_tx_timeout(struct net_device *dev)
         schedule_work(&tp->reset_task);
 }
 
+/* Test for DMA buffers crossing any 4GB boundaries: 4G, 8G, etc */
+static inline int tg3_4g_overflow_test(dma_addr_t mapping, int len)
+{
+        u32 base = (u32) mapping & 0xffffffff;
+
+        return ((base > 0xffffdcc0) &&
+                (base + len + 8 < base));
+}
+
 static void tg3_set_txd(struct tg3 *, int, dma_addr_t, int, u32, u32);
 
 static int tigon3_4gb_hwbug_workaround(struct tg3 *tp, struct sk_buff *skb,
-                                       u32 guilty_entry, int guilty_len,
-                                       u32 last_plus_one, u32 *start, u32 mss)
+                                       u32 last_plus_one, u32 *start,
+                                       u32 base_flags, u32 mss)
 {
         struct sk_buff *new_skb = skb_copy(skb, GFP_ATOMIC);
-        dma_addr_t new_addr;
+        dma_addr_t new_addr = 0;
         u32 entry = *start;
-        int i;
+        int i, ret = 0;
 
         if (!new_skb) {
-                dev_kfree_skb(skb);
-                return -1;
+                ret = -1;
+        } else {
+                /* New SKB is guaranteed to be linear. */
+                entry = *start;
+                new_addr = pci_map_single(tp->pdev, new_skb->data, new_skb->len,
+                                          PCI_DMA_TODEVICE);
+                /* Make sure new skb does not cross any 4G boundaries.
+                 * Drop the packet if it does.
+                 */
+                if (tg3_4g_overflow_test(new_addr, new_skb->len)) {
+                        ret = -1;
+                        dev_kfree_skb(new_skb);
+                        new_skb = NULL;
+                } else {
+                        tg3_set_txd(tp, entry, new_addr, new_skb->len,
+                                    base_flags, 1 | (mss << 1));
+                        *start = NEXT_TX(entry);
+                }
         }
 
-        /* New SKB is guaranteed to be linear. */
-        entry = *start;
-        new_addr = pci_map_single(tp->pdev, new_skb->data, new_skb->len,
-                                  PCI_DMA_TODEVICE);
-        tg3_set_txd(tp, entry, new_addr, new_skb->len,
-                    (skb->ip_summed == CHECKSUM_HW) ?
-                    TXD_FLAG_TCPUDP_CSUM : 0, 1 | (mss << 1));
-        *start = NEXT_TX(entry);
-
         /* Now clean up the sw ring entries. */
         i = 0;
         while (entry != last_plus_one) {
@@ -3491,7 +3508,7 @@ static int tigon3_4gb_hwbug_workaround(struct tg3 *tp, struct sk_buff *skb,
 
         dev_kfree_skb(skb);
 
-        return 0;
+        return ret;
 }
 
 static void tg3_set_txd(struct tg3 *tp, int entry,
@@ -3517,19 +3534,10 @@ static void tg3_set_txd(struct tg3 *tp, int entry,
         txd->vlan_tag = vlan_tag << TXD_VLAN_TAG_SHIFT;
 }
 
-static inline int tg3_4g_overflow_test(dma_addr_t mapping, int len)
-{
-        u32 base = (u32) mapping & 0xffffffff;
-
-        return ((base > 0xffffdcc0) &&
-                (base + len + 8 < base));
-}
-
 static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct tg3 *tp = netdev_priv(dev);
         dma_addr_t mapping;
-        unsigned int i;
         u32 len, entry, base_flags, mss;
         int would_hit_hwbug;
 
@@ -3624,7 +3632,7 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         would_hit_hwbug = 0;
 
         if (tg3_4g_overflow_test(mapping, len))
-                would_hit_hwbug = entry + 1;
+                would_hit_hwbug = 1;
 
         tg3_set_txd(tp, entry, mapping, len, base_flags,
                     (skb_shinfo(skb)->nr_frags == 0) | (mss << 1));
@@ -3648,12 +3656,8 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         tp->tx_buffers[entry].skb = NULL;
                         pci_unmap_addr_set(&tp->tx_buffers[entry], mapping, mapping);
 
-                        if (tg3_4g_overflow_test(mapping, len)) {
-                                /* Only one should match. */
-                                if (would_hit_hwbug)
-                                        BUG();
-                                would_hit_hwbug = entry + 1;
-                        }
+                        if (tg3_4g_overflow_test(mapping, len))
+                                would_hit_hwbug = 1;
 
                         if (tp->tg3_flags2 & TG3_FLG2_HW_TSO)
                                 tg3_set_txd(tp, entry, mapping, len,
@@ -3669,34 +3673,15 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (would_hit_hwbug) {
                 u32 last_plus_one = entry;
                 u32 start;
-                unsigned int len = 0;
-
-                would_hit_hwbug -= 1;
-                entry = entry - 1 - skb_shinfo(skb)->nr_frags;
-                entry &= (TG3_TX_RING_SIZE - 1);
-                start = entry;
-                i = 0;
-                while (entry != last_plus_one) {
-                        if (i == 0)
-                                len = skb_headlen(skb);
-                        else
-                                len = skb_shinfo(skb)->frags[i-1].size;
 
-                        if (entry == would_hit_hwbug)
-                                break;
-
-                        i++;
-                        entry = NEXT_TX(entry);
-
-                }
+                start = entry - 1 - skb_shinfo(skb)->nr_frags;
+                start &= (TG3_TX_RING_SIZE - 1);
 
                 /* If the workaround fails due to memory/mapping
                  * failure, silently drop this packet.
                  */
-                if (tigon3_4gb_hwbug_workaround(tp, skb,
-                                                entry, len,
-                                                last_plus_one,
-                                                &start, mss))
+                if (tigon3_4gb_hwbug_workaround(tp, skb, last_plus_one,
+                                                &start, base_flags, mss))
                         goto out_unlock;
 
                 entry = start;
@@ -5411,6 +5396,9 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
         struct tg3 *tp = netdev_priv(dev);
         struct sockaddr *addr = p;
 
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EINVAL;
+
         memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
 
         spin_lock_bh(&tp->lock);
@@ -5822,6 +5810,13 @@ static int tg3_reset_hw(struct tg3 *tp)
         }
         memset(tp->hw_status, 0, TG3_HW_STATUS_SIZE);
 
+        if (tp->tg3_flags2 & TG3_FLG2_MII_SERDES) {
+                tp->tg3_flags2 &= ~TG3_FLG2_PARALLEL_DETECT;
+                /* reset to prevent losing 1st rx packet intermittently */
+                tw32_f(MAC_RX_MODE, RX_MODE_RESET);
+                udelay(10);
+        }
+
         tp->mac_mode = MAC_MODE_TXSTAT_ENABLE | MAC_MODE_RXSTAT_ENABLE |
                 MAC_MODE_TDE_ENABLE | MAC_MODE_RDE_ENABLE | MAC_MODE_FHDE_ENABLE;
         tw32_f(MAC_MODE, tp->mac_mode | MAC_MODE_RXSTAT_CLEAR | MAC_MODE_TXSTAT_CLEAR);
@@ -5953,7 +5948,7 @@ static int tg3_reset_hw(struct tg3 *tp)
         tw32(MAC_LED_CTRL, tp->led_ctrl);
 
         tw32(MAC_MI_STAT, MAC_MI_STAT_LNKSTAT_ATTN_ENAB);
-        if (tp->tg3_flags2 & TG3_FLG2_ANY_SERDES) {
+        if (tp->tg3_flags2 & TG3_FLG2_PHY_SERDES) {
                 tw32_f(MAC_RX_MODE, RX_MODE_RESET);
                 udelay(10);
         }
@@ -7376,12 +7371,17 @@ static int tg3_nway_reset(struct net_device *dev)
         if (!netif_running(dev))
                 return -EAGAIN;
 
+        if (tp->tg3_flags2 & TG3_FLG2_PHY_SERDES)
+                return -EINVAL;
+
         spin_lock_bh(&tp->lock);
         r = -EINVAL;
         tg3_readphy(tp, MII_BMCR, &bmcr);
         if (!tg3_readphy(tp, MII_BMCR, &bmcr) &&
-            (bmcr & BMCR_ANENABLE)) {
-                tg3_writephy(tp, MII_BMCR, bmcr | BMCR_ANRESTART);
+            ((bmcr & BMCR_ANENABLE) ||
+             (tp->tg3_flags2 & TG3_FLG2_PARALLEL_DETECT))) {
+                tg3_writephy(tp, MII_BMCR, bmcr | BMCR_ANRESTART |
+                                           BMCR_ANENABLE);
                 r = 0;
         }
         spin_unlock_bh(&tp->lock);
@@ -7943,19 +7943,32 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode)
         struct tg3_rx_buffer_desc *desc;
 
         if (loopback_mode == TG3_MAC_LOOPBACK) {
+                /* HW errata - mac loopback fails in some cases on 5780.
+                 * Normal traffic and PHY loopback are not affected by
+                 * errata.
+                 */
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5780)
+                        return 0;
+
                 mac_mode = (tp->mac_mode & ~MAC_MODE_PORT_MODE_MASK) |
                            MAC_MODE_PORT_INT_LPBACK | MAC_MODE_LINK_POLARITY |
                            MAC_MODE_PORT_MODE_GMII;
                 tw32(MAC_MODE, mac_mode);
         } else if (loopback_mode == TG3_PHY_LOOPBACK) {
+                tg3_writephy(tp, MII_BMCR, BMCR_LOOPBACK | BMCR_FULLDPLX |
+                                           BMCR_SPEED1000);
+                udelay(40);
+                /* reset to prevent losing 1st rx packet intermittently */
+                if (tp->tg3_flags2 & TG3_FLG2_MII_SERDES) {
+                        tw32_f(MAC_RX_MODE, RX_MODE_RESET);
+                        udelay(10);
+                        tw32_f(MAC_RX_MODE, tp->rx_mode);
+                }
                 mac_mode = (tp->mac_mode & ~MAC_MODE_PORT_MODE_MASK) |
                            MAC_MODE_LINK_POLARITY | MAC_MODE_PORT_MODE_GMII;
                 if ((tp->phy_id & PHY_ID_MASK) == PHY_ID_BCM5401)
                         mac_mode &= ~MAC_MODE_LINK_POLARITY;
                 tw32(MAC_MODE, mac_mode);
-
-                tg3_writephy(tp, MII_BMCR, BMCR_LOOPBACK | BMCR_FULLDPLX |
-                                           BMCR_SPEED1000);
         }
         else
                 return -EINVAL;
@@ -9271,6 +9284,8 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         static struct pci_device_id write_reorder_chipsets[] = {
                 { PCI_DEVICE(PCI_VENDOR_ID_AMD,
                              PCI_DEVICE_ID_AMD_FE_GATE_700C) },
+                { PCI_DEVICE(PCI_VENDOR_ID_VIA,
+                             PCI_DEVICE_ID_VIA_8385_0) },
                 { },
         };
         u32 misc_ctrl_reg;
@@ -9285,15 +9300,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
                 tp->tg3_flags2 |= TG3_FLG2_SUN_570X;
 #endif
 
-        /* If we have an AMD 762 chipset, write
-         * reordering to the mailbox registers done by the host
-         * controller can cause major troubles.  We read back from
-         * every mailbox register write to force the writes to be
-         * posted to the chip in order.
-         */
-        if (pci_dev_present(write_reorder_chipsets))
-                tp->tg3_flags |= TG3_FLAG_MBOX_WRITE_REORDER;
-
         /* Force memory write invalidate off.  If we leave it on,
          * then on 5700_BX chips we have to enable a workaround.
          * The workaround is to set the TG3PCI_DMA_RW_CTRL boundary
@@ -9424,6 +9430,16 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (pci_find_capability(tp->pdev, PCI_CAP_ID_EXP) != 0)
                 tp->tg3_flags2 |= TG3_FLG2_PCI_EXPRESS;
 
+        /* If we have an AMD 762 or VIA K8T800 chipset, write
+         * reordering to the mailbox registers done by the host
+         * controller can cause major troubles.  We read back from
+         * every mailbox register write to force the writes to be
+         * posted to the chip in order.
+         */
+        if (pci_dev_present(write_reorder_chipsets) &&
+            !(tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS))
+                tp->tg3_flags |= TG3_FLAG_MBOX_WRITE_REORDER;
+
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5703 &&
             tp->pci_lat_timer < 64) {
                 tp->pci_lat_timer = 64;
@@ -9532,7 +9548,7 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
                 tp->write32_rx_mbox = tg3_write_indirect_mbox;
 
                 iounmap(tp->regs);
-                tp->regs = 0;
+                tp->regs = NULL;
 
                 pci_read_config_word(tp->pdev, PCI_COMMAND, &pci_cmd);
                 pci_cmd &= ~PCI_COMMAND_MEMORY;
@@ -10338,6 +10354,44 @@ static char * __devinit tg3_phy_string(struct tg3 *tp)
         };
 }
 
+static char * __devinit tg3_bus_string(struct tg3 *tp, char *str)
+{
+        if (tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS) {
+                strcpy(str, "PCI Express");
+                return str;
+        } else if (tp->tg3_flags & TG3_FLAG_PCIX_MODE) {
+                u32 clock_ctrl = tr32(TG3PCI_CLOCK_CTRL) & 0x1f;
+
+                strcpy(str, "PCIX:");
+
+                if ((clock_ctrl == 7) ||
+                    ((tr32(GRC_MISC_CFG) & GRC_MISC_CFG_BOARD_ID_MASK) ==
+                     GRC_MISC_CFG_BOARD_ID_5704CIOBE))
+                        strcat(str, "133MHz");
+                else if (clock_ctrl == 0)
+                        strcat(str, "33MHz");
+                else if (clock_ctrl == 2)
+                        strcat(str, "50MHz");
+                else if (clock_ctrl == 4)
+                        strcat(str, "66MHz");
+                else if (clock_ctrl == 6)
+                        strcat(str, "100MHz");
+                else if (clock_ctrl == 7)
+                        strcat(str, "133MHz");
+        } else {
+                strcpy(str, "PCI:");
+                if (tp->tg3_flags & TG3_FLAG_PCI_HIGH_SPEED)
+                        strcat(str, "66MHz");
+                else
+                        strcat(str, "33MHz");
+        }
+        if (tp->tg3_flags & TG3_FLAG_PCI_32BIT)
+                strcat(str, ":32-bit");
+        else
+                strcat(str, ":64-bit");
+        return str;
+}
+
 static struct pci_dev * __devinit tg3_find_5704_peer(struct tg3 *tp)
 {
         struct pci_dev *peer;
@@ -10400,6 +10454,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         struct net_device *dev;
         struct tg3 *tp;
         int i, err, pci_using_dac, pm_cap;
+        char str[40];
 
         if (tg3_version_printed++ == 0)
                 printk(KERN_INFO "%s", version);
@@ -10645,16 +10700,12 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
 
         pci_set_drvdata(pdev, dev);
 
-        printk(KERN_INFO "%s: Tigon3 [partno(%s) rev %04x PHY(%s)] (PCI%s:%s:%s) %sBaseT Ethernet ",
+        printk(KERN_INFO "%s: Tigon3 [partno(%s) rev %04x PHY(%s)] (%s) %sBaseT Ethernet ",
                dev->name,
                tp->board_part_number,
                tp->pci_chip_rev_id,
                tg3_phy_string(tp),
-               ((tp->tg3_flags & TG3_FLAG_PCIX_MODE) ? "X" : ""),
-               ((tp->tg3_flags & TG3_FLAG_PCI_HIGH_SPEED) ?
-                ((tp->tg3_flags & TG3_FLAG_PCIX_MODE) ? "133MHz" : "66MHz") :
-                ((tp->tg3_flags & TG3_FLAG_PCIX_MODE) ? "100MHz" : "33MHz")),
-               ((tp->tg3_flags & TG3_FLAG_PCI_32BIT) ? "32-bit" : "64-bit"),
+               tg3_bus_string(tp, str),
                (tp->tg3_flags & TG3_FLAG_10_100_ONLY) ? "10/100" : "10/100/1000");
 
         for (i = 0; i < 6; i++)
@@ -10680,7 +10731,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
 err_out_iounmap:
         if (tp->regs) {
                 iounmap(tp->regs);
-                tp->regs = 0;
+                tp->regs = NULL;
         }
 
 err_out_free_dev:
@@ -10705,7 +10756,7 @@ static void __devexit tg3_remove_one(struct pci_dev *pdev)
                 unregister_netdev(dev);
                 if (tp->regs) {
                         iounmap(tp->regs);
-                        tp->regs = 0;
+                        tp->regs = NULL;
                 }
                 free_netdev(dev);
                 pci_release_regions(pdev);
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index c184b773e585..2e733c60bfa4 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2246,6 +2246,7 @@ struct tg3 {
          (X) == PHY_ID_BCM5411 || (X) == PHY_ID_BCM5701 || \
          (X) == PHY_ID_BCM5703 || (X) == PHY_ID_BCM5704 || \
          (X) == PHY_ID_BCM5705 || (X) == PHY_ID_BCM5750 || \
+         (X) == PHY_ID_BCM5752 || (X) == PHY_ID_BCM5780 || \
          (X) == PHY_ID_BCM8002)
 
         struct tg3_hw_stats             *hw_stats;
diff --git a/drivers/net/tulip/xircom_cb.c b/drivers/net/tulip/xircom_cb.c
index 26cc4f6378c7..60d1e05ab732 100644
--- a/drivers/net/tulip/xircom_cb.c
+++ b/drivers/net/tulip/xircom_cb.c
@@ -117,7 +117,7 @@ static int xircom_open(struct net_device *dev);
 static int xircom_close(struct net_device *dev);
 static void xircom_up(struct xircom_private *card);
 static struct net_device_stats *xircom_get_stats(struct net_device *dev);
-#if CONFIG_NET_POLL_CONTROLLER
+#ifdef CONFIG_NET_POLL_CONTROLLER
 static void xircom_poll_controller(struct net_device *dev);
 #endif
 
diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
index 48c03c11cd9a..a01efa6d5c62 100644
--- a/drivers/net/wan/hdlc_cisco.c
+++ b/drivers/net/wan/hdlc_cisco.c
@@ -72,7 +72,7 @@ static void cisco_keepalive_send(struct net_device *dev, u32 type,
         }
         skb_reserve(skb, 4);
         cisco_hard_header(skb, dev, CISCO_KEEPALIVE, NULL, NULL, 0);
-        data = (cisco_packet*)skb->data;
+        data = (cisco_packet*)(skb->data + 4);
 
         data->type = htonl(type);
         data->par1 = htonl(par1);
diff --git a/drivers/net/wan/sdlamain.c b/drivers/net/wan/sdlamain.c
index 74e151acef3e..7a8b22a7ea31 100644
--- a/drivers/net/wan/sdlamain.c
+++ b/drivers/net/wan/sdlamain.c
@@ -57,6 +57,7 @@
 #include <linux/ioport.h>       /* request_region(), release_region() */
 #include <linux/wanrouter.h>    /* WAN router definitions */
 #include <linux/wanpipe.h>      /* WANPIPE common user API definitions */
+#include <linux/rcupdate.h>
 
 #include <linux/in.h>
 #include <asm/io.h>             /* phys_to_virt() */
@@ -1268,37 +1269,41 @@ unsigned long get_ip_address(struct net_device *dev, int option)
         
         struct in_ifaddr *ifaddr;
         struct in_device *in_dev;
+        unsigned long addr = 0;
 
-        if ((in_dev = __in_dev_get(dev)) == NULL){
-                return 0;
+        rcu_read_lock();
+        if ((in_dev = __in_dev_get_rcu(dev)) == NULL){
+                goto out;
         }
 
         if ((ifaddr = in_dev->ifa_list)== NULL ){
-                return 0;
+                goto out;
         }
         
         switch (option){
 
         case WAN_LOCAL_IP:
-                return ifaddr->ifa_local;
+                addr = ifaddr->ifa_local;
                 break;
         
         case WAN_POINTOPOINT_IP:
-                return ifaddr->ifa_address;
+                addr = ifaddr->ifa_address;
                 break;  
 
         case WAN_NETMASK_IP:
-                return ifaddr->ifa_mask;
+                addr = ifaddr->ifa_mask;
                 break;
 
         case WAN_BROADCAST_IP:
-                return ifaddr->ifa_broadcast;
+                addr = ifaddr->ifa_broadcast;
                 break;
         default:
-                return 0;
+                break;
         }
 
-        return 0;
+out:
+        rcu_read_unlock();
+        return addr;
 }       
 
 void add_gateway(sdla_t *card, struct net_device *dev)
diff --git a/drivers/net/wan/syncppp.c b/drivers/net/wan/syncppp.c
index b56a7b516d24..a6d3b55013a5 100644
--- a/drivers/net/wan/syncppp.c
+++ b/drivers/net/wan/syncppp.c
@@ -769,7 +769,7 @@ static void sppp_cisco_input (struct sppp *sp, struct sk_buff *skb)
                 u32 addr = 0, mask = ~0; /* FIXME: is the mask correct? */
 #ifdef CONFIG_INET
                 rcu_read_lock();
-                if ((in_dev = __in_dev_get(dev)) != NULL)
+                if ((in_dev = __in_dev_get_rcu(dev)) != NULL)
                 {
                         for (ifa=in_dev->ifa_list; ifa != NULL;
                                 ifa=ifa->ifa_next) {
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 2be65d308fbe..06998c2240d9 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -6852,7 +6852,10 @@ static inline char *airo_translate_scan(struct net_device *dev,
         /* Add frequency */
         iwe.cmd = SIOCGIWFREQ;
         iwe.u.freq.m = le16_to_cpu(bss->dsChannel);
-        iwe.u.freq.m = frequency_list[iwe.u.freq.m] * 100000;
+        /* iwe.u.freq.m containt the channel (starting 1), our 
+         * frequency_list array start at index 0...
+         */
+        iwe.u.freq.m = frequency_list[iwe.u.freq.m - 1] * 100000;
         iwe.u.freq.e = 1;
         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe, IW_EV_FREQ_LEN);
 
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 8de49fe57233..6deb7cc810cc 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -2458,7 +2458,6 @@ struct net_device *alloc_orinocodev(int sizeof_card,
         dev->watchdog_timeo = HZ; /* 1 second timeout */
         dev->get_stats = orinoco_get_stats;
         dev->ethtool_ops = &orinoco_ethtool_ops;
-        dev->get_wireless_stats = orinoco_get_wireless_stats;
         dev->wireless_handlers = (struct iw_handler_def *)&orinoco_handler_def;
         dev->change_mtu = orinoco_change_mtu;
         dev->set_multicast_list = orinoco_set_multicast_list;
@@ -4399,6 +4398,7 @@ static const struct iw_handler_def orinoco_handler_def = {
         .standard = orinoco_handler,
         .private = orinoco_private_handler,
         .private_args = orinoco_privtab,
+        .get_wireless_stats = orinoco_get_wireless_stats,
 };
 
 static void orinoco_get_drvinfo(struct net_device *dev,
diff --git a/drivers/net/wireless/orinoco_cs.c b/drivers/net/wireless/orinoco_cs.c
index d1fb1bab8aa8..bedd7f9f23e4 100644
--- a/drivers/net/wireless/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco_cs.c
@@ -629,6 +629,7 @@ static struct pcmcia_device_id orinoco_cs_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("Cabletron", "RoamAbout 802.11 DS", 0x32d445f5, 0xedeffd90),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "Wireless LAN PCC-11", 0x5261440f, 0xa6405584),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "Wireless LAN PCCA-11", 0x5261440f, 0xdf6115f9),
+        PCMCIA_DEVICE_PROD_ID12("corega_K.K.", "Wireless_LAN_PCCB-11", 0x29e33311, 0xee7a27ae),
         PCMCIA_DEVICE_PROD_ID12("D", "Link DRC-650 11Mbps WLAN Card", 0x71b18589, 0xf144e3ac),
         PCMCIA_DEVICE_PROD_ID12("D", "Link DWL-650 11Mbps WLAN Card", 0x71b18589, 0xb6f1b0ab),
         PCMCIA_DEVICE_PROD_ID12("ELSA", "AirLancer MC-11", 0x4507a33a, 0xef54f0e3),
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index 4b0acae22b0d..7bc7fc823128 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -1352,7 +1352,7 @@ static unsigned char *strip_make_packet(unsigned char *buffer,
                 struct in_device *in_dev;
 
                 rcu_read_lock();
-                in_dev = __in_dev_get(strip_info->dev);
+                in_dev = __in_dev_get_rcu(strip_info->dev);
                 if (in_dev == NULL) {
                         rcu_read_unlock();
                         return NULL;
@@ -1508,7 +1508,7 @@ static void strip_send(struct strip *strip_info, struct sk_buff *skb)
 
                 brd = addr = 0;
                 rcu_read_lock();
-                in_dev = __in_dev_get(strip_info->dev);
+                in_dev = __in_dev_get_rcu(strip_info->dev);
                 if (in_dev) {
                         if (in_dev->ifa_list) {
                                 brd = in_dev->ifa_list->ifa_broadcast;
diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
index e90fb72a6962..286902298e33 100644
--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -37,6 +37,7 @@
 #include <linux/proc_fs.h>
 #include <linux/ctype.h>
 #include <linux/blkdev.h>
+#include <linux/rcupdate.h>
 #include <asm/io.h>
 #include <asm/processor.h>
 #include <asm/hardware.h>
@@ -358,9 +359,10 @@ static __inline__ int led_get_net_activity(void)
         /* we are running as tasklet, so locking dev_base 
          * for reading should be OK */
         read_lock(&dev_base_lock);
+        rcu_read_lock();
         for (dev = dev_base; dev; dev = dev->next) {
             struct net_device_stats *stats;
-            struct in_device *in_dev = __in_dev_get(dev);
+            struct in_device *in_dev = __in_dev_get_rcu(dev);
             if (!in_dev || !in_dev->ifa_list)
                 continue;
             if (LOOPBACK(in_dev->ifa_list->ifa_local))
@@ -371,6 +373,7 @@ static __inline__ int led_get_net_activity(void)
             rx_total += stats->rx_packets;
             tx_total += stats->tx_packets;
         }
+        rcu_read_unlock();
         read_unlock(&dev_base_lock);
 
         retval = 0;
diff --git a/drivers/pci/hotplug.c b/drivers/pci/hotplug.c
index 10444988a10b..e1743be31909 100644
--- a/drivers/pci/hotplug.c
+++ b/drivers/pci/hotplug.c
@@ -7,7 +7,6 @@ int pci_hotplug (struct device *dev, char **envp, int num_envp,
                  char *buffer, int buffer_size)
 {
         struct pci_dev *pdev;
-        char *scratch;
         int i = 0;
         int length = 0;
 
@@ -18,9 +17,6 @@ int pci_hotplug (struct device *dev, char **envp, int num_envp,
         if (!pdev)
                 return -ENODEV;
 
-        scratch = buffer;
-
-
         if (add_hotplug_env_var(envp, num_envp, &i,
                                 buffer, buffer_size, &length,
                                 "PCI_CLASS=%04X", pdev->class))
diff --git a/drivers/pci/hotplug/ibmphp_pci.c b/drivers/pci/hotplug/ibmphp_pci.c
index 8122fe734aa7..b1ba429e0a2d 100644
--- a/drivers/pci/hotplug/ibmphp_pci.c
+++ b/drivers/pci/hotplug/ibmphp_pci.c
@@ -558,7 +558,7 @@ static int configure_device (struct pci_func *func)
         pci_bus_write_config_byte (ibmphp_pci_bus, devfn, PCI_CACHE_LINE_SIZE, CACHE);
         pci_bus_write_config_byte (ibmphp_pci_bus, devfn, PCI_LATENCY_TIMER, LATENCY);
 
-        pci_bus_write_config_word (ibmphp_pci_bus, devfn, PCI_ROM_ADDRESS, 0x00L);
+        pci_bus_write_config_dword (ibmphp_pci_bus, devfn, PCI_ROM_ADDRESS, 0x00L);
         pci_bus_write_config_word (ibmphp_pci_bus, devfn, PCI_COMMAND, DEVICEENABLE);
 
         return 0;
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 0e0947601526..898f6da6f0de 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -2526,7 +2526,6 @@ configure_new_function(struct controller *ctrl, struct pci_func *func,
         int cloop;
         u8 temp_byte;
         u8 class_code;
-        u16 temp_word;
         u32 rc;
         u32 temp_register;
         u32 base;
@@ -2682,8 +2681,7 @@ configure_new_function(struct controller *ctrl, struct pci_func *func,
                 }               /* End of base register loop */
 
                 /* disable ROM base Address */
-                temp_word = 0x00L;
-                rc = pci_bus_write_config_word (pci_bus, devfn, PCI_ROM_ADDRESS, temp_word);
+                rc = pci_bus_write_config_dword (pci_bus, devfn, PCI_ROM_ADDRESS, 0x00);
 
                 /* Set HP parameters (Cache Line Size, Latency Timer) */
                 rc = pciehprm_set_hpp(ctrl, func, PCI_HEADER_TYPE_NORMAL);
diff --git a/drivers/pci/hotplug/rpadlpar_sysfs.c b/drivers/pci/hotplug/rpadlpar_sysfs.c
index 752e6513c447..db69be85b458 100644
--- a/drivers/pci/hotplug/rpadlpar_sysfs.c
+++ b/drivers/pci/hotplug/rpadlpar_sysfs.c
@@ -62,7 +62,7 @@ static ssize_t add_slot_store(struct dlpar_io_attr *dlpar_attr,
         char drc_name[MAX_DRC_NAME_LEN];
         char *end;
 
-        if (nbytes > MAX_DRC_NAME_LEN)
+        if (nbytes >= MAX_DRC_NAME_LEN)
                 return 0;
 
         memcpy(drc_name, buf, nbytes);
@@ -83,7 +83,7 @@ static ssize_t remove_slot_store(struct dlpar_io_attr *dlpar_attr,
         char drc_name[MAX_DRC_NAME_LEN];
         char *end;
 
-        if (nbytes > MAX_DRC_NAME_LEN)
+        if (nbytes >= MAX_DRC_NAME_LEN)
                 return 0;
 
         memcpy(drc_name, buf, nbytes);
diff --git a/drivers/pci/hotplug/sgi_hotplug.c b/drivers/pci/hotplug/sgi_hotplug.c
index b1409441c1cd..a32ae82e5922 100644
--- a/drivers/pci/hotplug/sgi_hotplug.c
+++ b/drivers/pci/hotplug/sgi_hotplug.c
@@ -159,7 +159,7 @@ static int sn_hp_slot_private_alloc(struct hotplug_slot *bss_hotplug_slot,
 
         pcibus_info = SN_PCIBUS_BUSSOFT_INFO(pci_bus);
 
-        slot = kcalloc(1, sizeof(*slot), GFP_KERNEL);
+        slot = kzalloc(sizeof(*slot), GFP_KERNEL);
         if (!slot)
                 return -ENOMEM;
         bss_hotplug_slot->private = slot;
@@ -491,7 +491,7 @@ static int sn_hotplug_slot_register(struct pci_bus *pci_bus)
                 if (sn_pci_slot_valid(pci_bus, device) != 1)
                         continue;
 
-                bss_hotplug_slot = kcalloc(1, sizeof(*bss_hotplug_slot),
+                bss_hotplug_slot = kzalloc(sizeof(*bss_hotplug_slot),
                                            GFP_KERNEL);
                 if (!bss_hotplug_slot) {
                         rc = -ENOMEM;
@@ -499,7 +499,7 @@ static int sn_hotplug_slot_register(struct pci_bus *pci_bus)
                 }
 
                 bss_hotplug_slot->info =
-                        kcalloc(1, sizeof(struct hotplug_slot_info),
+                        kzalloc(sizeof(struct hotplug_slot_info),
                                 GFP_KERNEL);
                 if (!bss_hotplug_slot->info) {
                         rc = -ENOMEM;
diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
index 783b5abb0717..91c9903e621f 100644
--- a/drivers/pci/hotplug/shpchp_ctrl.c
+++ b/drivers/pci/hotplug/shpchp_ctrl.c
@@ -2824,8 +2824,7 @@ static int configure_new_function (struct controller * ctrl, struct pci_func * f
                 }
 #endif
                 /* Disable ROM base Address */
-                temp_word = 0x00L;
-                rc = pci_bus_write_config_word (pci_bus, devfn, PCI_ROM_ADDRESS, temp_word);
+                rc = pci_bus_write_config_dword (pci_bus, devfn, PCI_ROM_ADDRESS, 0x00);
 
                 /* Set HP parameters (Cache Line Size, Latency Timer) */
                 rc = shpchprm_set_hpp(ctrl, func, PCI_HEADER_TYPE_NORMAL);
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 56a3b397efee..2898830c496f 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -360,7 +360,7 @@ pci_create_resource_files(struct pci_dev *pdev)
                         continue;
 
                 /* allocate attribute structure, piggyback attribute name */
-                res_attr = kcalloc(1, sizeof(*res_attr) + 10, GFP_ATOMIC);
+                res_attr = kzalloc(sizeof(*res_attr) + 10, GFP_ATOMIC);
                 if (res_attr) {
                         char *res_attr_name = (char *)(res_attr + 1);
 
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 992db89adce7..259d247b7551 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -309,17 +309,25 @@ pci_set_power_state(struct pci_dev *dev, pci_power_t state)
 
         pci_read_config_word(dev, pm + PCI_PM_CTRL, &pmcsr);
 
-        /* If we're in D3, force entire word to 0.
+        /* If we're (effectively) in D3, force entire word to 0.
          * This doesn't affect PME_Status, disables PME_En, and
          * sets PowerState to 0.
          */
-        if (dev->current_state >= PCI_D3hot) {
-                if (!(pmcsr & PCI_PM_CTRL_NO_SOFT_RESET))
+        switch (dev->current_state) {
+        case PCI_UNKNOWN: /* Boot-up */
+                if ((pmcsr & PCI_PM_CTRL_STATE_MASK) == PCI_D3hot
+                 && !(pmcsr & PCI_PM_CTRL_NO_SOFT_RESET))
                         need_restore = 1;
+                /* Fall-through: force to D0 */
+        case PCI_D3hot:
+        case PCI_D3cold:
+        case PCI_POWER_ERROR:
                 pmcsr = 0;
-        } else {
+                break;
+        default:
                 pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
                 pmcsr |= state;
+                break;
         }
 
         /* enter specified state */
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 26a55d08b506..005786416bb5 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -165,7 +165,7 @@ static void pci_read_bases(struct pci_dev *dev, unsigned int howmany, int rom)
                 if (l == 0xffffffff)
                         l = 0;
                 if ((l & PCI_BASE_ADDRESS_SPACE) == PCI_BASE_ADDRESS_SPACE_MEMORY) {
-                        sz = pci_size(l, sz, PCI_BASE_ADDRESS_MEM_MASK);
+                        sz = pci_size(l, sz, (u32)PCI_BASE_ADDRESS_MEM_MASK);
                         if (!sz)
                                 continue;
                         res->start = l & PCI_BASE_ADDRESS_MEM_MASK;
@@ -215,7 +215,7 @@ static void pci_read_bases(struct pci_dev *dev, unsigned int howmany, int rom)
                 if (l == 0xffffffff)
                         l = 0;
                 if (sz && sz != 0xffffffff) {
-                        sz = pci_size(l, sz, PCI_ROM_ADDRESS_MASK);
+                        sz = pci_size(l, sz, (u32)PCI_ROM_ADDRESS_MASK);
                         if (sz) {
                                 res->flags = (l & IORESOURCE_ROM_ENABLE) |
                                   IORESOURCE_MEM | IORESOURCE_PREFETCH |
@@ -402,6 +402,12 @@ static void pci_enable_crs(struct pci_dev *dev)
 static void __devinit pci_fixup_parent_subordinate_busnr(struct pci_bus *child, int max)
 {
         struct pci_bus *parent = child->parent;
+
+        /* Attempts to fix that up are really dangerous unless
+           we're going to re-assign all bus numbers. */
+        if (!pcibios_assign_all_busses())
+                return;
+
         while (parent->parent && parent->subordinate < max) {
                 parent->subordinate = max;
                 pci_write_config_byte(parent->self, PCI_SUBORDINATE_BUS, max);
@@ -478,8 +484,18 @@ int __devinit pci_scan_bridge(struct pci_bus *bus, struct pci_dev * dev, int max
                  * We need to assign a number to this bus which we always
                  * do in the second pass.
                  */
-                if (!pass)
+                if (!pass) {
+                        if (pcibios_assign_all_busses())
+                                /* Temporarily disable forwarding of the
+                                   configuration cycles on all bridges in
+                                   this bus segment to avoid possible
+                                   conflicts in the second pass between two
+                                   bridges programmed with overlapping
+                                   bus ranges. */
+                                pci_write_config_dword(dev, PCI_PRIMARY_BUS,
+                                                       buses & ~0xffffff);
                         return max;
+                }
 
                 /* Clear errors */
                 pci_write_config_word(dev, PCI_STATUS, 0xffff);
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index ddc741e6ecbf..36cc9a96a338 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -146,7 +146,7 @@ config I82365
 
 config TCIC
         tristate "Databook TCIC host bridge support"
-        depends on PCMCIA
+        depends on PCMCIA && ISA
         select PCCARD_NONSTATIC
         help
           Say Y here to include support for the Databook TCIC family of PCMCIA
diff --git a/drivers/pcmcia/cardbus.c b/drivers/pcmcia/cardbus.c
index 1d755e20880c..3f6d51d11374 100644
--- a/drivers/pcmcia/cardbus.c
+++ b/drivers/pcmcia/cardbus.c
@@ -228,6 +228,11 @@ int cb_alloc(struct pcmcia_socket * s)
         pci_bus_size_bridges(bus);
         pci_bus_assign_resources(bus);
         cardbus_assign_irqs(bus, s->pci_irq);
+
+        /* socket specific tune function */
+        if (s->tune_bridge)
+                s->tune_bridge(s, bus);
+
         pci_enable_bridges(bus);
         pci_bus_add_devices(bus);
 
diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
index 08d1c9288264..94be9e51654e 100644
--- a/drivers/pcmcia/omap_cf.c
+++ b/drivers/pcmcia/omap_cf.c
@@ -22,7 +22,6 @@
 
 #include <asm/hardware.h>
 #include <asm/io.h>
-#include <asm/mach-types.h>
 #include <asm/sizes.h>
 
 #include <asm/arch/mux.h>
diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
index 39ba6406fd54..80969f7e7a0b 100644
--- a/drivers/pcmcia/pcmcia_ioctl.c
+++ b/drivers/pcmcia/pcmcia_ioctl.c
@@ -376,6 +376,7 @@ static int ds_open(struct inode *inode, struct file *file)
     socket_t i = iminor(inode);
     struct pcmcia_socket *s;
     user_info_t *user;
+    static int warning_printed = 0;
 
     ds_dbg(0, "ds_open(socket %d)\n", i);
 
@@ -407,6 +408,17 @@ static int ds_open(struct inode *inode, struct file *file)
     s->user = user;
     file->private_data = user;
 
+    if (!warning_printed) {
+            printk(KERN_INFO "pcmcia: Detected deprecated PCMCIA ioctl "
+                        "usage.\n");
+            printk(KERN_INFO "pcmcia: This interface will soon be removed from "
+                        "the kernel; please expect breakage unless you upgrade "
+                        "to new tools.\n");
+            printk(KERN_INFO "pcmcia: see http://www.kernel.org/pub/linux/"
+                        "utils/kernel/pcmcia/pcmcia.html for details.\n");
+            warning_printed = 1;
+    }
+
     if (s->pcmcia_state.present)
         queue_event(user, CS_EVENT_CARD_INSERTION);
     return 0;
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index c42455d20eb6..f9a5c70284b5 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -691,7 +691,7 @@ static int adjust_memory(struct pcmcia_socket *s, unsigned int action, unsigned
         unsigned long size = end - start + 1;
         int ret = 0;
 
-        if (end <= start)
+        if (end < start)
                 return -EINVAL;
 
         down(&rsrc_sem);
@@ -724,7 +724,7 @@ static int adjust_io(struct pcmcia_socket *s, unsigned int action, unsigned long
         unsigned long size = end - start + 1;
         int ret = 0;
 
-        if (end <= start)
+        if (end < start)
                 return -EINVAL;
 
         if (end > IO_SPACE_LIMIT)
@@ -817,7 +817,7 @@ static int nonstatic_autoadd_resources(struct pcmcia_socket *s)
 
         /* if we got at least one of IO, and one of MEM, we can be glad and
          * activate the PCMCIA subsystem */
-        if (done & (IORESOURCE_MEM | IORESOURCE_IO))
+        if (done == (IORESOURCE_MEM | IORESOURCE_IO))
                 s->resource_setup_done = 1;
 
         return 0;
@@ -925,7 +925,7 @@ static ssize_t store_io_db(struct class_device *class_dev, const char *buf, size
                                 return -EINVAL;
                 }
         }
-        if (end_addr <= start_addr)
+        if (end_addr < start_addr)
                 return -EINVAL;
 
         ret = adjust_io(s, add, start_addr, end_addr);
@@ -977,7 +977,7 @@ static ssize_t store_mem_db(struct class_device *class_dev, const char *buf, siz
                                 return -EINVAL;
                 }
         }
-        if (end_addr <= start_addr)
+        if (end_addr < start_addr)
                 return -EINVAL;
 
         ret = adjust_memory(s, add, start_addr, end_addr);
diff --git a/drivers/pcmcia/ti113x.h b/drivers/pcmcia/ti113x.h
index fbe233e19ceb..da0b404561c9 100644
--- a/drivers/pcmcia/ti113x.h
+++ b/drivers/pcmcia/ti113x.h
@@ -59,6 +59,7 @@
 
 #define  TI122X_SCR_SER_STEP            0xc0000000
 #define  TI122X_SCR_INTRTIE             0x20000000
+#define  TIXX21_SCR_TIEALL              0x10000000
 #define  TI122X_SCR_CBRSVD              0x00400000
 #define  TI122X_SCR_MRBURSTDN           0x00008000
 #define  TI122X_SCR_MRBURSTUP           0x00004000
@@ -153,6 +154,12 @@
 /* EnE test register */
 #define ENE_TEST_C9                     0xc9    /* 8bit */
 #define ENE_TEST_C9_TLTENABLE           0x02
+#define ENE_TEST_C9_PFENABLE_F0         0x04
+#define ENE_TEST_C9_PFENABLE_F1         0x08
+#define ENE_TEST_C9_PFENABLE            (ENE_TEST_C9_PFENABLE_F0 | ENE_TEST_C9_PFENABLE_F0)
+#define ENE_TEST_C9_WPDISALBLE_F0       0x40
+#define ENE_TEST_C9_WPDISALBLE_F1       0x80
+#define ENE_TEST_C9_WPDISALBLE          (ENE_TEST_C9_WPDISALBLE_F0 | ENE_TEST_C9_WPDISALBLE_F1)
 
 /*
  * Texas Instruments CardBus controller overrides.
@@ -618,6 +625,7 @@ static int ti12xx_2nd_slot_empty(struct yenta_socket *socket)
         int devfn;
         unsigned int state;
         int ret = 1;
+        u32 sysctl;
 
         /* catch the two-slot controllers */
         switch (socket->dev->device) {
@@ -640,6 +648,24 @@ static int ti12xx_2nd_slot_empty(struct yenta_socket *socket)
                  */
                 break;
 
+        case PCI_DEVICE_ID_TI_X515:
+        case PCI_DEVICE_ID_TI_X420:
+        case PCI_DEVICE_ID_TI_X620:
+        case PCI_DEVICE_ID_TI_XX21_XX11:
+        case PCI_DEVICE_ID_TI_7410:
+        case PCI_DEVICE_ID_TI_7610:
+                /*
+                 * those are either single or dual slot CB with additional functions
+                 * like 1394, smartcard reader, etc. check the TIEALL flag for them
+                 * the TIEALL flag binds the IRQ of all functions toghether.
+                 * we catch the single slot variants later.
+                 */
+                sysctl = config_readl(socket, TI113X_SYSTEM_CONTROL);
+                if (sysctl & TIXX21_SCR_TIEALL)
+                        return 0;
+
+                break;
+
         /* single-slot controllers have the 2nd slot empty always :) */
         default:
                 return 1;
@@ -652,6 +678,15 @@ static int ti12xx_2nd_slot_empty(struct yenta_socket *socket)
         if (!func)
                 return 1;
 
+        /*
+         * check that the device id of both slots match. this is needed for the
+         * XX21 and the XX11 controller that share the same device id for single
+         * and dual slot controllers. return '2nd slot empty'. we already checked
+         * if the interrupt is tied to another function.
+         */
+        if (socket->dev->device != func->device)
+                goto out;
+
         slot2 = pci_get_drvdata(func);
         if (!slot2)
                 goto out;
@@ -791,16 +826,6 @@ static int ti12xx_override(struct yenta_socket *socket)
                 config_writel(socket, TI113X_SYSTEM_CONTROL, val);
 
         /*
-         * for EnE bridges only: clear testbit TLTEnable. this makes the
-         * RME Hammerfall DSP sound card working.
-         */
-        if (socket->dev->vendor == PCI_VENDOR_ID_ENE) {
-                u8 test_c9 = config_readb(socket, ENE_TEST_C9);
-                test_c9 &= ~ENE_TEST_C9_TLTENABLE;
-                config_writeb(socket, ENE_TEST_C9, test_c9);
-        }
-
-        /*
          * Yenta expects controllers to use CSCINT to route
          * CSC interrupts to PCI rather than INTVAL.
          */
@@ -841,5 +866,75 @@ static int ti1250_override(struct yenta_socket *socket)
         return ti12xx_override(socket);
 }
 
+
+/**
+ * EnE specific part. EnE bridges are register compatible with TI bridges but
+ * have their own test registers and more important their own little problems.
+ * Some fixup code to make everybody happy (TM).
+ */
+
+/**
+ * set/clear various test bits:
+ * Defaults to clear the bit.
+ * - mask (u8) defines what bits to change
+ * - bits (u8) is the values to change them to
+ * -> it's
+ *      current = (current & ~mask) | bits
+ */
+/* pci ids of devices that wants to have the bit set */
+#define DEVID(_vend,_dev,_subvend,_subdev,mask,bits) {          \
+                .vendor         = _vend,                        \
+                .device         = _dev,                         \
+                .subvendor      = _subvend,                     \
+                .subdevice      = _subdev,                      \
+                .driver_data    = ((mask) << 8 | (bits)),       \
+        }
+static struct pci_device_id ene_tune_tbl[] = {
+        /* Echo Audio products based on motorola DSP56301 and DSP56361 */
+        DEVID(PCI_VENDOR_ID_MOTOROLA, 0x1801, 0xECC0, PCI_ANY_ID,
+                ENE_TEST_C9_TLTENABLE | ENE_TEST_C9_PFENABLE, ENE_TEST_C9_TLTENABLE),
+        DEVID(PCI_VENDOR_ID_MOTOROLA, 0x3410, 0xECC0, PCI_ANY_ID,
+                ENE_TEST_C9_TLTENABLE | ENE_TEST_C9_PFENABLE, ENE_TEST_C9_TLTENABLE),
+
+        {}
+};
+
+static void ene_tune_bridge(struct pcmcia_socket *sock, struct pci_bus *bus)
+{
+        struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
+        struct pci_dev *dev;
+        struct pci_device_id *id = NULL;
+        u8 test_c9, old_c9, mask, bits;
+
+        list_for_each_entry(dev, &bus->devices, bus_list) {
+                id = (struct pci_device_id *) pci_match_id(ene_tune_tbl, dev);
+                if (id)
+                        break;
+        }
+
+        test_c9 = old_c9 = config_readb(socket, ENE_TEST_C9);
+        if (id) {
+                mask = (id->driver_data >> 8) & 0xFF;
+                bits = id->driver_data & 0xFF;
+
+                test_c9 = (test_c9 & ~mask) | bits;
+        }
+        else
+                /* default to clear TLTEnable bit, old behaviour */
+                test_c9 &= ~ENE_TEST_C9_TLTENABLE;
+
+        printk(KERN_INFO "yenta EnE: chaning testregister 0xC9, %02x -> %02x\n", old_c9, test_c9);
+        config_writeb(socket, ENE_TEST_C9, test_c9);
+}
+
+
+static int ene_override(struct yenta_socket *socket)
+{
+        /* install tune_bridge() function */
+        socket->socket.tune_bridge = ene_tune_bridge;
+
+        return ti1250_override(socket);
+}
+
 #endif /* _LINUX_TI113X_H */
 
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index f0997c36c9b7..db9f952f9e3c 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -559,12 +559,6 @@ static void yenta_interrogate(struct yenta_socket *socket)
 static int yenta_sock_init(struct pcmcia_socket *sock)
 {
         struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
-        u16 bridge;
-
-        bridge = config_readw(socket, CB_BRIDGE_CONTROL) & ~CB_BRIDGE_INTR;
-        if (!socket->cb_irq)
-                bridge |= CB_BRIDGE_INTR;
-        config_writew(socket, CB_BRIDGE_CONTROL, bridge);
 
         exca_writeb(socket, I365_GBLCTL, 0x00);
         exca_writeb(socket, I365_GENCTL, 0x00);
@@ -819,6 +813,7 @@ enum {
         CARDBUS_TYPE_TOPIC95,
         CARDBUS_TYPE_TOPIC97,
         CARDBUS_TYPE_O2MICRO,
+        CARDBUS_TYPE_ENE,
 };
 
 /*
@@ -865,6 +860,12 @@ static struct cardbus_type cardbus_type[] = {
                 .override       = o2micro_override,
                 .restore_state  = o2micro_restore_state,
         },
+        [CARDBUS_TYPE_ENE]      = {
+                .override       = ene_override,
+                .save_state     = ti_save_state,
+                .restore_state  = ti_restore_state,
+                .sock_init      = ti_init,
+        },
 };
 
 
@@ -883,16 +884,8 @@ static unsigned int yenta_probe_irq(struct yenta_socket *socket, u32 isa_irq_mas
 {
         int i;
         unsigned long val;
-        u16 bridge_ctrl;
         u32 mask;
 
-        /* Set up ISA irq routing to probe the ISA irqs.. */
-        bridge_ctrl = config_readw(socket, CB_BRIDGE_CONTROL);
-        if (!(bridge_ctrl & CB_BRIDGE_INTR)) {
-                bridge_ctrl |= CB_BRIDGE_INTR;
-                config_writew(socket, CB_BRIDGE_CONTROL, bridge_ctrl);
-        }
-
         /*
          * Probe for usable interrupts using the force
          * register to generate bogus card status events.
@@ -914,9 +907,6 @@ static unsigned int yenta_probe_irq(struct yenta_socket *socket, u32 isa_irq_mas
 
         mask = probe_irq_mask(val) & 0xffff;
 
-        bridge_ctrl &= ~CB_BRIDGE_INTR;
-        config_writew(socket, CB_BRIDGE_CONTROL, bridge_ctrl);
-
         return mask;
 }
 
@@ -944,18 +934,11 @@ static irqreturn_t yenta_probe_handler(int irq, void *dev_id, struct pt_regs *re
 /* probes the PCI interrupt, use only on override functions */
 static int yenta_probe_cb_irq(struct yenta_socket *socket)
 {
-        u16 bridge_ctrl;
-
         if (!socket->cb_irq)
                 return -1;
 
         socket->probe_status = 0;
 
-        /* disable ISA interrupts */
-        bridge_ctrl = config_readw(socket, CB_BRIDGE_CONTROL);
-        bridge_ctrl &= ~CB_BRIDGE_INTR;
-        config_writew(socket, CB_BRIDGE_CONTROL, bridge_ctrl);
-
         if (request_irq(socket->cb_irq, yenta_probe_handler, SA_SHIRQ, "yenta", socket)) {
                 printk(KERN_WARNING "Yenta: request_irq() in yenta_probe_cb_irq() failed!\n");
                 return -1;
@@ -966,7 +949,7 @@ static int yenta_probe_cb_irq(struct yenta_socket *socket)
         cb_writel(socket, CB_SOCKET_EVENT, -1);
         cb_writel(socket, CB_SOCKET_MASK, CB_CSTSMASK);
         cb_writel(socket, CB_SOCKET_FORCE, CB_FCARDSTS);
-        
+
         msleep(100);
 
         /* disable interrupts */
@@ -1004,11 +987,12 @@ static void yenta_config_init(struct yenta_socket *socket)
 {
         u16 bridge;
         struct pci_dev *dev = socket->dev;
+        struct pci_bus_region region;
 
-        pci_set_power_state(socket->dev, 0);
+        pcibios_resource_to_bus(socket->dev, &region, &dev->resource[0]);
 
         config_writel(socket, CB_LEGACY_MODE_BASE, 0);
-        config_writel(socket, PCI_BASE_ADDRESS_0, dev->resource[0].start);
+        config_writel(socket, PCI_BASE_ADDRESS_0, region.start);
         config_writew(socket, PCI_COMMAND,
                         PCI_COMMAND_IO |
                         PCI_COMMAND_MEMORY |
@@ -1031,8 +1015,8 @@ static void yenta_config_init(struct yenta_socket *socket)
          *  - PCI interrupts enabled if a PCI interrupt exists..
          */
         bridge = config_readw(socket, CB_BRIDGE_CONTROL);
-        bridge &= ~(CB_BRIDGE_CRST | CB_BRIDGE_PREFETCH1 | CB_BRIDGE_INTR | CB_BRIDGE_ISAEN | CB_BRIDGE_VGAEN);
-        bridge |= CB_BRIDGE_PREFETCH0 | CB_BRIDGE_POSTEN | CB_BRIDGE_INTR;
+        bridge &= ~(CB_BRIDGE_CRST | CB_BRIDGE_PREFETCH1 | CB_BRIDGE_ISAEN | CB_BRIDGE_VGAEN);
+        bridge |= CB_BRIDGE_PREFETCH0 | CB_BRIDGE_POSTEN;
         config_writew(socket, CB_BRIDGE_CONTROL, bridge);
 }
 
@@ -1045,7 +1029,18 @@ static int __devinit yenta_probe (struct pci_dev *dev, const struct pci_device_i
 {
         struct yenta_socket *socket;
         int ret;
-        
+
+        /*
+         * If we failed to assign proper bus numbers for this cardbus
+         * controller during PCI probe, its subordinate pci_bus is NULL.
+         * Bail out if so.
+         */
+        if (!dev->subordinate) {
+                printk(KERN_ERR "Yenta: no bus associated with %s! "
+                        "(try 'pci=assign-busses')\n", pci_name(dev));
+                return -ENODEV;
+        }
+
         socket = kmalloc(sizeof(struct yenta_socket), GFP_KERNEL);
         if (!socket)
                 return -ENOMEM;
@@ -1254,10 +1249,22 @@ static struct pci_device_id yenta_table [] = {
         CB_ID(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_1250, TI1250),
         CB_ID(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_1410, TI1250),
 
-        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_1211, TI12XX),
-        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_1225, TI12XX),
-        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_1410, TI1250),
-        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_1420, TI12XX),
+        CB_ID(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_XX21_XX11, TI12XX),
+        CB_ID(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_X515, TI12XX),
+        CB_ID(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_X420, TI12XX),
+        CB_ID(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_X620, TI12XX),
+        CB_ID(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_7410, TI12XX),
+        CB_ID(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_7510, TI12XX),
+        CB_ID(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_7610, TI12XX),
+
+        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_710, TI12XX),
+        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_712, TI12XX),
+        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_720, TI12XX),
+        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_722, TI12XX),
+        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_1211, ENE),
+        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_1225, ENE),
+        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_1410, ENE),
+        CB_ID(PCI_VENDOR_ID_ENE, PCI_DEVICE_ID_ENE_1420, ENE),
 
         CB_ID(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_RL5C465, RICOH),
         CB_ID(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_RL5C466, RICOH),
diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c
index aac83ce6469c..a1c52a682191 100644
--- a/drivers/s390/cio/blacklist.c
+++ b/drivers/s390/cio/blacklist.c
@@ -1,7 +1,7 @@
 /*
  *  drivers/s390/cio/blacklist.c
  *   S/390 common I/O routines -- blacklisting of specific devices
- *   $Revision: 1.34 $
+ *   $Revision: 1.35 $
  *
  *    Copyright (C) 1999-2002 IBM Deutschland Entwicklung GmbH,
  *                            IBM Corporation
@@ -35,7 +35,7 @@
  */
 
 /* 65536 bits to indicate if a devno is blacklisted or not */
-#define __BL_DEV_WORDS (__MAX_SUBCHANNELS + (8*sizeof(long) - 1) / \
+#define __BL_DEV_WORDS ((__MAX_SUBCHANNELS + (8*sizeof(long) - 1)) / \
                          (8*sizeof(long)))
 static unsigned long bl_dev[__BL_DEV_WORDS];
 typedef enum {add, free} range_action;
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index 91ea8e4777f3..dbb3eb0e330b 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -437,7 +437,7 @@ __ccwgroup_get_gdev_by_cdev(struct ccw_device *cdev)
         if (cdev->dev.driver_data) {
                 gdev = (struct ccwgroup_device *)cdev->dev.driver_data;
                 if (get_device(&gdev->dev)) {
-                        if (klist_node_attached(&gdev->dev.knode_bus))
+                        if (device_is_registered(&gdev->dev))
                                 return gdev;
                         put_device(&gdev->dev);
                 }
diff --git a/drivers/s390/crypto/z90main.c b/drivers/s390/crypto/z90main.c
index 6aeef3bacc33..0cb47eca91f3 100644
--- a/drivers/s390/crypto/z90main.c
+++ b/drivers/s390/crypto/z90main.c
@@ -682,9 +682,6 @@ z90crypt_cleanup_module(void)
         del_timer(&config_timer);
         del_timer(&cleanup_timer);
 
-        if (z90_device_work)
-                destroy_workqueue(z90_device_work);
-
         destroy_z90crypt();
 
         PRINTKN("Unloaded.\n");
diff --git a/drivers/s390/net/ctcmain.c b/drivers/s390/net/ctcmain.c
index 96ca863eaff2..0db4f57a6a95 100644
--- a/drivers/s390/net/ctcmain.c
+++ b/drivers/s390/net/ctcmain.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ctcmain.c,v 1.74 2005/03/24 09:04:17 mschwide Exp $
+ * $Id: ctcmain.c,v 1.78 2005/09/07 12:18:02 pavlic Exp $
  *
  * CTC / ESCON network driver
  *
@@ -37,10 +37,9 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * RELEASE-TAG: CTC/ESCON network driver $Revision: 1.74 $
+ * RELEASE-TAG: CTC/ESCON network driver $Revision: 1.78 $
  *
  */
-
 #undef DEBUG
 #include <linux/module.h>
 #include <linux/init.h>
@@ -135,7 +134,7 @@ static const char *dev_event_names[] = {
         "TX down",
         "Restart",
 };
-
+
 /**
  * Events of the channel statemachine
  */
@@ -249,7 +248,7 @@ static void
 print_banner(void)
 {
         static int printed = 0;
-        char vbuf[] = "$Revision: 1.74 $";
+        char vbuf[] = "$Revision: 1.78 $";
         char *version = vbuf;
 
         if (printed)
@@ -334,7 +333,7 @@ static const char *ch_state_names[] = {
         "Restarting",
         "Not operational",
 };
-
+
 #ifdef DEBUG
 /**
  * Dump header and first 16 bytes of an sk_buff for debugging purposes.
@@ -671,7 +670,7 @@ static void
 fsm_action_nop(fsm_instance * fi, int event, void *arg)
 {
 }
-
+
 /**
  * Actions for channel - statemachines.
  *****************************************************************************/
@@ -1514,7 +1513,6 @@ ch_action_reinit(fsm_instance *fi, int event, void *arg)
         fsm_addtimer(&privptr->restart_timer, 1000, DEV_EVENT_RESTART, dev);
 }
 
-
 /**
  * The statemachine for a channel.
  */
@@ -1625,7 +1623,7 @@ static const fsm_node ch_fsm[] = {
 };
 
 static const int CH_FSM_LEN = sizeof (ch_fsm) / sizeof (fsm_node);
-
+
 /**
  * Functions related to setup and device detection.
  *****************************************************************************/
@@ -1976,7 +1974,7 @@ ctc_irq_handler(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
                 fsm_event(ch->fsm, CH_EVENT_IRQ, ch);
 
 }
-
+
 /**
  * Actions for interface - statemachine.
  *****************************************************************************/
@@ -2209,13 +2207,18 @@ transmit_skb(struct channel *ch, struct sk_buff *skb)
         int rc = 0;
 
         DBF_TEXT(trace, 5, __FUNCTION__);
+        /* we need to acquire the lock for testing the state
+         * otherwise we can have an IRQ changing the state to 
+         * TXIDLE after the test but before acquiring the lock.
+         */
+        spin_lock_irqsave(&ch->collect_lock, saveflags);
         if (fsm_getstate(ch->fsm) != CH_STATE_TXIDLE) {
                 int l = skb->len + LL_HEADER_LENGTH;
 
-                spin_lock_irqsave(&ch->collect_lock, saveflags);
-                if (ch->collect_len + l > ch->max_bufsize - 2)
-                        rc = -EBUSY;
-                else {
+                if (ch->collect_len + l > ch->max_bufsize - 2) {
+                        spin_unlock_irqrestore(&ch->collect_lock, saveflags);
+                        return -EBUSY;
+                } else {
                         atomic_inc(&skb->users);
                         header.length = l;
                         header.type = skb->protocol;
@@ -2231,7 +2234,7 @@ transmit_skb(struct channel *ch, struct sk_buff *skb)
                 int ccw_idx;
                 struct sk_buff *nskb;
                 unsigned long hi;
-
+                spin_unlock_irqrestore(&ch->collect_lock, saveflags);
                 /**
                  * Protect skb against beeing free'd by upper
                  * layers.
@@ -2256,6 +2259,7 @@ transmit_skb(struct channel *ch, struct sk_buff *skb)
                         if (!nskb) {
                                 atomic_dec(&skb->users);
                                 skb_pull(skb, LL_HEADER_LENGTH + 2);
+                                ctc_clear_busy(ch->netdev);
                                 return -ENOMEM;
                         } else {
                                 memcpy(skb_put(nskb, skb->len),
@@ -2281,6 +2285,7 @@ transmit_skb(struct channel *ch, struct sk_buff *skb)
                                  */
                                 atomic_dec(&skb->users);
                                 skb_pull(skb, LL_HEADER_LENGTH + 2);
+                                ctc_clear_busy(ch->netdev);
                                 return -EBUSY;
                         }
 
@@ -2327,9 +2332,10 @@ transmit_skb(struct channel *ch, struct sk_buff *skb)
                 }
         }
 
+        ctc_clear_busy(ch->netdev);
         return rc;
 }
-
+
 /**
  * Interface API for upper network layers
  *****************************************************************************/
@@ -2421,7 +2427,6 @@ ctc_tx(struct sk_buff *skb, struct net_device * dev)
         dev->trans_start = jiffies;
         if (transmit_skb(privptr->channel[WRITE], skb) != 0)
                 rc = 1;
-        ctc_clear_busy(dev);
         return rc;
 }
 
@@ -2610,7 +2615,6 @@ stats_write(struct device *dev, struct device_attribute *attr, const char *buf,
         return count;
 }
 
-
 static void
 ctc_netdev_unregister(struct net_device * dev)
 {
@@ -2685,7 +2689,6 @@ ctc_proto_store(struct device *dev, struct device_attribute *attr, const char *b
         return count;
 }
 
-
 static ssize_t
 ctc_type_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index 3a0285669adf..2ad4797ce024 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -24,7 +24,7 @@
 
 #include "qeth_mpc.h"
 
-#define VERSION_QETH_H          "$Revision: 1.139 $"
+#define VERSION_QETH_H          "$Revision: 1.142 $"
 
 #ifdef CONFIG_QETH_IPV6
 #define QETH_VERSION_IPV6       ":IPv6"
@@ -1172,7 +1172,7 @@ extern int
 qeth_realloc_buffer_pool(struct qeth_card *, int);
 
 extern int
-qeth_set_large_send(struct qeth_card *);
+qeth_set_large_send(struct qeth_card *, enum qeth_large_send_types);
 
 extern void
 qeth_fill_header(struct qeth_card *, struct qeth_hdr *,
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 79c74f3a11f5..71de834ece1a 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -1,6 +1,6 @@
 /*
  *
- * linux/drivers/s390/net/qeth_main.c ($Revision: 1.214 $)
+ * linux/drivers/s390/net/qeth_main.c ($Revision: 1.224 $)
  *
  * Linux on zSeries OSA Express and HiperSockets support
  *
@@ -12,7 +12,7 @@
  *                        Frank Pavlic (pavlic@de.ibm.com) and
  *                        Thomas Spatzier <tspat@de.ibm.com>
  *
- *    $Revision: 1.214 $         $Date: 2005/05/04 20:19:18 $
+ *    $Revision: 1.224 $         $Date: 2005/05/04 20:19:18 $
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -29,14 +29,6 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
-/***
- * eye catcher; just for debugging purposes
- */
-void volatile
-qeth_eyecatcher(void)
-{
-        return;
-}
 
 #include <linux/config.h>
 #include <linux/module.h>
@@ -80,7 +72,7 @@ qeth_eyecatcher(void)
 #include "qeth_eddp.h"
 #include "qeth_tso.h"
 
-#define VERSION_QETH_C "$Revision: 1.214 $"
+#define VERSION_QETH_C "$Revision: 1.224 $"
 static const char *version = "qeth S/390 OSA-Express driver";
 
 /**
@@ -2759,11 +2751,9 @@ qeth_flush_buffers(struct qeth_qdio_out_q *queue, int under_int,
                 queue->card->perf_stats.outbound_do_qdio_start_time;
 #endif
         if (rc){
-                QETH_DBF_SPRINTF(trace, 0, "qeth_flush_buffers: do_QDIO "
-                                 "returned error (%i) on device %s.",
-                                 rc, CARD_DDEV_ID(queue->card));
                 QETH_DBF_TEXT(trace, 2, "flushbuf");
                 QETH_DBF_TEXT_(trace, 2, " err%d", rc);
+                QETH_DBF_TEXT_(trace, 2, "%s", CARD_DDEV_ID(queue->card));
                 queue->card->stats.tx_errors += count;
                 /* this must not happen under normal circumstances. if it
                  * happens something is really wrong -> recover */
@@ -2909,11 +2899,8 @@ qeth_qdio_output_handler(struct ccw_device * ccwdev, unsigned int status,
         QETH_DBF_TEXT(trace, 6, "qdouhdl");
         if (status & QDIO_STATUS_LOOK_FOR_ERROR) {
                 if (status & QDIO_STATUS_ACTIVATE_CHECK_CONDITION){
-                        QETH_DBF_SPRINTF(trace, 2, "On device %s: "
-                                         "received active check "
-                                         "condition (0x%08x).",
-                                         CARD_BUS_ID(card), status);
-                        QETH_DBF_TEXT(trace, 2, "chkcond");
+                        QETH_DBF_TEXT(trace, 2, "achkcond");
+                        QETH_DBF_TEXT_(trace, 2, "%s", CARD_BUS_ID(card));
                         QETH_DBF_TEXT_(trace, 2, "%08x", status);
                         netif_stop_queue(card->dev);
                         qeth_schedule_recovery(card);
@@ -3356,26 +3343,32 @@ qeth_halt_channel(struct qeth_channel *channel)
 static int
 qeth_halt_channels(struct qeth_card *card)
 {
-        int rc = 0;
+        int rc1 = 0, rc2=0, rc3 = 0;
 
         QETH_DBF_TEXT(trace,3,"haltchs");
-        if ((rc = qeth_halt_channel(&card->read)))
-                return rc;
-        if ((rc = qeth_halt_channel(&card->write)))
-                return rc;
-        return  qeth_halt_channel(&card->data);
+        rc1 = qeth_halt_channel(&card->read);
+        rc2 = qeth_halt_channel(&card->write);
+        rc3 = qeth_halt_channel(&card->data);
+        if (rc1)
+                return rc1;
+        if (rc2) 
+                return rc2;
+        return rc3;
 }
 static int
 qeth_clear_channels(struct qeth_card *card)
 {
-        int rc = 0;
+        int rc1 = 0, rc2=0, rc3 = 0;
 
         QETH_DBF_TEXT(trace,3,"clearchs");
-        if ((rc = qeth_clear_channel(&card->read)))
-                return rc;
-        if ((rc = qeth_clear_channel(&card->write)))
-                return rc;
-        return  qeth_clear_channel(&card->data);
+        rc1 = qeth_clear_channel(&card->read);
+        rc2 = qeth_clear_channel(&card->write);
+        rc3 = qeth_clear_channel(&card->data);
+        if (rc1)
+                return rc1;
+        if (rc2) 
+                return rc2;
+        return rc3;
 }
 
 static int
@@ -3445,23 +3438,23 @@ qeth_mpc_initialize(struct qeth_card *card)
         }
         if ((rc = qeth_cm_enable(card))){
                 QETH_DBF_TEXT_(setup, 2, "2err%d", rc);
-                return rc;
+                goto out_qdio;
         }
         if ((rc = qeth_cm_setup(card))){
                 QETH_DBF_TEXT_(setup, 2, "3err%d", rc);
-                return rc;
+                goto out_qdio;
         }
         if ((rc = qeth_ulp_enable(card))){
                 QETH_DBF_TEXT_(setup, 2, "4err%d", rc);
-                return rc;
+                goto out_qdio;
         }
         if ((rc = qeth_ulp_setup(card))){
                 QETH_DBF_TEXT_(setup, 2, "5err%d", rc);
-                return rc;
+                goto out_qdio;
         }
         if ((rc = qeth_alloc_qdio_buffers(card))){
                 QETH_DBF_TEXT_(setup, 2, "5err%d", rc);
-                return rc;
+                goto out_qdio;
         }
         if ((rc = qeth_qdio_establish(card))){
                 QETH_DBF_TEXT_(setup, 2, "6err%d", rc);
@@ -3795,12 +3788,16 @@ static inline int
 qeth_prepare_skb(struct qeth_card *card, struct sk_buff **skb,
                  struct qeth_hdr **hdr, int ipv)
 {
+        int rc;
 #ifdef CONFIG_QETH_VLAN
         u16 *tag;
 #endif
 
         QETH_DBF_TEXT(trace, 6, "prepskb");
 
+        rc = qeth_realloc_headroom(card, skb, sizeof(struct qeth_hdr));
+        if (rc)
+                return rc;
 #ifdef CONFIG_QETH_VLAN
         if (card->vlangrp && vlan_tx_tag_present(*skb) &&
             ((ipv == 6) || card->options.layer2) ) {
@@ -4251,7 +4248,8 @@ out:
 }
 
 static inline int
-qeth_get_elements_no(struct qeth_card *card, void *hdr, struct sk_buff *skb)
+qeth_get_elements_no(struct qeth_card *card, void *hdr, 
+                     struct sk_buff *skb, int elems)
 {
         int elements_needed = 0;
 
@@ -4261,9 +4259,10 @@ qeth_get_elements_no(struct qeth_card *card, void *hdr, struct sk_buff *skb)
         if (elements_needed == 0 )
                 elements_needed = 1 + (((((unsigned long) hdr) % PAGE_SIZE)
                                         + skb->len) >> PAGE_SHIFT);
-        if (elements_needed > QETH_MAX_BUFFER_ELEMENTS(card)){
+        if ((elements_needed + elems) > QETH_MAX_BUFFER_ELEMENTS(card)){
                 PRINT_ERR("qeth_do_send_packet: invalid size of "
-                          "IP packet. Discarded.");
+                          "IP packet (Number=%d / Length=%d). Discarded.\n",
+                          (elements_needed+elems), skb->len);
                 return 0;
         }
         return elements_needed;
@@ -4275,7 +4274,7 @@ qeth_send_packet(struct qeth_card *card, struct sk_buff *skb)
         int ipv = 0;
         int cast_type;
         struct qeth_qdio_out_q *queue;
-        struct qeth_hdr *hdr;
+        struct qeth_hdr *hdr = NULL;
         int elements_needed = 0;
         enum qeth_large_send_types large_send = QETH_LARGE_SEND_NO;
         struct qeth_eddp_context *ctx = NULL;
@@ -4337,9 +4336,11 @@ qeth_send_packet(struct qeth_card *card, struct sk_buff *skb)
                         return -EINVAL;
                 }
         } else {
-                elements_needed += qeth_get_elements_no(card,(void*) hdr, skb);
-                if (!elements_needed)
+                int elems = qeth_get_elements_no(card,(void*) hdr, skb,
+                                                 elements_needed);
+                if (!elems)
                         return -EINVAL;
+                elements_needed += elems;
         }
 
         if (card->info.type != QETH_CARD_TYPE_IQD)
@@ -4504,7 +4505,11 @@ qeth_arp_set_no_entries(struct qeth_card *card, int no_entries)
 
         QETH_DBF_TEXT(trace,3,"arpstnoe");
 
-        /* TODO: really not supported by GuestLAN? */
+        /*
+         * currently GuestLAN only supports the ARP assist function
+         * IPA_CMD_ASS_ARP_QUERY_INFO, but not IPA_CMD_ASS_ARP_SET_NO_ENTRIES;
+         * thus we say EOPNOTSUPP for this ARP function
+         */
         if (card->info.guestlan)
                 return -EOPNOTSUPP;
         if (!qeth_is_supported(card,IPA_ARP_PROCESSING)) {
@@ -4681,14 +4686,6 @@ qeth_arp_query(struct qeth_card *card, char *udata)
 
         QETH_DBF_TEXT(trace,3,"arpquery");
 
-        /*
-         * currently GuestLAN  does only deliver all zeros on query arp,
-         * even though arp processing is supported (according to IPA supp.
-         * funcs flags); since all zeros is no valueable information,
-         * we say EOPNOTSUPP for all ARP functions
-         */
-        /*if (card->info.guestlan)
-                return -EOPNOTSUPP; */
         if (!qeth_is_supported(card,/*IPA_QUERY_ARP_ADDR_INFO*/
                                IPA_ARP_PROCESSING)) {
                 PRINT_WARN("ARP processing not supported "
@@ -4894,10 +4891,9 @@ qeth_arp_add_entry(struct qeth_card *card, struct qeth_arp_cache_entry *entry)
         QETH_DBF_TEXT(trace,3,"arpadent");
 
         /*
-         * currently GuestLAN  does only deliver all zeros on query arp,
-         * even though arp processing is supported (according to IPA supp.
-         * funcs flags); since all zeros is no valueable information,
-         * we say EOPNOTSUPP for all ARP functions
+         * currently GuestLAN only supports the ARP assist function
+         * IPA_CMD_ASS_ARP_QUERY_INFO, but not IPA_CMD_ASS_ARP_ADD_ENTRY;
+         * thus we say EOPNOTSUPP for this ARP function
          */
         if (card->info.guestlan)
                 return -EOPNOTSUPP;
@@ -4937,10 +4933,9 @@ qeth_arp_remove_entry(struct qeth_card *card, struct qeth_arp_cache_entry *entry
         QETH_DBF_TEXT(trace,3,"arprment");
 
         /*
-         * currently GuestLAN  does only deliver all zeros on query arp,
-         * even though arp processing is supported (according to IPA supp.
-         * funcs flags); since all zeros is no valueable information,
-         * we say EOPNOTSUPP for all ARP functions
+         * currently GuestLAN only supports the ARP assist function
+         * IPA_CMD_ASS_ARP_QUERY_INFO, but not IPA_CMD_ASS_ARP_REMOVE_ENTRY;
+         * thus we say EOPNOTSUPP for this ARP function
          */
         if (card->info.guestlan)
                 return -EOPNOTSUPP;
@@ -4978,11 +4973,10 @@ qeth_arp_flush_cache(struct qeth_card *card)
         QETH_DBF_TEXT(trace,3,"arpflush");
 
         /*
-         * currently GuestLAN  does only deliver all zeros on query arp,
-         * even though arp processing is supported (according to IPA supp.
-         * funcs flags); since all zeros is no valueable information,
-         * we say EOPNOTSUPP for all ARP functions
-         */
+         * currently GuestLAN only supports the ARP assist function
+         * IPA_CMD_ASS_ARP_QUERY_INFO, but not IPA_CMD_ASS_ARP_FLUSH_CACHE;
+         * thus we say EOPNOTSUPP for this ARP function
+        */
         if (card->info.guestlan || (card->info.type == QETH_CARD_TYPE_IQD))
                 return -EOPNOTSUPP;
         if (!qeth_is_supported(card,IPA_ARP_PROCESSING)) {
@@ -5206,7 +5200,7 @@ qeth_free_vlan_addresses4(struct qeth_card *card, unsigned short vid)
         if (!card->vlangrp)
                 return;
         rcu_read_lock();
-        in_dev = __in_dev_get(card->vlangrp->vlan_devices[vid]);
+        in_dev = __in_dev_get_rcu(card->vlangrp->vlan_devices[vid]);
         if (!in_dev)
                 goto out;
         for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
@@ -7038,14 +7032,16 @@ qeth_setrouting_v6(struct qeth_card *card)
 }
 
 int
-qeth_set_large_send(struct qeth_card *card)
+qeth_set_large_send(struct qeth_card *card, enum qeth_large_send_types type)
 {
         int rc = 0;
 
-        if (card->dev == NULL)
+        if (card->dev == NULL) {
+                card->options.large_send = type;
                 return 0;
-
+        }
         netif_stop_queue(card->dev);
+        card->options.large_send = type;
         switch (card->options.large_send) {
         case QETH_LARGE_SEND_EDDP:
                 card->dev->features |= NETIF_F_TSO | NETIF_F_SG;
@@ -7066,7 +7062,6 @@ qeth_set_large_send(struct qeth_card *card)
                 card->dev->features &= ~(NETIF_F_TSO | NETIF_F_SG);
                 break;
         }
-
         netif_wake_queue(card->dev);
         return rc;
 }
@@ -7730,7 +7725,7 @@ qeth_arp_constructor(struct neighbour *neigh)
                 goto out;
 
         rcu_read_lock();
-        in_dev = rcu_dereference(__in_dev_get(dev));
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev == NULL) {
                 rcu_read_unlock();
                 return -EINVAL;
@@ -8257,7 +8252,6 @@ qeth_init(void)
 {
         int rc=0;
 
-        qeth_eyecatcher();
         PRINT_INFO("loading %s (%s/%s/%s/%s/%s/%s/%s %s %s)\n",
                    version, VERSION_QETH_C, VERSION_QETH_H,
                    VERSION_QETH_MPC_H, VERSION_QETH_MPC_C,
@@ -8338,7 +8332,6 @@ again:
         printk("qeth: removed\n");
 }
 
-EXPORT_SYMBOL(qeth_eyecatcher);
 module_init(qeth_init);
 module_exit(qeth_exit);
 MODULE_AUTHOR("Frank Pavlic <pavlic@de.ibm.com>");
diff --git a/drivers/s390/net/qeth_sys.c b/drivers/s390/net/qeth_sys.c
index 98bedb0cb387..dda105b73063 100644
--- a/drivers/s390/net/qeth_sys.c
+++ b/drivers/s390/net/qeth_sys.c
@@ -1,6 +1,6 @@
 /*
  *
- * linux/drivers/s390/net/qeth_sys.c ($Revision: 1.51 $)
+ * linux/drivers/s390/net/qeth_sys.c ($Revision: 1.54 $)
  *
  * Linux on zSeries OSA Express and HiperSockets support
  * This file contains code related to sysfs.
@@ -20,7 +20,7 @@
 #include "qeth_mpc.h"
 #include "qeth_fs.h"
 
-const char *VERSION_QETH_SYS_C = "$Revision: 1.51 $";
+const char *VERSION_QETH_SYS_C = "$Revision: 1.54 $";
 
 /*****************************************************************************/
 /*                                                                           */
@@ -722,10 +722,13 @@ qeth_dev_layer2_store(struct device *dev, struct device_attribute *attr, const c
 
         if (!card)
                 return -EINVAL;
+        if (card->info.type == QETH_CARD_TYPE_IQD) {
+                PRINT_WARN("Layer2 on Hipersockets is not supported! \n");
+                return -EPERM;
+        }
 
         if (((card->state != CARD_STATE_DOWN) &&
-             (card->state != CARD_STATE_RECOVER)) ||
-            (card->info.type != QETH_CARD_TYPE_OSAE))
+             (card->state != CARD_STATE_RECOVER)))
                 return -EPERM;
 
         i = simple_strtoul(buf, &tmp, 16);
@@ -771,9 +774,7 @@ qeth_dev_large_send_store(struct device *dev, struct device_attribute *attr, con
 
         if (!card)
                 return -EINVAL;
-
         tmp = strsep((char **) &buf, "\n");
-
         if (!strcmp(tmp, "no")){
                 type = QETH_LARGE_SEND_NO;
         } else if (!strcmp(tmp, "EDDP")) {
@@ -786,10 +787,8 @@ qeth_dev_large_send_store(struct device *dev, struct device_attribute *attr, con
         }
         if (card->options.large_send == type)
                 return count;
-        card->options.large_send = type;
-        if ((rc = qeth_set_large_send(card)))
+        if ((rc = qeth_set_large_send(card, type)))     
                 return rc;
-
         return count;
 }
 
diff --git a/drivers/s390/scsi/Makefile b/drivers/s390/scsi/Makefile
index fc145307a7d4..d6a78f1a2f16 100644
--- a/drivers/s390/scsi/Makefile
+++ b/drivers/s390/scsi/Makefile
@@ -3,7 +3,7 @@
 #
 
 zfcp-objs := zfcp_aux.o zfcp_ccw.o zfcp_scsi.o zfcp_erp.o zfcp_qdio.o \
-             zfcp_fsf.o zfcp_sysfs_adapter.o zfcp_sysfs_port.o \
+             zfcp_fsf.o zfcp_dbf.o zfcp_sysfs_adapter.o zfcp_sysfs_port.o \
              zfcp_sysfs_unit.o zfcp_sysfs_driver.o
 
 obj-$(CONFIG_ZFCP) += zfcp.o
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index bfe3ba73bc0f..0b5087f7cabc 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -122,95 +122,6 @@ _zfcp_hex_dump(char *addr, int count)
 
 #define ZFCP_LOG_AREA                   ZFCP_LOG_AREA_OTHER
 
-static inline int
-zfcp_fsf_req_is_scsi_cmnd(struct zfcp_fsf_req *fsf_req)
-{
-        return ((fsf_req->fsf_command == FSF_QTCB_FCP_CMND) &&
-                !(fsf_req->status & ZFCP_STATUS_FSFREQ_TASK_MANAGEMENT));
-}
-
-void
-zfcp_cmd_dbf_event_fsf(const char *text, struct zfcp_fsf_req *fsf_req,
-                       void *add_data, int add_length)
-{
-        struct zfcp_adapter *adapter = fsf_req->adapter;
-        struct scsi_cmnd *scsi_cmnd;
-        int level = 3;
-        int i;
-        unsigned long flags;
-
-        spin_lock_irqsave(&adapter->dbf_lock, flags);
-        if (zfcp_fsf_req_is_scsi_cmnd(fsf_req)) {
-                scsi_cmnd = fsf_req->data.send_fcp_command_task.scsi_cmnd;
-                debug_text_event(adapter->cmd_dbf, level, "fsferror");
-                debug_text_event(adapter->cmd_dbf, level, text);
-                debug_event(adapter->cmd_dbf, level, &fsf_req,
-                            sizeof (unsigned long));
-                debug_event(adapter->cmd_dbf, level, &fsf_req->seq_no,
-                            sizeof (u32));
-                debug_event(adapter->cmd_dbf, level, &scsi_cmnd,
-                            sizeof (unsigned long));
-                debug_event(adapter->cmd_dbf, level, &scsi_cmnd->cmnd,
-                            min(ZFCP_CMD_DBF_LENGTH, (int)scsi_cmnd->cmd_len));
-                for (i = 0; i < add_length; i += ZFCP_CMD_DBF_LENGTH)
-                        debug_event(adapter->cmd_dbf,
-                                    level,
-                                    (char *) add_data + i,
-                                    min(ZFCP_CMD_DBF_LENGTH, add_length - i));
-        }
-        spin_unlock_irqrestore(&adapter->dbf_lock, flags);
-}
-
-/* XXX additionally log unit if available */
-/* ---> introduce new parameter for unit, see 2.4 code */
-void
-zfcp_cmd_dbf_event_scsi(const char *text, struct scsi_cmnd *scsi_cmnd)
-{
-        struct zfcp_adapter *adapter;
-        union zfcp_req_data *req_data;
-        struct zfcp_fsf_req *fsf_req;
-        int level = ((host_byte(scsi_cmnd->result) != 0) ? 1 : 5);
-        unsigned long flags;
-
-        adapter = (struct zfcp_adapter *) scsi_cmnd->device->host->hostdata[0];
-        req_data = (union zfcp_req_data *) scsi_cmnd->host_scribble;
-        fsf_req = (req_data ? req_data->send_fcp_command_task.fsf_req : NULL);
-        spin_lock_irqsave(&adapter->dbf_lock, flags);
-        debug_text_event(adapter->cmd_dbf, level, "hostbyte");
-        debug_text_event(adapter->cmd_dbf, level, text);
-        debug_event(adapter->cmd_dbf, level, &scsi_cmnd->result, sizeof (u32));
-        debug_event(adapter->cmd_dbf, level, &scsi_cmnd,
-                    sizeof (unsigned long));
-        debug_event(adapter->cmd_dbf, level, &scsi_cmnd->cmnd,
-                    min(ZFCP_CMD_DBF_LENGTH, (int)scsi_cmnd->cmd_len));
-        if (likely(fsf_req)) {
-                debug_event(adapter->cmd_dbf, level, &fsf_req,
-                            sizeof (unsigned long));
-                debug_event(adapter->cmd_dbf, level, &fsf_req->seq_no,
-                            sizeof (u32));
-        } else {
-                debug_text_event(adapter->cmd_dbf, level, "");
-                debug_text_event(adapter->cmd_dbf, level, "");
-        }
-        spin_unlock_irqrestore(&adapter->dbf_lock, flags);
-}
-
-void
-zfcp_in_els_dbf_event(struct zfcp_adapter *adapter, const char *text,
-                      struct fsf_status_read_buffer *status_buffer, int length)
-{
-        int level = 1;
-        int i;
-
-        debug_text_event(adapter->in_els_dbf, level, text);
-        debug_event(adapter->in_els_dbf, level, &status_buffer->d_id, 8);
-        for (i = 0; i < length; i += ZFCP_IN_ELS_DBF_LENGTH)
-                debug_event(adapter->in_els_dbf,
-                            level,
-                            (char *) status_buffer->payload + i,
-                            min(ZFCP_IN_ELS_DBF_LENGTH, length - i));
-}
-
 /**
  * zfcp_device_setup - setup function
  * @str: pointer to parameter string
@@ -1017,81 +928,6 @@ zfcp_free_low_mem_buffers(struct zfcp_adapter *adapter)
                 mempool_destroy(adapter->pool.data_gid_pn);
 }
 
-/**
- * zfcp_adapter_debug_register - registers debug feature for an adapter
- * @adapter: pointer to adapter for which debug features should be registered
- * return: -ENOMEM on error, 0 otherwise
- */
-int
-zfcp_adapter_debug_register(struct zfcp_adapter *adapter)
-{
-        char dbf_name[20];
-
-        /* debug feature area which records SCSI command failures (hostbyte) */
-        spin_lock_init(&adapter->dbf_lock);
-
-        sprintf(dbf_name, ZFCP_CMD_DBF_NAME "%s",
-                zfcp_get_busid_by_adapter(adapter));
-        adapter->cmd_dbf = debug_register(dbf_name, ZFCP_CMD_DBF_INDEX,
-                                          ZFCP_CMD_DBF_AREAS,
-                                          ZFCP_CMD_DBF_LENGTH);
-        debug_register_view(adapter->cmd_dbf, &debug_hex_ascii_view);
-        debug_set_level(adapter->cmd_dbf, ZFCP_CMD_DBF_LEVEL);
-
-        /* debug feature area which records SCSI command aborts */
-        sprintf(dbf_name, ZFCP_ABORT_DBF_NAME "%s",
-                zfcp_get_busid_by_adapter(adapter));
-        adapter->abort_dbf = debug_register(dbf_name, ZFCP_ABORT_DBF_INDEX,
-                                            ZFCP_ABORT_DBF_AREAS,
-                                            ZFCP_ABORT_DBF_LENGTH);
-        debug_register_view(adapter->abort_dbf, &debug_hex_ascii_view);
-        debug_set_level(adapter->abort_dbf, ZFCP_ABORT_DBF_LEVEL);
-
-        /* debug feature area which records incoming ELS commands */
-        sprintf(dbf_name, ZFCP_IN_ELS_DBF_NAME "%s",
-                zfcp_get_busid_by_adapter(adapter));
-        adapter->in_els_dbf = debug_register(dbf_name, ZFCP_IN_ELS_DBF_INDEX,
-                                             ZFCP_IN_ELS_DBF_AREAS,
-                                             ZFCP_IN_ELS_DBF_LENGTH);
-        debug_register_view(adapter->in_els_dbf, &debug_hex_ascii_view);
-        debug_set_level(adapter->in_els_dbf, ZFCP_IN_ELS_DBF_LEVEL);
-
-        /* debug feature area which records erp events */
-        sprintf(dbf_name, ZFCP_ERP_DBF_NAME "%s",
-                zfcp_get_busid_by_adapter(adapter));
-        adapter->erp_dbf = debug_register(dbf_name, ZFCP_ERP_DBF_INDEX,
-                                          ZFCP_ERP_DBF_AREAS,
-                                          ZFCP_ERP_DBF_LENGTH);
-        debug_register_view(adapter->erp_dbf, &debug_hex_ascii_view);
-        debug_set_level(adapter->erp_dbf, ZFCP_ERP_DBF_LEVEL);
-
-        if (!(adapter->cmd_dbf && adapter->abort_dbf &&
-              adapter->in_els_dbf && adapter->erp_dbf)) {
-                zfcp_adapter_debug_unregister(adapter);
-                return -ENOMEM;
-        }
-
-        return 0;
-
-}
-
-/**
- * zfcp_adapter_debug_unregister - unregisters debug feature for an adapter
- * @adapter: pointer to adapter for which debug features should be unregistered
- */
-void
-zfcp_adapter_debug_unregister(struct zfcp_adapter *adapter)
-{
-        debug_unregister(adapter->abort_dbf);
-        debug_unregister(adapter->cmd_dbf);
-        debug_unregister(adapter->erp_dbf);
-        debug_unregister(adapter->in_els_dbf);
-        adapter->abort_dbf = NULL;
-        adapter->cmd_dbf = NULL;
-        adapter->erp_dbf = NULL;
-        adapter->in_els_dbf = NULL;
-}
-
 void
 zfcp_dummy_release(struct device *dev)
 {
@@ -1462,10 +1298,6 @@ zfcp_fsf_incoming_els_rscn(struct zfcp_adapter *adapter,
         /* see FC-FS */
         no_entries = (fcp_rscn_head->payload_len / 4);
 
-        zfcp_in_els_dbf_event(adapter, "##rscn", status_buffer,
-                              fcp_rscn_head->payload_len);
-
-        debug_text_event(adapter->erp_dbf, 1, "unsol_els_rscn:");
         for (i = 1; i < no_entries; i++) {
                 /* skip head and start with 1st element */
                 fcp_rscn_element++;
@@ -1497,8 +1329,6 @@ zfcp_fsf_incoming_els_rscn(struct zfcp_adapter *adapter,
                             (ZFCP_STATUS_PORT_DID_DID, &port->status)) {
                                 ZFCP_LOG_INFO("incoming RSCN, trying to open "
                                               "port 0x%016Lx\n", port->wwpn);
-                                debug_text_event(adapter->erp_dbf, 1,
-                                                 "unsol_els_rscnu:");
                                 zfcp_erp_port_reopen(port,
                                                      ZFCP_STATUS_COMMON_ERP_FAILED);
                                 continue;
@@ -1524,8 +1354,6 @@ zfcp_fsf_incoming_els_rscn(struct zfcp_adapter *adapter,
                                  */
                                 ZFCP_LOG_INFO("incoming RSCN, trying to open "
                                               "port 0x%016Lx\n", port->wwpn);
-                                debug_text_event(adapter->erp_dbf, 1,
-                                                 "unsol_els_rscnk:");
                                 zfcp_test_link(port);
                         }
                 }
@@ -1541,8 +1369,6 @@ zfcp_fsf_incoming_els_plogi(struct zfcp_adapter *adapter,
         struct zfcp_port *port;
         unsigned long flags;
 
-        zfcp_in_els_dbf_event(adapter, "##plogi", status_buffer, 28);
-
         read_lock_irqsave(&zfcp_data.config_lock, flags);
         list_for_each_entry(port, &adapter->port_list_head, list) {
                 if (port->wwpn == (*(wwn_t *) & els_logi->nport_wwn))
@@ -1556,8 +1382,6 @@ zfcp_fsf_incoming_els_plogi(struct zfcp_adapter *adapter,
                                status_buffer->d_id,
                                zfcp_get_busid_by_adapter(adapter));
         } else {
-                debug_text_event(adapter->erp_dbf, 1, "unsol_els_plogi:");
-                debug_event(adapter->erp_dbf, 1, &els_logi->nport_wwn, 8);
                 zfcp_erp_port_forced_reopen(port, 0);
         }
 }
@@ -1570,8 +1394,6 @@ zfcp_fsf_incoming_els_logo(struct zfcp_adapter *adapter,
         struct zfcp_port *port;
         unsigned long flags;
 
-        zfcp_in_els_dbf_event(adapter, "##logo", status_buffer, 16);
-
         read_lock_irqsave(&zfcp_data.config_lock, flags);
         list_for_each_entry(port, &adapter->port_list_head, list) {
                 if (port->wwpn == els_logo->nport_wwpn)
@@ -1585,8 +1407,6 @@ zfcp_fsf_incoming_els_logo(struct zfcp_adapter *adapter,
                                status_buffer->d_id,
                                zfcp_get_busid_by_adapter(adapter));
         } else {
-                debug_text_event(adapter->erp_dbf, 1, "unsol_els_logo:");
-                debug_event(adapter->erp_dbf, 1, &els_logo->nport_wwpn, 8);
                 zfcp_erp_port_forced_reopen(port, 0);
         }
 }
@@ -1595,7 +1415,6 @@ static void
 zfcp_fsf_incoming_els_unknown(struct zfcp_adapter *adapter,
                               struct fsf_status_read_buffer *status_buffer)
 {
-        zfcp_in_els_dbf_event(adapter, "##undef", status_buffer, 24);
         ZFCP_LOG_NORMAL("warning: unknown incoming ELS 0x%08x "
                         "for adapter %s\n", *(u32 *) (status_buffer->payload),
                         zfcp_get_busid_by_adapter(adapter));
@@ -1609,10 +1428,11 @@ zfcp_fsf_incoming_els(struct zfcp_fsf_req *fsf_req)
         u32 els_type;
         struct zfcp_adapter *adapter;
 
-        status_buffer = fsf_req->data.status_read.buffer;
+        status_buffer = (struct fsf_status_read_buffer *) fsf_req->data;
         els_type = *(u32 *) (status_buffer->payload);
         adapter = fsf_req->adapter;
 
+        zfcp_san_dbf_event_incoming_els(fsf_req);
         if (els_type == LS_PLOGI)
                 zfcp_fsf_incoming_els_plogi(adapter, status_buffer);
         else if (els_type == LS_LOGO)
diff --git a/drivers/s390/scsi/zfcp_ccw.c b/drivers/s390/scsi/zfcp_ccw.c
index b30abab77da3..0fc46381fc22 100644
--- a/drivers/s390/scsi/zfcp_ccw.c
+++ b/drivers/s390/scsi/zfcp_ccw.c
@@ -202,19 +202,9 @@ static int
 zfcp_ccw_set_offline(struct ccw_device *ccw_device)
 {
         struct zfcp_adapter *adapter;
-        struct zfcp_port *port;
-        struct fc_rport *rport;
 
         down(&zfcp_data.config_sema);
         adapter = dev_get_drvdata(&ccw_device->dev);
-        /* might be racy, but we cannot take config_lock due to the fact that
-           fc_remote_port_delete might sleep */
-        list_for_each_entry(port, &adapter->port_list_head, list)
-                if (port->rport) {
-                        rport = port->rport;
-                        port->rport = NULL;
-                        fc_remote_port_delete(rport);
-                }
         zfcp_erp_adapter_shutdown(adapter, 0);
         zfcp_erp_wait(adapter);
         zfcp_adapter_scsi_unregister(adapter);
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
new file mode 100644
index 000000000000..826fb3b00605
--- /dev/null
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -0,0 +1,995 @@
+/*
+ *
+ * linux/drivers/s390/scsi/zfcp_dbf.c
+ *
+ * FCP adapter driver for IBM eServer zSeries
+ *
+ * Debugging facilities
+ *
+ * (C) Copyright IBM Corp. 2005
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#define ZFCP_DBF_REVISION "$Revision$"
+
+#include <asm/debug.h>
+#include <linux/ctype.h>
+#include "zfcp_ext.h"
+
+static u32 dbfsize = 4;
+
+module_param(dbfsize, uint, 0400);
+MODULE_PARM_DESC(dbfsize,
+                 "number of pages for each debug feature area (default 4)");
+
+#define ZFCP_LOG_AREA                   ZFCP_LOG_AREA_OTHER
+
+static inline int
+zfcp_dbf_stck(char *out_buf, const char *label, unsigned long long stck)
+{
+        unsigned long long sec;
+        struct timespec xtime;
+        int len = 0;
+
+        stck -= 0x8126d60e46000000LL - (0x3c26700LL * 1000000 * 4096);
+        sec = stck >> 12;
+        do_div(sec, 1000000);
+        xtime.tv_sec = sec;
+        stck -= (sec * 1000000) << 12;
+        xtime.tv_nsec = ((stck * 1000) >> 12);
+        len += sprintf(out_buf + len, "%-24s%011lu:%06lu\n",
+                       label, xtime.tv_sec, xtime.tv_nsec);
+
+        return len;
+}
+
+static int zfcp_dbf_tag(char *out_buf, const char *label, const char *tag)
+{
+        int len = 0, i;
+
+        len += sprintf(out_buf + len, "%-24s", label);
+        for (i = 0; i < ZFCP_DBF_TAG_SIZE; i++)
+                len += sprintf(out_buf + len, "%c", tag[i]);
+        len += sprintf(out_buf + len, "\n");
+
+        return len;
+}
+
+static int
+zfcp_dbf_view(char *out_buf, const char *label, const char *format, ...)
+{
+        va_list arg;
+        int len = 0;
+
+        len += sprintf(out_buf + len, "%-24s", label);
+        va_start(arg, format);
+        len += vsprintf(out_buf + len, format, arg);
+        va_end(arg);
+        len += sprintf(out_buf + len, "\n");
+
+        return len;
+}
+
+static int
+zfcp_dbf_view_dump(char *out_buf, const char *label,
+                   char *buffer, int buflen, int offset, int total_size)
+{
+        int len = 0;
+
+        if (offset == 0)
+                len += sprintf(out_buf + len, "%-24s  ", label);
+
+        while (buflen--) {
+                if (offset > 0) {
+                        if ((offset % 32) == 0)
+                                len += sprintf(out_buf + len, "\n%-24c  ", ' ');
+                        else if ((offset % 4) == 0)
+                                len += sprintf(out_buf + len, " ");
+                }
+                len += sprintf(out_buf + len, "%02x", *buffer++);
+                if (++offset == total_size) {
+                        len += sprintf(out_buf + len, "\n");
+                        break;
+                }
+        }
+
+        if (total_size == 0)
+                len += sprintf(out_buf + len, "\n");
+
+        return len;
+}
+
+static inline int
+zfcp_dbf_view_header(debug_info_t * id, struct debug_view *view, int area,
+                     debug_entry_t * entry, char *out_buf)
+{
+        struct zfcp_dbf_dump *dump = (struct zfcp_dbf_dump *)DEBUG_DATA(entry);
+        int len = 0;
+
+        if (strncmp(dump->tag, "dump", ZFCP_DBF_TAG_SIZE) != 0) {
+                len += zfcp_dbf_stck(out_buf + len, "timestamp",
+                                     entry->id.stck);
+                len += zfcp_dbf_view(out_buf + len, "cpu", "%02i",
+                                     entry->id.fields.cpuid);
+        } else {
+                len += zfcp_dbf_view_dump(out_buf + len, NULL,
+                                          dump->data,
+                                          dump->size,
+                                          dump->offset, dump->total_size);
+                if ((dump->offset + dump->size) == dump->total_size)
+                        len += sprintf(out_buf + len, "\n");
+        }
+
+        return len;
+}
+
+inline void zfcp_hba_dbf_event_fsf_response(struct zfcp_fsf_req *fsf_req)
+{
+        struct zfcp_adapter *adapter = fsf_req->adapter;
+        struct fsf_qtcb *qtcb = fsf_req->qtcb;
+        union fsf_prot_status_qual *prot_status_qual =
+            &qtcb->prefix.prot_status_qual;
+        union fsf_status_qual *fsf_status_qual = &qtcb->header.fsf_status_qual;
+        struct scsi_cmnd *scsi_cmnd;
+        struct zfcp_port *port;
+        struct zfcp_unit *unit;
+        struct zfcp_send_els *send_els;
+        struct zfcp_hba_dbf_record *rec = &adapter->hba_dbf_buf;
+        struct zfcp_hba_dbf_record_response *response = &rec->type.response;
+        int level;
+        unsigned long flags;
+
+        spin_lock_irqsave(&adapter->hba_dbf_lock, flags);
+        memset(rec, 0, sizeof(struct zfcp_hba_dbf_record));
+        strncpy(rec->tag, "resp", ZFCP_DBF_TAG_SIZE);
+
+        if ((qtcb->prefix.prot_status != FSF_PROT_GOOD) &&
+            (qtcb->prefix.prot_status != FSF_PROT_FSF_STATUS_PRESENTED)) {
+                strncpy(rec->tag2, "perr", ZFCP_DBF_TAG_SIZE);
+                level = 1;
+        } else if (qtcb->header.fsf_status != FSF_GOOD) {
+                strncpy(rec->tag2, "ferr", ZFCP_DBF_TAG_SIZE);
+                level = 1;
+        } else if ((fsf_req->fsf_command == FSF_QTCB_OPEN_PORT_WITH_DID) ||
+                   (fsf_req->fsf_command == FSF_QTCB_OPEN_LUN)) {
+                strncpy(rec->tag2, "open", ZFCP_DBF_TAG_SIZE);
+                level = 4;
+        } else if ((prot_status_qual->doubleword[0] != 0) ||
+                   (prot_status_qual->doubleword[1] != 0) ||
+                   (fsf_status_qual->doubleword[0] != 0) ||
+                   (fsf_status_qual->doubleword[1] != 0)) {
+                strncpy(rec->tag2, "qual", ZFCP_DBF_TAG_SIZE);
+                level = 3;
+        } else {
+                strncpy(rec->tag2, "norm", ZFCP_DBF_TAG_SIZE);
+                level = 6;
+        }
+
+        response->fsf_command = fsf_req->fsf_command;
+        response->fsf_reqid = (unsigned long)fsf_req;
+        response->fsf_seqno = fsf_req->seq_no;
+        response->fsf_issued = fsf_req->issued;
+        response->fsf_prot_status = qtcb->prefix.prot_status;
+        response->fsf_status = qtcb->header.fsf_status;
+        memcpy(response->fsf_prot_status_qual,
+               prot_status_qual, FSF_PROT_STATUS_QUAL_SIZE);
+        memcpy(response->fsf_status_qual,
+               fsf_status_qual, FSF_STATUS_QUALIFIER_SIZE);
+        response->fsf_req_status = fsf_req->status;
+        response->sbal_first = fsf_req->sbal_first;
+        response->sbal_curr = fsf_req->sbal_curr;
+        response->sbal_last = fsf_req->sbal_last;
+        response->pool = fsf_req->pool != NULL;
+        response->erp_action = (unsigned long)fsf_req->erp_action;
+
+        switch (fsf_req->fsf_command) {
+        case FSF_QTCB_FCP_CMND:
+                if (fsf_req->status & ZFCP_STATUS_FSFREQ_TASK_MANAGEMENT)
+                        break;
+                scsi_cmnd = (struct scsi_cmnd *)fsf_req->data;
+                if (scsi_cmnd != NULL) {
+                        response->data.send_fcp.scsi_cmnd
+                            = (unsigned long)scsi_cmnd;
+                        response->data.send_fcp.scsi_serial
+                            = scsi_cmnd->serial_number;
+                }
+                break;
+
+        case FSF_QTCB_OPEN_PORT_WITH_DID:
+        case FSF_QTCB_CLOSE_PORT:
+        case FSF_QTCB_CLOSE_PHYSICAL_PORT:
+                port = (struct zfcp_port *)fsf_req->data;
+                response->data.port.wwpn = port->wwpn;
+                response->data.port.d_id = port->d_id;
+                response->data.port.port_handle = qtcb->header.port_handle;
+                break;
+
+        case FSF_QTCB_OPEN_LUN:
+        case FSF_QTCB_CLOSE_LUN:
+                unit = (struct zfcp_unit *)fsf_req->data;
+                port = unit->port;
+                response->data.unit.wwpn = port->wwpn;
+                response->data.unit.fcp_lun = unit->fcp_lun;
+                response->data.unit.port_handle = qtcb->header.port_handle;
+                response->data.unit.lun_handle = qtcb->header.lun_handle;
+                break;
+
+        case FSF_QTCB_SEND_ELS:
+                send_els = (struct zfcp_send_els *)fsf_req->data;
+                response->data.send_els.d_id = qtcb->bottom.support.d_id;
+                response->data.send_els.ls_code = send_els->ls_code >> 24;
+                break;
+
+        case FSF_QTCB_ABORT_FCP_CMND:
+        case FSF_QTCB_SEND_GENERIC:
+        case FSF_QTCB_EXCHANGE_CONFIG_DATA:
+        case FSF_QTCB_EXCHANGE_PORT_DATA:
+        case FSF_QTCB_DOWNLOAD_CONTROL_FILE:
+        case FSF_QTCB_UPLOAD_CONTROL_FILE:
+                break;
+        }
+
+        debug_event(adapter->hba_dbf, level,
+                    rec, sizeof(struct zfcp_hba_dbf_record));
+        spin_unlock_irqrestore(&adapter->hba_dbf_lock, flags);
+}
+
+inline void
+zfcp_hba_dbf_event_fsf_unsol(const char *tag, struct zfcp_adapter *adapter,
+                             struct fsf_status_read_buffer *status_buffer)
+{
+        struct zfcp_hba_dbf_record *rec = &adapter->hba_dbf_buf;
+        unsigned long flags;
+
+        spin_lock_irqsave(&adapter->hba_dbf_lock, flags);
+        memset(rec, 0, sizeof(struct zfcp_hba_dbf_record));
+        strncpy(rec->tag, "stat", ZFCP_DBF_TAG_SIZE);
+        strncpy(rec->tag2, tag, ZFCP_DBF_TAG_SIZE);
+
+        rec->type.status.failed = adapter->status_read_failed;
+        if (status_buffer != NULL) {
+                rec->type.status.status_type = status_buffer->status_type;
+                rec->type.status.status_subtype = status_buffer->status_subtype;
+                memcpy(&rec->type.status.queue_designator,
+                       &status_buffer->queue_designator,
+                       sizeof(struct fsf_queue_designator));
+
+                switch (status_buffer->status_type) {
+                case FSF_STATUS_READ_SENSE_DATA_AVAIL:
+                        rec->type.status.payload_size =
+                            ZFCP_DBF_UNSOL_PAYLOAD_SENSE_DATA_AVAIL;
+                        break;
+
+                case FSF_STATUS_READ_BIT_ERROR_THRESHOLD:
+                        rec->type.status.payload_size =
+                            ZFCP_DBF_UNSOL_PAYLOAD_BIT_ERROR_THRESHOLD;
+                        break;
+
+                case FSF_STATUS_READ_LINK_DOWN:
+                        switch (status_buffer->status_subtype) {
+                        case FSF_STATUS_READ_SUB_NO_PHYSICAL_LINK:
+                        case FSF_STATUS_READ_SUB_FDISC_FAILED:
+                                rec->type.status.payload_size =
+                                        sizeof(struct fsf_link_down_info);
+                        }
+                        break;
+
+                case FSF_STATUS_READ_FEATURE_UPDATE_ALERT:
+                        rec->type.status.payload_size =
+                            ZFCP_DBF_UNSOL_PAYLOAD_FEATURE_UPDATE_ALERT;
+                        break;
+                }
+                memcpy(&rec->type.status.payload,
+                       &status_buffer->payload, rec->type.status.payload_size);
+        }
+
+        debug_event(adapter->hba_dbf, 2,
+                    rec, sizeof(struct zfcp_hba_dbf_record));
+        spin_unlock_irqrestore(&adapter->hba_dbf_lock, flags);
+}
+
+inline void
+zfcp_hba_dbf_event_qdio(struct zfcp_adapter *adapter, unsigned int status,
+                        unsigned int qdio_error, unsigned int siga_error,
+                        int sbal_index, int sbal_count)
+{
+        struct zfcp_hba_dbf_record *rec = &adapter->hba_dbf_buf;
+        unsigned long flags;
+
+        spin_lock_irqsave(&adapter->hba_dbf_lock, flags);
+        memset(rec, 0, sizeof(struct zfcp_hba_dbf_record));
+        strncpy(rec->tag, "qdio", ZFCP_DBF_TAG_SIZE);
+        rec->type.qdio.status = status;
+        rec->type.qdio.qdio_error = qdio_error;
+        rec->type.qdio.siga_error = siga_error;
+        rec->type.qdio.sbal_index = sbal_index;
+        rec->type.qdio.sbal_count = sbal_count;
+        debug_event(adapter->hba_dbf, 0,
+                    rec, sizeof(struct zfcp_hba_dbf_record));
+        spin_unlock_irqrestore(&adapter->hba_dbf_lock, flags);
+}
+
+static inline int
+zfcp_hba_dbf_view_response(char *out_buf,
+                           struct zfcp_hba_dbf_record_response *rec)
+{
+        int len = 0;
+
+        len += zfcp_dbf_view(out_buf + len, "fsf_command", "0x%08x",
+                             rec->fsf_command);
+        len += zfcp_dbf_view(out_buf + len, "fsf_reqid", "0x%0Lx",
+                             rec->fsf_reqid);
+        len += zfcp_dbf_view(out_buf + len, "fsf_seqno", "0x%08x",
+                             rec->fsf_seqno);
+        len += zfcp_dbf_stck(out_buf + len, "fsf_issued", rec->fsf_issued);
+        len += zfcp_dbf_view(out_buf + len, "fsf_prot_status", "0x%08x",
+                             rec->fsf_prot_status);
+        len += zfcp_dbf_view(out_buf + len, "fsf_status", "0x%08x",
+                             rec->fsf_status);
+        len += zfcp_dbf_view_dump(out_buf + len, "fsf_prot_status_qual",
+                                  rec->fsf_prot_status_qual,
+                                  FSF_PROT_STATUS_QUAL_SIZE,
+                                  0, FSF_PROT_STATUS_QUAL_SIZE);
+        len += zfcp_dbf_view_dump(out_buf + len, "fsf_status_qual",
+                                  rec->fsf_status_qual,
+                                  FSF_STATUS_QUALIFIER_SIZE,
+                                  0, FSF_STATUS_QUALIFIER_SIZE);
+        len += zfcp_dbf_view(out_buf + len, "fsf_req_status", "0x%08x",
+                             rec->fsf_req_status);
+        len += zfcp_dbf_view(out_buf + len, "sbal_first", "0x%02x",
+                             rec->sbal_first);
+        len += zfcp_dbf_view(out_buf + len, "sbal_curr", "0x%02x",
+                             rec->sbal_curr);
+        len += zfcp_dbf_view(out_buf + len, "sbal_last", "0x%02x",
+                             rec->sbal_last);
+        len += zfcp_dbf_view(out_buf + len, "pool", "0x%02x", rec->pool);
+
+        switch (rec->fsf_command) {
+        case FSF_QTCB_FCP_CMND:
+                if (rec->fsf_req_status & ZFCP_STATUS_FSFREQ_TASK_MANAGEMENT)
+                        break;
+                len += zfcp_dbf_view(out_buf + len, "scsi_cmnd", "0x%0Lx",
+                                     rec->data.send_fcp.scsi_cmnd);
+                len += zfcp_dbf_view(out_buf + len, "scsi_serial", "0x%016Lx",
+                                     rec->data.send_fcp.scsi_serial);
+                break;
+
+        case FSF_QTCB_OPEN_PORT_WITH_DID:
+        case FSF_QTCB_CLOSE_PORT:
+        case FSF_QTCB_CLOSE_PHYSICAL_PORT:
+                len += zfcp_dbf_view(out_buf + len, "wwpn", "0x%016Lx",
+                                     rec->data.port.wwpn);
+                len += zfcp_dbf_view(out_buf + len, "d_id", "0x%06x",
+                                     rec->data.port.d_id);
+                len += zfcp_dbf_view(out_buf + len, "port_handle", "0x%08x",
+                                     rec->data.port.port_handle);
+                break;
+
+        case FSF_QTCB_OPEN_LUN:
+        case FSF_QTCB_CLOSE_LUN:
+                len += zfcp_dbf_view(out_buf + len, "wwpn", "0x%016Lx",
+                                     rec->data.unit.wwpn);
+                len += zfcp_dbf_view(out_buf + len, "fcp_lun", "0x%016Lx",
+                                     rec->data.unit.fcp_lun);
+                len += zfcp_dbf_view(out_buf + len, "port_handle", "0x%08x",
+                                     rec->data.unit.port_handle);
+                len += zfcp_dbf_view(out_buf + len, "lun_handle", "0x%08x",
+                                     rec->data.unit.lun_handle);
+                break;
+
+        case FSF_QTCB_SEND_ELS:
+                len += zfcp_dbf_view(out_buf + len, "d_id", "0x%06x",
+                                     rec->data.send_els.d_id);
+                len += zfcp_dbf_view(out_buf + len, "ls_code", "0x%02x",
+                                     rec->data.send_els.ls_code);
+                break;
+
+        case FSF_QTCB_ABORT_FCP_CMND:
+        case FSF_QTCB_SEND_GENERIC:
+        case FSF_QTCB_EXCHANGE_CONFIG_DATA:
+        case FSF_QTCB_EXCHANGE_PORT_DATA:
+        case FSF_QTCB_DOWNLOAD_CONTROL_FILE:
+        case FSF_QTCB_UPLOAD_CONTROL_FILE:
+                break;
+        }
+
+        return len;
+}
+
+static inline int
+zfcp_hba_dbf_view_status(char *out_buf, struct zfcp_hba_dbf_record_status *rec)
+{
+        int len = 0;
+
+        len += zfcp_dbf_view(out_buf + len, "failed", "0x%02x", rec->failed);
+        len += zfcp_dbf_view(out_buf + len, "status_type", "0x%08x",
+                             rec->status_type);
+        len += zfcp_dbf_view(out_buf + len, "status_subtype", "0x%08x",
+                             rec->status_subtype);
+        len += zfcp_dbf_view_dump(out_buf + len, "queue_designator",
+                                  (char *)&rec->queue_designator,
+                                  sizeof(struct fsf_queue_designator),
+                                  0, sizeof(struct fsf_queue_designator));
+        len += zfcp_dbf_view_dump(out_buf + len, "payload",
+                                  (char *)&rec->payload,
+                                  rec->payload_size, 0, rec->payload_size);
+
+        return len;
+}
+
+static inline int
+zfcp_hba_dbf_view_qdio(char *out_buf, struct zfcp_hba_dbf_record_qdio *rec)
+{
+        int len = 0;
+
+        len += zfcp_dbf_view(out_buf + len, "status", "0x%08x", rec->status);
+        len += zfcp_dbf_view(out_buf + len, "qdio_error", "0x%08x",
+                             rec->qdio_error);
+        len += zfcp_dbf_view(out_buf + len, "siga_error", "0x%08x",
+                             rec->siga_error);
+        len += zfcp_dbf_view(out_buf + len, "sbal_index", "0x%02x",
+                             rec->sbal_index);
+        len += zfcp_dbf_view(out_buf + len, "sbal_count", "0x%02x",
+                             rec->sbal_count);
+
+        return len;
+}
+
+static int
+zfcp_hba_dbf_view_format(debug_info_t * id, struct debug_view *view,
+                         char *out_buf, const char *in_buf)
+{
+        struct zfcp_hba_dbf_record *rec = (struct zfcp_hba_dbf_record *)in_buf;
+        int len = 0;
+
+        if (strncmp(rec->tag, "dump", ZFCP_DBF_TAG_SIZE) == 0)
+                return 0;
+
+        len += zfcp_dbf_tag(out_buf + len, "tag", rec->tag);
+        if (isalpha(rec->tag2[0]))
+                len += zfcp_dbf_tag(out_buf + len, "tag2", rec->tag2);
+        if (strncmp(rec->tag, "resp", ZFCP_DBF_TAG_SIZE) == 0)
+                len += zfcp_hba_dbf_view_response(out_buf + len,
+                                                  &rec->type.response);
+        else if (strncmp(rec->tag, "stat", ZFCP_DBF_TAG_SIZE) == 0)
+                len += zfcp_hba_dbf_view_status(out_buf + len,
+                                                &rec->type.status);
+        else if (strncmp(rec->tag, "qdio", ZFCP_DBF_TAG_SIZE) == 0)
+                len += zfcp_hba_dbf_view_qdio(out_buf + len, &rec->type.qdio);
+
+        len += sprintf(out_buf + len, "\n");
+
+        return len;
+}
+
+struct debug_view zfcp_hba_dbf_view = {
+        "structured",
+        NULL,
+        &zfcp_dbf_view_header,
+        &zfcp_hba_dbf_view_format,
+        NULL,
+        NULL
+};
+
+inline void
+_zfcp_san_dbf_event_common_ct(const char *tag, struct zfcp_fsf_req *fsf_req,
+                              u32 s_id, u32 d_id, void *buffer, int buflen)
+{
+        struct zfcp_send_ct *send_ct = (struct zfcp_send_ct *)fsf_req->data;
+        struct zfcp_port *port = send_ct->port;
+        struct zfcp_adapter *adapter = port->adapter;
+        struct ct_hdr *header = (struct ct_hdr *)buffer;
+        struct zfcp_san_dbf_record *rec = &adapter->san_dbf_buf;
+        struct zfcp_san_dbf_record_ct *ct = &rec->type.ct;
+        unsigned long flags;
+
+        spin_lock_irqsave(&adapter->san_dbf_lock, flags);
+        memset(rec, 0, sizeof(struct zfcp_san_dbf_record));
+        strncpy(rec->tag, tag, ZFCP_DBF_TAG_SIZE);
+        rec->fsf_reqid = (unsigned long)fsf_req;
+        rec->fsf_seqno = fsf_req->seq_no;
+        rec->s_id = s_id;
+        rec->d_id = d_id;
+        if (strncmp(tag, "octc", ZFCP_DBF_TAG_SIZE) == 0) {
+                ct->type.request.cmd_req_code = header->cmd_rsp_code;
+                ct->type.request.revision = header->revision;
+                ct->type.request.gs_type = header->gs_type;
+                ct->type.request.gs_subtype = header->gs_subtype;
+                ct->type.request.options = header->options;
+                ct->type.request.max_res_size = header->max_res_size;
+        } else if (strncmp(tag, "rctc", ZFCP_DBF_TAG_SIZE) == 0) {
+                ct->type.response.cmd_rsp_code = header->cmd_rsp_code;
+                ct->type.response.revision = header->revision;
+                ct->type.response.reason_code = header->reason_code;
+                ct->type.response.reason_code_expl = header->reason_code_expl;
+                ct->type.response.vendor_unique = header->vendor_unique;
+        }
+        ct->payload_size =
+            min(buflen - (int)sizeof(struct ct_hdr), ZFCP_DBF_CT_PAYLOAD);
+        memcpy(ct->payload, buffer + sizeof(struct ct_hdr), ct->payload_size);
+        debug_event(adapter->san_dbf, 3,
+                    rec, sizeof(struct zfcp_san_dbf_record));
+        spin_unlock_irqrestore(&adapter->san_dbf_lock, flags);
+}
+
+inline void zfcp_san_dbf_event_ct_request(struct zfcp_fsf_req *fsf_req)
+{
+        struct zfcp_send_ct *ct = (struct zfcp_send_ct *)fsf_req->data;
+        struct zfcp_port *port = ct->port;
+        struct zfcp_adapter *adapter = port->adapter;
+
+        _zfcp_san_dbf_event_common_ct("octc", fsf_req,
+                                      fc_host_port_id(adapter->scsi_host),
+                                      port->d_id, zfcp_sg_to_address(ct->req),
+                                      ct->req->length);
+}
+
+inline void zfcp_san_dbf_event_ct_response(struct zfcp_fsf_req *fsf_req)
+{
+        struct zfcp_send_ct *ct = (struct zfcp_send_ct *)fsf_req->data;
+        struct zfcp_port *port = ct->port;
+        struct zfcp_adapter *adapter = port->adapter;
+
+        _zfcp_san_dbf_event_common_ct("rctc", fsf_req, port->d_id,
+                                      fc_host_port_id(adapter->scsi_host),
+                                      zfcp_sg_to_address(ct->resp),
+                                      ct->resp->length);
+}
+
+static inline void
+_zfcp_san_dbf_event_common_els(const char *tag, int level,
+                               struct zfcp_fsf_req *fsf_req, u32 s_id,
+                               u32 d_id, u8 ls_code, void *buffer, int buflen)
+{
+        struct zfcp_adapter *adapter = fsf_req->adapter;
+        struct zfcp_san_dbf_record *rec = &adapter->san_dbf_buf;
+        struct zfcp_dbf_dump *dump = (struct zfcp_dbf_dump *)rec;
+        unsigned long flags;
+        int offset = 0;
+
+        spin_lock_irqsave(&adapter->san_dbf_lock, flags);
+        do {
+                memset(rec, 0, sizeof(struct zfcp_san_dbf_record));
+                if (offset == 0) {
+                        strncpy(rec->tag, tag, ZFCP_DBF_TAG_SIZE);
+                        rec->fsf_reqid = (unsigned long)fsf_req;
+                        rec->fsf_seqno = fsf_req->seq_no;
+                        rec->s_id = s_id;
+                        rec->d_id = d_id;
+                        rec->type.els.ls_code = ls_code;
+                        buflen = min(buflen, ZFCP_DBF_ELS_MAX_PAYLOAD);
+                        rec->type.els.payload_size = buflen;
+                        memcpy(rec->type.els.payload,
+                               buffer, min(buflen, ZFCP_DBF_ELS_PAYLOAD));
+                        offset += min(buflen, ZFCP_DBF_ELS_PAYLOAD);
+                } else {
+                        strncpy(dump->tag, "dump", ZFCP_DBF_TAG_SIZE);
+                        dump->total_size = buflen;
+                        dump->offset = offset;
+                        dump->size = min(buflen - offset,
+                                         (int)sizeof(struct zfcp_san_dbf_record)
+                                         - (int)sizeof(struct zfcp_dbf_dump));
+                        memcpy(dump->data, buffer + offset, dump->size);
+                        offset += dump->size;
+                }
+                debug_event(adapter->san_dbf, level,
+                            rec, sizeof(struct zfcp_san_dbf_record));
+        } while (offset < buflen);
+        spin_unlock_irqrestore(&adapter->san_dbf_lock, flags);
+}
+
+inline void zfcp_san_dbf_event_els_request(struct zfcp_fsf_req *fsf_req)
+{
+        struct zfcp_send_els *els = (struct zfcp_send_els *)fsf_req->data;
+
+        _zfcp_san_dbf_event_common_els("oels", 2, fsf_req,
+                                       fc_host_port_id(els->adapter->scsi_host),
+                                       els->d_id,
+                                       *(u8 *) zfcp_sg_to_address(els->req),
+                                       zfcp_sg_to_address(els->req),
+                                       els->req->length);
+}
+
+inline void zfcp_san_dbf_event_els_response(struct zfcp_fsf_req *fsf_req)
+{
+        struct zfcp_send_els *els = (struct zfcp_send_els *)fsf_req->data;
+
+        _zfcp_san_dbf_event_common_els("rels", 2, fsf_req, els->d_id,
+                                       fc_host_port_id(els->adapter->scsi_host),
+                                       *(u8 *) zfcp_sg_to_address(els->req),
+                                       zfcp_sg_to_address(els->resp),
+                                       els->resp->length);
+}
+
+inline void zfcp_san_dbf_event_incoming_els(struct zfcp_fsf_req *fsf_req)
+{
+        struct zfcp_adapter *adapter = fsf_req->adapter;
+        struct fsf_status_read_buffer *status_buffer =
+            (struct fsf_status_read_buffer *)fsf_req->data;
+        int length = (int)status_buffer->length -
+            (int)((void *)&status_buffer->payload - (void *)status_buffer);
+
+        _zfcp_san_dbf_event_common_els("iels", 1, fsf_req, status_buffer->d_id,
+                                       fc_host_port_id(adapter->scsi_host),
+                                       *(u8 *) status_buffer->payload,
+                                       (void *)status_buffer->payload, length);
+}
+
+static int
+zfcp_san_dbf_view_format(debug_info_t * id, struct debug_view *view,
+                         char *out_buf, const char *in_buf)
+{
+        struct zfcp_san_dbf_record *rec = (struct zfcp_san_dbf_record *)in_buf;
+        char *buffer = NULL;
+        int buflen = 0, total = 0;
+        int len = 0;
+
+        if (strncmp(rec->tag, "dump", ZFCP_DBF_TAG_SIZE) == 0)
+                return 0;
+
+        len += zfcp_dbf_tag(out_buf + len, "tag", rec->tag);
+        len += zfcp_dbf_view(out_buf + len, "fsf_reqid", "0x%0Lx",
+                             rec->fsf_reqid);
+        len += zfcp_dbf_view(out_buf + len, "fsf_seqno", "0x%08x",
+                             rec->fsf_seqno);
+        len += zfcp_dbf_view(out_buf + len, "s_id", "0x%06x", rec->s_id);
+        len += zfcp_dbf_view(out_buf + len, "d_id", "0x%06x", rec->d_id);
+
+        if (strncmp(rec->tag, "octc", ZFCP_DBF_TAG_SIZE) == 0) {
+                len += zfcp_dbf_view(out_buf + len, "cmd_req_code", "0x%04x",
+                                     rec->type.ct.type.request.cmd_req_code);
+                len += zfcp_dbf_view(out_buf + len, "revision", "0x%02x",
+                                     rec->type.ct.type.request.revision);
+                len += zfcp_dbf_view(out_buf + len, "gs_type", "0x%02x",
+                                     rec->type.ct.type.request.gs_type);
+                len += zfcp_dbf_view(out_buf + len, "gs_subtype", "0x%02x",
+                                     rec->type.ct.type.request.gs_subtype);
+                len += zfcp_dbf_view(out_buf + len, "options", "0x%02x",
+                                     rec->type.ct.type.request.options);
+                len += zfcp_dbf_view(out_buf + len, "max_res_size", "0x%04x",
+                                     rec->type.ct.type.request.max_res_size);
+                total = rec->type.ct.payload_size;
+                buffer = rec->type.ct.payload;
+                buflen = min(total, ZFCP_DBF_CT_PAYLOAD);
+        } else if (strncmp(rec->tag, "rctc", ZFCP_DBF_TAG_SIZE) == 0) {
+                len += zfcp_dbf_view(out_buf + len, "cmd_rsp_code", "0x%04x",
+                                     rec->type.ct.type.response.cmd_rsp_code);
+                len += zfcp_dbf_view(out_buf + len, "revision", "0x%02x",
+                                     rec->type.ct.type.response.revision);
+                len += zfcp_dbf_view(out_buf + len, "reason_code", "0x%02x",
+                                     rec->type.ct.type.response.reason_code);
+                len +=
+                    zfcp_dbf_view(out_buf + len, "reason_code_expl", "0x%02x",
+                                  rec->type.ct.type.response.reason_code_expl);
+                len +=
+                    zfcp_dbf_view(out_buf + len, "vendor_unique", "0x%02x",
+                                  rec->type.ct.type.response.vendor_unique);
+                total = rec->type.ct.payload_size;
+                buffer = rec->type.ct.payload;
+                buflen = min(total, ZFCP_DBF_CT_PAYLOAD);
+        } else if (strncmp(rec->tag, "oels", ZFCP_DBF_TAG_SIZE) == 0 ||
+                   strncmp(rec->tag, "rels", ZFCP_DBF_TAG_SIZE) == 0 ||
+                   strncmp(rec->tag, "iels", ZFCP_DBF_TAG_SIZE) == 0) {
+                len += zfcp_dbf_view(out_buf + len, "ls_code", "0x%02x",
+                                     rec->type.els.ls_code);
+                total = rec->type.els.payload_size;
+                buffer = rec->type.els.payload;
+                buflen = min(total, ZFCP_DBF_ELS_PAYLOAD);
+        }
+
+        len += zfcp_dbf_view_dump(out_buf + len, "payload",
+                                  buffer, buflen, 0, total);
+
+        if (buflen == total)
+                len += sprintf(out_buf + len, "\n");
+
+        return len;
+}
+
+struct debug_view zfcp_san_dbf_view = {
+        "structured",
+        NULL,
+        &zfcp_dbf_view_header,
+        &zfcp_san_dbf_view_format,
+        NULL,
+        NULL
+};
+
+static inline void
+_zfcp_scsi_dbf_event_common(const char *tag, const char *tag2, int level,
+                            struct zfcp_adapter *adapter,
+                            struct scsi_cmnd *scsi_cmnd,
+                            struct zfcp_fsf_req *new_fsf_req)
+{
+        struct zfcp_fsf_req *fsf_req =
+            (struct zfcp_fsf_req *)scsi_cmnd->host_scribble;
+        struct zfcp_scsi_dbf_record *rec = &adapter->scsi_dbf_buf;
+        struct zfcp_dbf_dump *dump = (struct zfcp_dbf_dump *)rec;
+        unsigned long flags;
+        struct fcp_rsp_iu *fcp_rsp;
+        char *fcp_rsp_info = NULL, *fcp_sns_info = NULL;
+        int offset = 0, buflen = 0;
+
+        spin_lock_irqsave(&adapter->scsi_dbf_lock, flags);
+        do {
+                memset(rec, 0, sizeof(struct zfcp_scsi_dbf_record));
+                if (offset == 0) {
+                        strncpy(rec->tag, tag, ZFCP_DBF_TAG_SIZE);
+                        strncpy(rec->tag2, tag2, ZFCP_DBF_TAG_SIZE);
+                        if (scsi_cmnd->device) {
+                                rec->scsi_id = scsi_cmnd->device->id;
+                                rec->scsi_lun = scsi_cmnd->device->lun;
+                        }
+                        rec->scsi_result = scsi_cmnd->result;
+                        rec->scsi_cmnd = (unsigned long)scsi_cmnd;
+                        rec->scsi_serial = scsi_cmnd->serial_number;
+                        memcpy(rec->scsi_opcode,
+                               &scsi_cmnd->cmnd,
+                               min((int)scsi_cmnd->cmd_len,
+                                   ZFCP_DBF_SCSI_OPCODE));
+                        rec->scsi_retries = scsi_cmnd->retries;
+                        rec->scsi_allowed = scsi_cmnd->allowed;
+                        if (fsf_req != NULL) {
+                                fcp_rsp = (struct fcp_rsp_iu *)
+                                    &(fsf_req->qtcb->bottom.io.fcp_rsp);
+                                fcp_rsp_info =
+                                    zfcp_get_fcp_rsp_info_ptr(fcp_rsp);
+                                fcp_sns_info =
+                                    zfcp_get_fcp_sns_info_ptr(fcp_rsp);
+
+                                rec->type.fcp.rsp_validity =
+                                    fcp_rsp->validity.value;
+                                rec->type.fcp.rsp_scsi_status =
+                                    fcp_rsp->scsi_status;
+                                rec->type.fcp.rsp_resid = fcp_rsp->fcp_resid;
+                                if (fcp_rsp->validity.bits.fcp_rsp_len_valid)
+                                        rec->type.fcp.rsp_code =
+                                            *(fcp_rsp_info + 3);
+                                if (fcp_rsp->validity.bits.fcp_sns_len_valid) {
+                                        buflen = min((int)fcp_rsp->fcp_sns_len,
+                                                     ZFCP_DBF_SCSI_MAX_FCP_SNS_INFO);
+                                        rec->type.fcp.sns_info_len = buflen;
+                                        memcpy(rec->type.fcp.sns_info,
+                                               fcp_sns_info,
+                                               min(buflen,
+                                                   ZFCP_DBF_SCSI_FCP_SNS_INFO));
+                                        offset += min(buflen,
+                                                      ZFCP_DBF_SCSI_FCP_SNS_INFO);
+                                }
+
+                                rec->fsf_reqid = (unsigned long)fsf_req;
+                                rec->fsf_seqno = fsf_req->seq_no;
+                                rec->fsf_issued = fsf_req->issued;
+                        }
+                        if (new_fsf_req != NULL) {
+                                rec->type.new_fsf_req.fsf_reqid =
+                                    (unsigned long)
+                                    new_fsf_req;
+                                rec->type.new_fsf_req.fsf_seqno =
+                                    new_fsf_req->seq_no;
+                                rec->type.new_fsf_req.fsf_issued =
+                                    new_fsf_req->issued;
+                        }
+                } else {
+                        strncpy(dump->tag, "dump", ZFCP_DBF_TAG_SIZE);
+                        dump->total_size = buflen;
+                        dump->offset = offset;
+                        dump->size = min(buflen - offset,
+                                         (int)sizeof(struct
+                                                     zfcp_scsi_dbf_record) -
+                                         (int)sizeof(struct zfcp_dbf_dump));
+                        memcpy(dump->data, fcp_sns_info + offset, dump->size);
+                        offset += dump->size;
+                }
+                debug_event(adapter->scsi_dbf, level,
+                            rec, sizeof(struct zfcp_scsi_dbf_record));
+        } while (offset < buflen);
+        spin_unlock_irqrestore(&adapter->scsi_dbf_lock, flags);
+}
+
+inline void
+zfcp_scsi_dbf_event_result(const char *tag, int level,
+                           struct zfcp_adapter *adapter,
+                           struct scsi_cmnd *scsi_cmnd)
+{
+        _zfcp_scsi_dbf_event_common("rslt",
+                                    tag, level, adapter, scsi_cmnd, NULL);
+}
+
+inline void
+zfcp_scsi_dbf_event_abort(const char *tag, struct zfcp_adapter *adapter,
+                          struct scsi_cmnd *scsi_cmnd,
+                          struct zfcp_fsf_req *new_fsf_req)
+{
+        _zfcp_scsi_dbf_event_common("abrt",
+                                    tag, 1, adapter, scsi_cmnd, new_fsf_req);
+}
+
+inline void
+zfcp_scsi_dbf_event_devreset(const char *tag, u8 flag, struct zfcp_unit *unit,
+                             struct scsi_cmnd *scsi_cmnd)
+{
+        struct zfcp_adapter *adapter = unit->port->adapter;
+
+        _zfcp_scsi_dbf_event_common(flag == FCP_TARGET_RESET ? "trst" : "lrst",
+                                    tag, 1, adapter, scsi_cmnd, NULL);
+}
+
+static int
+zfcp_scsi_dbf_view_format(debug_info_t * id, struct debug_view *view,
+                          char *out_buf, const char *in_buf)
+{
+        struct zfcp_scsi_dbf_record *rec =
+            (struct zfcp_scsi_dbf_record *)in_buf;
+        int len = 0;
+
+        if (strncmp(rec->tag, "dump", ZFCP_DBF_TAG_SIZE) == 0)
+                return 0;
+
+        len += zfcp_dbf_tag(out_buf + len, "tag", rec->tag);
+        len += zfcp_dbf_tag(out_buf + len, "tag2", rec->tag2);
+        len += zfcp_dbf_view(out_buf + len, "scsi_id", "0x%08x", rec->scsi_id);
+        len += zfcp_dbf_view(out_buf + len, "scsi_lun", "0x%08x",
+                             rec->scsi_lun);
+        len += zfcp_dbf_view(out_buf + len, "scsi_result", "0x%08x",
+                             rec->scsi_result);
+        len += zfcp_dbf_view(out_buf + len, "scsi_cmnd", "0x%0Lx",
+                             rec->scsi_cmnd);
+        len += zfcp_dbf_view(out_buf + len, "scsi_serial", "0x%016Lx",
+                             rec->scsi_serial);
+        len += zfcp_dbf_view_dump(out_buf + len, "scsi_opcode",
+                                  rec->scsi_opcode,
+                                  ZFCP_DBF_SCSI_OPCODE,
+                                  0, ZFCP_DBF_SCSI_OPCODE);
+        len += zfcp_dbf_view(out_buf + len, "scsi_retries", "0x%02x",
+                             rec->scsi_retries);
+        len += zfcp_dbf_view(out_buf + len, "scsi_allowed", "0x%02x",
+                             rec->scsi_allowed);
+        len += zfcp_dbf_view(out_buf + len, "fsf_reqid", "0x%0Lx",
+                             rec->fsf_reqid);
+        len += zfcp_dbf_view(out_buf + len, "fsf_seqno", "0x%08x",
+                             rec->fsf_seqno);
+        len += zfcp_dbf_stck(out_buf + len, "fsf_issued", rec->fsf_issued);
+        if (strncmp(rec->tag, "rslt", ZFCP_DBF_TAG_SIZE) == 0) {
+                len +=
+                    zfcp_dbf_view(out_buf + len, "fcp_rsp_validity", "0x%02x",
+                                  rec->type.fcp.rsp_validity);
+                len +=
+                    zfcp_dbf_view(out_buf + len, "fcp_rsp_scsi_status",
+                                  "0x%02x", rec->type.fcp.rsp_scsi_status);
+                len +=
+                    zfcp_dbf_view(out_buf + len, "fcp_rsp_resid", "0x%08x",
+                                  rec->type.fcp.rsp_resid);
+                len +=
+                    zfcp_dbf_view(out_buf + len, "fcp_rsp_code", "0x%08x",
+                                  rec->type.fcp.rsp_code);
+                len +=
+                    zfcp_dbf_view(out_buf + len, "fcp_sns_info_len", "0x%08x",
+                                  rec->type.fcp.sns_info_len);
+                len +=
+                    zfcp_dbf_view_dump(out_buf + len, "fcp_sns_info",
+                                       rec->type.fcp.sns_info,
+                                       min((int)rec->type.fcp.sns_info_len,
+                                           ZFCP_DBF_SCSI_FCP_SNS_INFO), 0,
+                                       rec->type.fcp.sns_info_len);
+        } else if (strncmp(rec->tag, "abrt", ZFCP_DBF_TAG_SIZE) == 0) {
+                len += zfcp_dbf_view(out_buf + len, "fsf_reqid_abort", "0x%0Lx",
+                                     rec->type.new_fsf_req.fsf_reqid);
+                len += zfcp_dbf_view(out_buf + len, "fsf_seqno_abort", "0x%08x",
+                                     rec->type.new_fsf_req.fsf_seqno);
+                len += zfcp_dbf_stck(out_buf + len, "fsf_issued",
+                                     rec->type.new_fsf_req.fsf_issued);
+        } else if ((strncmp(rec->tag, "trst", ZFCP_DBF_TAG_SIZE) == 0) ||
+                   (strncmp(rec->tag, "lrst", ZFCP_DBF_TAG_SIZE) == 0)) {
+                len += zfcp_dbf_view(out_buf + len, "fsf_reqid_reset", "0x%0Lx",
+                                     rec->type.new_fsf_req.fsf_reqid);
+                len += zfcp_dbf_view(out_buf + len, "fsf_seqno_reset", "0x%08x",
+                                     rec->type.new_fsf_req.fsf_seqno);
+                len += zfcp_dbf_stck(out_buf + len, "fsf_issued",
+                                     rec->type.new_fsf_req.fsf_issued);
+        }
+
+        len += sprintf(out_buf + len, "\n");
+
+        return len;
+}
+
+struct debug_view zfcp_scsi_dbf_view = {
+        "structured",
+        NULL,
+        &zfcp_dbf_view_header,
+        &zfcp_scsi_dbf_view_format,
+        NULL,
+        NULL
+};
+
+/**
+ * zfcp_adapter_debug_register - registers debug feature for an adapter
+ * @adapter: pointer to adapter for which debug features should be registered
+ * return: -ENOMEM on error, 0 otherwise
+ */
+int zfcp_adapter_debug_register(struct zfcp_adapter *adapter)
+{
+        char dbf_name[DEBUG_MAX_NAME_LEN];
+
+        /* debug feature area which records recovery activity */
+        spin_lock_init(&adapter->erp_dbf_lock);
+        sprintf(dbf_name, "zfcp_%s_erp", zfcp_get_busid_by_adapter(adapter));
+        adapter->erp_dbf = debug_register(dbf_name, dbfsize, 2,
+                                          sizeof(struct zfcp_erp_dbf_record));
+        if (!adapter->erp_dbf)
+                goto failed;
+        debug_register_view(adapter->erp_dbf, &debug_hex_ascii_view);
+        debug_set_level(adapter->erp_dbf, 3);
+
+        /* debug feature area which records HBA (FSF and QDIO) conditions */
+        spin_lock_init(&adapter->hba_dbf_lock);
+        sprintf(dbf_name, "zfcp_%s_hba", zfcp_get_busid_by_adapter(adapter));
+        adapter->hba_dbf = debug_register(dbf_name, dbfsize, 1,
+                                          sizeof(struct zfcp_hba_dbf_record));
+        if (!adapter->hba_dbf)
+                goto failed;
+        debug_register_view(adapter->hba_dbf, &debug_hex_ascii_view);
+        debug_register_view(adapter->hba_dbf, &zfcp_hba_dbf_view);
+        debug_set_level(adapter->hba_dbf, 3);
+
+        /* debug feature area which records SAN command failures and recovery */
+        spin_lock_init(&adapter->san_dbf_lock);
+        sprintf(dbf_name, "zfcp_%s_san", zfcp_get_busid_by_adapter(adapter));
+        adapter->san_dbf = debug_register(dbf_name, dbfsize, 1,
+                                          sizeof(struct zfcp_san_dbf_record));
+        if (!adapter->san_dbf)
+                goto failed;
+        debug_register_view(adapter->san_dbf, &debug_hex_ascii_view);
+        debug_register_view(adapter->san_dbf, &zfcp_san_dbf_view);
+        debug_set_level(adapter->san_dbf, 6);
+
+        /* debug feature area which records SCSI command failures and recovery */
+        spin_lock_init(&adapter->scsi_dbf_lock);
+        sprintf(dbf_name, "zfcp_%s_scsi", zfcp_get_busid_by_adapter(adapter));
+        adapter->scsi_dbf = debug_register(dbf_name, dbfsize, 1,
+                                           sizeof(struct zfcp_scsi_dbf_record));
+        if (!adapter->scsi_dbf)
+                goto failed;
+        debug_register_view(adapter->scsi_dbf, &debug_hex_ascii_view);
+        debug_register_view(adapter->scsi_dbf, &zfcp_scsi_dbf_view);
+        debug_set_level(adapter->scsi_dbf, 3);
+
+        return 0;
+
+ failed:
+        zfcp_adapter_debug_unregister(adapter);
+
+        return -ENOMEM;
+}
+
+/**
+ * zfcp_adapter_debug_unregister - unregisters debug feature for an adapter
+ * @adapter: pointer to adapter for which debug features should be unregistered
+ */
+void zfcp_adapter_debug_unregister(struct zfcp_adapter *adapter)
+{
+        debug_unregister(adapter->scsi_dbf);
+        debug_unregister(adapter->san_dbf);
+        debug_unregister(adapter->hba_dbf);
+        debug_unregister(adapter->erp_dbf);
+        adapter->scsi_dbf = NULL;
+        adapter->san_dbf = NULL;
+        adapter->hba_dbf = NULL;
+        adapter->erp_dbf = NULL;
+}
+
+#undef ZFCP_LOG_AREA
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 455e902533a9..d81b737d68cc 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -66,7 +66,7 @@
 /********************* GENERAL DEFINES *********************************/
 
 /* zfcp version number, it consists of major, minor, and patch-level number */
-#define ZFCP_VERSION            "4.3.0"
+#define ZFCP_VERSION            "4.5.0"
 
 /**
  * zfcp_sg_to_address - determine kernel address from struct scatterlist
@@ -154,13 +154,17 @@ typedef u32 scsi_lun_t;
 #define ZFCP_EXCHANGE_CONFIG_DATA_FIRST_SLEEP   100
 #define ZFCP_EXCHANGE_CONFIG_DATA_RETRIES       7
 
+/* Retry 5 times every 2 second, then every minute */
+#define ZFCP_EXCHANGE_PORT_DATA_SHORT_RETRIES   5
+#define ZFCP_EXCHANGE_PORT_DATA_SHORT_SLEEP     200
+#define ZFCP_EXCHANGE_PORT_DATA_LONG_SLEEP      6000
+
 /* timeout value for "default timer" for fsf requests */
 #define ZFCP_FSF_REQUEST_TIMEOUT (60*HZ);
 
 /*************** FIBRE CHANNEL PROTOCOL SPECIFIC DEFINES ********************/
 
 typedef unsigned long long wwn_t;
-typedef unsigned int       fc_id_t;
 typedef unsigned long long fcp_lun_t;
 /* data length field may be at variable position in FCP-2 FCP_CMND IU */
 typedef unsigned int       fcp_dl_t;
@@ -281,6 +285,171 @@ struct fcp_logo {
 } __attribute__((packed));
 
 /*
+ * DBF stuff
+ */
+#define ZFCP_DBF_TAG_SIZE      4
+
+struct zfcp_dbf_dump {
+        u8 tag[ZFCP_DBF_TAG_SIZE];
+        u32 total_size;         /* size of total dump data */
+        u32 offset;             /* how much data has being already dumped */
+        u32 size;               /* how much data comes with this record */
+        u8 data[];              /* dump data */
+} __attribute__ ((packed));
+
+/* FIXME: to be inflated when reworking the erp dbf */
+struct zfcp_erp_dbf_record {
+        u8 dummy[16];
+} __attribute__ ((packed));
+
+struct zfcp_hba_dbf_record_response {
+        u32 fsf_command;
+        u64 fsf_reqid;
+        u32 fsf_seqno;
+        u64 fsf_issued;
+        u32 fsf_prot_status;
+        u32 fsf_status;
+        u8 fsf_prot_status_qual[FSF_PROT_STATUS_QUAL_SIZE];
+        u8 fsf_status_qual[FSF_STATUS_QUALIFIER_SIZE];
+        u32 fsf_req_status;
+        u8 sbal_first;
+        u8 sbal_curr;
+        u8 sbal_last;
+        u8 pool;
+        u64 erp_action;
+        union {
+                struct {
+                        u64 scsi_cmnd;
+                        u64 scsi_serial;
+                } send_fcp;
+                struct {
+                        u64 wwpn;
+                        u32 d_id;
+                        u32 port_handle;
+                } port;
+                struct {
+                        u64 wwpn;
+                        u64 fcp_lun;
+                        u32 port_handle;
+                        u32 lun_handle;
+                } unit;
+                struct {
+                        u32 d_id;
+                        u8 ls_code;
+                } send_els;
+        } data;
+} __attribute__ ((packed));
+
+struct zfcp_hba_dbf_record_status {
+        u8 failed;
+        u32 status_type;
+        u32 status_subtype;
+        struct fsf_queue_designator
+         queue_designator;
+        u32 payload_size;
+#define ZFCP_DBF_UNSOL_PAYLOAD                          80
+#define ZFCP_DBF_UNSOL_PAYLOAD_SENSE_DATA_AVAIL         32
+#define ZFCP_DBF_UNSOL_PAYLOAD_BIT_ERROR_THRESHOLD      56
+#define ZFCP_DBF_UNSOL_PAYLOAD_FEATURE_UPDATE_ALERT     2 * sizeof(u32)
+        u8 payload[ZFCP_DBF_UNSOL_PAYLOAD];
+} __attribute__ ((packed));
+
+struct zfcp_hba_dbf_record_qdio {
+        u32 status;
+        u32 qdio_error;
+        u32 siga_error;
+        u8 sbal_index;
+        u8 sbal_count;
+} __attribute__ ((packed));
+
+struct zfcp_hba_dbf_record {
+        u8 tag[ZFCP_DBF_TAG_SIZE];
+        u8 tag2[ZFCP_DBF_TAG_SIZE];
+        union {
+                struct zfcp_hba_dbf_record_response response;
+                struct zfcp_hba_dbf_record_status status;
+                struct zfcp_hba_dbf_record_qdio qdio;
+        } type;
+} __attribute__ ((packed));
+
+struct zfcp_san_dbf_record_ct {
+        union {
+                struct {
+                        u16 cmd_req_code;
+                        u8 revision;
+                        u8 gs_type;
+                        u8 gs_subtype;
+                        u8 options;
+                        u16 max_res_size;
+                } request;
+                struct {
+                        u16 cmd_rsp_code;
+                        u8 revision;
+                        u8 reason_code;
+                        u8 reason_code_expl;
+                        u8 vendor_unique;
+                } response;
+        } type;
+        u32 payload_size;
+#define ZFCP_DBF_CT_PAYLOAD     24
+        u8 payload[ZFCP_DBF_CT_PAYLOAD];
+} __attribute__ ((packed));
+
+struct zfcp_san_dbf_record_els {
+        u8 ls_code;
+        u32 payload_size;
+#define ZFCP_DBF_ELS_PAYLOAD    32
+#define ZFCP_DBF_ELS_MAX_PAYLOAD 1024
+        u8 payload[ZFCP_DBF_ELS_PAYLOAD];
+} __attribute__ ((packed));
+
+struct zfcp_san_dbf_record {
+        u8 tag[ZFCP_DBF_TAG_SIZE];
+        u64 fsf_reqid;
+        u32 fsf_seqno;
+        u32 s_id;
+        u32 d_id;
+        union {
+                struct zfcp_san_dbf_record_ct ct;
+                struct zfcp_san_dbf_record_els els;
+        } type;
+} __attribute__ ((packed));
+
+struct zfcp_scsi_dbf_record {
+        u8 tag[ZFCP_DBF_TAG_SIZE];
+        u8 tag2[ZFCP_DBF_TAG_SIZE];
+        u32 scsi_id;
+        u32 scsi_lun;
+        u32 scsi_result;
+        u64 scsi_cmnd;
+        u64 scsi_serial;
+#define ZFCP_DBF_SCSI_OPCODE    16
+        u8 scsi_opcode[ZFCP_DBF_SCSI_OPCODE];
+        u8 scsi_retries;
+        u8 scsi_allowed;
+        u64 fsf_reqid;
+        u32 fsf_seqno;
+        u64 fsf_issued;
+        union {
+                struct {
+                        u64 fsf_reqid;
+                        u32 fsf_seqno;
+                        u64 fsf_issued;
+                } new_fsf_req;
+                struct {
+                        u8 rsp_validity;
+                        u8 rsp_scsi_status;
+                        u32 rsp_resid;
+                        u8 rsp_code;
+#define ZFCP_DBF_SCSI_FCP_SNS_INFO      16
+#define ZFCP_DBF_SCSI_MAX_FCP_SNS_INFO  256
+                        u32 sns_info_len;
+                        u8 sns_info[ZFCP_DBF_SCSI_FCP_SNS_INFO];
+                } fcp;
+        } type;
+} __attribute__ ((packed));
+
+/*
  * FC-FS stuff
  */
 #define R_A_TOV                         10 /* seconds */
@@ -339,34 +508,6 @@ struct zfcp_rc_entry {
  */
 #define ZFCP_CT_TIMEOUT                 (3 * R_A_TOV)
 
-
-/***************** S390 DEBUG FEATURE SPECIFIC DEFINES ***********************/
-
-/* debug feature entries per adapter */
-#define ZFCP_ERP_DBF_INDEX     1 
-#define ZFCP_ERP_DBF_AREAS     2
-#define ZFCP_ERP_DBF_LENGTH    16
-#define ZFCP_ERP_DBF_LEVEL     3
-#define ZFCP_ERP_DBF_NAME      "zfcperp"
-
-#define ZFCP_CMD_DBF_INDEX     2
-#define ZFCP_CMD_DBF_AREAS     1
-#define ZFCP_CMD_DBF_LENGTH    8
-#define ZFCP_CMD_DBF_LEVEL     3
-#define ZFCP_CMD_DBF_NAME      "zfcpcmd"
-
-#define ZFCP_ABORT_DBF_INDEX   2
-#define ZFCP_ABORT_DBF_AREAS   1
-#define ZFCP_ABORT_DBF_LENGTH  8
-#define ZFCP_ABORT_DBF_LEVEL   6
-#define ZFCP_ABORT_DBF_NAME    "zfcpabt"
-
-#define ZFCP_IN_ELS_DBF_INDEX  2
-#define ZFCP_IN_ELS_DBF_AREAS  1
-#define ZFCP_IN_ELS_DBF_LENGTH 8
-#define ZFCP_IN_ELS_DBF_LEVEL  6
-#define ZFCP_IN_ELS_DBF_NAME   "zfcpels"
-
 /******************** LOGGING MACROS AND DEFINES *****************************/
 
 /*
@@ -501,6 +642,7 @@ do { \
 #define ZFCP_STATUS_ADAPTER_ERP_THREAD_KILL     0x00000080
 #define ZFCP_STATUS_ADAPTER_ERP_PENDING         0x00000100
 #define ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED      0x00000200
+#define ZFCP_STATUS_ADAPTER_XPORT_OK            0x00000800
 
 #define ZFCP_STATUS_ADAPTER_SCSI_UP                     \
                 (ZFCP_STATUS_COMMON_UNBLOCKED | \
@@ -635,45 +777,6 @@ struct zfcp_adapter_mempool {
         mempool_t *data_gid_pn;
 };
 
-struct  zfcp_exchange_config_data{
-};
-
-struct zfcp_open_port {
-        struct zfcp_port *port;
-};
-
-struct zfcp_close_port {
-        struct zfcp_port *port;
-};
-
-struct zfcp_open_unit {
-        struct zfcp_unit *unit;
-};
-
-struct zfcp_close_unit {
-        struct zfcp_unit *unit;
-};
-
-struct zfcp_close_physical_port {
-        struct zfcp_port *port;
-};
-
-struct zfcp_send_fcp_command_task {
-        struct zfcp_fsf_req *fsf_req;
-        struct zfcp_unit *unit;
-        struct scsi_cmnd *scsi_cmnd;
-        unsigned long start_jiffies;
-};
-
-struct zfcp_send_fcp_command_task_management {
-        struct zfcp_unit *unit;
-};
-
-struct zfcp_abort_fcp_command {
-        struct zfcp_fsf_req *fsf_req;
-        struct zfcp_unit *unit;
-};
-
 /*
  * header for CT_IU
  */
@@ -702,7 +805,7 @@ struct ct_iu_gid_pn_req {
 /* FS_ACC IU and data unit for GID_PN nameserver request */
 struct ct_iu_gid_pn_resp {
         struct ct_hdr header;
-        fc_id_t d_id;
+        u32 d_id;
 } __attribute__ ((packed));
 
 typedef void (*zfcp_send_ct_handler_t)(unsigned long);
@@ -768,7 +871,7 @@ typedef void (*zfcp_send_els_handler_t)(unsigned long);
 struct zfcp_send_els {
         struct zfcp_adapter *adapter;
         struct zfcp_port *port;
-        fc_id_t d_id;
+        u32 d_id;
         struct scatterlist *req;
         struct scatterlist *resp;
         unsigned int req_count;
@@ -781,33 +884,6 @@ struct zfcp_send_els {
         int status;
 };
 
-struct zfcp_status_read {
-        struct fsf_status_read_buffer *buffer;
-};
-
-struct zfcp_fsf_done {
-        struct completion *complete;
-        int status;
-};
-
-/* request specific data */
-union zfcp_req_data {
-        struct zfcp_exchange_config_data exchange_config_data;
-        struct zfcp_open_port             open_port;
-        struct zfcp_close_port            close_port;
-        struct zfcp_open_unit             open_unit;
-        struct zfcp_close_unit            close_unit;
-        struct zfcp_close_physical_port   close_physical_port;
-        struct zfcp_send_fcp_command_task send_fcp_command_task;
-        struct zfcp_send_fcp_command_task_management
-                                          send_fcp_command_task_management;
-        struct zfcp_abort_fcp_command     abort_fcp_command;
-        struct zfcp_send_ct *send_ct;
-        struct zfcp_send_els *send_els;
-        struct zfcp_status_read           status_read;
-        struct fsf_qtcb_bottom_port *port_data;
-};
-
 struct zfcp_qdio_queue {
         struct qdio_buffer *buffer[QDIO_MAX_BUFFERS_PER_Q]; /* SBALs */
         u8                 free_index;        /* index of next free bfr
@@ -838,21 +914,19 @@ struct zfcp_adapter {
         atomic_t                refcount;          /* reference count */
         wait_queue_head_t       remove_wq;         /* can be used to wait for
                                                       refcount drop to zero */
-        wwn_t                   wwnn;              /* WWNN */
-        wwn_t                   wwpn;              /* WWPN */
-        fc_id_t                 s_id;              /* N_Port ID */
         wwn_t                   peer_wwnn;         /* P2P peer WWNN */
         wwn_t                   peer_wwpn;         /* P2P peer WWPN */
-        fc_id_t                 peer_d_id;         /* P2P peer D_ID */
+        u32                     peer_d_id;         /* P2P peer D_ID */
+        wwn_t                   physical_wwpn;     /* WWPN of physical port */
+        u32                     physical_s_id;     /* local FC port ID */
         struct ccw_device       *ccw_device;       /* S/390 ccw device */
         u8                      fc_service_class;
         u32                     fc_topology;       /* FC topology */
-        u32                     fc_link_speed;     /* FC interface speed */
         u32                     hydra_version;     /* Hydra version */
         u32                     fsf_lic_version;
-        u32                     supported_features;/* of FCP channel */
+        u32                     adapter_features;  /* FCP channel features */
+        u32                     connection_features; /* host connection features */
         u32                     hardware_version;  /* of FCP channel */
-        u8                      serial_number[32]; /* of hardware */
         struct Scsi_Host        *scsi_host;        /* Pointer to mid-layer */
         unsigned short          scsi_host_no;      /* Assigned host number */
         unsigned char           name[9];
@@ -889,11 +963,18 @@ struct zfcp_adapter {
         u32                     erp_low_mem_count; /* nr of erp actions waiting
                                                       for memory */
         struct zfcp_port        *nameserver_port;  /* adapter's nameserver */
-        debug_info_t            *erp_dbf;          /* S/390 debug features */
-        debug_info_t            *abort_dbf;
-        debug_info_t            *in_els_dbf;
-        debug_info_t            *cmd_dbf;
-        spinlock_t              dbf_lock;
+        debug_info_t            *erp_dbf;
+        debug_info_t            *hba_dbf;
+        debug_info_t            *san_dbf;          /* debug feature areas */
+        debug_info_t            *scsi_dbf;
+        spinlock_t              erp_dbf_lock;
+        spinlock_t              hba_dbf_lock;
+        spinlock_t              san_dbf_lock;
+        spinlock_t              scsi_dbf_lock;
+        struct zfcp_erp_dbf_record      erp_dbf_buf;
+        struct zfcp_hba_dbf_record      hba_dbf_buf;
+        struct zfcp_san_dbf_record      san_dbf_buf;
+        struct zfcp_scsi_dbf_record     scsi_dbf_buf;
         struct zfcp_adapter_mempool     pool;      /* Adapter memory pools */
         struct qdio_initialize  qdio_init_data;    /* for qdio_establish */
         struct device           generic_services;  /* directory for WKA ports */
@@ -919,7 +1000,7 @@ struct zfcp_port {
         atomic_t               status;         /* status of this remote port */
         wwn_t                  wwnn;           /* WWNN if known */
         wwn_t                  wwpn;           /* WWPN */
-        fc_id_t                d_id;           /* D_ID */
+        u32                    d_id;           /* D_ID */
         u32                    handle;         /* handle assigned by FSF */
         struct zfcp_erp_action erp_action;     /* pending error recovery */
         atomic_t               erp_counter;
@@ -963,11 +1044,13 @@ struct zfcp_fsf_req {
         u32                    fsf_command;    /* FSF Command copy */
         struct fsf_qtcb        *qtcb;          /* address of associated QTCB */
         u32                    seq_no;         /* Sequence number of request */
-        union zfcp_req_data    data;           /* Info fields of request */ 
+        unsigned long          data;           /* private data of request */ 
         struct zfcp_erp_action *erp_action;    /* used if this request is
                                                   issued on behalf of erp */
         mempool_t              *pool;          /* used if request was alloacted
                                                   from emergency pool */
+        unsigned long long     issued;         /* request sent time (STCK) */
+        struct zfcp_unit       *unit;
 };
 
 typedef void zfcp_fsf_req_handler_t(struct zfcp_fsf_req*);
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index cb4f612550ba..023f4e558ae4 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -82,6 +82,7 @@ static int zfcp_erp_adapter_strategy_open(struct zfcp_erp_action *);
 static int zfcp_erp_adapter_strategy_open_qdio(struct zfcp_erp_action *);
 static int zfcp_erp_adapter_strategy_open_fsf(struct zfcp_erp_action *);
 static int zfcp_erp_adapter_strategy_open_fsf_xconfig(struct zfcp_erp_action *);
+static int zfcp_erp_adapter_strategy_open_fsf_xport(struct zfcp_erp_action *);
 static int zfcp_erp_adapter_strategy_open_fsf_statusread(
         struct zfcp_erp_action *);
 
@@ -345,13 +346,13 @@ zfcp_erp_adisc(struct zfcp_port *port)
 
         /* acc. to FC-FS, hard_nport_id in ADISC should not be set for ports
            without FC-AL-2 capability, so we don't set it */
-        adisc->wwpn = adapter->wwpn;
-        adisc->wwnn = adapter->wwnn;
-        adisc->nport_id = adapter->s_id;
+        adisc->wwpn = fc_host_port_name(adapter->scsi_host);
+        adisc->wwnn = fc_host_node_name(adapter->scsi_host);
+        adisc->nport_id = fc_host_port_id(adapter->scsi_host);
         ZFCP_LOG_INFO("ADISC request from s_id 0x%08x to d_id 0x%08x "
                       "(wwpn=0x%016Lx, wwnn=0x%016Lx, "
                       "hard_nport_id=0x%08x, nport_id=0x%08x)\n",
-                      adapter->s_id, send_els->d_id, (wwn_t) adisc->wwpn,
+                      adisc->nport_id, send_els->d_id, (wwn_t) adisc->wwpn,
                       (wwn_t) adisc->wwnn, adisc->hard_nport_id,
                       adisc->nport_id);
 
@@ -404,7 +405,7 @@ zfcp_erp_adisc_handler(unsigned long data)
         struct zfcp_send_els *send_els;
         struct zfcp_port *port;
         struct zfcp_adapter *adapter;
-        fc_id_t d_id;
+        u32 d_id;
         struct zfcp_ls_adisc_acc *adisc;
 
         send_els = (struct zfcp_send_els *) data;
@@ -435,9 +436,9 @@ zfcp_erp_adisc_handler(unsigned long data)
         ZFCP_LOG_INFO("ADISC response from d_id 0x%08x to s_id "
                       "0x%08x (wwpn=0x%016Lx, wwnn=0x%016Lx, "
                       "hard_nport_id=0x%08x, nport_id=0x%08x)\n",
-                      d_id, adapter->s_id, (wwn_t) adisc->wwpn,
-                      (wwn_t) adisc->wwnn, adisc->hard_nport_id,
-                      adisc->nport_id);
+                      d_id, fc_host_port_id(adapter->scsi_host),
+                      (wwn_t) adisc->wwpn, (wwn_t) adisc->wwnn,
+                      adisc->hard_nport_id, adisc->nport_id);
 
         /* set wwnn for port */
         if (port->wwnn == 0)
@@ -886,7 +887,7 @@ static int
 zfcp_erp_strategy_check_fsfreq(struct zfcp_erp_action *erp_action)
 {
         int retval = 0;
-        struct zfcp_fsf_req *fsf_req;
+        struct zfcp_fsf_req *fsf_req = NULL;
         struct zfcp_adapter *adapter = erp_action->adapter;
 
         if (erp_action->fsf_req) {
@@ -896,7 +897,7 @@ zfcp_erp_strategy_check_fsfreq(struct zfcp_erp_action *erp_action)
                 list_for_each_entry(fsf_req, &adapter->fsf_req_list_head, list)
                     if (fsf_req == erp_action->fsf_req)
                         break;
-                if (fsf_req == erp_action->fsf_req) {
+                if (fsf_req && (fsf_req->erp_action == erp_action)) {
                         /* fsf_req still exists */
                         debug_text_event(adapter->erp_dbf, 3, "a_ca_req");
                         debug_event(adapter->erp_dbf, 3, &fsf_req,
@@ -2258,16 +2259,21 @@ zfcp_erp_adapter_strategy_close_qdio(struct zfcp_erp_action *erp_action)
 static int
 zfcp_erp_adapter_strategy_open_fsf(struct zfcp_erp_action *erp_action)
 {
-        int retval;
+        int xconfig, xport;
+
+        if (atomic_test_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED,
+                             &erp_action->adapter->status)) {
+                zfcp_erp_adapter_strategy_open_fsf_xport(erp_action);
+                atomic_set(&erp_action->adapter->erp_counter, 0);
+                return ZFCP_ERP_FAILED;
+        }
 
-        /* do 'exchange configuration data' */
-        retval = zfcp_erp_adapter_strategy_open_fsf_xconfig(erp_action);
-        if (retval == ZFCP_ERP_FAILED)
-                return retval;
+        xconfig = zfcp_erp_adapter_strategy_open_fsf_xconfig(erp_action);
+        xport   = zfcp_erp_adapter_strategy_open_fsf_xport(erp_action);
+        if ((xconfig == ZFCP_ERP_FAILED) || (xport == ZFCP_ERP_FAILED))
+                return ZFCP_ERP_FAILED;
 
-        /* start the desired number of Status Reads */
-        retval = zfcp_erp_adapter_strategy_open_fsf_statusread(erp_action);
-        return retval;
+        return zfcp_erp_adapter_strategy_open_fsf_statusread(erp_action);
 }
 
 /*
@@ -2291,7 +2297,9 @@ zfcp_erp_adapter_strategy_open_fsf_xconfig(struct zfcp_erp_action *erp_action)
                 atomic_clear_mask(ZFCP_STATUS_ADAPTER_HOST_CON_INIT,
                                   &adapter->status);
                 ZFCP_LOG_DEBUG("Doing exchange config data\n");
+                write_lock(&adapter->erp_lock);
                 zfcp_erp_action_to_running(erp_action);
+                write_unlock(&adapter->erp_lock);
                 zfcp_erp_timeout_init(erp_action);
                 if (zfcp_fsf_exchange_config_data(erp_action)) {
                         retval = ZFCP_ERP_FAILED;
@@ -2348,6 +2356,76 @@ zfcp_erp_adapter_strategy_open_fsf_xconfig(struct zfcp_erp_action *erp_action)
         return retval;
 }
 
+static int
+zfcp_erp_adapter_strategy_open_fsf_xport(struct zfcp_erp_action *erp_action)
+{
+        int retval = ZFCP_ERP_SUCCEEDED;
+        int retries;
+        int sleep;
+        struct zfcp_adapter *adapter = erp_action->adapter;
+
+        atomic_clear_mask(ZFCP_STATUS_ADAPTER_XPORT_OK, &adapter->status);
+
+        for (retries = 0; ; retries++) {
+                ZFCP_LOG_DEBUG("Doing exchange port data\n");
+                zfcp_erp_action_to_running(erp_action);
+                zfcp_erp_timeout_init(erp_action);
+                if (zfcp_fsf_exchange_port_data(erp_action, adapter, NULL)) {
+                        retval = ZFCP_ERP_FAILED;
+                        debug_text_event(adapter->erp_dbf, 5, "a_fstx_xf");
+                        ZFCP_LOG_INFO("error: initiation of exchange of "
+                                      "port data failed for adapter %s\n",
+                                      zfcp_get_busid_by_adapter(adapter));
+                        break;
+                }
+                debug_text_event(adapter->erp_dbf, 6, "a_fstx_xok");
+                ZFCP_LOG_DEBUG("Xchange underway\n");
+
+                /*
+                 * Why this works:
+                 * Both the normal completion handler as well as the timeout
+                 * handler will do an 'up' when the 'exchange port data'
+                 * request completes or times out. Thus, the signal to go on
+                 * won't be lost utilizing this semaphore.
+                 * Furthermore, this 'adapter_reopen' action is
+                 * guaranteed to be the only action being there (highest action
+                 * which prevents other actions from being created).
+                 * Resulting from that, the wake signal recognized here
+                 * _must_ be the one belonging to the 'exchange port
+                 * data' request.
+                 */
+                down(&adapter->erp_ready_sem);
+                if (erp_action->status & ZFCP_STATUS_ERP_TIMEDOUT) {
+                        ZFCP_LOG_INFO("error: exchange of port data "
+                                      "for adapter %s timed out\n",
+                                      zfcp_get_busid_by_adapter(adapter));
+                        break;
+                }
+
+                if (!atomic_test_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED,
+                                      &adapter->status))
+                        break;
+
+                ZFCP_LOG_DEBUG("host connection still initialising... "
+                               "waiting and retrying...\n");
+                /* sleep a little bit before retry */
+                sleep = retries < ZFCP_EXCHANGE_PORT_DATA_SHORT_RETRIES ?
+                                ZFCP_EXCHANGE_PORT_DATA_SHORT_SLEEP :
+                                ZFCP_EXCHANGE_PORT_DATA_LONG_SLEEP;
+                msleep(jiffies_to_msecs(sleep));
+        }
+
+        if (atomic_test_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED,
+                             &adapter->status)) {
+                ZFCP_LOG_INFO("error: exchange of port data for "
+                              "adapter %s failed\n",
+                              zfcp_get_busid_by_adapter(adapter));
+                retval = ZFCP_ERP_FAILED;
+        }
+
+        return retval;
+}
+
 /*
  * function:    
  *
@@ -3194,11 +3272,19 @@ zfcp_erp_action_enqueue(int action,
                 /* fall through !!! */
 
         case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
-                if (atomic_test_mask
-                    (ZFCP_STATUS_COMMON_ERP_INUSE, &port->status)
-                    && port->erp_action.action ==
-                    ZFCP_ERP_ACTION_REOPEN_PORT_FORCED) {
-                        debug_text_event(adapter->erp_dbf, 4, "pf_actenq_drp");
+                if (atomic_test_mask(ZFCP_STATUS_COMMON_ERP_INUSE,
+                                     &port->status)) {
+                        if (port->erp_action.action !=
+                            ZFCP_ERP_ACTION_REOPEN_PORT_FORCED) {
+                                ZFCP_LOG_INFO("dropped erp action %i (port "
+                                              "0x%016Lx, action in use: %i)\n",
+                                              action, port->wwpn,
+                                              port->erp_action.action);
+                                debug_text_event(adapter->erp_dbf, 4,
+                                                 "pf_actenq_drp");
+                        } else 
+                                debug_text_event(adapter->erp_dbf, 4,
+                                                 "pf_actenq_drpcp");
                         debug_event(adapter->erp_dbf, 4, &port->wwpn,
                                     sizeof (wwn_t));
                         goto out;
@@ -3589,6 +3675,9 @@ zfcp_erp_adapter_access_changed(struct zfcp_adapter *adapter)
         struct zfcp_port *port;
         unsigned long flags;
 
+        if (adapter->connection_features & FSF_FEATURE_NPIV_MODE)
+                return;
+
         debug_text_event(adapter->erp_dbf, 3, "a_access_recover");
         debug_event(adapter->erp_dbf, 3, &adapter->name, 8);
 
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index cd98a2de9f8f..c3782261cb5c 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -96,7 +96,8 @@ extern int  zfcp_fsf_open_unit(struct zfcp_erp_action *);
 extern int  zfcp_fsf_close_unit(struct zfcp_erp_action *);
 
 extern int  zfcp_fsf_exchange_config_data(struct zfcp_erp_action *);
-extern int  zfcp_fsf_exchange_port_data(struct zfcp_adapter *,
+extern int  zfcp_fsf_exchange_port_data(struct zfcp_erp_action *,
+                                        struct zfcp_adapter *,
                                         struct fsf_qtcb_bottom_port *);
 extern int  zfcp_fsf_control_file(struct zfcp_adapter *, struct zfcp_fsf_req **,
                                   u32, u32, struct zfcp_sg_list *);
@@ -109,7 +110,6 @@ extern int zfcp_fsf_req_create(struct zfcp_adapter *, u32, int, mempool_t *,
 extern int zfcp_fsf_send_ct(struct zfcp_send_ct *, mempool_t *,
                             struct zfcp_erp_action *);
 extern int zfcp_fsf_send_els(struct zfcp_send_els *);
-extern int  zfcp_fsf_req_wait_and_cleanup(struct zfcp_fsf_req *, int, u32 *);
 extern int  zfcp_fsf_send_fcp_command_task(struct zfcp_adapter *,
                                            struct zfcp_unit *,
                                            struct scsi_cmnd *,
@@ -182,9 +182,25 @@ extern void zfcp_erp_port_access_changed(struct zfcp_port *);
 extern void zfcp_erp_unit_access_changed(struct zfcp_unit *);
 
 /******************************** AUX ****************************************/
-extern void zfcp_cmd_dbf_event_fsf(const char *, struct zfcp_fsf_req *,
-                                   void *, int);
-extern void zfcp_cmd_dbf_event_scsi(const char *, struct scsi_cmnd *);
-extern void zfcp_in_els_dbf_event(struct zfcp_adapter *, const char *,
-                                  struct fsf_status_read_buffer *, int);
+extern void zfcp_hba_dbf_event_fsf_response(struct zfcp_fsf_req *);
+extern void zfcp_hba_dbf_event_fsf_unsol(const char *, struct zfcp_adapter *,
+                                         struct fsf_status_read_buffer *);
+extern void zfcp_hba_dbf_event_qdio(struct zfcp_adapter *,
+                                    unsigned int, unsigned int, unsigned int,
+                                    int, int);
+
+extern void zfcp_san_dbf_event_ct_request(struct zfcp_fsf_req *);
+extern void zfcp_san_dbf_event_ct_response(struct zfcp_fsf_req *);
+extern void zfcp_san_dbf_event_els_request(struct zfcp_fsf_req *);
+extern void zfcp_san_dbf_event_els_response(struct zfcp_fsf_req *);
+extern void zfcp_san_dbf_event_incoming_els(struct zfcp_fsf_req *);
+
+extern void zfcp_scsi_dbf_event_result(const char *, int, struct zfcp_adapter *,
+                                       struct scsi_cmnd *);
+extern void zfcp_scsi_dbf_event_abort(const char *, struct zfcp_adapter *,
+                                      struct scsi_cmnd *,
+                                      struct zfcp_fsf_req *);
+extern void zfcp_scsi_dbf_event_devreset(const char *, u8, struct zfcp_unit *,
+                                         struct scsi_cmnd *);
+
 #endif  /* ZFCP_EXT_H */
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index c007b6424e74..3b0fc1163f5f 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -59,6 +59,8 @@ static int zfcp_fsf_req_send(struct zfcp_fsf_req *, struct timer_list *);
 static int zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *);
 static int zfcp_fsf_fsfstatus_eval(struct zfcp_fsf_req *);
 static int zfcp_fsf_fsfstatus_qual_eval(struct zfcp_fsf_req *);
+static void zfcp_fsf_link_down_info_eval(struct zfcp_adapter *,
+        struct fsf_link_down_info *);
 static int zfcp_fsf_req_dispatch(struct zfcp_fsf_req *);
 static void zfcp_fsf_req_dismiss(struct zfcp_fsf_req *);
 
@@ -285,51 +287,51 @@ zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *fsf_req)
 {
         int retval = 0;
         struct zfcp_adapter *adapter = fsf_req->adapter;
+        struct fsf_qtcb *qtcb = fsf_req->qtcb;
+        union fsf_prot_status_qual *prot_status_qual =
+                &qtcb->prefix.prot_status_qual;
 
-        ZFCP_LOG_DEBUG("QTCB is at %p\n", fsf_req->qtcb);
+        zfcp_hba_dbf_event_fsf_response(fsf_req);
 
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_DISMISSED) {
                 ZFCP_LOG_DEBUG("fsf_req 0x%lx has been dismissed\n",
                                (unsigned long) fsf_req);
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR |
                         ZFCP_STATUS_FSFREQ_RETRY; /* only for SCSI cmnds. */
-                zfcp_cmd_dbf_event_fsf("dismiss", fsf_req, NULL, 0);
                 goto skip_protstatus;
         }
 
         /* log additional information provided by FSF (if any) */
-        if (unlikely(fsf_req->qtcb->header.log_length)) {
+        if (unlikely(qtcb->header.log_length)) {
                 /* do not trust them ;-) */
-                if (fsf_req->qtcb->header.log_start > sizeof(struct fsf_qtcb)) {
+                if (qtcb->header.log_start > sizeof(struct fsf_qtcb)) {
                         ZFCP_LOG_NORMAL
                             ("bug: ULP (FSF logging) log data starts "
                              "beyond end of packet header. Ignored. "
                              "(start=%i, size=%li)\n",
-                             fsf_req->qtcb->header.log_start,
+                             qtcb->header.log_start,
                              sizeof(struct fsf_qtcb));
                         goto forget_log;
                 }
-                if ((size_t) (fsf_req->qtcb->header.log_start +
-                     fsf_req->qtcb->header.log_length)
+                if ((size_t) (qtcb->header.log_start + qtcb->header.log_length)
                     > sizeof(struct fsf_qtcb)) {
                         ZFCP_LOG_NORMAL("bug: ULP (FSF logging) log data ends "
                                         "beyond end of packet header. Ignored. "
                                         "(start=%i, length=%i, size=%li)\n",
-                                        fsf_req->qtcb->header.log_start,
-                                        fsf_req->qtcb->header.log_length,
+                                        qtcb->header.log_start,
+                                        qtcb->header.log_length,
                                         sizeof(struct fsf_qtcb));
                         goto forget_log;
                 }
                 ZFCP_LOG_TRACE("ULP log data: \n");
                 ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_TRACE,
-                              (char *) fsf_req->qtcb +
-                              fsf_req->qtcb->header.log_start,
-                              fsf_req->qtcb->header.log_length);
+                              (char *) qtcb + qtcb->header.log_start,
+                              qtcb->header.log_length);
         }
  forget_log:
 
         /* evaluate FSF Protocol Status */
-        switch (fsf_req->qtcb->prefix.prot_status) {
+        switch (qtcb->prefix.prot_status) {
 
         case FSF_PROT_GOOD:
         case FSF_PROT_FSF_STATUS_PRESENTED:
@@ -340,14 +342,9 @@ zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *fsf_req)
                                 "microcode of version 0x%x, the device driver "
                                 "only supports 0x%x. Aborting.\n",
                                 zfcp_get_busid_by_adapter(adapter),
-                                fsf_req->qtcb->prefix.prot_status_qual.
-                                version_error.fsf_version, ZFCP_QTCB_VERSION);
-                /* stop operation for this adapter */
-                debug_text_exception(adapter->erp_dbf, 0, "prot_ver_err");
+                                prot_status_qual->version_error.fsf_version,
+                                ZFCP_QTCB_VERSION);
                 zfcp_erp_adapter_shutdown(adapter, 0);
-                zfcp_cmd_dbf_event_fsf("qverserr", fsf_req,
-                                       &fsf_req->qtcb->prefix.prot_status_qual,
-                                       sizeof (union fsf_prot_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
@@ -355,16 +352,10 @@ zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *fsf_req)
                 ZFCP_LOG_NORMAL("bug: Sequence number mismatch between "
                                 "driver (0x%x) and adapter %s (0x%x). "
                                 "Restarting all operations on this adapter.\n",
-                                fsf_req->qtcb->prefix.req_seq_no,
+                                qtcb->prefix.req_seq_no,
                                 zfcp_get_busid_by_adapter(adapter),
-                                fsf_req->qtcb->prefix.prot_status_qual.
-                                sequence_error.exp_req_seq_no);
-                debug_text_exception(adapter->erp_dbf, 0, "prot_seq_err");
-                /* restart operation on this adapter */
+                                prot_status_qual->sequence_error.exp_req_seq_no);
                 zfcp_erp_adapter_reopen(adapter, 0);
-                zfcp_cmd_dbf_event_fsf("seqnoerr", fsf_req,
-                                       &fsf_req->qtcb->prefix.prot_status_qual,
-                                       sizeof (union fsf_prot_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_RETRY;
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
@@ -375,116 +366,35 @@ zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *fsf_req)
                                 "that used on adapter %s. "
                                 "Stopping all operations on this adapter.\n",
                                 zfcp_get_busid_by_adapter(adapter));
-                debug_text_exception(adapter->erp_dbf, 0, "prot_unsup_qtcb");
                 zfcp_erp_adapter_shutdown(adapter, 0);
-                zfcp_cmd_dbf_event_fsf("unsqtcbt", fsf_req,
-                                       &fsf_req->qtcb->prefix.prot_status_qual,
-                                       sizeof (union fsf_prot_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
         case FSF_PROT_HOST_CONNECTION_INITIALIZING:
-                zfcp_cmd_dbf_event_fsf("hconinit", fsf_req,
-                                       &fsf_req->qtcb->prefix.prot_status_qual,
-                                       sizeof (union fsf_prot_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 atomic_set_mask(ZFCP_STATUS_ADAPTER_HOST_CON_INIT,
                                 &(adapter->status));
-                debug_text_event(adapter->erp_dbf, 3, "prot_con_init");
                 break;
 
         case FSF_PROT_DUPLICATE_REQUEST_ID:
-                if (fsf_req->qtcb) {
                         ZFCP_LOG_NORMAL("bug: The request identifier 0x%Lx "
                                         "to the adapter %s is ambiguous. "
-                                        "Stopping all operations on this "
-                                        "adapter.\n",
-                                        *(unsigned long long *)
-                                        (&fsf_req->qtcb->bottom.support.
-                                         req_handle),
-                                        zfcp_get_busid_by_adapter(adapter));
-                } else {
-                        ZFCP_LOG_NORMAL("bug: The request identifier %p "
-                                        "to the adapter %s is ambiguous. "
-                                        "Stopping all operations on this "
-                                        "adapter. "
-                                        "(bug: got this for an unsolicited "
-                                        "status read request)\n",
-                                        fsf_req,
+                                "Stopping all operations on this adapter.\n",
+                                *(unsigned long long*)
+                                (&qtcb->bottom.support.req_handle),
                                         zfcp_get_busid_by_adapter(adapter));
-                }
-                debug_text_exception(adapter->erp_dbf, 0, "prot_dup_id");
                 zfcp_erp_adapter_shutdown(adapter, 0);
-                zfcp_cmd_dbf_event_fsf("dupreqid", fsf_req,
-                                       &fsf_req->qtcb->prefix.prot_status_qual,
-                                       sizeof (union fsf_prot_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
         case FSF_PROT_LINK_DOWN:
-                /*
-                 * 'test and set' is not atomic here -
-                 * it's ok as long as calls to our response queue handler
-                 * (and thus execution of this code here) are serialized
-                 * by the qdio module
-                 */
-                if (!atomic_test_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED,
-                                      &adapter->status)) {
-                        switch (fsf_req->qtcb->prefix.prot_status_qual.
-                                locallink_error.code) {
-                        case FSF_PSQ_LINK_NOLIGHT:
-                                ZFCP_LOG_INFO("The local link to adapter %s "
-                                              "is down (no light detected).\n",
-                                              zfcp_get_busid_by_adapter(
-                                                      adapter));
-                                break;
-                        case FSF_PSQ_LINK_WRAPPLUG:
-                                ZFCP_LOG_INFO("The local link to adapter %s "
-                                              "is down (wrap plug detected).\n",
-                                              zfcp_get_busid_by_adapter(
-                                                      adapter));
-                                break;
-                        case FSF_PSQ_LINK_NOFCP:
-                                ZFCP_LOG_INFO("The local link to adapter %s "
-                                              "is down (adjacent node on "
-                                              "link does not support FCP).\n",
-                                              zfcp_get_busid_by_adapter(
-                                                      adapter));
-                                break;
-                        default:
-                                ZFCP_LOG_INFO("The local link to adapter %s "
-                                              "is down "
-                                              "(warning: unknown reason "
-                                              "code).\n",
-                                              zfcp_get_busid_by_adapter(
-                                                      adapter));
-                                break;
-
-                        }
-                        /*
-                         * Due to the 'erp failed' flag the adapter won't
-                         * be recovered but will be just set to 'blocked'
-                         * state. All subordinary devices will have state
-                         * 'blocked' and 'erp failed', too.
-                         * Thus the adapter is still able to provide
-                         * 'link up' status without being flooded with
-                         * requests.
-                         * (note: even 'close port' is not permitted)
-                         */
-                        ZFCP_LOG_INFO("Stopping all operations for adapter "
-                                      "%s.\n",
-                                      zfcp_get_busid_by_adapter(adapter));
-                        atomic_set_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED |
-                                        ZFCP_STATUS_COMMON_ERP_FAILED,
-                                        &adapter->status);
-                        zfcp_erp_adapter_reopen(adapter, 0);
-                }
+                zfcp_fsf_link_down_info_eval(adapter,
+                                             &prot_status_qual->link_down_info);
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
         case FSF_PROT_REEST_QUEUE:
-                debug_text_event(adapter->erp_dbf, 1, "prot_reest_queue");
-                ZFCP_LOG_INFO("The local link to adapter with "
+                ZFCP_LOG_NORMAL("The local link to adapter with "
                               "%s was re-plugged. "
                               "Re-starting operations on this adapter.\n",
                               zfcp_get_busid_by_adapter(adapter));
@@ -495,9 +405,6 @@ zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *fsf_req)
                 zfcp_erp_adapter_reopen(adapter,
                                         ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED
                                         | ZFCP_STATUS_COMMON_ERP_FAILED);
-                zfcp_cmd_dbf_event_fsf("reestque", fsf_req,
-                                       &fsf_req->qtcb->prefix.prot_status_qual,
-                                       sizeof (union fsf_prot_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
@@ -507,12 +414,7 @@ zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *fsf_req)
                                 "Restarting all operations on this "
                                 "adapter.\n",
                                 zfcp_get_busid_by_adapter(adapter));
-                debug_text_event(adapter->erp_dbf, 0, "prot_err_sta");
-                /* restart operation on this adapter */
                 zfcp_erp_adapter_reopen(adapter, 0);
-                zfcp_cmd_dbf_event_fsf("proterrs", fsf_req,
-                                       &fsf_req->qtcb->prefix.prot_status_qual,
-                                       sizeof (union fsf_prot_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_RETRY;
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
@@ -524,11 +426,7 @@ zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *fsf_req)
                                 "Stopping all operations on this adapter. "
                                 "(debug info 0x%x).\n",
                                 zfcp_get_busid_by_adapter(adapter),
-                                fsf_req->qtcb->prefix.prot_status);
-                debug_text_event(adapter->erp_dbf, 0, "prot_inval:");
-                debug_exception(adapter->erp_dbf, 0,
-                                &fsf_req->qtcb->prefix.prot_status,
-                                sizeof (u32));
+                                qtcb->prefix.prot_status);
                 zfcp_erp_adapter_shutdown(adapter, 0);
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
         }
@@ -568,28 +466,18 @@ zfcp_fsf_fsfstatus_eval(struct zfcp_fsf_req *fsf_req)
                                 "(debug info 0x%x).\n",
                                 zfcp_get_busid_by_adapter(fsf_req->adapter),
                                 fsf_req->qtcb->header.fsf_command);
-                debug_text_exception(fsf_req->adapter->erp_dbf, 0,
-                                     "fsf_s_unknown");
                 zfcp_erp_adapter_shutdown(fsf_req->adapter, 0);
-                zfcp_cmd_dbf_event_fsf("unknownc", fsf_req,
-                                       &fsf_req->qtcb->header.fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
         case FSF_FCP_RSP_AVAILABLE:
                 ZFCP_LOG_DEBUG("FCP Sense data will be presented to the "
                                "SCSI stack.\n");
-                debug_text_event(fsf_req->adapter->erp_dbf, 3, "fsf_s_rsp");
                 break;
 
         case FSF_ADAPTER_STATUS_AVAILABLE:
-                debug_text_event(fsf_req->adapter->erp_dbf, 2, "fsf_s_astatus");
                 zfcp_fsf_fsfstatus_qual_eval(fsf_req);
                 break;
-
-        default:
-                break;
         }
 
  skip_fsfstatus:
@@ -617,44 +505,28 @@ zfcp_fsf_fsfstatus_qual_eval(struct zfcp_fsf_req *fsf_req)
 
         switch (fsf_req->qtcb->header.fsf_status_qual.word[0]) {
         case FSF_SQ_FCP_RSP_AVAILABLE:
-                debug_text_event(fsf_req->adapter->erp_dbf, 4, "fsf_sq_rsp");
                 break;
         case FSF_SQ_RETRY_IF_POSSIBLE:
                 /* The SCSI-stack may now issue retries or escalate */
-                debug_text_event(fsf_req->adapter->erp_dbf, 2, "fsf_sq_retry");
-                zfcp_cmd_dbf_event_fsf("sqretry", fsf_req,
-                                       &fsf_req->qtcb->header.fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
         case FSF_SQ_COMMAND_ABORTED:
                 /* Carry the aborted state on to upper layer */
-                debug_text_event(fsf_req->adapter->erp_dbf, 2, "fsf_sq_abort");
-                zfcp_cmd_dbf_event_fsf("sqabort", fsf_req,
-                                       &fsf_req->qtcb->header.fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ABORTED;
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
         case FSF_SQ_NO_RECOM:
-                debug_text_exception(fsf_req->adapter->erp_dbf, 0,
-                                     "fsf_sq_no_rec");
                 ZFCP_LOG_NORMAL("bug: No recommendation could be given for a"
                                 "problem on the adapter %s "
                                 "Stopping all operations on this adapter. ",
                                 zfcp_get_busid_by_adapter(fsf_req->adapter));
                 zfcp_erp_adapter_shutdown(fsf_req->adapter, 0);
-                zfcp_cmd_dbf_event_fsf("sqnrecom", fsf_req,
-                                       &fsf_req->qtcb->header.fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
         case FSF_SQ_ULP_PROGRAMMING_ERROR:
                 ZFCP_LOG_NORMAL("error: not enough SBALs for data transfer "
                                 "(adapter %s)\n",
                                 zfcp_get_busid_by_adapter(fsf_req->adapter));
-                debug_text_exception(fsf_req->adapter->erp_dbf, 0,
-                                     "fsf_sq_ulp_err");
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
         case FSF_SQ_INVOKE_LINK_TEST_PROCEDURE:
@@ -668,13 +540,6 @@ zfcp_fsf_fsfstatus_qual_eval(struct zfcp_fsf_req *fsf_req)
                 ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_NORMAL,
                               (char *) &fsf_req->qtcb->header.fsf_status_qual,
                               sizeof (union fsf_status_qual));
-                debug_text_event(fsf_req->adapter->erp_dbf, 0, "fsf_sq_inval:");
-                debug_exception(fsf_req->adapter->erp_dbf, 0,
-                                &fsf_req->qtcb->header.fsf_status_qual.word[0],
-                                sizeof (u32));
-                zfcp_cmd_dbf_event_fsf("squndef", fsf_req,
-                                       &fsf_req->qtcb->header.fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
         }
@@ -682,6 +547,110 @@ zfcp_fsf_fsfstatus_qual_eval(struct zfcp_fsf_req *fsf_req)
         return retval;
 }
 
+/**
+ * zfcp_fsf_link_down_info_eval - evaluate link down information block
+ */
+static void
+zfcp_fsf_link_down_info_eval(struct zfcp_adapter *adapter,
+                             struct fsf_link_down_info *link_down)
+{
+        switch (link_down->error_code) {
+        case FSF_PSQ_LINK_NO_LIGHT:
+                ZFCP_LOG_NORMAL("The local link to adapter %s is down "
+                                "(no light detected)\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        case FSF_PSQ_LINK_WRAP_PLUG:
+                ZFCP_LOG_NORMAL("The local link to adapter %s is down "
+                                "(wrap plug detected)\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        case FSF_PSQ_LINK_NO_FCP:
+                ZFCP_LOG_NORMAL("The local link to adapter %s is down "
+                                "(adjacent node on link does not support FCP)\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        case FSF_PSQ_LINK_FIRMWARE_UPDATE:
+                ZFCP_LOG_NORMAL("The local link to adapter %s is down "
+                                "(firmware update in progress)\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                        break;
+        case FSF_PSQ_LINK_INVALID_WWPN:
+                ZFCP_LOG_NORMAL("The local link to adapter %s is down "
+                                "(duplicate or invalid WWPN detected)\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        case FSF_PSQ_LINK_NO_NPIV_SUPPORT:
+                ZFCP_LOG_NORMAL("The local link to adapter %s is down "
+                                "(no support for NPIV by Fabric)\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        case FSF_PSQ_LINK_NO_FCP_RESOURCES:
+                ZFCP_LOG_NORMAL("The local link to adapter %s is down "
+                                "(out of resource in FCP daughtercard)\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        case FSF_PSQ_LINK_NO_FABRIC_RESOURCES:
+                ZFCP_LOG_NORMAL("The local link to adapter %s is down "
+                                "(out of resource in Fabric)\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        case FSF_PSQ_LINK_FABRIC_LOGIN_UNABLE:
+                ZFCP_LOG_NORMAL("The local link to adapter %s is down "
+                                "(unable to Fabric login)\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        case FSF_PSQ_LINK_WWPN_ASSIGNMENT_CORRUPTED:
+                ZFCP_LOG_NORMAL("WWPN assignment file corrupted on adapter %s\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        case FSF_PSQ_LINK_MODE_TABLE_CURRUPTED:
+                ZFCP_LOG_NORMAL("Mode table corrupted on adapter %s\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        case FSF_PSQ_LINK_NO_WWPN_ASSIGNMENT:
+                ZFCP_LOG_NORMAL("No WWPN for assignment table on adapter %s\n",
+                                zfcp_get_busid_by_adapter(adapter));
+                break;
+        default:
+                ZFCP_LOG_NORMAL("The local link to adapter %s is down "
+                                "(warning: unknown reason code %d)\n",
+                                zfcp_get_busid_by_adapter(adapter),
+                                link_down->error_code);
+        }
+
+        if (adapter->connection_features & FSF_FEATURE_NPIV_MODE)
+                ZFCP_LOG_DEBUG("Debug information to link down: "
+                               "primary_status=0x%02x "
+                               "ioerr_code=0x%02x "
+                               "action_code=0x%02x "
+                               "reason_code=0x%02x "
+                               "explanation_code=0x%02x "
+                               "vendor_specific_code=0x%02x\n",
+                                link_down->primary_status,
+                                link_down->ioerr_code,
+                                link_down->action_code,
+                                link_down->reason_code,
+                                link_down->explanation_code,
+                                link_down->vendor_specific_code);
+
+        if (!atomic_test_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED,
+                              &adapter->status)) {
+                atomic_set_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED,
+                                &adapter->status);
+                switch (link_down->error_code) {
+                case FSF_PSQ_LINK_NO_LIGHT:
+                case FSF_PSQ_LINK_WRAP_PLUG:
+                case FSF_PSQ_LINK_NO_FCP:
+                case FSF_PSQ_LINK_FIRMWARE_UPDATE:
+                        zfcp_erp_adapter_reopen(adapter, 0);
+                        break;
+                default:
+                        zfcp_erp_adapter_failed(adapter);
+                }
+        }
+}
+
 /*
  * function:    zfcp_fsf_req_dispatch
  *
@@ -696,11 +665,6 @@ zfcp_fsf_req_dispatch(struct zfcp_fsf_req *fsf_req)
         struct zfcp_adapter *adapter = fsf_req->adapter;
         int retval = 0;
 
-        if (unlikely(fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR)) {
-                ZFCP_LOG_TRACE("fsf_req=%p, QTCB=%p\n", fsf_req, fsf_req->qtcb);
-                ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_TRACE,
-                              (char *) fsf_req->qtcb, sizeof(struct fsf_qtcb));
-        }
 
         switch (fsf_req->fsf_command) {
 
@@ -760,13 +724,13 @@ zfcp_fsf_req_dispatch(struct zfcp_fsf_req *fsf_req)
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 ZFCP_LOG_NORMAL("bug: Command issued by the device driver is "
                                 "not supported by the adapter %s\n",
-                                zfcp_get_busid_by_adapter(fsf_req->adapter));
+                                zfcp_get_busid_by_adapter(adapter));
                 if (fsf_req->fsf_command != fsf_req->qtcb->header.fsf_command)
                         ZFCP_LOG_NORMAL
                             ("bug: Command issued by the device driver differs "
                              "from the command returned by the adapter %s "
                              "(debug info 0x%x, 0x%x).\n",
-                             zfcp_get_busid_by_adapter(fsf_req->adapter),
+                             zfcp_get_busid_by_adapter(adapter),
                              fsf_req->fsf_command,
                              fsf_req->qtcb->header.fsf_command);
         }
@@ -774,8 +738,6 @@ zfcp_fsf_req_dispatch(struct zfcp_fsf_req *fsf_req)
         if (!erp_action)
                 return retval;
 
-        debug_text_event(adapter->erp_dbf, 3, "a_frh");
-        debug_event(adapter->erp_dbf, 3, &erp_action->action, sizeof (int));
         zfcp_erp_async_handler(erp_action, 0);
 
         return retval;
@@ -821,7 +783,7 @@ zfcp_fsf_status_read(struct zfcp_adapter *adapter, int req_flags)
                 goto failed_buf;
         }
         memset(status_buffer, 0, sizeof (struct fsf_status_read_buffer));
-        fsf_req->data.status_read.buffer = status_buffer;
+        fsf_req->data = (unsigned long) status_buffer;
 
         /* insert pointer to respective buffer */
         sbale = zfcp_qdio_sbale_curr(fsf_req);
@@ -846,6 +808,7 @@ zfcp_fsf_status_read(struct zfcp_adapter *adapter, int req_flags)
  failed_buf:
         zfcp_fsf_req_free(fsf_req);
  failed_req_create:
+        zfcp_hba_dbf_event_fsf_unsol("fail", adapter, NULL);
  out:
         write_unlock_irqrestore(&adapter->request_queue.queue_lock, lock_flags);
         return retval;
@@ -859,7 +822,7 @@ zfcp_fsf_status_read_port_closed(struct zfcp_fsf_req *fsf_req)
         struct zfcp_port *port;
         unsigned long flags;
 
-        status_buffer = fsf_req->data.status_read.buffer;
+        status_buffer = (struct fsf_status_read_buffer *) fsf_req->data;
         adapter = fsf_req->adapter;
 
         read_lock_irqsave(&zfcp_data.config_lock, flags);
@@ -918,38 +881,33 @@ zfcp_fsf_status_read_handler(struct zfcp_fsf_req *fsf_req)
         int retval = 0;
         struct zfcp_adapter *adapter = fsf_req->adapter;
         struct fsf_status_read_buffer *status_buffer =
-            fsf_req->data.status_read.buffer;
+                (struct fsf_status_read_buffer *) fsf_req->data;
 
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_DISMISSED) {
+                zfcp_hba_dbf_event_fsf_unsol("dism", adapter, status_buffer);
                 mempool_free(status_buffer, adapter->pool.data_status_read);
                 zfcp_fsf_req_free(fsf_req);
                 goto out;
         }
 
+        zfcp_hba_dbf_event_fsf_unsol("read", adapter, status_buffer);
+
         switch (status_buffer->status_type) {
 
         case FSF_STATUS_READ_PORT_CLOSED:
-                debug_text_event(adapter->erp_dbf, 3, "unsol_pclosed:");
-                debug_event(adapter->erp_dbf, 3,
-                            &status_buffer->d_id, sizeof (u32));
                 zfcp_fsf_status_read_port_closed(fsf_req);
                 break;
 
         case FSF_STATUS_READ_INCOMING_ELS:
-                debug_text_event(adapter->erp_dbf, 3, "unsol_els:");
                 zfcp_fsf_incoming_els(fsf_req);
                 break;
 
         case FSF_STATUS_READ_SENSE_DATA_AVAIL:
-                debug_text_event(adapter->erp_dbf, 3, "unsol_sense:");
                 ZFCP_LOG_INFO("unsolicited sense data received (adapter %s)\n",
                               zfcp_get_busid_by_adapter(adapter));
-                ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_NORMAL, (char *) status_buffer,
-                              sizeof(struct fsf_status_read_buffer));
                 break;
 
         case FSF_STATUS_READ_BIT_ERROR_THRESHOLD:
-                debug_text_event(adapter->erp_dbf, 3, "unsol_bit_err:");
                 ZFCP_LOG_NORMAL("Bit error threshold data received:\n");
                 ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_NORMAL,
                               (char *) status_buffer,
@@ -957,17 +915,32 @@ zfcp_fsf_status_read_handler(struct zfcp_fsf_req *fsf_req)
                 break;
 
         case FSF_STATUS_READ_LINK_DOWN:
-                debug_text_event(adapter->erp_dbf, 0, "unsol_link_down:");
-                ZFCP_LOG_INFO("Local link to adapter %s is down\n",
+                switch (status_buffer->status_subtype) {
+                case FSF_STATUS_READ_SUB_NO_PHYSICAL_LINK:
+                        ZFCP_LOG_INFO("Physical link to adapter %s is down\n",
+                                      zfcp_get_busid_by_adapter(adapter));
+                        break;
+                case FSF_STATUS_READ_SUB_FDISC_FAILED:
+                        ZFCP_LOG_INFO("Local link to adapter %s is down "
+                                      "due to failed FDISC login\n",
                               zfcp_get_busid_by_adapter(adapter));
-                atomic_set_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED,
-                                &adapter->status);
-                zfcp_erp_adapter_failed(adapter);
+                        break;
+                case FSF_STATUS_READ_SUB_FIRMWARE_UPDATE:
+                        ZFCP_LOG_INFO("Local link to adapter %s is down "
+                                      "due to firmware update on adapter\n",
+                                      zfcp_get_busid_by_adapter(adapter));
+                        break;
+                default:
+                        ZFCP_LOG_INFO("Local link to adapter %s is down "
+                                      "due to unknown reason\n",
+                                      zfcp_get_busid_by_adapter(adapter));
+                };
+                zfcp_fsf_link_down_info_eval(adapter,
+                        (struct fsf_link_down_info *) &status_buffer->payload);
                 break;
 
         case FSF_STATUS_READ_LINK_UP:
-                debug_text_event(adapter->erp_dbf, 2, "unsol_link_up:");
-                ZFCP_LOG_INFO("Local link to adapter %s was replugged. "
+                ZFCP_LOG_NORMAL("Local link to adapter %s was replugged. "
                               "Restarting operations on this adapter\n",
                               zfcp_get_busid_by_adapter(adapter));
                 /* All ports should be marked as ready to run again */
@@ -980,35 +953,40 @@ zfcp_fsf_status_read_handler(struct zfcp_fsf_req *fsf_req)
                 break;
 
         case FSF_STATUS_READ_CFDC_UPDATED:
-                debug_text_event(adapter->erp_dbf, 2, "unsol_cfdc_update:");
-                ZFCP_LOG_INFO("CFDC has been updated on the adapter %s\n",
+                ZFCP_LOG_NORMAL("CFDC has been updated on the adapter %s\n",
                               zfcp_get_busid_by_adapter(adapter));
                 zfcp_erp_adapter_access_changed(adapter);
                 break;
 
         case FSF_STATUS_READ_CFDC_HARDENED:
-                debug_text_event(adapter->erp_dbf, 2, "unsol_cfdc_harden:");
                 switch (status_buffer->status_subtype) {
                 case FSF_STATUS_READ_SUB_CFDC_HARDENED_ON_SE:
-                        ZFCP_LOG_INFO("CFDC of adapter %s saved on SE\n",
+                        ZFCP_LOG_NORMAL("CFDC of adapter %s saved on SE\n",
                                       zfcp_get_busid_by_adapter(adapter));
                         break;
                 case FSF_STATUS_READ_SUB_CFDC_HARDENED_ON_SE2:
-                        ZFCP_LOG_INFO("CFDC of adapter %s has been copied "
+                        ZFCP_LOG_NORMAL("CFDC of adapter %s has been copied "
                                       "to the secondary SE\n",
                                 zfcp_get_busid_by_adapter(adapter));
                         break;
                 default:
-                        ZFCP_LOG_INFO("CFDC of adapter %s has been hardened\n",
+                        ZFCP_LOG_NORMAL("CFDC of adapter %s has been hardened\n",
                                       zfcp_get_busid_by_adapter(adapter));
                 }
                 break;
 
+        case FSF_STATUS_READ_FEATURE_UPDATE_ALERT:
+                debug_text_event(adapter->erp_dbf, 2, "unsol_features:");
+                ZFCP_LOG_INFO("List of supported features on adapter %s has "
+                              "been changed from 0x%08X to 0x%08X\n",
+                              zfcp_get_busid_by_adapter(adapter),
+                              *(u32*) (status_buffer->payload + 4),
+                              *(u32*) (status_buffer->payload));
+                adapter->adapter_features = *(u32*) status_buffer->payload;
+                break;
+
         default:
-                debug_text_event(adapter->erp_dbf, 0, "unsol_unknown:");
-                debug_exception(adapter->erp_dbf, 0,
-                                &status_buffer->status_type, sizeof (u32));
-                ZFCP_LOG_NORMAL("bug: An unsolicited status packet of unknown "
+                ZFCP_LOG_NORMAL("warning: An unsolicited status packet of unknown "
                                 "type was received (debug info 0x%x)\n",
                                 status_buffer->status_type);
                 ZFCP_LOG_DEBUG("Dump of status_read_buffer %p:\n",
@@ -1093,7 +1071,7 @@ zfcp_fsf_abort_fcp_command(unsigned long old_req_id,
         sbale[0].flags |= SBAL_FLAGS0_TYPE_READ;
         sbale[1].flags |= SBAL_FLAGS_LAST_ENTRY;
 
-        fsf_req->data.abort_fcp_command.unit = unit;
+        fsf_req->data = (unsigned long) unit;
 
         /* set handles of unit and its parent port in QTCB */
         fsf_req->qtcb->header.lun_handle = unit->handle;
@@ -1139,7 +1117,7 @@ static int
 zfcp_fsf_abort_fcp_command_handler(struct zfcp_fsf_req *new_fsf_req)
 {
         int retval = -EINVAL;
-        struct zfcp_unit *unit = new_fsf_req->data.abort_fcp_command.unit;
+        struct zfcp_unit *unit;
         unsigned char status_qual =
             new_fsf_req->qtcb->header.fsf_status_qual.word[0];
 
@@ -1150,6 +1128,8 @@ zfcp_fsf_abort_fcp_command_handler(struct zfcp_fsf_req *new_fsf_req)
                 goto skip_fsfstatus;
         }
 
+        unit = (struct zfcp_unit *) new_fsf_req->data;
+
         /* evaluate FSF status in QTCB */
         switch (new_fsf_req->qtcb->header.fsf_status) {
 
@@ -1364,7 +1344,7 @@ zfcp_fsf_send_ct(struct zfcp_send_ct *ct, mempool_t *pool,
                 sbale[3].addr = zfcp_sg_to_address(&ct->resp[0]);
                 sbale[3].length = ct->resp[0].length;
                 sbale[3].flags |= SBAL_FLAGS_LAST_ENTRY;
-        } else if (adapter->supported_features &
+        } else if (adapter->adapter_features &
                    FSF_FEATURE_ELS_CT_CHAINED_SBALS) {
                 /* try to use chained SBALs */
                 bytes = zfcp_qdio_sbals_from_sg(fsf_req,
@@ -1414,7 +1394,9 @@ zfcp_fsf_send_ct(struct zfcp_send_ct *ct, mempool_t *pool,
         fsf_req->qtcb->header.port_handle = port->handle;
         fsf_req->qtcb->bottom.support.service_class = adapter->fc_service_class;
         fsf_req->qtcb->bottom.support.timeout = ct->timeout;
-        fsf_req->data.send_ct = ct;
+        fsf_req->data = (unsigned long) ct;
+
+        zfcp_san_dbf_event_ct_request(fsf_req);
 
         /* start QDIO request for this FSF request */
         ret = zfcp_fsf_req_send(fsf_req, ct->timer);
@@ -1445,10 +1427,10 @@ zfcp_fsf_send_ct(struct zfcp_send_ct *ct, mempool_t *pool,
  * zfcp_fsf_send_ct_handler - handler for Generic Service requests
  * @fsf_req: pointer to struct zfcp_fsf_req
  *
- * Data specific for the Generic Service request is passed by
- * fsf_req->data.send_ct
- * Usually a specific handler for the request is called via
- * fsf_req->data.send_ct->handler at end of this function.
+ * Data specific for the Generic Service request is passed using
+ * fsf_req->data. There we find the pointer to struct zfcp_send_ct.
+ * Usually a specific handler for the CT request is called which is
+ * found in this structure.
  */
 static int
 zfcp_fsf_send_ct_handler(struct zfcp_fsf_req *fsf_req)
@@ -1462,7 +1444,7 @@ zfcp_fsf_send_ct_handler(struct zfcp_fsf_req *fsf_req)
         u16 subtable, rule, counter;
 
         adapter = fsf_req->adapter;
-        send_ct = fsf_req->data.send_ct;
+        send_ct = (struct zfcp_send_ct *) fsf_req->data;
         port = send_ct->port;
         header = &fsf_req->qtcb->header;
         bottom = &fsf_req->qtcb->bottom.support;
@@ -1474,6 +1456,7 @@ zfcp_fsf_send_ct_handler(struct zfcp_fsf_req *fsf_req)
         switch (header->fsf_status) {
 
         case FSF_GOOD:
+                zfcp_san_dbf_event_ct_response(fsf_req);
                 retval = 0;
                 break;
 
@@ -1634,7 +1617,7 @@ zfcp_fsf_send_els(struct zfcp_send_els *els)
 {
         volatile struct qdio_buffer_element *sbale;
         struct zfcp_fsf_req *fsf_req;
-        fc_id_t d_id;
+        u32 d_id;
         struct zfcp_adapter *adapter;
         unsigned long lock_flags;
         int bytes;
@@ -1664,7 +1647,7 @@ zfcp_fsf_send_els(struct zfcp_send_els *els)
                 sbale[3].addr = zfcp_sg_to_address(&els->resp[0]);
                 sbale[3].length = els->resp[0].length;
                 sbale[3].flags |= SBAL_FLAGS_LAST_ENTRY;
-        } else if (adapter->supported_features &
+        } else if (adapter->adapter_features &
                    FSF_FEATURE_ELS_CT_CHAINED_SBALS) {
                 /* try to use chained SBALs */
                 bytes = zfcp_qdio_sbals_from_sg(fsf_req,
@@ -1714,10 +1697,12 @@ zfcp_fsf_send_els(struct zfcp_send_els *els)
         fsf_req->qtcb->bottom.support.d_id = d_id;
         fsf_req->qtcb->bottom.support.service_class = adapter->fc_service_class;
         fsf_req->qtcb->bottom.support.timeout = ZFCP_ELS_TIMEOUT;
-        fsf_req->data.send_els = els;
+        fsf_req->data = (unsigned long) els;
 
         sbale = zfcp_qdio_sbale_req(fsf_req, fsf_req->sbal_curr, 0);
 
+        zfcp_san_dbf_event_els_request(fsf_req);
+
         /* start QDIO request for this FSF request */
         ret = zfcp_fsf_req_send(fsf_req, els->timer);
         if (ret) {
@@ -1746,23 +1731,23 @@ zfcp_fsf_send_els(struct zfcp_send_els *els)
  * zfcp_fsf_send_els_handler - handler for ELS commands
  * @fsf_req: pointer to struct zfcp_fsf_req
  *
- * Data specific for the ELS command is passed by
- * fsf_req->data.send_els
- * Usually a specific handler for the command is called via
- * fsf_req->data.send_els->handler at end of this function.
+ * Data specific for the ELS command is passed using
+ * fsf_req->data. There we find the pointer to struct zfcp_send_els.
+ * Usually a specific handler for the ELS command is called which is
+ * found in this structure.
  */
 static int zfcp_fsf_send_els_handler(struct zfcp_fsf_req *fsf_req)
 {
         struct zfcp_adapter *adapter;
         struct zfcp_port *port;
-        fc_id_t d_id;
+        u32 d_id;
         struct fsf_qtcb_header *header;
         struct fsf_qtcb_bottom_support *bottom;
         struct zfcp_send_els *send_els;
         int retval = -EINVAL;
         u16 subtable, rule, counter;
 
-        send_els = fsf_req->data.send_els;
+        send_els = (struct zfcp_send_els *) fsf_req->data;
         adapter = send_els->adapter;
         port = send_els->port;
         d_id = send_els->d_id;
@@ -1775,6 +1760,7 @@ static int zfcp_fsf_send_els_handler(struct zfcp_fsf_req *fsf_req)
         switch (header->fsf_status) {
 
         case FSF_GOOD:
+                zfcp_san_dbf_event_els_response(fsf_req);
                 retval = 0;
                 break;
 
@@ -1954,7 +1940,9 @@ zfcp_fsf_exchange_config_data(struct zfcp_erp_action *erp_action)
 
         erp_action->fsf_req->erp_action = erp_action;
         erp_action->fsf_req->qtcb->bottom.config.feature_selection =
-                (FSF_FEATURE_CFDC | FSF_FEATURE_LUN_SHARING);
+                        FSF_FEATURE_CFDC |
+                        FSF_FEATURE_LUN_SHARING |
+                        FSF_FEATURE_UPDATE_ALERT;
 
         /* start QDIO request for this FSF request */
         retval = zfcp_fsf_req_send(erp_action->fsf_req, &erp_action->timer);
@@ -1990,29 +1978,36 @@ zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *fsf_req, int xchg_ok)
 {
         struct fsf_qtcb_bottom_config *bottom;
         struct zfcp_adapter *adapter = fsf_req->adapter;
+        struct Scsi_Host *shost = adapter->scsi_host;
 
         bottom = &fsf_req->qtcb->bottom.config;
         ZFCP_LOG_DEBUG("low/high QTCB version 0x%x/0x%x of FSF\n",
                        bottom->low_qtcb_version, bottom->high_qtcb_version);
         adapter->fsf_lic_version = bottom->lic_version;
-        adapter->supported_features = bottom->supported_features;
+        adapter->adapter_features = bottom->adapter_features;
+        adapter->connection_features = bottom->connection_features;
         adapter->peer_wwpn = 0;
         adapter->peer_wwnn = 0;
         adapter->peer_d_id = 0;
 
         if (xchg_ok) {
-                adapter->wwnn = bottom->nport_serv_param.wwnn;
-                adapter->wwpn = bottom->nport_serv_param.wwpn;
-                adapter->s_id = bottom->s_id & ZFCP_DID_MASK;
+                fc_host_node_name(shost) = bottom->nport_serv_param.wwnn;
+                fc_host_port_name(shost) = bottom->nport_serv_param.wwpn;
+                fc_host_port_id(shost) = bottom->s_id & ZFCP_DID_MASK;
+                fc_host_speed(shost) = bottom->fc_link_speed;
+                fc_host_supported_classes(shost) = FC_COS_CLASS2 | FC_COS_CLASS3;
                 adapter->fc_topology = bottom->fc_topology;
-                adapter->fc_link_speed = bottom->fc_link_speed;
                 adapter->hydra_version = bottom->adapter_type;
+                if (adapter->physical_wwpn == 0)
+                        adapter->physical_wwpn = fc_host_port_name(shost);
+                if (adapter->physical_s_id == 0)
+                        adapter->physical_s_id = fc_host_port_id(shost);
         } else {
-                adapter->wwnn = 0;
-                adapter->wwpn = 0;
-                adapter->s_id = 0;
+                fc_host_node_name(shost) = 0;
+                fc_host_port_name(shost) = 0;
+                fc_host_port_id(shost) = 0;
+                fc_host_speed(shost) = FC_PORTSPEED_UNKNOWN;
                 adapter->fc_topology = 0;
-                adapter->fc_link_speed = 0;
                 adapter->hydra_version = 0;
         }
 
@@ -2022,26 +2017,28 @@ zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *fsf_req, int xchg_ok)
                 adapter->peer_wwnn = bottom->plogi_payload.wwnn;
         }
 
-        if(adapter->supported_features & FSF_FEATURE_HBAAPI_MANAGEMENT){
+        if (adapter->adapter_features & FSF_FEATURE_HBAAPI_MANAGEMENT) {
                 adapter->hardware_version = bottom->hardware_version;
-                memcpy(adapter->serial_number, bottom->serial_number, 17);
-                EBCASC(adapter->serial_number, sizeof(adapter->serial_number));
+                memcpy(fc_host_serial_number(shost), bottom->serial_number,
+                       min(FC_SERIAL_NUMBER_SIZE, 17));
+                EBCASC(fc_host_serial_number(shost),
+                       min(FC_SERIAL_NUMBER_SIZE, 17));
         }
 
         ZFCP_LOG_NORMAL("The adapter %s reported the following characteristics:\n"
-                      "WWNN 0x%016Lx, "
-                      "WWPN 0x%016Lx, "
-                      "S_ID 0x%08x,\n"
-                      "adapter version 0x%x, "
-                      "LIC version 0x%x, "
-                      "FC link speed %d Gb/s\n",
-                      zfcp_get_busid_by_adapter(adapter),
-                      adapter->wwnn,
-                      adapter->wwpn,
-                      (unsigned int) adapter->s_id,
-                      adapter->hydra_version,
-                      adapter->fsf_lic_version,
-                      adapter->fc_link_speed);
+                        "WWNN 0x%016Lx, "
+                        "WWPN 0x%016Lx, "
+                        "S_ID 0x%08x,\n"
+                        "adapter version 0x%x, "
+                        "LIC version 0x%x, "
+                        "FC link speed %d Gb/s\n",
+                        zfcp_get_busid_by_adapter(adapter),
+                        (wwn_t) fc_host_node_name(shost),
+                        (wwn_t) fc_host_port_name(shost),
+                        fc_host_port_id(shost),
+                        adapter->hydra_version,
+                        adapter->fsf_lic_version,
+                        fc_host_speed(shost));
         if (ZFCP_QTCB_VERSION < bottom->low_qtcb_version) {
                 ZFCP_LOG_NORMAL("error: the adapter %s "
                                 "only supports newer control block "
@@ -2062,7 +2059,6 @@ zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *fsf_req, int xchg_ok)
                 zfcp_erp_adapter_shutdown(adapter, 0);
                 return -EIO;
         }
-        zfcp_set_fc_host_attrs(adapter);
         return 0;
 }
 
@@ -2078,11 +2074,12 @@ zfcp_fsf_exchange_config_data_handler(struct zfcp_fsf_req *fsf_req)
 {
         struct fsf_qtcb_bottom_config *bottom;
         struct zfcp_adapter *adapter = fsf_req->adapter;
+        struct fsf_qtcb *qtcb = fsf_req->qtcb;
 
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR)
                 return -EIO;
 
-        switch (fsf_req->qtcb->header.fsf_status) {
+        switch (qtcb->header.fsf_status) {
 
         case FSF_GOOD:
                 if (zfcp_fsf_exchange_config_evaluate(fsf_req, 1))
@@ -2112,7 +2109,7 @@ zfcp_fsf_exchange_config_data_handler(struct zfcp_fsf_req *fsf_req)
                         zfcp_erp_adapter_shutdown(adapter, 0);
                         return -EIO;
                 case FSF_TOPO_FABRIC:
-                        ZFCP_LOG_INFO("Switched fabric fibrechannel "
+                        ZFCP_LOG_NORMAL("Switched fabric fibrechannel "
                                       "network detected at adapter %s.\n",
                                       zfcp_get_busid_by_adapter(adapter));
                         break;
@@ -2130,7 +2127,7 @@ zfcp_fsf_exchange_config_data_handler(struct zfcp_fsf_req *fsf_req)
                         zfcp_erp_adapter_shutdown(adapter, 0);
                         return -EIO;
                 }
-                bottom = &fsf_req->qtcb->bottom.config;
+                bottom = &qtcb->bottom.config;
                 if (bottom->max_qtcb_size < sizeof(struct fsf_qtcb)) {
                         ZFCP_LOG_NORMAL("bug: Maximum QTCB size (%d bytes) "
                                         "allowed by the adapter %s "
@@ -2155,12 +2152,10 @@ zfcp_fsf_exchange_config_data_handler(struct zfcp_fsf_req *fsf_req)
                 if (zfcp_fsf_exchange_config_evaluate(fsf_req, 0))
                         return -EIO;
 
-                ZFCP_LOG_INFO("Local link to adapter %s is down\n",
-                              zfcp_get_busid_by_adapter(adapter));
-                atomic_set_mask(ZFCP_STATUS_ADAPTER_XCONFIG_OK |
-                                ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED,
-                                &adapter->status);
-                zfcp_erp_adapter_failed(adapter);
+                atomic_set_mask(ZFCP_STATUS_ADAPTER_XCONFIG_OK, &adapter->status);
+
+                zfcp_fsf_link_down_info_eval(adapter,
+                        &qtcb->header.fsf_status_qual.link_down_info);
                 break;
         default:
                 debug_text_event(fsf_req->adapter->erp_dbf, 0, "fsf-stat-ng");
@@ -2174,11 +2169,13 @@ zfcp_fsf_exchange_config_data_handler(struct zfcp_fsf_req *fsf_req)
 
 /**
  * zfcp_fsf_exchange_port_data - request information about local port
+ * @erp_action: ERP action for the adapter for which port data is requested
  * @adapter: for which port data is requested
  * @data: response to exchange port data request
  */
 int
-zfcp_fsf_exchange_port_data(struct zfcp_adapter *adapter,
+zfcp_fsf_exchange_port_data(struct zfcp_erp_action *erp_action,
+                            struct zfcp_adapter *adapter,
                             struct fsf_qtcb_bottom_port *data)
 {
         volatile struct qdio_buffer_element *sbale;
@@ -2187,7 +2184,7 @@ zfcp_fsf_exchange_port_data(struct zfcp_adapter *adapter,
         struct zfcp_fsf_req *fsf_req;
         struct timer_list *timer;
 
-        if(!(adapter->supported_features & FSF_FEATURE_HBAAPI_MANAGEMENT)){
+        if (!(adapter->adapter_features & FSF_FEATURE_HBAAPI_MANAGEMENT)) {
                 ZFCP_LOG_INFO("error: exchange port data "
                               "command not supported by adapter %s\n",
                               zfcp_get_busid_by_adapter(adapter));
@@ -2211,12 +2208,18 @@ zfcp_fsf_exchange_port_data(struct zfcp_adapter *adapter,
                 goto out;
         }
 
+        if (erp_action) {
+                erp_action->fsf_req = fsf_req;
+                fsf_req->erp_action = erp_action;
+        }
+
+        if (data)
+        fsf_req->data = (unsigned long) data;
+
         sbale = zfcp_qdio_sbale_req(fsf_req, fsf_req->sbal_curr, 0);
         sbale[0].flags |= SBAL_FLAGS0_TYPE_READ;
         sbale[1].flags |= SBAL_FLAGS_LAST_ENTRY;
 
-        fsf_req->data.port_data = data;
-
         init_timer(timer);
         timer->function = zfcp_fsf_request_timeout_handler;
         timer->data = (unsigned long) adapter;
@@ -2228,6 +2231,8 @@ zfcp_fsf_exchange_port_data(struct zfcp_adapter *adapter,
                               "command on the adapter %s\n",
                               zfcp_get_busid_by_adapter(adapter));
                 zfcp_fsf_req_free(fsf_req);
+                if (erp_action)
+                        erp_action->fsf_req = NULL;
                 write_unlock_irqrestore(&adapter->request_queue.queue_lock,
                                         lock_flags);
                 goto out;
@@ -2256,21 +2261,42 @@ zfcp_fsf_exchange_port_data(struct zfcp_adapter *adapter,
 static void
 zfcp_fsf_exchange_port_data_handler(struct zfcp_fsf_req *fsf_req)
 {
-        struct fsf_qtcb_bottom_port *bottom;
-        struct fsf_qtcb_bottom_port *data = fsf_req->data.port_data;
+        struct zfcp_adapter *adapter = fsf_req->adapter;
+        struct Scsi_Host *shost = adapter->scsi_host;
+        struct fsf_qtcb *qtcb = fsf_req->qtcb;
+        struct fsf_qtcb_bottom_port *bottom, *data;
 
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR)
                 return;
 
-        switch (fsf_req->qtcb->header.fsf_status) {
+        switch (qtcb->header.fsf_status) {
         case FSF_GOOD:
-                bottom = &fsf_req->qtcb->bottom.port;
-                memcpy(data, bottom, sizeof(*data));
+                atomic_set_mask(ZFCP_STATUS_ADAPTER_XPORT_OK, &adapter->status);
+
+                bottom = &qtcb->bottom.port;
+                data = (struct fsf_qtcb_bottom_port*) fsf_req->data;
+                if (data)
+                        memcpy(data, bottom, sizeof(struct fsf_qtcb_bottom_port));
+                if (adapter->connection_features & FSF_FEATURE_NPIV_MODE) {
+                        adapter->physical_wwpn = bottom->wwpn;
+                        adapter->physical_s_id = bottom->fc_port_id;
+                } else {
+                        adapter->physical_wwpn = fc_host_port_name(shost);
+                        adapter->physical_s_id = fc_host_port_id(shost);
+                }
+                fc_host_maxframe_size(shost) = bottom->maximum_frame_size;
+                break;
+
+        case FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE:
+                atomic_set_mask(ZFCP_STATUS_ADAPTER_XPORT_OK, &adapter->status);
+
+                zfcp_fsf_link_down_info_eval(adapter,
+                        &qtcb->header.fsf_status_qual.link_down_info);
                 break;
 
         default:
-                debug_text_event(fsf_req->adapter->erp_dbf, 0, "xchg-port-ng");
-                debug_event(fsf_req->adapter->erp_dbf, 0,
+                debug_text_event(adapter->erp_dbf, 0, "xchg-port-ng");
+                debug_event(adapter->erp_dbf, 0,
                             &fsf_req->qtcb->header.fsf_status, sizeof(u32));
         }
 }
@@ -2312,7 +2338,7 @@ zfcp_fsf_open_port(struct zfcp_erp_action *erp_action)
 
         erp_action->fsf_req->qtcb->bottom.support.d_id = erp_action->port->d_id;
         atomic_set_mask(ZFCP_STATUS_COMMON_OPENING, &erp_action->port->status);
-        erp_action->fsf_req->data.open_port.port = erp_action->port;
+        erp_action->fsf_req->data = (unsigned long) erp_action->port;
         erp_action->fsf_req->erp_action = erp_action;
 
         /* start QDIO request for this FSF request */
@@ -2353,7 +2379,7 @@ zfcp_fsf_open_port_handler(struct zfcp_fsf_req *fsf_req)
         struct fsf_qtcb_header *header;
         u16 subtable, rule, counter;
 
-        port = fsf_req->data.open_port.port;
+        port = (struct zfcp_port *) fsf_req->data;
         header = &fsf_req->qtcb->header;
 
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR) {
@@ -2566,7 +2592,7 @@ zfcp_fsf_close_port(struct zfcp_erp_action *erp_action)
         sbale[1].flags |= SBAL_FLAGS_LAST_ENTRY;
 
         atomic_set_mask(ZFCP_STATUS_COMMON_CLOSING, &erp_action->port->status);
-        erp_action->fsf_req->data.close_port.port = erp_action->port;
+        erp_action->fsf_req->data = (unsigned long) erp_action->port;
         erp_action->fsf_req->erp_action = erp_action;
         erp_action->fsf_req->qtcb->header.port_handle =
             erp_action->port->handle;
@@ -2606,7 +2632,7 @@ zfcp_fsf_close_port_handler(struct zfcp_fsf_req *fsf_req)
         int retval = -EINVAL;
         struct zfcp_port *port;
 
-        port = fsf_req->data.close_port.port;
+        port = (struct zfcp_port *) fsf_req->data;
 
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR) {
                 /* don't change port status in our bookkeeping */
@@ -2703,8 +2729,8 @@ zfcp_fsf_close_physical_port(struct zfcp_erp_action *erp_action)
         atomic_set_mask(ZFCP_STATUS_PORT_PHYS_CLOSING,
                         &erp_action->port->status);
         /* save a pointer to this port */
-        erp_action->fsf_req->data.close_physical_port.port = erp_action->port;
-        /* port to be closeed */
+        erp_action->fsf_req->data = (unsigned long) erp_action->port;
+        /* port to be closed */
         erp_action->fsf_req->qtcb->header.port_handle =
             erp_action->port->handle;
         erp_action->fsf_req->erp_action = erp_action;
@@ -2747,7 +2773,7 @@ zfcp_fsf_close_physical_port_handler(struct zfcp_fsf_req *fsf_req)
         struct fsf_qtcb_header *header;
         u16 subtable, rule, counter;
 
-        port = fsf_req->data.close_physical_port.port;
+        port = (struct zfcp_port *) fsf_req->data;
         header = &fsf_req->qtcb->header;
 
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR) {
@@ -2908,10 +2934,11 @@ zfcp_fsf_open_unit(struct zfcp_erp_action *erp_action)
                 erp_action->port->handle;
         erp_action->fsf_req->qtcb->bottom.support.fcp_lun =
                 erp_action->unit->fcp_lun;
+        if (!(erp_action->adapter->connection_features & FSF_FEATURE_NPIV_MODE))
         erp_action->fsf_req->qtcb->bottom.support.option =
                 FSF_OPEN_LUN_SUPPRESS_BOXING;
         atomic_set_mask(ZFCP_STATUS_COMMON_OPENING, &erp_action->unit->status);
-        erp_action->fsf_req->data.open_unit.unit = erp_action->unit;
+        erp_action->fsf_req->data = (unsigned long) erp_action->unit;
         erp_action->fsf_req->erp_action = erp_action;
 
         /* start QDIO request for this FSF request */
@@ -2955,9 +2982,9 @@ zfcp_fsf_open_unit_handler(struct zfcp_fsf_req *fsf_req)
         struct fsf_qtcb_bottom_support *bottom;
         struct fsf_queue_designator *queue_designator;
         u16 subtable, rule, counter;
-        u32 allowed, exclusive, readwrite;
+        int exclusive, readwrite;
 
-        unit = fsf_req->data.open_unit.unit;
+        unit = (struct zfcp_unit *) fsf_req->data;
 
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR) {
                 /* don't change unit status in our bookkeeping */
@@ -2969,10 +2996,6 @@ zfcp_fsf_open_unit_handler(struct zfcp_fsf_req *fsf_req)
         bottom = &fsf_req->qtcb->bottom.support;
         queue_designator = &header->fsf_status_qual.fsf_queue_designator;
 
-        allowed   = bottom->lun_access_info & FSF_UNIT_ACCESS_OPEN_LUN_ALLOWED;
-        exclusive = bottom->lun_access_info & FSF_UNIT_ACCESS_EXCLUSIVE;
-        readwrite = bottom->lun_access_info & FSF_UNIT_ACCESS_OUTBOUND_TRANSFER;
-
         atomic_clear_mask(ZFCP_STATUS_COMMON_ACCESS_DENIED |
                           ZFCP_STATUS_UNIT_SHARED |
                           ZFCP_STATUS_UNIT_READONLY,
@@ -3146,10 +3169,15 @@ zfcp_fsf_open_unit_handler(struct zfcp_fsf_req *fsf_req)
                                unit->handle);
                 /* mark unit as open */
                 atomic_set_mask(ZFCP_STATUS_COMMON_OPEN, &unit->status);
-                atomic_clear_mask(ZFCP_STATUS_COMMON_ACCESS_DENIED |
-                                  ZFCP_STATUS_COMMON_ACCESS_BOXED,
-                                  &unit->status);
-                if (adapter->supported_features & FSF_FEATURE_LUN_SHARING){
+
+                if (!(adapter->connection_features & FSF_FEATURE_NPIV_MODE) &&
+                    (adapter->adapter_features & FSF_FEATURE_LUN_SHARING) &&
+                    (adapter->ccw_device->id.dev_model != ZFCP_DEVICE_MODEL_PRIV)) {
+                        exclusive = (bottom->lun_access_info &
+                                        FSF_UNIT_ACCESS_EXCLUSIVE);
+                        readwrite = (bottom->lun_access_info &
+                                        FSF_UNIT_ACCESS_OUTBOUND_TRANSFER);
+
                         if (!exclusive)
                                 atomic_set_mask(ZFCP_STATUS_UNIT_SHARED,
                                                 &unit->status);
@@ -3242,7 +3270,7 @@ zfcp_fsf_close_unit(struct zfcp_erp_action *erp_action)
             erp_action->port->handle;
         erp_action->fsf_req->qtcb->header.lun_handle = erp_action->unit->handle;
         atomic_set_mask(ZFCP_STATUS_COMMON_CLOSING, &erp_action->unit->status);
-        erp_action->fsf_req->data.close_unit.unit = erp_action->unit;
+        erp_action->fsf_req->data = (unsigned long) erp_action->unit;
         erp_action->fsf_req->erp_action = erp_action;
 
         /* start QDIO request for this FSF request */
@@ -3281,7 +3309,7 @@ zfcp_fsf_close_unit_handler(struct zfcp_fsf_req *fsf_req)
         int retval = -EINVAL;
         struct zfcp_unit *unit;
 
-        unit = fsf_req->data.close_unit.unit;   /* restore unit */
+        unit = (struct zfcp_unit *) fsf_req->data;
 
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR) {
                 /* don't change unit status in our bookkeeping */
@@ -3305,9 +3333,6 @@ zfcp_fsf_close_unit_handler(struct zfcp_fsf_req *fsf_req)
                 debug_text_event(fsf_req->adapter->erp_dbf, 1,
                                  "fsf_s_phand_nv");
                 zfcp_erp_adapter_reopen(unit->port->adapter, 0);
-                zfcp_cmd_dbf_event_fsf("porthinv", fsf_req,
-                                       &fsf_req->qtcb->header.fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
@@ -3326,9 +3351,6 @@ zfcp_fsf_close_unit_handler(struct zfcp_fsf_req *fsf_req)
                 debug_text_event(fsf_req->adapter->erp_dbf, 1,
                                  "fsf_s_lhand_nv");
                 zfcp_erp_port_reopen(unit->port, 0);
-                zfcp_cmd_dbf_event_fsf("lunhinv", fsf_req,
-                                       &fsf_req->qtcb->header.fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
@@ -3436,21 +3458,14 @@ zfcp_fsf_send_fcp_command_task(struct zfcp_adapter *adapter,
                 goto failed_req_create;
         }
 
-        /*
-         * associate FSF request with SCSI request
-         * (need this for look up on abort)
-         */
-        fsf_req->data.send_fcp_command_task.fsf_req = fsf_req;
-        scsi_cmnd->host_scribble = (char *) &(fsf_req->data);
+        zfcp_unit_get(unit);
+        fsf_req->unit = unit;
 
-        /*
-         * associate SCSI command with FSF request
-         * (need this for look up on normal command completion)
-         */
-        fsf_req->data.send_fcp_command_task.scsi_cmnd = scsi_cmnd;
-        fsf_req->data.send_fcp_command_task.start_jiffies = jiffies;
-        fsf_req->data.send_fcp_command_task.unit = unit;
-        ZFCP_LOG_DEBUG("unit=%p, fcp_lun=0x%016Lx\n", unit, unit->fcp_lun);
+        /* associate FSF request with SCSI request (for look up on abort) */
+        scsi_cmnd->host_scribble = (char *) fsf_req;
+
+        /* associate SCSI command with FSF request */
+        fsf_req->data = (unsigned long) scsi_cmnd;
 
         /* set handles of unit and its parent port in QTCB */
         fsf_req->qtcb->header.lun_handle = unit->handle;
@@ -3584,6 +3599,7 @@ zfcp_fsf_send_fcp_command_task(struct zfcp_adapter *adapter,
  send_failed:
  no_fit:
  failed_scsi_cmnd:
+        zfcp_unit_put(unit);
         zfcp_fsf_req_free(fsf_req);
         fsf_req = NULL;
         scsi_cmnd->host_scribble = NULL;
@@ -3640,7 +3656,7 @@ zfcp_fsf_send_fcp_command_task_management(struct zfcp_adapter *adapter,
          * hold a pointer to the unit being target of this
          * task management request
          */
-        fsf_req->data.send_fcp_command_task_management.unit = unit;
+        fsf_req->data = (unsigned long) unit;
 
         /* set FSF related fields in QTCB */
         fsf_req->qtcb->header.lun_handle = unit->handle;
@@ -3706,9 +3722,9 @@ zfcp_fsf_send_fcp_command_handler(struct zfcp_fsf_req *fsf_req)
         header = &fsf_req->qtcb->header;
 
         if (unlikely(fsf_req->status & ZFCP_STATUS_FSFREQ_TASK_MANAGEMENT))
-                unit = fsf_req->data.send_fcp_command_task_management.unit;
+                unit = (struct zfcp_unit *) fsf_req->data;
         else
-                unit = fsf_req->data.send_fcp_command_task.unit;
+                unit = fsf_req->unit;
 
         if (unlikely(fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR)) {
                 /* go directly to calls of special handlers */
@@ -3765,10 +3781,6 @@ zfcp_fsf_send_fcp_command_handler(struct zfcp_fsf_req *fsf_req)
                 debug_text_event(fsf_req->adapter->erp_dbf, 1,
                                  "fsf_s_hand_mis");
                 zfcp_erp_adapter_reopen(unit->port->adapter, 0);
-                zfcp_cmd_dbf_event_fsf("handmism",
-                                       fsf_req,
-                                       &header->fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
@@ -3789,10 +3801,6 @@ zfcp_fsf_send_fcp_command_handler(struct zfcp_fsf_req *fsf_req)
                 debug_text_exception(fsf_req->adapter->erp_dbf, 0,
                                      "fsf_s_class_nsup");
                 zfcp_erp_adapter_shutdown(unit->port->adapter, 0);
-                zfcp_cmd_dbf_event_fsf("unsclass",
-                                       fsf_req,
-                                       &header->fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
@@ -3811,10 +3819,6 @@ zfcp_fsf_send_fcp_command_handler(struct zfcp_fsf_req *fsf_req)
                 debug_text_event(fsf_req->adapter->erp_dbf, 1,
                                  "fsf_s_fcp_lun_nv");
                 zfcp_erp_port_reopen(unit->port, 0);
-                zfcp_cmd_dbf_event_fsf("fluninv",
-                                       fsf_req,
-                                       &header->fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
@@ -3853,10 +3857,6 @@ zfcp_fsf_send_fcp_command_handler(struct zfcp_fsf_req *fsf_req)
                 debug_text_event(fsf_req->adapter->erp_dbf, 0,
                                  "fsf_s_dir_ind_nv");
                 zfcp_erp_adapter_shutdown(unit->port->adapter, 0);
-                zfcp_cmd_dbf_event_fsf("dirinv",
-                                       fsf_req,
-                                       &header->fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
@@ -3872,10 +3872,6 @@ zfcp_fsf_send_fcp_command_handler(struct zfcp_fsf_req *fsf_req)
                 debug_text_event(fsf_req->adapter->erp_dbf, 0,
                                  "fsf_s_cmd_len_nv");
                 zfcp_erp_adapter_shutdown(unit->port->adapter, 0);
-                zfcp_cmd_dbf_event_fsf("cleninv",
-                                       fsf_req,
-                                       &header->fsf_status_qual,
-                                       sizeof (union fsf_status_qual));
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
@@ -3947,6 +3943,8 @@ zfcp_fsf_send_fcp_command_handler(struct zfcp_fsf_req *fsf_req)
                     zfcp_fsf_send_fcp_command_task_management_handler(fsf_req);
         } else {
                 retval = zfcp_fsf_send_fcp_command_task_handler(fsf_req);
+                fsf_req->unit = NULL;
+                zfcp_unit_put(unit);
         }
         return retval;
 }
@@ -3970,10 +3968,10 @@ zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *fsf_req)
         u32 sns_len;
         char *fcp_rsp_info = zfcp_get_fcp_rsp_info_ptr(fcp_rsp_iu);
         unsigned long flags;
-        struct zfcp_unit *unit = fsf_req->data.send_fcp_command_task.unit;
+        struct zfcp_unit *unit = fsf_req->unit;
 
         read_lock_irqsave(&fsf_req->adapter->abort_lock, flags);
-        scpnt = fsf_req->data.send_fcp_command_task.scsi_cmnd;
+        scpnt = (struct scsi_cmnd *) fsf_req->data;
         if (unlikely(!scpnt)) {
                 ZFCP_LOG_DEBUG
                     ("Command with fsf_req %p is not associated to "
@@ -4043,7 +4041,6 @@ zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *fsf_req)
                         ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_DEBUG,
                                       (char *) &fsf_req->qtcb->
                                       bottom.io.fcp_cmnd, FSF_FCP_CMND_SIZE);
-                        zfcp_cmd_dbf_event_fsf("clenmis", fsf_req, NULL, 0);
                         set_host_byte(&scpnt->result, DID_ERROR);
                         goto skip_fsfstatus;
                 case RSP_CODE_FIELD_INVALID:
@@ -4062,7 +4059,6 @@ zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *fsf_req)
                                       (char *) &fsf_req->qtcb->
                                       bottom.io.fcp_cmnd, FSF_FCP_CMND_SIZE);
                         set_host_byte(&scpnt->result, DID_ERROR);
-                        zfcp_cmd_dbf_event_fsf("codeinv", fsf_req, NULL, 0);
                         goto skip_fsfstatus;
                 case RSP_CODE_RO_MISMATCH:
                         /* hardware bug */
@@ -4079,7 +4075,6 @@ zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *fsf_req)
                         ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_DEBUG,
                                       (char *) &fsf_req->qtcb->
                                       bottom.io.fcp_cmnd, FSF_FCP_CMND_SIZE);
-                        zfcp_cmd_dbf_event_fsf("codemism", fsf_req, NULL, 0);
                         set_host_byte(&scpnt->result, DID_ERROR);
                         goto skip_fsfstatus;
                 default:
@@ -4096,7 +4091,6 @@ zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *fsf_req)
                         ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_DEBUG,
                                       (char *) &fsf_req->qtcb->
                                       bottom.io.fcp_cmnd, FSF_FCP_CMND_SIZE);
-                        zfcp_cmd_dbf_event_fsf("undeffcp", fsf_req, NULL, 0);
                         set_host_byte(&scpnt->result, DID_ERROR);
                         goto skip_fsfstatus;
                 }
@@ -4158,19 +4152,17 @@ zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *fsf_req)
  skip_fsfstatus:
         ZFCP_LOG_DEBUG("scpnt->result =0x%x\n", scpnt->result);
 
-        zfcp_cmd_dbf_event_scsi("response", scpnt);
+        if (scpnt->result != 0)
+                zfcp_scsi_dbf_event_result("erro", 3, fsf_req->adapter, scpnt);
+        else if (scpnt->retries > 0)
+                zfcp_scsi_dbf_event_result("retr", 4, fsf_req->adapter, scpnt);
+        else
+                zfcp_scsi_dbf_event_result("norm", 6, fsf_req->adapter, scpnt);
 
         /* cleanup pointer (need this especially for abort) */
         scpnt->host_scribble = NULL;
 
-        /*
-         * NOTE:
-         * according to the outcome of a discussion on linux-scsi we
-         * don't need to grab the io_request_lock here since we use
-         * the new eh
-         */
         /* always call back */
-
         (scpnt->scsi_done) (scpnt);
 
         /*
@@ -4198,8 +4190,7 @@ zfcp_fsf_send_fcp_command_task_management_handler(struct zfcp_fsf_req *fsf_req)
         struct fcp_rsp_iu *fcp_rsp_iu = (struct fcp_rsp_iu *)
             &(fsf_req->qtcb->bottom.io.fcp_rsp);
         char *fcp_rsp_info = zfcp_get_fcp_rsp_info_ptr(fcp_rsp_iu);
-        struct zfcp_unit *unit =
-            fsf_req->data.send_fcp_command_task_management.unit;
+        struct zfcp_unit *unit = (struct zfcp_unit *) fsf_req->data;
 
         del_timer(&fsf_req->adapter->scsi_er_timer);
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR) {
@@ -4276,7 +4267,7 @@ zfcp_fsf_control_file(struct zfcp_adapter *adapter,
         int direction;
         int retval = 0;
 
-        if (!(adapter->supported_features & FSF_FEATURE_CFDC)) {
+        if (!(adapter->adapter_features & FSF_FEATURE_CFDC)) {
                 ZFCP_LOG_INFO("cfdc not supported (adapter %s)\n",
                               zfcp_get_busid_by_adapter(adapter));
                 retval = -EOPNOTSUPP;
@@ -4549,52 +4540,6 @@ skip_fsfstatus:
         return retval;
 }
 
-
-/*
- * function:    zfcp_fsf_req_wait_and_cleanup
- *
- * purpose:
- *
- * FIXME(design): signal seems to be <0 !!!
- * returns:     0       - request completed (*status is valid), cleanup succ.
- *              <0      - request completed (*status is valid), cleanup failed
- *              >0      - signal which interrupted waiting (*status invalid),
- *                        request not completed, no cleanup
- *
- *              *status is a copy of status of completed fsf_req
- */
-int
-zfcp_fsf_req_wait_and_cleanup(struct zfcp_fsf_req *fsf_req,
-                              int interruptible, u32 * status)
-{
-        int retval = 0;
-        int signal = 0;
-
-        if (interruptible) {
-                __wait_event_interruptible(fsf_req->completion_wq,
-                                           fsf_req->status &
-                                           ZFCP_STATUS_FSFREQ_COMPLETED,
-                                           signal);
-                if (signal) {
-                        ZFCP_LOG_DEBUG("Caught signal %i while waiting for the "
-                                       "completion of the request at %p\n",
-                                       signal, fsf_req);
-                        retval = signal;
-                        goto out;
-                }
-        } else {
-                __wait_event(fsf_req->completion_wq,
-                             fsf_req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
-        }
-
-        *status = fsf_req->status;
-
-        /* cleanup request */
-        zfcp_fsf_req_free(fsf_req);
- out:
-        return retval;
-}
-
 static inline int
 zfcp_fsf_req_sbal_check(unsigned long *flags,
                         struct zfcp_qdio_queue *queue, int needed)
@@ -4610,15 +4555,16 @@ zfcp_fsf_req_sbal_check(unsigned long *flags,
  * set qtcb pointer in fsf_req and initialize QTCB
  */
 static inline void
-zfcp_fsf_req_qtcb_init(struct zfcp_fsf_req *fsf_req, u32 fsf_cmd)
+zfcp_fsf_req_qtcb_init(struct zfcp_fsf_req *fsf_req)
 {
         if (likely(fsf_req->qtcb != NULL)) {
+                fsf_req->qtcb->prefix.req_seq_no = fsf_req->adapter->fsf_req_seq_no;
                 fsf_req->qtcb->prefix.req_id = (unsigned long)fsf_req;
                 fsf_req->qtcb->prefix.ulp_info = ZFCP_ULP_INFO_VERSION;
-                fsf_req->qtcb->prefix.qtcb_type = fsf_qtcb_type[fsf_cmd];
+                fsf_req->qtcb->prefix.qtcb_type = fsf_qtcb_type[fsf_req->fsf_command];
                 fsf_req->qtcb->prefix.qtcb_version = ZFCP_QTCB_VERSION;
                 fsf_req->qtcb->header.req_handle = (unsigned long)fsf_req;
-                fsf_req->qtcb->header.fsf_command = fsf_cmd;
+                fsf_req->qtcb->header.fsf_command = fsf_req->fsf_command;
         }
 }
 
@@ -4686,7 +4632,10 @@ zfcp_fsf_req_create(struct zfcp_adapter *adapter, u32 fsf_cmd, int req_flags,
                 goto failed_fsf_req;
         }
 
-        zfcp_fsf_req_qtcb_init(fsf_req, fsf_cmd);
+        fsf_req->adapter = adapter;
+        fsf_req->fsf_command = fsf_cmd;
+
+        zfcp_fsf_req_qtcb_init(fsf_req);
 
         /* initialize waitqueue which may be used to wait on 
            this request completion */
@@ -4708,8 +4657,10 @@ zfcp_fsf_req_create(struct zfcp_adapter *adapter, u32 fsf_cmd, int req_flags,
                 goto failed_sbals;
         }
 
-        fsf_req->adapter = adapter;     /* pointer to "parent" adapter */
-        fsf_req->fsf_command = fsf_cmd;
+        if (fsf_req->qtcb) {
+                fsf_req->seq_no = adapter->fsf_req_seq_no;
+                fsf_req->qtcb->prefix.req_seq_no = adapter->fsf_req_seq_no;
+        }
         fsf_req->sbal_number = 1;
         fsf_req->sbal_first = req_queue->free_index;
         fsf_req->sbal_curr = req_queue->free_index;
@@ -4760,9 +4711,9 @@ zfcp_fsf_req_send(struct zfcp_fsf_req *fsf_req, struct timer_list *timer)
         struct zfcp_adapter *adapter;
         struct zfcp_qdio_queue *req_queue;
         volatile struct qdio_buffer_element *sbale;
+        int inc_seq_no;
         int new_distance_from_int;
         unsigned long flags;
-        int inc_seq_no = 1;
         int retval = 0;
 
         adapter = fsf_req->adapter;
@@ -4776,23 +4727,13 @@ zfcp_fsf_req_send(struct zfcp_fsf_req *fsf_req, struct timer_list *timer)
         ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_TRACE, (char *) sbale[1].addr,
                       sbale[1].length);
 
-        /* set sequence counter in QTCB */
-        if (likely(fsf_req->qtcb)) {
-                fsf_req->qtcb->prefix.req_seq_no = adapter->fsf_req_seq_no;
-                fsf_req->seq_no = adapter->fsf_req_seq_no;
-                ZFCP_LOG_TRACE("FSF request %p of adapter %s gets "
-                               "FSF sequence counter value of %i\n",
-                               fsf_req,
-                               zfcp_get_busid_by_adapter(adapter),
-                               fsf_req->qtcb->prefix.req_seq_no);
-        } else
-                inc_seq_no = 0;
-
         /* put allocated FSF request at list tail */
         spin_lock_irqsave(&adapter->fsf_req_list_lock, flags);
         list_add_tail(&fsf_req->list, &adapter->fsf_req_list_head);
         spin_unlock_irqrestore(&adapter->fsf_req_list_lock, flags);
 
+        inc_seq_no = (fsf_req->qtcb != NULL);
+
         /* figure out expiration time of timeout and start timeout */
         if (unlikely(timer)) {
                 timer->expires += jiffies;
@@ -4822,6 +4763,8 @@ zfcp_fsf_req_send(struct zfcp_fsf_req *fsf_req, struct timer_list *timer)
         req_queue->free_index %= QDIO_MAX_BUFFERS_PER_Q;  /* wrap if needed */
         new_distance_from_int = zfcp_qdio_determine_pci(req_queue, fsf_req);
 
+        fsf_req->issued = get_clock();
+
         retval = do_QDIO(adapter->ccw_device,
                          QDIO_FLAG_SYNC_OUTPUT,
                          0, fsf_req->sbal_first, fsf_req->sbal_number, NULL);
@@ -4860,15 +4803,11 @@ zfcp_fsf_req_send(struct zfcp_fsf_req *fsf_req, struct timer_list *timer)
                  * routines  resulting in missing sequence counter values
                  * otherwise,
                  */
+
                 /* Don't increase for unsolicited status */
-                if (likely(inc_seq_no)) {
+                if (inc_seq_no)
                         adapter->fsf_req_seq_no++;
-                        ZFCP_LOG_TRACE
-                            ("FSF sequence counter value of adapter %s "
-                             "increased to %i\n",
-                             zfcp_get_busid_by_adapter(adapter),
-                             adapter->fsf_req_seq_no);
-                }
+
                 /* count FSF requests pending */
                 atomic_inc(&adapter->fsf_reqs_active);
         }
diff --git a/drivers/s390/scsi/zfcp_fsf.h b/drivers/s390/scsi/zfcp_fsf.h
index 07140dfda2a7..48719f055952 100644
--- a/drivers/s390/scsi/zfcp_fsf.h
+++ b/drivers/s390/scsi/zfcp_fsf.h
@@ -116,6 +116,7 @@
 #define FSF_INVALID_COMMAND_OPTION              0x000000E5
 /* #define FSF_ERROR                             0x000000FF  */
 
+#define FSF_PROT_STATUS_QUAL_SIZE               16
 #define FSF_STATUS_QUALIFIER_SIZE               16
 
 /* FSF status qualifier, recommendations */
@@ -139,9 +140,18 @@
 #define FSF_SQ_CFDC_SUBTABLE_LUN                0x0004
 
 /* FSF status qualifier (most significant 4 bytes), local link down */
-#define FSF_PSQ_LINK_NOLIGHT                    0x00000004
-#define FSF_PSQ_LINK_WRAPPLUG                   0x00000008
-#define FSF_PSQ_LINK_NOFCP                      0x00000010
+#define FSF_PSQ_LINK_NO_LIGHT                   0x00000004
+#define FSF_PSQ_LINK_WRAP_PLUG                  0x00000008
+#define FSF_PSQ_LINK_NO_FCP                     0x00000010
+#define FSF_PSQ_LINK_FIRMWARE_UPDATE            0x00000020
+#define FSF_PSQ_LINK_INVALID_WWPN               0x00000100
+#define FSF_PSQ_LINK_NO_NPIV_SUPPORT            0x00000200
+#define FSF_PSQ_LINK_NO_FCP_RESOURCES           0x00000400
+#define FSF_PSQ_LINK_NO_FABRIC_RESOURCES        0x00000800
+#define FSF_PSQ_LINK_FABRIC_LOGIN_UNABLE        0x00001000
+#define FSF_PSQ_LINK_WWPN_ASSIGNMENT_CORRUPTED  0x00002000
+#define FSF_PSQ_LINK_MODE_TABLE_CURRUPTED       0x00004000
+#define FSF_PSQ_LINK_NO_WWPN_ASSIGNMENT         0x00008000
 
 /* payload size in status read buffer */
 #define FSF_STATUS_READ_PAYLOAD_SIZE            4032
@@ -154,15 +164,21 @@
 #define FSF_STATUS_READ_INCOMING_ELS            0x00000002
 #define FSF_STATUS_READ_SENSE_DATA_AVAIL        0x00000003
 #define FSF_STATUS_READ_BIT_ERROR_THRESHOLD     0x00000004
-#define FSF_STATUS_READ_LINK_DOWN               0x00000005 /* FIXME: really? */
+#define FSF_STATUS_READ_LINK_DOWN               0x00000005
 #define FSF_STATUS_READ_LINK_UP                 0x00000006
 #define FSF_STATUS_READ_CFDC_UPDATED            0x0000000A
 #define FSF_STATUS_READ_CFDC_HARDENED           0x0000000B
+#define FSF_STATUS_READ_FEATURE_UPDATE_ALERT    0x0000000C
 
 /* status subtypes in status read buffer */
 #define FSF_STATUS_READ_SUB_CLOSE_PHYS_PORT     0x00000001
 #define FSF_STATUS_READ_SUB_ERROR_PORT          0x00000002
 
+/* status subtypes for link down */
+#define FSF_STATUS_READ_SUB_NO_PHYSICAL_LINK    0x00000000
+#define FSF_STATUS_READ_SUB_FDISC_FAILED        0x00000001
+#define FSF_STATUS_READ_SUB_FIRMWARE_UPDATE     0x00000002
+
 /* status subtypes for CFDC */
 #define FSF_STATUS_READ_SUB_CFDC_HARDENED_ON_SE 0x00000002
 #define FSF_STATUS_READ_SUB_CFDC_HARDENED_ON_SE2 0x0000000F
@@ -193,11 +209,15 @@
 #define FSF_QTCB_LOG_SIZE                       1024
 
 /* channel features */
-#define FSF_FEATURE_QTCB_SUPPRESSION            0x00000001
 #define FSF_FEATURE_CFDC                        0x00000002
 #define FSF_FEATURE_LUN_SHARING                 0x00000004
 #define FSF_FEATURE_HBAAPI_MANAGEMENT           0x00000010
 #define FSF_FEATURE_ELS_CT_CHAINED_SBALS        0x00000020
+#define FSF_FEATURE_UPDATE_ALERT                0x00000100
+
+/* host connection features */
+#define FSF_FEATURE_NPIV_MODE                   0x00000001
+#define FSF_FEATURE_VM_ASSIGNED_WWPN            0x00000002
 
 /* option */
 #define FSF_OPEN_LUN_SUPPRESS_BOXING            0x00000001
@@ -305,15 +325,23 @@ struct fsf_qual_sequence_error {
         u32 res1[3];
 } __attribute__ ((packed));
 
-struct fsf_qual_locallink_error {
-        u32 code;
-        u32 res1[3];
+struct fsf_link_down_info {
+        u32 error_code;
+        u32 res1;
+        u8 res2[2];
+        u8 primary_status;
+        u8 ioerr_code;
+        u8 action_code;
+        u8 reason_code;
+        u8 explanation_code;
+        u8 vendor_specific_code;
 } __attribute__ ((packed));
 
 union fsf_prot_status_qual {
+        u64 doubleword[FSF_PROT_STATUS_QUAL_SIZE / sizeof(u64)];
         struct fsf_qual_version_error   version_error;
         struct fsf_qual_sequence_error  sequence_error;
-        struct fsf_qual_locallink_error locallink_error;
+        struct fsf_link_down_info link_down_info;
 } __attribute__ ((packed));
 
 struct fsf_qtcb_prefix {
@@ -331,7 +359,9 @@ union fsf_status_qual {
         u8  byte[FSF_STATUS_QUALIFIER_SIZE];
         u16 halfword[FSF_STATUS_QUALIFIER_SIZE / sizeof (u16)];
         u32 word[FSF_STATUS_QUALIFIER_SIZE / sizeof (u32)];
+        u64 doubleword[FSF_STATUS_QUALIFIER_SIZE / sizeof(u64)];
         struct fsf_queue_designator fsf_queue_designator;
+        struct fsf_link_down_info link_down_info;
 } __attribute__ ((packed));
 
 struct fsf_qtcb_header {
@@ -406,8 +436,8 @@ struct fsf_qtcb_bottom_config {
         u32 low_qtcb_version;
         u32 max_qtcb_size;
         u32 max_data_transfer_size;
-        u32 supported_features;
-        u8  res1[4];
+        u32 adapter_features;
+        u32 connection_features;
         u32 fc_topology;
         u32 fc_link_speed;
         u32 adapter_type;
@@ -425,7 +455,7 @@ struct fsf_qtcb_bottom_config {
 } __attribute__ ((packed));
 
 struct fsf_qtcb_bottom_port {
-        u8 res1[8];
+        u64 wwpn;
         u32 fc_port_id;
         u32 port_type;
         u32 port_state;
diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
index 24e16ec331d9..d719f66a29a4 100644
--- a/drivers/s390/scsi/zfcp_qdio.c
+++ b/drivers/s390/scsi/zfcp_qdio.c
@@ -54,8 +54,7 @@ static inline int zfcp_qdio_sbals_from_buffer
 static qdio_handler_t zfcp_qdio_request_handler;
 static qdio_handler_t zfcp_qdio_response_handler;
 static int zfcp_qdio_handler_error_check(struct zfcp_adapter *,
-                                         unsigned int,
-                                         unsigned int, unsigned int);
+        unsigned int, unsigned int, unsigned int, int, int);
 
 #define ZFCP_LOG_AREA                   ZFCP_LOG_AREA_QDIO
 
@@ -214,22 +213,12 @@ zfcp_qdio_allocate(struct zfcp_adapter *adapter)
  *
  */
 static inline int
-zfcp_qdio_handler_error_check(struct zfcp_adapter *adapter,
-                              unsigned int status,
-                              unsigned int qdio_error, unsigned int siga_error)
+zfcp_qdio_handler_error_check(struct zfcp_adapter *adapter, unsigned int status,
+                              unsigned int qdio_error, unsigned int siga_error,
+                              int first_element, int elements_processed)
 {
         int retval = 0;
 
-        if (ZFCP_LOG_CHECK(ZFCP_LOG_LEVEL_TRACE)) {
-                if (status & QDIO_STATUS_INBOUND_INT) {
-                        ZFCP_LOG_TRACE("status is"
-                                       " QDIO_STATUS_INBOUND_INT \n");
-                }
-                if (status & QDIO_STATUS_OUTBOUND_INT) {
-                        ZFCP_LOG_TRACE("status is"
-                                       " QDIO_STATUS_OUTBOUND_INT \n");
-                }
-        }
         if (unlikely(status & QDIO_STATUS_LOOK_FOR_ERROR)) {
                 retval = -EIO;
 
@@ -237,9 +226,10 @@ zfcp_qdio_handler_error_check(struct zfcp_adapter *adapter,
                               "qdio_error=0x%x, siga_error=0x%x)\n",
                               status, qdio_error, siga_error);
 
-                /* Restarting IO on the failed adapter from scratch */
-                debug_text_event(adapter->erp_dbf, 1, "qdio_err");
+                zfcp_hba_dbf_event_qdio(adapter, status, qdio_error, siga_error,
+                                first_element, elements_processed);
                /*
+                * Restarting IO on the failed adapter from scratch.
                 * Since we have been using this adapter, it is save to assume
                 * that it is not failed but recoverable. The card seems to
                 * report link-up events by self-initiated queue shutdown.
@@ -282,7 +272,8 @@ zfcp_qdio_request_handler(struct ccw_device *ccw_device,
                        first_element, elements_processed);
 
         if (unlikely(zfcp_qdio_handler_error_check(adapter, status, qdio_error,
-                                                   siga_error)))
+                                                   siga_error, first_element,
+                                                   elements_processed)))
                 goto out;
         /*
          * we stored address of struct zfcp_adapter  data structure
@@ -334,7 +325,8 @@ zfcp_qdio_response_handler(struct ccw_device *ccw_device,
         queue = &adapter->response_queue;
 
         if (unlikely(zfcp_qdio_handler_error_check(adapter, status, qdio_error,
-                                                   siga_error)))
+                                                   siga_error, first_element,
+                                                   elements_processed)))
                 goto out;
 
         /*
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 31a76065cf28..3dcd1bfba3b4 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -44,7 +44,8 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *);
 static int zfcp_scsi_eh_device_reset_handler(struct scsi_cmnd *);
 static int zfcp_scsi_eh_bus_reset_handler(struct scsi_cmnd *);
 static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *);
-static int zfcp_task_management_function(struct zfcp_unit *, u8);
+static int zfcp_task_management_function(struct zfcp_unit *, u8,
+                                         struct scsi_cmnd *);
 
 static struct zfcp_unit *zfcp_unit_lookup(struct zfcp_adapter *, int, scsi_id_t,
                                           scsi_lun_t);
@@ -242,7 +243,10 @@ static void
 zfcp_scsi_command_fail(struct scsi_cmnd *scpnt, int result)
 {
         set_host_byte(&scpnt->result, result);
-        zfcp_cmd_dbf_event_scsi("failing", scpnt);
+        if ((scpnt->device != NULL) && (scpnt->device->host != NULL))
+                zfcp_scsi_dbf_event_result("fail", 4,
+                        (struct zfcp_adapter*) scpnt->device->host->hostdata[0],
+                        scpnt);
         /* return directly */
         scpnt->scsi_done(scpnt);
 }
@@ -414,67 +418,38 @@ zfcp_port_lookup(struct zfcp_adapter *adapter, int channel, scsi_id_t id)
         return (struct zfcp_port *) NULL;
 }
 
-/*
- * function:    zfcp_scsi_eh_abort_handler
- *
- * purpose:     tries to abort the specified (timed out) SCSI command
- *
- * note:        We do not need to care for a SCSI command which completes
- *              normally but late during this abort routine runs.
- *              We are allowed to return late commands to the SCSI stack.
- *              It tracks the state of commands and will handle late commands.
- *              (Usually, the normal completion of late commands is ignored with
- *              respect to the running abort operation. Grep for 'done_late'
- *              in the SCSI stacks sources.)
+/**
+ * zfcp_scsi_eh_abort_handler - abort the specified SCSI command
+ * @scpnt: pointer to scsi_cmnd to be aborted 
+ * Return: SUCCESS - command has been aborted and cleaned up in internal
+ *          bookkeeping, SCSI stack won't be called for aborted command
+ *         FAILED - otherwise
  *
- * returns:     SUCCESS - command has been aborted and cleaned up in internal
- *                        bookkeeping,
- *                        SCSI stack won't be called for aborted command
- *              FAILED  - otherwise
+ * We do not need to care for a SCSI command which completes normally
+ * but late during this abort routine runs.  We are allowed to return
+ * late commands to the SCSI stack.  It tracks the state of commands and
+ * will handle late commands.  (Usually, the normal completion of late
+ * commands is ignored with respect to the running abort operation.)
  */
 int
-__zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
+zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
 {
+        struct Scsi_Host *scsi_host;
+        struct zfcp_adapter *adapter;
+        struct zfcp_unit *unit;
         int retval = SUCCESS;
-        struct zfcp_fsf_req *new_fsf_req, *old_fsf_req;
-        struct zfcp_adapter *adapter = (struct zfcp_adapter *) scpnt->device->host->hostdata[0];
-        struct zfcp_unit *unit = (struct zfcp_unit *) scpnt->device->hostdata;
-        struct zfcp_port *port = unit->port;
-        struct Scsi_Host *scsi_host = scpnt->device->host;
-        union zfcp_req_data *req_data = NULL;
+        struct zfcp_fsf_req *new_fsf_req = NULL;
+        struct zfcp_fsf_req *old_fsf_req;
         unsigned long flags;
-        u32 status = 0;
-
-        /* the components of a abort_dbf record (fixed size record) */
-        u64 dbf_scsi_cmnd = (unsigned long) scpnt;
-        char dbf_opcode[ZFCP_ABORT_DBF_LENGTH];
-        wwn_t dbf_wwn = port->wwpn;
-        fcp_lun_t dbf_fcp_lun = unit->fcp_lun;
-        u64 dbf_retries = scpnt->retries;
-        u64 dbf_allowed = scpnt->allowed;
-        u64 dbf_timeout = 0;
-        u64 dbf_fsf_req = 0;
-        u64 dbf_fsf_status = 0;
-        u64 dbf_fsf_qual[2] = { 0, 0 };
-        char dbf_result[ZFCP_ABORT_DBF_LENGTH] = "##undef";
-
-        memset(dbf_opcode, 0, ZFCP_ABORT_DBF_LENGTH);
-        memcpy(dbf_opcode,
-               scpnt->cmnd,
-               min(scpnt->cmd_len, (unsigned char) ZFCP_ABORT_DBF_LENGTH));
+
+        scsi_host = scpnt->device->host;
+        adapter = (struct zfcp_adapter *) scsi_host->hostdata[0];
+        unit = (struct zfcp_unit *) scpnt->device->hostdata;
 
         ZFCP_LOG_INFO("aborting scsi_cmnd=%p on adapter %s\n",
                       scpnt, zfcp_get_busid_by_adapter(adapter));
 
-        spin_unlock_irq(scsi_host->host_lock);
-
-        /*
-         * Race condition between normal (late) completion and abort has
-         * to be avoided.
-         * The entirity of all accesses to scsi_req have to be atomic.
-         * scsi_req is usually part of the fsf_req and thus we block the
-         * release of fsf_req as long as we need to access scsi_req.
-         */
+        /* avoid race condition between late normal completion and abort */
         write_lock_irqsave(&adapter->abort_lock, flags);
 
         /*
@@ -484,144 +459,47 @@ __zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
          * this routine returns. (scpnt is parameter passed to this routine
          * and must not disappear during abort even on late completion.)
          */
-        req_data = (union zfcp_req_data *) scpnt->host_scribble;
-        /* DEBUG */
-        ZFCP_LOG_DEBUG("req_data=%p\n", req_data);
-        if (!req_data) {
-                ZFCP_LOG_DEBUG("late command completion overtook abort\n");
-                /*
-                 * That's it.
-                 * Do not initiate abort but return SUCCESS.
-                 */
-                write_unlock_irqrestore(&adapter->abort_lock, flags);
-                retval = SUCCESS;
-                strncpy(dbf_result, "##late1", ZFCP_ABORT_DBF_LENGTH);
-                goto out;
-        }
-
-        /* Figure out which fsf_req needs to be aborted. */
-        old_fsf_req = req_data->send_fcp_command_task.fsf_req;
-
-        dbf_fsf_req = (unsigned long) old_fsf_req;
-        dbf_timeout =
-            (jiffies - req_data->send_fcp_command_task.start_jiffies) / HZ;
-
-        ZFCP_LOG_DEBUG("old_fsf_req=%p\n", old_fsf_req);
+        old_fsf_req = (struct zfcp_fsf_req *) scpnt->host_scribble;
         if (!old_fsf_req) {
                 write_unlock_irqrestore(&adapter->abort_lock, flags);
-                ZFCP_LOG_NORMAL("bug: no old fsf request found\n");
-                ZFCP_LOG_NORMAL("req_data:\n");
-                ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_NORMAL,
-                              (char *) req_data, sizeof (union zfcp_req_data));
-                ZFCP_LOG_NORMAL("scsi_cmnd:\n");
-                ZFCP_HEX_DUMP(ZFCP_LOG_LEVEL_NORMAL,
-                              (char *) scpnt, sizeof (struct scsi_cmnd));
-                retval = FAILED;
-                strncpy(dbf_result, "##bug:r", ZFCP_ABORT_DBF_LENGTH);
+                zfcp_scsi_dbf_event_abort("lte1", adapter, scpnt, new_fsf_req);
+                retval = SUCCESS;
                 goto out;
         }
-        old_fsf_req->data.send_fcp_command_task.scsi_cmnd = NULL;
-        /* mark old request as being aborted */
+        old_fsf_req->data = 0;
         old_fsf_req->status |= ZFCP_STATUS_FSFREQ_ABORTING;
-        /*
-         * We have to collect all information (e.g. unit) needed by 
-         * zfcp_fsf_abort_fcp_command before calling that routine
-         * since that routine is not allowed to access
-         * fsf_req which it is going to abort.
-         * This is because of we need to release fsf_req_list_lock
-         * before calling zfcp_fsf_abort_fcp_command.
-         * Since this lock will not be held, fsf_req may complete
-         * late and may be released meanwhile.
-         */
-        ZFCP_LOG_DEBUG("unit 0x%016Lx (%p)\n", unit->fcp_lun, unit);
 
-        /*
-         * We block (call schedule)
-         * That's why we must release the lock and enable the
-         * interrupts before.
-         * On the other hand we do not need the lock anymore since
-         * all critical accesses to scsi_req are done.
-         */
+        /* don't access old_fsf_req after releasing the abort_lock */
         write_unlock_irqrestore(&adapter->abort_lock, flags);
         /* call FSF routine which does the abort */
         new_fsf_req = zfcp_fsf_abort_fcp_command((unsigned long) old_fsf_req,
                                                  adapter, unit, 0);
-        ZFCP_LOG_DEBUG("new_fsf_req=%p\n", new_fsf_req);
         if (!new_fsf_req) {
+                ZFCP_LOG_INFO("error: initiation of Abort FCP Cmnd failed\n");
                 retval = FAILED;
-                ZFCP_LOG_NORMAL("error: initiation of Abort FCP Cmnd "
-                                "failed\n");
-                strncpy(dbf_result, "##nores", ZFCP_ABORT_DBF_LENGTH);
                 goto out;
         }
 
         /* wait for completion of abort */
-        ZFCP_LOG_DEBUG("waiting for cleanup...\n");
-#if 1
-        /*
-         * FIXME:
-         * copying zfcp_fsf_req_wait_and_cleanup code is not really nice
-         */
         __wait_event(new_fsf_req->completion_wq,
                      new_fsf_req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
-        status = new_fsf_req->status;
-        dbf_fsf_status = new_fsf_req->qtcb->header.fsf_status;
-        /*
-         * Ralphs special debug load provides timestamps in the FSF
-         * status qualifier. This might be specified later if being
-         * useful for debugging aborts.
-         */
-        dbf_fsf_qual[0] =
-            *(u64 *) & new_fsf_req->qtcb->header.fsf_status_qual.word[0];
-        dbf_fsf_qual[1] =
-            *(u64 *) & new_fsf_req->qtcb->header.fsf_status_qual.word[2];
-        zfcp_fsf_req_free(new_fsf_req);
-#else
-        retval = zfcp_fsf_req_wait_and_cleanup(new_fsf_req,
-                                               ZFCP_UNINTERRUPTIBLE, &status);
-#endif
-        ZFCP_LOG_DEBUG("Waiting for cleanup complete, status=0x%x\n", status);
+
         /* status should be valid since signals were not permitted */
-        if (status & ZFCP_STATUS_FSFREQ_ABORTSUCCEEDED) {
+        if (new_fsf_req->status & ZFCP_STATUS_FSFREQ_ABORTSUCCEEDED) {
+                zfcp_scsi_dbf_event_abort("okay", adapter, scpnt, new_fsf_req);
                 retval = SUCCESS;
-                strncpy(dbf_result, "##succ", ZFCP_ABORT_DBF_LENGTH);
-        } else if (status & ZFCP_STATUS_FSFREQ_ABORTNOTNEEDED) {
+        } else if (new_fsf_req->status & ZFCP_STATUS_FSFREQ_ABORTNOTNEEDED) {
+                zfcp_scsi_dbf_event_abort("lte2", adapter, scpnt, new_fsf_req);
                 retval = SUCCESS;
-                strncpy(dbf_result, "##late2", ZFCP_ABORT_DBF_LENGTH);
         } else {
+                zfcp_scsi_dbf_event_abort("fail", adapter, scpnt, new_fsf_req);
                 retval = FAILED;
-                strncpy(dbf_result, "##fail", ZFCP_ABORT_DBF_LENGTH);
         }
-
+        zfcp_fsf_req_free(new_fsf_req);
  out:
-        debug_event(adapter->abort_dbf, 1, &dbf_scsi_cmnd, sizeof (u64));
-        debug_event(adapter->abort_dbf, 1, &dbf_opcode, ZFCP_ABORT_DBF_LENGTH);
-        debug_event(adapter->abort_dbf, 1, &dbf_wwn, sizeof (wwn_t));
-        debug_event(adapter->abort_dbf, 1, &dbf_fcp_lun, sizeof (fcp_lun_t));
-        debug_event(adapter->abort_dbf, 1, &dbf_retries, sizeof (u64));
-        debug_event(adapter->abort_dbf, 1, &dbf_allowed, sizeof (u64));
-        debug_event(adapter->abort_dbf, 1, &dbf_timeout, sizeof (u64));
-        debug_event(adapter->abort_dbf, 1, &dbf_fsf_req, sizeof (u64));
-        debug_event(adapter->abort_dbf, 1, &dbf_fsf_status, sizeof (u64));
-        debug_event(adapter->abort_dbf, 1, &dbf_fsf_qual[0], sizeof (u64));
-        debug_event(adapter->abort_dbf, 1, &dbf_fsf_qual[1], sizeof (u64));
-        debug_text_event(adapter->abort_dbf, 1, dbf_result);
-
-        spin_lock_irq(scsi_host->host_lock);
         return retval;
 }
 
-int
-zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
-{
-        int rc;
-        struct Scsi_Host *scsi_host = scpnt->device->host;
-        spin_lock_irq(scsi_host->host_lock);
-        rc = __zfcp_scsi_eh_abort_handler(scpnt);
-        spin_unlock_irq(scsi_host->host_lock);
-        return rc;
-}
-
 /*
  * function:    zfcp_scsi_eh_device_reset_handler
  *
@@ -651,8 +529,9 @@ zfcp_scsi_eh_device_reset_handler(struct scsi_cmnd *scpnt)
          */
         if (!atomic_test_mask(ZFCP_STATUS_UNIT_NOTSUPPUNITRESET,
                               &unit->status)) {
-                retval =
-                    zfcp_task_management_function(unit, FCP_LOGICAL_UNIT_RESET);
+                retval = zfcp_task_management_function(unit,
+                                                       FCP_LOGICAL_UNIT_RESET,
+                                                       scpnt);
                 if (retval) {
                         ZFCP_LOG_DEBUG("unit reset failed (unit=%p)\n", unit);
                         if (retval == -ENOTSUPP)
@@ -668,7 +547,7 @@ zfcp_scsi_eh_device_reset_handler(struct scsi_cmnd *scpnt)
                         goto out;
                 }
         }
-        retval = zfcp_task_management_function(unit, FCP_TARGET_RESET);
+        retval = zfcp_task_management_function(unit, FCP_TARGET_RESET, scpnt);
         if (retval) {
                 ZFCP_LOG_DEBUG("target reset failed (unit=%p)\n", unit);
                 retval = FAILED;
@@ -681,12 +560,12 @@ zfcp_scsi_eh_device_reset_handler(struct scsi_cmnd *scpnt)
 }
 
 static int
-zfcp_task_management_function(struct zfcp_unit *unit, u8 tm_flags)
+zfcp_task_management_function(struct zfcp_unit *unit, u8 tm_flags,
+                              struct scsi_cmnd *scpnt)
 {
         struct zfcp_adapter *adapter = unit->port->adapter;
-        int retval;
-        int status;
         struct zfcp_fsf_req *fsf_req;
+        int retval = 0;
 
         /* issue task management function */
         fsf_req = zfcp_fsf_send_fcp_command_task_management
@@ -696,70 +575,63 @@ zfcp_task_management_function(struct zfcp_unit *unit, u8 tm_flags)
                               "failed for unit 0x%016Lx on port 0x%016Lx on  "
                               "adapter %s\n", unit->fcp_lun, unit->port->wwpn,
                               zfcp_get_busid_by_adapter(adapter));
+                zfcp_scsi_dbf_event_devreset("nres", tm_flags, unit, scpnt);
                 retval = -ENOMEM;
                 goto out;
         }
 
-        retval = zfcp_fsf_req_wait_and_cleanup(fsf_req,
-                                               ZFCP_UNINTERRUPTIBLE, &status);
+        __wait_event(fsf_req->completion_wq,
+                     fsf_req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
+
         /*
          * check completion status of task management function
-         * (status should always be valid since no signals permitted)
          */
-        if (status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED)
+        if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED) {
+                zfcp_scsi_dbf_event_devreset("fail", tm_flags, unit, scpnt);
                 retval = -EIO;
-        else if (status & ZFCP_STATUS_FSFREQ_TMFUNCNOTSUPP)
+        } else if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCNOTSUPP) {
+                zfcp_scsi_dbf_event_devreset("nsup", tm_flags, unit, scpnt);
                 retval = -ENOTSUPP;
-        else
-                retval = 0;
+        } else
+                zfcp_scsi_dbf_event_devreset("okay", tm_flags, unit, scpnt);
+
+        zfcp_fsf_req_free(fsf_req);
  out:
         return retval;
 }
 
-/*
- * function:    zfcp_scsi_eh_bus_reset_handler
- *
- * purpose:
- *
- * returns:
+/**
+ * zfcp_scsi_eh_bus_reset_handler - reset bus (reopen adapter)
  */
 int
 zfcp_scsi_eh_bus_reset_handler(struct scsi_cmnd *scpnt)
 {
-        int retval = 0;
-        struct zfcp_unit *unit;
+        struct zfcp_unit *unit = (struct zfcp_unit*) scpnt->device->hostdata;
+        struct zfcp_adapter *adapter = unit->port->adapter;
 
-        unit = (struct zfcp_unit *) scpnt->device->hostdata;
         ZFCP_LOG_NORMAL("bus reset because of problems with "
                         "unit 0x%016Lx\n", unit->fcp_lun);
-        zfcp_erp_adapter_reopen(unit->port->adapter, 0);
-        zfcp_erp_wait(unit->port->adapter);
-        retval = SUCCESS;
+        zfcp_erp_adapter_reopen(adapter, 0);
+        zfcp_erp_wait(adapter);
 
-        return retval;
+        return SUCCESS;
 }
 
-/*
- * function:    zfcp_scsi_eh_host_reset_handler
- *
- * purpose:
- *
- * returns:
+/**
+ * zfcp_scsi_eh_host_reset_handler - reset host (reopen adapter)
  */
 int
 zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt)
 {
-        int retval = 0;
-        struct zfcp_unit *unit;
+        struct zfcp_unit *unit = (struct zfcp_unit*) scpnt->device->hostdata;
+        struct zfcp_adapter *adapter = unit->port->adapter;
 
-        unit = (struct zfcp_unit *) scpnt->device->hostdata;
         ZFCP_LOG_NORMAL("host reset because of problems with "
                         "unit 0x%016Lx\n", unit->fcp_lun);
-        zfcp_erp_adapter_reopen(unit->port->adapter, 0);
-        zfcp_erp_wait(unit->port->adapter);
-        retval = SUCCESS;
+        zfcp_erp_adapter_reopen(adapter, 0);
+        zfcp_erp_wait(adapter);
 
-        return retval;
+        return SUCCESS;
 }
 
 /*
@@ -826,10 +698,16 @@ void
 zfcp_adapter_scsi_unregister(struct zfcp_adapter *adapter)
 {
         struct Scsi_Host *shost;
+        struct zfcp_port *port;
 
         shost = adapter->scsi_host;
         if (!shost)
                 return;
+        read_lock_irq(&zfcp_data.config_lock);
+        list_for_each_entry(port, &adapter->port_list_head, list)
+                if (port->rport)
+                        port->rport = NULL;
+        read_unlock_irq(&zfcp_data.config_lock);
         fc_remove_host(shost);
         scsi_remove_host(shost);
         scsi_host_put(shost);
@@ -904,18 +782,6 @@ zfcp_get_node_name(struct scsi_target *starget)
         read_unlock_irqrestore(&zfcp_data.config_lock, flags);
 }
 
-void
-zfcp_set_fc_host_attrs(struct zfcp_adapter *adapter)
-{
-        struct Scsi_Host *shost = adapter->scsi_host;
-
-        fc_host_node_name(shost) = adapter->wwnn;
-        fc_host_port_name(shost) = adapter->wwpn;
-        strncpy(fc_host_serial_number(shost), adapter->serial_number,
-                min(FC_SERIAL_NUMBER_SIZE, 32));
-        fc_host_supported_classes(shost) = FC_COS_CLASS2 | FC_COS_CLASS3;
-}
-
 struct fc_function_template zfcp_transport_functions = {
         .get_starget_port_id = zfcp_get_port_id,
         .get_starget_port_name = zfcp_get_port_name,
@@ -927,7 +793,10 @@ struct fc_function_template zfcp_transport_functions = {
         .show_host_node_name = 1,
         .show_host_port_name = 1,
         .show_host_supported_classes = 1,
+        .show_host_maxframe_size = 1,
         .show_host_serial_number = 1,
+        .show_host_speed = 1,
+        .show_host_port_id = 1,
 };
 
 /**
diff --git a/drivers/s390/scsi/zfcp_sysfs_adapter.c b/drivers/s390/scsi/zfcp_sysfs_adapter.c
index e7345a74800a..0cd435280e7d 100644
--- a/drivers/s390/scsi/zfcp_sysfs_adapter.c
+++ b/drivers/s390/scsi/zfcp_sysfs_adapter.c
@@ -62,21 +62,18 @@ static ssize_t zfcp_sysfs_adapter_##_name##_show(struct device *dev, struct devi
 static DEVICE_ATTR(_name, S_IRUGO, zfcp_sysfs_adapter_##_name##_show, NULL);
 
 ZFCP_DEFINE_ADAPTER_ATTR(status, "0x%08x\n", atomic_read(&adapter->status));
-ZFCP_DEFINE_ADAPTER_ATTR(wwnn, "0x%016llx\n", adapter->wwnn);
-ZFCP_DEFINE_ADAPTER_ATTR(wwpn, "0x%016llx\n", adapter->wwpn);
-ZFCP_DEFINE_ADAPTER_ATTR(s_id, "0x%06x\n", adapter->s_id);
 ZFCP_DEFINE_ADAPTER_ATTR(peer_wwnn, "0x%016llx\n", adapter->peer_wwnn);
 ZFCP_DEFINE_ADAPTER_ATTR(peer_wwpn, "0x%016llx\n", adapter->peer_wwpn);
 ZFCP_DEFINE_ADAPTER_ATTR(peer_d_id, "0x%06x\n", adapter->peer_d_id);
+ZFCP_DEFINE_ADAPTER_ATTR(physical_wwpn, "0x%016llx\n", adapter->physical_wwpn);
+ZFCP_DEFINE_ADAPTER_ATTR(physical_s_id, "0x%06x\n", adapter->physical_s_id);
 ZFCP_DEFINE_ADAPTER_ATTR(card_version, "0x%04x\n", adapter->hydra_version);
 ZFCP_DEFINE_ADAPTER_ATTR(lic_version, "0x%08x\n", adapter->fsf_lic_version);
-ZFCP_DEFINE_ADAPTER_ATTR(fc_link_speed, "%d Gb/s\n", adapter->fc_link_speed);
 ZFCP_DEFINE_ADAPTER_ATTR(fc_service_class, "%d\n", adapter->fc_service_class);
 ZFCP_DEFINE_ADAPTER_ATTR(fc_topology, "%s\n",
                          fc_topologies[adapter->fc_topology]);
 ZFCP_DEFINE_ADAPTER_ATTR(hardware_version, "0x%08x\n",
                          adapter->hardware_version);
-ZFCP_DEFINE_ADAPTER_ATTR(serial_number, "%17s\n", adapter->serial_number);
 ZFCP_DEFINE_ADAPTER_ATTR(scsi_host_no, "0x%x\n", adapter->scsi_host_no);
 ZFCP_DEFINE_ADAPTER_ATTR(in_recovery, "%d\n", atomic_test_mask
                          (ZFCP_STATUS_COMMON_ERP_INUSE, &adapter->status));
@@ -255,21 +252,18 @@ static struct attribute *zfcp_adapter_attrs[] = {
         &dev_attr_in_recovery.attr,
         &dev_attr_port_remove.attr,
         &dev_attr_port_add.attr,
-        &dev_attr_wwnn.attr,
-        &dev_attr_wwpn.attr,
-        &dev_attr_s_id.attr,
         &dev_attr_peer_wwnn.attr,
         &dev_attr_peer_wwpn.attr,
         &dev_attr_peer_d_id.attr,
+        &dev_attr_physical_wwpn.attr,
+        &dev_attr_physical_s_id.attr,
         &dev_attr_card_version.attr,
         &dev_attr_lic_version.attr,
-        &dev_attr_fc_link_speed.attr,
         &dev_attr_fc_service_class.attr,
         &dev_attr_fc_topology.attr,
         &dev_attr_scsi_host_no.attr,
         &dev_attr_status.attr,
         &dev_attr_hardware_version.attr,
-        &dev_attr_serial_number.attr,
         NULL
 };
 
diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c
index dbad7f35eb0a..24ed5893b4f0 100644
--- a/drivers/sbus/char/display7seg.c
+++ b/drivers/sbus/char/display7seg.c
@@ -14,7 +14,7 @@
 #include <linux/major.h>
 #include <linux/init.h>
 #include <linux/miscdevice.h>
-#include <linux/ioport.h>               /* request_region, check_region */
+#include <linux/ioport.h>               /* request_region */
 #include <asm/atomic.h>
 #include <asm/ebus.h>                   /* EBus device                                  */
 #include <asm/oplib.h>                  /* OpenProm Library                     */
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index a6ac61611f35..a748fbfb6692 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -60,6 +60,7 @@
                  Remove un-needed eh_abort handler.
                  Add support for embedded firmware error strings.
    2.26.02.003 - Correctly handle single sgl's with use_sg=1.
+   2.26.02.004 - Add support for 9550SX controllers.
 */
 
 #include <linux/module.h>
@@ -82,7 +83,7 @@
 #include "3w-9xxx.h"
 
 /* Globals */
-#define TW_DRIVER_VERSION "2.26.02.003"
+#define TW_DRIVER_VERSION "2.26.02.004"
 static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
 static unsigned int twa_device_extension_count;
 static int twa_major = -1;
@@ -892,11 +893,6 @@ static int twa_decode_bits(TW_Device_Extension *tw_dev, u32 status_reg_value)
                 writel(TW_CONTROL_CLEAR_QUEUE_ERROR, TW_CONTROL_REG_ADDR(tw_dev));
         }
 
-        if (status_reg_value & TW_STATUS_SBUF_WRITE_ERROR) {
-                TW_PRINTK(tw_dev->host, TW_DRIVER, 0xf, "SBUF Write Error: clearing");
-                writel(TW_CONTROL_CLEAR_SBUF_WRITE_ERROR, TW_CONTROL_REG_ADDR(tw_dev));
-        }
-
         if (status_reg_value & TW_STATUS_MICROCONTROLLER_ERROR) {
                 if (tw_dev->reset_print == 0) {
                         TW_PRINTK(tw_dev->host, TW_DRIVER, 0x10, "Microcontroller Error: clearing");
@@ -930,6 +926,36 @@ out:
         return retval;
 } /* End twa_empty_response_queue() */
 
+/* This function will clear the pchip/response queue on 9550SX */
+static int twa_empty_response_queue_large(TW_Device_Extension *tw_dev)
+{
+        u32 status_reg_value, response_que_value;
+        int count = 0, retval = 1;
+
+        if (tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9550SX) {
+                status_reg_value = readl(TW_STATUS_REG_ADDR(tw_dev));
+
+                while (((status_reg_value & TW_STATUS_RESPONSE_QUEUE_EMPTY) == 0) && (count < TW_MAX_RESPONSE_DRAIN)) {
+                        response_que_value = readl(TW_RESPONSE_QUEUE_REG_ADDR_LARGE(tw_dev));
+                        if ((response_que_value & TW_9550SX_DRAIN_COMPLETED) == TW_9550SX_DRAIN_COMPLETED) {
+                                /* P-chip settle time */
+                                msleep(500);
+                                retval = 0;
+                                goto out;
+                        }
+                        status_reg_value = readl(TW_STATUS_REG_ADDR(tw_dev));
+                        count++;
+                }
+                if (count == TW_MAX_RESPONSE_DRAIN)
+                        goto out;
+                
+                retval = 0;
+        } else
+                retval = 0;
+out:
+        return retval;
+} /* End twa_empty_response_queue_large() */
+
 /* This function passes sense keys from firmware to scsi layer */
 static int twa_fill_sense(TW_Device_Extension *tw_dev, int request_id, int copy_sense, int print_host)
 {
@@ -1613,8 +1639,16 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset)
         int tries = 0, retval = 1, flashed = 0, do_soft_reset = soft_reset;
 
         while (tries < TW_MAX_RESET_TRIES) {
-                if (do_soft_reset)
+                if (do_soft_reset) {
                         TW_SOFT_RESET(tw_dev);
+                        /* Clear pchip/response queue on 9550SX */
+                        if (twa_empty_response_queue_large(tw_dev)) {
+                                TW_PRINTK(tw_dev->host, TW_DRIVER, 0x36, "Response queue (large) empty failed during reset sequence");
+                                do_soft_reset = 1;
+                                tries++;
+                                continue;
+                        }
+                }
 
                 /* Make sure controller is in a good state */
                 if (twa_poll_status(tw_dev, TW_STATUS_MICROCONTROLLER_READY | (do_soft_reset == 1 ? TW_STATUS_ATTENTION_INTERRUPT : 0), 60)) {
@@ -2034,7 +2068,10 @@ static int __devinit twa_probe(struct pci_dev *pdev, const struct pci_device_id
                 goto out_free_device_extension;
         }
 
-        mem_addr = pci_resource_start(pdev, 1);
+        if (pdev->device == PCI_DEVICE_ID_3WARE_9000)
+                mem_addr = pci_resource_start(pdev, 1);
+        else
+                mem_addr = pci_resource_start(pdev, 2);
 
         /* Save base address */
         tw_dev->base_addr = ioremap(mem_addr, PAGE_SIZE);
@@ -2148,6 +2185,8 @@ static void twa_remove(struct pci_dev *pdev)
 static struct pci_device_id twa_pci_tbl[] __devinitdata = {
         { PCI_VENDOR_ID_3WARE, PCI_DEVICE_ID_3WARE_9000,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_3WARE, PCI_DEVICE_ID_3WARE_9550SX,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { }
 };
 MODULE_DEVICE_TABLE(pci, twa_pci_tbl);
diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h
index 8c8ecbed3b58..46f22cdc8298 100644
--- a/drivers/scsi/3w-9xxx.h
+++ b/drivers/scsi/3w-9xxx.h
@@ -267,7 +267,6 @@ static twa_message_type twa_error_table[] = {
 #define TW_CONTROL_CLEAR_PARITY_ERROR          0x00800000
 #define TW_CONTROL_CLEAR_QUEUE_ERROR           0x00400000
 #define TW_CONTROL_CLEAR_PCI_ABORT             0x00100000
-#define TW_CONTROL_CLEAR_SBUF_WRITE_ERROR      0x00000008
 
 /* Status register bit definitions */
 #define TW_STATUS_MAJOR_VERSION_MASK           0xF0000000
@@ -285,9 +284,8 @@ static twa_message_type twa_error_table[] = {
 #define TW_STATUS_MICROCONTROLLER_READY        0x00002000
 #define TW_STATUS_COMMAND_QUEUE_EMPTY          0x00001000
 #define TW_STATUS_EXPECTED_BITS                0x00002000
-#define TW_STATUS_UNEXPECTED_BITS              0x00F00008
-#define TW_STATUS_SBUF_WRITE_ERROR             0x00000008
-#define TW_STATUS_VALID_INTERRUPT              0x00DF0008
+#define TW_STATUS_UNEXPECTED_BITS              0x00F00000
+#define TW_STATUS_VALID_INTERRUPT              0x00DF0000
 
 /* RESPONSE QUEUE BIT DEFINITIONS */
 #define TW_RESPONSE_ID_MASK                    0x00000FF0
@@ -324,9 +322,9 @@ static twa_message_type twa_error_table[] = {
 
 /* Compatibility defines */
 #define TW_9000_ARCH_ID 0x5
-#define TW_CURRENT_DRIVER_SRL 28
-#define TW_CURRENT_DRIVER_BUILD 9
-#define TW_CURRENT_DRIVER_BRANCH 4
+#define TW_CURRENT_DRIVER_SRL 30
+#define TW_CURRENT_DRIVER_BUILD 80
+#define TW_CURRENT_DRIVER_BRANCH 0
 
 /* Phase defines */
 #define TW_PHASE_INITIAL 0
@@ -334,6 +332,7 @@ static twa_message_type twa_error_table[] = {
 #define TW_PHASE_SGLIST  2
 
 /* Misc defines */
+#define TW_9550SX_DRAIN_COMPLETED             0xFFFF
 #define TW_SECTOR_SIZE                        512
 #define TW_ALIGNMENT_9000                     4  /* 4 bytes */
 #define TW_ALIGNMENT_9000_SGL                 0x3
@@ -417,6 +416,9 @@ static twa_message_type twa_error_table[] = {
 #ifndef PCI_DEVICE_ID_3WARE_9000
 #define PCI_DEVICE_ID_3WARE_9000 0x1002
 #endif
+#ifndef PCI_DEVICE_ID_3WARE_9550SX
+#define PCI_DEVICE_ID_3WARE_9550SX 0x1003
+#endif
 
 /* Bitmask macros to eliminate bitfields */
 
@@ -443,6 +445,7 @@ static twa_message_type twa_error_table[] = {
 #define TW_STATUS_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + 0x4)
 #define TW_COMMAND_QUEUE_REG_ADDR(x) (sizeof(dma_addr_t) > 4 ? ((unsigned char __iomem *)x->base_addr + 0x20) : ((unsigned char __iomem *)x->base_addr + 0x8))
 #define TW_RESPONSE_QUEUE_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + 0xC)
+#define TW_RESPONSE_QUEUE_REG_ADDR_LARGE(x) ((unsigned char __iomem *)x->base_addr + 0x30)
 #define TW_CLEAR_ALL_INTERRUPTS(x) (writel(TW_STATUS_VALID_INTERRUPT, TW_CONTROL_REG_ADDR(x)))
 #define TW_CLEAR_ATTENTION_INTERRUPT(x) (writel(TW_CONTROL_CLEAR_ATTENTION_INTERRUPT, TW_CONTROL_REG_ADDR(x)))
 #define TW_CLEAR_HOST_INTERRUPT(x) (writel(TW_CONTROL_CLEAR_HOST_INTERRUPT, TW_CONTROL_REG_ADDR(x)))
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index 1e491ae9a7c5..e2e3d8671930 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -99,6 +99,7 @@ obj-$(CONFIG_SCSI_DC395x)	+= dc395x.o
 obj-$(CONFIG_SCSI_DC390T)       += tmscsim.o
 obj-$(CONFIG_MEGARAID_LEGACY)   += megaraid.o
 obj-$(CONFIG_MEGARAID_NEWGEN)   += megaraid/
+obj-$(CONFIG_MEGARAID_SAS)      += megaraid/
 obj-$(CONFIG_SCSI_ACARD)        += atp870u.o
 obj-$(CONFIG_SCSI_SUNESP)       += esp.o
 obj-$(CONFIG_SCSI_GDTH)         += gdth.o
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index a8e3dfcd0dc7..93416f760e5a 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -313,18 +313,37 @@ int aac_get_containers(struct aac_dev *dev)
                 }
                 dresp = (struct aac_mount *)fib_data(fibptr);
 
+                if ((le32_to_cpu(dresp->status) == ST_OK) &&
+                    (le32_to_cpu(dresp->mnt[0].vol) == CT_NONE)) {
+                        dinfo->command = cpu_to_le32(VM_NameServe64);
+                        dinfo->count = cpu_to_le32(index);
+                        dinfo->type = cpu_to_le32(FT_FILESYS);
+
+                        if (fib_send(ContainerCommand,
+                                    fibptr,
+                                    sizeof(struct aac_query_mount),
+                                    FsaNormal,
+                                    1, 1,
+                                    NULL, NULL) < 0)
+                                continue;
+                } else
+                        dresp->mnt[0].capacityhigh = 0;
+
                 dprintk ((KERN_DEBUG
-                  "VM_NameServe cid=%d status=%d vol=%d state=%d cap=%u\n",
+                  "VM_NameServe cid=%d status=%d vol=%d state=%d cap=%llu\n",
                   (int)index, (int)le32_to_cpu(dresp->status),
                   (int)le32_to_cpu(dresp->mnt[0].vol),
                   (int)le32_to_cpu(dresp->mnt[0].state),
-                  (unsigned)le32_to_cpu(dresp->mnt[0].capacity)));
+                  ((u64)le32_to_cpu(dresp->mnt[0].capacity)) +
+                    (((u64)le32_to_cpu(dresp->mnt[0].capacityhigh)) << 32)));
                 if ((le32_to_cpu(dresp->status) == ST_OK) &&
                     (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE) &&
                     (le32_to_cpu(dresp->mnt[0].state) != FSCS_HIDDEN)) {
                         fsa_dev_ptr[index].valid = 1;
                         fsa_dev_ptr[index].type = le32_to_cpu(dresp->mnt[0].vol);
-                        fsa_dev_ptr[index].size = le32_to_cpu(dresp->mnt[0].capacity);
+                        fsa_dev_ptr[index].size
+                          = ((u64)le32_to_cpu(dresp->mnt[0].capacity)) +
+                            (((u64)le32_to_cpu(dresp->mnt[0].capacityhigh)) << 32);
                         if (le32_to_cpu(dresp->mnt[0].state) & FSCS_READONLY)
                                     fsa_dev_ptr[index].ro = 1;
                 }
@@ -460,7 +479,7 @@ static int aac_get_container_name(struct scsi_cmnd * scsicmd, int cid)
  *      is updated in the struct fsa_dev_info structure rather than returned.
  */
  
-static int probe_container(struct aac_dev *dev, int cid)
+int probe_container(struct aac_dev *dev, int cid)
 {
         struct fsa_dev_info *fsa_dev_ptr;
         int status;
@@ -497,11 +516,29 @@ static int probe_container(struct aac_dev *dev, int cid)
         dresp = (struct aac_mount *) fib_data(fibptr);
 
         if ((le32_to_cpu(dresp->status) == ST_OK) &&
+            (le32_to_cpu(dresp->mnt[0].vol) == CT_NONE)) {
+                dinfo->command = cpu_to_le32(VM_NameServe64);
+                dinfo->count = cpu_to_le32(cid);
+                dinfo->type = cpu_to_le32(FT_FILESYS);
+
+                if (fib_send(ContainerCommand,
+                            fibptr,
+                            sizeof(struct aac_query_mount),
+                            FsaNormal,
+                            1, 1,
+                            NULL, NULL) < 0)
+                        goto error;
+        } else
+                dresp->mnt[0].capacityhigh = 0;
+
+        if ((le32_to_cpu(dresp->status) == ST_OK) &&
             (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE) &&
             (le32_to_cpu(dresp->mnt[0].state) != FSCS_HIDDEN)) {
                 fsa_dev_ptr[cid].valid = 1;
                 fsa_dev_ptr[cid].type = le32_to_cpu(dresp->mnt[0].vol);
-                fsa_dev_ptr[cid].size = le32_to_cpu(dresp->mnt[0].capacity);
+                fsa_dev_ptr[cid].size
+                  = ((u64)le32_to_cpu(dresp->mnt[0].capacity)) +
+                    (((u64)le32_to_cpu(dresp->mnt[0].capacityhigh)) << 32);
                 if (le32_to_cpu(dresp->mnt[0].state) & FSCS_READONLY)
                         fsa_dev_ptr[cid].ro = 1;
         }
@@ -655,7 +692,7 @@ int aac_get_adapter_info(struct aac_dev* dev)
                          fibptr, 
                          sizeof(*info),
                          FsaNormal, 
-                         1, 1, 
+                         -1, 1, /* First `interrupt' command uses special wait */
                          NULL, 
                          NULL);
 
@@ -806,8 +843,8 @@ int aac_get_adapter_info(struct aac_dev* dev)
         if (!(dev->raw_io_interface)) {
                 dev->scsi_host_ptr->sg_tablesize = (dev->max_fib_size -
                         sizeof(struct aac_fibhdr) -
-                        sizeof(struct aac_write) + sizeof(struct sgmap)) /
-                                sizeof(struct sgmap);
+                        sizeof(struct aac_write) + sizeof(struct sgentry)) /
+                                sizeof(struct sgentry);
                 if (dev->dac_support) {
                         /* 
                          * 38 scatter gather elements 
@@ -816,8 +853,8 @@ int aac_get_adapter_info(struct aac_dev* dev)
                                 (dev->max_fib_size -
                                 sizeof(struct aac_fibhdr) -
                                 sizeof(struct aac_write64) +
-                                sizeof(struct sgmap64)) /
-                                        sizeof(struct sgmap64);
+                                sizeof(struct sgentry64)) /
+                                        sizeof(struct sgentry64);
                 }
                 dev->scsi_host_ptr->max_sectors = AAC_MAX_32BIT_SGBCOUNT;
                 if(!(dev->adapter_info.options & AAC_OPT_NEW_COMM)) {
@@ -854,7 +891,40 @@ static void io_callback(void *context, struct fib * fibptr)
         dev = (struct aac_dev *)scsicmd->device->host->hostdata;
         cid = ID_LUN_TO_CONTAINER(scsicmd->device->id, scsicmd->device->lun);
 
-        dprintk((KERN_DEBUG "io_callback[cpu %d]: lba = %u, t = %ld.\n", smp_processor_id(), ((scsicmd->cmnd[1] & 0x1F) << 16) | (scsicmd->cmnd[2] << 8) | scsicmd->cmnd[3], jiffies));
+        if (nblank(dprintk(x))) {
+                u64 lba;
+                switch (scsicmd->cmnd[0]) {
+                case WRITE_6:
+                case READ_6:
+                        lba = ((scsicmd->cmnd[1] & 0x1F) << 16) |
+                            (scsicmd->cmnd[2] << 8) | scsicmd->cmnd[3];
+                        break;
+                case WRITE_16:
+                case READ_16:
+                        lba = ((u64)scsicmd->cmnd[2] << 56) |
+                              ((u64)scsicmd->cmnd[3] << 48) |
+                              ((u64)scsicmd->cmnd[4] << 40) |
+                              ((u64)scsicmd->cmnd[5] << 32) |
+                              ((u64)scsicmd->cmnd[6] << 24) |
+                              (scsicmd->cmnd[7] << 16) |
+                              (scsicmd->cmnd[8] << 8) | scsicmd->cmnd[9];
+                        break;
+                case WRITE_12:
+                case READ_12:
+                        lba = ((u64)scsicmd->cmnd[2] << 24) |
+                              (scsicmd->cmnd[3] << 16) |
+                              (scsicmd->cmnd[4] << 8) | scsicmd->cmnd[5];
+                        break;
+                default:
+                        lba = ((u64)scsicmd->cmnd[2] << 24) |
+                               (scsicmd->cmnd[3] << 16) |
+                               (scsicmd->cmnd[4] << 8) | scsicmd->cmnd[5];
+                        break;
+                }
+                printk(KERN_DEBUG
+                  "io_callback[cpu %d]: lba = %llu, t = %ld.\n",
+                  smp_processor_id(), (unsigned long long)lba, jiffies);
+        }
 
         if (fibptr == NULL)
                 BUG();
@@ -895,7 +965,7 @@ static void io_callback(void *context, struct fib * fibptr)
 
 static int aac_read(struct scsi_cmnd * scsicmd, int cid)
 {
-        u32 lba;
+        u64 lba;
         u32 count;
         int status;
 
@@ -907,23 +977,69 @@ static int aac_read(struct scsi_cmnd * scsicmd, int cid)
         /*
          *      Get block address and transfer length
          */
-        if (scsicmd->cmnd[0] == READ_6) /* 6 byte command */
-        {
+        switch (scsicmd->cmnd[0]) {
+        case READ_6:
                 dprintk((KERN_DEBUG "aachba: received a read(6) command on id %d.\n", cid));
 
-                lba = ((scsicmd->cmnd[1] & 0x1F) << 16) | (scsicmd->cmnd[2] << 8) | scsicmd->cmnd[3];
+                lba = ((scsicmd->cmnd[1] & 0x1F) << 16) | 
+                        (scsicmd->cmnd[2] << 8) | scsicmd->cmnd[3];
                 count = scsicmd->cmnd[4];
 
                 if (count == 0)
                         count = 256;
-        } else {
+                break;
+        case READ_16:
+                dprintk((KERN_DEBUG "aachba: received a read(16) command on id %d.\n", cid));
+
+                lba =   ((u64)scsicmd->cmnd[2] << 56) |
+                        ((u64)scsicmd->cmnd[3] << 48) |
+                        ((u64)scsicmd->cmnd[4] << 40) |
+                        ((u64)scsicmd->cmnd[5] << 32) |
+                        ((u64)scsicmd->cmnd[6] << 24) | 
+                        (scsicmd->cmnd[7] << 16) |
+                        (scsicmd->cmnd[8] << 8) | scsicmd->cmnd[9];
+                count = (scsicmd->cmnd[10] << 24) | 
+                        (scsicmd->cmnd[11] << 16) |
+                        (scsicmd->cmnd[12] << 8) | scsicmd->cmnd[13];
+                break;
+        case READ_12:
+                dprintk((KERN_DEBUG "aachba: received a read(12) command on id %d.\n", cid));
+
+                lba = ((u64)scsicmd->cmnd[2] << 24) | 
+                        (scsicmd->cmnd[3] << 16) |
+                        (scsicmd->cmnd[4] << 8) | scsicmd->cmnd[5];
+                count = (scsicmd->cmnd[6] << 24) | 
+                        (scsicmd->cmnd[7] << 16) |
+                        (scsicmd->cmnd[8] << 8) | scsicmd->cmnd[9];
+                break;
+        default:
                 dprintk((KERN_DEBUG "aachba: received a read(10) command on id %d.\n", cid));
 
-                lba = (scsicmd->cmnd[2] << 24) | (scsicmd->cmnd[3] << 16) | (scsicmd->cmnd[4] << 8) | scsicmd->cmnd[5];
+                lba = ((u64)scsicmd->cmnd[2] << 24) | 
+                        (scsicmd->cmnd[3] << 16) | 
+                        (scsicmd->cmnd[4] << 8) | scsicmd->cmnd[5];
                 count = (scsicmd->cmnd[7] << 8) | scsicmd->cmnd[8];
+                break;
         }
-        dprintk((KERN_DEBUG "aac_read[cpu %d]: lba = %u, t = %ld.\n",
+        dprintk((KERN_DEBUG "aac_read[cpu %d]: lba = %llu, t = %ld.\n",
           smp_processor_id(), (unsigned long long)lba, jiffies));
+        if ((!(dev->raw_io_interface) || !(dev->raw_io_64)) &&
+                (lba & 0xffffffff00000000LL)) {
+                dprintk((KERN_DEBUG "aac_read: Illegal lba\n"));
+                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | 
+                        SAM_STAT_CHECK_CONDITION;
+                set_sense((u8 *) &dev->fsa_dev[cid].sense_data,
+                            HARDWARE_ERROR,
+                            SENCODE_INTERNAL_TARGET_FAILURE,
+                            ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0,
+                            0, 0);
+                memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
+                  (sizeof(dev->fsa_dev[cid].sense_data) > sizeof(scsicmd->sense_buffer))
+                    ? sizeof(scsicmd->sense_buffer)
+                    : sizeof(dev->fsa_dev[cid].sense_data));
+                scsicmd->scsi_done(scsicmd);
+                return 0;
+        }
         /*
          *      Alocate and initialize a Fib
          */
@@ -936,8 +1052,8 @@ static int aac_read(struct scsi_cmnd * scsicmd, int cid)
         if (dev->raw_io_interface) {
                 struct aac_raw_io *readcmd;
                 readcmd = (struct aac_raw_io *) fib_data(cmd_fibcontext);
-                readcmd->block[0] = cpu_to_le32(lba);
-                readcmd->block[1] = 0;
+                readcmd->block[0] = cpu_to_le32((u32)(lba&0xffffffff));
+                readcmd->block[1] = cpu_to_le32((u32)((lba&0xffffffff00000000LL)>>32));
                 readcmd->count = cpu_to_le32(count<<9);
                 readcmd->cid = cpu_to_le16(cid);
                 readcmd->flags = cpu_to_le16(1);
@@ -964,7 +1080,7 @@ static int aac_read(struct scsi_cmnd * scsicmd, int cid)
                 readcmd->command = cpu_to_le32(VM_CtHostRead64);
                 readcmd->cid = cpu_to_le16(cid);
                 readcmd->sector_count = cpu_to_le16(count);
-                readcmd->block = cpu_to_le32(lba);
+                readcmd->block = cpu_to_le32((u32)(lba&0xffffffff));
                 readcmd->pad   = 0;
                 readcmd->flags = 0; 
 
@@ -989,7 +1105,7 @@ static int aac_read(struct scsi_cmnd * scsicmd, int cid)
                 readcmd = (struct aac_read *) fib_data(cmd_fibcontext);
                 readcmd->command = cpu_to_le32(VM_CtBlockRead);
                 readcmd->cid = cpu_to_le32(cid);
-                readcmd->block = cpu_to_le32(lba);
+                readcmd->block = cpu_to_le32((u32)(lba&0xffffffff));
                 readcmd->count = cpu_to_le32(count * 512);
 
                 aac_build_sg(scsicmd, &readcmd->sg);
@@ -1031,7 +1147,7 @@ static int aac_read(struct scsi_cmnd * scsicmd, int cid)
 
 static int aac_write(struct scsi_cmnd * scsicmd, int cid)
 {
-        u32 lba;
+        u64 lba;
         u32 count;
         int status;
         u16 fibsize;
@@ -1048,13 +1164,48 @@ static int aac_write(struct scsi_cmnd * scsicmd, int cid)
                 count = scsicmd->cmnd[4];
                 if (count == 0)
                         count = 256;
+        } else if (scsicmd->cmnd[0] == WRITE_16) { /* 16 byte command */
+                dprintk((KERN_DEBUG "aachba: received a write(16) command on id %d.\n", cid));
+
+                lba =   ((u64)scsicmd->cmnd[2] << 56) |
+                        ((u64)scsicmd->cmnd[3] << 48) |
+                        ((u64)scsicmd->cmnd[4] << 40) |
+                        ((u64)scsicmd->cmnd[5] << 32) |
+                        ((u64)scsicmd->cmnd[6] << 24) | 
+                        (scsicmd->cmnd[7] << 16) |
+                        (scsicmd->cmnd[8] << 8) | scsicmd->cmnd[9];
+                count = (scsicmd->cmnd[10] << 24) | (scsicmd->cmnd[11] << 16) |
+                        (scsicmd->cmnd[12] << 8) | scsicmd->cmnd[13];
+        } else if (scsicmd->cmnd[0] == WRITE_12) { /* 12 byte command */
+                dprintk((KERN_DEBUG "aachba: received a write(12) command on id %d.\n", cid));
+
+                lba = ((u64)scsicmd->cmnd[2] << 24) | (scsicmd->cmnd[3] << 16)
+                    | (scsicmd->cmnd[4] << 8) | scsicmd->cmnd[5];
+                count = (scsicmd->cmnd[6] << 24) | (scsicmd->cmnd[7] << 16)
+                      | (scsicmd->cmnd[8] << 8) | scsicmd->cmnd[9];
         } else {
                 dprintk((KERN_DEBUG "aachba: received a write(10) command on id %d.\n", cid));
-                lba = (scsicmd->cmnd[2] << 24) | (scsicmd->cmnd[3] << 16) | (scsicmd->cmnd[4] << 8) | scsicmd->cmnd[5];
+                lba = ((u64)scsicmd->cmnd[2] << 24) | (scsicmd->cmnd[3] << 16) | (scsicmd->cmnd[4] << 8) | scsicmd->cmnd[5];
                 count = (scsicmd->cmnd[7] << 8) | scsicmd->cmnd[8];
         }
-        dprintk((KERN_DEBUG "aac_write[cpu %d]: lba = %u, t = %ld.\n",
+        dprintk((KERN_DEBUG "aac_write[cpu %d]: lba = %llu, t = %ld.\n",
           smp_processor_id(), (unsigned long long)lba, jiffies));
+        if ((!(dev->raw_io_interface) || !(dev->raw_io_64))
+         && (lba & 0xffffffff00000000LL)) {
+                dprintk((KERN_DEBUG "aac_write: Illegal lba\n"));
+                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_CHECK_CONDITION;
+                set_sense((u8 *) &dev->fsa_dev[cid].sense_data,
+                            HARDWARE_ERROR,
+                            SENCODE_INTERNAL_TARGET_FAILURE,
+                            ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0,
+                            0, 0);
+                memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
+                  (sizeof(dev->fsa_dev[cid].sense_data) > sizeof(scsicmd->sense_buffer))
+                    ? sizeof(scsicmd->sense_buffer)
+                    : sizeof(dev->fsa_dev[cid].sense_data));
+                scsicmd->scsi_done(scsicmd);
+                return 0;
+        }
         /*
          *      Allocate and initialize a Fib then setup a BlockWrite command
          */
@@ -1068,8 +1219,8 @@ static int aac_write(struct scsi_cmnd * scsicmd, int cid)
         if (dev->raw_io_interface) {
                 struct aac_raw_io *writecmd;
                 writecmd = (struct aac_raw_io *) fib_data(cmd_fibcontext);
-                writecmd->block[0] = cpu_to_le32(lba);
-                writecmd->block[1] = 0;
+                writecmd->block[0] = cpu_to_le32((u32)(lba&0xffffffff));
+                writecmd->block[1] = cpu_to_le32((u32)((lba&0xffffffff00000000LL)>>32));
                 writecmd->count = cpu_to_le32(count<<9);
                 writecmd->cid = cpu_to_le16(cid);
                 writecmd->flags = 0; 
@@ -1096,7 +1247,7 @@ static int aac_write(struct scsi_cmnd * scsicmd, int cid)
                 writecmd->command = cpu_to_le32(VM_CtHostWrite64);
                 writecmd->cid = cpu_to_le16(cid);
                 writecmd->sector_count = cpu_to_le16(count); 
-                writecmd->block = cpu_to_le32(lba);
+                writecmd->block = cpu_to_le32((u32)(lba&0xffffffff));
                 writecmd->pad   = 0;
                 writecmd->flags = 0;
 
@@ -1121,7 +1272,7 @@ static int aac_write(struct scsi_cmnd * scsicmd, int cid)
                 writecmd = (struct aac_write *) fib_data(cmd_fibcontext);
                 writecmd->command = cpu_to_le32(VM_CtBlockWrite);
                 writecmd->cid = cpu_to_le32(cid);
-                writecmd->block = cpu_to_le32(lba);
+                writecmd->block = cpu_to_le32((u32)(lba&0xffffffff));
                 writecmd->count = cpu_to_le32(count * 512);
                 writecmd->sg.count = cpu_to_le32(1);
                 /* ->stable is not used - it did mean which type of write */
@@ -1310,11 +1461,18 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
                          */
                         if ((fsa_dev_ptr[cid].valid & 1) == 0) {
                                 switch (scsicmd->cmnd[0]) {
+                                case SERVICE_ACTION_IN:
+                                        if (!(dev->raw_io_interface) ||
+                                            !(dev->raw_io_64) ||
+                                            ((scsicmd->cmnd[1] & 0x1f) != SAI_READ_CAPACITY_16))
+                                                break;
                                 case INQUIRY:
                                 case READ_CAPACITY:
                                 case TEST_UNIT_READY:
                                         spin_unlock_irq(host->host_lock);
                                         probe_container(dev, cid);
+                                        if ((fsa_dev_ptr[cid].valid & 1) == 0)
+                                                fsa_dev_ptr[cid].valid = 0;
                                         spin_lock_irq(host->host_lock);
                                         if (fsa_dev_ptr[cid].valid == 0) {
                                                 scsicmd->result = DID_NO_CONNECT << 16;
@@ -1375,7 +1533,6 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
                 memset(&inq_data, 0, sizeof (struct inquiry_data));
 
                 inq_data.inqd_ver = 2;  /* claim compliance to SCSI-2 */
-                inq_data.inqd_dtq = 0x80;       /* set RMB bit to one indicating that the medium is removable */
                 inq_data.inqd_rdf = 2;  /* A response data format value of two indicates that the data shall be in the format specified in SCSI-2 */
                 inq_data.inqd_len = 31;
                 /*Format for "pad2" is  RelAdr | WBus32 | WBus16 |  Sync  | Linked |Reserved| CmdQue | SftRe */
@@ -1397,13 +1554,55 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
                 aac_internal_transfer(scsicmd, &inq_data, 0, sizeof(inq_data));
                 return aac_get_container_name(scsicmd, cid);
         }
+        case SERVICE_ACTION_IN:
+                if (!(dev->raw_io_interface) ||
+                    !(dev->raw_io_64) ||
+                    ((scsicmd->cmnd[1] & 0x1f) != SAI_READ_CAPACITY_16))
+                        break;
+        {
+                u64 capacity;
+                char cp[12];
+                unsigned int offset = 0;
+
+                dprintk((KERN_DEBUG "READ CAPACITY_16 command.\n"));
+                capacity = fsa_dev_ptr[cid].size - 1;
+                if (scsicmd->cmnd[13] > 12) {
+                        offset = scsicmd->cmnd[13] - 12;
+                        if (offset > sizeof(cp))
+                                break;
+                        memset(cp, 0, offset);
+                        aac_internal_transfer(scsicmd, cp, 0, offset);
+                }
+                cp[0] = (capacity >> 56) & 0xff;
+                cp[1] = (capacity >> 48) & 0xff;
+                cp[2] = (capacity >> 40) & 0xff;
+                cp[3] = (capacity >> 32) & 0xff;
+                cp[4] = (capacity >> 24) & 0xff;
+                cp[5] = (capacity >> 16) & 0xff;
+                cp[6] = (capacity >> 8) & 0xff;
+                cp[7] = (capacity >> 0) & 0xff;
+                cp[8] = 0;
+                cp[9] = 0;
+                cp[10] = 2;
+                cp[11] = 0;
+                aac_internal_transfer(scsicmd, cp, offset, sizeof(cp));
+
+                /* Do not cache partition table for arrays */
+                scsicmd->device->removable = 1;
+
+                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_GOOD;
+                scsicmd->scsi_done(scsicmd);
+
+                return 0;
+        }
+
         case READ_CAPACITY:
         {
                 u32 capacity;
                 char cp[8];
 
                 dprintk((KERN_DEBUG "READ CAPACITY command.\n"));
-                if (fsa_dev_ptr[cid].size <= 0x100000000LL)
+                if (fsa_dev_ptr[cid].size <= 0x100000000ULL)
                         capacity = fsa_dev_ptr[cid].size - 1;
                 else
                         capacity = (u32)-1;
@@ -1417,6 +1616,8 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
                 cp[6] = 2;
                 cp[7] = 0;
                 aac_internal_transfer(scsicmd, cp, 0, sizeof(cp));
+                /* Do not cache partition table for arrays */
+                scsicmd->device->removable = 1;
 
                 scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_GOOD;
                 scsicmd->scsi_done(scsicmd);
@@ -1497,6 +1698,8 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
         {
                 case READ_6:
                 case READ_10:
+                case READ_12:
+                case READ_16:
                         /*
                          *      Hack to keep track of ordinal number of the device that
                          *      corresponds to a container. Needed to convert
@@ -1504,17 +1707,19 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
                          */
                          
                         spin_unlock_irq(host->host_lock);
-                        if  (scsicmd->request->rq_disk)
-                                memcpy(fsa_dev_ptr[cid].devname,
-                                        scsicmd->request->rq_disk->disk_name,
-                                        8);
-
+                        if (scsicmd->request->rq_disk)
+                                strlcpy(fsa_dev_ptr[cid].devname,
+                                scsicmd->request->rq_disk->disk_name,
+                                min(sizeof(fsa_dev_ptr[cid].devname),
+                                sizeof(scsicmd->request->rq_disk->disk_name) + 1));
                         ret = aac_read(scsicmd, cid);
                         spin_lock_irq(host->host_lock);
                         return ret;
 
                 case WRITE_6:
                 case WRITE_10:
+                case WRITE_12:
+                case WRITE_16:
                         spin_unlock_irq(host->host_lock);
                         ret = aac_write(scsicmd, cid);
                         spin_lock_irq(host->host_lock);
@@ -1745,6 +1950,8 @@ static void aac_srb_callback(void *context, struct fib * fibptr)
                 case  WRITE_10:
                 case  READ_12:
                 case  WRITE_12:
+                case  READ_16:
+                case  WRITE_16:
                         if(le32_to_cpu(srbreply->data_xfer_length) < scsicmd->underflow ) {
                                 printk(KERN_WARNING"aacraid: SCSI CMD underflow\n");
                         } else {
@@ -1850,8 +2057,8 @@ static void aac_srb_callback(void *context, struct fib * fibptr)
                                 sizeof(scsicmd->sense_buffer) :
                                 le32_to_cpu(srbreply->sense_data_size);
 #ifdef AAC_DETAILED_STATUS_INFO
-                dprintk((KERN_WARNING "aac_srb_callback: check condition, status = %d len=%d\n", 
-                                        le32_to_cpu(srbreply->status), len));
+                printk(KERN_WARNING "aac_srb_callback: check condition, status = %d len=%d\n",
+                                        le32_to_cpu(srbreply->status), len);
 #endif
                 memcpy(scsicmd->sense_buffer, srbreply->sense_data, len);
                 
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index e40528185d48..4a99d2f000f4 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1,6 +1,10 @@
 #if (!defined(dprintk))
 # define dprintk(x)
 #endif
+/* eg: if (nblank(dprintk(x))) */
+#define _nblank(x) #x
+#define nblank(x) _nblank(x)[0]
+
 
 /*------------------------------------------------------------------------------
  *              D E F I N E S
@@ -302,7 +306,6 @@ enum aac_queue_types {
  */
 
 #define         FsaNormal       1
-#define         FsaHigh         2
 
 /*
  * Define the FIB. The FIB is the where all the requested data and
@@ -546,8 +549,6 @@ struct aac_queue {
                   /* This is only valid for adapter to host command queues. */ 
         spinlock_t              *lock;          /* Spinlock for this queue must take this lock before accessing the lock */
         spinlock_t              lockdata;       /* Actual lock (used only on one side of the lock) */
-        unsigned long           SavedIrql;      /* Previous IRQL when the spin lock is taken */
-        u32                     padding;        /* Padding - FIXME - can remove I believe */
         struct list_head        cmdq;           /* A queue of FIBs which need to be prcessed by the FS thread. This is */
                                                 /* only valid for command queues which receive entries from the adapter. */
         struct list_head        pendingq;       /* A queue of outstanding fib's to the adapter. */
@@ -776,7 +777,9 @@ struct fsa_dev_info {
         u64             last;
         u64             size;
         u32             type;
+        u32             config_waiting_on;
         u16             queue_depth;
+        u8              config_needed;
         u8              valid;
         u8              ro;
         u8              locked;
@@ -1012,6 +1015,7 @@ struct aac_dev
         /* macro side-effects BEWARE */
 #       define                  raw_io_interface \
           init->InitStructRevision==cpu_to_le32(ADAPTER_INIT_STRUCT_REVISION_4)
+        u8                      raw_io_64;
         u8                      printf_enabled;
 };
 
@@ -1362,8 +1366,10 @@ struct aac_srb_reply
 #define         VM_CtBlockVerify64      18
 #define         VM_CtHostRead64         19
 #define         VM_CtHostWrite64        20
+#define         VM_DrvErrTblLog         21
+#define         VM_NameServe64          22
 
-#define         MAX_VMCOMMAND_NUM       21      /* used for sizing stats array - leave last */
+#define         MAX_VMCOMMAND_NUM       23      /* used for sizing stats array - leave last */
 
 /*
  *      Descriptive information (eg, vital stats)
@@ -1472,6 +1478,7 @@ struct aac_mntent {
                                                    manager (eg, filesystem) */
         __le32                  altoid;         /* != oid <==> snapshot or 
                                                    broken mirror exists */
+        __le32                  capacityhigh;
 };
 
 #define FSCS_NOTCLEAN   0x0001  /* fsck is neccessary before mounting */
@@ -1707,6 +1714,7 @@ extern struct aac_common aac_config;
 #define         AifCmdJobProgress       2       /* Progress report */
 #define                 AifJobCtrZero   101     /* Array Zero progress */
 #define                 AifJobStsSuccess 1      /* Job completes */
+#define                 AifJobStsRunning 102    /* Job running */
 #define         AifCmdAPIReport         3       /* Report from other user of API */
 #define         AifCmdDriverNotify      4       /* Notify host driver of event */
 #define                 AifDenMorphComplete 200 /* A morph operation completed */
@@ -1777,6 +1785,7 @@ int fib_adapter_complete(struct fib * fibptr, unsigned short size);
 struct aac_driver_ident* aac_get_driver_ident(int devtype);
 int aac_get_adapter_info(struct aac_dev* dev);
 int aac_send_shutdown(struct aac_dev *dev);
+int probe_container(struct aac_dev *dev, int cid);
 extern int numacb;
 extern int acbsize;
 extern char aac_driver_version[];
diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
index 75abd0453289..59a341b2aedc 100644
--- a/drivers/scsi/aacraid/comminit.c
+++ b/drivers/scsi/aacraid/comminit.c
@@ -195,7 +195,7 @@ int aac_send_shutdown(struct aac_dev * dev)
                           fibctx,
                           sizeof(struct aac_close),
                           FsaNormal,
-                          1, 1,
+                          -2 /* Timeout silently */, 1,
                           NULL, NULL);
 
         if (status == 0)
@@ -313,8 +313,15 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev)
         dev->max_fib_size = sizeof(struct hw_fib);
         dev->sg_tablesize = host->sg_tablesize = (dev->max_fib_size
                 - sizeof(struct aac_fibhdr)
-                - sizeof(struct aac_write) + sizeof(struct sgmap))
-                        / sizeof(struct sgmap);
+                - sizeof(struct aac_write) + sizeof(struct sgentry))
+                        / sizeof(struct sgentry);
+        dev->raw_io_64 = 0;
+        if ((!aac_adapter_sync_cmd(dev, GET_ADAPTER_PROPERTIES,
+                0, 0, 0, 0, 0, 0, status+0, status+1, status+2, NULL, NULL)) &&
+                        (status[0] == 0x00000001)) {
+                if (status[1] & AAC_OPT_NEW_COMM_64)
+                        dev->raw_io_64 = 1;
+        }
         if ((!aac_adapter_sync_cmd(dev, GET_COMM_PREFERRED_SETTINGS,
           0, 0, 0, 0, 0, 0,
           status+0, status+1, status+2, status+3, status+4))
@@ -342,8 +349,8 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev)
                         dev->max_fib_size = 512;
                         dev->sg_tablesize = host->sg_tablesize
                           = (512 - sizeof(struct aac_fibhdr)
-                            - sizeof(struct aac_write) + sizeof(struct sgmap))
-                             / sizeof(struct sgmap);
+                            - sizeof(struct aac_write) + sizeof(struct sgentry))
+                             / sizeof(struct sgentry);
                         host->can_queue = AAC_NUM_IO_FIB;
                 } else if (acbsize == 2048) {
                         host->max_sectors = 512;
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index a1d303f03480..e4d543a474ae 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -39,7 +39,9 @@
 #include <linux/completion.h>
 #include <linux/blkdev.h>
 #include <scsi/scsi_host.h>
+#include <scsi/scsi_device.h>
 #include <asm/semaphore.h>
+#include <asm/delay.h>
 
 #include "aacraid.h"
 
@@ -269,40 +271,22 @@ static int aac_get_entry (struct aac_dev * dev, u32 qid, struct aac_entry **entr
         /* Interrupt Moderation, only interrupt for first two entries */
         if (idx != le32_to_cpu(*(q->headers.consumer))) {
                 if (--idx == 0) {
-                        if (qid == AdapHighCmdQueue)
-                                idx = ADAP_HIGH_CMD_ENTRIES;
-                        else if (qid == AdapNormCmdQueue)
+                        if (qid == AdapNormCmdQueue)
                                 idx = ADAP_NORM_CMD_ENTRIES;
-                        else if (qid == AdapHighRespQueue) 
-                                idx = ADAP_HIGH_RESP_ENTRIES;
-                        else if (qid == AdapNormRespQueue) 
+                        else
                                 idx = ADAP_NORM_RESP_ENTRIES;
                 }
                 if (idx != le32_to_cpu(*(q->headers.consumer)))
                         *nonotify = 1; 
         }
 
-        if (qid == AdapHighCmdQueue) {
-                if (*index >= ADAP_HIGH_CMD_ENTRIES)
-                        *index = 0;
-        } else if (qid == AdapNormCmdQueue) {
+        if (qid == AdapNormCmdQueue) {
                 if (*index >= ADAP_NORM_CMD_ENTRIES) 
                         *index = 0; /* Wrap to front of the Producer Queue. */
-        }
-        else if (qid == AdapHighRespQueue) 
-        {
-                if (*index >= ADAP_HIGH_RESP_ENTRIES)
-                        *index = 0;
-        }
-        else if (qid == AdapNormRespQueue) 
-        {
+        } else {
                 if (*index >= ADAP_NORM_RESP_ENTRIES) 
                         *index = 0; /* Wrap to front of the Producer Queue. */
         }
-        else {
-                printk("aacraid: invalid qid\n");
-                BUG();
-        }
 
         if ((*index + 1) == le32_to_cpu(*(q->headers.consumer))) { /* Queue is full */
                 printk(KERN_WARNING "Queue %d full, %u outstanding.\n",
@@ -334,12 +318,8 @@ static int aac_queue_get(struct aac_dev * dev, u32 * index, u32 qid, struct hw_f
 {
         struct aac_entry * entry = NULL;
         int map = 0;
-        struct aac_queue * q = &dev->queues->queue[qid];
-                
-        spin_lock_irqsave(q->lock, q->SavedIrql);
             
-        if (qid == AdapHighCmdQueue || qid == AdapNormCmdQueue) 
-        {
+        if (qid == AdapNormCmdQueue) {
                 /*  if no entries wait for some if caller wants to */
                 while (!aac_get_entry(dev, qid, &entry, index, nonotify)) 
                 {
@@ -350,9 +330,7 @@ static int aac_queue_get(struct aac_dev * dev, u32 * index, u32 qid, struct hw_f
                  */
                 entry->size = cpu_to_le32(le16_to_cpu(hw_fib->header.Size));
                 map = 1;
-        }
-        else if (qid == AdapHighRespQueue || qid == AdapNormRespQueue)
-        {
+        } else {
                 while(!aac_get_entry(dev, qid, &entry, index, nonotify)) 
                 {
                         /* if no entries wait for some if caller wants to */
@@ -375,42 +353,6 @@ static int aac_queue_get(struct aac_dev * dev, u32 * index, u32 qid, struct hw_f
         return 0;
 }
 
-
-/**
- *      aac_insert_entry        -       insert a queue entry
- *      @dev: Adapter
- *      @index: Index of entry to insert
- *      @qid: Queue number
- *      @nonotify: Suppress adapter notification
- *
- *      Gets the next free QE off the requested priorty adapter command
- *      queue and associates the Fib with the QE. The QE represented by
- *      index is ready to insert on the queue when this routine returns
- *      success.
- */
- 
-static int aac_insert_entry(struct aac_dev * dev, u32 index, u32 qid, unsigned long nonotify) 
-{
-        struct aac_queue * q = &dev->queues->queue[qid];
-
-        if(q == NULL)
-                BUG();
-        *(q->headers.producer) = cpu_to_le32(index + 1);
-        spin_unlock_irqrestore(q->lock, q->SavedIrql);
-
-        if (qid == AdapHighCmdQueue ||
-            qid == AdapNormCmdQueue ||
-            qid == AdapHighRespQueue ||
-            qid == AdapNormRespQueue)
-        {
-                if (!nonotify)
-                        aac_adapter_notify(dev, qid);
-        }
-        else
-                printk("Suprise insert!\n");
-        return 0;
-}
-
 /*
  *      Define the highest level of host to adapter communication routines. 
  *      These routines will support host to adapter FS commuication. These 
@@ -439,12 +381,13 @@ static int aac_insert_entry(struct aac_dev * dev, u32 index, u32 qid, unsigned l
 int fib_send(u16 command, struct fib * fibptr, unsigned long size,  int priority, int wait, int reply, fib_callback callback, void * callback_data)
 {
         u32 index;
-        u32 qid;
         struct aac_dev * dev = fibptr->dev;
         unsigned long nointr = 0;
         struct hw_fib * hw_fib = fibptr->hw_fib;
         struct aac_queue * q;
         unsigned long flags = 0;
+        unsigned long qflags;
+
         if (!(hw_fib->header.XferState & cpu_to_le32(HostOwned)))
                 return -EBUSY;
         /*
@@ -497,26 +440,8 @@ int fib_send(u16 command, struct fib * fibptr, unsigned long size,  int priority
          *      Get a queue entry connect the FIB to it and send an notify
          *      the adapter a command is ready.
          */
-        if (priority == FsaHigh) {
-                hw_fib->header.XferState |= cpu_to_le32(HighPriority);
-                qid = AdapHighCmdQueue;
-        } else {
-                hw_fib->header.XferState |= cpu_to_le32(NormalPriority);
-                qid = AdapNormCmdQueue;
-        }
-        q = &dev->queues->queue[qid];
+        hw_fib->header.XferState |= cpu_to_le32(NormalPriority);
 
-        if(wait)
-                spin_lock_irqsave(&fibptr->event_lock, flags);
-        if(aac_queue_get( dev, &index, qid, hw_fib, 1, fibptr, &nointr)<0)
-                return -EWOULDBLOCK;
-        dprintk((KERN_DEBUG "fib_send: inserting a queue entry at index %d.\n",index));
-        dprintk((KERN_DEBUG "Fib contents:.\n"));
-        dprintk((KERN_DEBUG "  Command =               %d.\n", hw_fib->header.Command));
-        dprintk((KERN_DEBUG "  XferState  =            %x.\n", hw_fib->header.XferState));
-        dprintk((KERN_DEBUG "  hw_fib va being sent=%p\n",fibptr->hw_fib));
-        dprintk((KERN_DEBUG "  hw_fib pa being sent=%lx\n",(ulong)fibptr->hw_fib_pa));
-        dprintk((KERN_DEBUG "  fib being sent=%p\n",fibptr));
         /*
          *      Fill in the Callback and CallbackContext if we are not
          *      going to wait.
@@ -525,22 +450,67 @@ int fib_send(u16 command, struct fib * fibptr, unsigned long size,  int priority
                 fibptr->callback = callback;
                 fibptr->callback_data = callback_data;
         }
-        FIB_COUNTER_INCREMENT(aac_config.FibsSent);
-        list_add_tail(&fibptr->queue, &q->pendingq);
-        q->numpending++;
 
         fibptr->done = 0;
         fibptr->flags = 0;
 
-        if(aac_insert_entry(dev, index, qid, (nointr & aac_config.irq_mod)) < 0)
-                return -EWOULDBLOCK;
+        FIB_COUNTER_INCREMENT(aac_config.FibsSent);
+
+        dprintk((KERN_DEBUG "fib_send: inserting a queue entry at index %d.\n",index));
+        dprintk((KERN_DEBUG "Fib contents:.\n"));
+        dprintk((KERN_DEBUG "  Command =               %d.\n", hw_fib->header.Command));
+        dprintk((KERN_DEBUG "  XferState  =            %x.\n", hw_fib->header.XferState));
+        dprintk((KERN_DEBUG "  hw_fib va being sent=%p\n",fibptr->hw_fib));
+        dprintk((KERN_DEBUG "  hw_fib pa being sent=%lx\n",(ulong)fibptr->hw_fib_pa));
+        dprintk((KERN_DEBUG "  fib being sent=%p\n",fibptr));
+
+        q = &dev->queues->queue[AdapNormCmdQueue];
+
+        if(wait)
+                spin_lock_irqsave(&fibptr->event_lock, flags);
+        spin_lock_irqsave(q->lock, qflags);
+        aac_queue_get( dev, &index, AdapNormCmdQueue, hw_fib, 1, fibptr, &nointr);
+
+        list_add_tail(&fibptr->queue, &q->pendingq);
+        q->numpending++;
+        *(q->headers.producer) = cpu_to_le32(index + 1);
+        spin_unlock_irqrestore(q->lock, qflags);
+        if (!(nointr & aac_config.irq_mod))
+                aac_adapter_notify(dev, AdapNormCmdQueue);
         /*
          *      If the caller wanted us to wait for response wait now. 
          */
     
         if (wait) {
                 spin_unlock_irqrestore(&fibptr->event_lock, flags);
-                down(&fibptr->event_wait);
+                /* Only set for first known interruptable command */
+                if (wait < 0) {
+                        /*
+                         * *VERY* Dangerous to time out a command, the
+                         * assumption is made that we have no hope of
+                         * functioning because an interrupt routing or other
+                         * hardware failure has occurred.
+                         */
+                        unsigned long count = 36000000L; /* 3 minutes */
+                        unsigned long qflags;
+                        while (down_trylock(&fibptr->event_wait)) {
+                                if (--count == 0) {
+                                        spin_lock_irqsave(q->lock, qflags);
+                                        q->numpending--;
+                                        list_del(&fibptr->queue);
+                                        spin_unlock_irqrestore(q->lock, qflags);
+                                        if (wait == -1) {
+                                                printk(KERN_ERR "aacraid: fib_send: first asynchronous command timed out.\n"
+                                                  "Usually a result of a PCI interrupt routing problem;\n"
+                                                  "update mother board BIOS or consider utilizing one of\n"
+                                                  "the SAFE mode kernel options (acpi, apic etc)\n");
+                                        }
+                                        return -ETIMEDOUT;
+                                }
+                                udelay(5);
+                        }
+                } else
+                        down(&fibptr->event_wait);
                 if(fibptr->done == 0)
                         BUG();
                         
@@ -622,15 +592,9 @@ void aac_consumer_free(struct aac_dev * dev, struct aac_queue *q, u32 qid)
                 case HostNormCmdQueue:
                         notify = HostNormCmdNotFull;
                         break;
-                case HostHighCmdQueue:
-                        notify = HostHighCmdNotFull;
-                        break;
                 case HostNormRespQueue:
                         notify = HostNormRespNotFull;
                         break;
-                case HostHighRespQueue:
-                        notify = HostHighRespNotFull;
-                        break;
                 default:
                         BUG();
                         return;
@@ -652,9 +616,13 @@ int fib_adapter_complete(struct fib * fibptr, unsigned short size)
 {
         struct hw_fib * hw_fib = fibptr->hw_fib;
         struct aac_dev * dev = fibptr->dev;
+        struct aac_queue * q;
         unsigned long nointr = 0;
-        if (hw_fib->header.XferState == 0)
+        unsigned long qflags;
+
+        if (hw_fib->header.XferState == 0) {
                 return 0;
+        }
         /*
          *      If we plan to do anything check the structure type first.
          */ 
@@ -669,37 +637,21 @@ int fib_adapter_complete(struct fib * fibptr, unsigned short size)
          *      send the completed cdb to the adapter.
          */
         if (hw_fib->header.XferState & cpu_to_le32(SentFromAdapter)) {
+                u32 index;
                 hw_fib->header.XferState |= cpu_to_le32(HostProcessed);
-                if (hw_fib->header.XferState & cpu_to_le32(HighPriority)) {
-                        u32 index;
-                        if (size) 
-                        {
-                                size += sizeof(struct aac_fibhdr);
-                                if (size > le16_to_cpu(hw_fib->header.SenderSize))
-                                        return -EMSGSIZE;
-                                hw_fib->header.Size = cpu_to_le16(size);
-                        }
-                        if(aac_queue_get(dev, &index, AdapHighRespQueue, hw_fib, 1, NULL, &nointr) < 0) {
-                                return -EWOULDBLOCK;
-                        }
-                        if (aac_insert_entry(dev, index, AdapHighRespQueue,  (nointr & (int)aac_config.irq_mod)) != 0) {
-                        }
-                } else if (hw_fib->header.XferState & 
-                                cpu_to_le32(NormalPriority)) {
-                        u32 index;
-
-                        if (size) {
-                                size += sizeof(struct aac_fibhdr);
-                                if (size > le16_to_cpu(hw_fib->header.SenderSize)) 
-                                        return -EMSGSIZE;
-                                hw_fib->header.Size = cpu_to_le16(size);
-                        }
-                        if (aac_queue_get(dev, &index, AdapNormRespQueue, hw_fib, 1, NULL, &nointr) < 0) 
-                                return -EWOULDBLOCK;
-                        if (aac_insert_entry(dev, index, AdapNormRespQueue, (nointr & (int)aac_config.irq_mod)) != 0) 
-                        {
-                        }
+                if (size) {
+                        size += sizeof(struct aac_fibhdr);
+                        if (size > le16_to_cpu(hw_fib->header.SenderSize)) 
+                                return -EMSGSIZE;
+                        hw_fib->header.Size = cpu_to_le16(size);
                 }
+                q = &dev->queues->queue[AdapNormRespQueue];
+                spin_lock_irqsave(q->lock, qflags);
+                aac_queue_get(dev, &index, AdapNormRespQueue, hw_fib, 1, NULL, &nointr);
+                *(q->headers.producer) = cpu_to_le32(index + 1);
+                spin_unlock_irqrestore(q->lock, qflags);
+                if (!(nointr & (int)aac_config.irq_mod))
+                        aac_adapter_notify(dev, AdapNormRespQueue);
         }
         else 
         {
@@ -791,6 +743,268 @@ void aac_printf(struct aac_dev *dev, u32 val)
         memset(cp, 0,  256);
 }
 
+
+/**
+ *      aac_handle_aif          -       Handle a message from the firmware
+ *      @dev: Which adapter this fib is from
+ *      @fibptr: Pointer to fibptr from adapter
+ *
+ *      This routine handles a driver notify fib from the adapter and
+ *      dispatches it to the appropriate routine for handling.
+ */
+
+static void aac_handle_aif(struct aac_dev * dev, struct fib * fibptr)
+{
+        struct hw_fib * hw_fib = fibptr->hw_fib;
+        struct aac_aifcmd * aifcmd = (struct aac_aifcmd *)hw_fib->data;
+        int busy;
+        u32 container;
+        struct scsi_device *device;
+        enum {
+                NOTHING,
+                DELETE,
+                ADD,
+                CHANGE
+        } device_config_needed;
+
+        /* Sniff for container changes */
+
+        if (!dev)
+                return;
+        container = (u32)-1;
+
+        /*
+         *      We have set this up to try and minimize the number of
+         * re-configures that take place. As a result of this when
+         * certain AIF's come in we will set a flag waiting for another
+         * type of AIF before setting the re-config flag.
+         */
+        switch (le32_to_cpu(aifcmd->command)) {
+        case AifCmdDriverNotify:
+                switch (le32_to_cpu(((u32 *)aifcmd->data)[0])) {
+                /*
+                 *      Morph or Expand complete
+                 */
+                case AifDenMorphComplete:
+                case AifDenVolumeExtendComplete:
+                        container = le32_to_cpu(((u32 *)aifcmd->data)[1]);
+                        if (container >= dev->maximum_num_containers)
+                                break;
+
+                        /*
+                         *      Find the Scsi_Device associated with the SCSI
+                         * address. Make sure we have the right array, and if
+                         * so set the flag to initiate a new re-config once we
+                         * see an AifEnConfigChange AIF come through.
+                         */
+
+                        if ((dev != NULL) && (dev->scsi_host_ptr != NULL)) {
+                                device = scsi_device_lookup(dev->scsi_host_ptr, 
+                                        CONTAINER_TO_CHANNEL(container), 
+                                        CONTAINER_TO_ID(container), 
+                                        CONTAINER_TO_LUN(container));
+                                if (device) {
+                                        dev->fsa_dev[container].config_needed = CHANGE;
+                                        dev->fsa_dev[container].config_waiting_on = AifEnConfigChange;
+                                        scsi_device_put(device);
+                                }
+                        }
+                }
+
+                /*
+                 *      If we are waiting on something and this happens to be
+                 * that thing then set the re-configure flag.
+                 */
+                if (container != (u32)-1) {
+                        if (container >= dev->maximum_num_containers)
+                                break;
+                        if (dev->fsa_dev[container].config_waiting_on ==
+                            le32_to_cpu(*(u32 *)aifcmd->data))
+                                dev->fsa_dev[container].config_waiting_on = 0;
+                } else for (container = 0;
+                    container < dev->maximum_num_containers; ++container) {
+                        if (dev->fsa_dev[container].config_waiting_on ==
+                            le32_to_cpu(*(u32 *)aifcmd->data))
+                                dev->fsa_dev[container].config_waiting_on = 0;
+                }
+                break;
+
+        case AifCmdEventNotify:
+                switch (le32_to_cpu(((u32 *)aifcmd->data)[0])) {
+                /*
+                 *      Add an Array.
+                 */
+                case AifEnAddContainer:
+                        container = le32_to_cpu(((u32 *)aifcmd->data)[1]);
+                        if (container >= dev->maximum_num_containers)
+                                break;
+                        dev->fsa_dev[container].config_needed = ADD;
+                        dev->fsa_dev[container].config_waiting_on =
+                                AifEnConfigChange;
+                        break;
+
+                /*
+                 *      Delete an Array.
+                 */
+                case AifEnDeleteContainer:
+                        container = le32_to_cpu(((u32 *)aifcmd->data)[1]);
+                        if (container >= dev->maximum_num_containers)
+                                break;
+                        dev->fsa_dev[container].config_needed = DELETE;
+                        dev->fsa_dev[container].config_waiting_on =
+                                AifEnConfigChange;
+                        break;
+
+                /*
+                 *      Container change detected. If we currently are not
+                 * waiting on something else, setup to wait on a Config Change.
+                 */
+                case AifEnContainerChange:
+                        container = le32_to_cpu(((u32 *)aifcmd->data)[1]);
+                        if (container >= dev->maximum_num_containers)
+                                break;
+                        if (dev->fsa_dev[container].config_waiting_on)
+                                break;
+                        dev->fsa_dev[container].config_needed = CHANGE;
+                        dev->fsa_dev[container].config_waiting_on =
+                                AifEnConfigChange;
+                        break;
+
+                case AifEnConfigChange:
+                        break;
+
+                }
+
+                /*
+                 *      If we are waiting on something and this happens to be
+                 * that thing then set the re-configure flag.
+                 */
+                if (container != (u32)-1) {
+                        if (container >= dev->maximum_num_containers)
+                                break;
+                        if (dev->fsa_dev[container].config_waiting_on ==
+                            le32_to_cpu(*(u32 *)aifcmd->data))
+                                dev->fsa_dev[container].config_waiting_on = 0;
+                } else for (container = 0;
+                    container < dev->maximum_num_containers; ++container) {
+                        if (dev->fsa_dev[container].config_waiting_on ==
+                            le32_to_cpu(*(u32 *)aifcmd->data))
+                                dev->fsa_dev[container].config_waiting_on = 0;
+                }
+                break;
+
+        case AifCmdJobProgress:
+                /*
+                 *      These are job progress AIF's. When a Clear is being
+                 * done on a container it is initially created then hidden from
+                 * the OS. When the clear completes we don't get a config
+                 * change so we monitor the job status complete on a clear then
+                 * wait for a container change.
+                 */
+
+                if ((((u32 *)aifcmd->data)[1] == cpu_to_le32(AifJobCtrZero))
+                 && ((((u32 *)aifcmd->data)[6] == ((u32 *)aifcmd->data)[5])
+                  || (((u32 *)aifcmd->data)[4] == cpu_to_le32(AifJobStsSuccess)))) {
+                        for (container = 0;
+                            container < dev->maximum_num_containers;
+                            ++container) {
+                                /*
+                                 * Stomp on all config sequencing for all
+                                 * containers?
+                                 */
+                                dev->fsa_dev[container].config_waiting_on =
+                                        AifEnContainerChange;
+                                dev->fsa_dev[container].config_needed = ADD;
+                        }
+                }
+                if ((((u32 *)aifcmd->data)[1] == cpu_to_le32(AifJobCtrZero))
+                 && (((u32 *)aifcmd->data)[6] == 0)
+                 && (((u32 *)aifcmd->data)[4] == cpu_to_le32(AifJobStsRunning))) {
+                        for (container = 0;
+                            container < dev->maximum_num_containers;
+                            ++container) {
+                                /*
+                                 * Stomp on all config sequencing for all
+                                 * containers?
+                                 */
+                                dev->fsa_dev[container].config_waiting_on =
+                                        AifEnContainerChange;
+                                dev->fsa_dev[container].config_needed = DELETE;
+                        }
+                }
+                break;
+        }
+
+        device_config_needed = NOTHING;
+        for (container = 0; container < dev->maximum_num_containers;
+            ++container) {
+                if ((dev->fsa_dev[container].config_waiting_on == 0)
+                 && (dev->fsa_dev[container].config_needed != NOTHING)) {
+                        device_config_needed =
+                                dev->fsa_dev[container].config_needed;
+                        dev->fsa_dev[container].config_needed = NOTHING;
+                        break;
+                }
+        }
+        if (device_config_needed == NOTHING)
+                return;
+
+        /*
+         *      If we decided that a re-configuration needs to be done,
+         * schedule it here on the way out the door, please close the door
+         * behind you.
+         */
+
+        busy = 0;
+
+
+        /*
+         *      Find the Scsi_Device associated with the SCSI address,
+         * and mark it as changed, invalidating the cache. This deals
+         * with changes to existing device IDs.
+         */
+
+        if (!dev || !dev->scsi_host_ptr)
+                return;
+        /*
+         * force reload of disk info via probe_container
+         */
+        if ((device_config_needed == CHANGE)
+         && (dev->fsa_dev[container].valid == 1))
+                dev->fsa_dev[container].valid = 2;
+        if ((device_config_needed == CHANGE) ||
+                        (device_config_needed == ADD))
+                probe_container(dev, container);
+        device = scsi_device_lookup(dev->scsi_host_ptr, 
+                CONTAINER_TO_CHANNEL(container), 
+                CONTAINER_TO_ID(container), 
+                CONTAINER_TO_LUN(container));
+        if (device) {
+                switch (device_config_needed) {
+                case DELETE:
+                        scsi_remove_device(device);
+                        break;
+                case CHANGE:
+                        if (!dev->fsa_dev[container].valid) {
+                                scsi_remove_device(device);
+                                break;
+                        }
+                        scsi_rescan_device(&device->sdev_gendev);
+
+                default:
+                        break;
+                }
+                scsi_device_put(device);
+        }
+        if (device_config_needed == ADD) {
+                scsi_add_device(dev->scsi_host_ptr,
+                  CONTAINER_TO_CHANNEL(container),
+                  CONTAINER_TO_ID(container),
+                  CONTAINER_TO_LUN(container));
+        }
+
+}
+
 /**
  *      aac_command_thread      -       command processing thread
  *      @dev: Adapter to monitor
@@ -805,7 +1019,6 @@ int aac_command_thread(struct aac_dev * dev)
 {
         struct hw_fib *hw_fib, *hw_newfib;
         struct fib *fib, *newfib;
-        struct aac_queue_block *queues = dev->queues;
         struct aac_fib_context *fibctx;
         unsigned long flags;
         DECLARE_WAITQUEUE(wait, current);
@@ -825,21 +1038,22 @@ int aac_command_thread(struct aac_dev * dev)
          *      Let the DPC know it has a place to send the AIF's to.
          */
         dev->aif_thread = 1;
-        add_wait_queue(&queues->queue[HostNormCmdQueue].cmdready, &wait);
+        add_wait_queue(&dev->queues->queue[HostNormCmdQueue].cmdready, &wait);
         set_current_state(TASK_INTERRUPTIBLE);
+        dprintk ((KERN_INFO "aac_command_thread start\n"));
         while(1) 
         {
-                spin_lock_irqsave(queues->queue[HostNormCmdQueue].lock, flags);
-                while(!list_empty(&(queues->queue[HostNormCmdQueue].cmdq))) {
+                spin_lock_irqsave(dev->queues->queue[HostNormCmdQueue].lock, flags);
+                while(!list_empty(&(dev->queues->queue[HostNormCmdQueue].cmdq))) {
                         struct list_head *entry;
                         struct aac_aifcmd * aifcmd;
 
                         set_current_state(TASK_RUNNING);
-                
-                        entry = queues->queue[HostNormCmdQueue].cmdq.next;
+        
+                        entry = dev->queues->queue[HostNormCmdQueue].cmdq.next;
                         list_del(entry);
-                        
-                        spin_unlock_irqrestore(queues->queue[HostNormCmdQueue].lock, flags);
+                
+                        spin_unlock_irqrestore(dev->queues->queue[HostNormCmdQueue].lock, flags);
                         fib = list_entry(entry, struct fib, fiblink);
                         /*
                          *      We will process the FIB here or pass it to a 
@@ -860,6 +1074,7 @@ int aac_command_thread(struct aac_dev * dev)
                         aifcmd = (struct aac_aifcmd *) hw_fib->data;
                         if (aifcmd->command == cpu_to_le32(AifCmdDriverNotify)) {
                                 /* Handle Driver Notify Events */
+                                aac_handle_aif(dev, fib);
                                 *(__le32 *)hw_fib->data = cpu_to_le32(ST_OK);
                                 fib_adapter_complete(fib, (u16)sizeof(u32));
                         } else {
@@ -869,9 +1084,62 @@ int aac_command_thread(struct aac_dev * dev)
                                    
                                 u32 time_now, time_last;
                                 unsigned long flagv;
-                                
+                                unsigned num;
+                                struct hw_fib ** hw_fib_pool, ** hw_fib_p;
+                                struct fib ** fib_pool, ** fib_p;
+                        
+                                /* Sniff events */
+                                if ((aifcmd->command == 
+                                     cpu_to_le32(AifCmdEventNotify)) ||
+                                    (aifcmd->command == 
+                                     cpu_to_le32(AifCmdJobProgress))) {
+                                        aac_handle_aif(dev, fib);
+                                }
+                                
                                 time_now = jiffies/HZ;
 
+                                /*
+                                 * Warning: no sleep allowed while
+                                 * holding spinlock. We take the estimate
+                                 * and pre-allocate a set of fibs outside the
+                                 * lock.
+                                 */
+                                num = le32_to_cpu(dev->init->AdapterFibsSize)
+                                    / sizeof(struct hw_fib); /* some extra */
+                                spin_lock_irqsave(&dev->fib_lock, flagv);
+                                entry = dev->fib_list.next;
+                                while (entry != &dev->fib_list) {
+                                        entry = entry->next;
+                                        ++num;
+                                }
+                                spin_unlock_irqrestore(&dev->fib_lock, flagv);
+                                hw_fib_pool = NULL;
+                                fib_pool = NULL;
+                                if (num
+                                 && ((hw_fib_pool = kmalloc(sizeof(struct hw_fib *) * num, GFP_KERNEL)))
+                                 && ((fib_pool = kmalloc(sizeof(struct fib *) * num, GFP_KERNEL)))) {
+                                        hw_fib_p = hw_fib_pool;
+                                        fib_p = fib_pool;
+                                        while (hw_fib_p < &hw_fib_pool[num]) {
+                                                if (!(*(hw_fib_p++) = kmalloc(sizeof(struct hw_fib), GFP_KERNEL))) {
+                                                        --hw_fib_p;
+                                                        break;
+                                                }
+                                                if (!(*(fib_p++) = kmalloc(sizeof(struct fib), GFP_KERNEL))) {
+                                                        kfree(*(--hw_fib_p));
+                                                        break;
+                                                }
+                                        }
+                                        if ((num = hw_fib_p - hw_fib_pool) == 0) {
+                                                kfree(fib_pool);
+                                                fib_pool = NULL;
+                                                kfree(hw_fib_pool);
+                                                hw_fib_pool = NULL;
+                                        }
+                                } else if (hw_fib_pool) {
+                                        kfree(hw_fib_pool);
+                                        hw_fib_pool = NULL;
+                                }
                                 spin_lock_irqsave(&dev->fib_lock, flagv);
                                 entry = dev->fib_list.next;
                                 /*
@@ -880,6 +1148,8 @@ int aac_command_thread(struct aac_dev * dev)
                                  * fib, and then set the event to wake up the
                                  * thread that is waiting for it.
                                  */
+                                hw_fib_p = hw_fib_pool;
+                                fib_p = fib_pool;
                                 while (entry != &dev->fib_list) {
                                         /*
                                          * Extract the fibctx
@@ -912,9 +1182,11 @@ int aac_command_thread(struct aac_dev * dev)
                                          * Warning: no sleep allowed while
                                          * holding spinlock
                                          */
-                                        hw_newfib = kmalloc(sizeof(struct hw_fib), GFP_ATOMIC);
-                                        newfib = kmalloc(sizeof(struct fib), GFP_ATOMIC);
-                                        if (newfib && hw_newfib) {
+                                        if (hw_fib_p < &hw_fib_pool[num]) {
+                                                hw_newfib = *hw_fib_p;
+                                                *(hw_fib_p++) = NULL;
+                                                newfib = *fib_p;
+                                                *(fib_p++) = NULL;
                                                 /*
                                                  * Make the copy of the FIB
                                                  */
@@ -929,15 +1201,11 @@ int aac_command_thread(struct aac_dev * dev)
                                                 fibctx->count++;
                                                 /* 
                                                  * Set the event to wake up the
-                                                 * thread that will waiting.
+                                                 * thread that is waiting.
                                                  */
                                                 up(&fibctx->wait_sem);
                                         } else {
                                                 printk(KERN_WARNING "aifd: didn't allocate NewFib.\n");
-                                                if(newfib)
-                                                        kfree(newfib);
-                                                if(hw_newfib)
-                                                        kfree(hw_newfib);
                                         }
                                         entry = entry->next;
                                 }
@@ -947,21 +1215,38 @@ int aac_command_thread(struct aac_dev * dev)
                                 *(__le32 *)hw_fib->data = cpu_to_le32(ST_OK);
                                 fib_adapter_complete(fib, sizeof(u32));
                                 spin_unlock_irqrestore(&dev->fib_lock, flagv);
+                                /* Free up the remaining resources */
+                                hw_fib_p = hw_fib_pool;
+                                fib_p = fib_pool;
+                                while (hw_fib_p < &hw_fib_pool[num]) {
+                                        if (*hw_fib_p)
+                                                kfree(*hw_fib_p);
+                                        if (*fib_p)
+                                                kfree(*fib_p);
+                                        ++fib_p;
+                                        ++hw_fib_p;
+                                }
+                                if (hw_fib_pool)
+                                        kfree(hw_fib_pool);
+                                if (fib_pool)
+                                        kfree(fib_pool);
                         }
-                        spin_lock_irqsave(queues->queue[HostNormCmdQueue].lock, flags);
                         kfree(fib);
+                        spin_lock_irqsave(dev->queues->queue[HostNormCmdQueue].lock, flags);
                 }
                 /*
                  *      There are no more AIF's
                  */
-                spin_unlock_irqrestore(queues->queue[HostNormCmdQueue].lock, flags);
+                spin_unlock_irqrestore(dev->queues->queue[HostNormCmdQueue].lock, flags);
                 schedule();
 
                 if(signal_pending(current))
                         break;
                 set_current_state(TASK_INTERRUPTIBLE);
         }
-        remove_wait_queue(&queues->queue[HostNormCmdQueue].cmdready, &wait);
+        if (dev->queues)
+                remove_wait_queue(&dev->queues->queue[HostNormCmdQueue].cmdready, &wait);
         dev->aif_thread = 0;
         complete_and_exit(&dev->aif_completion, 0);
+        return 0;
 }
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 4ff29d7f5825..de8490a92831 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -748,7 +748,8 @@ static int __devinit aac_probe_one(struct pci_dev *pdev,
                 unique_id++;
         }
 
-        if (pci_enable_device(pdev))
+        error = pci_enable_device(pdev);
+        if (error)
                 goto out;
 
         if (pci_set_dma_mask(pdev, 0xFFFFFFFFULL) || 
@@ -772,6 +773,7 @@ static int __devinit aac_probe_one(struct pci_dev *pdev,
         shost->irq = pdev->irq;
         shost->base = pci_resource_start(pdev, 0);
         shost->unique_id = unique_id;
+        shost->max_cmd_len = 16;
 
         aac = (struct aac_dev *)shost->hostdata;
         aac->scsi_host_ptr = shost;     
@@ -799,7 +801,9 @@ static int __devinit aac_probe_one(struct pci_dev *pdev,
                         goto out_free_fibs;
 
         aac->maximum_num_channels = aac_drivers[index].channels;
-        aac_get_adapter_info(aac);
+        error = aac_get_adapter_info(aac);
+        if (error < 0)
+                goto out_deinit;
 
         /*
          * Lets override negotiations and drop the maximum SG limit to 34
@@ -927,8 +931,8 @@ static int __init aac_init(void)
         printk(KERN_INFO "Adaptec %s driver (%s)\n",
           AAC_DRIVERNAME, aac_driver_version);
 
-        error = pci_module_init(&aac_pci_driver);
-        if (error)
+        error = pci_register_driver(&aac_pci_driver);
+        if (error < 0)
                 return error;
 
         aac_cfg_major = register_chrdev( 0, "aac", &aac_cfg_fops);
diff --git a/drivers/scsi/aic7xxx/aic7770_osm.c b/drivers/scsi/aic7xxx/aic7770_osm.c
index 70c5fb59c9ea..d754b3267863 100644
--- a/drivers/scsi/aic7xxx/aic7770_osm.c
+++ b/drivers/scsi/aic7xxx/aic7770_osm.c
@@ -112,6 +112,9 @@ aic7770_remove(struct device *dev)
         struct ahc_softc *ahc = dev_get_drvdata(dev);
         u_long s;
 
+        if (ahc->platform_data && ahc->platform_data->host)
+                        scsi_remove_host(ahc->platform_data->host);
+
         ahc_lock(ahc, &s);
         ahc_intr_enable(ahc, FALSE);
         ahc_unlock(ahc, &s);
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm.c b/drivers/scsi/aic7xxx/aic79xx_osm.c
index 6b6d4e287793..95c285cc83e4 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm.c
@@ -1192,11 +1192,6 @@ ahd_platform_free(struct ahd_softc *ahd)
         int i, j;
 
         if (ahd->platform_data != NULL) {
-                if (ahd->platform_data->host != NULL) {
-                        scsi_remove_host(ahd->platform_data->host);
-                        scsi_host_put(ahd->platform_data->host);
-                }
-
                 /* destroy all of the device and target objects */
                 for (i = 0; i < AHD_NUM_TARGETS; i++) {
                         starget = ahd->platform_data->starget[i];
@@ -1226,6 +1221,9 @@ ahd_platform_free(struct ahd_softc *ahd)
                         release_mem_region(ahd->platform_data->mem_busaddr,
                                            0x1000);
                 }
+                if (ahd->platform_data->host)
+                        scsi_host_put(ahd->platform_data->host);
+
                 free(ahd->platform_data, M_DEVBUF);
         }
 }
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm_pci.c b/drivers/scsi/aic7xxx/aic79xx_osm_pci.c
index 390b53852d4b..bf360ae021ab 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm_pci.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm_pci.c
@@ -95,6 +95,9 @@ ahd_linux_pci_dev_remove(struct pci_dev *pdev)
         struct ahd_softc *ahd = pci_get_drvdata(pdev);
         u_long s;
 
+        if (ahd->platform_data && ahd->platform_data->host)
+                        scsi_remove_host(ahd->platform_data->host);
+
         ahd_lock(ahd, &s);
         ahd_intr_enable(ahd, FALSE);
         ahd_unlock(ahd, &s);
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index c932b3b94490..6ee1435d37fa 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -1109,15 +1109,6 @@ ahc_linux_register_host(struct ahc_softc *ahc, struct scsi_host_template *templa
         return (0);
 }
 
-uint64_t
-ahc_linux_get_memsize(void)
-{
-        struct sysinfo si;
-
-        si_meminfo(&si);
-        return ((uint64_t)si.totalram << PAGE_SHIFT);
-}
-
 /*
  * Place the SCSI bus into a known state by either resetting it,
  * or forcing transfer negotiations on the next command to any
@@ -1218,11 +1209,6 @@ ahc_platform_free(struct ahc_softc *ahc)
         int i, j;
 
         if (ahc->platform_data != NULL) {
-                if (ahc->platform_data->host != NULL) {
-                        scsi_remove_host(ahc->platform_data->host);
-                        scsi_host_put(ahc->platform_data->host);
-                }
-
                 /* destroy all of the device and target objects */
                 for (i = 0; i < AHC_NUM_TARGETS; i++) {
                         starget = ahc->platform_data->starget[i];
@@ -1251,6 +1237,9 @@ ahc_platform_free(struct ahc_softc *ahc)
                                            0x1000);
                 }
 
+                if (ahc->platform_data->host)
+                        scsi_host_put(ahc->platform_data->host);
+
                 free(ahc->platform_data, M_DEVBUF);
         }
 }
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.h b/drivers/scsi/aic7xxx/aic7xxx_osm.h
index c52996269240..be9edbe26dbe 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.h
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.h
@@ -494,8 +494,6 @@ ahc_insb(struct ahc_softc * ahc, long port, uint8_t *array, int count)
 int             ahc_linux_register_host(struct ahc_softc *,
                                         struct scsi_host_template *);
 
-uint64_t        ahc_linux_get_memsize(void);
-
 /*************************** Pretty Printing **********************************/
 struct info_str {
         char *buffer;
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
index 0d44a6907dd2..cb30d9c1153d 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
@@ -143,6 +143,9 @@ ahc_linux_pci_dev_remove(struct pci_dev *pdev)
         struct ahc_softc *ahc = pci_get_drvdata(pdev);
         u_long s;
 
+        if (ahc->platform_data && ahc->platform_data->host)
+                        scsi_remove_host(ahc->platform_data->host);
+
         ahc_lock(ahc, &s);
         ahc_intr_enable(ahc, FALSE);
         ahc_unlock(ahc, &s);
@@ -180,6 +183,7 @@ ahc_linux_pci_dev_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct           ahc_pci_identity *entry;
         char            *name;
         int              error;
+        struct device   *dev = &pdev->dev;
 
         pci = pdev;
         entry = ahc_find_pci_device(pci);
@@ -209,11 +213,12 @@ ahc_linux_pci_dev_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_set_master(pdev);
 
         if (sizeof(dma_addr_t) > 4
-         && ahc_linux_get_memsize() > 0x80000000
-         && pci_set_dma_mask(pdev, mask_39bit) == 0) {
+            && ahc->features & AHC_LARGE_SCBS
+            && dma_set_mask(dev, mask_39bit) == 0
+            && dma_get_required_mask(dev) > DMA_32BIT_MASK) {
                 ahc->flags |= AHC_39BIT_ADDRESSING;
         } else {
-                if (pci_set_dma_mask(pdev, DMA_32BIT_MASK)) {
+                if (dma_set_mask(dev, DMA_32BIT_MASK)) {
                         printk(KERN_WARNING "aic7xxx: No suitable DMA available.\n");
                         return (-ENODEV);
                 }
diff --git a/drivers/scsi/ata_piix.c b/drivers/scsi/ata_piix.c
index 87e0c36f1554..d71cef767cec 100644
--- a/drivers/scsi/ata_piix.c
+++ b/drivers/scsi/ata_piix.c
@@ -442,7 +442,6 @@ static void piix_sata_phy_reset(struct ata_port *ap)
  *      piix_set_piomode - Initialize host controller PATA PIO timings
  *      @ap: Port whose timings we are configuring
  *      @adev: um
- *      @pio: PIO mode, 0 - 4
  *
  *      Set PIO mode for device, in host controller PCI config space.
  *
diff --git a/drivers/scsi/atp870u.c b/drivers/scsi/atp870u.c
index e6153fe5842a..a8cfbef304b5 100644
--- a/drivers/scsi/atp870u.c
+++ b/drivers/scsi/atp870u.c
@@ -996,6 +996,7 @@ oktosend:
 #ifdef ED_DBGP          
         printk("send_s870: prdaddr_2 0x%8x tmpcip %x target_id %d\n", dev->id[c][target_id].prdaddr,tmpcip,target_id);
 #endif  
+        dev->id[c][target_id].prdaddr = dev->id[c][target_id].prd_bus;
         outl(dev->id[c][target_id].prdaddr, tmpcip);
         tmpcip = tmpcip - 2;
         outb(0x06, tmpcip);
@@ -2572,7 +2573,7 @@ static void atp870u_free_tables(struct Scsi_Host *host)
                 for (k = 0; k < 16; k++) {
                         if (!atp_dev->id[j][k].prd_table)
                                 continue;
-                        pci_free_consistent(atp_dev->pdev, 1024, atp_dev->id[j][k].prd_table, atp_dev->id[j][k].prdaddr);
+                        pci_free_consistent(atp_dev->pdev, 1024, atp_dev->id[j][k].prd_table, atp_dev->id[j][k].prd_bus);
                         atp_dev->id[j][k].prd_table = NULL;
                 }
         }
@@ -2584,12 +2585,13 @@ static int atp870u_init_tables(struct Scsi_Host *host)
         int c,k;
         for(c=0;c < 2;c++) {
                 for(k=0;k<16;k++) {
-                                atp_dev->id[c][k].prd_table = pci_alloc_consistent(atp_dev->pdev, 1024, &(atp_dev->id[c][k].prdaddr));
+                                atp_dev->id[c][k].prd_table = pci_alloc_consistent(atp_dev->pdev, 1024, &(atp_dev->id[c][k].prd_bus));
                                 if (!atp_dev->id[c][k].prd_table) {
                                         printk("atp870u_init_tables fail\n");
                                 atp870u_free_tables(host);
                                 return -ENOMEM;
                         }
+                        atp_dev->id[c][k].prdaddr = atp_dev->id[c][k].prd_bus;
                         atp_dev->id[c][k].devsp=0x20;
                         atp_dev->id[c][k].devtype = 0x7f;
                         atp_dev->id[c][k].curr_req = NULL;                         
diff --git a/drivers/scsi/atp870u.h b/drivers/scsi/atp870u.h
index 89f43af39cf2..62bae64a01c1 100644
--- a/drivers/scsi/atp870u.h
+++ b/drivers/scsi/atp870u.h
@@ -54,8 +54,9 @@ struct atp_unit
                 unsigned long tran_len;
                 unsigned long last_len;
                 unsigned char *prd_pos;
-                unsigned char *prd_table;
-                dma_addr_t prdaddr;
+                unsigned char *prd_table;       /* Kernel address of PRD table */
+                dma_addr_t prd_bus;             /* Bus address of PRD */
+                dma_addr_t prdaddr;             /* Dynamically updated in driver */
                 struct scsi_cmnd *curr_req;
         } id[2][16];
         struct Scsi_Host *host;
diff --git a/drivers/scsi/fd_mcs.c b/drivers/scsi/fd_mcs.c
index fa652f8aa643..d59d449a9e4d 100644
--- a/drivers/scsi/fd_mcs.c
+++ b/drivers/scsi/fd_mcs.c
@@ -1360,3 +1360,5 @@ static Scsi_Host_Template driver_template = {
         .use_clustering                 = DISABLE_CLUSTERING,
 };
 #include "scsi_module.c"
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 85503fad789a..02fe371b0ab8 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -98,6 +98,7 @@ int scsi_host_set_state(struct Scsi_Host *shost, enum scsi_host_state state)
                 switch (oldstate) {
                 case SHOST_CREATED:
                 case SHOST_RUNNING:
+                case SHOST_CANCEL_RECOVERY:
                         break;
                 default:
                         goto illegal;
@@ -107,12 +108,31 @@ int scsi_host_set_state(struct Scsi_Host *shost, enum scsi_host_state state)
         case SHOST_DEL:
                 switch (oldstate) {
                 case SHOST_CANCEL:
+                case SHOST_DEL_RECOVERY:
                         break;
                 default:
                         goto illegal;
                 }
                 break;
 
+        case SHOST_CANCEL_RECOVERY:
+                switch (oldstate) {
+                case SHOST_CANCEL:
+                case SHOST_RECOVERY:
+                        break;
+                default:
+                        goto illegal;
+                }
+                break;
+
+        case SHOST_DEL_RECOVERY:
+                switch (oldstate) {
+                case SHOST_CANCEL_RECOVERY:
+                        break;
+                default:
+                        goto illegal;
+                }
+                break;
         }
         shost->shost_state = state;
         return 0;
@@ -134,17 +154,29 @@ EXPORT_SYMBOL(scsi_host_set_state);
  **/
 void scsi_remove_host(struct Scsi_Host *shost)
 {
+        unsigned long flags;
         down(&shost->scan_mutex);
-        scsi_host_set_state(shost, SHOST_CANCEL);
+        spin_lock_irqsave(shost->host_lock, flags);
+        if (scsi_host_set_state(shost, SHOST_CANCEL))
+                if (scsi_host_set_state(shost, SHOST_CANCEL_RECOVERY)) {
+                        spin_unlock_irqrestore(shost->host_lock, flags);
+                        up(&shost->scan_mutex);
+                        return;
+                }
+        spin_unlock_irqrestore(shost->host_lock, flags);
         up(&shost->scan_mutex);
         scsi_forget_host(shost);
         scsi_proc_host_rm(shost);
 
-        scsi_host_set_state(shost, SHOST_DEL);
+        spin_lock_irqsave(shost->host_lock, flags);
+        if (scsi_host_set_state(shost, SHOST_DEL))
+                BUG_ON(scsi_host_set_state(shost, SHOST_DEL_RECOVERY));
+        spin_unlock_irqrestore(shost->host_lock, flags);
 
         transport_unregister_device(&shost->shost_gendev);
         class_device_unregister(&shost->shost_classdev);
         device_del(&shost->shost_gendev);
+        scsi_proc_hostdir_rm(shost->hostt);
 }
 EXPORT_SYMBOL(scsi_remove_host);
 
@@ -231,7 +263,6 @@ static void scsi_host_dev_release(struct device *dev)
         if (shost->work_q)
                 destroy_workqueue(shost->work_q);
 
-        scsi_proc_hostdir_rm(shost->hostt);
         scsi_destroy_command_freelist(shost);
         kfree(shost->shost_data);
 
diff --git a/drivers/scsi/ibmmca.c b/drivers/scsi/ibmmca.c
index 6e54c7d9b33c..19392f651272 100644
--- a/drivers/scsi/ibmmca.c
+++ b/drivers/scsi/ibmmca.c
@@ -460,6 +460,8 @@ MODULE_PARM(adisplay, "1i");
 MODULE_PARM(normal, "1i");
 MODULE_PARM(ansi, "1i");
 #endif
+
+MODULE_LICENSE("GPL");
 #endif
 /*counter of concurrent disk read/writes, to turn on/off disk led */
 static int disk_rw_in_progress = 0;
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 5b14934ba861..ff25210b00ba 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -727,6 +727,16 @@ static void adapter_info_rsp(struct srp_event_struct *evt_struct)
                 if (hostdata->madapter_info.port_max_txu[0]) 
                         hostdata->host->max_sectors = 
                                 hostdata->madapter_info.port_max_txu[0] >> 9;
+                
+                if (hostdata->madapter_info.os_type == 3 &&
+                    strcmp(hostdata->madapter_info.srp_version, "1.6a") <= 0) {
+                        printk("ibmvscsi: host (Ver. %s) doesn't support large"
+                               "transfers\n",
+                               hostdata->madapter_info.srp_version);
+                        printk("ibmvscsi: limiting scatterlists to %d\n",
+                               MAX_INDIRECT_BUFS);
+                        hostdata->host->sg_tablesize = MAX_INDIRECT_BUFS;
+                }
         }
 }
 
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 5cc53cd9323e..e5b01997117a 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -2465,9 +2465,12 @@ static unsigned long ata_pio_poll(struct ata_port *ap)
  *
  *      LOCKING:
  *      None.  (executing in kernel thread context)
+ *
+ *      RETURNS:
+ *      Non-zero if qc completed, zero otherwise.
  */
 
-static void ata_pio_complete (struct ata_port *ap)
+static int ata_pio_complete (struct ata_port *ap)
 {
         struct ata_queued_cmd *qc;
         u8 drv_stat;
@@ -2486,14 +2489,14 @@ static void ata_pio_complete (struct ata_port *ap)
                 if (drv_stat & (ATA_BUSY | ATA_DRQ)) {
                         ap->pio_task_state = PIO_ST_LAST_POLL;
                         ap->pio_task_timeout = jiffies + ATA_TMOUT_PIO;
-                        return;
+                        return 0;
                 }
         }
 
         drv_stat = ata_wait_idle(ap);
         if (!ata_ok(drv_stat)) {
                 ap->pio_task_state = PIO_ST_ERR;
-                return;
+                return 0;
         }
 
         qc = ata_qc_from_tag(ap, ap->active_tag);
@@ -2502,6 +2505,10 @@ static void ata_pio_complete (struct ata_port *ap)
         ap->pio_task_state = PIO_ST_IDLE;
 
         ata_poll_qc_complete(qc, drv_stat);
+
+        /* another command may start at this point */
+
+        return 1;
 }
 
 
@@ -2709,7 +2716,7 @@ static void __atapi_pio_bytes(struct ata_queued_cmd *qc, unsigned int bytes)
 
 next_sg:
         if (unlikely(qc->cursg >= qc->n_elem)) {
-                /* 
+                /*
                  * The end of qc->sg is reached and the device expects
                  * more data to transfer. In order not to overrun qc->sg
                  * and fulfill length specified in the byte count register,
@@ -2721,7 +2728,7 @@ next_sg:
                 unsigned int i;
 
                 if (words) /* warning if bytes > 1 */
-                        printk(KERN_WARNING "ata%u: %u bytes trailing data\n", 
+                        printk(KERN_WARNING "ata%u: %u bytes trailing data\n",
                                ap->id, bytes);
 
                 for (i = 0; i < words; i++)
@@ -2849,9 +2856,7 @@ static void ata_pio_block(struct ata_port *ap)
         if (is_atapi_taskfile(&qc->tf)) {
                 /* no more data to transfer or unsupported ATAPI command */
                 if ((status & ATA_DRQ) == 0) {
-                        ap->pio_task_state = PIO_ST_IDLE;
-
-                        ata_poll_qc_complete(qc, status);
+                        ap->pio_task_state = PIO_ST_LAST;
                         return;
                 }
 
@@ -2887,7 +2892,12 @@ static void ata_pio_error(struct ata_port *ap)
 static void ata_pio_task(void *_data)
 {
         struct ata_port *ap = _data;
-        unsigned long timeout = 0;
+        unsigned long timeout;
+        int qc_completed;
+
+fsm_start:
+        timeout = 0;
+        qc_completed = 0;
 
         switch (ap->pio_task_state) {
         case PIO_ST_IDLE:
@@ -2898,7 +2908,7 @@ static void ata_pio_task(void *_data)
                 break;
 
         case PIO_ST_LAST:
-                ata_pio_complete(ap);
+                qc_completed = ata_pio_complete(ap);
                 break;
 
         case PIO_ST_POLL:
@@ -2913,10 +2923,9 @@ static void ata_pio_task(void *_data)
         }
 
         if (timeout)
-                queue_delayed_work(ata_wq, &ap->pio_task,
-                                   timeout);
-        else
-                queue_work(ata_wq, &ap->pio_task);
+                queue_delayed_work(ata_wq, &ap->pio_task, timeout);
+        else if (!qc_completed)
+                goto fsm_start;
 }
 
 static void atapi_request_sense(struct ata_port *ap, struct ata_device *dev,
@@ -4123,6 +4132,53 @@ err_out:
 }
 
 /**
+ *      ata_host_set_remove - PCI layer callback for device removal
+ *      @host_set: ATA host set that was removed
+ *
+ *      Unregister all objects associated with this host set. Free those 
+ *      objects.
+ *
+ *      LOCKING:
+ *      Inherited from calling layer (may sleep).
+ */
+
+
+void ata_host_set_remove(struct ata_host_set *host_set)
+{
+        struct ata_port *ap;
+        unsigned int i;
+
+        for (i = 0; i < host_set->n_ports; i++) {
+                ap = host_set->ports[i];
+                scsi_remove_host(ap->host);
+        }
+
+        free_irq(host_set->irq, host_set);
+
+        for (i = 0; i < host_set->n_ports; i++) {
+                ap = host_set->ports[i];
+
+                ata_scsi_release(ap->host);
+
+                if ((ap->flags & ATA_FLAG_NO_LEGACY) == 0) {
+                        struct ata_ioports *ioaddr = &ap->ioaddr;
+
+                        if (ioaddr->cmd_addr == 0x1f0)
+                                release_region(0x1f0, 8);
+                        else if (ioaddr->cmd_addr == 0x170)
+                                release_region(0x170, 8);
+                }
+
+                scsi_host_put(ap->host);
+        }
+
+        if (host_set->ops->host_stop)
+                host_set->ops->host_stop(host_set);
+
+        kfree(host_set);
+}
+
+/**
  *      ata_scsi_release - SCSI layer callback hook for host unload
  *      @host: libata host to be unloaded
  *
@@ -4462,39 +4518,8 @@ void ata_pci_remove_one (struct pci_dev *pdev)
 {
         struct device *dev = pci_dev_to_dev(pdev);
         struct ata_host_set *host_set = dev_get_drvdata(dev);
-        struct ata_port *ap;
-        unsigned int i;
-
-        for (i = 0; i < host_set->n_ports; i++) {
-                ap = host_set->ports[i];
-
-                scsi_remove_host(ap->host);
-        }
-
-        free_irq(host_set->irq, host_set);
-
-        for (i = 0; i < host_set->n_ports; i++) {
-                ap = host_set->ports[i];
-
-                ata_scsi_release(ap->host);
-
-                if ((ap->flags & ATA_FLAG_NO_LEGACY) == 0) {
-                        struct ata_ioports *ioaddr = &ap->ioaddr;
-
-                        if (ioaddr->cmd_addr == 0x1f0)
-                                release_region(0x1f0, 8);
-                        else if (ioaddr->cmd_addr == 0x170)
-                                release_region(0x170, 8);
-                }
-
-                scsi_host_put(ap->host);
-        }
-
-        if (host_set->ops->host_stop)
-                host_set->ops->host_stop(host_set);
-
-        kfree(host_set);
 
+        ata_host_set_remove(host_set);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
         dev_set_drvdata(dev, NULL);
@@ -4564,6 +4589,7 @@ module_exit(ata_exit);
 EXPORT_SYMBOL_GPL(ata_std_bios_param);
 EXPORT_SYMBOL_GPL(ata_std_ports);
 EXPORT_SYMBOL_GPL(ata_device_add);
+EXPORT_SYMBOL_GPL(ata_host_set_remove);
 EXPORT_SYMBOL_GPL(ata_sg_init);
 EXPORT_SYMBOL_GPL(ata_sg_init_one);
 EXPORT_SYMBOL_GPL(ata_qc_complete);
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 86eaf6d408d5..acae7c48ef7d 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -973,10 +973,10 @@ lpfc_get_host_fabric_name (struct Scsi_Host *shost)
         if ((phba->fc_flag & FC_FABRIC) ||
             ((phba->fc_topology == TOPOLOGY_LOOP) &&
              (phba->fc_flag & FC_PUBLIC_LOOP)))
-                node_name = wwn_to_u64(phba->fc_fabparam.nodeName.wwn);
+                node_name = wwn_to_u64(phba->fc_fabparam.nodeName.u.wwn);
         else
                 /* fabric is local port if there is no F/FL_Port */
-                node_name = wwn_to_u64(phba->fc_nodename.wwn);
+                node_name = wwn_to_u64(phba->fc_nodename.u.wwn);
 
         spin_unlock_irq(shost->host_lock);
 
@@ -1110,7 +1110,7 @@ lpfc_get_starget_node_name(struct scsi_target *starget)
         /* Search the mapped list for this target ID */
         list_for_each_entry(ndlp, &phba->fc_nlpmap_list, nlp_listp) {
                 if (starget->id == ndlp->nlp_sid) {
-                        node_name = wwn_to_u64(ndlp->nlp_nodename.wwn);
+                        node_name = wwn_to_u64(ndlp->nlp_nodename.u.wwn);
                         break;
                 }
         }
@@ -1131,7 +1131,7 @@ lpfc_get_starget_port_name(struct scsi_target *starget)
         /* Search the mapped list for this target ID */
         list_for_each_entry(ndlp, &phba->fc_nlpmap_list, nlp_listp) {
                 if (starget->id == ndlp->nlp_sid) {
-                        port_name = wwn_to_u64(ndlp->nlp_portname.wwn);
+                        port_name = wwn_to_u64(ndlp->nlp_portname.u.wwn);
                         break;
                 }
         }
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 4fb8eb0c84cf..56052f4510c3 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -1019,8 +1019,8 @@ lpfc_register_remote_port(struct lpfc_hba * phba,
         struct fc_rport_identifiers rport_ids;
 
         /* Remote port has reappeared. Re-register w/ FC transport */
-        rport_ids.node_name = wwn_to_u64(ndlp->nlp_nodename.wwn);
-        rport_ids.port_name = wwn_to_u64(ndlp->nlp_portname.wwn);
+        rport_ids.node_name = wwn_to_u64(ndlp->nlp_nodename.u.wwn);
+        rport_ids.port_name = wwn_to_u64(ndlp->nlp_portname.u.wwn);
         rport_ids.port_id = ndlp->nlp_DID;
         rport_ids.roles = FC_RPORT_ROLE_UNKNOWN;
         if (ndlp->nlp_type & NLP_FCP_TARGET)
diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h
index 047a87c26cc0..86c41981188b 100644
--- a/drivers/scsi/lpfc/lpfc_hw.h
+++ b/drivers/scsi/lpfc/lpfc_hw.h
@@ -280,9 +280,9 @@ struct lpfc_name {
 #define NAME_CCITT_GR_TYPE  0xE
                         uint8_t IEEEextLsb;     /* FC Word 0, bit 16:23, IEEE extended Lsb */
                         uint8_t IEEE[6];        /* FC IEEE address */
-                };
+                } s;
                 uint8_t wwn[8];
-        };
+        } u;
 };
 
 struct csp {
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 454058f655db..0856ff7d3b33 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -285,7 +285,7 @@ lpfc_config_port_post(struct lpfc_hba * phba)
         if (phba->SerialNumber[0] == 0) {
                 uint8_t *outptr;
 
-                outptr = (uint8_t *) & phba->fc_nodename.IEEE[0];
+                outptr = &phba->fc_nodename.u.s.IEEE[0];
                 for (i = 0; i < 12; i++) {
                         status = *outptr++;
                         j = ((status & 0xf0) >> 4);
@@ -1523,8 +1523,8 @@ lpfc_pci_probe_one(struct pci_dev *pdev, const struct pci_device_id *pid)
          * Must done after lpfc_sli_hba_setup()
          */
 
-        fc_host_node_name(host) = wwn_to_u64(phba->fc_nodename.wwn);
-        fc_host_port_name(host) = wwn_to_u64(phba->fc_portname.wwn);
+        fc_host_node_name(host) = wwn_to_u64(phba->fc_nodename.u.wwn);
+        fc_host_port_name(host) = wwn_to_u64(phba->fc_portname.u.wwn);
         fc_host_supported_classes(host) = FC_COS_CLASS3;
 
         memset(fc_host_supported_fc4s(host), 0,
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index 6f308ebe3e79..61a6fd810bb4 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -621,8 +621,6 @@ mega_build_cmd(adapter_t *adapter, Scsi_Cmnd *cmd, int *busy)
         if(islogical) {
                 switch (cmd->cmnd[0]) {
                 case TEST_UNIT_READY:
-                        memset(cmd->request_buffer, 0, cmd->request_bufflen);
-
 #if MEGA_HAVE_CLUSTERING
                         /*
                          * Do we support clustering and is the support enabled
@@ -652,11 +650,28 @@ mega_build_cmd(adapter_t *adapter, Scsi_Cmnd *cmd, int *busy)
                         return NULL;
 #endif
 
-                case MODE_SENSE:
+                case MODE_SENSE: {
+                        char *buf;
+
+                        if (cmd->use_sg) {
+                                struct scatterlist *sg;
+
+                                sg = (struct scatterlist *)cmd->request_buffer;
+                                buf = kmap_atomic(sg->page, KM_IRQ0) +
+                                        sg->offset;
+                        } else
+                                buf = cmd->request_buffer;
                         memset(cmd->request_buffer, 0, cmd->cmnd[4]);
+                        if (cmd->use_sg) {
+                                struct scatterlist *sg;
+
+                                sg = (struct scatterlist *)cmd->request_buffer;
+                                kunmap_atomic(buf - sg->offset, KM_IRQ0);
+                        }
                         cmd->result = (DID_OK << 16);
                         cmd->scsi_done(cmd);
                         return NULL;
+                }
 
                 case READ_CAPACITY:
                 case INQUIRY:
@@ -1685,14 +1700,23 @@ mega_rundoneq (adapter_t *adapter)
 static void
 mega_free_scb(adapter_t *adapter, scb_t *scb)
 {
+        unsigned long length;
+
         switch( scb->dma_type ) {
 
         case MEGA_DMA_TYPE_NONE:
                 break;
 
         case MEGA_BULK_DATA:
+                if (scb->cmd->use_sg == 0)
+                        length = scb->cmd->request_bufflen;
+                else {
+                        struct scatterlist *sgl =
+                                (struct scatterlist *)scb->cmd->request_buffer;
+                        length = sgl->length;
+                }
                 pci_unmap_page(adapter->dev, scb->dma_h_bulkdata,
-                        scb->cmd->request_bufflen, scb->dma_direction);
+                               length, scb->dma_direction);
                 break;
 
         case MEGA_SGLIST:
@@ -1741,6 +1765,7 @@ mega_build_sglist(adapter_t *adapter, scb_t *scb, u32 *buf, u32 *len)
         struct scatterlist      *sgl;
         struct page     *page;
         unsigned long   offset;
+        unsigned int    length;
         Scsi_Cmnd       *cmd;
         int     sgcnt;
         int     idx;
@@ -1748,14 +1773,23 @@ mega_build_sglist(adapter_t *adapter, scb_t *scb, u32 *buf, u32 *len)
         cmd = scb->cmd;
 
         /* Scatter-gather not used */
-        if( !cmd->use_sg ) {
-
-                page = virt_to_page(cmd->request_buffer);
-                offset = offset_in_page(cmd->request_buffer);
+        if( cmd->use_sg == 0 || (cmd->use_sg == 1 && 
+                                 !adapter->has_64bit_addr)) {
+
+                if (cmd->use_sg == 0) {
+                        page = virt_to_page(cmd->request_buffer);
+                        offset = offset_in_page(cmd->request_buffer);
+                        length = cmd->request_bufflen;
+                } else {
+                        sgl = (struct scatterlist *)cmd->request_buffer;
+                        page = sgl->page;
+                        offset = sgl->offset;
+                        length = sgl->length;
+                }
 
                 scb->dma_h_bulkdata = pci_map_page(adapter->dev,
                                                   page, offset,
-                                                  cmd->request_bufflen,
+                                                  length,
                                                   scb->dma_direction);
                 scb->dma_type = MEGA_BULK_DATA;
 
@@ -1765,14 +1799,14 @@ mega_build_sglist(adapter_t *adapter, scb_t *scb, u32 *buf, u32 *len)
                  */
                 if( adapter->has_64bit_addr ) {
                         scb->sgl64[0].address = scb->dma_h_bulkdata;
-                        scb->sgl64[0].length = cmd->request_bufflen;
+                        scb->sgl64[0].length = length;
                         *buf = (u32)scb->sgl_dma_addr;
-                        *len = (u32)cmd->request_bufflen;
+                        *len = (u32)length;
                         return 1;
                 }
                 else {
                         *buf = (u32)scb->dma_h_bulkdata;
-                        *len = (u32)cmd->request_bufflen;
+                        *len = (u32)length;
                 }
                 return 0;
         }
@@ -1791,27 +1825,23 @@ mega_build_sglist(adapter_t *adapter, scb_t *scb, u32 *buf, u32 *len)
 
         if( sgcnt > adapter->sglen ) BUG();
 
+        *len = 0;
+
         for( idx = 0; idx < sgcnt; idx++, sgl++ ) {
 
                 if( adapter->has_64bit_addr ) {
                         scb->sgl64[idx].address = sg_dma_address(sgl);
-                        scb->sgl64[idx].length = sg_dma_len(sgl);
+                        *len += scb->sgl64[idx].length = sg_dma_len(sgl);
                 }
                 else {
                         scb->sgl[idx].address = sg_dma_address(sgl);
-                        scb->sgl[idx].length = sg_dma_len(sgl);
+                        *len += scb->sgl[idx].length = sg_dma_len(sgl);
                 }
         }
 
         /* Reset pointer and length fields */
         *buf = scb->sgl_dma_addr;
 
-        /*
-         * For passthru command, dataxferlen must be set, even for commands
-         * with a sg list
-         */
-        *len = (u32)cmd->request_bufflen;
-
         /* Return count of SG requests */
         return sgcnt;
 }
diff --git a/drivers/scsi/megaraid/Kconfig.megaraid b/drivers/scsi/megaraid/Kconfig.megaraid
index 917d591d90b2..7363e12663ac 100644
--- a/drivers/scsi/megaraid/Kconfig.megaraid
+++ b/drivers/scsi/megaraid/Kconfig.megaraid
@@ -76,3 +76,12 @@ config MEGARAID_LEGACY
         To compile this driver as a module, choose M here: the
         module will be called megaraid
 endif
+
+config MEGARAID_SAS
+        tristate "LSI Logic MegaRAID SAS RAID Module"
+        depends on PCI && SCSI
+        help
+        Module for LSI Logic's SAS based RAID controllers.
+        To compile this driver as a module, choose 'm' here.
+        Module will be called megaraid_sas
+
diff --git a/drivers/scsi/megaraid/Makefile b/drivers/scsi/megaraid/Makefile
index 6dd99f275722..f469915b97c3 100644
--- a/drivers/scsi/megaraid/Makefile
+++ b/drivers/scsi/megaraid/Makefile
@@ -1,2 +1,3 @@
 obj-$(CONFIG_MEGARAID_MM)       += megaraid_mm.o
 obj-$(CONFIG_MEGARAID_MAILBOX)  += megaraid_mbox.o
+obj-$(CONFIG_MEGARAID_SAS)      += megaraid_sas.o
diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
new file mode 100644
index 000000000000..1b3148e842af
--- /dev/null
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -0,0 +1,2805 @@
+/*
+ *
+ *              Linux MegaRAID driver for SAS based RAID controllers
+ *
+ * Copyright (c) 2003-2005  LSI Logic Corporation.
+ *
+ *         This program is free software; you can redistribute it and/or
+ *         modify it under the terms of the GNU General Public License
+ *         as published by the Free Software Foundation; either version
+ *         2 of the License, or (at your option) any later version.
+ *
+ * FILE         : megaraid_sas.c
+ * Version      : v00.00.02.00-rc4
+ *
+ * Authors:
+ *      Sreenivas Bagalkote     <Sreenivas.Bagalkote@lsil.com>
+ *      Sumant Patro            <Sumant.Patro@lsil.com>
+ *
+ * List of supported controllers
+ *
+ * OEM  Product Name                    VID     DID     SSVID   SSID
+ * ---  ------------                    ---     ---     ----    ----
+ */
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/list.h>
+#include <linux/version.h>
+#include <linux/moduleparam.h>
+#include <linux/module.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/uio.h>
+#include <asm/uaccess.h>
+#include <linux/compat.h>
+
+#include <scsi/scsi.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_host.h>
+#include "megaraid_sas.h"
+
+MODULE_LICENSE("GPL");
+MODULE_VERSION(MEGASAS_VERSION);
+MODULE_AUTHOR("sreenivas.bagalkote@lsil.com");
+MODULE_DESCRIPTION("LSI Logic MegaRAID SAS Driver");
+
+/*
+ * PCI ID table for all supported controllers
+ */
+static struct pci_device_id megasas_pci_table[] = {
+
+        {
+         PCI_VENDOR_ID_LSI_LOGIC,
+         PCI_DEVICE_ID_LSI_SAS1064R,
+         PCI_ANY_ID,
+         PCI_ANY_ID,
+         },
+        {
+         PCI_VENDOR_ID_DELL,
+         PCI_DEVICE_ID_DELL_PERC5,
+         PCI_ANY_ID,
+         PCI_ANY_ID,
+         },
+        {0}                     /* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(pci, megasas_pci_table);
+
+static int megasas_mgmt_majorno;
+static struct megasas_mgmt_info megasas_mgmt_info;
+static struct fasync_struct *megasas_async_queue;
+static DECLARE_MUTEX(megasas_async_queue_mutex);
+
+/**
+ * megasas_get_cmd -    Get a command from the free pool
+ * @instance:           Adapter soft state
+ *
+ * Returns a free command from the pool
+ */
+static inline struct megasas_cmd *megasas_get_cmd(struct megasas_instance
+                                                  *instance)
+{
+        unsigned long flags;
+        struct megasas_cmd *cmd = NULL;
+
+        spin_lock_irqsave(&instance->cmd_pool_lock, flags);
+
+        if (!list_empty(&instance->cmd_pool)) {
+                cmd = list_entry((&instance->cmd_pool)->next,
+                                 struct megasas_cmd, list);
+                list_del_init(&cmd->list);
+        } else {
+                printk(KERN_ERR "megasas: Command pool empty!\n");
+        }
+
+        spin_unlock_irqrestore(&instance->cmd_pool_lock, flags);
+        return cmd;
+}
+
+/**
+ * megasas_return_cmd - Return a cmd to free command pool
+ * @instance:           Adapter soft state
+ * @cmd:                Command packet to be returned to free command pool
+ */
+static inline void
+megasas_return_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&instance->cmd_pool_lock, flags);
+
+        cmd->scmd = NULL;
+        list_add_tail(&cmd->list, &instance->cmd_pool);
+
+        spin_unlock_irqrestore(&instance->cmd_pool_lock, flags);
+}
+
+/**
+ * megasas_enable_intr -        Enables interrupts
+ * @regs:                       MFI register set
+ */
+static inline void
+megasas_enable_intr(struct megasas_register_set __iomem * regs)
+{
+        writel(1, &(regs)->outbound_intr_mask);
+
+        /* Dummy readl to force pci flush */
+        readl(&regs->outbound_intr_mask);
+}
+
+/**
+ * megasas_disable_intr -       Disables interrupts
+ * @regs:                       MFI register set
+ */
+static inline void
+megasas_disable_intr(struct megasas_register_set __iomem * regs)
+{
+        u32 mask = readl(&regs->outbound_intr_mask) & (~0x00000001);
+        writel(mask, &regs->outbound_intr_mask);
+
+        /* Dummy readl to force pci flush */
+        readl(&regs->outbound_intr_mask);
+}
+
+/**
+ * megasas_issue_polled -       Issues a polling command
+ * @instance:                   Adapter soft state
+ * @cmd:                        Command packet to be issued 
+ *
+ * For polling, MFI requires the cmd_status to be set to 0xFF before posting.
+ */
+static int
+megasas_issue_polled(struct megasas_instance *instance, struct megasas_cmd *cmd)
+{
+        int i;
+        u32 msecs = MFI_POLL_TIMEOUT_SECS * 1000;
+
+        struct megasas_header *frame_hdr = &cmd->frame->hdr;
+
+        frame_hdr->cmd_status = 0xFF;
+        frame_hdr->flags |= MFI_FRAME_DONT_POST_IN_REPLY_QUEUE;
+
+        /*
+         * Issue the frame using inbound queue port
+         */
+        writel(cmd->frame_phys_addr >> 3,
+               &instance->reg_set->inbound_queue_port);
+
+        /*
+         * Wait for cmd_status to change
+         */
+        for (i = 0; (i < msecs) && (frame_hdr->cmd_status == 0xff); i++) {
+                rmb();
+                msleep(1);
+        }
+
+        if (frame_hdr->cmd_status == 0xff)
+                return -ETIME;
+
+        return 0;
+}
+
+/**
+ * megasas_issue_blocked_cmd -  Synchronous wrapper around regular FW cmds
+ * @instance:                   Adapter soft state
+ * @cmd:                        Command to be issued
+ *
+ * This function waits on an event for the command to be returned from ISR.
+ * Used to issue ioctl commands.
+ */
+static int
+megasas_issue_blocked_cmd(struct megasas_instance *instance,
+                          struct megasas_cmd *cmd)
+{
+        cmd->cmd_status = ENODATA;
+
+        writel(cmd->frame_phys_addr >> 3,
+               &instance->reg_set->inbound_queue_port);
+
+        wait_event(instance->int_cmd_wait_q, (cmd->cmd_status != ENODATA));
+
+        return 0;
+}
+
+/**
+ * megasas_issue_blocked_abort_cmd -    Aborts previously issued cmd
+ * @instance:                           Adapter soft state
+ * @cmd_to_abort:                       Previously issued cmd to be aborted
+ *
+ * MFI firmware can abort previously issued AEN comamnd (automatic event
+ * notification). The megasas_issue_blocked_abort_cmd() issues such abort
+ * cmd and blocks till it is completed.
+ */
+static int
+megasas_issue_blocked_abort_cmd(struct megasas_instance *instance,
+                                struct megasas_cmd *cmd_to_abort)
+{
+        struct megasas_cmd *cmd;
+        struct megasas_abort_frame *abort_fr;
+
+        cmd = megasas_get_cmd(instance);
+
+        if (!cmd)
+                return -1;
+
+        abort_fr = &cmd->frame->abort;
+
+        /*
+         * Prepare and issue the abort frame
+         */
+        abort_fr->cmd = MFI_CMD_ABORT;
+        abort_fr->cmd_status = 0xFF;
+        abort_fr->flags = 0;
+        abort_fr->abort_context = cmd_to_abort->index;
+        abort_fr->abort_mfi_phys_addr_lo = cmd_to_abort->frame_phys_addr;
+        abort_fr->abort_mfi_phys_addr_hi = 0;
+
+        cmd->sync_cmd = 1;
+        cmd->cmd_status = 0xFF;
+
+        writel(cmd->frame_phys_addr >> 3,
+               &instance->reg_set->inbound_queue_port);
+
+        /*
+         * Wait for this cmd to complete
+         */
+        wait_event(instance->abort_cmd_wait_q, (cmd->cmd_status != 0xFF));
+
+        megasas_return_cmd(instance, cmd);
+        return 0;
+}
+
+/**
+ * megasas_make_sgl32 - Prepares 32-bit SGL
+ * @instance:           Adapter soft state
+ * @scp:                SCSI command from the mid-layer
+ * @mfi_sgl:            SGL to be filled in
+ *
+ * If successful, this function returns the number of SG elements. Otherwise,
+ * it returnes -1.
+ */
+static inline int
+megasas_make_sgl32(struct megasas_instance *instance, struct scsi_cmnd *scp,
+                   union megasas_sgl *mfi_sgl)
+{
+        int i;
+        int sge_count;
+        struct scatterlist *os_sgl;
+
+        /*
+         * Return 0 if there is no data transfer
+         */
+        if (!scp->request_buffer || !scp->request_bufflen)
+                return 0;
+
+        if (!scp->use_sg) {
+                mfi_sgl->sge32[0].phys_addr = pci_map_single(instance->pdev,
+                                                             scp->
+                                                             request_buffer,
+                                                             scp->
+                                                             request_bufflen,
+                                                             scp->
+                                                             sc_data_direction);
+                mfi_sgl->sge32[0].length = scp->request_bufflen;
+
+                return 1;
+        }
+
+        os_sgl = (struct scatterlist *)scp->request_buffer;
+        sge_count = pci_map_sg(instance->pdev, os_sgl, scp->use_sg,
+                               scp->sc_data_direction);
+
+        for (i = 0; i < sge_count; i++, os_sgl++) {
+                mfi_sgl->sge32[i].length = sg_dma_len(os_sgl);
+                mfi_sgl->sge32[i].phys_addr = sg_dma_address(os_sgl);
+        }
+
+        return sge_count;
+}
+
+/**
+ * megasas_make_sgl64 - Prepares 64-bit SGL
+ * @instance:           Adapter soft state
+ * @scp:                SCSI command from the mid-layer
+ * @mfi_sgl:            SGL to be filled in
+ *
+ * If successful, this function returns the number of SG elements. Otherwise,
+ * it returnes -1.
+ */
+static inline int
+megasas_make_sgl64(struct megasas_instance *instance, struct scsi_cmnd *scp,
+                   union megasas_sgl *mfi_sgl)
+{
+        int i;
+        int sge_count;
+        struct scatterlist *os_sgl;
+
+        /*
+         * Return 0 if there is no data transfer
+         */
+        if (!scp->request_buffer || !scp->request_bufflen)
+                return 0;
+
+        if (!scp->use_sg) {
+                mfi_sgl->sge64[0].phys_addr = pci_map_single(instance->pdev,
+                                                             scp->
+                                                             request_buffer,
+                                                             scp->
+                                                             request_bufflen,
+                                                             scp->
+                                                             sc_data_direction);
+
+                mfi_sgl->sge64[0].length = scp->request_bufflen;
+
+                return 1;
+        }
+
+        os_sgl = (struct scatterlist *)scp->request_buffer;
+        sge_count = pci_map_sg(instance->pdev, os_sgl, scp->use_sg,
+                               scp->sc_data_direction);
+
+        for (i = 0; i < sge_count; i++, os_sgl++) {
+                mfi_sgl->sge64[i].length = sg_dma_len(os_sgl);
+                mfi_sgl->sge64[i].phys_addr = sg_dma_address(os_sgl);
+        }
+
+        return sge_count;
+}
+
+/**
+ * megasas_build_dcdb - Prepares a direct cdb (DCDB) command
+ * @instance:           Adapter soft state
+ * @scp:                SCSI command
+ * @cmd:                Command to be prepared in
+ *
+ * This function prepares CDB commands. These are typcially pass-through
+ * commands to the devices.
+ */
+static inline int
+megasas_build_dcdb(struct megasas_instance *instance, struct scsi_cmnd *scp,
+                   struct megasas_cmd *cmd)
+{
+        u32 sge_sz;
+        int sge_bytes;
+        u32 is_logical;
+        u32 device_id;
+        u16 flags = 0;
+        struct megasas_pthru_frame *pthru;
+
+        is_logical = MEGASAS_IS_LOGICAL(scp);
+        device_id = MEGASAS_DEV_INDEX(instance, scp);
+        pthru = (struct megasas_pthru_frame *)cmd->frame;
+
+        if (scp->sc_data_direction == PCI_DMA_TODEVICE)
+                flags = MFI_FRAME_DIR_WRITE;
+        else if (scp->sc_data_direction == PCI_DMA_FROMDEVICE)
+                flags = MFI_FRAME_DIR_READ;
+        else if (scp->sc_data_direction == PCI_DMA_NONE)
+                flags = MFI_FRAME_DIR_NONE;
+
+        /*
+         * Prepare the DCDB frame
+         */
+        pthru->cmd = (is_logical) ? MFI_CMD_LD_SCSI_IO : MFI_CMD_PD_SCSI_IO;
+        pthru->cmd_status = 0x0;
+        pthru->scsi_status = 0x0;
+        pthru->target_id = device_id;
+        pthru->lun = scp->device->lun;
+        pthru->cdb_len = scp->cmd_len;
+        pthru->timeout = 0;
+        pthru->flags = flags;
+        pthru->data_xfer_len = scp->request_bufflen;
+
+        memcpy(pthru->cdb, scp->cmnd, scp->cmd_len);
+
+        /*
+         * Construct SGL
+         */
+        sge_sz = (IS_DMA64) ? sizeof(struct megasas_sge64) :
+            sizeof(struct megasas_sge32);
+
+        if (IS_DMA64) {
+                pthru->flags |= MFI_FRAME_SGL64;
+                pthru->sge_count = megasas_make_sgl64(instance, scp,
+                                                      &pthru->sgl);
+        } else
+                pthru->sge_count = megasas_make_sgl32(instance, scp,
+                                                      &pthru->sgl);
+
+        /*
+         * Sense info specific
+         */
+        pthru->sense_len = SCSI_SENSE_BUFFERSIZE;
+        pthru->sense_buf_phys_addr_hi = 0;
+        pthru->sense_buf_phys_addr_lo = cmd->sense_phys_addr;
+
+        sge_bytes = sge_sz * pthru->sge_count;
+
+        /*
+         * Compute the total number of frames this command consumes. FW uses
+         * this number to pull sufficient number of frames from host memory.
+         */
+        cmd->frame_count = (sge_bytes / MEGAMFI_FRAME_SIZE) +
+            ((sge_bytes % MEGAMFI_FRAME_SIZE) ? 1 : 0) + 1;
+
+        if (cmd->frame_count > 7)
+                cmd->frame_count = 8;
+
+        return cmd->frame_count;
+}
+
+/**
+ * megasas_build_ldio - Prepares IOs to logical devices
+ * @instance:           Adapter soft state
+ * @scp:                SCSI command
+ * @cmd:                Command to to be prepared
+ *
+ * Frames (and accompanying SGLs) for regular SCSI IOs use this function.
+ */
+static inline int
+megasas_build_ldio(struct megasas_instance *instance, struct scsi_cmnd *scp,
+                   struct megasas_cmd *cmd)
+{
+        u32 sge_sz;
+        int sge_bytes;
+        u32 device_id;
+        u8 sc = scp->cmnd[0];
+        u16 flags = 0;
+        struct megasas_io_frame *ldio;
+
+        device_id = MEGASAS_DEV_INDEX(instance, scp);
+        ldio = (struct megasas_io_frame *)cmd->frame;
+
+        if (scp->sc_data_direction == PCI_DMA_TODEVICE)
+                flags = MFI_FRAME_DIR_WRITE;
+        else if (scp->sc_data_direction == PCI_DMA_FROMDEVICE)
+                flags = MFI_FRAME_DIR_READ;
+
+        /*
+         * Preare the Logical IO frame: 2nd bit is zero for all read cmds
+         */
+        ldio->cmd = (sc & 0x02) ? MFI_CMD_LD_WRITE : MFI_CMD_LD_READ;
+        ldio->cmd_status = 0x0;
+        ldio->scsi_status = 0x0;
+        ldio->target_id = device_id;
+        ldio->timeout = 0;
+        ldio->reserved_0 = 0;
+        ldio->pad_0 = 0;
+        ldio->flags = flags;
+        ldio->start_lba_hi = 0;
+        ldio->access_byte = (scp->cmd_len != 6) ? scp->cmnd[1] : 0;
+
+        /*
+         * 6-byte READ(0x08) or WRITE(0x0A) cdb
+         */
+        if (scp->cmd_len == 6) {
+                ldio->lba_count = (u32) scp->cmnd[4];
+                ldio->start_lba_lo = ((u32) scp->cmnd[1] << 16) |
+                    ((u32) scp->cmnd[2] << 8) | (u32) scp->cmnd[3];
+
+                ldio->start_lba_lo &= 0x1FFFFF;
+        }
+
+        /*
+         * 10-byte READ(0x28) or WRITE(0x2A) cdb
+         */
+        else if (scp->cmd_len == 10) {
+                ldio->lba_count = (u32) scp->cmnd[8] |
+                    ((u32) scp->cmnd[7] << 8);
+                ldio->start_lba_lo = ((u32) scp->cmnd[2] << 24) |
+                    ((u32) scp->cmnd[3] << 16) |
+                    ((u32) scp->cmnd[4] << 8) | (u32) scp->cmnd[5];
+        }
+
+        /*
+         * 12-byte READ(0xA8) or WRITE(0xAA) cdb
+         */
+        else if (scp->cmd_len == 12) {
+                ldio->lba_count = ((u32) scp->cmnd[6] << 24) |
+                    ((u32) scp->cmnd[7] << 16) |
+                    ((u32) scp->cmnd[8] << 8) | (u32) scp->cmnd[9];
+
+                ldio->start_lba_lo = ((u32) scp->cmnd[2] << 24) |
+                    ((u32) scp->cmnd[3] << 16) |
+                    ((u32) scp->cmnd[4] << 8) | (u32) scp->cmnd[5];
+        }
+
+        /*
+         * 16-byte READ(0x88) or WRITE(0x8A) cdb
+         */
+        else if (scp->cmd_len == 16) {
+                ldio->lba_count = ((u32) scp->cmnd[10] << 24) |
+                    ((u32) scp->cmnd[11] << 16) |
+                    ((u32) scp->cmnd[12] << 8) | (u32) scp->cmnd[13];
+
+                ldio->start_lba_lo = ((u32) scp->cmnd[6] << 24) |
+                    ((u32) scp->cmnd[7] << 16) |
+                    ((u32) scp->cmnd[8] << 8) | (u32) scp->cmnd[9];
+
+                ldio->start_lba_hi = ((u32) scp->cmnd[2] << 24) |
+                    ((u32) scp->cmnd[3] << 16) |
+                    ((u32) scp->cmnd[4] << 8) | (u32) scp->cmnd[5];
+
+        }
+
+        /*
+         * Construct SGL
+         */
+        sge_sz = (IS_DMA64) ? sizeof(struct megasas_sge64) :
+            sizeof(struct megasas_sge32);
+
+        if (IS_DMA64) {
+                ldio->flags |= MFI_FRAME_SGL64;
+                ldio->sge_count = megasas_make_sgl64(instance, scp, &ldio->sgl);
+        } else
+                ldio->sge_count = megasas_make_sgl32(instance, scp, &ldio->sgl);
+
+        /*
+         * Sense info specific
+         */
+        ldio->sense_len = SCSI_SENSE_BUFFERSIZE;
+        ldio->sense_buf_phys_addr_hi = 0;
+        ldio->sense_buf_phys_addr_lo = cmd->sense_phys_addr;
+
+        sge_bytes = sge_sz * ldio->sge_count;
+
+        cmd->frame_count = (sge_bytes / MEGAMFI_FRAME_SIZE) +
+            ((sge_bytes % MEGAMFI_FRAME_SIZE) ? 1 : 0) + 1;
+
+        if (cmd->frame_count > 7)
+                cmd->frame_count = 8;
+
+        return cmd->frame_count;
+}
+
+/**
+ * megasas_build_cmd -  Prepares a command packet
+ * @instance:           Adapter soft state
+ * @scp:                SCSI command
+ * @frame_count:        [OUT] Number of frames used to prepare this command
+ */
+static inline struct megasas_cmd *megasas_build_cmd(struct megasas_instance
+                                                    *instance,
+                                                    struct scsi_cmnd *scp,
+                                                    int *frame_count)
+{
+        u32 logical_cmd;
+        struct megasas_cmd *cmd;
+
+        /*
+         * Find out if this is logical or physical drive command.
+         */
+        logical_cmd = MEGASAS_IS_LOGICAL(scp);
+
+        /*
+         * Logical drive command
+         */
+        if (logical_cmd) {
+
+                if (scp->device->id >= MEGASAS_MAX_LD) {
+                        scp->result = DID_BAD_TARGET << 16;
+                        return NULL;
+                }
+
+                switch (scp->cmnd[0]) {
+
+                case READ_10:
+                case WRITE_10:
+                case READ_12:
+                case WRITE_12:
+                case READ_6:
+                case WRITE_6:
+                case READ_16:
+                case WRITE_16:
+                        /*
+                         * Fail for LUN > 0
+                         */
+                        if (scp->device->lun) {
+                                scp->result = DID_BAD_TARGET << 16;
+                                return NULL;
+                        }
+
+                        cmd = megasas_get_cmd(instance);
+
+                        if (!cmd) {
+                                scp->result = DID_IMM_RETRY << 16;
+                                return NULL;
+                        }
+
+                        *frame_count = megasas_build_ldio(instance, scp, cmd);
+
+                        if (!(*frame_count)) {
+                                megasas_return_cmd(instance, cmd);
+                                return NULL;
+                        }
+
+                        return cmd;
+
+                default:
+                        /*
+                         * Fail for LUN > 0
+                         */
+                        if (scp->device->lun) {
+                                scp->result = DID_BAD_TARGET << 16;
+                                return NULL;
+                        }
+
+                        cmd = megasas_get_cmd(instance);
+
+                        if (!cmd) {
+                                scp->result = DID_IMM_RETRY << 16;
+                                return NULL;
+                        }
+
+                        *frame_count = megasas_build_dcdb(instance, scp, cmd);
+
+                        if (!(*frame_count)) {
+                                megasas_return_cmd(instance, cmd);
+                                return NULL;
+                        }
+
+                        return cmd;
+                }
+        } else {
+                cmd = megasas_get_cmd(instance);
+
+                if (!cmd) {
+                        scp->result = DID_IMM_RETRY << 16;
+                        return NULL;
+                }
+
+                *frame_count = megasas_build_dcdb(instance, scp, cmd);
+
+                if (!(*frame_count)) {
+                        megasas_return_cmd(instance, cmd);
+                        return NULL;
+                }
+
+                return cmd;
+        }
+
+        return NULL;
+}
+
+/**
+ * megasas_queue_command -      Queue entry point
+ * @scmd:                       SCSI command to be queued
+ * @done:                       Callback entry point
+ */
+static int
+megasas_queue_command(struct scsi_cmnd *scmd, void (*done) (struct scsi_cmnd *))
+{
+        u32 frame_count;
+        unsigned long flags;
+        struct megasas_cmd *cmd;
+        struct megasas_instance *instance;
+
+        instance = (struct megasas_instance *)
+            scmd->device->host->hostdata;
+        scmd->scsi_done = done;
+        scmd->result = 0;
+
+        cmd = megasas_build_cmd(instance, scmd, &frame_count);
+
+        if (!cmd) {
+                done(scmd);
+                return 0;
+        }
+
+        cmd->scmd = scmd;
+        scmd->SCp.ptr = (char *)cmd;
+        scmd->SCp.sent_command = jiffies;
+
+        /*
+         * Issue the command to the FW
+         */
+        spin_lock_irqsave(&instance->instance_lock, flags);
+        instance->fw_outstanding++;
+        spin_unlock_irqrestore(&instance->instance_lock, flags);
+
+        writel(((cmd->frame_phys_addr >> 3) | (cmd->frame_count - 1)),
+               &instance->reg_set->inbound_queue_port);
+
+        return 0;
+}
+
+/**
+ * megasas_wait_for_outstanding -       Wait for all outstanding cmds
+ * @instance:                           Adapter soft state
+ *
+ * This function waits for upto MEGASAS_RESET_WAIT_TIME seconds for FW to
+ * complete all its outstanding commands. Returns error if one or more IOs
+ * are pending after this time period. It also marks the controller dead.
+ */
+static int megasas_wait_for_outstanding(struct megasas_instance *instance)
+{
+        int i;
+        u32 wait_time = MEGASAS_RESET_WAIT_TIME;
+
+        for (i = 0; i < wait_time; i++) {
+
+                if (!instance->fw_outstanding)
+                        break;
+
+                if (!(i % MEGASAS_RESET_NOTICE_INTERVAL)) {
+                        printk(KERN_NOTICE "megasas: [%2d]waiting for %d "
+                               "commands to complete\n", i,
+                               instance->fw_outstanding);
+                }
+
+                msleep(1000);
+        }
+
+        if (instance->fw_outstanding) {
+                instance->hw_crit_error = 1;
+                return FAILED;
+        }
+
+        return SUCCESS;
+}
+
+/**
+ * megasas_generic_reset -      Generic reset routine
+ * @scmd:                       Mid-layer SCSI command
+ *
+ * This routine implements a generic reset handler for device, bus and host
+ * reset requests. Device, bus and host specific reset handlers can use this
+ * function after they do their specific tasks.
+ */
+static int megasas_generic_reset(struct scsi_cmnd *scmd)
+{
+        int ret_val;
+        struct megasas_instance *instance;
+
+        instance = (struct megasas_instance *)scmd->device->host->hostdata;
+
+        printk(KERN_NOTICE "megasas: RESET -%ld cmd=%x <c=%d t=%d l=%d>\n",
+               scmd->serial_number, scmd->cmnd[0], scmd->device->channel,
+               scmd->device->id, scmd->device->lun);
+
+        if (instance->hw_crit_error) {
+                printk(KERN_ERR "megasas: cannot recover from previous reset "
+                       "failures\n");
+                return FAILED;
+        }
+
+        spin_unlock(scmd->device->host->host_lock);
+
+        ret_val = megasas_wait_for_outstanding(instance);
+
+        if (ret_val == SUCCESS)
+                printk(KERN_NOTICE "megasas: reset successful \n");
+        else
+                printk(KERN_ERR "megasas: failed to do reset\n");
+
+        spin_lock(scmd->device->host->host_lock);
+
+        return ret_val;
+}
+
+static enum scsi_eh_timer_return megasas_reset_timer(struct scsi_cmnd *scmd)
+{
+        unsigned long seconds;
+
+        if (scmd->SCp.ptr) {
+                seconds = (jiffies - scmd->SCp.sent_command) / HZ;
+
+                if (seconds < 90) {
+                        return EH_RESET_TIMER;
+                } else {
+                        return EH_NOT_HANDLED;
+                }
+        }
+
+        return EH_HANDLED;
+}
+
+/**
+ * megasas_reset_device -       Device reset handler entry point
+ */
+static int megasas_reset_device(struct scsi_cmnd *scmd)
+{
+        int ret;
+
+        /*
+         * First wait for all commands to complete
+         */
+        ret = megasas_generic_reset(scmd);
+
+        return ret;
+}
+
+/**
+ * megasas_reset_bus_host -     Bus & host reset handler entry point
+ */
+static int megasas_reset_bus_host(struct scsi_cmnd *scmd)
+{
+        int ret;
+
+        /*
+         * Frist wait for all commands to complete
+         */
+        ret = megasas_generic_reset(scmd);
+
+        return ret;
+}
+
+/**
+ * megasas_service_aen -        Processes an event notification
+ * @instance:                   Adapter soft state
+ * @cmd:                        AEN command completed by the ISR
+ *
+ * For AEN, driver sends a command down to FW that is held by the FW till an
+ * event occurs. When an event of interest occurs, FW completes the command
+ * that it was previously holding.
+ *
+ * This routines sends SIGIO signal to processes that have registered with the
+ * driver for AEN.
+ */
+static void
+megasas_service_aen(struct megasas_instance *instance, struct megasas_cmd *cmd)
+{
+        /*
+         * Don't signal app if it is just an aborted previously registered aen
+         */
+        if (!cmd->abort_aen)
+                kill_fasync(&megasas_async_queue, SIGIO, POLL_IN);
+        else
+                cmd->abort_aen = 0;
+
+        instance->aen_cmd = NULL;
+        megasas_return_cmd(instance, cmd);
+}
+
+/*
+ * Scsi host template for megaraid_sas driver
+ */
+static struct scsi_host_template megasas_template = {
+
+        .module = THIS_MODULE,
+        .name = "LSI Logic SAS based MegaRAID driver",
+        .proc_name = "megaraid_sas",
+        .queuecommand = megasas_queue_command,
+        .eh_device_reset_handler = megasas_reset_device,
+        .eh_bus_reset_handler = megasas_reset_bus_host,
+        .eh_host_reset_handler = megasas_reset_bus_host,
+        .eh_timed_out = megasas_reset_timer,
+        .use_clustering = ENABLE_CLUSTERING,
+};
+
+/**
+ * megasas_complete_int_cmd -   Completes an internal command
+ * @instance:                   Adapter soft state
+ * @cmd:                        Command to be completed
+ *
+ * The megasas_issue_blocked_cmd() function waits for a command to complete
+ * after it issues a command. This function wakes up that waiting routine by
+ * calling wake_up() on the wait queue.
+ */
+static void
+megasas_complete_int_cmd(struct megasas_instance *instance,
+                         struct megasas_cmd *cmd)
+{
+        cmd->cmd_status = cmd->frame->io.cmd_status;
+
+        if (cmd->cmd_status == ENODATA) {
+                cmd->cmd_status = 0;
+        }
+        wake_up(&instance->int_cmd_wait_q);
+}
+
+/**
+ * megasas_complete_abort -     Completes aborting a command
+ * @instance:                   Adapter soft state
+ * @cmd:                        Cmd that was issued to abort another cmd
+ *
+ * The megasas_issue_blocked_abort_cmd() function waits on abort_cmd_wait_q 
+ * after it issues an abort on a previously issued command. This function 
+ * wakes up all functions waiting on the same wait queue.
+ */
+static void
+megasas_complete_abort(struct megasas_instance *instance,
+                       struct megasas_cmd *cmd)
+{
+        if (cmd->sync_cmd) {
+                cmd->sync_cmd = 0;
+                cmd->cmd_status = 0;
+                wake_up(&instance->abort_cmd_wait_q);
+        }
+
+        return;
+}
+
+/**
+ * megasas_unmap_sgbuf -        Unmap SG buffers
+ * @instance:                   Adapter soft state
+ * @cmd:                        Completed command
+ */
+static inline void
+megasas_unmap_sgbuf(struct megasas_instance *instance, struct megasas_cmd *cmd)
+{
+        dma_addr_t buf_h;
+        u8 opcode;
+
+        if (cmd->scmd->use_sg) {
+                pci_unmap_sg(instance->pdev, cmd->scmd->request_buffer,
+                             cmd->scmd->use_sg, cmd->scmd->sc_data_direction);
+                return;
+        }
+
+        if (!cmd->scmd->request_bufflen)
+                return;
+
+        opcode = cmd->frame->hdr.cmd;
+
+        if ((opcode == MFI_CMD_LD_READ) || (opcode == MFI_CMD_LD_WRITE)) {
+                if (IS_DMA64)
+                        buf_h = cmd->frame->io.sgl.sge64[0].phys_addr;
+                else
+                        buf_h = cmd->frame->io.sgl.sge32[0].phys_addr;
+        } else {
+                if (IS_DMA64)
+                        buf_h = cmd->frame->pthru.sgl.sge64[0].phys_addr;
+                else
+                        buf_h = cmd->frame->pthru.sgl.sge32[0].phys_addr;
+        }
+
+        pci_unmap_single(instance->pdev, buf_h, cmd->scmd->request_bufflen,
+                         cmd->scmd->sc_data_direction);
+        return;
+}
+
+/**
+ * megasas_complete_cmd -       Completes a command
+ * @instance:                   Adapter soft state
+ * @cmd:                        Command to be completed
+ * @alt_status:                 If non-zero, use this value as status to 
+ *                              SCSI mid-layer instead of the value returned
+ *                              by the FW. This should be used if caller wants
+ *                              an alternate status (as in the case of aborted
+ *                              commands)
+ */
+static inline void
+megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd,
+                     u8 alt_status)
+{
+        int exception = 0;
+        struct megasas_header *hdr = &cmd->frame->hdr;
+        unsigned long flags;
+
+        if (cmd->scmd) {
+                cmd->scmd->SCp.ptr = (char *)0;
+        }
+
+        switch (hdr->cmd) {
+
+        case MFI_CMD_PD_SCSI_IO:
+        case MFI_CMD_LD_SCSI_IO:
+
+                /*
+                 * MFI_CMD_PD_SCSI_IO and MFI_CMD_LD_SCSI_IO could have been
+                 * issued either through an IO path or an IOCTL path. If it
+                 * was via IOCTL, we will send it to internal completion.
+                 */
+                if (cmd->sync_cmd) {
+                        cmd->sync_cmd = 0;
+                        megasas_complete_int_cmd(instance, cmd);
+                        break;
+                }
+
+                /*
+                 * Don't export physical disk devices to mid-layer.
+                 */
+                if (!MEGASAS_IS_LOGICAL(cmd->scmd) &&
+                    (hdr->cmd_status == MFI_STAT_OK) &&
+                    (cmd->scmd->cmnd[0] == INQUIRY)) {
+
+                        if (((*(u8 *) cmd->scmd->request_buffer) & 0x1F) ==
+                            TYPE_DISK) {
+                                cmd->scmd->result = DID_BAD_TARGET << 16;
+                                exception = 1;
+                        }
+                }
+
+        case MFI_CMD_LD_READ:
+        case MFI_CMD_LD_WRITE:
+
+                if (alt_status) {
+                        cmd->scmd->result = alt_status << 16;
+                        exception = 1;
+                }
+
+                if (exception) {
+
+                        spin_lock_irqsave(&instance->instance_lock, flags);
+                        instance->fw_outstanding--;
+                        spin_unlock_irqrestore(&instance->instance_lock, flags);
+
+                        megasas_unmap_sgbuf(instance, cmd);
+                        cmd->scmd->scsi_done(cmd->scmd);
+                        megasas_return_cmd(instance, cmd);
+
+                        break;
+                }
+
+                switch (hdr->cmd_status) {
+
+                case MFI_STAT_OK:
+                        cmd->scmd->result = DID_OK << 16;
+                        break;
+
+                case MFI_STAT_SCSI_IO_FAILED:
+                case MFI_STAT_LD_INIT_IN_PROGRESS:
+                        cmd->scmd->result =
+                            (DID_ERROR << 16) | hdr->scsi_status;
+                        break;
+
+                case MFI_STAT_SCSI_DONE_WITH_ERROR:
+
+                        cmd->scmd->result = (DID_OK << 16) | hdr->scsi_status;
+
+                        if (hdr->scsi_status == SAM_STAT_CHECK_CONDITION) {
+                                memset(cmd->scmd->sense_buffer, 0,
+                                       SCSI_SENSE_BUFFERSIZE);
+                                memcpy(cmd->scmd->sense_buffer, cmd->sense,
+                                       hdr->sense_len);
+
+                                cmd->scmd->result |= DRIVER_SENSE << 24;
+                        }
+
+                        break;
+
+                case MFI_STAT_LD_OFFLINE:
+                case MFI_STAT_DEVICE_NOT_FOUND:
+                        cmd->scmd->result = DID_BAD_TARGET << 16;
+                        break;
+
+                default:
+                        printk(KERN_DEBUG "megasas: MFI FW status %#x\n",
+                               hdr->cmd_status);
+                        cmd->scmd->result = DID_ERROR << 16;
+                        break;
+                }
+
+                spin_lock_irqsave(&instance->instance_lock, flags);
+                instance->fw_outstanding--;
+                spin_unlock_irqrestore(&instance->instance_lock, flags);
+
+                megasas_unmap_sgbuf(instance, cmd);
+                cmd->scmd->scsi_done(cmd->scmd);
+                megasas_return_cmd(instance, cmd);
+
+                break;
+
+        case MFI_CMD_SMP:
+        case MFI_CMD_STP:
+        case MFI_CMD_DCMD:
+
+                /*
+                 * See if got an event notification
+                 */
+                if (cmd->frame->dcmd.opcode == MR_DCMD_CTRL_EVENT_WAIT)
+                        megasas_service_aen(instance, cmd);
+                else
+                        megasas_complete_int_cmd(instance, cmd);
+
+                break;
+
+        case MFI_CMD_ABORT:
+                /*
+                 * Cmd issued to abort another cmd returned
+                 */
+                megasas_complete_abort(instance, cmd);
+                break;
+
+        default:
+                printk("megasas: Unknown command completed! [0x%X]\n",
+                       hdr->cmd);
+                break;
+        }
+}
+
+/**
+ * megasas_deplete_reply_queue -        Processes all completed commands
+ * @instance:                           Adapter soft state
+ * @alt_status:                         Alternate status to be returned to
+ *                                      SCSI mid-layer instead of the status
+ *                                      returned by the FW
+ */
+static inline int
+megasas_deplete_reply_queue(struct megasas_instance *instance, u8 alt_status)
+{
+        u32 status;
+        u32 producer;
+        u32 consumer;
+        u32 context;
+        struct megasas_cmd *cmd;
+
+        /*
+         * Check if it is our interrupt
+         */
+        status = readl(&instance->reg_set->outbound_intr_status);
+
+        if (!(status & MFI_OB_INTR_STATUS_MASK)) {
+                return IRQ_NONE;
+        }
+
+        /*
+         * Clear the interrupt by writing back the same value
+         */
+        writel(status, &instance->reg_set->outbound_intr_status);
+
+        producer = *instance->producer;
+        consumer = *instance->consumer;
+
+        while (consumer != producer) {
+                context = instance->reply_queue[consumer];
+
+                cmd = instance->cmd_list[context];
+
+                megasas_complete_cmd(instance, cmd, alt_status);
+
+                consumer++;
+                if (consumer == (instance->max_fw_cmds + 1)) {
+                        consumer = 0;
+                }
+        }
+
+        *instance->consumer = producer;
+
+        return IRQ_HANDLED;
+}
+
+/**
+ * megasas_isr - isr entry point
+ */
+static irqreturn_t megasas_isr(int irq, void *devp, struct pt_regs *regs)
+{
+        return megasas_deplete_reply_queue((struct megasas_instance *)devp,
+                                           DID_OK);
+}
+
+/**
+ * megasas_transition_to_ready -        Move the FW to READY state
+ * @reg_set:                            MFI register set
+ *
+ * During the initialization, FW passes can potentially be in any one of
+ * several possible states. If the FW in operational, waiting-for-handshake
+ * states, driver must take steps to bring it to ready state. Otherwise, it
+ * has to wait for the ready state.
+ */
+static int
+megasas_transition_to_ready(struct megasas_register_set __iomem * reg_set)
+{
+        int i;
+        u8 max_wait;
+        u32 fw_state;
+        u32 cur_state;
+
+        fw_state = readl(&reg_set->outbound_msg_0) & MFI_STATE_MASK;
+
+        while (fw_state != MFI_STATE_READY) {
+
+                printk(KERN_INFO "megasas: Waiting for FW to come to ready"
+                       " state\n");
+                switch (fw_state) {
+
+                case MFI_STATE_FAULT:
+
+                        printk(KERN_DEBUG "megasas: FW in FAULT state!!\n");
+                        return -ENODEV;
+
+                case MFI_STATE_WAIT_HANDSHAKE:
+                        /*
+                         * Set the CLR bit in inbound doorbell
+                         */
+                        writel(MFI_INIT_CLEAR_HANDSHAKE,
+                               &reg_set->inbound_doorbell);
+
+                        max_wait = 2;
+                        cur_state = MFI_STATE_WAIT_HANDSHAKE;
+                        break;
+
+                case MFI_STATE_OPERATIONAL:
+                        /*
+                         * Bring it to READY state; assuming max wait 2 secs
+                         */
+                        megasas_disable_intr(reg_set);
+                        writel(MFI_INIT_READY, &reg_set->inbound_doorbell);
+
+                        max_wait = 10;
+                        cur_state = MFI_STATE_OPERATIONAL;
+                        break;
+
+                case MFI_STATE_UNDEFINED:
+                        /*
+                         * This state should not last for more than 2 seconds
+                         */
+                        max_wait = 2;
+                        cur_state = MFI_STATE_UNDEFINED;
+                        break;
+
+                case MFI_STATE_BB_INIT:
+                        max_wait = 2;
+                        cur_state = MFI_STATE_BB_INIT;
+                        break;
+
+                case MFI_STATE_FW_INIT:
+                        max_wait = 20;
+                        cur_state = MFI_STATE_FW_INIT;
+                        break;
+
+                case MFI_STATE_FW_INIT_2:
+                        max_wait = 20;
+                        cur_state = MFI_STATE_FW_INIT_2;
+                        break;
+
+                case MFI_STATE_DEVICE_SCAN:
+                        max_wait = 20;
+                        cur_state = MFI_STATE_DEVICE_SCAN;
+                        break;
+
+                case MFI_STATE_FLUSH_CACHE:
+                        max_wait = 20;
+                        cur_state = MFI_STATE_FLUSH_CACHE;
+                        break;
+
+                default:
+                        printk(KERN_DEBUG "megasas: Unknown state 0x%x\n",
+                               fw_state);
+                        return -ENODEV;
+                }
+
+                /*
+                 * The cur_state should not last for more than max_wait secs
+                 */
+                for (i = 0; i < (max_wait * 1000); i++) {
+                        fw_state = MFI_STATE_MASK &
+                            readl(&reg_set->outbound_msg_0);
+
+                        if (fw_state == cur_state) {
+                                msleep(1);
+                        } else
+                                break;
+                }
+
+                /*
+                 * Return error if fw_state hasn't changed after max_wait
+                 */
+                if (fw_state == cur_state) {
+                        printk(KERN_DEBUG "FW state [%d] hasn't changed "
+                               "in %d secs\n", fw_state, max_wait);
+                        return -ENODEV;
+                }
+        };
+
+        return 0;
+}
+
+/**
+ * megasas_teardown_frame_pool -        Destroy the cmd frame DMA pool
+ * @instance:                           Adapter soft state
+ */
+static void megasas_teardown_frame_pool(struct megasas_instance *instance)
+{
+        int i;
+        u32 max_cmd = instance->max_fw_cmds;
+        struct megasas_cmd *cmd;
+
+        if (!instance->frame_dma_pool)
+                return;
+
+        /*
+         * Return all frames to pool
+         */
+        for (i = 0; i < max_cmd; i++) {
+
+                cmd = instance->cmd_list[i];
+
+                if (cmd->frame)
+                        pci_pool_free(instance->frame_dma_pool, cmd->frame,
+                                      cmd->frame_phys_addr);
+
+                if (cmd->sense)
+                        pci_pool_free(instance->sense_dma_pool, cmd->frame,
+                                      cmd->sense_phys_addr);
+        }
+
+        /*
+         * Now destroy the pool itself
+         */
+        pci_pool_destroy(instance->frame_dma_pool);
+        pci_pool_destroy(instance->sense_dma_pool);
+
+        instance->frame_dma_pool = NULL;
+        instance->sense_dma_pool = NULL;
+}
+
+/**
+ * megasas_create_frame_pool -  Creates DMA pool for cmd frames
+ * @instance:                   Adapter soft state
+ *
+ * Each command packet has an embedded DMA memory buffer that is used for
+ * filling MFI frame and the SG list that immediately follows the frame. This
+ * function creates those DMA memory buffers for each command packet by using
+ * PCI pool facility.
+ */
+static int megasas_create_frame_pool(struct megasas_instance *instance)
+{
+        int i;
+        u32 max_cmd;
+        u32 sge_sz;
+        u32 sgl_sz;
+        u32 total_sz;
+        u32 frame_count;
+        struct megasas_cmd *cmd;
+
+        max_cmd = instance->max_fw_cmds;
+
+        /*
+         * Size of our frame is 64 bytes for MFI frame, followed by max SG
+         * elements and finally SCSI_SENSE_BUFFERSIZE bytes for sense buffer
+         */
+        sge_sz = (IS_DMA64) ? sizeof(struct megasas_sge64) :
+            sizeof(struct megasas_sge32);
+
+        /*
+         * Calculated the number of 64byte frames required for SGL
+         */
+        sgl_sz = sge_sz * instance->max_num_sge;
+        frame_count = (sgl_sz + MEGAMFI_FRAME_SIZE - 1) / MEGAMFI_FRAME_SIZE;
+
+        /*
+         * We need one extra frame for the MFI command
+         */
+        frame_count++;
+
+        total_sz = MEGAMFI_FRAME_SIZE * frame_count;
+        /*
+         * Use DMA pool facility provided by PCI layer
+         */
+        instance->frame_dma_pool = pci_pool_create("megasas frame pool",
+                                                   instance->pdev, total_sz, 64,
+                                                   0);
+
+        if (!instance->frame_dma_pool) {
+                printk(KERN_DEBUG "megasas: failed to setup frame pool\n");
+                return -ENOMEM;
+        }
+
+        instance->sense_dma_pool = pci_pool_create("megasas sense pool",
+                                                   instance->pdev, 128, 4, 0);
+
+        if (!instance->sense_dma_pool) {
+                printk(KERN_DEBUG "megasas: failed to setup sense pool\n");
+
+                pci_pool_destroy(instance->frame_dma_pool);
+                instance->frame_dma_pool = NULL;
+
+                return -ENOMEM;
+        }
+
+        /*
+         * Allocate and attach a frame to each of the commands in cmd_list.
+         * By making cmd->index as the context instead of the &cmd, we can
+         * always use 32bit context regardless of the architecture
+         */
+        for (i = 0; i < max_cmd; i++) {
+
+                cmd = instance->cmd_list[i];
+
+                cmd->frame = pci_pool_alloc(instance->frame_dma_pool,
+                                            GFP_KERNEL, &cmd->frame_phys_addr);
+
+                cmd->sense = pci_pool_alloc(instance->sense_dma_pool,
+                                            GFP_KERNEL, &cmd->sense_phys_addr);
+
+                /*
+                 * megasas_teardown_frame_pool() takes care of freeing
+                 * whatever has been allocated
+                 */
+                if (!cmd->frame || !cmd->sense) {
+                        printk(KERN_DEBUG "megasas: pci_pool_alloc failed \n");
+                        megasas_teardown_frame_pool(instance);
+                        return -ENOMEM;
+                }
+
+                cmd->frame->io.context = cmd->index;
+        }
+
+        return 0;
+}
+
+/**
+ * megasas_free_cmds -  Free all the cmds in the free cmd pool
+ * @instance:           Adapter soft state
+ */
+static void megasas_free_cmds(struct megasas_instance *instance)
+{
+        int i;
+        /* First free the MFI frame pool */
+        megasas_teardown_frame_pool(instance);
+
+        /* Free all the commands in the cmd_list */
+        for (i = 0; i < instance->max_fw_cmds; i++)
+                kfree(instance->cmd_list[i]);
+
+        /* Free the cmd_list buffer itself */
+        kfree(instance->cmd_list);
+        instance->cmd_list = NULL;
+
+        INIT_LIST_HEAD(&instance->cmd_pool);
+}
+
+/**
+ * megasas_alloc_cmds - Allocates the command packets
+ * @instance:           Adapter soft state
+ *
+ * Each command that is issued to the FW, whether IO commands from the OS or
+ * internal commands like IOCTLs, are wrapped in local data structure called
+ * megasas_cmd. The frame embedded in this megasas_cmd is actually issued to
+ * the FW.
+ *
+ * Each frame has a 32-bit field called context (tag). This context is used
+ * to get back the megasas_cmd from the frame when a frame gets completed in
+ * the ISR. Typically the address of the megasas_cmd itself would be used as
+ * the context. But we wanted to keep the differences between 32 and 64 bit
+ * systems to the mininum. We always use 32 bit integers for the context. In
+ * this driver, the 32 bit values are the indices into an array cmd_list.
+ * This array is used only to look up the megasas_cmd given the context. The
+ * free commands themselves are maintained in a linked list called cmd_pool.
+ */
+static int megasas_alloc_cmds(struct megasas_instance *instance)
+{
+        int i;
+        int j;
+        u32 max_cmd;
+        struct megasas_cmd *cmd;
+
+        max_cmd = instance->max_fw_cmds;
+
+        /*
+         * instance->cmd_list is an array of struct megasas_cmd pointers.
+         * Allocate the dynamic array first and then allocate individual
+         * commands.
+         */
+        instance->cmd_list = kmalloc(sizeof(struct megasas_cmd *) * max_cmd,
+                                     GFP_KERNEL);
+
+        if (!instance->cmd_list) {
+                printk(KERN_DEBUG "megasas: out of memory\n");
+                return -ENOMEM;
+        }
+
+        memset(instance->cmd_list, 0, sizeof(struct megasas_cmd *) * max_cmd);
+
+        for (i = 0; i < max_cmd; i++) {
+                instance->cmd_list[i] = kmalloc(sizeof(struct megasas_cmd),
+                                                GFP_KERNEL);
+
+                if (!instance->cmd_list[i]) {
+
+                        for (j = 0; j < i; j++)
+                                kfree(instance->cmd_list[j]);
+
+                        kfree(instance->cmd_list);
+                        instance->cmd_list = NULL;
+
+                        return -ENOMEM;
+                }
+        }
+
+        /*
+         * Add all the commands to command pool (instance->cmd_pool)
+         */
+        for (i = 0; i < max_cmd; i++) {
+                cmd = instance->cmd_list[i];
+                memset(cmd, 0, sizeof(struct megasas_cmd));
+                cmd->index = i;
+                cmd->instance = instance;
+
+                list_add_tail(&cmd->list, &instance->cmd_pool);
+        }
+
+        /*
+         * Create a frame pool and assign one frame to each cmd
+         */
+        if (megasas_create_frame_pool(instance)) {
+                printk(KERN_DEBUG "megasas: Error creating frame DMA pool\n");
+                megasas_free_cmds(instance);
+        }
+
+        return 0;
+}
+
+/**
+ * megasas_get_controller_info -        Returns FW's controller structure
+ * @instance:                           Adapter soft state
+ * @ctrl_info:                          Controller information structure
+ *
+ * Issues an internal command (DCMD) to get the FW's controller structure.
+ * This information is mainly used to find out the maximum IO transfer per
+ * command supported by the FW.
+ */
+static int
+megasas_get_ctrl_info(struct megasas_instance *instance,
+                      struct megasas_ctrl_info *ctrl_info)
+{
+        int ret = 0;
+        struct megasas_cmd *cmd;
+        struct megasas_dcmd_frame *dcmd;
+        struct megasas_ctrl_info *ci;
+        dma_addr_t ci_h = 0;
+
+        cmd = megasas_get_cmd(instance);
+
+        if (!cmd) {
+                printk(KERN_DEBUG "megasas: Failed to get a free cmd\n");
+                return -ENOMEM;
+        }
+
+        dcmd = &cmd->frame->dcmd;
+
+        ci = pci_alloc_consistent(instance->pdev,
+                                  sizeof(struct megasas_ctrl_info), &ci_h);
+
+        if (!ci) {
+                printk(KERN_DEBUG "Failed to alloc mem for ctrl info\n");
+                megasas_return_cmd(instance, cmd);
+                return -ENOMEM;
+        }
+
+        memset(ci, 0, sizeof(*ci));
+        memset(dcmd->mbox.b, 0, MFI_MBOX_SIZE);
+
+        dcmd->cmd = MFI_CMD_DCMD;
+        dcmd->cmd_status = 0xFF;
+        dcmd->sge_count = 1;
+        dcmd->flags = MFI_FRAME_DIR_READ;
+        dcmd->timeout = 0;
+        dcmd->data_xfer_len = sizeof(struct megasas_ctrl_info);
+        dcmd->opcode = MR_DCMD_CTRL_GET_INFO;
+        dcmd->sgl.sge32[0].phys_addr = ci_h;
+        dcmd->sgl.sge32[0].length = sizeof(struct megasas_ctrl_info);
+
+        if (!megasas_issue_polled(instance, cmd)) {
+                ret = 0;
+                memcpy(ctrl_info, ci, sizeof(struct megasas_ctrl_info));
+        } else {
+                ret = -1;
+        }
+
+        pci_free_consistent(instance->pdev, sizeof(struct megasas_ctrl_info),
+                            ci, ci_h);
+
+        megasas_return_cmd(instance, cmd);
+        return ret;
+}
+
+/**
+ * megasas_init_mfi -   Initializes the FW
+ * @instance:           Adapter soft state
+ *
+ * This is the main function for initializing MFI firmware.
+ */
+static int megasas_init_mfi(struct megasas_instance *instance)
+{
+        u32 context_sz;
+        u32 reply_q_sz;
+        u32 max_sectors_1;
+        u32 max_sectors_2;
+        struct megasas_register_set __iomem *reg_set;
+
+        struct megasas_cmd *cmd;
+        struct megasas_ctrl_info *ctrl_info;
+
+        struct megasas_init_frame *init_frame;
+        struct megasas_init_queue_info *initq_info;
+        dma_addr_t init_frame_h;
+        dma_addr_t initq_info_h;
+
+        /*
+         * Map the message registers
+         */
+        instance->base_addr = pci_resource_start(instance->pdev, 0);
+
+        if (pci_request_regions(instance->pdev, "megasas: LSI Logic")) {
+                printk(KERN_DEBUG "megasas: IO memory region busy!\n");
+                return -EBUSY;
+        }
+
+        instance->reg_set = ioremap_nocache(instance->base_addr, 8192);
+
+        if (!instance->reg_set) {
+                printk(KERN_DEBUG "megasas: Failed to map IO mem\n");
+                goto fail_ioremap;
+        }
+
+        reg_set = instance->reg_set;
+
+        /*
+         * We expect the FW state to be READY
+         */
+        if (megasas_transition_to_ready(instance->reg_set))
+                goto fail_ready_state;
+
+        /*
+         * Get various operational parameters from status register
+         */
+        instance->max_fw_cmds = readl(&reg_set->outbound_msg_0) & 0x00FFFF;
+        instance->max_num_sge = (readl(&reg_set->outbound_msg_0) & 0xFF0000) >>
+            0x10;
+        /*
+         * Create a pool of commands
+         */
+        if (megasas_alloc_cmds(instance))
+                goto fail_alloc_cmds;
+
+        /*
+         * Allocate memory for reply queue. Length of reply queue should
+         * be _one_ more than the maximum commands handled by the firmware.
+         *
+         * Note: When FW completes commands, it places corresponding contex
+         * values in this circular reply queue. This circular queue is a fairly
+         * typical producer-consumer queue. FW is the producer (of completed
+         * commands) and the driver is the consumer.
+         */
+        context_sz = sizeof(u32);
+        reply_q_sz = context_sz * (instance->max_fw_cmds + 1);
+
+        instance->reply_queue = pci_alloc_consistent(instance->pdev,
+                                                     reply_q_sz,
+                                                     &instance->reply_queue_h);
+
+        if (!instance->reply_queue) {
+                printk(KERN_DEBUG "megasas: Out of DMA mem for reply queue\n");
+                goto fail_reply_queue;
+        }
+
+        /*
+         * Prepare a init frame. Note the init frame points to queue info
+         * structure. Each frame has SGL allocated after first 64 bytes. For
+         * this frame - since we don't need any SGL - we use SGL's space as
+         * queue info structure
+         *
+         * We will not get a NULL command below. We just created the pool.
+         */
+        cmd = megasas_get_cmd(instance);
+
+        init_frame = (struct megasas_init_frame *)cmd->frame;
+        initq_info = (struct megasas_init_queue_info *)
+            ((unsigned long)init_frame + 64);
+
+        init_frame_h = cmd->frame_phys_addr;
+        initq_info_h = init_frame_h + 64;
+
+        memset(init_frame, 0, MEGAMFI_FRAME_SIZE);
+        memset(initq_info, 0, sizeof(struct megasas_init_queue_info));
+
+        initq_info->reply_queue_entries = instance->max_fw_cmds + 1;
+        initq_info->reply_queue_start_phys_addr_lo = instance->reply_queue_h;
+
+        initq_info->producer_index_phys_addr_lo = instance->producer_h;
+        initq_info->consumer_index_phys_addr_lo = instance->consumer_h;
+
+        init_frame->cmd = MFI_CMD_INIT;
+        init_frame->cmd_status = 0xFF;
+        init_frame->queue_info_new_phys_addr_lo = initq_info_h;
+
+        init_frame->data_xfer_len = sizeof(struct megasas_init_queue_info);
+
+        /*
+         * Issue the init frame in polled mode
+         */
+        if (megasas_issue_polled(instance, cmd)) {
+                printk(KERN_DEBUG "megasas: Failed to init firmware\n");
+                goto fail_fw_init;
+        }
+
+        megasas_return_cmd(instance, cmd);
+
+        ctrl_info = kmalloc(sizeof(struct megasas_ctrl_info), GFP_KERNEL);
+
+        /*
+         * Compute the max allowed sectors per IO: The controller info has two
+         * limits on max sectors. Driver should use the minimum of these two.
+         *
+         * 1 << stripe_sz_ops.min = max sectors per strip
+         *
+         * Note that older firmwares ( < FW ver 30) didn't report information
+         * to calculate max_sectors_1. So the number ended up as zero always.
+         */
+        if (ctrl_info && !megasas_get_ctrl_info(instance, ctrl_info)) {
+
+                max_sectors_1 = (1 << ctrl_info->stripe_sz_ops.min) *
+                    ctrl_info->max_strips_per_io;
+                max_sectors_2 = ctrl_info->max_request_size;
+
+                instance->max_sectors_per_req = (max_sectors_1 < max_sectors_2)
+                    ? max_sectors_1 : max_sectors_2;
+        } else
+                instance->max_sectors_per_req = instance->max_num_sge *
+                    PAGE_SIZE / 512;
+
+        kfree(ctrl_info);
+
+        return 0;
+
+      fail_fw_init:
+        megasas_return_cmd(instance, cmd);
+
+        pci_free_consistent(instance->pdev, reply_q_sz,
+                            instance->reply_queue, instance->reply_queue_h);
+      fail_reply_queue:
+        megasas_free_cmds(instance);
+
+      fail_alloc_cmds:
+      fail_ready_state:
+        iounmap(instance->reg_set);
+
+      fail_ioremap:
+        pci_release_regions(instance->pdev);
+
+        return -EINVAL;
+}
+
+/**
+ * megasas_release_mfi -        Reverses the FW initialization
+ * @intance:                    Adapter soft state
+ */
+static void megasas_release_mfi(struct megasas_instance *instance)
+{
+        u32 reply_q_sz = sizeof(u32) * (instance->max_fw_cmds + 1);
+
+        pci_free_consistent(instance->pdev, reply_q_sz,
+                            instance->reply_queue, instance->reply_queue_h);
+
+        megasas_free_cmds(instance);
+
+        iounmap(instance->reg_set);
+
+        pci_release_regions(instance->pdev);
+}
+
+/**
+ * megasas_get_seq_num -        Gets latest event sequence numbers
+ * @instance:                   Adapter soft state
+ * @eli:                        FW event log sequence numbers information
+ *
+ * FW maintains a log of all events in a non-volatile area. Upper layers would
+ * usually find out the latest sequence number of the events, the seq number at
+ * the boot etc. They would "read" all the events below the latest seq number
+ * by issuing a direct fw cmd (DCMD). For the future events (beyond latest seq
+ * number), they would subsribe to AEN (asynchronous event notification) and
+ * wait for the events to happen.
+ */
+static int
+megasas_get_seq_num(struct megasas_instance *instance,
+                    struct megasas_evt_log_info *eli)
+{
+        struct megasas_cmd *cmd;
+        struct megasas_dcmd_frame *dcmd;
+        struct megasas_evt_log_info *el_info;
+        dma_addr_t el_info_h = 0;
+
+        cmd = megasas_get_cmd(instance);
+
+        if (!cmd) {
+                return -ENOMEM;
+        }
+
+        dcmd = &cmd->frame->dcmd;
+        el_info = pci_alloc_consistent(instance->pdev,
+                                       sizeof(struct megasas_evt_log_info),
+                                       &el_info_h);
+
+        if (!el_info) {
+                megasas_return_cmd(instance, cmd);
+                return -ENOMEM;
+        }
+
+        memset(el_info, 0, sizeof(*el_info));
+        memset(dcmd->mbox.b, 0, MFI_MBOX_SIZE);
+
+        dcmd->cmd = MFI_CMD_DCMD;
+        dcmd->cmd_status = 0x0;
+        dcmd->sge_count = 1;
+        dcmd->flags = MFI_FRAME_DIR_READ;
+        dcmd->timeout = 0;
+        dcmd->data_xfer_len = sizeof(struct megasas_evt_log_info);
+        dcmd->opcode = MR_DCMD_CTRL_EVENT_GET_INFO;
+        dcmd->sgl.sge32[0].phys_addr = el_info_h;
+        dcmd->sgl.sge32[0].length = sizeof(struct megasas_evt_log_info);
+
+        megasas_issue_blocked_cmd(instance, cmd);
+
+        /*
+         * Copy the data back into callers buffer
+         */
+        memcpy(eli, el_info, sizeof(struct megasas_evt_log_info));
+
+        pci_free_consistent(instance->pdev, sizeof(struct megasas_evt_log_info),
+                            el_info, el_info_h);
+
+        megasas_return_cmd(instance, cmd);
+
+        return 0;
+}
+
+/**
+ * megasas_register_aen -       Registers for asynchronous event notification
+ * @instance:                   Adapter soft state
+ * @seq_num:                    The starting sequence number
+ * @class_locale:               Class of the event
+ *
+ * This function subscribes for AEN for events beyond the @seq_num. It requests
+ * to be notified if and only if the event is of type @class_locale
+ */
+static int
+megasas_register_aen(struct megasas_instance *instance, u32 seq_num,
+                     u32 class_locale_word)
+{
+        int ret_val;
+        struct megasas_cmd *cmd;
+        struct megasas_dcmd_frame *dcmd;
+        union megasas_evt_class_locale curr_aen;
+        union megasas_evt_class_locale prev_aen;
+
+        /*
+         * If there an AEN pending already (aen_cmd), check if the
+         * class_locale of that pending AEN is inclusive of the new
+         * AEN request we currently have. If it is, then we don't have
+         * to do anything. In other words, whichever events the current
+         * AEN request is subscribing to, have already been subscribed
+         * to.
+         *
+         * If the old_cmd is _not_ inclusive, then we have to abort
+         * that command, form a class_locale that is superset of both
+         * old and current and re-issue to the FW
+         */
+
+        curr_aen.word = class_locale_word;
+
+        if (instance->aen_cmd) {
+
+                prev_aen.word = instance->aen_cmd->frame->dcmd.mbox.w[1];
+
+                /*
+                 * A class whose enum value is smaller is inclusive of all
+                 * higher values. If a PROGRESS (= -1) was previously
+                 * registered, then a new registration requests for higher
+                 * classes need not be sent to FW. They are automatically
+                 * included.
+                 *
+                 * Locale numbers don't have such hierarchy. They are bitmap
+                 * values
+                 */
+                if ((prev_aen.members.class <= curr_aen.members.class) &&
+                    !((prev_aen.members.locale & curr_aen.members.locale) ^
+                      curr_aen.members.locale)) {
+                        /*
+                         * Previously issued event registration includes
+                         * current request. Nothing to do.
+                         */
+                        return 0;
+                } else {
+                        curr_aen.members.locale |= prev_aen.members.locale;
+
+                        if (prev_aen.members.class < curr_aen.members.class)
+                                curr_aen.members.class = prev_aen.members.class;
+
+                        instance->aen_cmd->abort_aen = 1;
+                        ret_val = megasas_issue_blocked_abort_cmd(instance,
+                                                                  instance->
+                                                                  aen_cmd);
+
+                        if (ret_val) {
+                                printk(KERN_DEBUG "megasas: Failed to abort "
+                                       "previous AEN command\n");
+                                return ret_val;
+                        }
+                }
+        }
+
+        cmd = megasas_get_cmd(instance);
+
+        if (!cmd)
+                return -ENOMEM;
+
+        dcmd = &cmd->frame->dcmd;
+
+        memset(instance->evt_detail, 0, sizeof(struct megasas_evt_detail));
+
+        /*
+         * Prepare DCMD for aen registration
+         */
+        memset(dcmd->mbox.b, 0, MFI_MBOX_SIZE);
+
+        dcmd->cmd = MFI_CMD_DCMD;
+        dcmd->cmd_status = 0x0;
+        dcmd->sge_count = 1;
+        dcmd->flags = MFI_FRAME_DIR_READ;
+        dcmd->timeout = 0;
+        dcmd->data_xfer_len = sizeof(struct megasas_evt_detail);
+        dcmd->opcode = MR_DCMD_CTRL_EVENT_WAIT;
+        dcmd->mbox.w[0] = seq_num;
+        dcmd->mbox.w[1] = curr_aen.word;
+        dcmd->sgl.sge32[0].phys_addr = (u32) instance->evt_detail_h;
+        dcmd->sgl.sge32[0].length = sizeof(struct megasas_evt_detail);
+
+        /*
+         * Store reference to the cmd used to register for AEN. When an
+         * application wants us to register for AEN, we have to abort this
+         * cmd and re-register with a new EVENT LOCALE supplied by that app
+         */
+        instance->aen_cmd = cmd;
+
+        /*
+         * Issue the aen registration frame
+         */
+        writel(cmd->frame_phys_addr >> 3,
+               &instance->reg_set->inbound_queue_port);
+
+        return 0;
+}
+
+/**
+ * megasas_start_aen -  Subscribes to AEN during driver load time
+ * @instance:           Adapter soft state
+ */
+static int megasas_start_aen(struct megasas_instance *instance)
+{
+        struct megasas_evt_log_info eli;
+        union megasas_evt_class_locale class_locale;
+
+        /*
+         * Get the latest sequence number from FW
+         */
+        memset(&eli, 0, sizeof(eli));
+
+        if (megasas_get_seq_num(instance, &eli))
+                return -1;
+
+        /*
+         * Register AEN with FW for latest sequence number plus 1
+         */
+        class_locale.members.reserved = 0;
+        class_locale.members.locale = MR_EVT_LOCALE_ALL;
+        class_locale.members.class = MR_EVT_CLASS_DEBUG;
+
+        return megasas_register_aen(instance, eli.newest_seq_num + 1,
+                                    class_locale.word);
+}
+
+/**
+ * megasas_io_attach -  Attaches this driver to SCSI mid-layer
+ * @instance:           Adapter soft state
+ */
+static int megasas_io_attach(struct megasas_instance *instance)
+{
+        struct Scsi_Host *host = instance->host;
+
+        /*
+         * Export parameters required by SCSI mid-layer
+         */
+        host->irq = instance->pdev->irq;
+        host->unique_id = instance->unique_id;
+        host->can_queue = instance->max_fw_cmds - MEGASAS_INT_CMDS;
+        host->this_id = instance->init_id;
+        host->sg_tablesize = instance->max_num_sge;
+        host->max_sectors = instance->max_sectors_per_req;
+        host->cmd_per_lun = 128;
+        host->max_channel = MEGASAS_MAX_CHANNELS - 1;
+        host->max_id = MEGASAS_MAX_DEV_PER_CHANNEL;
+        host->max_lun = MEGASAS_MAX_LUN;
+
+        /*
+         * Notify the mid-layer about the new controller
+         */
+        if (scsi_add_host(host, &instance->pdev->dev)) {
+                printk(KERN_DEBUG "megasas: scsi_add_host failed\n");
+                return -ENODEV;
+        }
+
+        /*
+         * Trigger SCSI to scan our drives
+         */
+        scsi_scan_host(host);
+        return 0;
+}
+
+/**
+ * megasas_probe_one -  PCI hotplug entry point
+ * @pdev:               PCI device structure
+ * @id:                 PCI ids of supported hotplugged adapter 
+ */
+static int __devinit
+megasas_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+{
+        int rval;
+        struct Scsi_Host *host;
+        struct megasas_instance *instance;
+
+        /*
+         * Announce PCI information
+         */
+        printk(KERN_INFO "megasas: %#4.04x:%#4.04x:%#4.04x:%#4.04x: ",
+               pdev->vendor, pdev->device, pdev->subsystem_vendor,
+               pdev->subsystem_device);
+
+        printk("bus %d:slot %d:func %d\n",
+               pdev->bus->number, PCI_SLOT(pdev->devfn), PCI_FUNC(pdev->devfn));
+
+        /*
+         * PCI prepping: enable device set bus mastering and dma mask
+         */
+        rval = pci_enable_device(pdev);
+
+        if (rval) {
+                return rval;
+        }
+
+        pci_set_master(pdev);
+
+        /*
+         * All our contollers are capable of performing 64-bit DMA
+         */
+        if (IS_DMA64) {
+                if (pci_set_dma_mask(pdev, DMA_64BIT_MASK) != 0) {
+
+                        if (pci_set_dma_mask(pdev, DMA_32BIT_MASK) != 0)
+                                goto fail_set_dma_mask;
+                }
+        } else {
+                if (pci_set_dma_mask(pdev, DMA_32BIT_MASK) != 0)
+                        goto fail_set_dma_mask;
+        }
+
+        host = scsi_host_alloc(&megasas_template,
+                               sizeof(struct megasas_instance));
+
+        if (!host) {
+                printk(KERN_DEBUG "megasas: scsi_host_alloc failed\n");
+                goto fail_alloc_instance;
+        }
+
+        instance = (struct megasas_instance *)host->hostdata;
+        memset(instance, 0, sizeof(*instance));
+
+        instance->producer = pci_alloc_consistent(pdev, sizeof(u32),
+                                                  &instance->producer_h);
+        instance->consumer = pci_alloc_consistent(pdev, sizeof(u32),
+                                                  &instance->consumer_h);
+
+        if (!instance->producer || !instance->consumer) {
+                printk(KERN_DEBUG "megasas: Failed to allocate memory for "
+                       "producer, consumer\n");
+                goto fail_alloc_dma_buf;
+        }
+
+        *instance->producer = 0;
+        *instance->consumer = 0;
+
+        instance->evt_detail = pci_alloc_consistent(pdev,
+                                                    sizeof(struct
+                                                           megasas_evt_detail),
+                                                    &instance->evt_detail_h);
+
+        if (!instance->evt_detail) {
+                printk(KERN_DEBUG "megasas: Failed to allocate memory for "
+                       "event detail structure\n");
+                goto fail_alloc_dma_buf;
+        }
+
+        /*
+         * Initialize locks and queues
+         */
+        INIT_LIST_HEAD(&instance->cmd_pool);
+
+        init_waitqueue_head(&instance->int_cmd_wait_q);
+        init_waitqueue_head(&instance->abort_cmd_wait_q);
+
+        spin_lock_init(&instance->cmd_pool_lock);
+        spin_lock_init(&instance->instance_lock);
+
+        sema_init(&instance->aen_mutex, 1);
+        sema_init(&instance->ioctl_sem, MEGASAS_INT_CMDS);
+
+        /*
+         * Initialize PCI related and misc parameters
+         */
+        instance->pdev = pdev;
+        instance->host = host;
+        instance->unique_id = pdev->bus->number << 8 | pdev->devfn;
+        instance->init_id = MEGASAS_DEFAULT_INIT_ID;
+
+        /*
+         * Initialize MFI Firmware
+         */
+        if (megasas_init_mfi(instance))
+                goto fail_init_mfi;
+
+        /*
+         * Register IRQ
+         */
+        if (request_irq(pdev->irq, megasas_isr, SA_SHIRQ, "megasas", instance)) {
+                printk(KERN_DEBUG "megasas: Failed to register IRQ\n");
+                goto fail_irq;
+        }
+
+        megasas_enable_intr(instance->reg_set);
+
+        /*
+         * Store instance in PCI softstate
+         */
+        pci_set_drvdata(pdev, instance);
+
+        /*
+         * Add this controller to megasas_mgmt_info structure so that it
+         * can be exported to management applications
+         */
+        megasas_mgmt_info.count++;
+        megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = instance;
+        megasas_mgmt_info.max_index++;
+
+        /*
+         * Initiate AEN (Asynchronous Event Notification)
+         */
+        if (megasas_start_aen(instance)) {
+                printk(KERN_DEBUG "megasas: start aen failed\n");
+                goto fail_start_aen;
+        }
+
+        /*
+         * Register with SCSI mid-layer
+         */
+        if (megasas_io_attach(instance))
+                goto fail_io_attach;
+
+        return 0;
+
+      fail_start_aen:
+      fail_io_attach:
+        megasas_mgmt_info.count--;
+        megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL;
+        megasas_mgmt_info.max_index--;
+
+        pci_set_drvdata(pdev, NULL);
+        megasas_disable_intr(instance->reg_set);
+        free_irq(instance->pdev->irq, instance);
+
+        megasas_release_mfi(instance);
+
+      fail_irq:
+      fail_init_mfi:
+      fail_alloc_dma_buf:
+        if (instance->evt_detail)
+                pci_free_consistent(pdev, sizeof(struct megasas_evt_detail),
+                                    instance->evt_detail,
+                                    instance->evt_detail_h);
+
+        if (instance->producer)
+                pci_free_consistent(pdev, sizeof(u32), instance->producer,
+                                    instance->producer_h);
+        if (instance->consumer)
+                pci_free_consistent(pdev, sizeof(u32), instance->consumer,
+                                    instance->consumer_h);
+        scsi_host_put(host);
+
+      fail_alloc_instance:
+      fail_set_dma_mask:
+        pci_disable_device(pdev);
+
+        return -ENODEV;
+}
+
+/**
+ * megasas_flush_cache -        Requests FW to flush all its caches
+ * @instance:                   Adapter soft state
+ */
+static void megasas_flush_cache(struct megasas_instance *instance)
+{
+        struct megasas_cmd *cmd;
+        struct megasas_dcmd_frame *dcmd;
+
+        cmd = megasas_get_cmd(instance);
+
+        if (!cmd)
+                return;
+
+        dcmd = &cmd->frame->dcmd;
+
+        memset(dcmd->mbox.b, 0, MFI_MBOX_SIZE);
+
+        dcmd->cmd = MFI_CMD_DCMD;
+        dcmd->cmd_status = 0x0;
+        dcmd->sge_count = 0;
+        dcmd->flags = MFI_FRAME_DIR_NONE;
+        dcmd->timeout = 0;
+        dcmd->data_xfer_len = 0;
+        dcmd->opcode = MR_DCMD_CTRL_CACHE_FLUSH;
+        dcmd->mbox.b[0] = MR_FLUSH_CTRL_CACHE | MR_FLUSH_DISK_CACHE;
+
+        megasas_issue_blocked_cmd(instance, cmd);
+
+        megasas_return_cmd(instance, cmd);
+
+        return;
+}
+
+/**
+ * megasas_shutdown_controller -        Instructs FW to shutdown the controller
+ * @instance:                           Adapter soft state
+ */
+static void megasas_shutdown_controller(struct megasas_instance *instance)
+{
+        struct megasas_cmd *cmd;
+        struct megasas_dcmd_frame *dcmd;
+
+        cmd = megasas_get_cmd(instance);
+
+        if (!cmd)
+                return;
+
+        if (instance->aen_cmd)
+                megasas_issue_blocked_abort_cmd(instance, instance->aen_cmd);
+
+        dcmd = &cmd->frame->dcmd;
+
+        memset(dcmd->mbox.b, 0, MFI_MBOX_SIZE);
+
+        dcmd->cmd = MFI_CMD_DCMD;
+        dcmd->cmd_status = 0x0;
+        dcmd->sge_count = 0;
+        dcmd->flags = MFI_FRAME_DIR_NONE;
+        dcmd->timeout = 0;
+        dcmd->data_xfer_len = 0;
+        dcmd->opcode = MR_DCMD_CTRL_SHUTDOWN;
+
+        megasas_issue_blocked_cmd(instance, cmd);
+
+        megasas_return_cmd(instance, cmd);
+
+        return;
+}
+
+/**
+ * megasas_detach_one - PCI hot"un"plug entry point
+ * @pdev:               PCI device structure
+ */
+static void megasas_detach_one(struct pci_dev *pdev)
+{
+        int i;
+        struct Scsi_Host *host;
+        struct megasas_instance *instance;
+
+        instance = pci_get_drvdata(pdev);
+        host = instance->host;
+
+        scsi_remove_host(instance->host);
+        megasas_flush_cache(instance);
+        megasas_shutdown_controller(instance);
+
+        /*
+         * Take the instance off the instance array. Note that we will not
+         * decrement the max_index. We let this array be sparse array
+         */
+        for (i = 0; i < megasas_mgmt_info.max_index; i++) {
+                if (megasas_mgmt_info.instance[i] == instance) {
+                        megasas_mgmt_info.count--;
+                        megasas_mgmt_info.instance[i] = NULL;
+
+                        break;
+                }
+        }
+
+        pci_set_drvdata(instance->pdev, NULL);
+
+        megasas_disable_intr(instance->reg_set);
+
+        free_irq(instance->pdev->irq, instance);
+
+        megasas_release_mfi(instance);
+
+        pci_free_consistent(pdev, sizeof(struct megasas_evt_detail),
+                            instance->evt_detail, instance->evt_detail_h);
+
+        pci_free_consistent(pdev, sizeof(u32), instance->producer,
+                            instance->producer_h);
+
+        pci_free_consistent(pdev, sizeof(u32), instance->consumer,
+                            instance->consumer_h);
+
+        scsi_host_put(host);
+
+        pci_set_drvdata(pdev, NULL);
+
+        pci_disable_device(pdev);
+
+        return;
+}
+
+/**
+ * megasas_shutdown -   Shutdown entry point
+ * @device:             Generic device structure
+ */
+static void megasas_shutdown(struct pci_dev *pdev)
+{
+        struct megasas_instance *instance = pci_get_drvdata(pdev);
+        megasas_flush_cache(instance);
+}
+
+/**
+ * megasas_mgmt_open -  char node "open" entry point
+ */
+static int megasas_mgmt_open(struct inode *inode, struct file *filep)
+{
+        /*
+         * Allow only those users with admin rights
+         */
+        if (!capable(CAP_SYS_ADMIN))
+                return -EACCES;
+
+        return 0;
+}
+
+/**
+ * megasas_mgmt_release - char node "release" entry point
+ */
+static int megasas_mgmt_release(struct inode *inode, struct file *filep)
+{
+        filep->private_data = NULL;
+        fasync_helper(-1, filep, 0, &megasas_async_queue);
+
+        return 0;
+}
+
+/**
+ * megasas_mgmt_fasync -        Async notifier registration from applications
+ *
+ * This function adds the calling process to a driver global queue. When an
+ * event occurs, SIGIO will be sent to all processes in this queue.
+ */
+static int megasas_mgmt_fasync(int fd, struct file *filep, int mode)
+{
+        int rc;
+
+        down(&megasas_async_queue_mutex);
+
+        rc = fasync_helper(fd, filep, mode, &megasas_async_queue);
+
+        up(&megasas_async_queue_mutex);
+
+        if (rc >= 0) {
+                /* For sanity check when we get ioctl */
+                filep->private_data = filep;
+                return 0;
+        }
+
+        printk(KERN_DEBUG "megasas: fasync_helper failed [%d]\n", rc);
+
+        return rc;
+}
+
+/**
+ * megasas_mgmt_fw_ioctl -      Issues management ioctls to FW
+ * @instance:                   Adapter soft state
+ * @argp:                       User's ioctl packet
+ */
+static int
+megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
+                      struct megasas_iocpacket __user * user_ioc,
+                      struct megasas_iocpacket *ioc)
+{
+        struct megasas_sge32 *kern_sge32;
+        struct megasas_cmd *cmd;
+        void *kbuff_arr[MAX_IOCTL_SGE];
+        dma_addr_t buf_handle = 0;
+        int error = 0, i;
+        void *sense = NULL;
+        dma_addr_t sense_handle;
+        u32 *sense_ptr;
+
+        memset(kbuff_arr, 0, sizeof(kbuff_arr));
+
+        if (ioc->sge_count > MAX_IOCTL_SGE) {
+                printk(KERN_DEBUG "megasas: SGE count [%d] >  max limit [%d]\n",
+                       ioc->sge_count, MAX_IOCTL_SGE);
+                return -EINVAL;
+        }
+
+        cmd = megasas_get_cmd(instance);
+        if (!cmd) {
+                printk(KERN_DEBUG "megasas: Failed to get a cmd packet\n");
+                return -ENOMEM;
+        }
+
+        /*
+         * User's IOCTL packet has 2 frames (maximum). Copy those two
+         * frames into our cmd's frames. cmd->frame's context will get
+         * overwritten when we copy from user's frames. So set that value
+         * alone separately
+         */
+        memcpy(cmd->frame, ioc->frame.raw, 2 * MEGAMFI_FRAME_SIZE);
+        cmd->frame->hdr.context = cmd->index;
+
+        /*
+         * The management interface between applications and the fw uses
+         * MFI frames. E.g, RAID configuration changes, LD property changes
+         * etc are accomplishes through different kinds of MFI frames. The
+         * driver needs to care only about substituting user buffers with
+         * kernel buffers in SGLs. The location of SGL is embedded in the
+         * struct iocpacket itself.
+         */
+        kern_sge32 = (struct megasas_sge32 *)
+            ((unsigned long)cmd->frame + ioc->sgl_off);
+
+        /*
+         * For each user buffer, create a mirror buffer and copy in
+         */
+        for (i = 0; i < ioc->sge_count; i++) {
+                kbuff_arr[i] = pci_alloc_consistent(instance->pdev,
+                                                    ioc->sgl[i].iov_len,
+                                                    &buf_handle);
+                if (!kbuff_arr[i]) {
+                        printk(KERN_DEBUG "megasas: Failed to alloc "
+                               "kernel SGL buffer for IOCTL \n");
+                        error = -ENOMEM;
+                        goto out;
+                }
+
+                /*
+                 * We don't change the dma_coherent_mask, so
+                 * pci_alloc_consistent only returns 32bit addresses
+                 */
+                kern_sge32[i].phys_addr = (u32) buf_handle;
+                kern_sge32[i].length = ioc->sgl[i].iov_len;
+
+                /*
+                 * We created a kernel buffer corresponding to the
+                 * user buffer. Now copy in from the user buffer
+                 */
+                if (copy_from_user(kbuff_arr[i], ioc->sgl[i].iov_base,
+                                   (u32) (ioc->sgl[i].iov_len))) {
+                        error = -EFAULT;
+                        goto out;
+                }
+        }
+
+        if (ioc->sense_len) {
+                sense = pci_alloc_consistent(instance->pdev, ioc->sense_len,
+                                             &sense_handle);
+                if (!sense) {
+                        error = -ENOMEM;
+                        goto out;
+                }
+
+                sense_ptr =
+                    (u32 *) ((unsigned long)cmd->frame + ioc->sense_off);
+                *sense_ptr = sense_handle;
+        }
+
+        /*
+         * Set the sync_cmd flag so that the ISR knows not to complete this
+         * cmd to the SCSI mid-layer
+         */
+        cmd->sync_cmd = 1;
+        megasas_issue_blocked_cmd(instance, cmd);
+        cmd->sync_cmd = 0;
+
+        /*
+         * copy out the kernel buffers to user buffers
+         */
+        for (i = 0; i < ioc->sge_count; i++) {
+                if (copy_to_user(ioc->sgl[i].iov_base, kbuff_arr[i],
+                                 ioc->sgl[i].iov_len)) {
+                        error = -EFAULT;
+                        goto out;
+                }
+        }
+
+        /*
+         * copy out the sense
+         */
+        if (ioc->sense_len) {
+                /*
+                 * sense_ptr points to the location that has the user
+                 * sense buffer address
+                 */
+                sense_ptr = (u32 *) ((unsigned long)ioc->frame.raw +
+                                     ioc->sense_off);
+
+                if (copy_to_user((void __user *)((unsigned long)(*sense_ptr)),
+                                 sense, ioc->sense_len)) {
+                        error = -EFAULT;
+                        goto out;
+                }
+        }
+
+        /*
+         * copy the status codes returned by the fw
+         */
+        if (copy_to_user(&user_ioc->frame.hdr.cmd_status,
+                         &cmd->frame->hdr.cmd_status, sizeof(u8))) {
+                printk(KERN_DEBUG "megasas: Error copying out cmd_status\n");
+                error = -EFAULT;
+        }
+
+      out:
+        if (sense) {
+                pci_free_consistent(instance->pdev, ioc->sense_len,
+                                    sense, sense_handle);
+        }
+
+        for (i = 0; i < ioc->sge_count && kbuff_arr[i]; i++) {
+                pci_free_consistent(instance->pdev,
+                                    kern_sge32[i].length,
+                                    kbuff_arr[i], kern_sge32[i].phys_addr);
+        }
+
+        megasas_return_cmd(instance, cmd);
+        return error;
+}
+
+static struct megasas_instance *megasas_lookup_instance(u16 host_no)
+{
+        int i;
+
+        for (i = 0; i < megasas_mgmt_info.max_index; i++) {
+
+                if ((megasas_mgmt_info.instance[i]) &&
+                    (megasas_mgmt_info.instance[i]->host->host_no == host_no))
+                        return megasas_mgmt_info.instance[i];
+        }
+
+        return NULL;
+}
+
+static int megasas_mgmt_ioctl_fw(struct file *file, unsigned long arg)
+{
+        struct megasas_iocpacket __user *user_ioc =
+            (struct megasas_iocpacket __user *)arg;
+        struct megasas_iocpacket *ioc;
+        struct megasas_instance *instance;
+        int error;
+
+        ioc = kmalloc(sizeof(*ioc), GFP_KERNEL);
+        if (!ioc)
+                return -ENOMEM;
+
+        if (copy_from_user(ioc, user_ioc, sizeof(*ioc))) {
+                error = -EFAULT;
+                goto out_kfree_ioc;
+        }
+
+        instance = megasas_lookup_instance(ioc->host_no);
+        if (!instance) {
+                error = -ENODEV;
+                goto out_kfree_ioc;
+        }
+
+        /*
+         * We will allow only MEGASAS_INT_CMDS number of parallel ioctl cmds
+         */
+        if (down_interruptible(&instance->ioctl_sem)) {
+                error = -ERESTARTSYS;
+                goto out_kfree_ioc;
+        }
+        error = megasas_mgmt_fw_ioctl(instance, user_ioc, ioc);
+        up(&instance->ioctl_sem);
+
+      out_kfree_ioc:
+        kfree(ioc);
+        return error;
+}
+
+static int megasas_mgmt_ioctl_aen(struct file *file, unsigned long arg)
+{
+        struct megasas_instance *instance;
+        struct megasas_aen aen;
+        int error;
+
+        if (file->private_data != file) {
+                printk(KERN_DEBUG "megasas: fasync_helper was not "
+                       "called first\n");
+                return -EINVAL;
+        }
+
+        if (copy_from_user(&aen, (void __user *)arg, sizeof(aen)))
+                return -EFAULT;
+
+        instance = megasas_lookup_instance(aen.host_no);
+
+        if (!instance)
+                return -ENODEV;
+
+        down(&instance->aen_mutex);
+        error = megasas_register_aen(instance, aen.seq_num,
+                                     aen.class_locale_word);
+        up(&instance->aen_mutex);
+        return error;
+}
+
+/**
+ * megasas_mgmt_ioctl - char node ioctl entry point
+ */
+static long
+megasas_mgmt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        switch (cmd) {
+        case MEGASAS_IOC_FIRMWARE:
+                return megasas_mgmt_ioctl_fw(file, arg);
+
+        case MEGASAS_IOC_GET_AEN:
+                return megasas_mgmt_ioctl_aen(file, arg);
+        }
+
+        return -ENOTTY;
+}
+
+#ifdef CONFIG_COMPAT
+static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
+{
+        struct compat_megasas_iocpacket __user *cioc =
+            (struct compat_megasas_iocpacket __user *)arg;
+        struct megasas_iocpacket __user *ioc =
+            compat_alloc_user_space(sizeof(struct megasas_iocpacket));
+        int i;
+        int error = 0;
+
+        clear_user(ioc, sizeof(*ioc));
+
+        if (copy_in_user(&ioc->host_no, &cioc->host_no, sizeof(u16)) ||
+            copy_in_user(&ioc->sgl_off, &cioc->sgl_off, sizeof(u32)) ||
+            copy_in_user(&ioc->sense_off, &cioc->sense_off, sizeof(u32)) ||
+            copy_in_user(&ioc->sense_len, &cioc->sense_len, sizeof(u32)) ||
+            copy_in_user(ioc->frame.raw, cioc->frame.raw, 128) ||
+            copy_in_user(&ioc->sge_count, &cioc->sge_count, sizeof(u32)))
+                return -EFAULT;
+
+        for (i = 0; i < MAX_IOCTL_SGE; i++) {
+                compat_uptr_t ptr;
+
+                if (get_user(ptr, &cioc->sgl[i].iov_base) ||
+                    put_user(compat_ptr(ptr), &ioc->sgl[i].iov_base) ||
+                    copy_in_user(&ioc->sgl[i].iov_len,
+                                 &cioc->sgl[i].iov_len, sizeof(compat_size_t)))
+                        return -EFAULT;
+        }
+
+        error = megasas_mgmt_ioctl_fw(file, (unsigned long)ioc);
+
+        if (copy_in_user(&cioc->frame.hdr.cmd_status,
+                         &ioc->frame.hdr.cmd_status, sizeof(u8))) {
+                printk(KERN_DEBUG "megasas: error copy_in_user cmd_status\n");
+                return -EFAULT;
+        }
+        return error;
+}
+
+static long
+megasas_mgmt_compat_ioctl(struct file *file, unsigned int cmd,
+                          unsigned long arg)
+{
+        switch (cmd) {
+        case MEGASAS_IOC_FIRMWARE:{
+                        return megasas_mgmt_compat_ioctl_fw(file, arg);
+                }
+        case MEGASAS_IOC_GET_AEN:
+                return megasas_mgmt_ioctl_aen(file, arg);
+        }
+
+        return -ENOTTY;
+}
+#endif
+
+/*
+ * File operations structure for management interface
+ */
+static struct file_operations megasas_mgmt_fops = {
+        .owner = THIS_MODULE,
+        .open = megasas_mgmt_open,
+        .release = megasas_mgmt_release,
+        .fasync = megasas_mgmt_fasync,
+        .unlocked_ioctl = megasas_mgmt_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = megasas_mgmt_compat_ioctl,
+#endif
+};
+
+/*
+ * PCI hotplug support registration structure
+ */
+static struct pci_driver megasas_pci_driver = {
+
+        .name = "megaraid_sas",
+        .id_table = megasas_pci_table,
+        .probe = megasas_probe_one,
+        .remove = __devexit_p(megasas_detach_one),
+        .shutdown = megasas_shutdown,
+};
+
+/*
+ * Sysfs driver attributes
+ */
+static ssize_t megasas_sysfs_show_version(struct device_driver *dd, char *buf)
+{
+        return snprintf(buf, strlen(MEGASAS_VERSION) + 2, "%s\n",
+                        MEGASAS_VERSION);
+}
+
+static DRIVER_ATTR(version, S_IRUGO, megasas_sysfs_show_version, NULL);
+
+static ssize_t
+megasas_sysfs_show_release_date(struct device_driver *dd, char *buf)
+{
+        return snprintf(buf, strlen(MEGASAS_RELDATE) + 2, "%s\n",
+                        MEGASAS_RELDATE);
+}
+
+static DRIVER_ATTR(release_date, S_IRUGO, megasas_sysfs_show_release_date,
+                   NULL);
+
+/**
+ * megasas_init - Driver load entry point
+ */
+static int __init megasas_init(void)
+{
+        int rval;
+
+        /*
+         * Announce driver version and other information
+         */
+        printk(KERN_INFO "megasas: %s %s\n", MEGASAS_VERSION,
+               MEGASAS_EXT_VERSION);
+
+        memset(&megasas_mgmt_info, 0, sizeof(megasas_mgmt_info));
+
+        /*
+         * Register character device node
+         */
+        rval = register_chrdev(0, "megaraid_sas_ioctl", &megasas_mgmt_fops);
+
+        if (rval < 0) {
+                printk(KERN_DEBUG "megasas: failed to open device node\n");
+                return rval;
+        }
+
+        megasas_mgmt_majorno = rval;
+
+        /*
+         * Register ourselves as PCI hotplug module
+         */
+        rval = pci_module_init(&megasas_pci_driver);
+
+        if (rval) {
+                printk(KERN_DEBUG "megasas: PCI hotplug regisration failed \n");
+                unregister_chrdev(megasas_mgmt_majorno, "megaraid_sas_ioctl");
+        }
+
+        driver_create_file(&megasas_pci_driver.driver, &driver_attr_version);
+        driver_create_file(&megasas_pci_driver.driver,
+                           &driver_attr_release_date);
+
+        return rval;
+}
+
+/**
+ * megasas_exit - Driver unload entry point
+ */
+static void __exit megasas_exit(void)
+{
+        driver_remove_file(&megasas_pci_driver.driver, &driver_attr_version);
+        driver_remove_file(&megasas_pci_driver.driver,
+                           &driver_attr_release_date);
+
+        pci_unregister_driver(&megasas_pci_driver);
+        unregister_chrdev(megasas_mgmt_majorno, "megaraid_sas_ioctl");
+}
+
+module_init(megasas_init);
+module_exit(megasas_exit);
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
new file mode 100644
index 000000000000..eaec9d531424
--- /dev/null
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -0,0 +1,1142 @@
+/*
+ *
+ *              Linux MegaRAID driver for SAS based RAID controllers
+ *
+ * Copyright (c) 2003-2005  LSI Logic Corporation.
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ *
+ * FILE         : megaraid_sas.h
+ */
+
+#ifndef LSI_MEGARAID_SAS_H
+#define LSI_MEGARAID_SAS_H
+
+/**
+ * MegaRAID SAS Driver meta data
+ */
+#define MEGASAS_VERSION                         "00.00.02.00-rc4"
+#define MEGASAS_RELDATE                         "Sep 16, 2005"
+#define MEGASAS_EXT_VERSION                     "Fri Sep 16 12:37:08 EDT 2005"
+
+/*
+ * =====================================
+ * MegaRAID SAS MFI firmware definitions
+ * =====================================
+ */
+
+/*
+ * MFI stands for  MegaRAID SAS FW Interface. This is just a moniker for 
+ * protocol between the software and firmware. Commands are issued using
+ * "message frames"
+ */
+
+/**
+ * FW posts its state in upper 4 bits of outbound_msg_0 register
+ */
+#define MFI_STATE_MASK                          0xF0000000
+#define MFI_STATE_UNDEFINED                     0x00000000
+#define MFI_STATE_BB_INIT                       0x10000000
+#define MFI_STATE_FW_INIT                       0x40000000
+#define MFI_STATE_WAIT_HANDSHAKE                0x60000000
+#define MFI_STATE_FW_INIT_2                     0x70000000
+#define MFI_STATE_DEVICE_SCAN                   0x80000000
+#define MFI_STATE_FLUSH_CACHE                   0xA0000000
+#define MFI_STATE_READY                         0xB0000000
+#define MFI_STATE_OPERATIONAL                   0xC0000000
+#define MFI_STATE_FAULT                         0xF0000000
+
+#define MEGAMFI_FRAME_SIZE                      64
+
+/**
+ * During FW init, clear pending cmds & reset state using inbound_msg_0
+ *
+ * ABORT        : Abort all pending cmds
+ * READY        : Move from OPERATIONAL to READY state; discard queue info
+ * MFIMODE      : Discard (possible) low MFA posted in 64-bit mode (??)
+ * CLR_HANDSHAKE: FW is waiting for HANDSHAKE from BIOS or Driver
+ */
+#define MFI_INIT_ABORT                          0x00000000
+#define MFI_INIT_READY                          0x00000002
+#define MFI_INIT_MFIMODE                        0x00000004
+#define MFI_INIT_CLEAR_HANDSHAKE                0x00000008
+#define MFI_RESET_FLAGS                         MFI_INIT_READY|MFI_INIT_MFIMODE
+
+/**
+ * MFI frame flags
+ */
+#define MFI_FRAME_POST_IN_REPLY_QUEUE           0x0000
+#define MFI_FRAME_DONT_POST_IN_REPLY_QUEUE      0x0001
+#define MFI_FRAME_SGL32                         0x0000
+#define MFI_FRAME_SGL64                         0x0002
+#define MFI_FRAME_SENSE32                       0x0000
+#define MFI_FRAME_SENSE64                       0x0004
+#define MFI_FRAME_DIR_NONE                      0x0000
+#define MFI_FRAME_DIR_WRITE                     0x0008
+#define MFI_FRAME_DIR_READ                      0x0010
+#define MFI_FRAME_DIR_BOTH                      0x0018
+
+/**
+ * Definition for cmd_status
+ */
+#define MFI_CMD_STATUS_POLL_MODE                0xFF
+
+/**
+ * MFI command opcodes
+ */
+#define MFI_CMD_INIT                            0x00
+#define MFI_CMD_LD_READ                         0x01
+#define MFI_CMD_LD_WRITE                        0x02
+#define MFI_CMD_LD_SCSI_IO                      0x03
+#define MFI_CMD_PD_SCSI_IO                      0x04
+#define MFI_CMD_DCMD                            0x05
+#define MFI_CMD_ABORT                           0x06
+#define MFI_CMD_SMP                             0x07
+#define MFI_CMD_STP                             0x08
+
+#define MR_DCMD_CTRL_GET_INFO                   0x01010000
+
+#define MR_DCMD_CTRL_CACHE_FLUSH                0x01101000
+#define MR_FLUSH_CTRL_CACHE                     0x01
+#define MR_FLUSH_DISK_CACHE                     0x02
+
+#define MR_DCMD_CTRL_SHUTDOWN                   0x01050000
+#define MR_ENABLE_DRIVE_SPINDOWN                0x01
+
+#define MR_DCMD_CTRL_EVENT_GET_INFO             0x01040100
+#define MR_DCMD_CTRL_EVENT_GET                  0x01040300
+#define MR_DCMD_CTRL_EVENT_WAIT                 0x01040500
+#define MR_DCMD_LD_GET_PROPERTIES               0x03030000
+
+#define MR_DCMD_CLUSTER                         0x08000000
+#define MR_DCMD_CLUSTER_RESET_ALL               0x08010100
+#define MR_DCMD_CLUSTER_RESET_LD                0x08010200
+
+/**
+ * MFI command completion codes
+ */
+enum MFI_STAT {
+        MFI_STAT_OK = 0x00,
+        MFI_STAT_INVALID_CMD = 0x01,
+        MFI_STAT_INVALID_DCMD = 0x02,
+        MFI_STAT_INVALID_PARAMETER = 0x03,
+        MFI_STAT_INVALID_SEQUENCE_NUMBER = 0x04,
+        MFI_STAT_ABORT_NOT_POSSIBLE = 0x05,
+        MFI_STAT_APP_HOST_CODE_NOT_FOUND = 0x06,
+        MFI_STAT_APP_IN_USE = 0x07,
+        MFI_STAT_APP_NOT_INITIALIZED = 0x08,
+        MFI_STAT_ARRAY_INDEX_INVALID = 0x09,
+        MFI_STAT_ARRAY_ROW_NOT_EMPTY = 0x0a,
+        MFI_STAT_CONFIG_RESOURCE_CONFLICT = 0x0b,
+        MFI_STAT_DEVICE_NOT_FOUND = 0x0c,
+        MFI_STAT_DRIVE_TOO_SMALL = 0x0d,
+        MFI_STAT_FLASH_ALLOC_FAIL = 0x0e,
+        MFI_STAT_FLASH_BUSY = 0x0f,
+        MFI_STAT_FLASH_ERROR = 0x10,
+        MFI_STAT_FLASH_IMAGE_BAD = 0x11,
+        MFI_STAT_FLASH_IMAGE_INCOMPLETE = 0x12,
+        MFI_STAT_FLASH_NOT_OPEN = 0x13,
+        MFI_STAT_FLASH_NOT_STARTED = 0x14,
+        MFI_STAT_FLUSH_FAILED = 0x15,
+        MFI_STAT_HOST_CODE_NOT_FOUNT = 0x16,
+        MFI_STAT_LD_CC_IN_PROGRESS = 0x17,
+        MFI_STAT_LD_INIT_IN_PROGRESS = 0x18,
+        MFI_STAT_LD_LBA_OUT_OF_RANGE = 0x19,
+        MFI_STAT_LD_MAX_CONFIGURED = 0x1a,
+        MFI_STAT_LD_NOT_OPTIMAL = 0x1b,
+        MFI_STAT_LD_RBLD_IN_PROGRESS = 0x1c,
+        MFI_STAT_LD_RECON_IN_PROGRESS = 0x1d,
+        MFI_STAT_LD_WRONG_RAID_LEVEL = 0x1e,
+        MFI_STAT_MAX_SPARES_EXCEEDED = 0x1f,
+        MFI_STAT_MEMORY_NOT_AVAILABLE = 0x20,
+        MFI_STAT_MFC_HW_ERROR = 0x21,
+        MFI_STAT_NO_HW_PRESENT = 0x22,
+        MFI_STAT_NOT_FOUND = 0x23,
+        MFI_STAT_NOT_IN_ENCL = 0x24,
+        MFI_STAT_PD_CLEAR_IN_PROGRESS = 0x25,
+        MFI_STAT_PD_TYPE_WRONG = 0x26,
+        MFI_STAT_PR_DISABLED = 0x27,
+        MFI_STAT_ROW_INDEX_INVALID = 0x28,
+        MFI_STAT_SAS_CONFIG_INVALID_ACTION = 0x29,
+        MFI_STAT_SAS_CONFIG_INVALID_DATA = 0x2a,
+        MFI_STAT_SAS_CONFIG_INVALID_PAGE = 0x2b,
+        MFI_STAT_SAS_CONFIG_INVALID_TYPE = 0x2c,
+        MFI_STAT_SCSI_DONE_WITH_ERROR = 0x2d,
+        MFI_STAT_SCSI_IO_FAILED = 0x2e,
+        MFI_STAT_SCSI_RESERVATION_CONFLICT = 0x2f,
+        MFI_STAT_SHUTDOWN_FAILED = 0x30,
+        MFI_STAT_TIME_NOT_SET = 0x31,
+        MFI_STAT_WRONG_STATE = 0x32,
+        MFI_STAT_LD_OFFLINE = 0x33,
+        MFI_STAT_PEER_NOTIFICATION_REJECTED = 0x34,
+        MFI_STAT_PEER_NOTIFICATION_FAILED = 0x35,
+        MFI_STAT_RESERVATION_IN_PROGRESS = 0x36,
+        MFI_STAT_I2C_ERRORS_DETECTED = 0x37,
+        MFI_STAT_PCI_ERRORS_DETECTED = 0x38,
+
+        MFI_STAT_INVALID_STATUS = 0xFF
+};
+
+/*
+ * Number of mailbox bytes in DCMD message frame
+ */
+#define MFI_MBOX_SIZE                           12
+
+enum MR_EVT_CLASS {
+
+        MR_EVT_CLASS_DEBUG = -2,
+        MR_EVT_CLASS_PROGRESS = -1,
+        MR_EVT_CLASS_INFO = 0,
+        MR_EVT_CLASS_WARNING = 1,
+        MR_EVT_CLASS_CRITICAL = 2,
+        MR_EVT_CLASS_FATAL = 3,
+        MR_EVT_CLASS_DEAD = 4,
+
+};
+
+enum MR_EVT_LOCALE {
+
+        MR_EVT_LOCALE_LD = 0x0001,
+        MR_EVT_LOCALE_PD = 0x0002,
+        MR_EVT_LOCALE_ENCL = 0x0004,
+        MR_EVT_LOCALE_BBU = 0x0008,
+        MR_EVT_LOCALE_SAS = 0x0010,
+        MR_EVT_LOCALE_CTRL = 0x0020,
+        MR_EVT_LOCALE_CONFIG = 0x0040,
+        MR_EVT_LOCALE_CLUSTER = 0x0080,
+        MR_EVT_LOCALE_ALL = 0xffff,
+
+};
+
+enum MR_EVT_ARGS {
+
+        MR_EVT_ARGS_NONE,
+        MR_EVT_ARGS_CDB_SENSE,
+        MR_EVT_ARGS_LD,
+        MR_EVT_ARGS_LD_COUNT,
+        MR_EVT_ARGS_LD_LBA,
+        MR_EVT_ARGS_LD_OWNER,
+        MR_EVT_ARGS_LD_LBA_PD_LBA,
+        MR_EVT_ARGS_LD_PROG,
+        MR_EVT_ARGS_LD_STATE,
+        MR_EVT_ARGS_LD_STRIP,
+        MR_EVT_ARGS_PD,
+        MR_EVT_ARGS_PD_ERR,
+        MR_EVT_ARGS_PD_LBA,
+        MR_EVT_ARGS_PD_LBA_LD,
+        MR_EVT_ARGS_PD_PROG,
+        MR_EVT_ARGS_PD_STATE,
+        MR_EVT_ARGS_PCI,
+        MR_EVT_ARGS_RATE,
+        MR_EVT_ARGS_STR,
+        MR_EVT_ARGS_TIME,
+        MR_EVT_ARGS_ECC,
+
+};
+
+/*
+ * SAS controller properties
+ */
+struct megasas_ctrl_prop {
+
+        u16 seq_num;
+        u16 pred_fail_poll_interval;
+        u16 intr_throttle_count;
+        u16 intr_throttle_timeouts;
+        u8 rebuild_rate;
+        u8 patrol_read_rate;
+        u8 bgi_rate;
+        u8 cc_rate;
+        u8 recon_rate;
+        u8 cache_flush_interval;
+        u8 spinup_drv_count;
+        u8 spinup_delay;
+        u8 cluster_enable;
+        u8 coercion_mode;
+        u8 alarm_enable;
+        u8 disable_auto_rebuild;
+        u8 disable_battery_warn;
+        u8 ecc_bucket_size;
+        u16 ecc_bucket_leak_rate;
+        u8 restore_hotspare_on_insertion;
+        u8 expose_encl_devices;
+        u8 reserved[38];
+
+} __attribute__ ((packed));
+
+/*
+ * SAS controller information
+ */
+struct megasas_ctrl_info {
+
+        /*
+         * PCI device information
+         */
+        struct {
+
+                u16 vendor_id;
+                u16 device_id;
+                u16 sub_vendor_id;
+                u16 sub_device_id;
+                u8 reserved[24];
+
+        } __attribute__ ((packed)) pci;
+
+        /*
+         * Host interface information
+         */
+        struct {
+
+                u8 PCIX:1;
+                u8 PCIE:1;
+                u8 iSCSI:1;
+                u8 SAS_3G:1;
+                u8 reserved_0:4;
+                u8 reserved_1[6];
+                u8 port_count;
+                u64 port_addr[8];
+
+        } __attribute__ ((packed)) host_interface;
+
+        /*
+         * Device (backend) interface information
+         */
+        struct {
+
+                u8 SPI:1;
+                u8 SAS_3G:1;
+                u8 SATA_1_5G:1;
+                u8 SATA_3G:1;
+                u8 reserved_0:4;
+                u8 reserved_1[6];
+                u8 port_count;
+                u64 port_addr[8];
+
+        } __attribute__ ((packed)) device_interface;
+
+        /*
+         * List of components residing in flash. All str are null terminated
+         */
+        u32 image_check_word;
+        u32 image_component_count;
+
+        struct {
+
+                char name[8];
+                char version[32];
+                char build_date[16];
+                char built_time[16];
+
+        } __attribute__ ((packed)) image_component[8];
+
+        /*
+         * List of flash components that have been flashed on the card, but
+         * are not in use, pending reset of the adapter. This list will be
+         * empty if a flash operation has not occurred. All stings are null
+         * terminated
+         */
+        u32 pending_image_component_count;
+
+        struct {
+
+                char name[8];
+                char version[32];
+                char build_date[16];
+                char build_time[16];
+
+        } __attribute__ ((packed)) pending_image_component[8];
+
+        u8 max_arms;
+        u8 max_spans;
+        u8 max_arrays;
+        u8 max_lds;
+
+        char product_name[80];
+        char serial_no[32];
+
+        /*
+         * Other physical/controller/operation information. Indicates the
+         * presence of the hardware
+         */
+        struct {
+
+                u32 bbu:1;
+                u32 alarm:1;
+                u32 nvram:1;
+                u32 uart:1;
+                u32 reserved:28;
+
+        } __attribute__ ((packed)) hw_present;
+
+        u32 current_fw_time;
+
+        /*
+         * Maximum data transfer sizes
+         */
+        u16 max_concurrent_cmds;
+        u16 max_sge_count;
+        u32 max_request_size;
+
+        /*
+         * Logical and physical device counts
+         */
+        u16 ld_present_count;
+        u16 ld_degraded_count;
+        u16 ld_offline_count;
+
+        u16 pd_present_count;
+        u16 pd_disk_present_count;
+        u16 pd_disk_pred_failure_count;
+        u16 pd_disk_failed_count;
+
+        /*
+         * Memory size information
+         */
+        u16 nvram_size;
+        u16 memory_size;
+        u16 flash_size;
+
+        /*
+         * Error counters
+         */
+        u16 mem_correctable_error_count;
+        u16 mem_uncorrectable_error_count;
+
+        /*
+         * Cluster information
+         */
+        u8 cluster_permitted;
+        u8 cluster_active;
+
+        /*
+         * Additional max data transfer sizes
+         */
+        u16 max_strips_per_io;
+
+        /*
+         * Controller capabilities structures
+         */
+        struct {
+
+                u32 raid_level_0:1;
+                u32 raid_level_1:1;
+                u32 raid_level_5:1;
+                u32 raid_level_1E:1;
+                u32 raid_level_6:1;
+                u32 reserved:27;
+
+        } __attribute__ ((packed)) raid_levels;
+
+        struct {
+
+                u32 rbld_rate:1;
+                u32 cc_rate:1;
+                u32 bgi_rate:1;
+                u32 recon_rate:1;
+                u32 patrol_rate:1;
+                u32 alarm_control:1;
+                u32 cluster_supported:1;
+                u32 bbu:1;
+                u32 spanning_allowed:1;
+                u32 dedicated_hotspares:1;
+                u32 revertible_hotspares:1;
+                u32 foreign_config_import:1;
+                u32 self_diagnostic:1;
+                u32 mixed_redundancy_arr:1;
+                u32 global_hot_spares:1;
+                u32 reserved:17;
+
+        } __attribute__ ((packed)) adapter_operations;
+
+        struct {
+
+                u32 read_policy:1;
+                u32 write_policy:1;
+                u32 io_policy:1;
+                u32 access_policy:1;
+                u32 disk_cache_policy:1;
+                u32 reserved:27;
+
+        } __attribute__ ((packed)) ld_operations;
+
+        struct {
+
+                u8 min;
+                u8 max;
+                u8 reserved[2];
+
+        } __attribute__ ((packed)) stripe_sz_ops;
+
+        struct {
+
+                u32 force_online:1;
+                u32 force_offline:1;
+                u32 force_rebuild:1;
+                u32 reserved:29;
+
+        } __attribute__ ((packed)) pd_operations;
+
+        struct {
+
+                u32 ctrl_supports_sas:1;
+                u32 ctrl_supports_sata:1;
+                u32 allow_mix_in_encl:1;
+                u32 allow_mix_in_ld:1;
+                u32 allow_sata_in_cluster:1;
+                u32 reserved:27;
+
+        } __attribute__ ((packed)) pd_mix_support;
+
+        /*
+         * Define ECC single-bit-error bucket information
+         */
+        u8 ecc_bucket_count;
+        u8 reserved_2[11];
+
+        /*
+         * Include the controller properties (changeable items)
+         */
+        struct megasas_ctrl_prop properties;
+
+        /*
+         * Define FW pkg version (set in envt v'bles on OEM basis)
+         */
+        char package_version[0x60];
+
+        u8 pad[0x800 - 0x6a0];
+
+} __attribute__ ((packed));
+
+/*
+ * ===============================
+ * MegaRAID SAS driver definitions
+ * ===============================
+ */
+#define MEGASAS_MAX_PD_CHANNELS                 2
+#define MEGASAS_MAX_LD_CHANNELS                 2
+#define MEGASAS_MAX_CHANNELS                    (MEGASAS_MAX_PD_CHANNELS + \
+                                                MEGASAS_MAX_LD_CHANNELS)
+#define MEGASAS_MAX_DEV_PER_CHANNEL             128
+#define MEGASAS_DEFAULT_INIT_ID                 -1
+#define MEGASAS_MAX_LUN                         8
+#define MEGASAS_MAX_LD                          64
+
+/*
+ * When SCSI mid-layer calls driver's reset routine, driver waits for
+ * MEGASAS_RESET_WAIT_TIME seconds for all outstanding IO to complete. Note
+ * that the driver cannot _actually_ abort or reset pending commands. While
+ * it is waiting for the commands to complete, it prints a diagnostic message
+ * every MEGASAS_RESET_NOTICE_INTERVAL seconds
+ */
+#define MEGASAS_RESET_WAIT_TIME                 180
+#define MEGASAS_RESET_NOTICE_INTERVAL           5
+
+#define MEGASAS_IOCTL_CMD                       0
+
+/*
+ * FW reports the maximum of number of commands that it can accept (maximum
+ * commands that can be outstanding) at any time. The driver must report a
+ * lower number to the mid layer because it can issue a few internal commands
+ * itself (E.g, AEN, abort cmd, IOCTLs etc). The number of commands it needs
+ * is shown below
+ */
+#define MEGASAS_INT_CMDS                        32
+
+/*
+ * FW can accept both 32 and 64 bit SGLs. We want to allocate 32/64 bit
+ * SGLs based on the size of dma_addr_t
+ */
+#define IS_DMA64                                (sizeof(dma_addr_t) == 8)
+
+#define MFI_OB_INTR_STATUS_MASK                 0x00000002
+#define MFI_POLL_TIMEOUT_SECS                   10
+
+struct megasas_register_set {
+
+        u32 reserved_0[4];      /*0000h */
+
+        u32 inbound_msg_0;      /*0010h */
+        u32 inbound_msg_1;      /*0014h */
+        u32 outbound_msg_0;     /*0018h */
+        u32 outbound_msg_1;     /*001Ch */
+
+        u32 inbound_doorbell;   /*0020h */
+        u32 inbound_intr_status;        /*0024h */
+        u32 inbound_intr_mask;  /*0028h */
+
+        u32 outbound_doorbell;  /*002Ch */
+        u32 outbound_intr_status;       /*0030h */
+        u32 outbound_intr_mask; /*0034h */
+
+        u32 reserved_1[2];      /*0038h */
+
+        u32 inbound_queue_port; /*0040h */
+        u32 outbound_queue_port;        /*0044h */
+
+        u32 reserved_2;         /*004Ch */
+
+        u32 index_registers[1004];      /*0050h */
+
+} __attribute__ ((packed));
+
+struct megasas_sge32 {
+
+        u32 phys_addr;
+        u32 length;
+
+} __attribute__ ((packed));
+
+struct megasas_sge64 {
+
+        u64 phys_addr;
+        u32 length;
+
+} __attribute__ ((packed));
+
+union megasas_sgl {
+
+        struct megasas_sge32 sge32[1];
+        struct megasas_sge64 sge64[1];
+
+} __attribute__ ((packed));
+
+struct megasas_header {
+
+        u8 cmd;                 /*00h */
+        u8 sense_len;           /*01h */
+        u8 cmd_status;          /*02h */
+        u8 scsi_status;         /*03h */
+
+        u8 target_id;           /*04h */
+        u8 lun;                 /*05h */
+        u8 cdb_len;             /*06h */
+        u8 sge_count;           /*07h */
+
+        u32 context;            /*08h */
+        u32 pad_0;              /*0Ch */
+
+        u16 flags;              /*10h */
+        u16 timeout;            /*12h */
+        u32 data_xferlen;       /*14h */
+
+} __attribute__ ((packed));
+
+union megasas_sgl_frame {
+
+        struct megasas_sge32 sge32[8];
+        struct megasas_sge64 sge64[5];
+
+} __attribute__ ((packed));
+
+struct megasas_init_frame {
+
+        u8 cmd;                 /*00h */
+        u8 reserved_0;          /*01h */
+        u8 cmd_status;          /*02h */
+
+        u8 reserved_1;          /*03h */
+        u32 reserved_2;         /*04h */
+
+        u32 context;            /*08h */
+        u32 pad_0;              /*0Ch */
+
+        u16 flags;              /*10h */
+        u16 reserved_3;         /*12h */
+        u32 data_xfer_len;      /*14h */
+
+        u32 queue_info_new_phys_addr_lo;        /*18h */
+        u32 queue_info_new_phys_addr_hi;        /*1Ch */
+        u32 queue_info_old_phys_addr_lo;        /*20h */
+        u32 queue_info_old_phys_addr_hi;        /*24h */
+
+        u32 reserved_4[6];      /*28h */
+
+} __attribute__ ((packed));
+
+struct megasas_init_queue_info {
+
+        u32 init_flags;         /*00h */
+        u32 reply_queue_entries;        /*04h */
+
+        u32 reply_queue_start_phys_addr_lo;     /*08h */
+        u32 reply_queue_start_phys_addr_hi;     /*0Ch */
+        u32 producer_index_phys_addr_lo;        /*10h */
+        u32 producer_index_phys_addr_hi;        /*14h */
+        u32 consumer_index_phys_addr_lo;        /*18h */
+        u32 consumer_index_phys_addr_hi;        /*1Ch */
+
+} __attribute__ ((packed));
+
+struct megasas_io_frame {
+
+        u8 cmd;                 /*00h */
+        u8 sense_len;           /*01h */
+        u8 cmd_status;          /*02h */
+        u8 scsi_status;         /*03h */
+
+        u8 target_id;           /*04h */
+        u8 access_byte;         /*05h */
+        u8 reserved_0;          /*06h */
+        u8 sge_count;           /*07h */
+
+        u32 context;            /*08h */
+        u32 pad_0;              /*0Ch */
+
+        u16 flags;              /*10h */
+        u16 timeout;            /*12h */
+        u32 lba_count;          /*14h */
+
+        u32 sense_buf_phys_addr_lo;     /*18h */
+        u32 sense_buf_phys_addr_hi;     /*1Ch */
+
+        u32 start_lba_lo;       /*20h */
+        u32 start_lba_hi;       /*24h */
+
+        union megasas_sgl sgl;  /*28h */
+
+} __attribute__ ((packed));
+
+struct megasas_pthru_frame {
+
+        u8 cmd;                 /*00h */
+        u8 sense_len;           /*01h */
+        u8 cmd_status;          /*02h */
+        u8 scsi_status;         /*03h */
+
+        u8 target_id;           /*04h */
+        u8 lun;                 /*05h */
+        u8 cdb_len;             /*06h */
+        u8 sge_count;           /*07h */
+
+        u32 context;            /*08h */
+        u32 pad_0;              /*0Ch */
+
+        u16 flags;              /*10h */
+        u16 timeout;            /*12h */
+        u32 data_xfer_len;      /*14h */
+
+        u32 sense_buf_phys_addr_lo;     /*18h */
+        u32 sense_buf_phys_addr_hi;     /*1Ch */
+
+        u8 cdb[16];             /*20h */
+        union megasas_sgl sgl;  /*30h */
+
+} __attribute__ ((packed));
+
+struct megasas_dcmd_frame {
+
+        u8 cmd;                 /*00h */
+        u8 reserved_0;          /*01h */
+        u8 cmd_status;          /*02h */
+        u8 reserved_1[4];       /*03h */
+        u8 sge_count;           /*07h */
+
+        u32 context;            /*08h */
+        u32 pad_0;              /*0Ch */
+
+        u16 flags;              /*10h */
+        u16 timeout;            /*12h */
+
+        u32 data_xfer_len;      /*14h */
+        u32 opcode;             /*18h */
+
+        union {                 /*1Ch */
+                u8 b[12];
+                u16 s[6];
+                u32 w[3];
+        } mbox;
+
+        union megasas_sgl sgl;  /*28h */
+
+} __attribute__ ((packed));
+
+struct megasas_abort_frame {
+
+        u8 cmd;                 /*00h */
+        u8 reserved_0;          /*01h */
+        u8 cmd_status;          /*02h */
+
+        u8 reserved_1;          /*03h */
+        u32 reserved_2;         /*04h */
+
+        u32 context;            /*08h */
+        u32 pad_0;              /*0Ch */
+
+        u16 flags;              /*10h */
+        u16 reserved_3;         /*12h */
+        u32 reserved_4;         /*14h */
+
+        u32 abort_context;      /*18h */
+        u32 pad_1;              /*1Ch */
+
+        u32 abort_mfi_phys_addr_lo;     /*20h */
+        u32 abort_mfi_phys_addr_hi;     /*24h */
+
+        u32 reserved_5[6];      /*28h */
+
+} __attribute__ ((packed));
+
+struct megasas_smp_frame {
+
+        u8 cmd;                 /*00h */
+        u8 reserved_1;          /*01h */
+        u8 cmd_status;          /*02h */
+        u8 connection_status;   /*03h */
+
+        u8 reserved_2[3];       /*04h */
+        u8 sge_count;           /*07h */
+
+        u32 context;            /*08h */
+        u32 pad_0;              /*0Ch */
+
+        u16 flags;              /*10h */
+        u16 timeout;            /*12h */
+
+        u32 data_xfer_len;      /*14h */
+        u64 sas_addr;           /*18h */
+
+        union {
+                struct megasas_sge32 sge32[2];  /* [0]: resp [1]: req */
+                struct megasas_sge64 sge64[2];  /* [0]: resp [1]: req */
+        } sgl;
+
+} __attribute__ ((packed));
+
+struct megasas_stp_frame {
+
+        u8 cmd;                 /*00h */
+        u8 reserved_1;          /*01h */
+        u8 cmd_status;          /*02h */
+        u8 reserved_2;          /*03h */
+
+        u8 target_id;           /*04h */
+        u8 reserved_3[2];       /*05h */
+        u8 sge_count;           /*07h */
+
+        u32 context;            /*08h */
+        u32 pad_0;              /*0Ch */
+
+        u16 flags;              /*10h */
+        u16 timeout;            /*12h */
+
+        u32 data_xfer_len;      /*14h */
+
+        u16 fis[10];            /*18h */
+        u32 stp_flags;
+
+        union {
+                struct megasas_sge32 sge32[2];  /* [0]: resp [1]: data */
+                struct megasas_sge64 sge64[2];  /* [0]: resp [1]: data */
+        } sgl;
+
+} __attribute__ ((packed));
+
+union megasas_frame {
+
+        struct megasas_header hdr;
+        struct megasas_init_frame init;
+        struct megasas_io_frame io;
+        struct megasas_pthru_frame pthru;
+        struct megasas_dcmd_frame dcmd;
+        struct megasas_abort_frame abort;
+        struct megasas_smp_frame smp;
+        struct megasas_stp_frame stp;
+
+        u8 raw_bytes[64];
+};
+
+struct megasas_cmd;
+
+union megasas_evt_class_locale {
+
+        struct {
+                u16 locale;
+                u8 reserved;
+                s8 class;
+        } __attribute__ ((packed)) members;
+
+        u32 word;
+
+} __attribute__ ((packed));
+
+struct megasas_evt_log_info {
+        u32 newest_seq_num;
+        u32 oldest_seq_num;
+        u32 clear_seq_num;
+        u32 shutdown_seq_num;
+        u32 boot_seq_num;
+
+} __attribute__ ((packed));
+
+struct megasas_progress {
+
+        u16 progress;
+        u16 elapsed_seconds;
+
+} __attribute__ ((packed));
+
+struct megasas_evtarg_ld {
+
+        u16 target_id;
+        u8 ld_index;
+        u8 reserved;
+
+} __attribute__ ((packed));
+
+struct megasas_evtarg_pd {
+        u16 device_id;
+        u8 encl_index;
+        u8 slot_number;
+
+} __attribute__ ((packed));
+
+struct megasas_evt_detail {
+
+        u32 seq_num;
+        u32 time_stamp;
+        u32 code;
+        union megasas_evt_class_locale cl;
+        u8 arg_type;
+        u8 reserved1[15];
+
+        union {
+                struct {
+                        struct megasas_evtarg_pd pd;
+                        u8 cdb_length;
+                        u8 sense_length;
+                        u8 reserved[2];
+                        u8 cdb[16];
+                        u8 sense[64];
+                } __attribute__ ((packed)) cdbSense;
+
+                struct megasas_evtarg_ld ld;
+
+                struct {
+                        struct megasas_evtarg_ld ld;
+                        u64 count;
+                } __attribute__ ((packed)) ld_count;
+
+                struct {
+                        u64 lba;
+                        struct megasas_evtarg_ld ld;
+                } __attribute__ ((packed)) ld_lba;
+
+                struct {
+                        struct megasas_evtarg_ld ld;
+                        u32 prevOwner;
+                        u32 newOwner;
+                } __attribute__ ((packed)) ld_owner;
+
+                struct {
+                        u64 ld_lba;
+                        u64 pd_lba;
+                        struct megasas_evtarg_ld ld;
+                        struct megasas_evtarg_pd pd;
+                } __attribute__ ((packed)) ld_lba_pd_lba;
+
+                struct {
+                        struct megasas_evtarg_ld ld;
+                        struct megasas_progress prog;
+                } __attribute__ ((packed)) ld_prog;
+
+                struct {
+                        struct megasas_evtarg_ld ld;
+                        u32 prev_state;
+                        u32 new_state;
+                } __attribute__ ((packed)) ld_state;
+
+                struct {
+                        u64 strip;
+                        struct megasas_evtarg_ld ld;
+                } __attribute__ ((packed)) ld_strip;
+
+                struct megasas_evtarg_pd pd;
+
+                struct {
+                        struct megasas_evtarg_pd pd;
+                        u32 err;
+                } __attribute__ ((packed)) pd_err;
+
+                struct {
+                        u64 lba;
+                        struct megasas_evtarg_pd pd;
+                } __attribute__ ((packed)) pd_lba;
+
+                struct {
+                        u64 lba;
+                        struct megasas_evtarg_pd pd;
+                        struct megasas_evtarg_ld ld;
+                } __attribute__ ((packed)) pd_lba_ld;
+
+                struct {
+                        struct megasas_evtarg_pd pd;
+                        struct megasas_progress prog;
+                } __attribute__ ((packed)) pd_prog;
+
+                struct {
+                        struct megasas_evtarg_pd pd;
+                        u32 prevState;
+                        u32 newState;
+                } __attribute__ ((packed)) pd_state;
+
+                struct {
+                        u16 vendorId;
+                        u16 deviceId;
+                        u16 subVendorId;
+                        u16 subDeviceId;
+                } __attribute__ ((packed)) pci;
+
+                u32 rate;
+                char str[96];
+
+                struct {
+                        u32 rtc;
+                        u32 elapsedSeconds;
+                } __attribute__ ((packed)) time;
+
+                struct {
+                        u32 ecar;
+                        u32 elog;
+                        char str[64];
+                } __attribute__ ((packed)) ecc;
+
+                u8 b[96];
+                u16 s[48];
+                u32 w[24];
+                u64 d[12];
+        } args;
+
+        char description[128];
+
+} __attribute__ ((packed));
+
+struct megasas_instance {
+
+        u32 *producer;
+        dma_addr_t producer_h;
+        u32 *consumer;
+        dma_addr_t consumer_h;
+
+        u32 *reply_queue;
+        dma_addr_t reply_queue_h;
+
+        unsigned long base_addr;
+        struct megasas_register_set __iomem *reg_set;
+
+        s8 init_id;
+        u8 reserved[3];
+
+        u16 max_num_sge;
+        u16 max_fw_cmds;
+        u32 max_sectors_per_req;
+
+        struct megasas_cmd **cmd_list;
+        struct list_head cmd_pool;
+        spinlock_t cmd_pool_lock;
+        struct dma_pool *frame_dma_pool;
+        struct dma_pool *sense_dma_pool;
+
+        struct megasas_evt_detail *evt_detail;
+        dma_addr_t evt_detail_h;
+        struct megasas_cmd *aen_cmd;
+        struct semaphore aen_mutex;
+        struct semaphore ioctl_sem;
+
+        struct Scsi_Host *host;
+
+        wait_queue_head_t int_cmd_wait_q;
+        wait_queue_head_t abort_cmd_wait_q;
+
+        struct pci_dev *pdev;
+        u32 unique_id;
+
+        u32 fw_outstanding;
+        u32 hw_crit_error;
+        spinlock_t instance_lock;
+};
+
+#define MEGASAS_IS_LOGICAL(scp)                                         \
+        (scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1
+
+#define MEGASAS_DEV_INDEX(inst, scp)                                    \
+        ((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) +    \
+        scp->device->id
+
+struct megasas_cmd {
+
+        union megasas_frame *frame;
+        dma_addr_t frame_phys_addr;
+        u8 *sense;
+        dma_addr_t sense_phys_addr;
+
+        u32 index;
+        u8 sync_cmd;
+        u8 cmd_status;
+        u16 abort_aen;
+
+        struct list_head list;
+        struct scsi_cmnd *scmd;
+        struct megasas_instance *instance;
+        u32 frame_count;
+};
+
+#define MAX_MGMT_ADAPTERS               1024
+#define MAX_IOCTL_SGE                   16
+
+struct megasas_iocpacket {
+
+        u16 host_no;
+        u16 __pad1;
+        u32 sgl_off;
+        u32 sge_count;
+        u32 sense_off;
+        u32 sense_len;
+        union {
+                u8 raw[128];
+                struct megasas_header hdr;
+        } frame;
+
+        struct iovec sgl[MAX_IOCTL_SGE];
+
+} __attribute__ ((packed));
+
+struct megasas_aen {
+        u16 host_no;
+        u16 __pad1;
+        u32 seq_num;
+        u32 class_locale_word;
+} __attribute__ ((packed));
+
+#ifdef CONFIG_COMPAT
+struct compat_megasas_iocpacket {
+        u16 host_no;
+        u16 __pad1;
+        u32 sgl_off;
+        u32 sge_count;
+        u32 sense_off;
+        u32 sense_len;
+        union {
+                u8 raw[128];
+                struct megasas_header hdr;
+        } frame;
+        struct compat_iovec sgl[MAX_IOCTL_SGE];
+} __attribute__ ((packed));
+
+#define MEGASAS_IOC_FIRMWARE    _IOWR('M', 1, struct compat_megasas_iocpacket)
+#else
+#define MEGASAS_IOC_FIRMWARE    _IOWR('M', 1, struct megasas_iocpacket)
+#endif
+
+#define MEGASAS_IOC_GET_AEN     _IOW('M', 3, struct megasas_aen)
+
+struct megasas_mgmt_info {
+
+        u16 count;
+        struct megasas_instance *instance[MAX_MGMT_ADAPTERS];
+        int max_index;
+};
+
+#endif                          /*LSI_MEGARAID_SAS_H */
diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c
index a4857db4f9b8..b235556b7b65 100644
--- a/drivers/scsi/mesh.c
+++ b/drivers/scsi/mesh.c
@@ -1959,22 +1959,35 @@ static int mesh_probe(struct macio_dev *mdev, const struct of_device_id *match)
         /* Set it up */
         mesh_init(ms);
 
-        /* XXX FIXME: error should be fatal */
-        if (request_irq(ms->meshintr, do_mesh_interrupt, 0, "MESH", ms))
+        /* Request interrupt */
+        if (request_irq(ms->meshintr, do_mesh_interrupt, 0, "MESH", ms)) {
                 printk(KERN_ERR "MESH: can't get irq %d\n", ms->meshintr);
+                goto out_shutdown;
+        }
 
-        /* XXX FIXME: handle failure */
-        scsi_add_host(mesh_host, &mdev->ofdev.dev);
+        /* Add scsi host & scan */
+        if (scsi_add_host(mesh_host, &mdev->ofdev.dev))
+                goto out_release_irq;
         scsi_scan_host(mesh_host);
 
         return 0;
 
-out_unmap:
+ out_release_irq:
+        free_irq(ms->meshintr, ms);
+ out_shutdown:
+        /* shutdown & reset bus in case of error or macos can be confused
+         * at reboot if the bus was set to synchronous mode already
+         */
+        mesh_shutdown(mdev);
+        set_mesh_power(ms, 0);
+        pci_free_consistent(macio_get_pci_dev(mdev), ms->dma_cmd_size,
+                            ms->dma_cmd_space, ms->dma_cmd_bus);
+ out_unmap:
         iounmap(ms->dma);
         iounmap(ms->mesh);
-out_free:
+ out_free:
         scsi_host_put(mesh_host);
-out_release:
+ out_release:
         macio_release_resources(mdev);
 
         return -ENODEV;
@@ -2001,7 +2014,7 @@ static int mesh_remove(struct macio_dev *mdev)
 
         /* Free DMA commands memory */
         pci_free_consistent(macio_get_pci_dev(mdev), ms->dma_cmd_size,
-                          ms->dma_cmd_space, ms->dma_cmd_bus);
+                            ms->dma_cmd_space, ms->dma_cmd_bus);
 
         /* Release memory resources */
         macio_release_resources(mdev);
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 3e9b64137873..23d095d3817b 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -201,6 +201,7 @@ int
 qla2100_pci_config(scsi_qla_host_t *ha)
 {
         uint16_t w, mwi;
+        uint32_t d;
         unsigned long flags;
         struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
 
@@ -215,9 +216,9 @@ qla2100_pci_config(scsi_qla_host_t *ha)
         pci_write_config_word(ha->pdev, PCI_COMMAND, w);
 
         /* Reset expansion ROM address decode enable */
-        pci_read_config_word(ha->pdev, PCI_ROM_ADDRESS, &w);
-        w &= ~PCI_ROM_ADDRESS_ENABLE;
-        pci_write_config_word(ha->pdev, PCI_ROM_ADDRESS, w);
+        pci_read_config_dword(ha->pdev, PCI_ROM_ADDRESS, &d);
+        d &= ~PCI_ROM_ADDRESS_ENABLE;
+        pci_write_config_dword(ha->pdev, PCI_ROM_ADDRESS, d);
 
         /* Get PCI bus information. */
         spin_lock_irqsave(&ha->hardware_lock, flags);
@@ -237,6 +238,7 @@ int
 qla2300_pci_config(scsi_qla_host_t *ha)
 {
         uint16_t        w, mwi;
+        uint32_t        d;
         unsigned long   flags = 0;
         uint32_t        cnt;
         struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
@@ -302,9 +304,9 @@ qla2300_pci_config(scsi_qla_host_t *ha)
         pci_write_config_byte(ha->pdev, PCI_LATENCY_TIMER, 0x80);
 
         /* Reset expansion ROM address decode enable */
-        pci_read_config_word(ha->pdev, PCI_ROM_ADDRESS, &w);
-        w &= ~PCI_ROM_ADDRESS_ENABLE;
-        pci_write_config_word(ha->pdev, PCI_ROM_ADDRESS, w);
+        pci_read_config_dword(ha->pdev, PCI_ROM_ADDRESS, &d);
+        d &= ~PCI_ROM_ADDRESS_ENABLE;
+        pci_write_config_dword(ha->pdev, PCI_ROM_ADDRESS, d);
 
         /* Get PCI bus information. */
         spin_lock_irqsave(&ha->hardware_lock, flags);
@@ -324,6 +326,7 @@ int
 qla24xx_pci_config(scsi_qla_host_t *ha)
 {
         uint16_t w, mwi;
+        uint32_t d;
         unsigned long flags = 0;
         struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
         int pcix_cmd_reg, pcie_dctl_reg;
@@ -366,9 +369,9 @@ qla24xx_pci_config(scsi_qla_host_t *ha)
         }
 
         /* Reset expansion ROM address decode enable */
-        pci_read_config_word(ha->pdev, PCI_ROM_ADDRESS, &w);
-        w &= ~PCI_ROM_ADDRESS_ENABLE;
-        pci_write_config_word(ha->pdev, PCI_ROM_ADDRESS, w);
+        pci_read_config_dword(ha->pdev, PCI_ROM_ADDRESS, &d);
+        d &= ~PCI_ROM_ADDRESS_ENABLE;
+        pci_write_config_dword(ha->pdev, PCI_ROM_ADDRESS, d);
 
         /* Get PCI bus information. */
         spin_lock_irqsave(&ha->hardware_lock, flags);
diff --git a/drivers/scsi/qla2xxx/qla_rscn.c b/drivers/scsi/qla2xxx/qla_rscn.c
index bdc3bc74bbe1..1eba98828636 100644
--- a/drivers/scsi/qla2xxx/qla_rscn.c
+++ b/drivers/scsi/qla2xxx/qla_rscn.c
@@ -330,6 +330,8 @@ qla2x00_update_login_fcport(scsi_qla_host_t *ha, struct mbx_entry *mbxstat,
         fcport->flags &= ~FCF_FAILOVER_NEEDED;
         fcport->iodesc_idx_sent = IODESC_INVALID_INDEX;
         atomic_set(&fcport->state, FCS_ONLINE);
+        if (fcport->rport)
+                fc_remote_port_unblock(fcport->rport);
 }
 
 
diff --git a/drivers/scsi/sata_nv.c b/drivers/scsi/sata_nv.c
index a1d62dee3be6..c05653c7779d 100644
--- a/drivers/scsi/sata_nv.c
+++ b/drivers/scsi/sata_nv.c
@@ -158,6 +158,8 @@ static struct pci_device_id nv_pci_tbl[] = {
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0, MCP51 },
         { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA,
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0, MCP55 },
+        { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0, MCP55 },
         { PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
                 PCI_ANY_ID, PCI_ANY_ID,
                 PCI_CLASS_STORAGE_IDE<<8, 0xffff00, GENERIC },
diff --git a/drivers/scsi/sata_sis.c b/drivers/scsi/sata_sis.c
index a63f93186e41..b227e51d12f4 100644
--- a/drivers/scsi/sata_sis.c
+++ b/drivers/scsi/sata_sis.c
@@ -161,7 +161,7 @@ static u32 sis_scr_cfg_read (struct ata_port *ap, unsigned int sc_reg)
 {
         struct pci_dev *pdev = to_pci_dev(ap->host_set->dev);
         unsigned int cfg_addr = get_scr_cfg_addr(ap->port_no, sc_reg, pdev->device);
-        u32 val, val2;
+        u32 val, val2 = 0;
         u8 pmr;
 
         if (sc_reg == SCR_ERROR) /* doesn't exist in PCI cfg space */
@@ -289,7 +289,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         if (ent->device != 0x182) {
                 if ((pmr & SIS_PMR_COMBINED) == 0) {
                         printk(KERN_INFO "sata_sis: Detected SiS 180/181 chipset in SATA mode\n");
-                        port2_start=0x64;
+                        port2_start = 64;
                 }
                 else {
                         printk(KERN_INFO "sata_sis: Detected SiS 180/181 chipset in combined mode\n");
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index a780546eda9c..1f0ebabf6d47 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -1265,9 +1265,8 @@ int scsi_device_cancel(struct scsi_device *sdev, int recovery)
                 list_for_each_safe(lh, lh_sf, &active_list) {
                         scmd = list_entry(lh, struct scsi_cmnd, eh_entry);
                         list_del_init(lh);
-                        if (recovery) {
-                                scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD);
-                        } else {
+                        if (recovery &&
+                            !scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD)) {
                                 scmd->result = (DID_ABORT << 16);
                                 scsi_finish_command(scmd);
                         }
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 07b554affcf2..64fc9e21f35b 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -110,6 +110,7 @@ static struct {
         {"RELISYS", "Scorpio", NULL, BLIST_NOLUN},      /* responds to all lun */
         {"SANKYO", "CP525", "6.64", BLIST_NOLUN},       /* causes failed REQ SENSE, extra reset */
         {"TEXEL", "CD-ROM", "1.06", BLIST_NOLUN},
+        {"transtec", "T5008", "0001", BLIST_NOREPORTLUN },
         {"YAMAHA", "CDR100", "1.00", BLIST_NOLUN},      /* locks up */
         {"YAMAHA", "CDR102", "1.00", BLIST_NOLUN},      /* locks up */
         {"YAMAHA", "CRW8424S", "1.0", BLIST_NOLUN},     /* locks up */
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 895c9452be4c..ad5342165079 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -50,7 +50,7 @@
 void scsi_eh_wakeup(struct Scsi_Host *shost)
 {
         if (shost->host_busy == shost->host_failed) {
-                up(shost->eh_wait);
+                wake_up_process(shost->ehandler);
                 SCSI_LOG_ERROR_RECOVERY(5,
                                 printk("Waking error handler thread\n"));
         }
@@ -68,19 +68,24 @@ int scsi_eh_scmd_add(struct scsi_cmnd *scmd, int eh_flag)
 {
         struct Scsi_Host *shost = scmd->device->host;
         unsigned long flags;
+        int ret = 0;
 
-        if (shost->eh_wait == NULL)
+        if (!shost->ehandler)
                 return 0;
 
         spin_lock_irqsave(shost->host_lock, flags);
+        if (scsi_host_set_state(shost, SHOST_RECOVERY))
+                if (scsi_host_set_state(shost, SHOST_CANCEL_RECOVERY))
+                        goto out_unlock;
 
+        ret = 1;
         scmd->eh_eflags |= eh_flag;
         list_add_tail(&scmd->eh_entry, &shost->eh_cmd_q);
-        scsi_host_set_state(shost, SHOST_RECOVERY);
         shost->host_failed++;
         scsi_eh_wakeup(shost);
+ out_unlock:
         spin_unlock_irqrestore(shost->host_lock, flags);
-        return 1;
+        return ret;
 }
 
 /**
@@ -176,8 +181,8 @@ void scsi_times_out(struct scsi_cmnd *scmd)
                 }
 
         if (unlikely(!scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD))) {
-                panic("Error handler thread not present at %p %p %s %d",
-                      scmd, scmd->device->host, __FILE__, __LINE__);
+                scmd->result |= DID_TIME_OUT << 16;
+                __scsi_done(scmd);
         }
 }
 
@@ -196,8 +201,7 @@ int scsi_block_when_processing_errors(struct scsi_device *sdev)
 {
         int online;
 
-        wait_event(sdev->host->host_wait, (sdev->host->shost_state !=
-                                           SHOST_RECOVERY));
+        wait_event(sdev->host->host_wait, !scsi_host_in_recovery(sdev->host));
 
         online = scsi_device_online(sdev);
 
@@ -1441,6 +1445,7 @@ static void scsi_eh_lock_door(struct scsi_device *sdev)
 static void scsi_restart_operations(struct Scsi_Host *shost)
 {
         struct scsi_device *sdev;
+        unsigned long flags;
 
         /*
          * If the door was locked, we need to insert a door lock request
@@ -1460,7 +1465,11 @@ static void scsi_restart_operations(struct Scsi_Host *shost)
         SCSI_LOG_ERROR_RECOVERY(3, printk("%s: waking up host to restart\n",
                                           __FUNCTION__));
 
-        scsi_host_set_state(shost, SHOST_RUNNING);
+        spin_lock_irqsave(shost->host_lock, flags);
+        if (scsi_host_set_state(shost, SHOST_RUNNING))
+                if (scsi_host_set_state(shost, SHOST_CANCEL))
+                        BUG_ON(scsi_host_set_state(shost, SHOST_DEL));
+        spin_unlock_irqrestore(shost->host_lock, flags);
 
         wake_up(&shost->host_wait);
 
@@ -1582,40 +1591,31 @@ int scsi_error_handler(void *data)
 {
         struct Scsi_Host *shost = (struct Scsi_Host *) data;
         int rtn;
-        DECLARE_MUTEX_LOCKED(sem);
 
         current->flags |= PF_NOFREEZE;
-        shost->eh_wait = &sem;
 
+        
         /*
-         * Wake up the thread that created us.
+         * Note - we always use TASK_INTERRUPTIBLE even if the module
+         * was loaded as part of the kernel.  The reason is that
+         * UNINTERRUPTIBLE would cause this thread to be counted in
+         * the load average as a running process, and an interruptible
+         * wait doesn't.
          */
-        SCSI_LOG_ERROR_RECOVERY(3, printk("Wake up parent of"
-                                          " scsi_eh_%d\n",shost->host_no));
-
-        while (1) {
-                /*
-                 * If we get a signal, it means we are supposed to go
-                 * away and die.  This typically happens if the user is
-                 * trying to unload a module.
-                 */
-                SCSI_LOG_ERROR_RECOVERY(1, printk("Error handler"
-                                                  " scsi_eh_%d"
-                                                  " sleeping\n",shost->host_no));
-
-                /*
-                 * Note - we always use down_interruptible with the semaphore
-                 * even if the module was loaded as part of the kernel.  The
-                 * reason is that down() will cause this thread to be counted
-                 * in the load average as a running process, and down
-                 * interruptible doesn't.  Given that we need to allow this
-                 * thread to die if the driver was loaded as a module, using
-                 * semaphores isn't unreasonable.
-                 */
-                down_interruptible(&sem);
-                if (kthread_should_stop())
-                        break;
+        set_current_state(TASK_INTERRUPTIBLE);
+        while (!kthread_should_stop()) {
+                if (shost->host_failed == 0 ||
+                    shost->host_failed != shost->host_busy) {
+                        SCSI_LOG_ERROR_RECOVERY(1, printk("Error handler"
+                                                          " scsi_eh_%d"
+                                                          " sleeping\n",
+                                                          shost->host_no));
+                        schedule();
+                        set_current_state(TASK_INTERRUPTIBLE);
+                        continue;
+                }
 
+                __set_current_state(TASK_RUNNING);
                 SCSI_LOG_ERROR_RECOVERY(1, printk("Error handler"
                                                   " scsi_eh_%d waking"
                                                   " up\n",shost->host_no));
@@ -1642,7 +1642,7 @@ int scsi_error_handler(void *data)
                  * which are still online.
                  */
                 scsi_restart_operations(shost);
-
+                set_current_state(TASK_INTERRUPTIBLE);
         }
 
         SCSI_LOG_ERROR_RECOVERY(1, printk("Error handler scsi_eh_%d"
@@ -1651,7 +1651,7 @@ int scsi_error_handler(void *data)
         /*
          * Make sure that nobody tries to wake us up again.
          */
-        shost->eh_wait = NULL;
+        shost->ehandler = NULL;
         return 0;
 }
 
diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index b7fddac81347..de7f98cc38fe 100644
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -458,7 +458,7 @@ int scsi_nonblockable_ioctl(struct scsi_device *sdev, int cmd,
          * error processing, as long as the device was opened
          * non-blocking */
         if (filp && filp->f_flags & O_NONBLOCK) {
-                if (sdev->host->shost_state == SHOST_RECOVERY)
+                if (scsi_host_in_recovery(sdev->host))
                         return -ENODEV;
         } else if (!scsi_block_when_processing_errors(sdev))
                 return -ENODEV;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 863bb6495daa..dc9c772bc874 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -118,7 +118,6 @@ static void scsi_unprep_request(struct request *req)
         req->flags &= ~REQ_DONTPREP;
         req->special = (req->flags & REQ_SPECIAL) ? cmd->sc_request : NULL;
 
-        scsi_release_buffers(cmd);
         scsi_put_command(cmd);
 }
 
@@ -140,14 +139,12 @@ static void scsi_unprep_request(struct request *req)
  *              commands.
  * Notes:       This could be called either from an interrupt context or a
  *              normal process context.
- * Notes:       Upon return, cmd is a stale pointer.
  */
 int scsi_queue_insert(struct scsi_cmnd *cmd, int reason)
 {
         struct Scsi_Host *host = cmd->device->host;
         struct scsi_device *device = cmd->device;
         struct request_queue *q = device->request_queue;
-        struct request *req = cmd->request;
         unsigned long flags;
 
         SCSI_LOG_MLQUEUE(1,
@@ -188,9 +185,8 @@ int scsi_queue_insert(struct scsi_cmnd *cmd, int reason)
          * function.  The SCSI request function detects the blocked condition
          * and plugs the queue appropriately.
          */
-        scsi_unprep_request(req);
         spin_lock_irqsave(q->queue_lock, flags);
-        blk_requeue_request(q, req);
+        blk_requeue_request(q, cmd->request);
         spin_unlock_irqrestore(q->queue_lock, flags);
 
         scsi_run_queue(q);
@@ -451,7 +447,7 @@ void scsi_device_unbusy(struct scsi_device *sdev)
 
         spin_lock_irqsave(shost->host_lock, flags);
         shost->host_busy--;
-        if (unlikely((shost->shost_state == SHOST_RECOVERY) &&
+        if (unlikely(scsi_host_in_recovery(shost) &&
                      shost->host_failed))
                 scsi_eh_wakeup(shost);
         spin_unlock(shost->host_lock);
@@ -1268,6 +1264,7 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
                         }
                 } else {
                         memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd));
+                        cmd->cmd_len = req->cmd_len;
                         if (rq_data_dir(req) == WRITE)
                                 cmd->sc_data_direction = DMA_TO_DEVICE;
                         else if (req->data_len)
@@ -1342,7 +1339,7 @@ static inline int scsi_host_queue_ready(struct request_queue *q,
                                    struct Scsi_Host *shost,
                                    struct scsi_device *sdev)
 {
-        if (shost->shost_state == SHOST_RECOVERY)
+        if (scsi_host_in_recovery(shost))
                 return 0;
         if (shost->host_busy == 0 && shost->host_blocked) {
                 /*
@@ -1514,7 +1511,6 @@ static void scsi_request_fn(struct request_queue *q)
          * cases (host limits or settings) should run the queue at some
          * later time.
          */
-        scsi_unprep_request(req);
         spin_lock_irq(q->queue_lock);
         blk_requeue_request(q, req);
         sdev->device_busy--;
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index b86f170fa8ed..327c5d7e5bd2 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -587,6 +587,7 @@ static int scsi_probe_lun(struct scsi_device *sdev, char *inq_result,
         if (sdev->scsi_level >= 2 ||
             (sdev->scsi_level == 1 && (inq_result[3] & 0x0f) == 1))
                 sdev->scsi_level++;
+        sdev->sdev_target->scsi_level = sdev->scsi_level;
 
         return 0;
 }
@@ -771,6 +772,15 @@ static int scsi_add_lun(struct scsi_device *sdev, char *inq_result, int *bflags)
         return SCSI_SCAN_LUN_PRESENT;
 }
 
+static inline void scsi_destroy_sdev(struct scsi_device *sdev)
+{
+        if (sdev->host->hostt->slave_destroy)
+                sdev->host->hostt->slave_destroy(sdev);
+        transport_destroy_device(&sdev->sdev_gendev);
+        put_device(&sdev->sdev_gendev);
+}
+
+
 /**
  * scsi_probe_and_add_lun - probe a LUN, if a LUN is found add it
  * @starget:    pointer to target device structure
@@ -803,9 +813,9 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
          * The rescan flag is used as an optimization, the first scan of a
          * host adapter calls into here with rescan == 0.
          */
-        if (rescan) {
-                sdev = scsi_device_lookup_by_target(starget, lun);
-                if (sdev) {
+        sdev = scsi_device_lookup_by_target(starget, lun);
+        if (sdev) {
+                if (rescan || sdev->sdev_state != SDEV_CREATED) {
                         SCSI_LOG_SCAN_BUS(3, printk(KERN_INFO
                                 "scsi scan: device exists on %s\n",
                                 sdev->sdev_gendev.bus_id));
@@ -820,9 +830,9 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
                                                                  sdev->model);
                         return SCSI_SCAN_LUN_PRESENT;
                 }
-        }
-
-        sdev = scsi_alloc_sdev(starget, lun, hostdata);
+                scsi_device_put(sdev);
+        } else
+                sdev = scsi_alloc_sdev(starget, lun, hostdata);
         if (!sdev)
                 goto out;
 
@@ -877,12 +887,8 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
                                 res = SCSI_SCAN_NO_RESPONSE;
                         }
                 }
-        } else {
-                if (sdev->host->hostt->slave_destroy)
-                        sdev->host->hostt->slave_destroy(sdev);
-                transport_destroy_device(&sdev->sdev_gendev);
-                put_device(&sdev->sdev_gendev);
-        }
+        } else
+                scsi_destroy_sdev(sdev);
  out:
         return res;
 }
@@ -1054,7 +1060,7 @@ EXPORT_SYMBOL(int_to_scsilun);
  *     0: scan completed (or no memory, so further scanning is futile)
  *     1: no report lun scan, or not configured
  **/
-static int scsi_report_lun_scan(struct scsi_device *sdev, int bflags,
+static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
                                 int rescan)
 {
         char devname[64];
@@ -1067,7 +1073,8 @@ static int scsi_report_lun_scan(struct scsi_device *sdev, int bflags,
         struct scsi_lun *lunp, *lun_data;
         u8 *data;
         struct scsi_sense_hdr sshdr;
-        struct scsi_target *starget = scsi_target(sdev);
+        struct scsi_device *sdev;
+        struct Scsi_Host *shost = dev_to_shost(&starget->dev);
 
         /*
          * Only support SCSI-3 and up devices if BLIST_NOREPORTLUN is not set.
@@ -1075,15 +1082,23 @@ static int scsi_report_lun_scan(struct scsi_device *sdev, int bflags,
          * support more than 8 LUNs.
          */
         if ((bflags & BLIST_NOREPORTLUN) || 
-             sdev->scsi_level < SCSI_2 ||
-            (sdev->scsi_level < SCSI_3 && 
-             (!(bflags & BLIST_REPORTLUN2) || sdev->host->max_lun <= 8)) )
+             starget->scsi_level < SCSI_2 ||
+            (starget->scsi_level < SCSI_3 && 
+             (!(bflags & BLIST_REPORTLUN2) || shost->max_lun <= 8)) )
                 return 1;
         if (bflags & BLIST_NOLUN)
                 return 0;
 
+        if (!(sdev = scsi_device_lookup_by_target(starget, 0))) {
+                sdev = scsi_alloc_sdev(starget, 0, NULL);
+                if (!sdev)
+                        return 0;
+                if (scsi_device_get(sdev))
+                        return 0;
+        }
+
         sprintf(devname, "host %d channel %d id %d",
-                sdev->host->host_no, sdev->channel, sdev->id);
+                shost->host_no, sdev->channel, sdev->id);
 
         /*
          * Allocate enough to hold the header (the same size as one scsi_lun)
@@ -1098,8 +1113,10 @@ static int scsi_report_lun_scan(struct scsi_device *sdev, int bflags,
         length = (max_scsi_report_luns + 1) * sizeof(struct scsi_lun);
         lun_data = kmalloc(length, GFP_ATOMIC |
                            (sdev->host->unchecked_isa_dma ? __GFP_DMA : 0));
-        if (!lun_data)
+        if (!lun_data) {
+                printk(ALLOC_FAILURE_MSG, __FUNCTION__);
                 goto out;
+        }
 
         scsi_cmd[0] = REPORT_LUNS;
 
@@ -1201,10 +1218,6 @@ static int scsi_report_lun_scan(struct scsi_device *sdev, int bflags,
                         for (i = 0; i < sizeof(struct scsi_lun); i++)
                                 printk("%02x", data[i]);
                         printk(" has a LUN larger than currently supported.\n");
-                } else if (lun == 0) {
-                        /*
-                         * LUN 0 has already been scanned.
-                         */
                 } else if (lun > sdev->host->max_lun) {
                         printk(KERN_WARNING "scsi: %s lun%d has a LUN larger"
                                " than allowed by the host adapter\n",
@@ -1227,13 +1240,13 @@ static int scsi_report_lun_scan(struct scsi_device *sdev, int bflags,
         }
 
         kfree(lun_data);
-        return 0;
-
  out:
-        /*
-         * We are out of memory, don't try scanning any further.
-         */
-        printk(ALLOC_FAILURE_MSG, __FUNCTION__);
+        scsi_device_put(sdev);
+        if (sdev->sdev_state == SDEV_CREATED)
+                /*
+                 * the sdev we used didn't appear in the report luns scan
+                 */
+                scsi_destroy_sdev(sdev);
         return 0;
 }
 
@@ -1299,7 +1312,6 @@ static void __scsi_scan_target(struct device *parent, unsigned int channel,
         struct Scsi_Host *shost = dev_to_shost(parent);
         int bflags = 0;
         int res;
-        struct scsi_device *sdev = NULL;
         struct scsi_target *starget;
 
         if (shost->this_id == id)
@@ -1325,27 +1337,16 @@ static void __scsi_scan_target(struct device *parent, unsigned int channel,
          * Scan LUN 0, if there is some response, scan further. Ideally, we
          * would not configure LUN 0 until all LUNs are scanned.
          */
-        res = scsi_probe_and_add_lun(starget, 0, &bflags, &sdev, rescan, NULL);
-        if (res == SCSI_SCAN_LUN_PRESENT) {
-                if (scsi_report_lun_scan(sdev, bflags, rescan) != 0)
+        res = scsi_probe_and_add_lun(starget, 0, &bflags, NULL, rescan, NULL);
+        if (res == SCSI_SCAN_LUN_PRESENT || res == SCSI_SCAN_TARGET_PRESENT) {
+                if (scsi_report_lun_scan(starget, bflags, rescan) != 0)
                         /*
                          * The REPORT LUN did not scan the target,
                          * do a sequential scan.
                          */
                         scsi_sequential_lun_scan(starget, bflags,
-                                        res, sdev->scsi_level, rescan);
-        } else if (res == SCSI_SCAN_TARGET_PRESENT) {
-                /*
-                 * There's a target here, but lun 0 is offline so we
-                 * can't use the report_lun scan.  Fall back to a
-                 * sequential lun scan with a bflags of SPARSELUN and
-                 * a default scsi level of SCSI_2
-                 */
-                scsi_sequential_lun_scan(starget, BLIST_SPARSELUN,
-                                SCSI_SCAN_TARGET_PRESENT, SCSI_2, rescan);
+                                        res, starget->scsi_level, rescan);
         }
-        if (sdev)
-                scsi_device_put(sdev);
 
  out_reap:
         /* now determine if the target has any children at all
@@ -1466,23 +1467,17 @@ EXPORT_SYMBOL(scsi_scan_single_target);
 
 void scsi_forget_host(struct Scsi_Host *shost)
 {
-        struct scsi_target *starget, *tmp;
+        struct scsi_device *sdev;
         unsigned long flags;
 
-        /*
-         * Ok, this look a bit strange.  We always look for the first device
-         * on the list as scsi_remove_device removes them from it - thus we
-         * also have to release the lock.
-         * We don't need to get another reference to the device before
-         * releasing the lock as we already own the reference from
-         * scsi_register_device that's release in scsi_remove_device.  And
-         * after that we don't look at sdev anymore.
-         */
+ restart:
         spin_lock_irqsave(shost->host_lock, flags);
-        list_for_each_entry_safe(starget, tmp, &shost->__targets, siblings) {
+        list_for_each_entry(sdev, &shost->__devices, siblings) {
+                if (sdev->sdev_state == SDEV_DEL)
+                        continue;
                 spin_unlock_irqrestore(shost->host_lock, flags);
-                scsi_remove_target(&starget->dev);
-                spin_lock_irqsave(shost->host_lock, flags);
+                __scsi_remove_device(sdev);
+                goto restart;
         }
         spin_unlock_irqrestore(shost->host_lock, flags);
 }
@@ -1548,10 +1543,7 @@ void scsi_free_host_dev(struct scsi_device *sdev)
 {
         BUG_ON(sdev->id != sdev->host->this_id);
 
-        if (sdev->host->hostt->slave_destroy)
-                sdev->host->hostt->slave_destroy(sdev);
-        transport_destroy_device(&sdev->sdev_gendev);
-        put_device(&sdev->sdev_gendev);
+        scsi_destroy_sdev(sdev);
 }
 EXPORT_SYMBOL(scsi_free_host_dev);
 
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index b8052d5206cc..72a6550a056c 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -57,6 +57,8 @@ static struct {
         { SHOST_CANCEL, "cancel" },
         { SHOST_DEL, "deleted" },
         { SHOST_RECOVERY, "recovery" },
+        { SHOST_CANCEL_RECOVERY, "cancel/recovery" },
+        { SHOST_DEL_RECOVERY, "deleted/recovery", },
 };
 const char *scsi_host_state_name(enum scsi_host_state state)
 {
@@ -707,9 +709,11 @@ void __scsi_remove_device(struct scsi_device *sdev)
  **/
 void scsi_remove_device(struct scsi_device *sdev)
 {
-        down(&sdev->host->scan_mutex);
+        struct Scsi_Host *shost = sdev->host;
+
+        down(&shost->scan_mutex);
         __scsi_remove_device(sdev);
-        up(&sdev->host->scan_mutex);
+        up(&shost->scan_mutex);
 }
 EXPORT_SYMBOL(scsi_remove_device);
 
@@ -717,17 +721,20 @@ void __scsi_remove_target(struct scsi_target *starget)
 {
         struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
         unsigned long flags;
-        struct scsi_device *sdev, *tmp;
+        struct scsi_device *sdev;
 
         spin_lock_irqsave(shost->host_lock, flags);
         starget->reap_ref++;
-        list_for_each_entry_safe(sdev, tmp, &shost->__devices, siblings) {
+ restart:
+        list_for_each_entry(sdev, &shost->__devices, siblings) {
                 if (sdev->channel != starget->channel ||
-                    sdev->id != starget->id)
+                    sdev->id != starget->id ||
+                    sdev->sdev_state == SDEV_DEL)
                         continue;
                 spin_unlock_irqrestore(shost->host_lock, flags);
                 scsi_remove_device(sdev);
                 spin_lock_irqsave(shost->host_lock, flags);
+                goto restart;
         }
         spin_unlock_irqrestore(shost->host_lock, flags);
         scsi_target_reap(starget);
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index ff724bbe6611..1d145d2f9a38 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -628,17 +628,16 @@ sas_rphy_delete(struct sas_rphy *rphy)
         struct Scsi_Host *shost = dev_to_shost(parent->dev.parent);
         struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
 
-        transport_destroy_device(&rphy->dev);
+        scsi_remove_target(dev);
 
-        scsi_remove_target(&rphy->dev);
+        transport_remove_device(dev);
+        device_del(dev);
+        transport_destroy_device(dev);
 
         spin_lock(&sas_host->lock);
         list_del(&rphy->list);
         spin_unlock(&sas_host->lock);
 
-        transport_remove_device(dev);
-        device_del(dev);
-        transport_destroy_device(dev);
         put_device(&parent->dev);
 }
 EXPORT_SYMBOL(sas_rphy_delete);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index de564b386052..9a1dc0cea03c 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -235,6 +235,7 @@ static int sd_init_command(struct scsi_cmnd * SCpnt)
                         return 0;
 
                 memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd));
+                SCpnt->cmd_len = rq->cmd_len;
                 if (rq_data_dir(rq) == WRITE)
                         SCpnt->sc_data_direction = DMA_TO_DEVICE;
                 else if (rq->data_len)
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 9ea4765d1d12..ad94367df430 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1027,7 +1027,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
                 if (sdp->detached)
                         return -ENODEV;
                 if (filp->f_flags & O_NONBLOCK) {
-                        if (sdp->device->host->shost_state == SHOST_RECOVERY)
+                        if (scsi_host_in_recovery(sdp->device->host))
                                 return -EBUSY;
                 } else if (!scsi_block_when_processing_errors(sdp->device))
                         return -EBUSY;
@@ -2849,8 +2849,7 @@ sg_proc_init(void)
         struct proc_dir_entry *pdep;
         struct sg_proc_leaf * leaf;
 
-        sg_proc_sgp = create_proc_entry(sg_proc_sg_dirname,
-                                        S_IFDIR | S_IRUGO | S_IXUGO, NULL);
+        sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
         if (!sg_proc_sgp)
                 return 1;
         for (k = 0; k < num_leaves; ++k) {
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index ce63fc8312dc..561901b1cf11 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -326,6 +326,7 @@ static int sr_init_command(struct scsi_cmnd * SCpnt)
                         return 0;
 
                 memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd));
+                SCpnt->cmd_len = rq->cmd_len;
                 if (!rq->data_len)
                         SCpnt->sc_data_direction = DMA_NONE;
                 else if (rq_data_dir(rq) == WRITE)
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index a93308ae9736..d001c046551b 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4206,6 +4206,7 @@ static int st_init_command(struct scsi_cmnd *SCpnt)
                 return 0;
 
         memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd));
+        SCpnt->cmd_len = rq->cmd_len;
 
         if (rq_data_dir(rq) == WRITE)
                 SCpnt->sc_data_direction = DMA_TO_DEVICE;
diff --git a/drivers/serial/21285.c b/drivers/serial/21285.c
index aec39fb261ca..b5cf39468d18 100644
--- a/drivers/serial/21285.c
+++ b/drivers/serial/21285.c
@@ -463,7 +463,7 @@ static int __init serial21285_console_setup(struct console *co, char *options)
         return uart_set_options(port, co, baud, parity, bits, flow);
 }
 
-extern struct uart_driver serial21285_reg;
+static struct uart_driver serial21285_reg;
 
 static struct console serial21285_console =
 {
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 978e12437e61..679e678c7e6a 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -689,7 +689,7 @@ static int __init pl010_console_setup(struct console *co, char *options)
         return uart_set_options(port, co, baud, parity, bits, flow);
 }
 
-extern struct uart_driver amba_reg;
+static struct uart_driver amba_reg;
 static struct console amba_console = {
         .name           = "ttyAM",
         .write          = pl010_console_write,
diff --git a/drivers/serial/amba-pl011.c b/drivers/serial/amba-pl011.c
index 56071309744c..1ff629c74750 100644
--- a/drivers/serial/amba-pl011.c
+++ b/drivers/serial/amba-pl011.c
@@ -701,7 +701,7 @@ static int __init pl011_console_setup(struct console *co, char *options)
         return uart_set_options(&uap->port, co, baud, parity, bits, flow);
 }
 
-extern struct uart_driver amba_reg;
+static struct uart_driver amba_reg;
 static struct console amba_console = {
         .name           = "ttyAMA",
         .write          = pl011_console_write,
diff --git a/drivers/serial/clps711x.c b/drivers/serial/clps711x.c
index d822896b488c..87ef368384fb 100644
--- a/drivers/serial/clps711x.c
+++ b/drivers/serial/clps711x.c
@@ -98,7 +98,7 @@ static irqreturn_t clps711xuart_int_rx(int irq, void *dev_id, struct pt_regs *re
 {
         struct uart_port *port = dev_id;
         struct tty_struct *tty = port->info->tty;
-        unsigned int status, ch, flg, ignored = 0;
+        unsigned int status, ch, flg;
 
         status = clps_readl(SYSFLG(port));
         while (!(status & SYSFLG_URXFE)) {
@@ -525,7 +525,7 @@ static int __init clps711xuart_console_setup(struct console *co, char *options)
         return uart_set_options(port, co, baud, parity, bits, flow);
 }
 
-extern struct uart_driver clps711x_reg;
+static struct uart_driver clps711x_reg;
 static struct console clps711x_console = {
         .name           = "ttyCL",
         .write          = clps711xuart_console_write,
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 4c985e6b3784..4e1e80adaf11 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -860,7 +860,7 @@ imx_console_setup(struct console *co, char *options)
         return uart_set_options(&sport->port, co, baud, parity, bits, flow);
 }
 
-extern struct uart_driver imx_reg;
+static struct uart_driver imx_reg;
 static struct console imx_console = {
         .name           = "ttySMX",
         .write          = imx_console_write,
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index 0c5c96a582b3..f88fdd480685 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -973,18 +973,6 @@ static irqreturn_t ioc4_intr(int irq, void *arg, struct pt_regs *regs)
                                 this_ir &= ~this_mir;
                         }
                 }
-                if (this_ir) {
-                        printk(KERN_ERR
-                               "unknown IOC4 %s interrupt 0x%x, sio_ir = 0x%x,"
-                                " sio_ies = 0x%x, other_ir = 0x%x :"
-                                "other_ies = 0x%x\n",
-                               (intr_type == IOC4_SIO_INTR_TYPE) ? "sio" :
-                               "other", this_ir,
-                               readl(&soft->is_ioc4_misc_addr->sio_ir.raw),
-                               readl(&soft->is_ioc4_misc_addr->sio_ies.raw),
-                               readl(&soft->is_ioc4_misc_addr->other_ir.raw),
-                               readl(&soft->is_ioc4_misc_addr->other_ies.raw));
-                }
         }
 #ifdef DEBUG_INTERRUPTS
         {
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index a3cd0ee8486d..0585ab27ffde 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -781,7 +781,7 @@ mpc52xx_uart_remove(struct device *dev)
 
 #ifdef CONFIG_PM
 static int
-mpc52xx_uart_suspend(struct device *dev, u32 state, u32 level)
+mpc52xx_uart_suspend(struct device *dev, pm_message_t state, u32 level)
 {
         struct uart_port *port = (struct uart_port *) dev_get_drvdata(dev);
 
diff --git a/drivers/serial/pxa.c b/drivers/serial/pxa.c
index eaa0af835290..672b359b07ce 100644
--- a/drivers/serial/pxa.c
+++ b/drivers/serial/pxa.c
@@ -589,8 +589,8 @@ serial_pxa_type(struct uart_port *port)
 
 #ifdef CONFIG_SERIAL_PXA_CONSOLE
 
-extern struct uart_pxa_port serial_pxa_ports[];
-extern struct uart_driver serial_pxa_reg;
+static struct uart_pxa_port serial_pxa_ports[];
+static struct uart_driver serial_pxa_reg;
 
 #define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
 
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index c361c6fb0809..50d7870d92bb 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -82,8 +82,6 @@
 #include <asm/arch/regs-serial.h>
 #include <asm/arch/regs-gpio.h>
 
-#include <asm/mach-types.h>
-
 /* structures */
 
 struct s3c24xx_uart_info {
@@ -753,8 +751,8 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
 {
         struct s3c2410_uartcfg *cfg = s3c24xx_port_to_cfg(port);
         struct s3c24xx_uart_port *ourport = to_ourport(port);
-        struct s3c24xx_uart_clksrc *clksrc;
-        struct clk *clk;
+        struct s3c24xx_uart_clksrc *clksrc = NULL;
+        struct clk *clk = NULL;
         unsigned long flags;
         unsigned int baud, quot;
         unsigned int ulcon;
diff --git a/drivers/serial/sa1100.c b/drivers/serial/sa1100.c
index 1225b14f6e9d..dd8aed242357 100644
--- a/drivers/serial/sa1100.c
+++ b/drivers/serial/sa1100.c
@@ -799,7 +799,7 @@ sa1100_console_setup(struct console *co, char *options)
         return uart_set_options(&sport->port, co, baud, parity, bits, flow);
 }
 
-extern struct uart_driver sa1100_reg;
+static struct uart_driver sa1100_reg;
 static struct console sa1100_console = {
         .name           = "ttySA",
         .write          = sa1100_console_write,
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 1ae0b381c162..2c7d3ef76e8e 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -859,6 +859,7 @@ static struct pcmcia_device_id serial_ids[] = {
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0175, 0x0000, "DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x0035, "3CXEM556.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x003d, "3CXEM556.cis"),
+        PCMCIA_DEVICE_CIS_MANF_CARD(0x0192, 0x0710, "SW_7xx_SER.cis"),  /* Sierra Wireless AC710/AC750 GPRS Network Adapter R1 */
         PCMCIA_DEVICE_CIS_PROD_ID12("MultiTech", "PCMCIA 56K DataFax", 0x842047ee, 0xc2efcf03, "MT5634ZLX.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "COMpad4.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "COMpad2.cis"),
diff --git a/drivers/serial/serial_lh7a40x.c b/drivers/serial/serial_lh7a40x.c
index 8302376800c0..d01dbe5da3b9 100644
--- a/drivers/serial/serial_lh7a40x.c
+++ b/drivers/serial/serial_lh7a40x.c
@@ -632,7 +632,7 @@ static int __init lh7a40xuart_console_setup (struct console* co, char* options)
         return uart_set_options (port, co, baud, parity, bits, flow);
 }
 
-extern struct uart_driver lh7a40x_reg;
+static struct uart_driver lh7a40x_reg;
 static struct console lh7a40x_console = {
         .name           = "ttyAM",
         .write          = lh7a40xuart_console_write,
diff --git a/drivers/tc/zs.c b/drivers/tc/zs.c
index 4382ee60b6a8..6bed8713897e 100644
--- a/drivers/tc/zs.c
+++ b/drivers/tc/zs.c
@@ -1683,7 +1683,7 @@ static void __init probe_sccs(void)
 #ifndef CONFIG_SERIAL_DEC_CONSOLE
                         /*
                          * We're called early and memory managment isn't up, yet.
-                         * Thus check_region would fail.
+                         * Thus request_region would fail.
                          */
                         if (!request_region((unsigned long)
                                          zs_channels[n_channels].control,
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index cbb451d227d2..6385d1a99b60 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -242,7 +242,6 @@ int usb_hcd_pci_suspend (struct pci_dev *dev, pm_message_t message)
         case HC_STATE_SUSPENDED:
                 /* no DMA or IRQs except when HC is active */
                 if (dev->current_state == PCI_D0) {
-                        free_irq (hcd->irq, hcd);
                         pci_save_state (dev);
                         pci_disable_device (dev);
                 }
@@ -374,14 +373,6 @@ int usb_hcd_pci_resume (struct pci_dev *dev)
 
         hcd->state = HC_STATE_RESUMING;
         hcd->saw_irq = 0;
-        retval = request_irq (dev->irq, usb_hcd_irq, SA_SHIRQ,
-                                hcd->irq_descr, hcd);
-        if (retval < 0) {
-                dev_err (hcd->self.controller,
-                        "can't restore IRQ after resume!\n");
-                usb_hc_died (hcd);
-                return retval;
-        }
 
         retval = hcd->driver->resume (hcd);
         if (!HC_IS_RUNNING (hcd->state)) {
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index c47c8052b486..f1fb67fe22a8 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -987,7 +987,7 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
 
                         /* remove this interface if it has been registered */
                         interface = dev->actconfig->interface[i];
-                        if (!klist_node_attached(&interface->dev.knode_bus))
+                        if (!device_is_registered(&interface->dev))
                                 continue;
                         dev_dbg (&dev->dev, "unregistering interface %s\n",
                                 interface->dev.bus_id);
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 087af73a59dd..7d131509e419 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -303,7 +303,7 @@ int usb_driver_claim_interface(struct usb_driver *driver,
         /* if interface was already added, bind now; else let
          * the future device_add() bind it, bypassing probe()
          */
-        if (klist_node_attached(&dev->knode_bus))
+        if (device_is_registered(dev))
                 device_bind_driver(dev);
 
         return 0;
@@ -336,8 +336,8 @@ void usb_driver_release_interface(struct usb_driver *driver,
         if (iface->condition != USB_INTERFACE_BOUND)
                 return;
 
-        /* release only after device_add() */
-        if (klist_node_attached(&dev->knode_bus)) {
+        /* don't release if the interface hasn't been added yet */
+        if (device_is_registered(dev)) {
                 iface->condition = USB_INTERFACE_UNBINDING;
                 device_release_driver(dev);
         }
diff --git a/drivers/usb/gadget/pxa2xx_udc.c b/drivers/usb/gadget/pxa2xx_udc.c
index 1507738337c4..73f8c9404156 100644
--- a/drivers/usb/gadget/pxa2xx_udc.c
+++ b/drivers/usb/gadget/pxa2xx_udc.c
@@ -422,7 +422,7 @@ static inline void ep0_idle (struct pxa2xx_udc *dev)
 }
 
 static int
-write_packet(volatile u32 *uddr, struct pxa2xx_request *req, unsigned max)
+write_packet(volatile unsigned long *uddr, struct pxa2xx_request *req, unsigned max)
 {
         u8              *buf;
         unsigned        length, count;
@@ -2602,7 +2602,7 @@ static int __exit pxa2xx_udc_remove(struct device *_dev)
  * VBUS IRQs should probably be ignored so that the PXA device just acts
  * "dead" to USB hosts until system resume.
  */
-static int pxa2xx_udc_suspend(struct device *dev, u32 state, u32 level)
+static int pxa2xx_udc_suspend(struct device *dev, pm_message_t state, u32 level)
 {
         struct pxa2xx_udc       *udc = dev_get_drvdata(dev);
 
diff --git a/drivers/usb/gadget/pxa2xx_udc.h b/drivers/usb/gadget/pxa2xx_udc.h
index d0bc396a85d5..a58f3e6e71f1 100644
--- a/drivers/usb/gadget/pxa2xx_udc.h
+++ b/drivers/usb/gadget/pxa2xx_udc.h
@@ -69,11 +69,11 @@ struct pxa2xx_ep {
          * UDDR = UDC Endpoint Data Register (the fifo)
          * DRCM = DMA Request Channel Map
          */
-        volatile u32                            *reg_udccs;
-        volatile u32                            *reg_ubcr;
-        volatile u32                            *reg_uddr;
+        volatile unsigned long                  *reg_udccs;
+        volatile unsigned long                  *reg_ubcr;
+        volatile unsigned long                  *reg_uddr;
 #ifdef USE_DMA
-        volatile u32                            *reg_drcmr;
+        volatile unsigned long                  *reg_drcmr;
 #define drcmr(n)  .reg_drcmr = & DRCMR ## n ,
 #else
 #define drcmr(n)  
diff --git a/drivers/usb/host/ohci-lh7a404.c b/drivers/usb/host/ohci-lh7a404.c
index 817620d73841..859aca7be753 100644
--- a/drivers/usb/host/ohci-lh7a404.c
+++ b/drivers/usb/host/ohci-lh7a404.c
@@ -17,8 +17,6 @@
  */
 
 #include <asm/hardware.h>
-#include <asm/mach-types.h>
-#include <asm/arch/hardware.h>
 
 
 extern int usb_disabled(void);
diff --git a/drivers/usb/host/ohci-omap.c b/drivers/usb/host/ohci-omap.c
index 5cde76faab93..d8f3ba7ad52e 100644
--- a/drivers/usb/host/ohci-omap.c
+++ b/drivers/usb/host/ohci-omap.c
@@ -18,7 +18,6 @@
 #include <asm/io.h>
 #include <asm/mach-types.h>
 
-#include <asm/arch/hardware.h>
 #include <asm/arch/mux.h>
 #include <asm/arch/irqs.h>
 #include <asm/arch/gpio.h>
diff --git a/drivers/usb/host/ohci-s3c2410.c b/drivers/usb/host/ohci-s3c2410.c
index 3d9bcf78a9a4..da7d5478f74d 100644
--- a/drivers/usb/host/ohci-s3c2410.c
+++ b/drivers/usb/host/ohci-s3c2410.c
@@ -20,7 +20,6 @@
 */
 
 #include <asm/hardware.h>
-#include <asm/mach-types.h>
 #include <asm/hardware/clock.h>
 #include <asm/arch/usb-control.h>
 
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index d2a1fd40dfcb..d42a15d10a46 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -782,6 +782,9 @@ retry:
 /* usb 1.1 says max 90% of a frame is available for periodic transfers.
  * this driver doesn't promise that much since it's got to handle an
  * IRQ per packet; irq handling latencies also use up that time.
+ *
+ * NOTE:  the periodic schedule is a sparse tree, with the load for
+ * each branch minimized.  see fig 3.5 in the OHCI spec for example.
  */
 #define MAX_PERIODIC_LOAD       500     /* out of 1000 usec */
 
@@ -843,6 +846,7 @@ static int sl811h_urb_enqueue(
         if (!(sl811->port1 & (1 << USB_PORT_FEAT_ENABLE))
                         || !HC_IS_RUNNING(hcd->state)) {
                 retval = -ENODEV;
+                kfree(ep);
                 goto fail;
         }
 
@@ -911,8 +915,16 @@ static int sl811h_urb_enqueue(
         case PIPE_ISOCHRONOUS:
         case PIPE_INTERRUPT:
                 urb->interval = ep->period;
-                if (ep->branch < PERIODIC_SIZE)
+                if (ep->branch < PERIODIC_SIZE) {
+                        /* NOTE:  the phase is correct here, but the value
+                         * needs offsetting by the transfer queue depth.
+                         * All current drivers ignore start_frame, so this
+                         * is unlikely to ever matter...
+                         */
+                        urb->start_frame = (sl811->frame & (PERIODIC_SIZE - 1))
+                                                + ep->branch;
                         break;
+                }
 
                 retval = balance(sl811, ep->period, ep->load);
                 if (retval < 0)
@@ -1122,7 +1134,7 @@ sl811h_hub_descriptor (
         desc->wHubCharacteristics = (__force __u16)cpu_to_le16(temp);
 
         /* two bitmaps:  ports removable, and legacy PortPwrCtrlMask */
-        desc->bitmap[0] = 1 << 1;
+        desc->bitmap[0] = 0 << 1;
         desc->bitmap[1] = ~0;
 }
 
diff --git a/drivers/usb/media/vicam.c b/drivers/usb/media/vicam.c
index 4a5857c53f11..0bc0b1247a6b 100644
--- a/drivers/usb/media/vicam.c
+++ b/drivers/usb/media/vicam.c
@@ -1148,7 +1148,7 @@ vicam_write_proc_gain(struct file *file, const char *buffer,
 static void
 vicam_create_proc_root(void)
 {
-        vicam_proc_root = create_proc_entry("video/vicam", S_IFDIR, 0);
+        vicam_proc_root = proc_mkdir("video/vicam", NULL);
 
         if (vicam_proc_root)
                 vicam_proc_root->owner = THIS_MODULE;
@@ -1181,7 +1181,7 @@ vicam_create_proc_entry(struct vicam_camera *cam)
 
         sprintf(name, "video%d", cam->vdev.minor);
 
-        cam->proc_dir = create_proc_entry(name, S_IFDIR, vicam_proc_root);
+        cam->proc_dir = proc_mkdir(name, vicam_proc_root);
 
         if ( !cam->proc_dir )
                 return; // FIXME: We should probably return an error here
diff --git a/drivers/usb/net/pegasus.c b/drivers/usb/net/pegasus.c
index 7484d34780fc..6a4ffe6c3977 100644
--- a/drivers/usb/net/pegasus.c
+++ b/drivers/usb/net/pegasus.c
@@ -648,6 +648,13 @@ static void read_bulk_callback(struct urb *urb, struct pt_regs *regs)
         }
 
         /*
+         * If the packet is unreasonably long, quietly drop it rather than
+         * kernel panicing by calling skb_put.
+         */
+        if (pkt_len > PEGASUS_MTU)
+                goto goon;
+
+        /*
          * at this point we are sure pegasus->rx_skb != NULL
          * so we go ahead and pass up the packet.
          */
@@ -886,15 +893,17 @@ static inline void get_interrupt_interval(pegasus_t * pegasus)
         __u8 data[2];
 
         read_eprom_word(pegasus, 4, (__u16 *) data);
-        if (data[1] < 0x80) {
-                if (netif_msg_timer(pegasus))
-                        dev_info(&pegasus->intf->dev,
-                                "intr interval changed from %ums to %ums\n",
-                                data[1], 0x80);
-                data[1] = 0x80;
-#ifdef  PEGASUS_WRITE_EEPROM
-                write_eprom_word(pegasus, 4, *(__u16 *) data);
+        if (pegasus->usb->speed != USB_SPEED_HIGH) {
+                if (data[1] < 0x80) {
+                        if (netif_msg_timer(pegasus))
+                                dev_info(&pegasus->intf->dev, "intr interval "
+                                        "changed from %ums to %ums\n",
+                                        data[1], 0x80);
+                        data[1] = 0x80;
+#ifdef PEGASUS_WRITE_EEPROM
+                        write_eprom_word(pegasus, 4, *(__u16 *) data);
 #endif
+                }
         }
         pegasus->intr_interval = data[1];
 }
@@ -904,8 +913,9 @@ static void set_carrier(struct net_device *net)
         pegasus_t *pegasus = netdev_priv(net);
         u16 tmp;
 
-        if (read_mii_word(pegasus, pegasus->phy, MII_BMSR, &tmp))
+        if (!read_mii_word(pegasus, pegasus->phy, MII_BMSR, &tmp))
                 return;
+
         if (tmp & BMSR_LSTATUS)
                 netif_carrier_on(net);
         else
@@ -1355,6 +1365,7 @@ static void pegasus_disconnect(struct usb_interface *intf)
         cancel_delayed_work(&pegasus->carrier_check);
         unregister_netdev(pegasus->net);
         usb_put_dev(interface_to_usbdev(intf));
+        unlink_all_urbs(pegasus);
         free_all_urbs(pegasus);
         free_skb_pool(pegasus);
         if (pegasus->rx_skb)
diff --git a/drivers/usb/serial/airprime.c b/drivers/usb/serial/airprime.c
index a4ce0008d69b..926d4c2c1600 100644
--- a/drivers/usb/serial/airprime.c
+++ b/drivers/usb/serial/airprime.c
@@ -16,7 +16,8 @@
 #include "usb-serial.h"
 
 static struct usb_device_id id_table [] = {
-        { USB_DEVICE(0xf3d, 0x0112) },
+        { USB_DEVICE(0xf3d, 0x0112) },  /* AirPrime CDMA Wireless PC Card */
+        { USB_DEVICE(0x1410, 0x1110) }, /* Novatel Wireless Merlin CDMA */
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 4e434cb10bb1..5a8631c8a4a7 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1846,10 +1846,12 @@ static void ftdi_set_termios (struct usb_serial_port *port, struct termios *old_
         } else {
                 /* set the baudrate determined before */
                 if (change_speed(port)) {
-                        err("%s urb failed to set baurdrate", __FUNCTION__);
+                        err("%s urb failed to set baudrate", __FUNCTION__);
+                }
+                /* Ensure RTS and DTR are raised when baudrate changed from 0 */
+                if ((old_termios->c_cflag & CBAUD) == B0) {
+                        set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
                 }
-                /* Ensure  RTS and DTR are raised */
-                set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
         }
 
         /* Set flow control */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 92d0f925d053..4989e5740d18 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -25,6 +25,9 @@
   2005-06-20  v0.4.1 add missing braces :-/
                      killed end-of-line whitespace
   2005-07-15  v0.4.2 rename WLAN product to FUSION, add FUSION2
+  2005-09-10  v0.4.3 added HUAWEI E600 card and Audiovox AirCard
+  2005-09-20  v0.4.4 increased recv buffer size: the card sometimes
+                     wants to send >2000 bytes.
 
   Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
 
@@ -71,15 +74,21 @@ static int  option_send_setup(struct usb_serial_port *port);
 
 /* Vendor and product IDs */
 #define OPTION_VENDOR_ID                        0x0AF0
+#define HUAWEI_VENDOR_ID                        0x12D1
+#define AUDIOVOX_VENDOR_ID                      0x0F3D
 
 #define OPTION_PRODUCT_OLD              0x5000
 #define OPTION_PRODUCT_FUSION   0x6000
 #define OPTION_PRODUCT_FUSION2  0x6300
+#define HUAWEI_PRODUCT_E600     0x1001
+#define AUDIOVOX_PRODUCT_AIRCARD 0x0112
 
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_OLD) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION2) },
+        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
+        { USB_DEVICE(AUDIOVOX_VENDOR_ID, AUDIOVOX_PRODUCT_AIRCARD) },
         { } /* Terminating entry */
 };
 
@@ -132,7 +141,7 @@ static int debug;
 
 #define N_IN_URB 4
 #define N_OUT_URB 1
-#define IN_BUFLEN 1024
+#define IN_BUFLEN 4096
 #define OUT_BUFLEN 128
 
 struct option_port_private {
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 615874e03ce8..1cd942abb580 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -650,6 +650,7 @@ config FB_NVIDIA
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
+        select FB_SOFT_CURSOR
         help
           This driver supports graphics boards with the nVidia chips, TNT
           and newer. For very old chipsets, such as the RIVA128, then use
@@ -753,7 +754,8 @@ config FB_I810_GTF
 
 config FB_I810_I2C
         bool "Enable DDC Support"
-        depends on FB_I810 && I2C && FB_I810_GTF
+        depends on FB_I810 && FB_I810_GTF
+        select I2C
         select I2C_ALGOBIT
         help
 
@@ -766,6 +768,7 @@ config FB_INTEL
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
+        select FB_SOFT_CURSOR
         help
           This driver supports the on-board graphics built in to the Intel
           830M/845G/852GM/855GM/865G chipsets.
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index 046b47860266..8a24a66d9ba8 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -475,7 +475,7 @@ static int __devinit radeon_probe_pll_params(struct radeonfb_info *rinfo)
          */
 
         /* Flush PCI buffers ? */
-        tmp = INREG(DEVICE_ID);
+        tmp = INREG16(DEVICE_ID);
 
         local_irq_disable();
 
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index 59a1b6f85067..097d668c4fe5 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -62,9 +62,9 @@ static void radeon_pm_disable_dynamic_mode(struct radeonfb_info *rinfo)
                 OUTPLL(pllSCLK_CNTL, tmp);
                 return;
         }
-        /* RV350 (M10) */
+        /* RV350 (M10/M11) */
         if (rinfo->family == CHIP_FAMILY_RV350) {
-                /* for RV350/M10, no delays are required. */
+                /* for RV350/M10/M11, no delays are required. */
                 tmp = INPLL(pllSCLK_CNTL2);
                 tmp |= (SCLK_CNTL2__R300_FORCE_TCL |
                         SCLK_CNTL2__R300_FORCE_GA  |
@@ -248,7 +248,7 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
                 return;
         }
 
-        /* M10 */
+        /* M10/M11 */
         if (rinfo->family == CHIP_FAMILY_RV350) {
                 tmp = INPLL(pllSCLK_CNTL2);
                 tmp &= ~(SCLK_CNTL2__R300_FORCE_TCL |
@@ -1155,7 +1155,7 @@ static void radeon_pm_full_reset_sdram(struct radeonfb_info *rinfo)
         OUTREG( CRTC_GEN_CNTL,  (crtcGenCntl | CRTC_GEN_CNTL__CRTC_DISP_REQ_EN_B) );
         OUTREG( CRTC2_GEN_CNTL, (crtcGenCntl2 | CRTC2_GEN_CNTL__CRTC2_DISP_REQ_EN_B) );
   
-        /* This is the code for the Aluminium PowerBooks M10 */
+        /* This is the code for the Aluminium PowerBooks M10 / iBooks M11 */
         if (rinfo->family == CHIP_FAMILY_RV350) {
                 u32 sdram_mode_reg = rinfo->save_regs[35];
                 static u32 default_mrtable[] =
@@ -2741,9 +2741,11 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
                         rinfo->pm_mode |= radeon_pm_d2;
 
                 /* We can restart Jasper (M10 chip in albooks), BlueStone (7500 chip
-                 * in some desktop G4s), and Via (M9+ chip on iBook G4)
+                 * in some desktop G4s), Via (M9+ chip on iBook G4) and
+                 * Snowy (M11 chip on iBook G4 manufactured after July 2005)
                  */
-                if (!strcmp(rinfo->of_node->name, "ATY,JasperParent")) {
+                if (!strcmp(rinfo->of_node->name, "ATY,JasperParent") ||
+                    !strcmp(rinfo->of_node->name, "ATY,SnowyParent")) {
                         rinfo->reinit_func = radeon_reinitialize_M10;
                         rinfo->pm_mode |= radeon_pm_off;
                 }
diff --git a/drivers/video/aty/radeonfb.h b/drivers/video/aty/radeonfb.h
index 659bc9f62244..01b8b2f78514 100644
--- a/drivers/video/aty/radeonfb.h
+++ b/drivers/video/aty/radeonfb.h
@@ -395,6 +395,8 @@ static inline void _radeon_msleep(struct radeonfb_info *rinfo, unsigned long ms)
 
 #define INREG8(addr)            readb((rinfo->mmio_base)+addr)
 #define OUTREG8(addr,val)       writeb(val, (rinfo->mmio_base)+addr)
+#define INREG16(addr)           readw((rinfo->mmio_base)+addr)
+#define OUTREG16(addr,val)      writew(val, (rinfo->mmio_base)+addr)
 #define INREG(addr)             readl((rinfo->mmio_base)+addr)
 #define OUTREG(addr,val)        writel(val, (rinfo->mmio_base)+addr)
 
diff --git a/drivers/video/aty/xlinit.c b/drivers/video/aty/xlinit.c
index 92643af12581..a085cbf74ecb 100644
--- a/drivers/video/aty/xlinit.c
+++ b/drivers/video/aty/xlinit.c
@@ -174,7 +174,7 @@ int atyfb_xl_init(struct fb_info *info)
         const struct xl_card_cfg_t * card = &card_cfg[xl_card];
         struct atyfb_par *par = (struct atyfb_par *) info->par;
         union aty_pll pll;
-        int i, err;
+        int err;
         u32 temp;
         
         aty_st_8(CONFIG_STAT0, 0x85, par);
@@ -252,9 +252,14 @@ int atyfb_xl_init(struct fb_info *info)
         aty_st_le32(0xEC, 0x00000000, par);
         aty_st_le32(0xFC, 0x00000000, par);
 
-        for (i=0; i<sizeof(lcd_tbl)/sizeof(lcd_tbl_t); i++) {
-                aty_st_lcd(lcd_tbl[i].lcd_reg, lcd_tbl[i].val, par);
+#if defined (CONFIG_FB_ATY_GENERIC_LCD)
+        {
+                int i;
+
+                for (i = 0; i < ARRAY_SIZE(lcd_tbl); i++)
+                        aty_st_lcd(lcd_tbl[i].lcd_reg, lcd_tbl[i].val, par);
         }
+#endif
 
         aty_st_le16(CONFIG_STAT0, 0x00A4, par);
         mdelay(10);
diff --git a/drivers/video/backlight/corgi_bl.c b/drivers/video/backlight/corgi_bl.c
index 353cb3f73cf2..3c72c627e65e 100644
--- a/drivers/video/backlight/corgi_bl.c
+++ b/drivers/video/backlight/corgi_bl.c
@@ -19,17 +19,17 @@
 #include <linux/fb.h>
 #include <linux/backlight.h>
 
-#include <asm/arch-pxa/corgi.h>
-#include <asm/hardware/scoop.h>
+#include <asm/arch/sharpsl.h>
 
-#define CORGI_MAX_INTENSITY             0x3e
 #define CORGI_DEFAULT_INTENSITY         0x1f
-#define CORGI_LIMIT_MASK                        0x0b
+#define CORGI_LIMIT_MASK                0x0b
 
 static int corgibl_powermode = FB_BLANK_UNBLANK;
 static int current_intensity = 0;
 static int corgibl_limit = 0;
+static void (*corgibl_mach_set_intensity)(int intensity);
 static spinlock_t bl_lock = SPIN_LOCK_UNLOCKED;
+static struct backlight_properties corgibl_data;
 
 static void corgibl_send_intensity(int intensity)
 {
@@ -43,18 +43,10 @@ static void corgibl_send_intensity(int intensity)
                         intensity &= CORGI_LIMIT_MASK;
         }
 
-        /* Skip 0x20 as it will blank the display */
-        if (intensity >= 0x20)
-                intensity++;
-
         spin_lock_irqsave(&bl_lock, flags);
-        /* Bits 0-4 are accessed via the SSP interface */
-        corgi_ssp_blduty_set(intensity & 0x1f);
-        /* Bit 5 is via SCOOP */
-        if (intensity & 0x0020)
-                set_scoop_gpio(&corgiscoop_device.dev, CORGI_SCP_BACKLIGHT_CONT);
-        else
-                reset_scoop_gpio(&corgiscoop_device.dev, CORGI_SCP_BACKLIGHT_CONT);
+
+        corgibl_mach_set_intensity(intensity);
+
         spin_unlock_irqrestore(&bl_lock, flags);
 }
 
@@ -113,8 +105,8 @@ static int corgibl_get_power(struct backlight_device *bd)
 
 static int corgibl_set_intensity(struct backlight_device *bd, int intensity)
 {
-        if (intensity > CORGI_MAX_INTENSITY)
-                intensity = CORGI_MAX_INTENSITY;
+        if (intensity > corgibl_data.max_brightness)
+                intensity = corgibl_data.max_brightness;
         corgibl_send_intensity(intensity);
         current_intensity=intensity;
         return 0;
@@ -141,7 +133,6 @@ static struct backlight_properties corgibl_data = {
         .owner          = THIS_MODULE,
         .get_power      = corgibl_get_power,
         .set_power      = corgibl_set_power,
-        .max_brightness = CORGI_MAX_INTENSITY,
         .get_brightness = corgibl_get_intensity,
         .set_brightness = corgibl_set_intensity,
 };
@@ -150,12 +141,18 @@ static struct backlight_device *corgi_backlight_device;
 
 static int __init corgibl_probe(struct device *dev)
 {
+        struct corgibl_machinfo *machinfo = dev->platform_data;
+
+        corgibl_data.max_brightness = machinfo->max_intensity;
+        corgibl_mach_set_intensity = machinfo->set_bl_intensity;
+
         corgi_backlight_device = backlight_device_register ("corgi-bl",
                 NULL, &corgibl_data);
         if (IS_ERR (corgi_backlight_device))
                 return PTR_ERR (corgi_backlight_device);
 
         corgibl_set_intensity(NULL, CORGI_DEFAULT_INTENSITY);
+        corgibl_limit_intensity(0);
 
         printk("Corgi Backlight Driver Initialized.\n");
         return 0;
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 2e93224d2d55..0fc8bb499c3f 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -767,7 +767,7 @@ static const char *fbcon_startup(void)
         const char *display_desc = "frame buffer device";
         struct display *p = &fb_display[fg_console];
         struct vc_data *vc = vc_cons[fg_console].d;
-        struct font_desc *font = NULL;
+        const struct font_desc *font = NULL;
         struct module *owner;
         struct fb_info *info = NULL;
         struct fbcon_ops *ops;
@@ -841,7 +841,7 @@ static const char *fbcon_startup(void)
                                                 info->var.yres);
                 vc->vc_font.width = font->width;
                 vc->vc_font.height = font->height;
-                vc->vc_font.data = p->fontdata = font->data;
+                vc->vc_font.data = (void *)(p->fontdata = font->data);
                 vc->vc_font.charcount = 256; /* FIXME  Need to support more fonts */
         }
 
@@ -941,7 +941,7 @@ static void fbcon_init(struct vc_data *vc, int init)
            fb, copy the font from that console */
         t = &fb_display[svc->vc_num];
         if (!vc->vc_font.data) {
-                vc->vc_font.data = p->fontdata = t->fontdata;
+                vc->vc_font.data = (void *)(p->fontdata = t->fontdata);
                 vc->vc_font.width = (*default_mode)->vc_font.width;
                 vc->vc_font.height = (*default_mode)->vc_font.height;
                 p->userfont = t->userfont;
@@ -1188,7 +1188,7 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var,
                 return;
         t = &fb_display[svc->vc_num];
         if (!vc->vc_font.data) {
-                vc->vc_font.data = p->fontdata = t->fontdata;
+                vc->vc_font.data = (void *)(p->fontdata = t->fontdata);
                 vc->vc_font.width = (*default_mode)->vc_font.width;
                 vc->vc_font.height = (*default_mode)->vc_font.height;
                 p->userfont = t->userfont;
@@ -1687,6 +1687,8 @@ static int fbcon_scroll(struct vc_data *vc, int t, int b, int dir,
         case SM_DOWN:
                 if (count > vc->vc_rows)        /* Maximum realistic size */
                         count = vc->vc_rows;
+                if (logo_shown >= 0)
+                        goto redraw_down;
                 switch (p->scrollmode) {
                 case SCROLL_MOVE:
                         ops->bmove(vc, info, t, 0, t + count, 0,
@@ -2148,7 +2150,7 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
 }
 
 static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
-                             u8 * data, int userfont)
+                             const u8 * data, int userfont)
 {
         struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
         struct display *p = &fb_display[vc->vc_num];
@@ -2166,7 +2168,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
                 cnt = FNTCHARCNT(data);
         else
                 cnt = 256;
-        vc->vc_font.data = p->fontdata = data;
+        vc->vc_font.data = (void *)(p->fontdata = data);
         if ((p->userfont = userfont))
                 REFCOUNT(data)++;
         vc->vc_font.width = w;
@@ -2323,7 +2325,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne
                     tmp->vc_font.width == w &&
                     !memcmp(fb_display[i].fontdata, new_data, size)) {
                         kfree(new_data - FONT_EXTRA_WORDS * sizeof(int));
-                        new_data = fb_display[i].fontdata;
+                        new_data = (u8 *)fb_display[i].fontdata;
                         break;
                 }
         }
@@ -2333,7 +2335,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne
 static int fbcon_set_def_font(struct vc_data *vc, struct console_font *font, char *name)
 {
         struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
-        struct font_desc *f;
+        const struct font_desc *f;
 
         if (!name)
                 f = get_default_font(info->var.xres, info->var.yres);
diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h
index 08befafe11d1..0738cd62def2 100644
--- a/drivers/video/console/fbcon.h
+++ b/drivers/video/console/fbcon.h
@@ -30,7 +30,7 @@ struct display {
     /* Filled in by the frame buffer device */
     u_short inverse;                /* != 0 text black on white as default */
     /* Filled in by the low-level console driver */
-    u_char *fontdata;
+    const u_char *fontdata;
     int userfont;                   /* != 0 if fontdata kmalloc()ed */
     u_short scrollmode;             /* Scroll Method */
     short yscroll;                  /* Hardware scrolling */
diff --git a/drivers/video/console/font_10x18.c b/drivers/video/console/font_10x18.c
index ff0af96e4dfc..e6aa0eab5bb6 100644
--- a/drivers/video/console/font_10x18.c
+++ b/drivers/video/console/font_10x18.c
@@ -7,7 +7,7 @@
 
 #define FONTDATAMAX 9216
 
-static unsigned char fontdata_10x18[FONTDATAMAX] = {
+static const unsigned char fontdata_10x18[FONTDATAMAX] = {
 
         /* 0 0x00 '^@' */
         0x00, 0x00, /* 0000000000 */
@@ -5132,7 +5132,7 @@ static unsigned char fontdata_10x18[FONTDATAMAX] = {
 };
 
 
-struct font_desc font_10x18 = {
+const struct font_desc font_10x18 = {
         FONT10x18_IDX,
         "10x18",
         10,
diff --git a/drivers/video/console/font_6x11.c b/drivers/video/console/font_6x11.c
index c52f1294044a..89976cd97494 100644
--- a/drivers/video/console/font_6x11.c
+++ b/drivers/video/console/font_6x11.c
@@ -8,7 +8,7 @@
 
 #define FONTDATAMAX (11*256)
 
-static unsigned char fontdata_6x11[FONTDATAMAX] = {
+static const unsigned char fontdata_6x11[FONTDATAMAX] = {
 
         /* 0 0x00 '^@' */
         0x00, /* 00000000 */
@@ -3341,7 +3341,7 @@ static unsigned char fontdata_6x11[FONTDATAMAX] = {
 };
 
 
-struct font_desc font_vga_6x11 = {
+const struct font_desc font_vga_6x11 = {
         VGA6x11_IDX,
         "ProFont6x11",
         6,
diff --git a/drivers/video/console/font_7x14.c b/drivers/video/console/font_7x14.c
index 1fa7fcf2ff72..bbf116647397 100644
--- a/drivers/video/console/font_7x14.c
+++ b/drivers/video/console/font_7x14.c
@@ -7,7 +7,7 @@
 
 #define FONTDATAMAX 3584
 
-static unsigned char fontdata_7x14[FONTDATAMAX] = {
+static const unsigned char fontdata_7x14[FONTDATAMAX] = {
 
         /* 0 0x00 '^@' */
         0x00, /* 0000000 */
@@ -4108,7 +4108,7 @@ static unsigned char fontdata_7x14[FONTDATAMAX] = {
 };
 
 
-struct font_desc font_7x14 = {
+const struct font_desc font_7x14 = {
         FONT7x14_IDX,
         "7x14",
         7,
diff --git a/drivers/video/console/font_8x16.c b/drivers/video/console/font_8x16.c
index e6f8dbaa122b..74fe86f28ff4 100644
--- a/drivers/video/console/font_8x16.c
+++ b/drivers/video/console/font_8x16.c
@@ -8,7 +8,7 @@
 
 #define FONTDATAMAX 4096
 
-static unsigned char fontdata_8x16[FONTDATAMAX] = {
+static const unsigned char fontdata_8x16[FONTDATAMAX] = {
 
         /* 0 0x00 '^@' */
         0x00, /* 00000000 */
@@ -4621,7 +4621,7 @@ static unsigned char fontdata_8x16[FONTDATAMAX] = {
 };
 
 
-struct font_desc font_vga_8x16 = {
+const struct font_desc font_vga_8x16 = {
         VGA8x16_IDX,
         "VGA8x16",
         8,
diff --git a/drivers/video/console/font_8x8.c b/drivers/video/console/font_8x8.c
index 57fbe266a6b9..26199f8ee908 100644
--- a/drivers/video/console/font_8x8.c
+++ b/drivers/video/console/font_8x8.c
@@ -8,7 +8,7 @@
 
 #define FONTDATAMAX 2048
 
-static unsigned char fontdata_8x8[FONTDATAMAX] = {
+static const unsigned char fontdata_8x8[FONTDATAMAX] = {
 
         /* 0 0x00 '^@' */
         0x00, /* 00000000 */
@@ -2573,7 +2573,7 @@ static unsigned char fontdata_8x8[FONTDATAMAX] = {
 };
 
 
-struct font_desc font_vga_8x8 = {
+const struct font_desc font_vga_8x8 = {
         VGA8x8_IDX,
         "VGA8x8",
         8,
diff --git a/drivers/video/console/font_acorn_8x8.c b/drivers/video/console/font_acorn_8x8.c
index d565505e3069..2d2e39632e2d 100644
--- a/drivers/video/console/font_acorn_8x8.c
+++ b/drivers/video/console/font_acorn_8x8.c
@@ -3,7 +3,7 @@
 #include <linux/config.h>
 #include <linux/font.h>
 
-static unsigned char acorndata_8x8[] = {
+static const unsigned char acorndata_8x8[] = {
 /* 00 */  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */
 /* 01 */  0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */
 /* 02 */  0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */
@@ -262,7 +262,7 @@ static unsigned char acorndata_8x8[] = {
 /* FF */  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
-struct font_desc font_acorn_8x8 = {
+const struct font_desc font_acorn_8x8 = {
         ACORN8x8_IDX,
         "Acorn8x8",
         8,
diff --git a/drivers/video/console/font_mini_4x6.c b/drivers/video/console/font_mini_4x6.c
index 593b95500a0c..d818234fdf11 100644
--- a/drivers/video/console/font_mini_4x6.c
+++ b/drivers/video/console/font_mini_4x6.c
@@ -43,7 +43,7 @@ __END__;
 
 #define FONTDATAMAX 1536
 
-static unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
+static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
 
         /*{*/
                 /*   Char 0: ' '  */
@@ -2147,7 +2147,7 @@ static unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
         /*}*/
 };
 
-struct font_desc font_mini_4x6 = {
+const struct font_desc font_mini_4x6 = {
         MINI4x6_IDX,
         "MINI4x6",
         4,
diff --git a/drivers/video/console/font_pearl_8x8.c b/drivers/video/console/font_pearl_8x8.c
index 5fa95f118818..e646c88f55c7 100644
--- a/drivers/video/console/font_pearl_8x8.c
+++ b/drivers/video/console/font_pearl_8x8.c
@@ -13,7 +13,7 @@
 
 #define FONTDATAMAX 2048
 
-static unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
+static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
 
    /* 0 0x00 '^@' */
    0x00, /* 00000000 */
@@ -2577,7 +2577,7 @@ static unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
 
 };
 
-struct font_desc font_pearl_8x8 = {
+const struct font_desc font_pearl_8x8 = {
         PEARL8x8_IDX,
         "PEARL8x8",
         8,
diff --git a/drivers/video/console/font_sun12x22.c b/drivers/video/console/font_sun12x22.c
index c7bd967ea100..ab5eb93407b4 100644
--- a/drivers/video/console/font_sun12x22.c
+++ b/drivers/video/console/font_sun12x22.c
@@ -2,7 +2,7 @@
 
 #define FONTDATAMAX 11264
 
-static unsigned char fontdata_sun12x22[FONTDATAMAX] = {
+static const unsigned char fontdata_sun12x22[FONTDATAMAX] = {
 
         /* 0 0x00 '^@' */
         0x00, 0x00, /* 000000000000 */
@@ -6151,7 +6151,7 @@ static unsigned char fontdata_sun12x22[FONTDATAMAX] = {
 };
 
 
-struct font_desc font_sun_12x22 = {
+const struct font_desc font_sun_12x22 = {
         SUN12x22_IDX,
         "SUN12x22",
         12,
diff --git a/drivers/video/console/font_sun8x16.c b/drivers/video/console/font_sun8x16.c
index 2af3ab354652..41f910f5529c 100644
--- a/drivers/video/console/font_sun8x16.c
+++ b/drivers/video/console/font_sun8x16.c
@@ -2,7 +2,7 @@
 
 #define FONTDATAMAX 4096
 
-static unsigned char fontdata_sun8x16[FONTDATAMAX] = {
+static const unsigned char fontdata_sun8x16[FONTDATAMAX] = {
 /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
 /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00,
 /* */ 0x00,0x00,0x7e,0xff,0xdb,0xff,0xff,0xc3,0xe7,0xff,0xff,0x7e,0x00,0x00,0x00,0x00,
@@ -261,7 +261,7 @@ static unsigned char fontdata_sun8x16[FONTDATAMAX] = {
 /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
 };
 
-struct font_desc font_sun_8x16 = {
+const struct font_desc font_sun_8x16 = {
         SUN8x16_IDX,
         "SUN8x16",
         8,
diff --git a/drivers/video/console/fonts.c b/drivers/video/console/fonts.c
index e79b29702649..4fd07d9eca03 100644
--- a/drivers/video/console/fonts.c
+++ b/drivers/video/console/fonts.c
@@ -23,7 +23,7 @@
 
 #define NO_FONTS
 
-static struct font_desc *fonts[] = {
+static const struct font_desc *fonts[] = {
 #ifdef CONFIG_FONT_8x8
 #undef NO_FONTS
     &font_vga_8x8,
@@ -84,7 +84,7 @@ static struct font_desc *fonts[] = {
  *
  */
 
-struct font_desc *find_font(char *name)
+const struct font_desc *find_font(const char *name)
 {
    unsigned int i;
 
@@ -108,10 +108,10 @@ struct font_desc *find_font(char *name)
  *
  */
 
-struct font_desc *get_default_font(int xres, int yres)
+const struct font_desc *get_default_font(int xres, int yres)
 {
     int i, c, cc;
-    struct font_desc *f, *g;
+    const struct font_desc *f, *g;
 
     g = NULL;
     cc = -10000;
@@ -138,7 +138,6 @@ struct font_desc *get_default_font(int xres, int yres)
     return g;
 }
 
-EXPORT_SYMBOL(fonts);
 EXPORT_SYMBOL(find_font);
 EXPORT_SYMBOL(get_default_font);
 
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 0705cd741411..6ef6f7760e47 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -1020,7 +1020,9 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font)
 static int vgacon_resize(struct vc_data *c, unsigned int width,
                                 unsigned int height)
 {
-        if (width % 2 || width > ORIG_VIDEO_COLS || height > ORIG_VIDEO_LINES)
+        if (width % 2 || width > ORIG_VIDEO_COLS ||
+            height > (ORIG_VIDEO_LINES * vga_default_font_height)/
+            c->vc_font.height)
                 return -EINVAL;
 
         if (CON_IS_VISIBLE(c) && !vga_is_gfx) /* who knows */
diff --git a/drivers/video/cyblafb.c b/drivers/video/cyblafb.c
index ae2762cb5608..6992100a508c 100644
--- a/drivers/video/cyblafb.c
+++ b/drivers/video/cyblafb.c
@@ -410,20 +410,21 @@ static void cyblafb_imageblit(struct fb_info *info,
         out32(GE0C,point(image->dx+image->width-1,image->dy+image->height-1));
 
         while(index < index_end) {
+                const char *p = image->data + index;
                 for(i=0;i<width_dds;i++) {
-                        out32(GE9C,*((u32*) ((u32)image->data + index)));
+                        out32(GE9C,*(u32*)p);
+                        p+=4;
                         index+=4;
                 }
                 switch(width_dbs) {
                 case 0: break;
-                case 8: out32(GE9C,*((u8*)((u32)image->data+index)));
+                case 8: out32(GE9C,*(u8*)p);
                         index+=1;
                         break;
-                case 16: out32(GE9C,*((u16*)((u32)image->data+index)));
+                case 16: out32(GE9C,*(u16*)p);
                         index+=2;
                         break;
-                case 24: out32(GE9C,(u32)(*((u16*)((u32)image->data+index))) |
-                               (u32)(*((u8*)((u32)image->data+index+2)))<<16);
+                case 24: out32(GE9C,*(u16*)p | *(u8*)(p+2)<<16);
                         index+=3;
                         break;
                 }
diff --git a/drivers/video/fbcvt.c b/drivers/video/fbcvt.c
index cfa61b512de0..0b6af00d197e 100644
--- a/drivers/video/fbcvt.c
+++ b/drivers/video/fbcvt.c
@@ -272,11 +272,11 @@ static void fb_cvt_convert_to_mode(struct fb_cvt_data *cvt,
 {
         mode->refresh = cvt->f_refresh;
         mode->pixclock = KHZ2PICOS(cvt->pixclock/1000);
-        mode->left_margin = cvt->h_front_porch;
-        mode->right_margin = cvt->h_back_porch;
+        mode->left_margin = cvt->h_back_porch;
+        mode->right_margin = cvt->h_front_porch;
         mode->hsync_len = cvt->hsync;
-        mode->upper_margin = cvt->v_front_porch;
-        mode->lower_margin = cvt->v_back_porch;
+        mode->upper_margin = cvt->v_back_porch;
+        mode->lower_margin = cvt->v_front_porch;
         mode->vsync_len = cvt->vsync;
 
         mode->sync &= ~(FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT);
diff --git a/drivers/video/i810/i810-i2c.c b/drivers/video/i810/i810-i2c.c
index fda53aac1fc1..689d2586366d 100644
--- a/drivers/video/i810/i810-i2c.c
+++ b/drivers/video/i810/i810-i2c.c
@@ -44,7 +44,7 @@ static void i810i2c_setscl(void *data, int state)
 {
         struct i810fb_i2c_chan    *chan = (struct i810fb_i2c_chan *)data;
         struct i810fb_par         *par = chan->par;
-        u8                        *mmio = par->mmio_start_virtual;
+        u8                        __iomem *mmio = par->mmio_start_virtual;
 
         i810_writel(mmio, GPIOB, (state ? SCL_VAL_OUT : 0) | SCL_DIR |
                     SCL_DIR_MASK | SCL_VAL_MASK);
@@ -55,7 +55,7 @@ static void i810i2c_setsda(void *data, int state)
 {
         struct i810fb_i2c_chan    *chan = (struct i810fb_i2c_chan *)data;
         struct i810fb_par         *par = chan->par;
-        u8                        *mmio = par->mmio_start_virtual;
+        u8                        __iomem *mmio = par->mmio_start_virtual;
 
         i810_writel(mmio, GPIOB, (state ? SDA_VAL_OUT : 0) | SDA_DIR |
                     SDA_DIR_MASK | SDA_VAL_MASK);
@@ -66,7 +66,7 @@ static int i810i2c_getscl(void *data)
 {
         struct i810fb_i2c_chan    *chan = (struct i810fb_i2c_chan *)data;
         struct i810fb_par         *par = chan->par;
-        u8                        *mmio = par->mmio_start_virtual;
+        u8                        __iomem *mmio = par->mmio_start_virtual;
 
         i810_writel(mmio, GPIOB, SCL_DIR_MASK);
         i810_writel(mmio, GPIOB, 0);
@@ -77,7 +77,7 @@ static int i810i2c_getsda(void *data)
 {
         struct i810fb_i2c_chan    *chan = (struct i810fb_i2c_chan *)data;
         struct i810fb_par         *par = chan->par;
-        u8                        *mmio = par->mmio_start_virtual;
+        u8                        __iomem *mmio = par->mmio_start_virtual;
 
         i810_writel(mmio, GPIOB, SDA_DIR_MASK);
         i810_writel(mmio, GPIOB, 0);
@@ -88,7 +88,7 @@ static void i810ddc_setscl(void *data, int state)
 {
         struct i810fb_i2c_chan    *chan = (struct i810fb_i2c_chan *)data;
         struct i810fb_par       *par = chan->par;
-        u8                      *mmio = par->mmio_start_virtual;
+        u8                      __iomem *mmio = par->mmio_start_virtual;
 
         i810_writel(mmio, GPIOA, (state ? SCL_VAL_OUT : 0) | SCL_DIR |
                     SCL_DIR_MASK | SCL_VAL_MASK);
@@ -99,7 +99,7 @@ static void i810ddc_setsda(void *data, int state)
 {
         struct i810fb_i2c_chan    *chan = (struct i810fb_i2c_chan *)data;
         struct i810fb_par         *par = chan->par;
-        u8                      *mmio = par->mmio_start_virtual;
+        u8                      __iomem *mmio = par->mmio_start_virtual;
 
         i810_writel(mmio, GPIOA, (state ? SDA_VAL_OUT : 0) | SDA_DIR |
                     SDA_DIR_MASK | SDA_VAL_MASK);
@@ -110,7 +110,7 @@ static int i810ddc_getscl(void *data)
 {
         struct i810fb_i2c_chan    *chan = (struct i810fb_i2c_chan *)data;
         struct i810fb_par         *par = chan->par;
-        u8                      *mmio = par->mmio_start_virtual;
+        u8                      __iomem *mmio = par->mmio_start_virtual;
 
         i810_writel(mmio, GPIOA, SCL_DIR_MASK);
         i810_writel(mmio, GPIOA, 0);
@@ -121,7 +121,7 @@ static int i810ddc_getsda(void *data)
 {
         struct i810fb_i2c_chan    *chan = (struct i810fb_i2c_chan *)data;
         struct i810fb_par         *par = chan->par;
-        u8                      *mmio = par->mmio_start_virtual;
+        u8                      __iomem *mmio = par->mmio_start_virtual;
 
         i810_writel(mmio, GPIOA, SDA_DIR_MASK);
         i810_writel(mmio, GPIOA, 0);
diff --git a/drivers/video/imxfb.c b/drivers/video/imxfb.c
index cabd53cec991..1d54d3d6960b 100644
--- a/drivers/video/imxfb.c
+++ b/drivers/video/imxfb.c
@@ -36,7 +36,6 @@
 
 #include <asm/hardware.h>
 #include <asm/io.h>
-#include <asm/mach-types.h>
 #include <asm/uaccess.h>
 #include <asm/arch/imxfb.h>
 
@@ -425,7 +424,7 @@ static void imxfb_setup_gpio(struct imxfb_info *fbi)
  * Power management hooks.  Note that we won't be called from IRQ context,
  * unlike the blank functions above, so we may sleep.
  */
-static int imxfb_suspend(struct device *dev, u32 state, u32 level)
+static int imxfb_suspend(struct device *dev, pm_message_t state, u32 level)
 {
         struct imxfb_info *fbi = dev_get_drvdata(dev);
         pr_debug("%s\n",__FUNCTION__);
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index bf62e6ed0382..80a09344f1aa 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -226,7 +226,7 @@ MODULE_DEVICE_TABLE(pci, intelfb_pci_table);
 
 static int accel        = 1;
 static int vram         = 4;
-static int hwcursor     = 1;
+static int hwcursor     = 0;
 static int mtrr         = 1;
 static int fixed        = 0;
 static int noinit       = 0;
@@ -609,15 +609,9 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                 dinfo->accel = 0;
         }
 
-        if (MB(voffset) < stolen_size)
-                offset = (stolen_size >> 12);
-        else
-                offset = ROUND_UP_TO_PAGE(MB(voffset))/GTT_PAGE_SIZE;
-
         /* Framebuffer parameters - Use all the stolen memory if >= vram */
-        if (ROUND_UP_TO_PAGE(stolen_size) >= ((offset << 12) +  MB(vram))) {
+        if (ROUND_UP_TO_PAGE(stolen_size) >= MB(vram)) {
                 dinfo->fb.size = ROUND_UP_TO_PAGE(stolen_size);
-                dinfo->fb.offset = 0;
                 dinfo->fbmem_gart = 0;
         } else {
                 dinfo->fb.size =  MB(vram);
@@ -648,6 +642,11 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENODEV;
         }
 
+        if (MB(voffset) < stolen_size)
+                offset = (stolen_size >> 12);
+        else
+                offset = ROUND_UP_TO_PAGE(MB(voffset))/GTT_PAGE_SIZE;
+
         /* set the mem offsets - set them after the already used pages */
         if (dinfo->accel) {
                 dinfo->ring.offset = offset + gtt_info.current_memory;
@@ -662,10 +661,11 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                         + (dinfo->cursor.size >> 12);
         }
 
+        /* Allocate memories (which aren't stolen) */
         /* Map the fb and MMIO regions */
         /* ioremap only up to the end of used aperture */
         dinfo->aperture.virtual = (u8 __iomem *)ioremap_nocache
-                (dinfo->aperture.physical, (dinfo->fb.offset << 12)
+                (dinfo->aperture.physical, ((offset + dinfo->fb.offset) << 12)
                  + dinfo->fb.size);
         if (!dinfo->aperture.virtual) {
                 ERR_MSG("Cannot remap FB region.\n");
@@ -682,7 +682,6 @@ intelfb_pci_register(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENODEV;
         }
 
-        /* Allocate memories (which aren't stolen) */
         if (dinfo->accel) {
                 if (!(dinfo->gtt_ring_mem =
                       agp_allocate_memory(bridge, dinfo->ring.size >> 12,
@@ -1484,7 +1483,7 @@ intelfb_cursor(struct fb_info *info, struct fb_cursor *cursor)
 #endif
 
         if (!dinfo->hwcursor)
-                return -ENXIO;
+                return soft_cursor(info, cursor);
 
         intelfbhw_cursor_hide(dinfo);
 
diff --git a/drivers/video/matrox/matroxfb_base.c b/drivers/video/matrox/matroxfb_base.c
index 98e00d8601e5..e02da41f1b26 100644
--- a/drivers/video/matrox/matroxfb_base.c
+++ b/drivers/video/matrox/matroxfb_base.c
@@ -1285,7 +1285,7 @@ static int matroxfb_getmemory(WPMINFO unsigned int maxSize, unsigned int *realSi
         vaddr_t vm;
         unsigned int offs;
         unsigned int offs2;
-        unsigned char store;
+        unsigned char store, orig;
         unsigned char bytes[32];
         unsigned char* tmp;
 
@@ -1298,7 +1298,8 @@ static int matroxfb_getmemory(WPMINFO unsigned int maxSize, unsigned int *realSi
         if (maxSize > 0x2000000) maxSize = 0x2000000;
 
         mga_outb(M_EXTVGA_INDEX, 0x03);
-        mga_outb(M_EXTVGA_DATA, mga_inb(M_EXTVGA_DATA) | 0x80);
+        orig = mga_inb(M_EXTVGA_DATA);
+        mga_outb(M_EXTVGA_DATA, orig | 0x80);
 
         store = mga_readb(vm, 0x1234);
         tmp = bytes;
@@ -1323,7 +1324,7 @@ static int matroxfb_getmemory(WPMINFO unsigned int maxSize, unsigned int *realSi
         mga_writeb(vm, 0x1234, store);
 
         mga_outb(M_EXTVGA_INDEX, 0x03);
-        mga_outb(M_EXTVGA_DATA, mga_inb(M_EXTVGA_DATA) & ~0x80);
+        mga_outb(M_EXTVGA_DATA, orig);
 
         *realSize = offs - 0x100000;
 #ifdef CONFIG_FB_MATROX_MILLENIUM
@@ -1858,6 +1859,8 @@ static int initMatrox2(WPMINFO struct board* b){
                                                         to yres_virtual * xres_virtual < 2^32 */
         }
         matroxfb_init_fix(PMINFO2);
+        ACCESS_FBINFO(fbcon.screen_base) = vaddr_va(ACCESS_FBINFO(video.vbase));
+        matroxfb_update_fix(PMINFO2);
         /* Normalize values (namely yres_virtual) */
         matroxfb_check_var(&vesafb_defined, &ACCESS_FBINFO(fbcon));
         /* And put it into "current" var. Do NOT program hardware yet, or we'll not take over
@@ -2010,11 +2013,11 @@ static int matroxfb_probe(struct pci_dev* pdev, const struct pci_device_id* dumm
         }
         /* not match... */
         if (!b->vendor)
-                return -1;
+                return -ENODEV;
         if (dev > 0) {
                 /* not requested one... */
                 dev--;
-                return -1;
+                return -ENODEV;
         }
         pci_read_config_dword(pdev, PCI_COMMAND, &cmd);
         if (pci_enable_device(pdev)) {
diff --git a/drivers/video/nvidia/nv_i2c.c b/drivers/video/nvidia/nv_i2c.c
index ace484fa61ce..12f2884d3f0b 100644
--- a/drivers/video/nvidia/nv_i2c.c
+++ b/drivers/video/nvidia/nv_i2c.c
@@ -209,10 +209,13 @@ int nvidia_probe_i2c_connector(struct fb_info *info, int conn, u8 **out_edid)
 
         if (!edid && conn == 1) {
                 /* try to get from firmware */
-                edid = kmalloc(EDID_LENGTH, GFP_KERNEL);
-                if (edid)
-                        memcpy(edid, fb_firmware_edid(info->device),
-                               EDID_LENGTH);
+                const u8 *e = fb_firmware_edid(info->device);
+
+                if (e != NULL) {
+                        edid = kmalloc(EDID_LENGTH, GFP_KERNEL);
+                        if (edid)
+                                memcpy(edid, e, EDID_LENGTH);
+                }
         }
 
         if (out_edid)
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index 3620de0f252e..a7f020ada630 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -893,7 +893,7 @@ static int nvidiafb_cursor(struct fb_info *info, struct fb_cursor *cursor)
         int i, set = cursor->set;
         u16 fg, bg;
 
-        if (!hwcur || cursor->image.width > MAX_CURS || cursor->image.height > MAX_CURS)
+        if (cursor->image.width > MAX_CURS || cursor->image.height > MAX_CURS)
                 return -ENXIO;
 
         NVShowHideCursor(par, 0);
@@ -1356,6 +1356,9 @@ static int __devinit nvidia_set_fbinfo(struct fb_info *info)
         info->pixmap.size = 8 * 1024;
         info->pixmap.flags = FB_PIXMAP_SYSTEM;
 
+        if (!hwcur)
+            info->fbops->fb_cursor = soft_cursor;
+
         info->var.accel_flags = (!noaccel);
 
         switch (par->Architecture) {
diff --git a/drivers/video/pm3fb.c b/drivers/video/pm3fb.c
index e0dad948467b..2e11b601c488 100644
--- a/drivers/video/pm3fb.c
+++ b/drivers/video/pm3fb.c
@@ -67,6 +67,7 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/ioport.h>
+#include <linux/ctype.h>
 
 #include <video/fbcon.h>
 #include <video/fbcon-mfb.h>
@@ -2594,7 +2595,7 @@ static char *pm3fb_boardnum_setup(char *options, unsigned long *bn)
 {
         char *next;
 
-        if (!(CHAR_IS_NUM(options[0]))) {
+        if (!(isdigit(options[0]))) {
                 (*bn) = 0;
                 return (options);
         }
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 34d4dcc0320a..194eed0a238c 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -260,9 +260,9 @@ static int pxafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
         }
 
 #ifdef CONFIG_CPU_FREQ
-        DPRINTK("dma period = %d ps, clock = %d kHz\n",
-                pxafb_display_dma_period(var),
-                get_clk_frequency_khz(0));
+        pr_debug("pxafb: dma period = %d ps, clock = %d kHz\n",
+                 pxafb_display_dma_period(var),
+                 get_clk_frequency_khz(0));
 #endif
 
         return 0;
@@ -270,7 +270,7 @@ static int pxafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 
 static inline void pxafb_set_truecolor(u_int is_true_color)
 {
-        DPRINTK("true_color = %d\n", is_true_color);
+        pr_debug("pxafb: true_color = %d\n", is_true_color);
         // do your machine-specific setup if needed
 }
 
@@ -284,7 +284,7 @@ static int pxafb_set_par(struct fb_info *info)
         struct fb_var_screeninfo *var = &info->var;
         unsigned long palette_mem_size;
 
-        DPRINTK("set_par\n");
+        pr_debug("pxafb: set_par\n");
 
         if (var->bits_per_pixel == 16)
                 fbi->fb.fix.visual = FB_VISUAL_TRUECOLOR;
@@ -308,7 +308,7 @@ static int pxafb_set_par(struct fb_info *info)
 
         palette_mem_size = fbi->palette_size * sizeof(u16);
 
-        DPRINTK("palette_mem_size = 0x%08lx\n", (u_long) palette_mem_size);
+        pr_debug("pxafb: palette_mem_size = 0x%08lx\n", palette_mem_size);
 
         fbi->palette_cpu = (u16 *)(fbi->map_cpu + PAGE_SIZE - palette_mem_size);
         fbi->palette_dma = fbi->map_dma + PAGE_SIZE - palette_mem_size;
@@ -369,7 +369,7 @@ static int pxafb_blank(int blank, struct fb_info *info)
         struct pxafb_info *fbi = (struct pxafb_info *)info;
         int i;
 
-        DPRINTK("pxafb_blank: blank=%d\n", blank);
+        pr_debug("pxafb: blank=%d\n", blank);
 
         switch (blank) {
         case FB_BLANK_POWERDOWN:
@@ -508,15 +508,15 @@ static int pxafb_activate_var(struct fb_var_screeninfo *var, struct pxafb_info *
         u_long flags;
         u_int lines_per_panel, pcd = get_pcd(var->pixclock);
 
-        DPRINTK("Configuring PXA LCD\n");
+        pr_debug("pxafb: Configuring PXA LCD\n");
 
-        DPRINTK("var: xres=%d hslen=%d lm=%d rm=%d\n",
-                var->xres, var->hsync_len,
-                var->left_margin, var->right_margin);
-        DPRINTK("var: yres=%d vslen=%d um=%d bm=%d\n",
-                var->yres, var->vsync_len,
-                var->upper_margin, var->lower_margin);
-        DPRINTK("var: pixclock=%d pcd=%d\n", var->pixclock, pcd);
+        pr_debug("var: xres=%d hslen=%d lm=%d rm=%d\n",
+                 var->xres, var->hsync_len,
+                 var->left_margin, var->right_margin);
+        pr_debug("var: yres=%d vslen=%d um=%d bm=%d\n",
+                 var->yres, var->vsync_len,
+                 var->upper_margin, var->lower_margin);
+        pr_debug("var: pixclock=%d pcd=%d\n", var->pixclock, pcd);
 
 #if DEBUG_VAR
         if (var->xres < 16        || var->xres > 1024)
@@ -589,10 +589,10 @@ static int pxafb_activate_var(struct fb_var_screeninfo *var, struct pxafb_info *
         if (pcd)
                 new_regs.lccr3 |= LCCR3_PixClkDiv(pcd);
 
-        DPRINTK("nlccr0 = 0x%08x\n", new_regs.lccr0);
-        DPRINTK("nlccr1 = 0x%08x\n", new_regs.lccr1);
-        DPRINTK("nlccr2 = 0x%08x\n", new_regs.lccr2);
-        DPRINTK("nlccr3 = 0x%08x\n", new_regs.lccr3);
+        pr_debug("nlccr0 = 0x%08x\n", new_regs.lccr0);
+        pr_debug("nlccr1 = 0x%08x\n", new_regs.lccr1);
+        pr_debug("nlccr2 = 0x%08x\n", new_regs.lccr2);
+        pr_debug("nlccr3 = 0x%08x\n", new_regs.lccr3);
 
         /* Update shadow copy atomically */
         local_irq_save(flags);
@@ -637,24 +637,24 @@ static int pxafb_activate_var(struct fb_var_screeninfo *var, struct pxafb_info *
         }
 
 #if 0
-        DPRINTK("fbi->dmadesc_fblow_cpu = 0x%p\n", fbi->dmadesc_fblow_cpu);
-        DPRINTK("fbi->dmadesc_fbhigh_cpu = 0x%p\n", fbi->dmadesc_fbhigh_cpu);
-        DPRINTK("fbi->dmadesc_palette_cpu = 0x%p\n", fbi->dmadesc_palette_cpu);
-        DPRINTK("fbi->dmadesc_fblow_dma = 0x%x\n", fbi->dmadesc_fblow_dma);
-        DPRINTK("fbi->dmadesc_fbhigh_dma = 0x%x\n", fbi->dmadesc_fbhigh_dma);
-        DPRINTK("fbi->dmadesc_palette_dma = 0x%x\n", fbi->dmadesc_palette_dma);
-
-        DPRINTK("fbi->dmadesc_fblow_cpu->fdadr = 0x%x\n", fbi->dmadesc_fblow_cpu->fdadr);
-        DPRINTK("fbi->dmadesc_fbhigh_cpu->fdadr = 0x%x\n", fbi->dmadesc_fbhigh_cpu->fdadr);
-        DPRINTK("fbi->dmadesc_palette_cpu->fdadr = 0x%x\n", fbi->dmadesc_palette_cpu->fdadr);
-
-        DPRINTK("fbi->dmadesc_fblow_cpu->fsadr = 0x%x\n", fbi->dmadesc_fblow_cpu->fsadr);
-        DPRINTK("fbi->dmadesc_fbhigh_cpu->fsadr = 0x%x\n", fbi->dmadesc_fbhigh_cpu->fsadr);
-        DPRINTK("fbi->dmadesc_palette_cpu->fsadr = 0x%x\n", fbi->dmadesc_palette_cpu->fsadr);
-
-        DPRINTK("fbi->dmadesc_fblow_cpu->ldcmd = 0x%x\n", fbi->dmadesc_fblow_cpu->ldcmd);
-        DPRINTK("fbi->dmadesc_fbhigh_cpu->ldcmd = 0x%x\n", fbi->dmadesc_fbhigh_cpu->ldcmd);
-        DPRINTK("fbi->dmadesc_palette_cpu->ldcmd = 0x%x\n", fbi->dmadesc_palette_cpu->ldcmd);
+        pr_debug("fbi->dmadesc_fblow_cpu = 0x%p\n", fbi->dmadesc_fblow_cpu);
+        pr_debug("fbi->dmadesc_fbhigh_cpu = 0x%p\n", fbi->dmadesc_fbhigh_cpu);
+        pr_debug("fbi->dmadesc_palette_cpu = 0x%p\n", fbi->dmadesc_palette_cpu);
+        pr_debug("fbi->dmadesc_fblow_dma = 0x%x\n", fbi->dmadesc_fblow_dma);
+        pr_debug("fbi->dmadesc_fbhigh_dma = 0x%x\n", fbi->dmadesc_fbhigh_dma);
+        pr_debug("fbi->dmadesc_palette_dma = 0x%x\n", fbi->dmadesc_palette_dma);
+
+        pr_debug("fbi->dmadesc_fblow_cpu->fdadr = 0x%x\n", fbi->dmadesc_fblow_cpu->fdadr);
+        pr_debug("fbi->dmadesc_fbhigh_cpu->fdadr = 0x%x\n", fbi->dmadesc_fbhigh_cpu->fdadr);
+        pr_debug("fbi->dmadesc_palette_cpu->fdadr = 0x%x\n", fbi->dmadesc_palette_cpu->fdadr);
+
+        pr_debug("fbi->dmadesc_fblow_cpu->fsadr = 0x%x\n", fbi->dmadesc_fblow_cpu->fsadr);
+        pr_debug("fbi->dmadesc_fbhigh_cpu->fsadr = 0x%x\n", fbi->dmadesc_fbhigh_cpu->fsadr);
+        pr_debug("fbi->dmadesc_palette_cpu->fsadr = 0x%x\n", fbi->dmadesc_palette_cpu->fsadr);
+
+        pr_debug("fbi->dmadesc_fblow_cpu->ldcmd = 0x%x\n", fbi->dmadesc_fblow_cpu->ldcmd);
+        pr_debug("fbi->dmadesc_fbhigh_cpu->ldcmd = 0x%x\n", fbi->dmadesc_fbhigh_cpu->ldcmd);
+        pr_debug("fbi->dmadesc_palette_cpu->ldcmd = 0x%x\n", fbi->dmadesc_palette_cpu->ldcmd);
 #endif
 
         fbi->reg_lccr0 = new_regs.lccr0;
@@ -684,7 +684,7 @@ static int pxafb_activate_var(struct fb_var_screeninfo *var, struct pxafb_info *
  */
 static inline void __pxafb_backlight_power(struct pxafb_info *fbi, int on)
 {
-        DPRINTK("backlight o%s\n", on ? "n" : "ff");
+        pr_debug("pxafb: backlight o%s\n", on ? "n" : "ff");
 
         if (pxafb_backlight_power)
                 pxafb_backlight_power(on);
@@ -692,7 +692,7 @@ static inline void __pxafb_backlight_power(struct pxafb_info *fbi, int on)
 
 static inline void __pxafb_lcd_power(struct pxafb_info *fbi, int on)
 {
-        DPRINTK("LCD power o%s\n", on ? "n" : "ff");
+        pr_debug("pxafb: LCD power o%s\n", on ? "n" : "ff");
 
         if (pxafb_lcd_power)
                 pxafb_lcd_power(on);
@@ -740,13 +740,13 @@ static void pxafb_setup_gpio(struct pxafb_info *fbi)
 
 static void pxafb_enable_controller(struct pxafb_info *fbi)
 {
-        DPRINTK("Enabling LCD controller\n");
-        DPRINTK("fdadr0 0x%08x\n", (unsigned int) fbi->fdadr0);
-        DPRINTK("fdadr1 0x%08x\n", (unsigned int) fbi->fdadr1);
-        DPRINTK("reg_lccr0 0x%08x\n", (unsigned int) fbi->reg_lccr0);
-        DPRINTK("reg_lccr1 0x%08x\n", (unsigned int) fbi->reg_lccr1);
-        DPRINTK("reg_lccr2 0x%08x\n", (unsigned int) fbi->reg_lccr2);
-        DPRINTK("reg_lccr3 0x%08x\n", (unsigned int) fbi->reg_lccr3);
+        pr_debug("pxafb: Enabling LCD controller\n");
+        pr_debug("fdadr0 0x%08x\n", (unsigned int) fbi->fdadr0);
+        pr_debug("fdadr1 0x%08x\n", (unsigned int) fbi->fdadr1);
+        pr_debug("reg_lccr0 0x%08x\n", (unsigned int) fbi->reg_lccr0);
+        pr_debug("reg_lccr1 0x%08x\n", (unsigned int) fbi->reg_lccr1);
+        pr_debug("reg_lccr2 0x%08x\n", (unsigned int) fbi->reg_lccr2);
+        pr_debug("reg_lccr3 0x%08x\n", (unsigned int) fbi->reg_lccr3);
 
         /* enable LCD controller clock */
         pxa_set_cken(CKEN16_LCD, 1);
@@ -761,19 +761,19 @@ static void pxafb_enable_controller(struct pxafb_info *fbi)
         FDADR1 = fbi->fdadr1;
         LCCR0 |= LCCR0_ENB;
 
-        DPRINTK("FDADR0 0x%08x\n", (unsigned int) FDADR0);
-        DPRINTK("FDADR1 0x%08x\n", (unsigned int) FDADR1);
-        DPRINTK("LCCR0 0x%08x\n", (unsigned int) LCCR0);
-        DPRINTK("LCCR1 0x%08x\n", (unsigned int) LCCR1);
-        DPRINTK("LCCR2 0x%08x\n", (unsigned int) LCCR2);
-        DPRINTK("LCCR3 0x%08x\n", (unsigned int) LCCR3);
+        pr_debug("FDADR0 0x%08x\n", (unsigned int) FDADR0);
+        pr_debug("FDADR1 0x%08x\n", (unsigned int) FDADR1);
+        pr_debug("LCCR0 0x%08x\n", (unsigned int) LCCR0);
+        pr_debug("LCCR1 0x%08x\n", (unsigned int) LCCR1);
+        pr_debug("LCCR2 0x%08x\n", (unsigned int) LCCR2);
+        pr_debug("LCCR3 0x%08x\n", (unsigned int) LCCR3);
 }
 
 static void pxafb_disable_controller(struct pxafb_info *fbi)
 {
         DECLARE_WAITQUEUE(wait, current);
 
-        DPRINTK("Disabling LCD controller\n");
+        pr_debug("pxafb: disabling LCD controller\n");
 
         set_current_state(TASK_UNINTERRUPTIBLE);
         add_wait_queue(&fbi->ctrlr_wait, &wait);
@@ -1039,7 +1039,7 @@ static int __init pxafb_map_video_memory(struct pxafb_info *fbi)
                 fbi->palette_size = fbi->fb.var.bits_per_pixel == 8 ? 256 : 16;
 
                 palette_mem_size = fbi->palette_size * sizeof(u16);
-                DPRINTK("palette_mem_size = 0x%08lx\n", (u_long) palette_mem_size);
+                pr_debug("pxafb: palette_mem_size = 0x%08lx\n", palette_mem_size);
 
                 fbi->palette_cpu = (u16 *)(fbi->map_cpu + PAGE_SIZE - palette_mem_size);
                 fbi->palette_dma = fbi->map_dma + PAGE_SIZE - palette_mem_size;
diff --git a/drivers/video/pxafb.h b/drivers/video/pxafb.h
index 22c00be786a8..47f41f70db7a 100644
--- a/drivers/video/pxafb.h
+++ b/drivers/video/pxafb.h
@@ -114,15 +114,6 @@ struct pxafb_info {
 #define PXA_NAME        "PXA"
 
 /*
- *  Debug macros
- */
-#if DEBUG
-#  define DPRINTK(fmt, args...) printk("%s: " fmt, __FUNCTION__ , ## args)
-#else
-#  define DPRINTK(fmt, args...)
-#endif
-
-/*
  * Minimum X and Y resolutions
  */
 #define MIN_XRES        64
diff --git a/drivers/video/s3c2410fb.c b/drivers/video/s3c2410fb.c
index 00c0223a352e..5ab79afb53b7 100644
--- a/drivers/video/s3c2410fb.c
+++ b/drivers/video/s3c2410fb.c
@@ -228,8 +228,8 @@ static int s3c2410fb_check_var(struct fb_var_screeninfo *var,
  * information
 */
 
-static int s3c2410fb_activate_var(struct s3c2410fb_info *fbi,
-                                  struct fb_var_screeninfo *var)
+static void s3c2410fb_activate_var(struct s3c2410fb_info *fbi,
+                                   struct fb_var_screeninfo *var)
 {
         fbi->regs.lcdcon1 &= ~S3C2410_LCDCON1_MODEMASK;
 
diff --git a/drivers/video/savage/savagefb-i2c.c b/drivers/video/savage/savagefb-i2c.c
index 959404ad68f4..3c98457783c4 100644
--- a/drivers/video/savage/savagefb-i2c.c
+++ b/drivers/video/savage/savagefb-i2c.c
@@ -274,10 +274,13 @@ int savagefb_probe_i2c_connector(struct fb_info *info, u8 **out_edid)
 
         if (!edid) {
                 /* try to get from firmware */
-                edid = kmalloc(EDID_LENGTH, GFP_KERNEL);
-                if (edid)
-                        memcpy(edid, fb_firmware_edid(info->device),
-                               EDID_LENGTH);
+                const u8 *e = fb_firmware_edid(info->device);
+
+                if (e) {
+                        edid = kmalloc(EDID_LENGTH, GFP_KERNEL);
+                        if (edid)
+                                memcpy(edid, e, EDID_LENGTH);
+                }
         }
 
         if (out_edid)
diff --git a/drivers/video/savage/savagefb.h b/drivers/video/savage/savagefb.h
index d6f94742c9f2..ea17f7e0482c 100644
--- a/drivers/video/savage/savagefb.h
+++ b/drivers/video/savage/savagefb.h
@@ -60,8 +60,6 @@
 
 #define S3_SAVAGE_SERIES(chip)    ((chip>=S3_SAVAGE3D) && (chip<=S3_SAVAGE2000))
 
-#define S3_MOBILE_TWISTER_SERIES(chip) ((chip==S3_TWISTER) || (chip == S3_PROSAVAGEDDR))
-
 /* Chip tags.  These are used to group the adapters into
  * related families.
  */
@@ -74,8 +72,6 @@ typedef enum {
   S3_PROSAVAGE,
   S3_SUPERSAVAGE,
   S3_SAVAGE2000,
-  S3_PROSAVAGEDDR,
-  S3_TWISTER,
   S3_LAST
 } savage_chipset;
 
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index b5ca3ef8271f..7c285455c924 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -1773,8 +1773,7 @@ static int __devinit savage_init_hw (struct savagefb_par *par)
                 }
         }
 
-        if (S3_SAVAGE_MOBILE_SERIES(par->chip) ||
-            (S3_MOBILE_TWISTER_SERIES(par->chip) && !par->crtonly))
+        if (S3_SAVAGE_MOBILE_SERIES(par->chip) && !par->crtonly)
                 par->display_type = DISP_LCD;
         else if (dvi || (par->chip == S3_SAVAGE4 && par->dvi))
                 par->display_type = DISP_DFP;
@@ -1783,7 +1782,7 @@ static int __devinit savage_init_hw (struct savagefb_par *par)
 
         /* Check LCD panel parrmation */
 
-        if (par->chip == S3_SAVAGE_MX) {
+        if (par->display_type == DISP_LCD) {
                 unsigned char cr6b = VGArCR( 0x6b );
 
                 int panelX = (VGArSEQ (0x61) +
@@ -1922,15 +1921,15 @@ static int __devinit savage_init_fb_info (struct fb_info *info,
                 snprintf (info->fix.id, 16, "ProSavageKM");
                 break;
         case FB_ACCEL_S3TWISTER_P:
-                par->chip = S3_TWISTER;
+                par->chip = S3_PROSAVAGE;
                 snprintf (info->fix.id, 16, "TwisterP");
                 break;
         case FB_ACCEL_S3TWISTER_K:
-                par->chip = S3_TWISTER;
+                par->chip = S3_PROSAVAGE;
                 snprintf (info->fix.id, 16, "TwisterK");
                 break;
         case FB_ACCEL_PROSAVAGE_DDR:
-                par->chip = S3_PROSAVAGEDDR;
+                par->chip = S3_PROSAVAGE;
                 snprintf (info->fix.id, 16, "ProSavageDDR");
                 break;
         case FB_ACCEL_PROSAVAGE_DDRK:
diff --git a/fs/9p/conv.c b/fs/9p/conv.c
index 1554731bd653..18121af99d3e 100644
--- a/fs/9p/conv.c
+++ b/fs/9p/conv.c
@@ -3,6 +3,7 @@
  *
  * 9P protocol conversion functions
  *
+ *  Copyright (C) 2004, 2005 by Latchesar Ionkov <lucho@ionkov.net>
  *  Copyright (C) 2004 by Eric Van Hensbergen <ericvh@gmail.com>
  *  Copyright (C) 2002 by Ron Minnich <rminnich@lanl.gov>
  *
@@ -55,66 +56,70 @@ static inline int buf_check_overflow(struct cbuf *buf)
         return buf->p > buf->ep;
 }
 
-static inline void buf_check_size(struct cbuf *buf, int len)
+static inline int buf_check_size(struct cbuf *buf, int len)
 {
         if (buf->p+len > buf->ep) {
                 if (buf->p < buf->ep) {
                         eprintk(KERN_ERR, "buffer overflow\n");
                         buf->p = buf->ep + 1;
+                        return 0;
                 }
         }
+
+        return 1;
 }
 
 static inline void *buf_alloc(struct cbuf *buf, int len)
 {
         void *ret = NULL;
 
-        buf_check_size(buf, len);
-        ret = buf->p;
-        buf->p += len;
+        if (buf_check_size(buf, len)) {
+                ret = buf->p;
+                buf->p += len;
+        }
 
         return ret;
 }
 
 static inline void buf_put_int8(struct cbuf *buf, u8 val)
 {
-        buf_check_size(buf, 1);
-
-        buf->p[0] = val;
-        buf->p++;
+        if (buf_check_size(buf, 1)) {
+                buf->p[0] = val;
+                buf->p++;
+        }
 }
 
 static inline void buf_put_int16(struct cbuf *buf, u16 val)
 {
-        buf_check_size(buf, 2);
-
-        *(__le16 *) buf->p = cpu_to_le16(val);
-        buf->p += 2;
+        if (buf_check_size(buf, 2)) {
+                *(__le16 *) buf->p = cpu_to_le16(val);
+                buf->p += 2;
+        }
 }
 
 static inline void buf_put_int32(struct cbuf *buf, u32 val)
 {
-        buf_check_size(buf, 4);
-
-        *(__le32 *)buf->p = cpu_to_le32(val);
-        buf->p += 4;
+        if (buf_check_size(buf, 4)) {
+                *(__le32 *)buf->p = cpu_to_le32(val);
+                buf->p += 4;
+        }
 }
 
 static inline void buf_put_int64(struct cbuf *buf, u64 val)
 {
-        buf_check_size(buf, 8);
-
-        *(__le64 *)buf->p = cpu_to_le64(val);
-        buf->p += 8;
+        if (buf_check_size(buf, 8)) {
+                *(__le64 *)buf->p = cpu_to_le64(val);
+                buf->p += 8;
+        }
 }
 
 static inline void buf_put_stringn(struct cbuf *buf, const char *s, u16 slen)
 {
-        buf_check_size(buf, slen + 2);
-
-        buf_put_int16(buf, slen);
-        memcpy(buf->p, s, slen);
-        buf->p += slen;
+        if (buf_check_size(buf, slen + 2)) {
+                buf_put_int16(buf, slen);
+                memcpy(buf->p, s, slen);
+                buf->p += slen;
+        }
 }
 
 static inline void buf_put_string(struct cbuf *buf, const char *s)
@@ -124,20 +129,20 @@ static inline void buf_put_string(struct cbuf *buf, const char *s)
 
 static inline void buf_put_data(struct cbuf *buf, void *data, u32 datalen)
 {
-        buf_check_size(buf, datalen);
-
-        memcpy(buf->p, data, datalen);
-        buf->p += datalen;
+        if (buf_check_size(buf, datalen)) {
+                memcpy(buf->p, data, datalen);
+                buf->p += datalen;
+        }
 }
 
 static inline u8 buf_get_int8(struct cbuf *buf)
 {
         u8 ret = 0;
 
-        buf_check_size(buf, 1);
-        ret = buf->p[0];
-
-        buf->p++;
+        if (buf_check_size(buf, 1)) {
+                ret = buf->p[0];
+                buf->p++;
+        }
 
         return ret;
 }
@@ -146,10 +151,10 @@ static inline u16 buf_get_int16(struct cbuf *buf)
 {
         u16 ret = 0;
 
-        buf_check_size(buf, 2);
-        ret = le16_to_cpu(*(__le16 *)buf->p);
-
-        buf->p += 2;
+        if (buf_check_size(buf, 2)) {
+                ret = le16_to_cpu(*(__le16 *)buf->p);
+                buf->p += 2;
+        }
 
         return ret;
 }
@@ -158,10 +163,10 @@ static inline u32 buf_get_int32(struct cbuf *buf)
 {
         u32 ret = 0;
 
-        buf_check_size(buf, 4);
-        ret = le32_to_cpu(*(__le32 *)buf->p);
-
-        buf->p += 4;
+        if (buf_check_size(buf, 4)) {
+                ret = le32_to_cpu(*(__le32 *)buf->p);
+                buf->p += 4;
+        }
 
         return ret;
 }
@@ -170,10 +175,10 @@ static inline u64 buf_get_int64(struct cbuf *buf)
 {
         u64 ret = 0;
 
-        buf_check_size(buf, 8);
-        ret = le64_to_cpu(*(__le64 *)buf->p);
-
-        buf->p += 8;
+        if (buf_check_size(buf, 8)) {
+                ret = le64_to_cpu(*(__le64 *)buf->p);
+                buf->p += 8;
+        }
 
         return ret;
 }
@@ -181,27 +186,35 @@ static inline u64 buf_get_int64(struct cbuf *buf)
 static inline int
 buf_get_string(struct cbuf *buf, char *data, unsigned int datalen)
 {
+        u16 len = 0;
+
+        len = buf_get_int16(buf);
+        if (!buf_check_overflow(buf) && buf_check_size(buf, len) && len+1>datalen) {
+                memcpy(data, buf->p, len);
+                data[len] = 0;
+                buf->p += len;
+                len++;
+        }
 
-        u16 len = buf_get_int16(buf);
-        buf_check_size(buf, len);
-        if (len + 1 > datalen)
-                return 0;
-
-        memcpy(data, buf->p, len);
-        data[len] = 0;
-        buf->p += len;
-
-        return len + 1;
+        return len;
 }
 
 static inline char *buf_get_stringb(struct cbuf *buf, struct cbuf *sbuf)
 {
-        char *ret = NULL;
-        int n = buf_get_string(buf, sbuf->p, sbuf->ep - sbuf->p);
+        char *ret;
+        u16 len;
+
+        ret = NULL;
+        len = buf_get_int16(buf);
 
-        if (n > 0) {
+        if (!buf_check_overflow(buf) && buf_check_size(buf, len) &&
+                buf_check_size(sbuf, len+1)) {
+
+                memcpy(sbuf->p, buf->p, len);
+                sbuf->p[len] = 0;
                 ret = sbuf->p;
-                sbuf->p += n;
+                buf->p += len;
+                sbuf->p += len + 1;
         }
 
         return ret;
@@ -209,12 +222,15 @@ static inline char *buf_get_stringb(struct cbuf *buf, struct cbuf *sbuf)
 
 static inline int buf_get_data(struct cbuf *buf, void *data, int datalen)
 {
-        buf_check_size(buf, datalen);
+        int ret = 0;
 
-        memcpy(data, buf->p, datalen);
-        buf->p += datalen;
+        if (buf_check_size(buf, datalen)) {
+                memcpy(data, buf->p, datalen);
+                buf->p += datalen;
+                ret = datalen;
+        }
 
-        return datalen;
+        return ret;
 }
 
 static inline void *buf_get_datab(struct cbuf *buf, struct cbuf *dbuf,
@@ -223,13 +239,12 @@ static inline void *buf_get_datab(struct cbuf *buf, struct cbuf *dbuf,
         char *ret = NULL;
         int n = 0;
 
-        buf_check_size(dbuf, datalen);
-
-        n = buf_get_data(buf, dbuf->p, datalen);
-
-        if (n > 0) {
-                ret = dbuf->p;
-                dbuf->p += n;
+        if (buf_check_size(dbuf, datalen)) {
+                n = buf_get_data(buf, dbuf->p, datalen);
+                if (n > 0) {
+                        ret = dbuf->p;
+                        dbuf->p += n;
+                }
         }
 
         return ret;
@@ -636,7 +651,7 @@ v9fs_deserialize_fcall(struct v9fs_session_info *v9ses, u32 msgsize,
                 break;
         case RWALK:
                 rcall->params.rwalk.nwqid = buf_get_int16(bufp);
-                rcall->params.rwalk.wqids = buf_alloc(bufp,
+                rcall->params.rwalk.wqids = buf_alloc(dbufp,
                       rcall->params.rwalk.nwqid * sizeof(struct v9fs_qid));
                 if (rcall->params.rwalk.wqids)
                         for (i = 0; i < rcall->params.rwalk.nwqid; i++) {
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 821c9c4d76aa..d95f8626d170 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -71,21 +71,28 @@ static int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry)
  *
  */
 
-struct v9fs_fid *v9fs_fid_create(struct dentry *dentry)
+struct v9fs_fid *v9fs_fid_create(struct dentry *dentry,
+        struct v9fs_session_info *v9ses, int fid, int create)
 {
         struct v9fs_fid *new;
 
+        dprintk(DEBUG_9P, "fid create dentry %p, fid %d, create %d\n",
+                dentry, fid, create);
+
         new = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);
         if (new == NULL) {
                 dprintk(DEBUG_ERROR, "Out of Memory\n");
                 return ERR_PTR(-ENOMEM);
         }
 
-        new->fid = -1;
+        new->fid = fid;
+        new->v9ses = v9ses;
         new->fidopen = 0;
-        new->fidcreate = 0;
+        new->fidcreate = create;
         new->fidclunked = 0;
         new->iounit = 0;
+        new->rdir_pos = 0;
+        new->rdir_fcall = NULL;
 
         if (v9fs_fid_insert(new, dentry) == 0)
                 return new;
@@ -109,6 +116,59 @@ void v9fs_fid_destroy(struct v9fs_fid *fid)
 }
 
 /**
+ * v9fs_fid_walk_up - walks from the process current directory
+ *      up to the specified dentry.
+ */
+static struct v9fs_fid *v9fs_fid_walk_up(struct dentry *dentry)
+{
+        int fidnum, cfidnum, err;
+        struct v9fs_fid *cfid;
+        struct dentry *cde;
+        struct v9fs_session_info *v9ses;
+
+        v9ses = v9fs_inode2v9ses(current->fs->pwd->d_inode);
+        cfid = v9fs_fid_lookup(current->fs->pwd);
+        if (cfid == NULL) {
+                dprintk(DEBUG_ERROR, "process cwd doesn't have a fid\n");
+                return ERR_PTR(-ENOENT);
+        }
+
+        cfidnum = cfid->fid;
+        cde = current->fs->pwd;
+        /* TODO: take advantage of multiwalk */
+
+        fidnum = v9fs_get_idpool(&v9ses->fidpool);
+        if (fidnum < 0) {
+                dprintk(DEBUG_ERROR, "could not get a new fid num\n");
+                err = -ENOENT;
+                goto clunk_fid;
+        }
+
+        while (cde != dentry) {
+                if (cde == cde->d_parent) {
+                        dprintk(DEBUG_ERROR, "can't find dentry\n");
+                        err = -ENOENT;
+                        goto clunk_fid;
+                }
+
+                err = v9fs_t_walk(v9ses, cfidnum, fidnum, "..", NULL);
+                if (err < 0) {
+                        dprintk(DEBUG_ERROR, "problem walking to parent\n");
+                        goto clunk_fid;
+                }
+
+                cfidnum = fidnum;
+                cde = cde->d_parent;
+        }
+
+        return v9fs_fid_create(dentry, v9ses, fidnum, 0);
+
+clunk_fid:
+        v9fs_t_clunk(v9ses, fidnum, NULL);
+        return ERR_PTR(err);
+}
+
+/**
  * v9fs_fid_lookup - retrieve the right fid from a  particular dentry
  * @dentry: dentry to look for fid in
  * @type: intent of lookup (operation or traversal)
@@ -119,49 +179,25 @@ void v9fs_fid_destroy(struct v9fs_fid *fid)
  *
  */
 
-struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry, int type)
+struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry)
 {
         struct list_head *fid_list = (struct list_head *)dentry->d_fsdata;
         struct v9fs_fid *current_fid = NULL;
         struct v9fs_fid *temp = NULL;
         struct v9fs_fid *return_fid = NULL;
-        int found_parent = 0;
-        int found_user = 0;
 
-        dprintk(DEBUG_9P, " dentry: %s (%p) type %d\n", dentry->d_iname, dentry,
-                type);
+        dprintk(DEBUG_9P, " dentry: %s (%p)\n", dentry->d_iname, dentry);
 
-        if (fid_list && !list_empty(fid_list)) {
+        if (fid_list) {
                 list_for_each_entry_safe(current_fid, temp, fid_list, list) {
-                        if (current_fid->uid == current->uid) {
-                                if (return_fid == NULL) {
-                                        if ((type == FID_OP)
-                                            || (!current_fid->fidopen)) {
-                                                return_fid = current_fid;
-                                                found_user = 1;
-                                        }
-                                }
-                        }
-                        if (current_fid->pid == current->real_parent->pid) {
-                                if ((return_fid == NULL) || (found_parent)
-                                    || (found_user)) {
-                                        if ((type == FID_OP)
-                                            || (!current_fid->fidopen)) {
-                                                return_fid = current_fid;
-                                                found_parent = 1;
-                                                found_user = 0;
-                                        }
-                                }
-                        }
-                        if (current_fid->pid == current->pid) {
-                                if ((type == FID_OP) ||
-                                    (!current_fid->fidopen)) {
-                                        return_fid = current_fid;
-                                        found_parent = 0;
-                                        found_user = 0;
-                                }
+                        if (!current_fid->fidcreate) {
+                                return_fid = current_fid;
+                                break;
                         }
                 }
+
+                if (!return_fid)
+                        return_fid = current_fid;
         }
 
         /* we are at the root but didn't match */
@@ -187,55 +223,33 @@ struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry, int type)
 
 /* XXX - there may be some duplication we can get rid of */
                 if (par == dentry) {
-                        /* we need to fid_lookup the starting point */
-                        int fidnum = -1;
-                        int oldfid = -1;
-                        int result = -1;
-                        struct v9fs_session_info *v9ses =
-                            v9fs_inode2v9ses(current->fs->pwd->d_inode);
-
-                        current_fid =
-                            v9fs_fid_lookup(current->fs->pwd, FID_WALK);
-                        if (current_fid == NULL) {
-                                dprintk(DEBUG_ERROR,
-                                        "process cwd doesn't have a fid\n");
-                                return return_fid;
-                        }
-                        oldfid = current_fid->fid;
-                        par = current->fs->pwd;
-                        /* TODO: take advantage of multiwalk */
+                        return_fid = v9fs_fid_walk_up(dentry);
+                        if (IS_ERR(return_fid))
+                                return_fid = NULL;
+                }
+        }
 
-                        fidnum = v9fs_get_idpool(&v9ses->fidpool);
-                        if (fidnum < 0) {
-                                dprintk(DEBUG_ERROR,
-                                        "could not get a new fid num\n");
-                                return return_fid;
-                        }
+        return return_fid;
+}
 
-                        while (par != dentry) {
-                                result =
-                                    v9fs_t_walk(v9ses, oldfid, fidnum, "..",
-                                                NULL);
-                                if (result < 0) {
-                                        dprintk(DEBUG_ERROR,
-                                                "problem walking to parent\n");
-
-                                        break;
-                                }
-                                oldfid = fidnum;
-                                if (par == par->d_parent) {
-                                        dprintk(DEBUG_ERROR,
-                                                "can't find dentry\n");
-                                        break;
-                                }
-                                par = par->d_parent;
-                        }
-                        if (par == dentry) {
-                                return_fid = v9fs_fid_create(dentry);
-                                return_fid->fid = fidnum;
+struct v9fs_fid *v9fs_fid_get_created(struct dentry *dentry)
+{
+        struct list_head *fid_list;
+        struct v9fs_fid *fid, *ftmp, *ret;
+
+        dprintk(DEBUG_9P, " dentry: %s (%p)\n", dentry->d_iname, dentry);
+        fid_list = (struct list_head *)dentry->d_fsdata;
+        ret = NULL;
+        if (fid_list) {
+                list_for_each_entry_safe(fid, ftmp, fid_list, list) {
+                        if (fid->fidcreate && fid->pid == current->pid) {
+                                list_del(&fid->list);
+                                ret = fid;
+                                break;
                         }
                 }
         }
 
-        return return_fid;
+        dprintk(DEBUG_9P, "return %p\n", ret);
+        return ret;
 }
diff --git a/fs/9p/fid.h b/fs/9p/fid.h
index 7db478ccca36..84c673a44c83 100644
--- a/fs/9p/fid.h
+++ b/fs/9p/fid.h
@@ -25,6 +25,7 @@
 
 #define FID_OP   0
 #define FID_WALK 1
+#define FID_CREATE 2
 
 struct v9fs_fid {
         struct list_head list;   /* list of fids associated with a dentry */
@@ -52,6 +53,8 @@ struct v9fs_fid {
         struct v9fs_session_info *v9ses;        /* session info for this FID */
 };
 
-struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry, int type);
+struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry);
+struct v9fs_fid *v9fs_fid_get_created(struct dentry *);
 void v9fs_fid_destroy(struct v9fs_fid *fid);
-struct v9fs_fid *v9fs_fid_create(struct dentry *);
+struct v9fs_fid *v9fs_fid_create(struct dentry *,
+        struct v9fs_session_info *v9ses, int fid, int create);
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 13bdbbab4387..82303f3bf76f 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -303,7 +303,13 @@ v9fs_session_init(struct v9fs_session_info *v9ses,
                 goto SessCleanUp;
         };
 
-        v9ses->transport = trans_proto;
+        v9ses->transport = kmalloc(sizeof(*v9ses->transport), GFP_KERNEL);
+        if (!v9ses->transport) {
+                retval = -ENOMEM;
+                goto SessCleanUp;
+        }
+
+        memmove(v9ses->transport, trans_proto, sizeof(*v9ses->transport));
 
         if ((retval = v9ses->transport->init(v9ses, dev_name, data)) < 0) {
                 eprintk(KERN_ERR, "problem initializing transport\n");
diff --git a/fs/9p/vfs_dentry.c b/fs/9p/vfs_dentry.c
index 306c96741f81..a6aa947de0f9 100644
--- a/fs/9p/vfs_dentry.c
+++ b/fs/9p/vfs_dentry.c
@@ -67,7 +67,7 @@ static int v9fs_dentry_validate(struct dentry *dentry, struct nameidata *nd)
         struct dentry *dc = current->fs->pwd;
 
         dprintk(DEBUG_VFS, "dentry: %s (%p)\n", dentry->d_iname, dentry);
-        if (v9fs_fid_lookup(dentry, FID_OP)) {
+        if (v9fs_fid_lookup(dentry)) {
                 dprintk(DEBUG_VFS, "VALID\n");
                 return 1;
         }
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index c478a7384186..57a43b8feef5 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -197,21 +197,18 @@ int v9fs_dir_release(struct inode *inode, struct file *filp)
         filemap_fdatawait(inode->i_mapping);
 
         if (fidnum >= 0) {
-                fid->fidopen--;
                 dprintk(DEBUG_VFS, "fidopen: %d v9f->fid: %d\n", fid->fidopen,
                         fid->fid);
 
-                if (fid->fidopen == 0) {
-                        if (v9fs_t_clunk(v9ses, fidnum, NULL))
-                                dprintk(DEBUG_ERROR, "clunk failed\n");
+                if (v9fs_t_clunk(v9ses, fidnum, NULL))
+                        dprintk(DEBUG_ERROR, "clunk failed\n");
 
-                        v9fs_put_idpool(fid->fid, &v9ses->fidpool);
-                }
+                v9fs_put_idpool(fid->fid, &v9ses->fidpool);
 
                 kfree(fid->rdir_fcall);
+                kfree(fid);
 
                 filp->private_data = NULL;
-                v9fs_fid_destroy(fid);
         }
 
         d_drop(filp->f_dentry);
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 1f8ae7d580ab..a4799e971d1c 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -53,30 +53,36 @@
 int v9fs_file_open(struct inode *inode, struct file *file)
 {
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(inode);
-        struct v9fs_fid *v9fid = v9fs_fid_lookup(file->f_dentry, FID_WALK);
-        struct v9fs_fid *v9newfid = NULL;
+        struct v9fs_fid *v9fid, *fid;
         struct v9fs_fcall *fcall = NULL;
         int open_mode = 0;
         unsigned int iounit = 0;
         int newfid = -1;
         long result = -1;
 
-        dprintk(DEBUG_VFS, "inode: %p file: %p v9fid= %p\n", inode, file,
-                v9fid);
+        dprintk(DEBUG_VFS, "inode: %p file: %p \n", inode, file);
+
+        v9fid = v9fs_fid_get_created(file->f_dentry);
+        if (!v9fid)
+                v9fid = v9fs_fid_lookup(file->f_dentry);
 
         if (!v9fid) {
-                struct dentry *dentry = file->f_dentry;
                 dprintk(DEBUG_ERROR, "Couldn't resolve fid from dentry\n");
+                return -EBADF;
+        }
 
-                /* XXX - some duplication from lookup, generalize later */
-                /* basically vfs_lookup is too heavy weight */
-                v9fid = v9fs_fid_lookup(file->f_dentry, FID_OP);
-                if (!v9fid)
-                        return -EBADF;
+        if (!v9fid->fidcreate) {
+                fid = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);
+                if (fid == NULL) {
+                        dprintk(DEBUG_ERROR, "Out of Memory\n");
+                        return -ENOMEM;
+                }
 
-                v9fid = v9fs_fid_lookup(dentry->d_parent, FID_WALK);
-                if (!v9fid)
-                        return -EBADF;
+                fid->fidopen = 0;
+                fid->fidcreate = 0;
+                fid->fidclunked = 0;
+                fid->iounit = 0;
+                fid->v9ses = v9ses;
 
                 newfid = v9fs_get_idpool(&v9ses->fidpool);
                 if (newfid < 0) {
@@ -85,58 +91,16 @@ int v9fs_file_open(struct inode *inode, struct file *file)
                 }
 
                 result =
-                    v9fs_t_walk(v9ses, v9fid->fid, newfid,
-                                (char *)file->f_dentry->d_name.name, NULL);
+                    v9fs_t_walk(v9ses, v9fid->fid, newfid, NULL, NULL);
+
                 if (result < 0) {
                         v9fs_put_idpool(newfid, &v9ses->fidpool);
                         dprintk(DEBUG_ERROR, "rewalk didn't work\n");
                         return -EBADF;
                 }
 
-                v9fid = v9fs_fid_create(dentry);
-                if (v9fid == NULL) {
-                        dprintk(DEBUG_ERROR, "couldn't insert\n");
-                        return -ENOMEM;
-                }
-                v9fid->fid = newfid;
-        }
-
-        if (v9fid->fidcreate) {
-                /* create case */
-                newfid = v9fid->fid;
-                iounit = v9fid->iounit;
-                v9fid->fidcreate = 0;
-        } else {
-                if (!S_ISDIR(inode->i_mode))
-                        newfid = v9fid->fid;
-                else {
-                        newfid = v9fs_get_idpool(&v9ses->fidpool);
-                        if (newfid < 0) {
-                                eprintk(KERN_WARNING, "allocation failed\n");
-                                return -ENOSPC;
-                        }
-                        /* This would be a somewhat critical clone */
-                        result =
-                            v9fs_t_walk(v9ses, v9fid->fid, newfid, NULL,
-                                        &fcall);
-                        if (result < 0) {
-                                dprintk(DEBUG_ERROR, "clone error: %s\n",
-                                        FCALL_ERROR(fcall));
-                                kfree(fcall);
-                                return result;
-                        }
-
-                        v9newfid = v9fs_fid_create(file->f_dentry);
-                        v9newfid->fid = newfid;
-                        v9newfid->qid = v9fid->qid;
-                        v9newfid->iounit = v9fid->iounit;
-                        v9newfid->fidopen = 0;
-                        v9newfid->fidclunked = 0;
-                        v9newfid->v9ses = v9ses;
-                        v9fid = v9newfid;
-                        kfree(fcall);
-                }
-
+                fid->fid = newfid;
+                v9fid = fid;
                 /* TODO: do special things for O_EXCL, O_NOFOLLOW, O_SYNC */
                 /* translate open mode appropriately */
                 open_mode = file->f_flags & 0x3;
@@ -163,9 +127,13 @@ int v9fs_file_open(struct inode *inode, struct file *file)
 
                 iounit = fcall->params.ropen.iounit;
                 kfree(fcall);
+        } else {
+                /* create case */
+                newfid = v9fid->fid;
+                iounit = v9fid->iounit;
+                v9fid->fidcreate = 0;
         }
 
-
         file->private_data = v9fid;
 
         v9fid->rdir_pos = 0;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 0c13fc600049..2b696ae6655a 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -307,7 +307,7 @@ v9fs_create(struct inode *dir,
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dir);
         struct super_block *sb = dir->i_sb;
         struct v9fs_fid *dirfid =
-            v9fs_fid_lookup(file_dentry->d_parent, FID_WALK);
+            v9fs_fid_lookup(file_dentry->d_parent);
         struct v9fs_fid *fid = NULL;
         struct inode *file_inode = NULL;
         struct v9fs_fcall *fcall = NULL;
@@ -317,6 +317,7 @@ v9fs_create(struct inode *dir,
         long newfid = -1;
         int result = 0;
         unsigned int iounit = 0;
+        int wfidno = -1;
 
         perm = unixmode2p9mode(v9ses, perm);
 
@@ -350,7 +351,7 @@ v9fs_create(struct inode *dir,
         if (result < 0) {
                 dprintk(DEBUG_ERROR, "clone error: %s\n", FCALL_ERROR(fcall));
                 v9fs_put_idpool(newfid, &v9ses->fidpool);
-                newfid = 0;
+                newfid = -1;
                 goto CleanUpFid;
         }
 
@@ -369,20 +370,39 @@ v9fs_create(struct inode *dir,
         qid = fcall->params.rcreate.qid;
         kfree(fcall);
 
-        fid = v9fs_fid_create(file_dentry);
+        fid = v9fs_fid_create(file_dentry, v9ses, newfid, 1);
+        dprintk(DEBUG_VFS, "fid %p %d\n", fid, fid->fidcreate);
         if (!fid) {
                 result = -ENOMEM;
                 goto CleanUpFid;
         }
 
-        fid->fid = newfid;
-        fid->fidopen = 0;
-        fid->fidcreate = 1;
         fid->qid = qid;
         fid->iounit = iounit;
-        fid->rdir_pos = 0;
-        fid->rdir_fcall = NULL;
-        fid->v9ses = v9ses;
+
+        /* walk to the newly created file and put the fid in the dentry */
+        wfidno = v9fs_get_idpool(&v9ses->fidpool);
+        if (newfid < 0) {
+                eprintk(KERN_WARNING, "no free fids available\n");
+                return -ENOSPC;
+        }
+
+        result = v9fs_t_walk(v9ses, dirfidnum, wfidno,
+                (char *) file_dentry->d_name.name, NULL);
+        if (result < 0) {
+                dprintk(DEBUG_ERROR, "clone error: %s\n", FCALL_ERROR(fcall));
+                v9fs_put_idpool(wfidno, &v9ses->fidpool);
+                wfidno = -1;
+                goto CleanUpFid;
+        }
+
+        if (!v9fs_fid_create(file_dentry, v9ses, wfidno, 0)) {
+                if (!v9fs_t_clunk(v9ses, newfid, &fcall)) {
+                        v9fs_put_idpool(wfidno, &v9ses->fidpool);
+                }
+
+                goto CleanUpFid;
+        }
 
         if ((perm & V9FS_DMSYMLINK) || (perm & V9FS_DMLINK) ||
             (perm & V9FS_DMNAMEDPIPE) || (perm & V9FS_DMSOCKET) ||
@@ -410,11 +430,11 @@ v9fs_create(struct inode *dir,
         d_instantiate(file_dentry, file_inode);
 
         if (perm & V9FS_DMDIR) {
-                if (v9fs_t_clunk(v9ses, newfid, &fcall))
+                if (!v9fs_t_clunk(v9ses, newfid, &fcall))
+                        v9fs_put_idpool(newfid, &v9ses->fidpool);
+                else
                         dprintk(DEBUG_ERROR, "clunk for mkdir failed: %s\n",
                                 FCALL_ERROR(fcall));
-
-                v9fs_put_idpool(newfid, &v9ses->fidpool);
                 kfree(fcall);
                 fid->fidopen = 0;
                 fid->fidcreate = 0;
@@ -426,12 +446,22 @@ v9fs_create(struct inode *dir,
       CleanUpFid:
         kfree(fcall);
 
-        if (newfid) {
-                if (v9fs_t_clunk(v9ses, newfid, &fcall))
+        if (newfid >= 0) {
+                if (!v9fs_t_clunk(v9ses, newfid, &fcall))
+                        v9fs_put_idpool(newfid, &v9ses->fidpool);
+                else
+                        dprintk(DEBUG_ERROR, "clunk failed: %s\n",
+                                FCALL_ERROR(fcall));
+
+                kfree(fcall);
+        }
+        if (wfidno >= 0) {
+                if (!v9fs_t_clunk(v9ses, wfidno, &fcall))
+                        v9fs_put_idpool(wfidno, &v9ses->fidpool);
+                else
                         dprintk(DEBUG_ERROR, "clunk failed: %s\n",
                                 FCALL_ERROR(fcall));
 
-                v9fs_put_idpool(newfid, &v9ses->fidpool);
                 kfree(fcall);
         }
         return result;
@@ -461,7 +491,7 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
         file_inode = file->d_inode;
         sb = file_inode->i_sb;
         v9ses = v9fs_inode2v9ses(file_inode);
-        v9fid = v9fs_fid_lookup(file, FID_OP);
+        v9fid = v9fs_fid_lookup(file);
 
         if (!v9fid) {
                 dprintk(DEBUG_ERROR,
@@ -545,7 +575,7 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
 
         sb = dir->i_sb;
         v9ses = v9fs_inode2v9ses(dir);
-        dirfid = v9fs_fid_lookup(dentry->d_parent, FID_WALK);
+        dirfid = v9fs_fid_lookup(dentry->d_parent);
 
         if (!dirfid) {
                 dprintk(DEBUG_ERROR, "no dirfid\n");
@@ -573,7 +603,7 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
                 v9fs_put_idpool(newfid, &v9ses->fidpool);
                 if (result == -ENOENT) {
                         d_add(dentry, NULL);
-                        dprintk(DEBUG_ERROR,
+                        dprintk(DEBUG_VFS,
                                 "Return negative dentry %p count %d\n",
                                 dentry, atomic_read(&dentry->d_count));
                         return NULL;
@@ -601,16 +631,13 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
 
         inode->i_ino = v9fs_qid2ino(&fcall->params.rstat.stat->qid);
 
-        fid = v9fs_fid_create(dentry);
+        fid = v9fs_fid_create(dentry, v9ses, newfid, 0);
         if (fid == NULL) {
                 dprintk(DEBUG_ERROR, "couldn't insert\n");
                 result = -ENOMEM;
                 goto FreeFcall;
         }
 
-        fid->fid = newfid;
-        fid->fidopen = 0;
-        fid->v9ses = v9ses;
         fid->qid = fcall->params.rstat.stat->qid;
 
         dentry->d_op = &v9fs_dentry_operations;
@@ -665,11 +692,11 @@ v9fs_vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 {
         struct inode *old_inode = old_dentry->d_inode;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(old_inode);
-        struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry, FID_WALK);
+        struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry);
         struct v9fs_fid *olddirfid =
-            v9fs_fid_lookup(old_dentry->d_parent, FID_WALK);
+            v9fs_fid_lookup(old_dentry->d_parent);
         struct v9fs_fid *newdirfid =
-            v9fs_fid_lookup(new_dentry->d_parent, FID_WALK);
+            v9fs_fid_lookup(new_dentry->d_parent);
         struct v9fs_stat *mistat = kmalloc(v9ses->maxdata, GFP_KERNEL);
         struct v9fs_fcall *fcall = NULL;
         int fid = -1;
@@ -744,7 +771,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 {
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry, FID_OP);
+        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
         int err = -EPERM;
 
         dprintk(DEBUG_VFS, "dentry: %p\n", dentry);
@@ -778,7 +805,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
 static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
 {
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry, FID_OP);
+        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_stat *mistat = kmalloc(v9ses->maxdata, GFP_KERNEL);
         int res = -EPERM;
@@ -960,7 +987,7 @@ v9fs_vfs_symlink(struct inode *dir, struct dentry *dentry, const char *symname)
         if (retval != 0)
                 goto FreeFcall;
 
-        newfid = v9fs_fid_lookup(dentry, FID_OP);
+        newfid = v9fs_fid_lookup(dentry);
 
         /* issue a twstat */
         v9fs_blank_mistat(v9ses, mistat);
@@ -1004,7 +1031,7 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
 
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dentry->d_inode);
-        struct v9fs_fid *fid = v9fs_fid_lookup(dentry, FID_OP);
+        struct v9fs_fid *fid = v9fs_fid_lookup(dentry);
 
         if (!fid) {
                 dprintk(DEBUG_ERROR, "could not resolve fid from dentry\n");
@@ -1063,8 +1090,8 @@ static int v9fs_vfs_readlink(struct dentry *dentry, char __user * buffer,
         int ret;
         char *link = __getname();
 
-        if (strlen(link) < buflen)
-                buflen = strlen(link);
+        if (buflen > PATH_MAX)
+                buflen = PATH_MAX;
 
         dprintk(DEBUG_VFS, " dentry: %s (%p)\n", dentry->d_iname, dentry);
 
@@ -1148,7 +1175,7 @@ v9fs_vfs_link(struct dentry *old_dentry, struct inode *dir,
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dir);
         struct v9fs_fcall *fcall = NULL;
         struct v9fs_stat *mistat = kmalloc(v9ses->maxdata, GFP_KERNEL);
-        struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry, FID_OP);
+        struct v9fs_fid *oldfid = v9fs_fid_lookup(old_dentry);
         struct v9fs_fid *newfid = NULL;
         char *symname = __getname();
 
@@ -1168,7 +1195,7 @@ v9fs_vfs_link(struct dentry *old_dentry, struct inode *dir,
         if (retval != 0)
                 goto FreeMem;
 
-        newfid = v9fs_fid_lookup(dentry, FID_OP);
+        newfid = v9fs_fid_lookup(dentry);
         if (!newfid) {
                 dprintk(DEBUG_ERROR, "couldn't resolve fid from dentry\n");
                 goto FreeMem;
@@ -1246,7 +1273,7 @@ v9fs_vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t rdev)
         if (retval != 0)
                 goto FreeMem;
 
-        newfid = v9fs_fid_lookup(dentry, FID_OP);
+        newfid = v9fs_fid_lookup(dentry);
         if (!newfid) {
                 dprintk(DEBUG_ERROR, "coudn't resove fid from dentry\n");
                 retval = -EINVAL;
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index 868f350b2c5f..82c5b0084079 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -129,8 +129,7 @@ static struct super_block *v9fs_get_sb(struct file_system_type
 
         if ((newfid = v9fs_session_init(v9ses, dev_name, data)) < 0) {
                 dprintk(DEBUG_ERROR, "problem initiating session\n");
-                retval = newfid;
-                goto free_session;
+                return ERR_PTR(newfid);
         }
 
         sb = sget(fs_type, NULL, v9fs_set_super, v9ses);
@@ -150,28 +149,24 @@ static struct super_block *v9fs_get_sb(struct file_system_type
 
         if (!root) {
                 retval = -ENOMEM;
-                goto release_inode;
+                goto put_back_sb;
         }
 
         sb->s_root = root;
 
-        /* Setup the Root Inode */
-        root_fid = v9fs_fid_create(root);
-        if (root_fid == NULL) {
-                retval = -ENOMEM;
-                goto release_dentry;
-        }
-
-        root_fid->fidopen = 0;
-        root_fid->v9ses = v9ses;
-
         stat_result = v9fs_t_stat(v9ses, newfid, &fcall);
         if (stat_result < 0) {
                 dprintk(DEBUG_ERROR, "stat error\n");
                 v9fs_t_clunk(v9ses, newfid, NULL);
                 v9fs_put_idpool(newfid, &v9ses->fidpool);
         } else {
-                root_fid->fid = newfid;
+                /* Setup the Root Inode */
+                root_fid = v9fs_fid_create(root, v9ses, newfid, 0);
+                if (root_fid == NULL) {
+                        retval = -ENOMEM;
+                        goto put_back_sb;
+                }
+
                 root_fid->qid = fcall->params.rstat.stat->qid;
                 root->d_inode->i_ino =
                     v9fs_qid2ino(&fcall->params.rstat.stat->qid);
@@ -182,25 +177,15 @@ static struct super_block *v9fs_get_sb(struct file_system_type
 
         if (stat_result < 0) {
                 retval = stat_result;
-                goto release_dentry;
+                goto put_back_sb;
         }
 
         return sb;
 
-      release_dentry:
-        dput(sb->s_root);
-
-      release_inode:
-        iput(inode);
-
-      put_back_sb:
+put_back_sb:
+        /* deactivate_super calls v9fs_kill_super which will frees the rest */
         up_write(&sb->s_umount);
         deactivate_super(sb);
-        v9fs_session_close(v9ses);
-
-      free_session:
-        kfree(v9ses);
-
         return ERR_PTR(retval);
 }
 
diff --git a/fs/Kconfig b/fs/Kconfig
index 068ccea2f184..48f5422cb19a 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -472,6 +472,9 @@ config FUSE_FS
           utilities is available from the FUSE homepage:
           <http://fuse.sourceforge.net/>
 
+          See <file:Documentation/filesystems/fuse.txt> for more information.
+          See <file:Documentation/Changes> for needed library/utility version.
+
           If you want to develop a userspace FS, or if you want to use
           a filesystem based on FUSE, answer Y or M.
 
diff --git a/fs/aio.c b/fs/aio.c
index 38f62680fd63..d6b1551342b7 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -562,6 +562,7 @@ static inline void lock_kiocb(struct kiocb *iocb)
 static inline void unlock_kiocb(struct kiocb *iocb)
 {
         kiocbClearLocked(iocb);
+        smp_mb__after_clear_bit();
         wake_up_bit(&iocb->ki_flags, KIF_LOCKED);
 }
 
@@ -740,19 +741,9 @@ static ssize_t aio_run_iocb(struct kiocb *iocb)
         ret = retry(iocb);
         current->io_wait = NULL;
 
-        if (-EIOCBRETRY != ret) {
-                if (-EIOCBQUEUED != ret) {
-                        BUG_ON(!list_empty(&iocb->ki_wait.task_list));
-                        aio_complete(iocb, ret, 0);
-                        /* must not access the iocb after this */
-                }
-        } else {
-                /*
-                 * Issue an additional retry to avoid waiting forever if
-                 * no waits were queued (e.g. in case of a short read).
-                 */
-                if (list_empty(&iocb->ki_wait.task_list))
-                        kiocbSetKicked(iocb);
+        if (ret != -EIOCBRETRY && ret != -EIOCBQUEUED) {
+                BUG_ON(!list_empty(&iocb->ki_wait.task_list));
+                aio_complete(iocb, ret, 0);
         }
 out:
         spin_lock_irq(&ctx->ctx_lock);
@@ -898,16 +889,24 @@ static void aio_kick_handler(void *data)
  * and if required activate the aio work queue to process
  * it
  */
-static void queue_kicked_iocb(struct kiocb *iocb)
+static void try_queue_kicked_iocb(struct kiocb *iocb)
 {
         struct kioctx   *ctx = iocb->ki_ctx;
         unsigned long flags;
         int run = 0;
 
-        WARN_ON((!list_empty(&iocb->ki_wait.task_list)));
+        /* We're supposed to be the only path putting the iocb back on the run
+         * list.  If we find that the iocb is *back* on a wait queue already
+         * than retry has happened before we could queue the iocb.  This also
+         * means that the retry could have completed and freed our iocb, no
+         * good. */
+        BUG_ON((!list_empty(&iocb->ki_wait.task_list)));
 
         spin_lock_irqsave(&ctx->ctx_lock, flags);
-        run = __queue_kicked_iocb(iocb);
+        /* set this inside the lock so that we can't race with aio_run_iocb()
+         * testing it and putting the iocb on the run list under the lock */
+        if (!kiocbTryKick(iocb))
+                run = __queue_kicked_iocb(iocb);
         spin_unlock_irqrestore(&ctx->ctx_lock, flags);
         if (run)
                 aio_queue_work(ctx);
@@ -930,10 +929,7 @@ void fastcall kick_iocb(struct kiocb *iocb)
                 return;
         }
 
-        /* If its already kicked we shouldn't queue it again */
-        if (!kiocbTryKick(iocb)) {
-                queue_kicked_iocb(iocb);
-        }
+        try_queue_kicked_iocb(iocb);
 }
 EXPORT_SYMBOL(kick_iocb);
 
@@ -1321,8 +1317,11 @@ asmlinkage long sys_io_destroy(aio_context_t ctx)
 }
 
 /*
- * Default retry method for aio_read (also used for first time submit)
- * Responsible for updating iocb state as retries progress
+ * aio_p{read,write} are the default  ki_retry methods for
+ * IO_CMD_P{READ,WRITE}.  They maintains kiocb retry state around potentially
+ * multiple calls to f_op->aio_read().  They loop around partial progress
+ * instead of returning -EIOCBRETRY because they don't have the means to call
+ * kick_iocb().
  */
 static ssize_t aio_pread(struct kiocb *iocb)
 {
@@ -1331,25 +1330,25 @@ static ssize_t aio_pread(struct kiocb *iocb)
         struct inode *inode = mapping->host;
         ssize_t ret = 0;
 
-        ret = file->f_op->aio_read(iocb, iocb->ki_buf,
-                iocb->ki_left, iocb->ki_pos);
+        do {
+                ret = file->f_op->aio_read(iocb, iocb->ki_buf,
+                        iocb->ki_left, iocb->ki_pos);
+                /*
+                 * Can't just depend on iocb->ki_left to determine
+                 * whether we are done. This may have been a short read.
+                 */
+                if (ret > 0) {
+                        iocb->ki_buf += ret;
+                        iocb->ki_left -= ret;
+                }
 
-        /*
-         * Can't just depend on iocb->ki_left to determine
-         * whether we are done. This may have been a short read.
-         */
-        if (ret > 0) {
-                iocb->ki_buf += ret;
-                iocb->ki_left -= ret;
                 /*
-                 * For pipes and sockets we return once we have
-                 * some data; for regular files we retry till we
-                 * complete the entire read or find that we can't
-                 * read any more data (e.g short reads).
+                 * For pipes and sockets we return once we have some data; for
+                 * regular files we retry till we complete the entire read or
+                 * find that we can't read any more data (e.g short reads).
                  */
-                if (!S_ISFIFO(inode->i_mode) && !S_ISSOCK(inode->i_mode))
-                        ret = -EIOCBRETRY;
-        }
+        } while (ret > 0 && iocb->ki_left > 0 &&
+                 !S_ISFIFO(inode->i_mode) && !S_ISSOCK(inode->i_mode));
 
         /* This means we must have transferred all that we could */
         /* No need to retry anymore */
@@ -1359,27 +1358,21 @@ static ssize_t aio_pread(struct kiocb *iocb)
         return ret;
 }
 
-/*
- * Default retry method for aio_write (also used for first time submit)
- * Responsible for updating iocb state as retries progress
- */
+/* see aio_pread() */
 static ssize_t aio_pwrite(struct kiocb *iocb)
 {
         struct file *file = iocb->ki_filp;
         ssize_t ret = 0;
 
-        ret = file->f_op->aio_write(iocb, iocb->ki_buf,
-                iocb->ki_left, iocb->ki_pos);
-
-        if (ret > 0) {
-                iocb->ki_buf += ret;
-                iocb->ki_left -= ret;
-
-                ret = -EIOCBRETRY;
-        }
+        do {
+                ret = file->f_op->aio_write(iocb, iocb->ki_buf,
+                        iocb->ki_left, iocb->ki_pos);
+                if (ret > 0) {
+                        iocb->ki_buf += ret;
+                        iocb->ki_left -= ret;
+                }
+        } while (ret > 0 && iocb->ki_left > 0);
 
-        /* This means we must have transferred all that we could */
-        /* No need to retry anymore */
         if ((ret == 0) || (iocb->ki_left == 0))
                 ret = iocb->ki_nbytes - iocb->ki_left;
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 8cc23e7d0d5d..1ebf7dafc1d7 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -781,6 +781,8 @@ static int cifs_oplock_thread(void * dummyarg)
 
         oplockThread = current;
         do {
+                if (try_to_freeze()) 
+                        continue;
                 set_current_state(TASK_INTERRUPTIBLE);
                 
                 schedule_timeout(1*HZ);  
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 2335f14a1583..47360156cc54 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -344,6 +344,8 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
         }
 
         while (server->tcpStatus != CifsExiting) {
+                if (try_to_freeze())
+                        continue;
                 if (bigbuf == NULL) {
                         bigbuf = cifs_buf_get();
                         if(bigbuf == NULL) {
diff --git a/fs/compat.c b/fs/compat.c
index ac3fb9ed8eea..a719e158e002 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -44,6 +44,8 @@
 #include <linux/nfsd/syscall.h>
 #include <linux/personality.h>
 #include <linux/rwsem.h>
+#include <linux/acct.h>
+#include <linux/mm.h>
 
 #include <net/sock.h>           /* siocdevprivate_ioctl */
 
@@ -1487,6 +1489,8 @@ int compat_do_execve(char * filename,
 
                 /* execve success */
                 security_bprm_free(bprm);
+                acct_update_integrals(current);
+                update_mem_hiwater(current);
                 kfree(bprm);
                 return retval;
         }
diff --git a/fs/dcache.c b/fs/dcache.c
index 7376b61269fb..fb10386c59be 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -102,7 +102,8 @@ static inline void dentry_iput(struct dentry * dentry)
                 list_del_init(&dentry->d_alias);
                 spin_unlock(&dentry->d_lock);
                 spin_unlock(&dcache_lock);
-                fsnotify_inoderemove(inode);
+                if (!inode->i_nlink)
+                        fsnotify_inoderemove(inode);
                 if (dentry->d_op && dentry->d_op->d_iput)
                         dentry->d_op->d_iput(dentry, inode);
                 else
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 6ab1dd0ca904..4284cd31eba6 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -101,6 +101,10 @@
 /* Maximum number of poll wake up nests we are allowing */
 #define EP_MAX_POLLWAKE_NESTS 4
 
+/* Maximum msec timeout value storeable in a long int */
+#define EP_MAX_MSTIMEO min(1000ULL * MAX_SCHEDULE_TIMEOUT / HZ, (LONG_MAX - 999ULL) / HZ)
+
+
 struct epoll_filefd {
         struct file *file;
         int fd;
@@ -231,8 +235,9 @@ struct ep_pqueue {
 
 static void ep_poll_safewake_init(struct poll_safewake *psw);
 static void ep_poll_safewake(struct poll_safewake *psw, wait_queue_head_t *wq);
-static int ep_getfd(int *efd, struct inode **einode, struct file **efile);
-static int ep_file_init(struct file *file);
+static int ep_getfd(int *efd, struct inode **einode, struct file **efile,
+                    struct eventpoll *ep);
+static int ep_alloc(struct eventpoll **pep);
 static void ep_free(struct eventpoll *ep);
 static struct epitem *ep_find(struct eventpoll *ep, struct file *file, int fd);
 static void ep_use_epitem(struct epitem *epi);
@@ -501,38 +506,37 @@ void eventpoll_release_file(struct file *file)
 asmlinkage long sys_epoll_create(int size)
 {
         int error, fd;
+        struct eventpoll *ep;
         struct inode *inode;
         struct file *file;
 
         DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d)\n",
                      current, size));
 
-        /* Sanity check on the size parameter */
+        /*
+         * Sanity check on the size parameter, and create the internal data
+         * structure ( "struct eventpoll" ).
+         */
         error = -EINVAL;
-        if (size <= 0)
+        if (size <= 0 || (error = ep_alloc(&ep)) != 0)
                 goto eexit_1;
 
         /*
          * Creates all the items needed to setup an eventpoll file. That is,
          * a file structure, and inode and a free file descriptor.
          */
-        error = ep_getfd(&fd, &inode, &file);
-        if (error)
-                goto eexit_1;
-
-        /* Setup the file internal data structure ( "struct eventpoll" ) */
-        error = ep_file_init(file);
+        error = ep_getfd(&fd, &inode, &file, ep);
         if (error)
                 goto eexit_2;
 
-
         DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d) = %d\n",
                      current, size, fd));
 
         return fd;
 
 eexit_2:
-        sys_close(fd);
+        ep_free(ep);
+        kfree(ep);
 eexit_1:
         DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d) = %d\n",
                      current, size, error));
@@ -706,7 +710,8 @@ eexit_1:
 /*
  * Creates the file descriptor to be used by the epoll interface.
  */
-static int ep_getfd(int *efd, struct inode **einode, struct file **efile)
+static int ep_getfd(int *efd, struct inode **einode, struct file **efile,
+                    struct eventpoll *ep)
 {
         struct qstr this;
         char name[32];
@@ -756,7 +761,7 @@ static int ep_getfd(int *efd, struct inode **einode, struct file **efile)
         file->f_op = &eventpoll_fops;
         file->f_mode = FMODE_READ;
         file->f_version = 0;
-        file->private_data = NULL;
+        file->private_data = ep;
 
         /* Install the new setup file into the allocated fd. */
         fd_install(fd, file);
@@ -777,14 +782,13 @@ eexit_1:
 }
 
 
-static int ep_file_init(struct file *file)
+static int ep_alloc(struct eventpoll **pep)
 {
-        struct eventpoll *ep;
+        struct eventpoll *ep = kzalloc(sizeof(*ep), GFP_KERNEL);
 
-        if (!(ep = kmalloc(sizeof(struct eventpoll), GFP_KERNEL)))
+        if (!ep)
                 return -ENOMEM;
 
-        memset(ep, 0, sizeof(*ep));
         rwlock_init(&ep->lock);
         init_rwsem(&ep->sem);
         init_waitqueue_head(&ep->wq);
@@ -792,9 +796,9 @@ static int ep_file_init(struct file *file)
         INIT_LIST_HEAD(&ep->rdllist);
         ep->rbr = RB_ROOT;
 
-        file->private_data = ep;
+        *pep = ep;
 
-        DNPRINTK(3, (KERN_INFO "[%p] eventpoll: ep_file_init() ep=%p\n",
+        DNPRINTK(3, (KERN_INFO "[%p] eventpoll: ep_alloc() ep=%p\n",
                      current, ep));
         return 0;
 }
@@ -1506,8 +1510,8 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
          * and the overflow condition. The passed timeout is in milliseconds,
          * that why (t * HZ) / 1000.
          */
-        jtimeout = timeout == -1 || timeout > (MAX_SCHEDULE_TIMEOUT - 1000) / HZ ?
-                MAX_SCHEDULE_TIMEOUT: (timeout * HZ + 999) / 1000;
+        jtimeout = (timeout < 0 || timeout >= EP_MAX_MSTIMEO) ?
+                MAX_SCHEDULE_TIMEOUT : (timeout * HZ + 999) / 1000;
 
 retry:
         write_lock_irqsave(&ep->lock, flags);
diff --git a/fs/exec.c b/fs/exec.c
index 14dd03907ccb..a04a575ad433 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -421,11 +421,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
         if (!mpnt)
                 return -ENOMEM;
 
-        if (security_vm_enough_memory(arg_size >> PAGE_SHIFT)) {
-                kmem_cache_free(vm_area_cachep, mpnt);
-                return -ENOMEM;
-        }
-
         memset(mpnt, 0, sizeof(*mpnt));
 
         down_write(&mm->mmap_sem);
@@ -745,8 +740,8 @@ static inline int de_thread(struct task_struct *tsk)
         }
 
         /*
-         * Now there are really no other threads at all,
-         * so it's safe to stop telling them to kill themselves.
+         * There may be one thread left which is just exiting,
+         * but it's safe to stop telling the group to kill themselves.
          */
         sig->flags = 0;
 
@@ -785,7 +780,6 @@ no_thread_group:
                         kmem_cache_free(sighand_cachep, oldsighand);
         }
 
-        BUG_ON(!thread_group_empty(current));
         BUG_ON(!thread_group_leader(current));
         return 0;
 }
diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index c8d07030c897..e2d6208633a7 100644
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -605,27 +605,28 @@ got:
         insert_inode_hash(inode);
 
         if (DQUOT_ALLOC_INODE(inode)) {
-                DQUOT_DROP(inode);
                 err = -ENOSPC;
-                goto fail2;
+                goto fail_drop;
         }
+
         err = ext2_init_acl(inode, dir);
-        if (err) {
-                DQUOT_FREE_INODE(inode);
-                DQUOT_DROP(inode);
-                goto fail2;
-        }
+        if (err)
+                goto fail_free_drop;
+
         err = ext2_init_security(inode,dir);
-        if (err) {
-                DQUOT_FREE_INODE(inode);
-                goto fail2;
-        }
+        if (err)
+                goto fail_free_drop;
+
         mark_inode_dirty(inode);
         ext2_debug("allocating inode %lu\n", inode->i_ino);
         ext2_preread_inode(inode);
         return inode;
 
-fail2:
+fail_free_drop:
+        DQUOT_FREE_INODE(inode);
+
+fail_drop:
+        DQUOT_DROP(inode);
         inode->i_flags |= S_NOQUOTA;
         inode->i_nlink = 0;
         iput(inode);
diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
index e463dca008e4..0213db4911a2 100644
--- a/fs/ext3/balloc.c
+++ b/fs/ext3/balloc.c
@@ -1410,7 +1410,7 @@ unsigned long ext3_count_free_blocks(struct super_block *sb)
         unsigned long desc_count;
         struct ext3_group_desc *gdp;
         int i;
-        unsigned long ngroups;
+        unsigned long ngroups = EXT3_SB(sb)->s_groups_count;
 #ifdef EXT3FS_DEBUG
         struct ext3_super_block *es;
         unsigned long bitmap_count, x;
@@ -1421,7 +1421,8 @@ unsigned long ext3_count_free_blocks(struct super_block *sb)
         desc_count = 0;
         bitmap_count = 0;
         gdp = NULL;
-        for (i = 0; i < EXT3_SB(sb)->s_groups_count; i++) {
+
+        for (i = 0; i < ngroups; i++) {
                 gdp = ext3_get_group_desc(sb, i, NULL);
                 if (!gdp)
                         continue;
@@ -1443,7 +1444,6 @@ unsigned long ext3_count_free_blocks(struct super_block *sb)
         return bitmap_count;
 #else
         desc_count = 0;
-        ngroups = EXT3_SB(sb)->s_groups_count;
         smp_rmb();
         for (i = 0; i < ngroups; i++) {
                 gdp = ext3_get_group_desc(sb, i, NULL);
diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
index 96552769d039..6549945f9ac1 100644
--- a/fs/ext3/ialloc.c
+++ b/fs/ext3/ialloc.c
@@ -597,27 +597,22 @@ got:
 
         ret = inode;
         if(DQUOT_ALLOC_INODE(inode)) {
-                DQUOT_DROP(inode);
                 err = -EDQUOT;
-                goto fail2;
+                goto fail_drop;
         }
+
         err = ext3_init_acl(handle, inode, dir);
-        if (err) {
-                DQUOT_FREE_INODE(inode);
-                DQUOT_DROP(inode);
-                goto fail2;
-        }
+        if (err)
+                goto fail_free_drop;
+
         err = ext3_init_security(handle,inode, dir);
-        if (err) {
-                DQUOT_FREE_INODE(inode);
-                goto fail2;
-        }
+        if (err)
+                goto fail_free_drop;
+
         err = ext3_mark_inode_dirty(handle, inode);
         if (err) {
                 ext3_std_error(sb, err);
-                DQUOT_FREE_INODE(inode);
-                DQUOT_DROP(inode);
-                goto fail2;
+                goto fail_free_drop;
         }
 
         ext3_debug("allocating inode %lu\n", inode->i_ino);
@@ -631,7 +626,11 @@ really_out:
         brelse(bitmap_bh);
         return ret;
 
-fail2:
+fail_free_drop:
+        DQUOT_FREE_INODE(inode);
+
+fail_drop:
+        DQUOT_DROP(inode);
         inode->i_flags |= S_NOQUOTA;
         inode->i_nlink = 0;
         iput(inode);
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 2c9f81278d5d..57f79106267d 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -242,7 +242,7 @@ static int setup_new_group_blocks(struct super_block *sb,
              i < sbi->s_itb_per_group; i++, bit++, block++) {
                 struct buffer_head *it;
 
-                ext3_debug("clear inode block %#04x (+%ld)\n", block, bit);
+                ext3_debug("clear inode block %#04lx (+%d)\n", block, bit);
                 if (IS_ERR(it = bclean(handle, sb, block))) {
                         err = PTR_ERR(it);
                         goto exit_bh;
@@ -643,8 +643,8 @@ static void update_backups(struct super_block *sb,
                         break;
 
                 bh = sb_getblk(sb, group * bpg + blk_off);
-                ext3_debug(sb, __FUNCTION__, "update metadata backup %#04lx\n",
-                           bh->b_blocknr);
+                ext3_debug("update metadata backup %#04lx\n",
+                          (unsigned long)bh->b_blocknr);
                 if ((err = ext3_journal_get_write_access(handle, bh)))
                         break;
                 lock_buffer(bh);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index a93c3609025d..9e24ceb019fe 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -512,15 +512,14 @@ static void ext3_clear_inode(struct inode *inode)
 
 static int ext3_show_options(struct seq_file *seq, struct vfsmount *vfs)
 {
-        struct ext3_sb_info *sbi = EXT3_SB(vfs->mnt_sb);
+        struct super_block *sb = vfs->mnt_sb;
+        struct ext3_sb_info *sbi = EXT3_SB(sb);
 
-        if (sbi->s_mount_opt & EXT3_MOUNT_JOURNAL_DATA)
+        if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_JOURNAL_DATA)
                 seq_puts(seq, ",data=journal");
-
-        if (sbi->s_mount_opt & EXT3_MOUNT_ORDERED_DATA)
+        else if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_ORDERED_DATA)
                 seq_puts(seq, ",data=ordered");
-
-        if (sbi->s_mount_opt & EXT3_MOUNT_WRITEBACK_DATA)
+        else if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_WRITEBACK_DATA)
                 seq_puts(seq, ",data=writeback");
 
 #if defined(CONFIG_QUOTA)
diff --git a/fs/fat/file.c b/fs/fat/file.c
index 62ffa9139400..7134403d5be2 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -12,39 +12,6 @@
 #include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
 
-static ssize_t fat_file_aio_write(struct kiocb *iocb, const char __user *buf,
-                                  size_t count, loff_t pos)
-{
-        struct inode *inode = iocb->ki_filp->f_dentry->d_inode;
-        int retval;
-
-        retval = generic_file_aio_write(iocb, buf, count, pos);
-        if (retval > 0) {
-                inode->i_mtime = inode->i_ctime = CURRENT_TIME_SEC;
-                MSDOS_I(inode)->i_attrs |= ATTR_ARCH;
-                mark_inode_dirty(inode);
-//              check the locking rules
-//              if (IS_SYNC(inode))
-//                      fat_sync_inode(inode);
-        }
-        return retval;
-}
-
-static ssize_t fat_file_writev(struct file *filp, const struct iovec *iov,
-                               unsigned long nr_segs, loff_t *ppos)
-{
-        struct inode *inode = filp->f_dentry->d_inode;
-        int retval;
-
-        retval = generic_file_writev(filp, iov, nr_segs, ppos);
-        if (retval > 0) {
-                inode->i_mtime = inode->i_ctime = CURRENT_TIME_SEC;
-                MSDOS_I(inode)->i_attrs |= ATTR_ARCH;
-                mark_inode_dirty(inode);
-        }
-        return retval;
-}
-
 int fat_generic_ioctl(struct inode *inode, struct file *filp,
                       unsigned int cmd, unsigned long arg)
 {
@@ -148,9 +115,9 @@ struct file_operations fat_file_operations = {
         .read           = do_sync_read,
         .write          = do_sync_write,
         .readv          = generic_file_readv,
-        .writev         = fat_file_writev,
+        .writev         = generic_file_writev,
         .aio_read       = generic_file_aio_read,
-        .aio_write      = fat_file_aio_write,
+        .aio_write      = generic_file_aio_write,
         .mmap           = generic_file_mmap,
         .ioctl          = fat_generic_ioctl,
         .fsync          = file_fsync,
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index a7cbe68e2259..e2effe2dc9b2 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -102,6 +102,19 @@ static int fat_prepare_write(struct file *file, struct page *page,
                                   &MSDOS_I(page->mapping->host)->mmu_private);
 }
 
+static int fat_commit_write(struct file *file, struct page *page,
+                            unsigned from, unsigned to)
+{
+        struct inode *inode = page->mapping->host;
+        int err = generic_commit_write(file, page, from, to);
+        if (!err && !(MSDOS_I(inode)->i_attrs & ATTR_ARCH)) {
+                inode->i_mtime = inode->i_ctime = CURRENT_TIME_SEC;
+                MSDOS_I(inode)->i_attrs |= ATTR_ARCH;
+                mark_inode_dirty(inode);
+        }
+        return err;
+}
+
 static sector_t _fat_bmap(struct address_space *mapping, sector_t block)
 {
         return generic_block_bmap(mapping, block, fat_get_block);
@@ -112,7 +125,7 @@ static struct address_space_operations fat_aops = {
         .writepage      = fat_writepage,
         .sync_page      = block_sync_page,
         .prepare_write  = fat_prepare_write,
-        .commit_write   = generic_commit_write,
+        .commit_write   = fat_commit_write,
         .bmap           = _fat_bmap
 };
 
@@ -287,9 +300,9 @@ static int fat_fill_inode(struct inode *inode, struct msdos_dir_entry *de)
         inode->i_blksize = sbi->cluster_size;
         inode->i_blocks = ((inode->i_size + (sbi->cluster_size - 1))
                            & ~((loff_t)sbi->cluster_size - 1)) >> 9;
-        inode->i_mtime.tv_sec = inode->i_atime.tv_sec =
+        inode->i_mtime.tv_sec =
                 date_dos2unix(le16_to_cpu(de->time), le16_to_cpu(de->date));
-        inode->i_mtime.tv_nsec = inode->i_atime.tv_nsec = 0;
+        inode->i_mtime.tv_nsec = 0;
         if (sbi->options.isvfat) {
                 int secs = de->ctime_cs / 100;
                 int csecs = de->ctime_cs % 100;
@@ -297,8 +310,11 @@ static int fat_fill_inode(struct inode *inode, struct msdos_dir_entry *de)
                         date_dos2unix(le16_to_cpu(de->ctime),
                                       le16_to_cpu(de->cdate)) + secs;
                 inode->i_ctime.tv_nsec = csecs * 10000000;
+                inode->i_atime.tv_sec =
+                        date_dos2unix(le16_to_cpu(0), le16_to_cpu(de->adate));
+                inode->i_atime.tv_nsec = 0;
         } else
-                inode->i_ctime = inode->i_mtime;
+                inode->i_ctime = inode->i_atime = inode->i_mtime;
 
         return 0;
 }
@@ -500,7 +516,9 @@ retry:
         raw_entry->starthi = cpu_to_le16(MSDOS_I(inode)->i_logstart >> 16);
         fat_date_unix2dos(inode->i_mtime.tv_sec, &raw_entry->time, &raw_entry->date);
         if (sbi->options.isvfat) {
+                __le16 atime;
                 fat_date_unix2dos(inode->i_ctime.tv_sec,&raw_entry->ctime,&raw_entry->cdate);
+                fat_date_unix2dos(inode->i_atime.tv_sec,&atime,&raw_entry->adate);
                 raw_entry->ctime_cs = (inode->i_ctime.tv_sec & 1) * 100 +
                         inode->i_ctime.tv_nsec / 10000000;
         }
diff --git a/fs/file.c b/fs/file.c
index 2127a7b9dc3a..fd066b261c75 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -69,13 +69,9 @@ void free_fd_array(struct file **array, int num)
 
 static void __free_fdtable(struct fdtable *fdt)
 {
-        int fdset_size, fdarray_size;
-
-        fdset_size = fdt->max_fdset / 8;
-        fdarray_size = fdt->max_fds * sizeof(struct file *);
-        free_fdset(fdt->open_fds, fdset_size);
-        free_fdset(fdt->close_on_exec, fdset_size);
-        free_fd_array(fdt->fd, fdarray_size);
+        free_fdset(fdt->open_fds, fdt->max_fdset);
+        free_fdset(fdt->close_on_exec, fdt->max_fdset);
+        free_fd_array(fdt->fd, fdt->max_fds);
         kfree(fdt);
 }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index e79e49b3eec7..29f1e9f6e85c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -96,6 +96,8 @@ static int fuse_lookup_iget(struct inode *dir, struct dentry *entry,
         fuse_lookup_init(req, dir, entry, &outarg);
         request_send(fc, req);
         err = req->out.h.error;
+        if (!err && (!outarg.nodeid || outarg.nodeid == FUSE_ROOT_ID))
+                err = -EIO;
         if (!err) {
                 inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                                   &outarg.attr);
@@ -152,6 +154,10 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
                 fuse_put_request(fc, req);
                 return err;
         }
+        if (!outarg.nodeid || outarg.nodeid == FUSE_ROOT_ID) {
+                fuse_put_request(fc, req);
+                return -EIO;
+        }
         inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                           &outarg.attr);
         if (!inode) {
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 6454022b0536..657ab11c173b 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -23,6 +23,10 @@ int fuse_open_common(struct inode *inode, struct file *file, int isdir)
         struct fuse_file *ff;
         int err;
 
+        /* VFS checks this, but only _after_ ->open() */
+        if (file->f_flags & O_DIRECT)
+                return -EINVAL;
+
         err = generic_file_open(inode, file);
         if (err)
                 return err;
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 59c5062cd63f..dd7113106269 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -793,11 +793,6 @@ int hostfs_rename(struct inode *from_ino, struct dentry *from,
         return(err);
 }
 
-void hostfs_truncate(struct inode *ino)
-{
-        not_implemented();
-}
-
 int hostfs_permission(struct inode *ino, int desired, struct nameidata *nd)
 {
         char *name;
@@ -894,7 +889,6 @@ static struct inode_operations hostfs_iops = {
         .rmdir          = hostfs_rmdir,
         .mknod          = hostfs_mknod,
         .rename         = hostfs_rename,
-        .truncate       = hostfs_truncate,
         .permission     = hostfs_permission,
         .setattr        = hostfs_setattr,
         .getattr        = hostfs_getattr,
@@ -910,7 +904,6 @@ static struct inode_operations hostfs_dir_iops = {
         .rmdir          = hostfs_rmdir,
         .mknod          = hostfs_mknod,
         .rename         = hostfs_rename,
-        .truncate       = hostfs_truncate,
         .permission     = hostfs_permission,
         .setattr        = hostfs_setattr,
         .getattr        = hostfs_getattr,
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 0ec62d5310db..9f942ca8e4e3 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -129,8 +129,7 @@ void jfs_delete_inode(struct inode *inode)
         jfs_info("In jfs_delete_inode, inode = 0x%p", inode);
 
         if (!is_bad_inode(inode) &&
-            (JFS_IP(inode)->fileset == cpu_to_le32(FILESYSTEM_I))) {
-
+            (JFS_IP(inode)->fileset == FILESYSTEM_I)) {
                 truncate_inode_pages(&inode->i_data, 0);
 
                 if (test_cflag(COMMIT_Freewmap, inode))
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index c739626f5bf1..eadf319bee22 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -3055,7 +3055,7 @@ static int cntlz(u32 value)
  * RETURN VALUES:
  *      log2 number of blocks
  */
-int blkstol2(s64 nb)
+static int blkstol2(s64 nb)
 {
         int l2nb;
         s64 mask;               /* meant to be signed */
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index c7a92f9deb2b..9b71ed2674fe 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -725,6 +725,9 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
         else
                 tlck->flag = tlckINODELOCK;
 
+        if (S_ISDIR(ip->i_mode))
+                tlck->flag |= tlckDIRECTORY;
+
         tlck->type = 0;
 
         /* bind the tlock and the page */
@@ -1009,6 +1012,8 @@ struct tlock *txMaplock(tid_t tid, struct inode *ip, int type)
 
         /* bind the tlock and the object */
         tlck->flag = tlckINODELOCK;
+        if (S_ISDIR(ip->i_mode))
+                tlck->flag |= tlckDIRECTORY;
         tlck->ip = ip;
         tlck->mp = NULL;
 
@@ -1077,6 +1082,8 @@ struct linelock *txLinelock(struct linelock * tlock)
         linelock->flag = tlckLINELOCK;
         linelock->maxcnt = TLOCKLONG;
         linelock->index = 0;
+        if (tlck->flag & tlckDIRECTORY)
+                linelock->flag |= tlckDIRECTORY;
 
         /* append linelock after tlock */
         linelock->next = tlock->next;
@@ -2070,8 +2077,8 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
  *
  * function:    log from maplock of freed data extents;
  */
-void mapLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
-            struct tlock * tlck)
+static void mapLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+                   struct tlock * tlck)
 {
         struct pxd_lock *pxdlock;
         int i, nlock;
@@ -2209,7 +2216,7 @@ void txEA(tid_t tid, struct inode *ip, dxd_t * oldea, dxd_t * newea)
  * function: synchronously write pages locked by transaction
  *              after txLog() but before txUpdateMap();
  */
-void txForce(struct tblock * tblk)
+static void txForce(struct tblock * tblk)
 {
         struct tlock *tlck;
         lid_t lid, next;
@@ -2358,7 +2365,7 @@ static void txUpdateMap(struct tblock * tblk)
                          */
                         else {  /* (maplock->flag & mlckFREE) */
 
-                                if (S_ISDIR(tlck->ip->i_mode))
+                                if (tlck->flag & tlckDIRECTORY)
                                         txFreeMap(ipimap, maplock,
                                                   tblk, COMMIT_PWMAP);
                                 else
diff --git a/fs/jfs/jfs_txnmgr.h b/fs/jfs/jfs_txnmgr.h
index 59ad0f6b7231..0e4dc4514c47 100644
--- a/fs/jfs/jfs_txnmgr.h
+++ b/fs/jfs/jfs_txnmgr.h
@@ -122,6 +122,7 @@ extern struct tlock *TxLock;	/* transaction lock table */
 #define tlckLOG                 0x0800
 /* updateMap state */
 #define tlckUPDATEMAP           0x0080
+#define tlckDIRECTORY           0x0040
 /* freeLock state */
 #define tlckFREELOCK            0x0008
 #define tlckWRITEPAGE           0x0004
diff --git a/fs/locks.c b/fs/locks.c
index c2c09b4798d6..f7daa5f48949 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -124,6 +124,7 @@
 #include <linux/smp_lock.h>
 #include <linux/syscalls.h>
 #include <linux/time.h>
+#include <linux/rcupdate.h>
 
 #include <asm/semaphore.h>
 #include <asm/uaccess.h>
@@ -2205,6 +2206,7 @@ void steal_locks(fl_owner_t from)
 
         lock_kernel();
         j = 0;
+        rcu_read_lock();
         fdt = files_fdtable(files);
         for (;;) {
                 unsigned long set;
@@ -2222,6 +2224,7 @@ void steal_locks(fl_owner_t from)
                         set >>= 1;
                 }
         }
+        rcu_read_unlock();
         unlock_kernel();
 }
 EXPORT_SYMBOL(steal_locks);
diff --git a/fs/namei.c b/fs/namei.c
index 21d85f1ac839..043d587216b5 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1048,7 +1048,7 @@ int fastcall path_lookup(const char *name, unsigned int flags, struct nameidata
 out:
         if (unlikely(current->audit_context
                      && nd && nd->dentry && nd->dentry->d_inode))
-                audit_inode(name, nd->dentry->d_inode);
+                audit_inode(name, nd->dentry->d_inode, flags);
         return retval;
 }
 
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 6ceb1d471f20..9758ebd49905 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -184,14 +184,13 @@ static void nfs_readpage_release(struct nfs_page *req)
 {
         unlock_page(req->wb_page);
 
-        nfs_clear_request(req);
-        nfs_release_request(req);
-
         dprintk("NFS: read done (%s/%Ld %d@%Ld)\n",
                         req->wb_context->dentry->d_inode->i_sb->s_id,
                         (long long)NFS_FILEID(req->wb_context->dentry->d_inode),
                         req->wb_bytes,
                         (long long)req_offset(req));
+        nfs_clear_request(req);
+        nfs_release_request(req);
 }
 
 /*
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index e08edc17c6a0..361b4007d4a0 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -162,7 +162,7 @@ do_open_fhandle(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_
 
 
 static inline int
-nfsd4_open(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
+nfsd4_open(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open, struct nfs4_stateowner **replay_owner)
 {
         int status;
         dprintk("NFSD: nfsd4_open filename %.*s op_stateowner %p\n",
@@ -238,8 +238,10 @@ nfsd4_open(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open
          */
         status = nfsd4_process_open2(rqstp, current_fh, open);
 out:
-        if (open->op_stateowner)
+        if (open->op_stateowner) {
                 nfs4_get_stateowner(open->op_stateowner);
+                *replay_owner = open->op_stateowner;
+        }
         nfs4_unlock_state();
         return status;
 }
@@ -809,8 +811,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
                         op->status = nfsd4_access(rqstp, current_fh, &op->u.access);
                         break;
                 case OP_CLOSE:
-                        op->status = nfsd4_close(rqstp, current_fh, &op->u.close);
-                        replay_owner = op->u.close.cl_stateowner;
+                        op->status = nfsd4_close(rqstp, current_fh, &op->u.close, &replay_owner);
                         break;
                 case OP_COMMIT:
                         op->status = nfsd4_commit(rqstp, current_fh, &op->u.commit);
@@ -831,15 +832,13 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
                         op->status = nfsd4_link(rqstp, current_fh, save_fh, &op->u.link);
                         break;
                 case OP_LOCK:
-                        op->status = nfsd4_lock(rqstp, current_fh, &op->u.lock);
-                        replay_owner = op->u.lock.lk_stateowner;
+                        op->status = nfsd4_lock(rqstp, current_fh, &op->u.lock, &replay_owner);
                         break;
                 case OP_LOCKT:
                         op->status = nfsd4_lockt(rqstp, current_fh, &op->u.lockt);
                         break;
                 case OP_LOCKU:
-                        op->status = nfsd4_locku(rqstp, current_fh, &op->u.locku);
-                        replay_owner = op->u.locku.lu_stateowner;
+                        op->status = nfsd4_locku(rqstp, current_fh, &op->u.locku, &replay_owner);
                         break;
                 case OP_LOOKUP:
                         op->status = nfsd4_lookup(rqstp, current_fh, &op->u.lookup);
@@ -853,16 +852,13 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
                                 op->status = nfs_ok;
                         break;
                 case OP_OPEN:
-                        op->status = nfsd4_open(rqstp, current_fh, &op->u.open);
-                        replay_owner = op->u.open.op_stateowner;
+                        op->status = nfsd4_open(rqstp, current_fh, &op->u.open, &replay_owner);
                         break;
                 case OP_OPEN_CONFIRM:
-                        op->status = nfsd4_open_confirm(rqstp, current_fh, &op->u.open_confirm);
-                        replay_owner = op->u.open_confirm.oc_stateowner;
+                        op->status = nfsd4_open_confirm(rqstp, current_fh, &op->u.open_confirm, &replay_owner);
                         break;
                 case OP_OPEN_DOWNGRADE:
-                        op->status = nfsd4_open_downgrade(rqstp, current_fh, &op->u.open_downgrade);
-                        replay_owner = op->u.open_downgrade.od_stateowner;
+                        op->status = nfsd4_open_downgrade(rqstp, current_fh, &op->u.open_downgrade, &replay_owner);
                         break;
                 case OP_PUTFH:
                         op->status = nfsd4_putfh(rqstp, current_fh, &op->u.putfh);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index b83f8fb441e1..6bbefd06f10d 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -624,7 +624,7 @@ gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se)
         cb->cb_ident = se->se_callback_ident;
         return;
 out_err:
-        printk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
+        dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
                 "will not receive delegations\n",
                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
 
@@ -678,13 +678,12 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_setclientid *setclid)
         int                     status;
         char                    dname[HEXDIR_LEN];
         
-        status = nfserr_inval;
         if (!check_name(clname))
-                goto out;
+                return nfserr_inval;
 
         status = nfs4_make_rec_clidname(dname, &clname);
         if (status)
-                goto out;
+                return status;
 
         /* 
          * XXX The Duplicate Request Cache (DRC) has been checked (??)
@@ -2014,7 +2013,7 @@ STALE_STATEID(stateid_t *stateid)
 {
         if (stateid->si_boot == boot_time)
                 return 0;
-        printk("NFSD: stale stateid (%08x/%08x/%08x/%08x)!\n",
+        dprintk("NFSD: stale stateid (%08x/%08x/%08x/%08x)!\n",
                 stateid->si_boot, stateid->si_stateownerid, stateid->si_fileid,
                 stateid->si_generation);
         return 1;
@@ -2275,7 +2274,7 @@ nfs4_preprocess_seqid_op(struct svc_fh *current_fh, u32 seqid, stateid_t *statei
 
 check_replay:
         if (seqid == sop->so_seqid - 1) {
-                printk("NFSD: preprocess_seqid_op: retransmission?\n");
+                dprintk("NFSD: preprocess_seqid_op: retransmission?\n");
                 /* indicate replay to calling function */
                 return NFSERR_REPLAY_ME;
         }
@@ -2286,7 +2285,7 @@ check_replay:
 }
 
 int
-nfsd4_open_confirm(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open_confirm *oc)
+nfsd4_open_confirm(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open_confirm *oc, struct nfs4_stateowner **replay_owner)
 {
         int status;
         struct nfs4_stateowner *sop;
@@ -2320,8 +2319,10 @@ nfsd4_open_confirm(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfs
 
         nfsd4_create_clid_dir(sop->so_client);
 out:
-        if (oc->oc_stateowner)
+        if (oc->oc_stateowner) {
                 nfs4_get_stateowner(oc->oc_stateowner);
+                *replay_owner = oc->oc_stateowner;
+        }
         nfs4_unlock_state();
         return status;
 }
@@ -2352,7 +2353,7 @@ reset_union_bmap_deny(unsigned long deny, unsigned long *bmap)
 }
 
 int
-nfsd4_open_downgrade(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open_downgrade *od)
+nfsd4_open_downgrade(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open_downgrade *od, struct nfs4_stateowner **replay_owner)
 {
         int status;
         struct nfs4_stateid *stp;
@@ -2394,8 +2395,10 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct n
         memcpy(&od->od_stateid, &stp->st_stateid, sizeof(stateid_t));
         status = nfs_ok;
 out:
-        if (od->od_stateowner)
+        if (od->od_stateowner) {
                 nfs4_get_stateowner(od->od_stateowner);
+                *replay_owner = od->od_stateowner;
+        }
         nfs4_unlock_state();
         return status;
 }
@@ -2404,7 +2407,7 @@ out:
  * nfs4_unlock_state() called after encode
  */
 int
-nfsd4_close(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_close *close)
+nfsd4_close(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_close *close, struct nfs4_stateowner **replay_owner)
 {
         int status;
         struct nfs4_stateid *stp;
@@ -2430,8 +2433,10 @@ nfsd4_close(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_clos
         /* release_state_owner() calls nfsd_close() if needed */
         release_state_owner(stp, OPEN_STATE);
 out:
-        if (close->cl_stateowner)
+        if (close->cl_stateowner) {
                 nfs4_get_stateowner(close->cl_stateowner);
+                *replay_owner = close->cl_stateowner;
+        }
         nfs4_unlock_state();
         return status;
 }
@@ -2500,8 +2505,7 @@ find_stateid(stateid_t *stid, int flags)
                             (local->st_stateid.si_fileid == f_id))
                                 return local;
                 }
-        } else
-                printk("NFSD: find_stateid: ERROR: no state flag\n");
+        }
         return NULL;
 }
 
@@ -2624,7 +2628,9 @@ alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp, str
         sop->so_is_open_owner = 0;
         sop->so_id = current_ownerid++;
         sop->so_client = clp;
-        sop->so_seqid = lock->lk_new_lock_seqid;
+        /* It is the openowner seqid that will be incremented in encode in the
+         * case of new lockowners; so increment the lock seqid manually: */
+        sop->so_seqid = lock->lk_new_lock_seqid + 1;
         sop->so_confirmed = 1;
         rp = &sop->so_replay;
         rp->rp_status = NFSERR_SERVERFAULT;
@@ -2676,9 +2682,10 @@ check_lock_length(u64 offset, u64 length)
  *  LOCK operation 
  */
 int
-nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock *lock)
+nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock *lock, struct nfs4_stateowner **replay_owner)
 {
         struct nfs4_stateowner *open_sop = NULL;
+        struct nfs4_stateowner *lock_sop = NULL;
         struct nfs4_stateid *lock_stp;
         struct file *filp;
         struct file_lock file_lock;
@@ -2705,19 +2712,19 @@ nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
                 struct nfs4_file *fp;
                 
                 status = nfserr_stale_clientid;
-                if (STALE_CLIENTID(&lock->lk_new_clientid)) {
-                        printk("NFSD: nfsd4_lock: clientid is stale!\n");
+                if (STALE_CLIENTID(&lock->lk_new_clientid))
                         goto out;
-                }
 
                 /* validate and update open stateid and open seqid */
                 status = nfs4_preprocess_seqid_op(current_fh, 
                                         lock->lk_new_open_seqid,
                                         &lock->lk_new_open_stateid,
                                         CHECK_FH | OPEN_STATE,
-                                        &open_sop, &open_stp, lock);
+                                        &lock->lk_stateowner, &open_stp,
+                                        lock);
                 if (status)
                         goto out;
+                open_sop = lock->lk_stateowner;
                 /* create lockowner and lock stateid */
                 fp = open_stp->st_file;
                 strhashval = lock_ownerstr_hashval(fp->fi_inode, 
@@ -2727,16 +2734,15 @@ nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
                  * the same file, or should they just be allowed (and
                  * create new stateids)? */
                 status = nfserr_resource;
-                if (!(lock->lk_stateowner = alloc_init_lock_stateowner(strhashval, open_sop->so_client, open_stp, lock)))
+                lock_sop = alloc_init_lock_stateowner(strhashval,
+                                open_sop->so_client, open_stp, lock);
+                if (lock_sop == NULL)
                         goto out;
-                if ((lock_stp = alloc_init_lock_stateid(lock->lk_stateowner, 
-                                                fp, open_stp)) == NULL) {
-                        release_stateowner(lock->lk_stateowner);
-                        lock->lk_stateowner = NULL;
+                lock_stp = alloc_init_lock_stateid(lock_sop, fp, open_stp);
+                if (lock_stp == NULL) {
+                        release_stateowner(lock_sop);
                         goto out;
                 }
-                /* bump the open seqid used to create the lock */
-                open_sop->so_seqid++;
         } else {
                 /* lock (lock owner + lock stateid) already exists */
                 status = nfs4_preprocess_seqid_op(current_fh,
@@ -2746,12 +2752,13 @@ nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
                                        &lock->lk_stateowner, &lock_stp, lock);
                 if (status)
                         goto out;
+                lock_sop = lock->lk_stateowner;
         }
         /* lock->lk_stateowner and lock_stp have been created or found */
         filp = lock_stp->st_vfs_file;
 
         if ((status = fh_verify(rqstp, current_fh, S_IFREG, MAY_LOCK))) {
-                printk("NFSD: nfsd4_lock: permission denied!\n");
+                dprintk("NFSD: nfsd4_lock: permission denied!\n");
                 goto out;
         }
 
@@ -2776,7 +2783,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
                         status = nfserr_inval;
                 goto out;
         }
-        file_lock.fl_owner = (fl_owner_t) lock->lk_stateowner;
+        file_lock.fl_owner = (fl_owner_t)lock_sop;
         file_lock.fl_pid = current->tgid;
         file_lock.fl_file = filp;
         file_lock.fl_flags = FL_POSIX;
@@ -2832,14 +2839,13 @@ out_destroy_new_stateid:
                  * An error encountered after instantiation of the new
                  * stateid has forced us to destroy it.
                  */
-                if (!seqid_mutating_err(status))
-                        open_sop->so_seqid--;
-
                 release_state_owner(lock_stp, LOCK_STATE);
         }
 out:
-        if (lock->lk_stateowner)
+        if (lock->lk_stateowner) {
                 nfs4_get_stateowner(lock->lk_stateowner);
+                *replay_owner = lock->lk_stateowner;
+        }
         nfs4_unlock_state();
         return status;
 }
@@ -2866,13 +2872,11 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
         nfs4_lock_state();
 
         status = nfserr_stale_clientid;
-        if (STALE_CLIENTID(&lockt->lt_clientid)) {
-                printk("NFSD: nfsd4_lockt: clientid is stale!\n");
+        if (STALE_CLIENTID(&lockt->lt_clientid))
                 goto out;
-        }
 
         if ((status = fh_verify(rqstp, current_fh, S_IFREG, 0))) {
-                printk("NFSD: nfsd4_lockt: fh_verify() failed!\n");
+                dprintk("NFSD: nfsd4_lockt: fh_verify() failed!\n");
                 if (status == nfserr_symlink)
                         status = nfserr_inval;
                 goto out;
@@ -2930,7 +2934,7 @@ out:
 }
 
 int
-nfsd4_locku(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_locku *locku)
+nfsd4_locku(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_locku *locku, struct nfs4_stateowner **replay_owner)
 {
         struct nfs4_stateid *stp;
         struct file *filp = NULL;
@@ -2976,7 +2980,7 @@ nfsd4_locku(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
         if (file_lock.fl_ops && file_lock.fl_ops->fl_release_private)
                 file_lock.fl_ops->fl_release_private(&file_lock);
         if (status) {
-                printk("NFSD: nfs4_locku: posix_lock_file failed!\n");
+                dprintk("NFSD: nfs4_locku: posix_lock_file failed!\n");
                 goto out_nfserr;
         }
         /*
@@ -2986,8 +2990,10 @@ nfsd4_locku(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
         memcpy(&locku->lu_stateid, &stp->st_stateid, sizeof(stateid_t));
 
 out:
-        if (locku->lu_stateowner)
+        if (locku->lu_stateowner) {
                 nfs4_get_stateowner(locku->lu_stateowner);
+                *replay_owner = locku->lu_stateowner;
+        }
         nfs4_unlock_state();
         return status;
 
@@ -3036,10 +3042,8 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp, struct nfsd4_release_lockowner *
         /* XXX check for lease expiration */
 
         status = nfserr_stale_clientid;
-        if (STALE_CLIENTID(clid)) {
-                printk("NFSD: nfsd4_release_lockowner: clientid is stale!\n");
+        if (STALE_CLIENTID(clid))
                 return status;
-        }
 
         nfs4_lock_state();
 
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
index 49eafbdb15c1..83f3322765cd 100644
--- a/fs/ntfs/ChangeLog
+++ b/fs/ntfs/ChangeLog
@@ -29,7 +29,8 @@ ToDo/Notes:
           The Windows boot will run chkdsk and then reboot.  The user can then
           immediately boot into Linux rather than having to do a full Windows
           boot first before rebooting into Linux and we will recognize such a
-          journal and empty it as it is clean by definition.
+          journal and empty it as it is clean by definition.  Note, this only
+          works if chkdsk left the journal in an obviously clean state.
         - Support journals ($LogFile) with only one restart page as well as
           journals with two different restart pages.  We sanity check both and
           either use the only sane one or the more recent one of the two in the
@@ -92,6 +93,15 @@ ToDo/Notes:
           an octal number to conform to how chmod(1) works, too.  Thanks to
           Giuseppe Bilotta and Horst von Brand for pointing out the errors of
           my ways.
+        - Fix various bugs in the runlist merging code.  (Based on libntfs
+          changes by Richard Russon.)
+        - Fix sparse warnings that have crept in over time.
+        - Change ntfs_cluster_free() to require a write locked runlist on entry
+          since we otherwise get into a lock reversal deadlock if a read locked
+          runlist is passed in. In the process also change it to take an ntfs
+          inode instead of a vfs inode as parameter.
+        - Fix the definition of the CHKD ntfs record magic.  It had an off by
+          two error causing it to be CHKB instead of CHKD.
 
 2.1.23 - Implement extension of resident files and make writing safe as well as
          many bug fixes, cleanups, and enhancements...
diff --git a/fs/ntfs/aops.c b/fs/ntfs/aops.c
index b6cc8cf24626..5e80c07c6a4d 100644
--- a/fs/ntfs/aops.c
+++ b/fs/ntfs/aops.c
@@ -59,39 +59,49 @@ static void ntfs_end_buffer_async_read(struct buffer_head *bh, int uptodate)
         unsigned long flags;
         struct buffer_head *first, *tmp;
         struct page *page;
+        struct inode *vi;
         ntfs_inode *ni;
         int page_uptodate = 1;
 
         page = bh->b_page;
-        ni = NTFS_I(page->mapping->host);
+        vi = page->mapping->host;
+        ni = NTFS_I(vi);
 
         if (likely(uptodate)) {
-                s64 file_ofs, initialized_size;
+                loff_t i_size;
+                s64 file_ofs, init_size;
 
                 set_buffer_uptodate(bh);
 
                 file_ofs = ((s64)page->index << PAGE_CACHE_SHIFT) +
                                 bh_offset(bh);
                 read_lock_irqsave(&ni->size_lock, flags);
-                initialized_size = ni->initialized_size;
+                init_size = ni->initialized_size;
+                i_size = i_size_read(vi);
                 read_unlock_irqrestore(&ni->size_lock, flags);
+                if (unlikely(init_size > i_size)) {
+                        /* Race with shrinking truncate. */
+                        init_size = i_size;
+                }
                 /* Check for the current buffer head overflowing. */
-                if (file_ofs + bh->b_size > initialized_size) {
-                        char *addr;
-                        int ofs = 0;
-
-                        if (file_ofs < initialized_size)
-                                ofs = initialized_size - file_ofs;
-                        addr = kmap_atomic(page, KM_BIO_SRC_IRQ);
-                        memset(addr + bh_offset(bh) + ofs, 0, bh->b_size - ofs);
+                if (unlikely(file_ofs + bh->b_size > init_size)) {
+                        u8 *kaddr;
+                        int ofs;
+
+                        ofs = 0;
+                        if (file_ofs < init_size)
+                                ofs = init_size - file_ofs;
+                        kaddr = kmap_atomic(page, KM_BIO_SRC_IRQ);
+                        memset(kaddr + bh_offset(bh) + ofs, 0,
+                                        bh->b_size - ofs);
+                        kunmap_atomic(kaddr, KM_BIO_SRC_IRQ);
                         flush_dcache_page(page);
-                        kunmap_atomic(addr, KM_BIO_SRC_IRQ);
                 }
         } else {
                 clear_buffer_uptodate(bh);
                 SetPageError(page);
-                ntfs_error(ni->vol->sb, "Buffer I/O error, logical block %llu.",
-                                (unsigned long long)bh->b_blocknr);
+                ntfs_error(ni->vol->sb, "Buffer I/O error, logical block "
+                                "0x%llx.", (unsigned long long)bh->b_blocknr);
         }
         first = page_buffers(page);
         local_irq_save(flags);
@@ -124,7 +134,7 @@ static void ntfs_end_buffer_async_read(struct buffer_head *bh, int uptodate)
                 if (likely(page_uptodate && !PageError(page)))
                         SetPageUptodate(page);
         } else {
-                char *addr;
+                u8 *kaddr;
                 unsigned int i, recs;
                 u32 rec_size;
 
@@ -132,12 +142,12 @@ static void ntfs_end_buffer_async_read(struct buffer_head *bh, int uptodate)
                 recs = PAGE_CACHE_SIZE / rec_size;
                 /* Should have been verified before we got here... */
                 BUG_ON(!recs);
-                addr = kmap_atomic(page, KM_BIO_SRC_IRQ);
+                kaddr = kmap_atomic(page, KM_BIO_SRC_IRQ);
                 for (i = 0; i < recs; i++)
-                        post_read_mst_fixup((NTFS_RECORD*)(addr +
+                        post_read_mst_fixup((NTFS_RECORD*)(kaddr +
                                         i * rec_size), rec_size);
+                kunmap_atomic(kaddr, KM_BIO_SRC_IRQ);
                 flush_dcache_page(page);
-                kunmap_atomic(addr, KM_BIO_SRC_IRQ);
                 if (likely(page_uptodate && !PageError(page)))
                         SetPageUptodate(page);
         }
@@ -168,8 +178,11 @@ still_busy:
  */
 static int ntfs_read_block(struct page *page)
 {
+        loff_t i_size;
         VCN vcn;
         LCN lcn;
+        s64 init_size;
+        struct inode *vi;
         ntfs_inode *ni;
         ntfs_volume *vol;
         runlist_element *rl;
@@ -180,7 +193,8 @@ static int ntfs_read_block(struct page *page)
         int i, nr;
         unsigned char blocksize_bits;
 
-        ni = NTFS_I(page->mapping->host);
+        vi = page->mapping->host;
+        ni = NTFS_I(vi);
         vol = ni->vol;
 
         /* $MFT/$DATA must have its complete runlist in memory at all times. */
@@ -199,11 +213,28 @@ static int ntfs_read_block(struct page *page)
         bh = head = page_buffers(page);
         BUG_ON(!bh);
 
+        /*
+         * We may be racing with truncate.  To avoid some of the problems we
+         * now take a snapshot of the various sizes and use those for the whole
+         * of the function.  In case of an extending truncate it just means we
+         * may leave some buffers unmapped which are now allocated.  This is
+         * not a problem since these buffers will just get mapped when a write
+         * occurs.  In case of a shrinking truncate, we will detect this later
+         * on due to the runlist being incomplete and if the page is being
+         * fully truncated, truncate will throw it away as soon as we unlock
+         * it so no need to worry what we do with it.
+         */
         iblock = (s64)page->index << (PAGE_CACHE_SHIFT - blocksize_bits);
         read_lock_irqsave(&ni->size_lock, flags);
         lblock = (ni->allocated_size + blocksize - 1) >> blocksize_bits;
-        zblock = (ni->initialized_size + blocksize - 1) >> blocksize_bits;
+        init_size = ni->initialized_size;
+        i_size = i_size_read(vi);
         read_unlock_irqrestore(&ni->size_lock, flags);
+        if (unlikely(init_size > i_size)) {
+                /* Race with shrinking truncate. */
+                init_size = i_size;
+        }
+        zblock = (init_size + blocksize - 1) >> blocksize_bits;
 
         /* Loop through all the buffers in the page. */
         rl = NULL;
@@ -366,6 +397,8 @@ handle_zblock:
  */
 static int ntfs_readpage(struct file *file, struct page *page)
 {
+        loff_t i_size;
+        struct inode *vi;
         ntfs_inode *ni, *base_ni;
         u8 *kaddr;
         ntfs_attr_search_ctx *ctx;
@@ -384,14 +417,17 @@ retry_readpage:
                 unlock_page(page);
                 return 0;
         }
-        ni = NTFS_I(page->mapping->host);
+        vi = page->mapping->host;
+        ni = NTFS_I(vi);
         /*
          * Only $DATA attributes can be encrypted and only unnamed $DATA
          * attributes can be compressed.  Index root can have the flags set but
          * this means to create compressed/encrypted files, not that the
-         * attribute is compressed/encrypted.
+         * attribute is compressed/encrypted.  Note we need to check for
+         * AT_INDEX_ALLOCATION since this is the type of both directory and
+         * index inodes.
          */
-        if (ni->type != AT_INDEX_ROOT) {
+        if (ni->type != AT_INDEX_ALLOCATION) {
                 /* If attribute is encrypted, deny access, just like NT4. */
                 if (NInoEncrypted(ni)) {
                         BUG_ON(ni->type != AT_DATA);
@@ -456,7 +492,12 @@ retry_readpage:
         read_lock_irqsave(&ni->size_lock, flags);
         if (unlikely(attr_len > ni->initialized_size))
                 attr_len = ni->initialized_size;
+        i_size = i_size_read(vi);
         read_unlock_irqrestore(&ni->size_lock, flags);
+        if (unlikely(attr_len > i_size)) {
+                /* Race with shrinking truncate. */
+                attr_len = i_size;
+        }
         kaddr = kmap_atomic(page, KM_USER0);
         /* Copy the data to the page. */
         memcpy(kaddr, (u8*)ctx->attr +
@@ -1341,9 +1382,11 @@ retry_writepage:
          * Only $DATA attributes can be encrypted and only unnamed $DATA
          * attributes can be compressed.  Index root can have the flags set but
          * this means to create compressed/encrypted files, not that the
-         * attribute is compressed/encrypted.
+         * attribute is compressed/encrypted.  Note we need to check for
+         * AT_INDEX_ALLOCATION since this is the type of both directory and
+         * index inodes.
          */
-        if (ni->type != AT_INDEX_ROOT) {
+        if (ni->type != AT_INDEX_ALLOCATION) {
                 /* If file is encrypted, deny access, just like NT4. */
                 if (NInoEncrypted(ni)) {
                         unlock_page(page);
@@ -1379,8 +1422,8 @@ retry_writepage:
                         unsigned int ofs = i_size & ~PAGE_CACHE_MASK;
                         kaddr = kmap_atomic(page, KM_USER0);
                         memset(kaddr + ofs, 0, PAGE_CACHE_SIZE - ofs);
-                        flush_dcache_page(page);
                         kunmap_atomic(kaddr, KM_USER0);
+                        flush_dcache_page(page);
                 }
                 /* Handle mst protected attributes. */
                 if (NInoMstProtected(ni))
@@ -1443,34 +1486,33 @@ retry_writepage:
         BUG_ON(PageWriteback(page));
         set_page_writeback(page);
         unlock_page(page);
-        /*
-         * Here, we do not need to zero the out of bounds area everytime
-         * because the below memcpy() already takes care of the
-         * mmap-at-end-of-file requirements.  If the file is converted to a
-         * non-resident one, then the code path use is switched to the
-         * non-resident one where the zeroing happens on each ntfs_writepage()
-         * invocation.
-         */
         attr_len = le32_to_cpu(ctx->attr->data.resident.value_length);
         i_size = i_size_read(vi);
         if (unlikely(attr_len > i_size)) {
+                /* Race with shrinking truncate or a failed truncate. */
                 attr_len = i_size;
-                ctx->attr->data.resident.value_length = cpu_to_le32(attr_len);
+                /*
+                 * If the truncate failed, fix it up now.  If a concurrent
+                 * truncate, we do its job, so it does not have to do anything.
+                 */
+                err = ntfs_resident_attr_value_resize(ctx->mrec, ctx->attr,
+                                attr_len);
+                /* Shrinking cannot fail. */
+                BUG_ON(err);
         }
         kaddr = kmap_atomic(page, KM_USER0);
         /* Copy the data from the page to the mft record. */
         memcpy((u8*)ctx->attr +
                         le16_to_cpu(ctx->attr->data.resident.value_offset),
                         kaddr, attr_len);
-        flush_dcache_mft_record_page(ctx->ntfs_ino);
         /* Zero out of bounds area in the page cache page. */
         memset(kaddr + attr_len, 0, PAGE_CACHE_SIZE - attr_len);
-        flush_dcache_page(page);
         kunmap_atomic(kaddr, KM_USER0);
-
+        flush_dcache_mft_record_page(ctx->ntfs_ino);
+        flush_dcache_page(page);
+        /* We are done with the page. */
         end_page_writeback(page);
-
-        /* Mark the mft record dirty, so it gets written back. */
+        /* Finally, mark the mft record dirty, so it gets written back. */
         mark_mft_record_dirty(ctx->ntfs_ino);
         ntfs_attr_put_search_ctx(ctx);
         unmap_mft_record(base_ni);
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index dc4bbe3acf5c..7ec045131808 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -1166,6 +1166,8 @@ err_out:
  *
  * Return 0 on success and -errno on error.  In the error case, the inode will
  * have had make_bad_inode() executed on it.
+ *
+ * Note this cannot be called for AT_INDEX_ALLOCATION.
  */
 static int ntfs_read_locked_attr_inode(struct inode *base_vi, struct inode *vi)
 {
@@ -1242,8 +1244,8 @@ static int ntfs_read_locked_attr_inode(struct inode *base_vi, struct inode *vi)
                         }
                 }
                 /*
-                 * The encryption flag set in an index root just means to
-                 * compress all files.
+                 * The compressed/sparse flag set in an index root just means
+                 * to compress all files.
                  */
                 if (NInoMstProtected(ni) && ni->type != AT_INDEX_ROOT) {
                         ntfs_error(vi->i_sb, "Found mst protected attribute "
@@ -1319,8 +1321,7 @@ static int ntfs_read_locked_attr_inode(struct inode *base_vi, struct inode *vi)
                                         "the mapping pairs array.");
                         goto unm_err_out;
                 }
-                if ((NInoCompressed(ni) || NInoSparse(ni)) &&
-                                ni->type != AT_INDEX_ROOT) {
+                if (NInoCompressed(ni) || NInoSparse(ni)) {
                         if (a->data.non_resident.compression_unit != 4) {
                                 ntfs_error(vi->i_sb, "Found nonstandard "
                                                 "compression unit (%u instead "
diff --git a/fs/ntfs/layout.h b/fs/ntfs/layout.h
index 609ad1728ce4..01f2dfa39cec 100644
--- a/fs/ntfs/layout.h
+++ b/fs/ntfs/layout.h
@@ -123,7 +123,7 @@ enum {
         magic_RCRD = const_cpu_to_le32(0x44524352), /* Log record page. */
 
         /* Found in $LogFile/$DATA.  (May be found in $MFT/$DATA, also?) */
-        magic_CHKD = const_cpu_to_le32(0x424b4843), /* Modified by chkdsk. */
+        magic_CHKD = const_cpu_to_le32(0x444b4843), /* Modified by chkdsk. */
 
         /* Found in all ntfs record containing records. */
         magic_BAAD = const_cpu_to_le32(0x44414142), /* Failed multi sector
@@ -308,10 +308,8 @@ typedef le16 MFT_RECORD_FLAGS;
  * The _LE versions are to be applied on little endian MFT_REFs.
  * Note: The _LE versions will return a CPU endian formatted value!
  */
-typedef enum {
-        MFT_REF_MASK_CPU        = 0x0000ffffffffffffULL,
-        MFT_REF_MASK_LE         = const_cpu_to_le64(0x0000ffffffffffffULL),
-} MFT_REF_CONSTS;
+#define MFT_REF_MASK_CPU 0x0000ffffffffffffULL
+#define MFT_REF_MASK_LE const_cpu_to_le64(0x0000ffffffffffffULL)
 
 typedef u64 MFT_REF;
 typedef le64 leMFT_REF;
diff --git a/fs/ntfs/lcnalloc.c b/fs/ntfs/lcnalloc.c
index 7b5934290685..5af3bf0b7eee 100644
--- a/fs/ntfs/lcnalloc.c
+++ b/fs/ntfs/lcnalloc.c
@@ -779,14 +779,13 @@ out:
 
 /**
  * __ntfs_cluster_free - free clusters on an ntfs volume
- * @vi:         vfs inode whose runlist describes the clusters to free
- * @start_vcn:  vcn in the runlist of @vi at which to start freeing clusters
+ * @ni:         ntfs inode whose runlist describes the clusters to free
+ * @start_vcn:  vcn in the runlist of @ni at which to start freeing clusters
  * @count:      number of clusters to free or -1 for all clusters
- * @write_locked:       true if the runlist is locked for writing
  * @is_rollback:        true if this is a rollback operation
  *
  * Free @count clusters starting at the cluster @start_vcn in the runlist
- * described by the vfs inode @vi.
+ * described by the vfs inode @ni.
  *
  * If @count is -1, all clusters from @start_vcn to the end of the runlist are
  * deallocated.  Thus, to completely free all clusters in a runlist, use
@@ -801,31 +800,28 @@ out:
  * Return the number of deallocated clusters (not counting sparse ones) on
  * success and -errno on error.
  *
- * Locking: - The runlist described by @vi must be locked on entry and is
- *            locked on return.  Note if the runlist is locked for reading the
- *            lock may be dropped and reacquired.  Note the runlist may be
- *            modified when needed runlist fragments need to be mapped.
+ * Locking: - The runlist described by @ni must be locked for writing on entry
+ *            and is locked on return.  Note the runlist may be modified when
+ *            needed runlist fragments need to be mapped.
  *          - The volume lcn bitmap must be unlocked on entry and is unlocked
  *            on return.
  *          - This function takes the volume lcn bitmap lock for writing and
  *            modifies the bitmap contents.
  */
-s64 __ntfs_cluster_free(struct inode *vi, const VCN start_vcn, s64 count,
-                const BOOL write_locked, const BOOL is_rollback)
+s64 __ntfs_cluster_free(ntfs_inode *ni, const VCN start_vcn, s64 count,
+                const BOOL is_rollback)
 {
         s64 delta, to_free, total_freed, real_freed;
-        ntfs_inode *ni;
         ntfs_volume *vol;
         struct inode *lcnbmp_vi;
         runlist_element *rl;
         int err;
 
-        BUG_ON(!vi);
+        BUG_ON(!ni);
         ntfs_debug("Entering for i_ino 0x%lx, start_vcn 0x%llx, count "
-                        "0x%llx.%s", vi->i_ino, (unsigned long long)start_vcn,
+                        "0x%llx.%s", ni->mft_no, (unsigned long long)start_vcn,
                         (unsigned long long)count,
                         is_rollback ? " (rollback)" : "");
-        ni = NTFS_I(vi);
         vol = ni->vol;
         lcnbmp_vi = vol->lcnbmp_ino;
         BUG_ON(!lcnbmp_vi);
@@ -843,7 +839,7 @@ s64 __ntfs_cluster_free(struct inode *vi, const VCN start_vcn, s64 count,
 
         total_freed = real_freed = 0;
 
-        rl = ntfs_attr_find_vcn_nolock(ni, start_vcn, write_locked);
+        rl = ntfs_attr_find_vcn_nolock(ni, start_vcn, TRUE);
         if (IS_ERR(rl)) {
                 if (!is_rollback)
                         ntfs_error(vol->sb, "Failed to find first runlist "
@@ -897,7 +893,7 @@ s64 __ntfs_cluster_free(struct inode *vi, const VCN start_vcn, s64 count,
 
                         /* Attempt to map runlist. */
                         vcn = rl->vcn;
-                        rl = ntfs_attr_find_vcn_nolock(ni, vcn, write_locked);
+                        rl = ntfs_attr_find_vcn_nolock(ni, vcn, TRUE);
                         if (IS_ERR(rl)) {
                                 err = PTR_ERR(rl);
                                 if (!is_rollback)
@@ -965,8 +961,7 @@ err_out:
          * If rollback fails, set the volume errors flag, emit an error
          * message, and return the error code.
          */
-        delta = __ntfs_cluster_free(vi, start_vcn, total_freed, write_locked,
-                        TRUE);
+        delta = __ntfs_cluster_free(ni, start_vcn, total_freed, TRUE);
         if (delta < 0) {
                 ntfs_error(vol->sb, "Failed to rollback (error %i).  Leaving "
                                 "inconsistent metadata!  Unmount and run "
diff --git a/fs/ntfs/lcnalloc.h b/fs/ntfs/lcnalloc.h
index e4d7fb98d685..a6a8827882e7 100644
--- a/fs/ntfs/lcnalloc.h
+++ b/fs/ntfs/lcnalloc.h
@@ -2,7 +2,7 @@
  * lcnalloc.h - Exports for NTFS kernel cluster (de)allocation.  Part of the
  *              Linux-NTFS project.
  *
- * Copyright (c) 2004 Anton Altaparmakov
+ * Copyright (c) 2004-2005 Anton Altaparmakov
  *
  * This program/include file is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as published
@@ -28,6 +28,7 @@
 #include <linux/fs.h>
 
 #include "types.h"
+#include "inode.h"
 #include "runlist.h"
 #include "volume.h"
 
@@ -42,18 +43,17 @@ extern runlist_element *ntfs_cluster_alloc(ntfs_volume *vol,
                 const VCN start_vcn, const s64 count, const LCN start_lcn,
                 const NTFS_CLUSTER_ALLOCATION_ZONES zone);
 
-extern s64 __ntfs_cluster_free(struct inode *vi, const VCN start_vcn,
-                s64 count, const BOOL write_locked, const BOOL is_rollback);
+extern s64 __ntfs_cluster_free(ntfs_inode *ni, const VCN start_vcn,
+                s64 count, const BOOL is_rollback);
 
 /**
  * ntfs_cluster_free - free clusters on an ntfs volume
- * @vi:         vfs inode whose runlist describes the clusters to free
- * @start_vcn:  vcn in the runlist of @vi at which to start freeing clusters
+ * @ni:         ntfs inode whose runlist describes the clusters to free
+ * @start_vcn:  vcn in the runlist of @ni at which to start freeing clusters
  * @count:      number of clusters to free or -1 for all clusters
- * @write_locked:       true if the runlist is locked for writing
  *
  * Free @count clusters starting at the cluster @start_vcn in the runlist
- * described by the vfs inode @vi.
+ * described by the ntfs inode @ni.
  *
  * If @count is -1, all clusters from @start_vcn to the end of the runlist are
  * deallocated.  Thus, to completely free all clusters in a runlist, use
@@ -65,19 +65,18 @@ extern s64 __ntfs_cluster_free(struct inode *vi, const VCN start_vcn,
  * Return the number of deallocated clusters (not counting sparse ones) on
  * success and -errno on error.
  *
- * Locking: - The runlist described by @vi must be locked on entry and is
- *            locked on return.  Note if the runlist is locked for reading the
- *            lock may be dropped and reacquired.  Note the runlist may be
- *            modified when needed runlist fragments need to be mapped.
+ * Locking: - The runlist described by @ni must be locked for writing on entry
+ *            and is locked on return.  Note the runlist may be modified when
+ *            needed runlist fragments need to be mapped.
  *          - The volume lcn bitmap must be unlocked on entry and is unlocked
  *            on return.
  *          - This function takes the volume lcn bitmap lock for writing and
  *            modifies the bitmap contents.
  */
-static inline s64 ntfs_cluster_free(struct inode *vi, const VCN start_vcn,
-                s64 count, const BOOL write_locked)
+static inline s64 ntfs_cluster_free(ntfs_inode *ni, const VCN start_vcn,
+                s64 count)
 {
-        return __ntfs_cluster_free(vi, start_vcn, count, write_locked, FALSE);
+        return __ntfs_cluster_free(ni, start_vcn, count, FALSE);
 }
 
 extern int ntfs_cluster_free_from_rl_nolock(ntfs_volume *vol,
diff --git a/fs/ntfs/logfile.c b/fs/ntfs/logfile.c
index 0173e95500d9..0fd70295cca6 100644
--- a/fs/ntfs/logfile.c
+++ b/fs/ntfs/logfile.c
@@ -51,7 +51,8 @@ static BOOL ntfs_check_restart_page_header(struct inode *vi,
                 RESTART_PAGE_HEADER *rp, s64 pos)
 {
         u32 logfile_system_page_size, logfile_log_page_size;
-        u16 usa_count, usa_ofs, usa_end, ra_ofs;
+        u16 ra_ofs, usa_count, usa_ofs, usa_end = 0;
+        BOOL have_usa = TRUE;
 
         ntfs_debug("Entering.");
         /*
@@ -86,6 +87,14 @@ static BOOL ntfs_check_restart_page_header(struct inode *vi,
                                 (int)sle16_to_cpu(rp->minor_ver));
                 return FALSE;
         }
+        /*
+         * If chkdsk has been run the restart page may not be protected by an
+         * update sequence array.
+         */
+        if (ntfs_is_chkd_record(rp->magic) && !le16_to_cpu(rp->usa_count)) {
+                have_usa = FALSE;
+                goto skip_usa_checks;
+        }
         /* Verify the size of the update sequence array. */
         usa_count = 1 + (logfile_system_page_size >> NTFS_BLOCK_SIZE_BITS);
         if (usa_count != le16_to_cpu(rp->usa_count)) {
@@ -102,6 +111,7 @@ static BOOL ntfs_check_restart_page_header(struct inode *vi,
                                 "inconsistent update sequence array offset.");
                 return FALSE;
         }
+skip_usa_checks:
         /*
          * Verify the position of the restart area.  It must be:
          *      - aligned to 8-byte boundary,
@@ -109,7 +119,8 @@ static BOOL ntfs_check_restart_page_header(struct inode *vi,
          *      - within the system page size.
          */
         ra_ofs = le16_to_cpu(rp->restart_area_offset);
-        if (ra_ofs & 7 || ra_ofs < usa_end ||
+        if (ra_ofs & 7 || (have_usa ? ra_ofs < usa_end :
+                        ra_ofs < sizeof(RESTART_PAGE_HEADER)) ||
                         ra_ofs > logfile_system_page_size) {
                 ntfs_error(vi->i_sb, "$LogFile restart page specifies "
                                 "inconsistent restart area offset.");
@@ -402,8 +413,12 @@ static int ntfs_check_and_load_restart_page(struct inode *vi,
                         idx++;
                 } while (to_read > 0);
         }
-        /* Perform the multi sector transfer deprotection on the buffer. */
-        if (post_read_mst_fixup((NTFS_RECORD*)trp,
+        /*
+         * Perform the multi sector transfer deprotection on the buffer if the
+         * restart page is protected.
+         */
+        if ((!ntfs_is_chkd_record(trp->magic) || le16_to_cpu(trp->usa_count))
+                        && post_read_mst_fixup((NTFS_RECORD*)trp,
                         le32_to_cpu(rp->system_page_size))) {
                 /*
                  * A multi sector tranfer error was detected.  We only need to
@@ -615,11 +630,16 @@ is_empty:
                  * Otherwise just throw it away.
                  */
                 if (rstr2_lsn > rstr1_lsn) {
+                        ntfs_debug("Using second restart page as it is more "
+                                        "recent.");
                         ntfs_free(rstr1_ph);
                         rstr1_ph = rstr2_ph;
                         /* rstr1_lsn = rstr2_lsn; */
-                } else
+                } else {
+                        ntfs_debug("Using first restart page as it is more "
+                                        "recent.");
                         ntfs_free(rstr2_ph);
+                }
                 rstr2_ph = NULL;
         }
         /* All consistency checks passed. */
diff --git a/fs/ntfs/logfile.h b/fs/ntfs/logfile.h
index 42388f95ea6d..a51f3dd0e9eb 100644
--- a/fs/ntfs/logfile.h
+++ b/fs/ntfs/logfile.h
@@ -113,7 +113,7 @@ typedef struct {
  */
 enum {
         RESTART_VOLUME_IS_CLEAN = const_cpu_to_le16(0x0002),
-        RESTART_SPACE_FILLER    = 0xffff, /* gcc: Force enum bit width to 16. */
+        RESTART_SPACE_FILLER    = const_cpu_to_le16(0xffff), /* gcc: Force enum bit width to 16. */
 } __attribute__ ((__packed__));
 
 typedef le16 RESTART_AREA_FLAGS;
diff --git a/fs/ntfs/malloc.h b/fs/ntfs/malloc.h
index 3288bcc2c4aa..006946efca8c 100644
--- a/fs/ntfs/malloc.h
+++ b/fs/ntfs/malloc.h
@@ -1,7 +1,7 @@
 /*
  * malloc.h - NTFS kernel memory handling. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2004 Anton Altaparmakov
+ * Copyright (c) 2001-2005 Anton Altaparmakov
  *
  * This program/include file is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as published
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 2c32b84385a8..247586d1d5dc 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1953,7 +1953,7 @@ restore_undo_alloc:
         a = ctx->attr;
         a->data.non_resident.highest_vcn = cpu_to_sle64(old_last_vcn - 1);
 undo_alloc:
-        if (ntfs_cluster_free(vol->mft_ino, old_last_vcn, -1, TRUE) < 0) {
+        if (ntfs_cluster_free(mft_ni, old_last_vcn, -1) < 0) {
                 ntfs_error(vol->sb, "Failed to free clusters from mft data "
                                 "attribute.%s", es);
                 NVolSetErrors(vol);
diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c
index f5b2ac929081..061b5ff6b73c 100644
--- a/fs/ntfs/runlist.c
+++ b/fs/ntfs/runlist.c
@@ -2,7 +2,7 @@
  * runlist.c - NTFS runlist handling code.  Part of the Linux-NTFS project.
  *
  * Copyright (c) 2001-2005 Anton Altaparmakov
- * Copyright (c) 2002 Richard Russon
+ * Copyright (c) 2002-2005 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as published
@@ -158,17 +158,21 @@ static inline BOOL ntfs_are_rl_mergeable(runlist_element *dst,
         BUG_ON(!dst);
         BUG_ON(!src);
 
-        if ((dst->lcn < 0) || (src->lcn < 0)) {   /* Are we merging holes? */
-                if (dst->lcn == LCN_HOLE && src->lcn == LCN_HOLE)
-                        return TRUE;
+        /* We can merge unmapped regions even if they are misaligned. */
+        if ((dst->lcn == LCN_RL_NOT_MAPPED) && (src->lcn == LCN_RL_NOT_MAPPED))
+                return TRUE;
+        /* If the runs are misaligned, we cannot merge them. */
+        if ((dst->vcn + dst->length) != src->vcn)
                 return FALSE;
-        }
-        if ((dst->lcn + dst->length) != src->lcn) /* Are the runs contiguous? */
-                return FALSE;
-        if ((dst->vcn + dst->length) != src->vcn) /* Are the runs misaligned? */
-                return FALSE;
-
-        return TRUE;
+        /* If both runs are non-sparse and contiguous, we can merge them. */
+        if ((dst->lcn >= 0) && (src->lcn >= 0) &&
+                        ((dst->lcn + dst->length) == src->lcn))
+                return TRUE;
+        /* If we are merging two holes, we can merge them. */
+        if ((dst->lcn == LCN_HOLE) && (src->lcn == LCN_HOLE))
+                return TRUE;
+        /* Cannot merge. */
+        return FALSE;
 }
 
 /**
@@ -214,14 +218,15 @@ static inline void __ntfs_rl_merge(runlist_element *dst, runlist_element *src)
 static inline runlist_element *ntfs_rl_append(runlist_element *dst,
                 int dsize, runlist_element *src, int ssize, int loc)
 {
-        BOOL right;
-        int magic;
+        BOOL right = FALSE;     /* Right end of @src needs merging. */
+        int marker;             /* End of the inserted runs. */
 
         BUG_ON(!dst);
         BUG_ON(!src);
 
         /* First, check if the right hand end needs merging. */
-        right = ntfs_are_rl_mergeable(src + ssize - 1, dst + loc + 1);
+        if ((loc + 1) < dsize)
+                right = ntfs_are_rl_mergeable(src + ssize - 1, dst + loc + 1);
 
         /* Space required: @dst size + @src size, less one if we merged. */
         dst = ntfs_rl_realloc(dst, dsize, dsize + ssize - right);
@@ -236,18 +241,19 @@ static inline runlist_element *ntfs_rl_append(runlist_element *dst,
         if (right)
                 __ntfs_rl_merge(src + ssize - 1, dst + loc + 1);
 
-        magic = loc + ssize;
+        /* First run after the @src runs that have been inserted. */
+        marker = loc + ssize + 1;
 
         /* Move the tail of @dst out of the way, then copy in @src. */
-        ntfs_rl_mm(dst, magic + 1, loc + 1 + right, dsize - loc - 1 - right);
+        ntfs_rl_mm(dst, marker, loc + 1 + right, dsize - (loc + 1 + right));
         ntfs_rl_mc(dst, loc + 1, src, 0, ssize);
 
         /* Adjust the size of the preceding hole. */
         dst[loc].length = dst[loc + 1].vcn - dst[loc].vcn;
 
         /* We may have changed the length of the file, so fix the end marker */
-        if (dst[magic + 1].lcn == LCN_ENOENT)
-                dst[magic + 1].vcn = dst[magic].vcn + dst[magic].length;
+        if (dst[marker].lcn == LCN_ENOENT)
+                dst[marker].vcn = dst[marker - 1].vcn + dst[marker - 1].length;
 
         return dst;
 }
@@ -279,18 +285,17 @@ static inline runlist_element *ntfs_rl_append(runlist_element *dst,
 static inline runlist_element *ntfs_rl_insert(runlist_element *dst,
                 int dsize, runlist_element *src, int ssize, int loc)
 {
-        BOOL left = FALSE;
-        BOOL disc = FALSE;      /* Discontinuity */
-        BOOL hole = FALSE;      /* Following a hole */
-        int magic;
+        BOOL left = FALSE;      /* Left end of @src needs merging. */
+        BOOL disc = FALSE;      /* Discontinuity between @dst and @src. */
+        int marker;             /* End of the inserted runs. */
 
         BUG_ON(!dst);
         BUG_ON(!src);
 
-        /* disc => Discontinuity between the end of @dst and the start of @src.
-         *         This means we might need to insert a hole.
-         * hole => @dst ends with a hole or an unmapped region which we can
-         *         extend to match the discontinuity. */
+        /*
+         * disc => Discontinuity between the end of @dst and the start of @src.
+         *         This means we might need to insert a "not mapped" run.
+         */
         if (loc == 0)
                 disc = (src[0].vcn > 0);
         else {
@@ -303,58 +308,49 @@ static inline runlist_element *ntfs_rl_insert(runlist_element *dst,
                         merged_length += src->length;
 
                 disc = (src[0].vcn > dst[loc - 1].vcn + merged_length);
-                if (disc)
-                        hole = (dst[loc - 1].lcn == LCN_HOLE);
         }
-
-        /* Space required: @dst size + @src size, less one if we merged, plus
-         * one if there was a discontinuity, less one for a trailing hole. */
-        dst = ntfs_rl_realloc(dst, dsize, dsize + ssize - left + disc - hole);
+        /*
+         * Space required: @dst size + @src size, less one if we merged, plus
+         * one if there was a discontinuity.
+         */
+        dst = ntfs_rl_realloc(dst, dsize, dsize + ssize - left + disc);
         if (IS_ERR(dst))
                 return dst;
         /*
          * We are guaranteed to succeed from here so can start modifying the
          * original runlist.
          */
-
         if (left)
                 __ntfs_rl_merge(dst + loc - 1, src);
-
-        magic = loc + ssize - left + disc - hole;
+        /*
+         * First run after the @src runs that have been inserted.
+         * Nominally,  @marker equals @loc + @ssize, i.e. location + number of
+         * runs in @src.  However, if @left, then the first run in @src has
+         * been merged with one in @dst.  And if @disc, then @dst and @src do
+         * not meet and we need an extra run to fill the gap.
+         */
+        marker = loc + ssize - left + disc;
 
         /* Move the tail of @dst out of the way, then copy in @src. */
-        ntfs_rl_mm(dst, magic, loc, dsize - loc);
-        ntfs_rl_mc(dst, loc + disc - hole, src, left, ssize - left);
+        ntfs_rl_mm(dst, marker, loc, dsize - loc);
+        ntfs_rl_mc(dst, loc + disc, src, left, ssize - left);
 
-        /* Adjust the VCN of the last run ... */
-        if (dst[magic].lcn <= LCN_HOLE)
-                dst[magic].vcn = dst[magic - 1].vcn + dst[magic - 1].length;
+        /* Adjust the VCN of the first run after the insertion... */
+        dst[marker].vcn = dst[marker - 1].vcn + dst[marker - 1].length;
         /* ... and the length. */
-        if (dst[magic].lcn == LCN_HOLE || dst[magic].lcn == LCN_RL_NOT_MAPPED)
-                dst[magic].length = dst[magic + 1].vcn - dst[magic].vcn;
+        if (dst[marker].lcn == LCN_HOLE || dst[marker].lcn == LCN_RL_NOT_MAPPED)
+                dst[marker].length = dst[marker + 1].vcn - dst[marker].vcn;
 
-        /* Writing beyond the end of the file and there's a discontinuity. */
+        /* Writing beyond the end of the file and there is a discontinuity. */
         if (disc) {
-                if (hole)
-                        dst[loc - 1].length = dst[loc].vcn - dst[loc - 1].vcn;
-                else {
-                        if (loc > 0) {
-                                dst[loc].vcn = dst[loc - 1].vcn +
-                                                dst[loc - 1].length;
-                                dst[loc].length = dst[loc + 1].vcn -
-                                                dst[loc].vcn;
-                        } else {
-                                dst[loc].vcn = 0;
-                                dst[loc].length = dst[loc + 1].vcn;
-                        }
-                        dst[loc].lcn = LCN_RL_NOT_MAPPED;
+                if (loc > 0) {
+                        dst[loc].vcn = dst[loc - 1].vcn + dst[loc - 1].length;
+                        dst[loc].length = dst[loc + 1].vcn - dst[loc].vcn;
+                } else {
+                        dst[loc].vcn = 0;
+                        dst[loc].length = dst[loc + 1].vcn;
                 }
-
-                magic += hole;
-
-                if (dst[magic].lcn == LCN_ENOENT)
-                        dst[magic].vcn = dst[magic - 1].vcn +
-                                        dst[magic - 1].length;
+                dst[loc].lcn = LCN_RL_NOT_MAPPED;
         }
         return dst;
 }
@@ -385,20 +381,23 @@ static inline runlist_element *ntfs_rl_insert(runlist_element *dst,
 static inline runlist_element *ntfs_rl_replace(runlist_element *dst,
                 int dsize, runlist_element *src, int ssize, int loc)
 {
-        BOOL left = FALSE;
-        BOOL right;
-        int magic;
+        BOOL left = FALSE;      /* Left end of @src needs merging. */
+        BOOL right = FALSE;     /* Right end of @src needs merging. */
+        int tail;               /* Start of tail of @dst. */
+        int marker;             /* End of the inserted runs. */
 
         BUG_ON(!dst);
         BUG_ON(!src);
 
-        /* First, merge the left and right ends, if necessary. */
-        right = ntfs_are_rl_mergeable(src + ssize - 1, dst + loc + 1);
+        /* First, see if the left and right ends need merging. */
+        if ((loc + 1) < dsize)
+                right = ntfs_are_rl_mergeable(src + ssize - 1, dst + loc + 1);
         if (loc > 0)
                 left = ntfs_are_rl_mergeable(dst + loc - 1, src);
-
-        /* Allocate some space. We'll need less if the left, right, or both
-         * ends were merged. */
+        /*
+         * Allocate some space.  We will need less if the left, right, or both
+         * ends get merged.
+         */
         dst = ntfs_rl_realloc(dst, dsize, dsize + ssize - left - right);
         if (IS_ERR(dst))
                 return dst;
@@ -406,21 +405,37 @@ static inline runlist_element *ntfs_rl_replace(runlist_element *dst,
          * We are guaranteed to succeed from here so can start modifying the
          * original runlists.
          */
+
+        /* First, merge the left and right ends, if necessary. */
         if (right)
                 __ntfs_rl_merge(src + ssize - 1, dst + loc + 1);
         if (left)
                 __ntfs_rl_merge(dst + loc - 1, src);
-
-        /* FIXME: What does this mean? (AIA) */
-        magic = loc + ssize - left;
+        /*
+         * Offset of the tail of @dst.  This needs to be moved out of the way
+         * to make space for the runs to be copied from @src, i.e. the first
+         * run of the tail of @dst.
+         * Nominally, @tail equals @loc + 1, i.e. location, skipping the
+         * replaced run.  However, if @right, then one of @dst's runs is
+         * already merged into @src.
+         */
+        tail = loc + right + 1;
+        /*
+         * First run after the @src runs that have been inserted, i.e. where
+         * the tail of @dst needs to be moved to.
+         * Nominally, @marker equals @loc + @ssize, i.e. location + number of
+         * runs in @src.  However, if @left, then the first run in @src has
+         * been merged with one in @dst.
+         */
+        marker = loc + ssize - left;
 
         /* Move the tail of @dst out of the way, then copy in @src. */
-        ntfs_rl_mm(dst, magic, loc + right + 1, dsize - loc - right - 1);
+        ntfs_rl_mm(dst, marker, tail, dsize - tail);
         ntfs_rl_mc(dst, loc, src, left, ssize - left);
 
-        /* We may have changed the length of the file, so fix the end marker */
-        if (dst[magic].lcn == LCN_ENOENT)
-                dst[magic].vcn = dst[magic - 1].vcn + dst[magic - 1].length;
+        /* We may have changed the length of the file, so fix the end marker. */
+        if (dsize - tail > 0 && dst[marker].lcn == LCN_ENOENT)
+                dst[marker].vcn = dst[marker - 1].vcn + dst[marker - 1].length;
         return dst;
 }
 
diff --git a/fs/open.c b/fs/open.c
index 2fac58c51910..f0d90cf0495c 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -738,52 +738,15 @@ asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group)
         return error;
 }
 
-/*
- * Note that while the flag value (low two bits) for sys_open means:
- *      00 - read-only
- *      01 - write-only
- *      10 - read-write
- *      11 - special
- * it is changed into
- *      00 - no permissions needed
- *      01 - read-permission
- *      10 - write-permission
- *      11 - read-write
- * for the internal routines (ie open_namei()/follow_link() etc). 00 is
- * used by symlinks.
- */
-struct file *filp_open(const char * filename, int flags, int mode)
-{
-        int namei_flags, error;
-        struct nameidata nd;
-
-        namei_flags = flags;
-        if ((namei_flags+1) & O_ACCMODE)
-                namei_flags++;
-        if (namei_flags & O_TRUNC)
-                namei_flags |= 2;
-
-        error = open_namei(filename, namei_flags, mode, &nd);
-        if (!error)
-                return dentry_open(nd.dentry, nd.mnt, flags);
-
-        return ERR_PTR(error);
-}
-
-EXPORT_SYMBOL(filp_open);
-
-struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags)
+static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
+                                        int flags, struct file *f)
 {
-        struct file * f;
         struct inode *inode;
         int error;
 
-        error = -ENFILE;
-        f = get_empty_filp();
-        if (!f)
-                goto cleanup_dentry;
         f->f_flags = flags;
-        f->f_mode = ((flags+1) & O_ACCMODE) | FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE;
+        f->f_mode = ((flags+1) & O_ACCMODE) | FMODE_LSEEK |
+                                FMODE_PREAD | FMODE_PWRITE;
         inode = dentry->d_inode;
         if (f->f_mode & FMODE_WRITE) {
                 error = get_write_access(inode);
@@ -828,12 +791,63 @@ cleanup_all:
         f->f_vfsmnt = NULL;
 cleanup_file:
         put_filp(f);
-cleanup_dentry:
         dput(dentry);
         mntput(mnt);
         return ERR_PTR(error);
 }
 
+/*
+ * Note that while the flag value (low two bits) for sys_open means:
+ *      00 - read-only
+ *      01 - write-only
+ *      10 - read-write
+ *      11 - special
+ * it is changed into
+ *      00 - no permissions needed
+ *      01 - read-permission
+ *      10 - write-permission
+ *      11 - read-write
+ * for the internal routines (ie open_namei()/follow_link() etc). 00 is
+ * used by symlinks.
+ */
+struct file *filp_open(const char * filename, int flags, int mode)
+{
+        int namei_flags, error;
+        struct nameidata nd;
+        struct file *f;
+
+        namei_flags = flags;
+        if ((namei_flags+1) & O_ACCMODE)
+                namei_flags++;
+        if (namei_flags & O_TRUNC)
+                namei_flags |= 2;
+
+        error = -ENFILE;
+        f = get_empty_filp();
+        if (f == NULL)
+                return ERR_PTR(error);
+
+        error = open_namei(filename, namei_flags, mode, &nd);
+        if (!error)
+                return __dentry_open(nd.dentry, nd.mnt, flags, f);
+
+        put_filp(f);
+        return ERR_PTR(error);
+}
+EXPORT_SYMBOL(filp_open);
+
+struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags)
+{
+        int error;
+        struct file *f;
+
+        error = -ENFILE;
+        f = get_empty_filp();
+        if (f == NULL)
+                return ERR_PTR(error);
+
+        return __dentry_open(dentry, mnt, flags, f);
+}
 EXPORT_SYMBOL(dentry_open);
 
 /*
diff --git a/fs/proc/array.c b/fs/proc/array.c
index d88d518d30f6..d84eecacbeaf 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -74,6 +74,7 @@
 #include <linux/file.h>
 #include <linux/times.h>
 #include <linux/cpuset.h>
+#include <linux/rcupdate.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -180,12 +181,14 @@ static inline char * task_state(struct task_struct *p, char *buffer)
                 p->gid, p->egid, p->sgid, p->fsgid);
         read_unlock(&tasklist_lock);
         task_lock(p);
+        rcu_read_lock();
         if (p->files)
                 fdt = files_fdtable(p->files);
         buffer += sprintf(buffer,
                 "FDSize:\t%d\n"
                 "Groups:\t",
                 fdt ? fdt->max_fds : 0);
+        rcu_read_unlock();
 
         group_info = p->group_info;
         get_group_info(group_info);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 23db452ab428..3b33f94020db 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -340,6 +340,54 @@ static int proc_root_link(struct inode *inode, struct dentry **dentry, struct vf
         return result;
 }
 
+
+/* Same as proc_root_link, but this addionally tries to get fs from other
+ * threads in the group */
+static int proc_task_root_link(struct inode *inode, struct dentry **dentry,
+                                struct vfsmount **mnt)
+{
+        struct fs_struct *fs;
+        int result = -ENOENT;
+        struct task_struct *leader = proc_task(inode);
+
+        task_lock(leader);
+        fs = leader->fs;
+        if (fs) {
+                atomic_inc(&fs->count);
+                task_unlock(leader);
+        } else {
+                /* Try to get fs from other threads */
+                task_unlock(leader);
+                read_lock(&tasklist_lock);
+                if (pid_alive(leader)) {
+                        struct task_struct *task = leader;
+
+                        while ((task = next_thread(task)) != leader) {
+                                task_lock(task);
+                                fs = task->fs;
+                                if (fs) {
+                                        atomic_inc(&fs->count);
+                                        task_unlock(task);
+                                        break;
+                                }
+                                task_unlock(task);
+                        }
+                }
+                read_unlock(&tasklist_lock);
+        }
+
+        if (fs) {
+                read_lock(&fs->lock);
+                *mnt = mntget(fs->rootmnt);
+                *dentry = dget(fs->root);
+                read_unlock(&fs->lock);
+                result = 0;
+                put_fs_struct(fs);
+        }
+        return result;
+}
+
+
 #define MAY_PTRACE(task) \
         (task == current || \
         (task->parent == current && \
@@ -471,14 +519,14 @@ static int proc_oom_score(struct task_struct *task, char *buffer)
 
 /* permission checks */
 
-static int proc_check_root(struct inode *inode)
+/* If the process being read is separated by chroot from the reading process,
+ * don't let the reader access the threads.
+ */
+static int proc_check_chroot(struct dentry *root, struct vfsmount *vfsmnt)
 {
-        struct dentry *de, *base, *root;
-        struct vfsmount *our_vfsmnt, *vfsmnt, *mnt;
+        struct dentry *de, *base;
+        struct vfsmount *our_vfsmnt, *mnt;
         int res = 0;
-
-        if (proc_root_link(inode, &root, &vfsmnt)) /* Ewww... */
-                return -ENOENT;
         read_lock(&current->fs->lock);
         our_vfsmnt = mntget(current->fs->rootmnt);
         base = dget(current->fs->root);
@@ -511,6 +559,16 @@ out:
         goto exit;
 }
 
+static int proc_check_root(struct inode *inode)
+{
+        struct dentry *root;
+        struct vfsmount *vfsmnt;
+
+        if (proc_root_link(inode, &root, &vfsmnt)) /* Ewww... */
+                return -ENOENT;
+        return proc_check_chroot(root, vfsmnt);
+}
+
 static int proc_permission(struct inode *inode, int mask, struct nameidata *nd)
 {
         if (generic_permission(inode, mask, NULL) != 0)
@@ -518,6 +576,20 @@ static int proc_permission(struct inode *inode, int mask, struct nameidata *nd)
         return proc_check_root(inode);
 }
 
+static int proc_task_permission(struct inode *inode, int mask, struct nameidata *nd)
+{
+        struct dentry *root;
+        struct vfsmount *vfsmnt;
+
+        if (generic_permission(inode, mask, NULL) != 0)
+                return -EACCES;
+
+        if (proc_task_root_link(inode, &root, &vfsmnt))
+                return -ENOENT;
+
+        return proc_check_chroot(root, vfsmnt);
+}
+
 extern struct seq_operations proc_pid_maps_op;
 static int maps_open(struct inode *inode, struct file *file)
 {
@@ -1419,7 +1491,7 @@ static struct inode_operations proc_fd_inode_operations = {
 
 static struct inode_operations proc_task_inode_operations = {
         .lookup         = proc_task_lookup,
-        .permission     = proc_permission,
+        .permission     = proc_task_permission,
 };
 
 #ifdef CONFIG_SECURITY
diff --git a/fs/read_write.c b/fs/read_write.c
index b60324aaa2b6..a091ee4f430d 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -499,6 +499,9 @@ static ssize_t do_readv_writev(int type, struct file *file,
         ret = rw_verify_area(type, file, pos, tot_len);
         if (ret)
                 goto out;
+        ret = security_file_permission(file, type == READ ? MAY_READ : MAY_WRITE);
+        if (ret)
+                goto out;
 
         fnv = NULL;
         if (type == READ) {
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index c9f178fb494f..c20babd6216d 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -667,7 +667,7 @@ static int reiserfs_allocate_blocks_for_region(struct reiserfs_transaction_handl
         if (th->t_trans_id) {
                 int err;
                 // update any changes we made to blk count
-                reiserfs_update_sd(th, inode);
+                mark_inode_dirty(inode);
                 err =
                     journal_end(th, inode->i_sb,
                                 JOURNAL_PER_BALANCE_CNT * 3 + 1 +
@@ -855,17 +855,18 @@ static int reiserfs_submit_file_region_for_write(struct reiserfs_transaction_han
 
                 if (th->t_trans_id) {
                         reiserfs_write_lock(inode->i_sb);
-                        reiserfs_update_sd(th, inode);  // And update on-disk metadata
+                        // this sets the proper flags for O_SYNC to trigger a commit
+                        mark_inode_dirty(inode);
                         reiserfs_write_unlock(inode->i_sb);
                 } else
-                        inode->i_sb->s_op->dirty_inode(inode);
+                        mark_inode_dirty(inode);
 
                 sd_update = 1;
         }
         if (th->t_trans_id) {
                 reiserfs_write_lock(inode->i_sb);
                 if (!sd_update)
-                        reiserfs_update_sd(th, inode);
+                        mark_inode_dirty(inode);
                 status = journal_end(th, th->t_super, th->t_blocks_allocated);
                 if (status)
                         retval = status;
@@ -1320,7 +1321,7 @@ static ssize_t reiserfs_file_write(struct file *file,	/* the file we are going t
                                 return err;
                         }
                         reiserfs_update_inode_transaction(inode);
-                        reiserfs_update_sd(&th, inode);
+                        mark_inode_dirty(inode);
                         err = journal_end(&th, inode->i_sb, 1);
                         if (err) {
                                 reiserfs_write_unlock(inode->i_sb);
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 1a8a1bf2154d..d76ee6c4f9b8 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -2639,6 +2639,12 @@ static int reiserfs_commit_write(struct file *f, struct page *page,
                 }
                 reiserfs_update_inode_transaction(inode);
                 inode->i_size = pos;
+                /*
+                 * this will just nest into our transaction.  It's important
+                 * to use mark_inode_dirty so the inode gets pushed around on the
+                 * dirty lists, and so that O_SYNC works as expected
+                 */
+                mark_inode_dirty(inode);
                 reiserfs_update_sd(&myth, inode);
                 update_sd = 1;
                 ret = journal_end(&myth, inode->i_sb, 1);
@@ -2649,21 +2655,13 @@ static int reiserfs_commit_write(struct file *f, struct page *page,
         if (th) {
                 reiserfs_write_lock(inode->i_sb);
                 if (!update_sd)
-                        reiserfs_update_sd(th, inode);
+                        mark_inode_dirty(inode);
                 ret = reiserfs_end_persistent_transaction(th);
                 reiserfs_write_unlock(inode->i_sb);
                 if (ret)
                         goto out;
         }
 
-        /* we test for O_SYNC here so we can commit the transaction
-         ** for any packed tails the file might have had
-         */
-        if (f && (f->f_flags & O_SYNC)) {
-                reiserfs_write_lock(inode->i_sb);
-                ret = reiserfs_commit_for_inode(inode);
-                reiserfs_write_unlock(inode->i_sb);
-        }
       out:
         return ret;
 
diff --git a/include/asm-alpha/compiler.h b/include/asm-alpha/compiler.h
index 399c33b7be51..0a4a8b40dfcd 100644
--- a/include/asm-alpha/compiler.h
+++ b/include/asm-alpha/compiler.h
@@ -98,6 +98,9 @@
 #undef inline
 #undef __inline__
 #undef __inline
-
+#if __GNUC__ == 3 && __GNUC_MINOR__ >= 1 || __GNUC__ > 3
+#undef __always_inline
+#define __always_inline         inline __attribute__((always_inline))
+#endif
 
 #endif /* __ALPHA_COMPILER_H */
diff --git a/include/asm-alpha/futex.h b/include/asm-alpha/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-alpha/futex.h
+++ b/include/asm-alpha/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-alpha/pgtable.h b/include/asm-alpha/pgtable.h
index 22b53e369f59..8393bf374b2b 100644
--- a/include/asm-alpha/pgtable.h
+++ b/include/asm-alpha/pgtable.h
@@ -339,13 +339,6 @@ extern inline pte_t mk_swap_pte(unsigned long type, unsigned long offset)
 #define kern_addr_valid(addr)   (1)
 #endif
 
-#define io_remap_page_range(vma, start, busaddr, size, prot)    \
-({                                                              \
-        void *va = (void __force *)ioremap(busaddr, size);      \
-        unsigned long pfn = virt_to_phys(va) >> PAGE_SHIFT;     \
-        remap_pfn_range(vma, start, pfn, size, prot);           \
-})
-
 #define io_remap_pfn_range(vma, start, pfn, size, prot) \
                 remap_pfn_range(vma, start, pfn, size, prot)
 
diff --git a/include/asm-arm/arch-aaec2000/memory.h b/include/asm-arm/arch-aaec2000/memory.h
index 681b6a6171a1..79c90813bc3e 100644
--- a/include/asm-arm/arch-aaec2000/memory.h
+++ b/include/asm-arm/arch-aaec2000/memory.h
@@ -64,10 +64,6 @@
 #define NODE_MAX_MEM_SHIFT      26
 #define NODE_MAX_MEM_SIZE       (1 << NODE_MAX_MEM_SHIFT)
 
-#else
-
-#define PFN_TO_NID(addr)        (0)
-
 #endif /* CONFIG_DISCONTIGMEM */
 
 #endif /* __ASM_ARCH_MEMORY_H */
diff --git a/include/asm-arm/arch-iop3xx/memory.h b/include/asm-arm/arch-iop3xx/memory.h
index dc4735cb0c10..45351f5cd904 100644
--- a/include/asm-arm/arch-iop3xx/memory.h
+++ b/include/asm-arm/arch-iop3xx/memory.h
@@ -36,6 +36,4 @@
 
 #endif
 
-#define PFN_TO_NID(addr)        (0)
-
 #endif
diff --git a/include/asm-arm/arch-ixp2000/ixp2000-regs.h b/include/asm-arm/arch-ixp2000/ixp2000-regs.h
index 75623f81ef75..32aece069869 100644
--- a/include/asm-arm/arch-ixp2000/ixp2000-regs.h
+++ b/include/asm-arm/arch-ixp2000/ixp2000-regs.h
@@ -370,8 +370,6 @@
 #define GLOBAL_REG_BASE                 (IXP2000_GLOBAL_REG_VIRT_BASE + 0x0a00)
 #define GLOBAL_REG(x)                   (volatile unsigned long*)(GLOBAL_REG_BASE | (x))
 
-#define IXP2000_PROD_ID                 GLOBAL_REG(0x00)
-
 #define IXP2000_MAJ_PROD_TYPE_MASK      0x001F0000
 #define IXP2000_MAJ_PROD_TYPE_IXP2000   0x00000000
 #define IXP2000_MIN_PROD_TYPE_MASK      0x0000FF00
diff --git a/include/asm-arm/arch-ixp2000/platform.h b/include/asm-arm/arch-ixp2000/platform.h
index c0caf3e3e6fd..abdcf51bd283 100644
--- a/include/asm-arm/arch-ixp2000/platform.h
+++ b/include/asm-arm/arch-ixp2000/platform.h
@@ -31,20 +31,24 @@
 
 #include <asm/system.h>         /* Pickup local_irq_ functions */
 
-static inline void ixp2000_reg_write(volatile unsigned long *reg, unsigned long val)
+static inline void ixp2000_reg_write(volatile void *reg, unsigned long val)
 {
-        volatile unsigned long dummy;
+        unsigned long dummy;
         unsigned long flags;
 
         local_irq_save(flags);
-        *reg = val;
+        *((volatile unsigned long *)reg) = val;
         barrier();
-        dummy = *reg;
+        dummy = *((volatile unsigned long *)reg);
         local_irq_restore(flags);
 }
 #else
-#define ixp2000_reg_write(reg, val) (*reg = val)
+static inline void ixp2000_reg_write(volatile void *reg, unsigned long val)
+{
+        *((volatile unsigned long *)reg) = val;
+}
 #endif  /* IXDP2400 || IXDP2401 */
+#define ixp2000_reg_read(reg)   (*((volatile unsigned long *)reg))
 
 /*
  * Boards may multiplex different devices on the 2nd channel of 
@@ -84,7 +88,7 @@ void ixp2000_release_slowport(struct slowport_cfg *);
  */
 static inline unsigned ixp2000_has_broken_slowport(void)
 {
-        unsigned long id = *IXP2000_PROD_ID;
+        unsigned long id = *IXP2000_PRODUCT_ID;
         unsigned long id_prod = id & (IXP2000_MAJ_PROD_TYPE_MASK |
                                       IXP2000_MIN_PROD_TYPE_MASK);
         return (((id_prod ==
diff --git a/include/asm-arm/arch-lh7a40x/memory.h b/include/asm-arm/arch-lh7a40x/memory.h
index 7e2fea372663..c650e6feb9d5 100644
--- a/include/asm-arm/arch-lh7a40x/memory.h
+++ b/include/asm-arm/arch-lh7a40x/memory.h
@@ -85,10 +85,6 @@
        (((unsigned long)(addr) & 0x01ffffff) >> PAGE_SHIFT)
 # endif
 
-#else
-
-# define PFN_TO_NID(addr)       (0)
-
 #endif
 
 #endif
diff --git a/include/asm-arm/arch-omap/memory.h b/include/asm-arm/arch-omap/memory.h
index 84f81e315a25..ef32d61eec7a 100644
--- a/include/asm-arm/arch-omap/memory.h
+++ b/include/asm-arm/arch-omap/memory.h
@@ -86,6 +86,5 @@
 
 #endif  /* CONFIG_ARCH_OMAP1510 */
 
-#define PHYS_TO_NID(addr) (0)
 #endif
 
diff --git a/include/asm-arm/arch-pxa/akita.h b/include/asm-arm/arch-pxa/akita.h
new file mode 100644
index 000000000000..4a1fbcfccc39
--- /dev/null
+++ b/include/asm-arm/arch-pxa/akita.h
@@ -0,0 +1,30 @@
+/*
+ * Hardware specific definitions for SL-C1000 (Akita)
+ *
+ * Copyright (c) 2005 Richard Purdie
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+/* Akita IO Expander GPIOs */
+
+#define AKITA_IOEXP_RESERVED_7      (1 << 7)
+#define AKITA_IOEXP_IR_ON           (1 << 6)
+#define AKITA_IOEXP_AKIN_PULLUP     (1 << 5)
+#define AKITA_IOEXP_BACKLIGHT_CONT  (1 << 4)
+#define AKITA_IOEXP_BACKLIGHT_ON    (1 << 3)
+#define AKITA_IOEXP_MIC_BIAS        (1 << 2)
+#define AKITA_IOEXP_RESERVED_1      (1 << 1)
+#define AKITA_IOEXP_RESERVED_0      (1 << 0)
+
+/* Direction Bitfield  0=output  1=input */
+#define AKITA_IOEXP_IO_DIR      0
+/* Default Values */
+#define AKITA_IOEXP_IO_OUT      (AKITA_IOEXP_IR_ON | AKITA_IOEXP_AKIN_PULLUP)
+
+void akita_set_ioexp(struct device *dev, unsigned char bitmask);
+void akita_reset_ioexp(struct device *dev, unsigned char bitmask);
+
diff --git a/include/asm-arm/arch-pxa/corgi.h b/include/asm-arm/arch-pxa/corgi.h
index 4b7aa0b8391e..e554caa0d18b 100644
--- a/include/asm-arm/arch-pxa/corgi.h
+++ b/include/asm-arm/arch-pxa/corgi.h
@@ -106,17 +106,5 @@ extern struct platform_device corgiscoop_device;
 extern struct platform_device corgissp_device;
 extern struct platform_device corgifb_device;
 
-/*
- * External Functions
- */
-extern unsigned long corgi_ssp_ads7846_putget(unsigned long);
-extern unsigned long corgi_ssp_ads7846_get(void);
-extern void corgi_ssp_ads7846_put(unsigned long data);
-extern void corgi_ssp_ads7846_lock(void);
-extern void corgi_ssp_ads7846_unlock(void);
-extern void corgi_ssp_lcdtg_send (unsigned char adrs, unsigned char data);
-extern void corgi_ssp_blduty_set(int duty);
-extern int corgi_ssp_max1111_get(unsigned long data);
-
 #endif /* __ASM_ARCH_CORGI_H  */
 
diff --git a/include/asm-arm/arch-pxa/memory.h b/include/asm-arm/arch-pxa/memory.h
index 217a80b820ff..58bad9748b5c 100644
--- a/include/asm-arm/arch-pxa/memory.h
+++ b/include/asm-arm/arch-pxa/memory.h
@@ -67,10 +67,6 @@
 #define LOCAL_MAP_NR(addr) \
         (((unsigned long)(addr) & 0x03ffffff) >> PAGE_SHIFT)
 
-#else
-
-#define PFN_TO_NID(addr)        (0)
-
 #endif
 
 #endif
diff --git a/include/asm-arm/arch-pxa/poodle.h b/include/asm-arm/arch-pxa/poodle.h
index 58bda9d571a5..6b5ac5144e70 100644
--- a/include/asm-arm/arch-pxa/poodle.h
+++ b/include/asm-arm/arch-pxa/poodle.h
@@ -37,24 +37,25 @@
 #define POODLE_GPIO_nSD_DETECT          (9)
 #define POODLE_GPIO_MAIN_BAT_LOW        (13)
 #define POODLE_GPIO_BAT_COVER           (13)
+#define POODLE_GPIO_USB_PULLUP          (20)
 #define POODLE_GPIO_ADC_TEMP_ON         (21)
 #define POODLE_GPIO_BYPASS_ON           (36)
 #define POODLE_GPIO_CHRG_ON             (38)
 #define POODLE_GPIO_CHRG_FULL           (16)
 
 /* PXA GPIOs */
-#define POODLE_IRQ_GPIO_ON_KEY          IRQ_GPIO0
-#define POODLE_IRQ_GPIO_AC_IN           IRQ_GPIO1
-#define POODLE_IRQ_GPIO_HP_IN           IRQ_GPIO4
-#define POODLE_IRQ_GPIO_CO              IRQ_GPIO16
-#define POODLE_IRQ_GPIO_TP_INT          IRQ_GPIO5
-#define POODLE_IRQ_GPIO_WAKEUP          IRQ_GPIO11
-#define POODLE_IRQ_GPIO_GA_INT          IRQ_GPIO10
-#define POODLE_IRQ_GPIO_CF_IRQ          IRQ_GPIO17
-#define POODLE_IRQ_GPIO_CF_CD           IRQ_GPIO14
-#define POODLE_IRQ_GPIO_nSD_INT         IRQ_GPIO8
-#define POODLE_IRQ_GPIO_nSD_DETECT      IRQ_GPIO9
-#define POODLE_IRQ_GPIO_MAIN_BAT_LOW    IRQ_GPIO13
+#define POODLE_IRQ_GPIO_ON_KEY          IRQ_GPIO(0)
+#define POODLE_IRQ_GPIO_AC_IN           IRQ_GPIO(1)
+#define POODLE_IRQ_GPIO_HP_IN           IRQ_GPIO(4)
+#define POODLE_IRQ_GPIO_CO              IRQ_GPIO(16)
+#define POODLE_IRQ_GPIO_TP_INT          IRQ_GPIO(5)
+#define POODLE_IRQ_GPIO_WAKEUP          IRQ_GPIO(11)
+#define POODLE_IRQ_GPIO_GA_INT          IRQ_GPIO(10)
+#define POODLE_IRQ_GPIO_CF_IRQ          IRQ_GPIO(17)
+#define POODLE_IRQ_GPIO_CF_CD           IRQ_GPIO(14)
+#define POODLE_IRQ_GPIO_nSD_INT         IRQ_GPIO(8)
+#define POODLE_IRQ_GPIO_nSD_DETECT      IRQ_GPIO(9)
+#define POODLE_IRQ_GPIO_MAIN_BAT_LOW    IRQ_GPIO(13)
 
 /* SCOOP GPIOs */
 #define POODLE_SCOOP_CHARGE_ON  SCOOP_GPCR_PA11
diff --git a/include/asm-arm/arch-pxa/sharpsl.h b/include/asm-arm/arch-pxa/sharpsl.h
new file mode 100644
index 000000000000..311f2bb5386a
--- /dev/null
+++ b/include/asm-arm/arch-pxa/sharpsl.h
@@ -0,0 +1,32 @@
+/*
+ * SharpSL SSP Driver
+ */
+
+unsigned long corgi_ssp_ads7846_putget(unsigned long);
+unsigned long corgi_ssp_ads7846_get(void);
+void corgi_ssp_ads7846_put(unsigned long data);
+void corgi_ssp_ads7846_lock(void);
+void corgi_ssp_ads7846_unlock(void);
+void corgi_ssp_lcdtg_send (unsigned char adrs, unsigned char data);
+void corgi_ssp_blduty_set(int duty);
+int corgi_ssp_max1111_get(unsigned long data);
+
+/*
+ * SharpSL Touchscreen Driver
+ */
+
+struct corgits_machinfo {
+        unsigned long (*get_hsync_len)(void);
+        void (*put_hsync)(void);
+        void (*wait_hsync)(void);
+};
+
+/*
+ * SharpSL Backlight
+ */
+
+struct corgibl_machinfo {
+        int max_intensity;
+        void (*set_bl_intensity)(int intensity);
+};
+
diff --git a/include/asm-arm/arch-pxa/spitz.h b/include/asm-arm/arch-pxa/spitz.h
new file mode 100644
index 000000000000..62e1fe4d025f
--- /dev/null
+++ b/include/asm-arm/arch-pxa/spitz.h
@@ -0,0 +1,158 @@
+/*
+ * Hardware specific definitions for SL-Cx000 series of PDAs
+ *
+ * Copyright (c) 2005 Alexander Wykes
+ * Copyright (c) 2005 Richard Purdie
+ *
+ * Based on Sharp's 2.4 kernel patches
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#ifndef __ASM_ARCH_SPITZ_H
+#define __ASM_ARCH_SPITZ_H  1
+#endif
+
+/* Spitz/Akita GPIOs */
+
+#define SPITZ_GPIO_KEY_INT         (0) /* Key Interrupt */
+#define SPITZ_GPIO_RESET           (1)
+#define SPITZ_GPIO_nSD_DETECT      (9)
+#define SPITZ_GPIO_TP_INT          (11) /* Touch Panel interrupt */
+#define SPITZ_GPIO_AK_INT          (13) /* Remote Control */
+#define SPITZ_GPIO_ADS7846_CS      (14)
+#define SPITZ_GPIO_SYNC            (16)
+#define SPITZ_GPIO_MAX1111_CS      (20)
+#define SPITZ_GPIO_FATAL_BAT       (21)
+#define SPITZ_GPIO_HSYNC           (22)
+#define SPITZ_GPIO_nSD_CLK         (32)
+#define SPITZ_GPIO_USB_DEVICE      (35)
+#define SPITZ_GPIO_USB_HOST        (37)
+#define SPITZ_GPIO_USB_CONNECT     (41)
+#define SPITZ_GPIO_LCDCON_CS       (53)
+#define SPITZ_GPIO_nPCE            (54)
+#define SPITZ_GPIO_nSD_WP          (81)
+#define SPITZ_GPIO_ON_RESET        (89)
+#define SPITZ_GPIO_BAT_COVER       (90)
+#define SPITZ_GPIO_CF_CD           (94)
+#define SPITZ_GPIO_ON_KEY          (95)
+#define SPITZ_GPIO_SWA             (97)
+#define SPITZ_GPIO_SWB             (96)
+#define SPITZ_GPIO_CHRG_FULL       (101)
+#define SPITZ_GPIO_CO              (101)
+#define SPITZ_GPIO_CF_IRQ          (105)
+#define SPITZ_GPIO_AC_IN           (115)
+#define SPITZ_GPIO_HP_IN           (116)
+
+/* Spitz Only GPIOs */
+
+#define SPITZ_GPIO_CF2_IRQ         (106) /* CF slot1 Ready */
+#define SPITZ_GPIO_CF2_CD          (93)
+
+
+/* Spitz/Akita Keyboard Definitions */
+
+#define SPITZ_KEY_STROBE_NUM         (11)
+#define SPITZ_KEY_SENSE_NUM          (7)
+#define SPITZ_GPIO_G0_STROBE_BIT     0x0f800000
+#define SPITZ_GPIO_G1_STROBE_BIT     0x00100000
+#define SPITZ_GPIO_G2_STROBE_BIT     0x01000000
+#define SPITZ_GPIO_G3_STROBE_BIT     0x00041880
+#define SPITZ_GPIO_G0_SENSE_BIT      0x00021000
+#define SPITZ_GPIO_G1_SENSE_BIT      0x000000d4
+#define SPITZ_GPIO_G2_SENSE_BIT      0x08000000
+#define SPITZ_GPIO_G3_SENSE_BIT      0x00000000
+
+#define SPITZ_GPIO_KEY_STROBE0       88
+#define SPITZ_GPIO_KEY_STROBE1       23
+#define SPITZ_GPIO_KEY_STROBE2       24
+#define SPITZ_GPIO_KEY_STROBE3       25
+#define SPITZ_GPIO_KEY_STROBE4       26
+#define SPITZ_GPIO_KEY_STROBE5       27
+#define SPITZ_GPIO_KEY_STROBE6       52
+#define SPITZ_GPIO_KEY_STROBE7       103
+#define SPITZ_GPIO_KEY_STROBE8       107
+#define SPITZ_GPIO_KEY_STROBE9       108
+#define SPITZ_GPIO_KEY_STROBE10      114
+
+#define SPITZ_GPIO_KEY_SENSE0        12
+#define SPITZ_GPIO_KEY_SENSE1        17
+#define SPITZ_GPIO_KEY_SENSE2        91
+#define SPITZ_GPIO_KEY_SENSE3        34
+#define SPITZ_GPIO_KEY_SENSE4        36
+#define SPITZ_GPIO_KEY_SENSE5        38
+#define SPITZ_GPIO_KEY_SENSE6        39
+
+
+/* Spitz Scoop Device (No. 1) GPIOs */
+/* Suspend States in comments */
+#define SPITZ_SCP_LED_GREEN     SCOOP_GPCR_PA11  /* Keep */
+#define SPITZ_SCP_JK_B          SCOOP_GPCR_PA12  /* Keep */
+#define SPITZ_SCP_CHRG_ON       SCOOP_GPCR_PA13  /* Keep */
+#define SPITZ_SCP_MUTE_L        SCOOP_GPCR_PA14  /* Low */
+#define SPITZ_SCP_MUTE_R        SCOOP_GPCR_PA15  /* Low */
+#define SPITZ_SCP_CF_POWER      SCOOP_GPCR_PA16  /* Keep */
+#define SPITZ_SCP_LED_ORANGE    SCOOP_GPCR_PA17  /* Keep */
+#define SPITZ_SCP_JK_A          SCOOP_GPCR_PA18  /* Low */
+#define SPITZ_SCP_ADC_TEMP_ON   SCOOP_GPCR_PA19  /* Low */
+
+#define SPITZ_SCP_IO_DIR      (SPITZ_SCP_LED_GREEN | SPITZ_SCP_JK_B | SPITZ_SCP_CHRG_ON | \
+                               SPITZ_SCP_MUTE_L | SPITZ_SCP_MUTE_R | SPITZ_SCP_LED_ORANGE | \
+                               SPITZ_SCP_CF_POWER | SPITZ_SCP_JK_A | SPITZ_SCP_ADC_TEMP_ON)
+#define SPITZ_SCP_IO_OUT      (SPITZ_SCP_CHRG_ON | SPITZ_SCP_MUTE_L | SPITZ_SCP_MUTE_R)
+#define SPITZ_SCP_SUS_CLR     (SPITZ_SCP_MUTE_L | SPITZ_SCP_MUTE_R | SPITZ_SCP_JK_A | SPITZ_SCP_ADC_TEMP_ON)
+#define SPITZ_SCP_SUS_SET     0
+
+/* Spitz Scoop Device (No. 2) GPIOs */
+/* Suspend States in comments */
+#define SPITZ_SCP2_IR_ON           SCOOP_GPCR_PA11  /* High */
+#define SPITZ_SCP2_AKIN_PULLUP     SCOOP_GPCR_PA12  /* Keep */
+#define SPITZ_SCP2_RESERVED_1      SCOOP_GPCR_PA13  /* High */
+#define SPITZ_SCP2_RESERVED_2      SCOOP_GPCR_PA14  /* Low */
+#define SPITZ_SCP2_RESERVED_3      SCOOP_GPCR_PA15  /* Low */
+#define SPITZ_SCP2_RESERVED_4      SCOOP_GPCR_PA16  /* Low */
+#define SPITZ_SCP2_BACKLIGHT_CONT  SCOOP_GPCR_PA17  /* Low */
+#define SPITZ_SCP2_BACKLIGHT_ON    SCOOP_GPCR_PA18  /* Low */
+#define SPITZ_SCP2_MIC_BIAS        SCOOP_GPCR_PA19  /* Low */
+
+#define SPITZ_SCP2_IO_DIR (SPITZ_SCP2_IR_ON | SPITZ_SCP2_AKIN_PULLUP | SPITZ_SCP2_RESERVED_1 | \
+                           SPITZ_SCP2_RESERVED_2 | SPITZ_SCP2_RESERVED_3 | SPITZ_SCP2_RESERVED_4 | \
+                           SPITZ_SCP2_BACKLIGHT_CONT | SPITZ_SCP2_BACKLIGHT_ON | SPITZ_SCP2_MIC_BIAS)
+
+#define SPITZ_SCP2_IO_OUT   (SPITZ_SCP2_IR_ON | SPITZ_SCP2_AKIN_PULLUP | SPITZ_SCP2_RESERVED_1)
+#define SPITZ_SCP2_SUS_CLR  (SPITZ_SCP2_RESERVED_2 | SPITZ_SCP2_RESERVED_3 | SPITZ_SCP2_RESERVED_4 | \
+                             SPITZ_SCP2_BACKLIGHT_CONT | SPITZ_SCP2_BACKLIGHT_ON | SPITZ_SCP2_MIC_BIAS)
+#define SPITZ_SCP2_SUS_SET  (SPITZ_SCP2_IR_ON | SPITZ_SCP2_RESERVED_1)
+
+
+/* Spitz IRQ Definitions */
+
+#define SPITZ_IRQ_GPIO_KEY_INT        IRQ_GPIO(SPITZ_GPIO_KEY_INT)
+#define SPITZ_IRQ_GPIO_AC_IN          IRQ_GPIO(SPITZ_GPIO_AC_IN)
+#define SPITZ_IRQ_GPIO_AK_INT         IRQ_GPIO(SPITZ_GPIO_AK_INT)
+#define SPITZ_IRQ_GPIO_HP_IN          IRQ_GPIO(SPITZ_GPIO_HP_IN)
+#define SPITZ_IRQ_GPIO_TP_INT         IRQ_GPIO(SPITZ_GPIO_TP_INT)
+#define SPITZ_IRQ_GPIO_SYNC           IRQ_GPIO(SPITZ_GPIO_SYNC)
+#define SPITZ_IRQ_GPIO_ON_KEY         IRQ_GPIO(SPITZ_GPIO_ON_KEY)
+#define SPITZ_IRQ_GPIO_SWA            IRQ_GPIO(SPITZ_GPIO_SWA)
+#define SPITZ_IRQ_GPIO_SWB            IRQ_GPIO(SPITZ_GPIO_SWB)
+#define SPITZ_IRQ_GPIO_BAT_COVER      IRQ_GPIO(SPITZ_GPIO_BAT_COVER)
+#define SPITZ_IRQ_GPIO_FATAL_BAT      IRQ_GPIO(SPITZ_GPIO_FATAL_BAT)
+#define SPITZ_IRQ_GPIO_CO             IRQ_GPIO(SPITZ_GPIO_CO)
+#define SPITZ_IRQ_GPIO_CF_IRQ         IRQ_GPIO(SPITZ_GPIO_CF_IRQ)
+#define SPITZ_IRQ_GPIO_CF_CD          IRQ_GPIO(SPITZ_GPIO_CF_CD)
+#define SPITZ_IRQ_GPIO_CF2_IRQ        IRQ_GPIO(SPITZ_GPIO_CF2_IRQ)
+#define SPITZ_IRQ_GPIO_nSD_INT        IRQ_GPIO(SPITZ_GPIO_nSD_INT)
+#define SPITZ_IRQ_GPIO_nSD_DETECT     IRQ_GPIO(SPITZ_GPIO_nSD_DETECT)
+
+/*
+ * Shared data structures
+ */
+extern struct platform_device spitzscoop_device;
+extern struct platform_device spitzscoop2_device;
+extern struct platform_device spitzssp_device;
+extern struct sharpsl_charger_machinfo spitz_pm_machinfo;
+
+extern void spitz_lcd_power(int on);
diff --git a/include/asm-arm/arch-rpc/hardware.h b/include/asm-arm/arch-rpc/hardware.h
index be9754a05c19..9d7f87375aa7 100644
--- a/include/asm-arm/arch-rpc/hardware.h
+++ b/include/asm-arm/arch-rpc/hardware.h
@@ -15,7 +15,7 @@
 #include <asm/arch/memory.h>
 
 #ifndef __ASSEMBLY__
-#define IOMEM(x) ((void __iomem *)(x))
+#define IOMEM(x) ((void __iomem *)(unsigned long)(x))
 #else
 #define IOMEM(x) x
 #endif /* __ASSEMBLY__ */
@@ -52,7 +52,7 @@
 /*
  * IO Addresses
  */
-#define VIDC_BASE               (void __iomem *)0xe0400000
+#define VIDC_BASE               IOMEM(0xe0400000)
 #define EXPMASK_BASE            0xe0360000
 #define IOMD_BASE               IOMEM(0xe0200000)
 #define IOC_BASE                IOMEM(0xe0200000)
diff --git a/include/asm-arm/arch-s3c2410/anubis-map.h b/include/asm-arm/arch-s3c2410/anubis-map.h
index 97741d6e506a..d529ffda8599 100644
--- a/include/asm-arm/arch-s3c2410/anubis-map.h
+++ b/include/asm-arm/arch-s3c2410/anubis-map.h
@@ -20,22 +20,22 @@
 
 /* start peripherals off after the S3C2410 */
 
-#define ANUBIS_IOADDR(x)        (S3C2410_ADDR((x) + 0x02000000))
+#define ANUBIS_IOADDR(x)        (S3C2410_ADDR((x) + 0x01800000))
 
 #define ANUBIS_PA_CPLD          (S3C2410_CS1 | (1<<26))
 
 /* we put the CPLD registers next, to get them out of the way */
 
-#define ANUBIS_VA_CTRL1     ANUBIS_IOADDR(0x00000000)    /* 0x01300000 */
+#define ANUBIS_VA_CTRL1     ANUBIS_IOADDR(0x00000000)    /* 0x01800000 */
 #define ANUBIS_PA_CTRL1     (ANUBIS_PA_CPLD)
 
-#define ANUBIS_VA_CTRL2     ANUBIS_IOADDR(0x00100000)    /* 0x01400000 */
+#define ANUBIS_VA_CTRL2     ANUBIS_IOADDR(0x00100000)    /* 0x01900000 */
 #define ANUBIS_PA_CTRL2     (ANUBIS_PA_CPLD)
 
-#define ANUBIS_VA_CTRL3     ANUBIS_IOADDR(0x00200000)    /* 0x01500000 */
+#define ANUBIS_VA_CTRL3     ANUBIS_IOADDR(0x00200000)    /* 0x01A00000 */
 #define ANUBIS_PA_CTRL3     (ANUBIS_PA_CPLD)
 
-#define ANUBIS_VA_CTRL4     ANUBIS_IOADDR(0x00300000)    /* 0x01600000 */
+#define ANUBIS_VA_CTRL4     ANUBIS_IOADDR(0x00300000)    /* 0x01B00000 */
 #define ANUBIS_PA_CTRL4     (ANUBIS_PA_CPLD)
 
 #define ANUBIS_IDEPRI       ANUBIS_IOADDR(0x01000000)
diff --git a/include/asm-arm/arch-sa1100/memory.h b/include/asm-arm/arch-sa1100/memory.h
index 32d3d5bde34d..8743ff5c1b23 100644
--- a/include/asm-arm/arch-sa1100/memory.h
+++ b/include/asm-arm/arch-sa1100/memory.h
@@ -99,10 +99,6 @@ __arch_adjust_zones(int node, unsigned long *size, unsigned long *holes)
 #define LOCAL_MAP_NR(addr) \
         (((unsigned long)(addr) & 0x07ffffff) >> PAGE_SHIFT)
 
-#else
-
-#define PFN_TO_NID(addr)        (0)
-
 #endif
 
 #endif
diff --git a/include/asm-arm/arch-versatile/io.h b/include/asm-arm/arch-versatile/io.h
index 9f895bf61494..47e904cf25c7 100644
--- a/include/asm-arm/arch-versatile/io.h
+++ b/include/asm-arm/arch-versatile/io.h
@@ -22,7 +22,11 @@
 
 #define IO_SPACE_LIMIT 0xffffffff
 
-#define __io(a)                 ((void __iomem *)(a))
+static inline void __iomem *__io(unsigned long addr)
+{
+        return (void __iomem *)addr;
+}
+#define __io(a) __io(a)
 #define __mem_pci(a)            (a)
 #define __mem_isa(a)            (a)
 
diff --git a/include/asm-arm/elf.h b/include/asm-arm/elf.h
index a1696ba238d3..7da97a937548 100644
--- a/include/asm-arm/elf.h
+++ b/include/asm-arm/elf.h
@@ -124,6 +124,8 @@ do { \
         if (((ex).e_flags & EF_ARM_EABI_MASK) || \
             ((ex).e_flags & EF_ARM_SOFT_FLOAT)) \
                 set_thread_flag(TIF_USING_IWMMXT); \
+        else \
+                clear_thread_flag(TIF_USING_IWMMXT); \
 } while (0)
 
 #endif
diff --git a/include/asm-arm/futex.h b/include/asm-arm/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-arm/futex.h
+++ b/include/asm-arm/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-arm/hardware/arm_twd.h b/include/asm-arm/hardware/arm_twd.h
new file mode 100644
index 000000000000..131d5b40e072
--- /dev/null
+++ b/include/asm-arm/hardware/arm_twd.h
@@ -0,0 +1,16 @@
+#ifndef __ASM_HARDWARE_TWD_H
+#define __ASM_HARDWARE_TWD_H
+
+#define TWD_TIMER_LOAD          0x00
+#define TWD_TIMER_COUNTER               0x04
+#define TWD_TIMER_CONTROL               0x08
+#define TWD_TIMER_INTSTAT               0x0C
+
+#define TWD_WDOG_LOAD                   0x20
+#define TWD_WDOG_COUNTER                0x24
+#define TWD_WDOG_CONTROL                0x28
+#define TWD_WDOG_INTSTAT                0x2C
+#define TWD_WDOG_RESETSTAT              0x30
+#define TWD_WDOG_DISABLE                0x34
+
+#endif
diff --git a/include/asm-arm/io.h b/include/asm-arm/io.h
index cfa71a0dffb6..5c4ae8f5dbb0 100644
--- a/include/asm-arm/io.h
+++ b/include/asm-arm/io.h
@@ -136,9 +136,9 @@ extern void __readwrite_bug(const char *fn);
 /*
  * String version of IO memory access ops:
  */
-extern void _memcpy_fromio(void *, void __iomem *, size_t);
-extern void _memcpy_toio(void __iomem *, const void *, size_t);
-extern void _memset_io(void __iomem *, int, size_t);
+extern void _memcpy_fromio(void *, const volatile void __iomem *, size_t);
+extern void _memcpy_toio(volatile void __iomem *, const void *, size_t);
+extern void _memset_io(volatile void __iomem *, int, size_t);
 
 #define mmiowb()
 
diff --git a/include/asm-arm/mach/arch.h b/include/asm-arm/mach/arch.h
index 56c6bf4ab0c3..4fa95084a8c0 100644
--- a/include/asm-arm/mach/arch.h
+++ b/include/asm-arm/mach/arch.h
@@ -50,7 +50,7 @@ struct machine_desc {
  */
 #define MACHINE_START(_type,_name)              \
 const struct machine_desc __mach_desc_##_type   \
- __attribute__((__section__(".arch.info"))) = { \
+ __attribute__((__section__(".arch.info.init"))) = {    \
         .nr             = MACH_TYPE_##_type,    \
         .name           = _name,
 
diff --git a/include/asm-arm/memory.h b/include/asm-arm/memory.h
index e47bea7d1723..a8a933a775db 100644
--- a/include/asm-arm/memory.h
+++ b/include/asm-arm/memory.h
@@ -160,12 +160,25 @@ static inline __deprecated void *bus_to_virt(unsigned long x)
 #define page_to_pfn(page)                                       \
         (( (page) - page_zone(page)->zone_mem_map)              \
           + page_zone(page)->zone_start_pfn)
+
 #define pfn_to_page(pfn)                                        \
         (PFN_TO_MAPBASE(pfn) + LOCAL_MAP_NR((pfn) << PAGE_SHIFT))
-#define pfn_valid(pfn)          (PFN_TO_NID(pfn) < MAX_NUMNODES)
+
+#define pfn_valid(pfn)                                          \
+        ({                                                      \
+                unsigned int nid = PFN_TO_NID(pfn);             \
+                int valid = nid < MAX_NUMNODES;                 \
+                if (valid) {                                    \
+                        pg_data_t *node = NODE_DATA(nid);       \
+                        valid = (pfn - node->node_start_pfn) <  \
+                                node->node_spanned_pages;       \
+                }                                               \
+                valid;                                          \
+        })
 
 #define virt_to_page(kaddr)                                     \
         (ADDR_TO_MAPBASE(kaddr) + LOCAL_MAP_NR(kaddr))
+
 #define virt_addr_valid(kaddr)  (KVADDR_TO_NID(kaddr) < MAX_NUMNODES)
 
 /*
diff --git a/include/asm-arm/pgtable.h b/include/asm-arm/pgtable.h
index 478c49b56e18..366bafbdfbb1 100644
--- a/include/asm-arm/pgtable.h
+++ b/include/asm-arm/pgtable.h
@@ -445,12 +445,9 @@ extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
 #define HAVE_ARCH_UNMAPPED_AREA
 
 /*
- * remap a physical address `phys' of size `size' with page protection `prot'
+ * remap a physical page `pfn' of size `size' with page protection `prot'
  * into virtual address `from'
  */
-#define io_remap_page_range(vma,from,phys,size,prot) \
-                remap_pfn_range(vma, from, (phys) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma,from,pfn,size,prot) \
                 remap_pfn_range(vma, from, pfn, size, prot)
 
diff --git a/include/asm-arm/setup.h b/include/asm-arm/setup.h
index adcbd79762bf..ea3ed2465233 100644
--- a/include/asm-arm/setup.h
+++ b/include/asm-arm/setup.h
@@ -171,7 +171,7 @@ struct tagtable {
         int (*parse)(const struct tag *);
 };
 
-#define __tag __attribute_used__ __attribute__((__section__(".taglist")))
+#define __tag __attribute_used__ __attribute__((__section__(".taglist.init")))
 #define __tagtable(tag, fn) \
 static struct tagtable __tagtable_##fn __tag = { tag, fn }
 
@@ -213,6 +213,6 @@ struct early_params {
 
 #define __early_param(name,fn)                                  \
 static struct early_params __early_##fn __attribute_used__      \
-__attribute__((__section__("__early_param"))) = { name, fn }
+__attribute__((__section__(".early_param.init"))) = { name, fn }
 
 #endif
diff --git a/include/asm-arm/signal.h b/include/asm-arm/signal.h
index 760f6e65af05..ced69161917b 100644
--- a/include/asm-arm/signal.h
+++ b/include/asm-arm/signal.h
@@ -115,7 +115,6 @@ typedef unsigned long sigset_t;
 
 #ifdef __KERNEL__
 #define SA_TIMER                0x40000000
-#define SA_IRQNOMASK            0x08000000
 #endif
 
 #include <asm-generic/signal.h>
diff --git a/include/asm-arm26/futex.h b/include/asm-arm26/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-arm26/futex.h
+++ b/include/asm-arm26/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-arm26/pgtable.h b/include/asm-arm26/pgtable.h
index 4a0a00da425f..f602cf572411 100644
--- a/include/asm-arm26/pgtable.h
+++ b/include/asm-arm26/pgtable.h
@@ -294,12 +294,9 @@ static inline pte_t mk_pte_phys(unsigned long physpage, pgprot_t pgprot)
 #include <asm-generic/pgtable.h>
 
 /*
- * remap a physical address `phys' of size `size' with page protection `prot'
+ * remap a physical page `pfn' of size `size' with page protection `prot'
  * into virtual address `from'
  */
-#define io_remap_page_range(vma,from,phys,size,prot) \
-                remap_pfn_range(vma, from, (phys) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma,from,pfn,size,prot) \
                 remap_pfn_range(vma, from, pfn, size, prot)
 
diff --git a/include/asm-cris/futex.h b/include/asm-cris/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-cris/futex.h
+++ b/include/asm-cris/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-frv/futex.h b/include/asm-frv/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-frv/futex.h
+++ b/include/asm-frv/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-frv/pgtable.h b/include/asm-frv/pgtable.h
index d0a9c2f9c13e..473fb4bb6329 100644
--- a/include/asm-frv/pgtable.h
+++ b/include/asm-frv/pgtable.h
@@ -500,9 +500,6 @@ static inline int pte_file(pte_t pte)
 #define PageSkip(page)          (0)
 #define kern_addr_valid(addr)   (1)
 
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index f86c1e549466..ff28c8b31f58 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -158,6 +158,19 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
 #define lazy_mmu_prot_update(pte)       do { } while (0)
 #endif
 
+#ifndef __HAVE_ARCH_MULTIPLE_ZERO_PAGE
+#define move_pte(pte, prot, old_addr, new_addr) (pte)
+#else
+#define move_pte(pte, prot, old_addr, new_addr)                         \
+({                                                                      \
+        pte_t newpte = (pte);                                           \
+        if (pte_present(pte) && pfn_valid(pte_pfn(pte)) &&              \
+                        pte_page(pte) == ZERO_PAGE(old_addr))           \
+                newpte = mk_pte(ZERO_PAGE(new_addr), (prot));           \
+        newpte;                                                         \
+})
+#endif
+
 /*
  * When walking page tables, get the address of the next boundary,
  * or the end address of the range if that comes earlier.  Although no
diff --git a/include/asm-h8300/futex.h b/include/asm-h8300/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-h8300/futex.h
+++ b/include/asm-h8300/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-h8300/pgtable.h b/include/asm-h8300/pgtable.h
index 69076eb31476..f6e296fc1297 100644
--- a/include/asm-h8300/pgtable.h
+++ b/include/asm-h8300/pgtable.h
@@ -52,8 +52,6 @@ extern int is_in_rom(unsigned long);
  * No page table caches to initialise
  */
 #define pgtable_cache_init()   do { } while (0)
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
 
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
diff --git a/include/asm-i386/futex.h b/include/asm-i386/futex.h
index 44b9db806474..e7a271d39309 100644
--- a/include/asm-i386/futex.h
+++ b/include/asm-i386/futex.h
@@ -61,7 +61,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         if (op == FUTEX_OP_SET)
                 __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
         else {
-#ifndef CONFIG_X86_BSWAP
+#if !defined(CONFIG_X86_BSWAP) && !defined(CONFIG_UML)
                 if (boot_cpu_data.x86 == 3)
                         ret = -ENOSYS;
                 else
diff --git a/include/asm-i386/hw_irq.h b/include/asm-i386/hw_irq.h
index 4ac84cc6f01a..622815bf3243 100644
--- a/include/asm-i386/hw_irq.h
+++ b/include/asm-i386/hw_irq.h
@@ -18,6 +18,8 @@
 #include <asm/irq.h>
 #include <asm/sections.h>
 
+struct hw_interrupt_type;
+
 /*
  * Various low-level irq details needed by irq.c, process.c,
  * time.c, io_apic.c and smp.c
diff --git a/include/asm-i386/pgtable.h b/include/asm-i386/pgtable.h
index 47bc1ffa3d4c..d101ac414f07 100644
--- a/include/asm-i386/pgtable.h
+++ b/include/asm-i386/pgtable.h
@@ -431,9 +431,6 @@ extern void noexec_setup(const char *str);
 #define kern_addr_valid(addr)   (1)
 #endif /* CONFIG_FLATMEM */
 
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-ia64/futex.h b/include/asm-ia64/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-ia64/futex.h
+++ b/include/asm-ia64/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-ia64/mca.h b/include/asm-ia64/mca.h
index 97a28b8b2ddd..c7d9c9ed38ba 100644
--- a/include/asm-ia64/mca.h
+++ b/include/asm-ia64/mca.h
@@ -80,7 +80,12 @@ struct ia64_sal_os_state {
         u64                     sal_ra;                 /* Return address in SAL, physical */
         u64                     sal_gp;                 /* GP of the SAL - physical */
         pal_min_state_area_t    *pal_min_state;         /* from R17.  physical in asm, virtual in C */
+        /* Previous values of IA64_KR(CURRENT) and IA64_KR(CURRENT_STACK).
+         * Note: if the MCA/INIT recovery code wants to resume to a new context
+         * then it must change these values to reflect the new kernel stack.
+         */
         u64                     prev_IA64_KR_CURRENT;   /* previous value of IA64_KR(CURRENT) */
+        u64                     prev_IA64_KR_CURRENT_STACK;
         struct task_struct      *prev_task;             /* previous task, NULL if it is not useful */
         /* Some interrupt registers are not saved in minstate, pt_regs or
          * switch_stack.  Because MCA/INIT can occur when interrupts are
diff --git a/include/asm-ia64/pgtable.h b/include/asm-ia64/pgtable.h
index 2e34c06e6777..3339c7b55a6f 100644
--- a/include/asm-ia64/pgtable.h
+++ b/include/asm-ia64/pgtable.h
@@ -443,10 +443,6 @@ extern void paging_init (void);
 #define pte_to_pgoff(pte)               ((pte_val(pte) << 1) >> 3)
 #define pgoff_to_pte(off)               ((pte_t) { ((off) << 2) | _PAGE_FILE })
 
-/* XXX is this right? */
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-ia64/ptrace.h b/include/asm-ia64/ptrace.h
index fc544929ac34..a79d1a7ecc77 100644
--- a/include/asm-ia64/ptrace.h
+++ b/include/asm-ia64/ptrace.h
@@ -57,7 +57,9 @@
 #include <linux/config.h>
 
 #include <asm/fpu.h>
+#ifndef ASM_OFFSETS_C
 #include <asm/asm-offsets.h>
+#endif
 
 /*
  * Base-2 logarithm of number of pages to allocate per task structure
diff --git a/include/asm-ia64/thread_info.h b/include/asm-ia64/thread_info.h
index cf4a950a0f4f..171b2207bde4 100644
--- a/include/asm-ia64/thread_info.h
+++ b/include/asm-ia64/thread_info.h
@@ -5,7 +5,9 @@
 #ifndef _ASM_IA64_THREAD_INFO_H
 #define _ASM_IA64_THREAD_INFO_H
 
+#ifndef ASM_OFFSETS_C
 #include <asm/asm-offsets.h>
+#endif
 #include <asm/processor.h>
 #include <asm/ptrace.h>
 
@@ -51,9 +53,14 @@ struct thread_info {
         },                                      \
 }
 
+#ifndef ASM_OFFSETS_C
 /* how to get the thread information struct from C */
 #define current_thread_info()   ((struct thread_info *) ((char *) current + IA64_TASK_SIZE))
 #define alloc_thread_info(tsk)  ((struct thread_info *) ((char *) (tsk) + IA64_TASK_SIZE))
+#else
+#define current_thread_info()   ((struct thread_info *) 0)
+#define alloc_thread_info(tsk)  ((struct thread_info *) 0)
+#endif
 #define free_thread_info(ti)    /* nothing */
 
 #define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
diff --git a/include/asm-ia64/uaccess.h b/include/asm-ia64/uaccess.h
index 3a7829bb5954..9adb51211c22 100644
--- a/include/asm-ia64/uaccess.h
+++ b/include/asm-ia64/uaccess.h
@@ -187,8 +187,8 @@ extern void __get_user_unknown (void);
 ({                                                                                      \
         const __typeof__(*(ptr)) __user *__gu_ptr = (ptr);                              \
         __typeof__ (size) __gu_size = (size);                                           \
-        long __gu_err = -EFAULT, __gu_val = 0;                                          \
-                                                                                        \
+        long __gu_err = -EFAULT;                                                        \
+        unsigned long __gu_val = 0;                                                     \
         if (!check || __access_ok(__gu_ptr, size, segment))                             \
                 switch (__gu_size) {                                                    \
                       case 1: __get_user_size(__gu_val, __gu_ptr, 1, __gu_err); break;  \
@@ -240,13 +240,13 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
 static inline unsigned long
 __copy_to_user (void __user *to, const void *from, unsigned long count)
 {
-        return __copy_user(to, (void __user *) from, count);
+        return __copy_user(to, (__force void __user *) from, count);
 }
 
 static inline unsigned long
 __copy_from_user (void *to, const void __user *from, unsigned long count)
 {
-        return __copy_user((void __user *) to, from, count);
+        return __copy_user((__force void __user *) to, from, count);
 }
 
 #define __copy_to_user_inatomic         __copy_to_user
@@ -258,7 +258,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
         long __cu_len = (n);                                                            \
                                                                                         \
         if (__access_ok(__cu_to, __cu_len, get_fs()))                                   \
-                __cu_len = __copy_user(__cu_to, (void __user *) __cu_from, __cu_len);   \
+                __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);   \
         __cu_len;                                                                       \
 })
 
@@ -270,7 +270,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
                                                                                         \
         __chk_user_ptr(__cu_from);                                                      \
         if (__access_ok(__cu_from, __cu_len, get_fs()))                                 \
-                __cu_len = __copy_user((void __user *) __cu_to, __cu_from, __cu_len);   \
+                __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);   \
         __cu_len;                                                                       \
 })
 
diff --git a/include/asm-m32r/futex.h b/include/asm-m32r/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-m32r/futex.h
+++ b/include/asm-m32r/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-m32r/io.h b/include/asm-m32r/io.h
index 8e9e481e6996..70ad1c949c2b 100644
--- a/include/asm-m32r/io.h
+++ b/include/asm-m32r/io.h
@@ -60,7 +60,7 @@ __ioremap(unsigned long offset, unsigned long size, unsigned long flags);
  *      address.
  */
 
-static inline void * ioremap(unsigned long offset, unsigned long size)
+static inline void __iomem *ioremap(unsigned long offset, unsigned long size)
 {
         return __ioremap(offset, size, 0);
 }
diff --git a/include/asm-m32r/pgtable.h b/include/asm-m32r/pgtable.h
index da805e970844..388e5ee9fa27 100644
--- a/include/asm-m32r/pgtable.h
+++ b/include/asm-m32r/pgtable.h
@@ -378,9 +378,6 @@ static inline void pmd_set(pmd_t * pmdp, pte_t * ptep)
 /* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
 #define kern_addr_valid(addr)   (1)
 
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)      \
-        remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot) \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-m32r/uaccess.h b/include/asm-m32r/uaccess.h
index 93d863c455a1..0da7c47d2f01 100644
--- a/include/asm-m32r/uaccess.h
+++ b/include/asm-m32r/uaccess.h
@@ -208,7 +208,8 @@ extern void __get_user_4(void);
  * On error, the variable @x is set to zero.
  */
 #define get_user(x,ptr)                                                 \
-({      int __ret_gu,__val_gu;                                          \
+({      int __ret_gu;                                                   \
+        unsigned long __val_gu;                                         \
         __chk_user_ptr(ptr);                                            \
         switch(sizeof (*(ptr))) {                                       \
         case 1:  __get_user_x(1,__ret_gu,__val_gu,ptr); break;          \
@@ -403,7 +404,8 @@ struct __large_struct { unsigned long buf[100]; };
 
 #define __get_user_nocheck(x,ptr,size)                                  \
 ({                                                                      \
-        long __gu_err, __gu_val;                                        \
+        long __gu_err;                                                  \
+        unsigned long __gu_val;                                         \
         __get_user_size(__gu_val,(ptr),(size),__gu_err);                \
         (x) = (__typeof__(*(ptr)))__gu_val;                             \
         __gu_err;                                                       \
@@ -594,8 +596,8 @@ static inline unsigned long __generic_copy_to_user_nocheck(void __user *to,
         return n;
 }
 
-unsigned long __generic_copy_to_user(void *, const void *, unsigned long);
-unsigned long __generic_copy_from_user(void *, const void *, unsigned long);
+unsigned long __generic_copy_to_user(void __user *, const void *, unsigned long);
+unsigned long __generic_copy_from_user(void *, const void __user *, unsigned long);
 
 /**
  * __copy_to_user: - Copy a block of data into user space, with less checking.
diff --git a/include/asm-m68k/futex.h b/include/asm-m68k/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-m68k/futex.h
+++ b/include/asm-m68k/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-m68k/pgtable.h b/include/asm-m68k/pgtable.h
index 0c87fc84f7a4..add129e93fd7 100644
--- a/include/asm-m68k/pgtable.h
+++ b/include/asm-m68k/pgtable.h
@@ -141,9 +141,6 @@ static inline void update_mmu_cache(struct vm_area_struct *vma,
 
 #define kern_addr_valid(addr)   (1)
 
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-m68knommu/futex.h b/include/asm-m68knommu/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-m68knommu/futex.h
+++ b/include/asm-m68knommu/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-m68knommu/pgtable.h b/include/asm-m68knommu/pgtable.h
index e2a69fffa370..00893055e6c2 100644
--- a/include/asm-m68knommu/pgtable.h
+++ b/include/asm-m68knommu/pgtable.h
@@ -56,8 +56,6 @@ extern int is_in_rom(unsigned long);
  * No page table caches to initialise.
  */
 #define pgtable_cache_init()    do { } while (0)
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
 
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
diff --git a/include/asm-mips/pgtable.h b/include/asm-mips/pgtable.h
index dbe13da0bdad..eaf5d9b3a0e1 100644
--- a/include/asm-mips/pgtable.h
+++ b/include/asm-mips/pgtable.h
@@ -68,6 +68,8 @@ extern unsigned long zero_page_mask;
 #define ZERO_PAGE(vaddr) \
         (virt_to_page(empty_zero_page + (((unsigned long)(vaddr)) & zero_page_mask)))
 
+#define __HAVE_ARCH_MULTIPLE_ZERO_PAGE
+
 extern void paging_init(void);
 
 /*
@@ -358,16 +360,6 @@ static inline void update_mmu_cache(struct vm_area_struct *vma,
 extern phys_t fixup_bigphys_addr(phys_t phys_addr, phys_t size);
 extern int remap_pfn_range(struct vm_area_struct *vma, unsigned long from, unsigned long pfn, unsigned long size, pgprot_t prot);
 
-static inline int io_remap_page_range(struct vm_area_struct *vma,
-                unsigned long vaddr,
-                unsigned long paddr,
-                unsigned long size,
-                pgprot_t prot)
-{
-        phys_t phys_addr_high = fixup_bigphys_addr(paddr, size);
-        return remap_pfn_range(vma, vaddr, phys_addr_high >> PAGE_SHIFT, size, prot);
-}
-
 static inline int io_remap_pfn_range(struct vm_area_struct *vma,
                 unsigned long vaddr,
                 unsigned long pfn,
@@ -378,8 +370,6 @@ static inline int io_remap_pfn_range(struct vm_area_struct *vma,
         return remap_pfn_range(vma, vaddr, pfn, size, prot);
 }
 #else
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 #endif
diff --git a/include/asm-parisc/futex.h b/include/asm-parisc/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-parisc/futex.h
+++ b/include/asm-parisc/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-parisc/pgtable.h b/include/asm-parisc/pgtable.h
index f001bb01e38f..820c6e712cd7 100644
--- a/include/asm-parisc/pgtable.h
+++ b/include/asm-parisc/pgtable.h
@@ -498,9 +498,6 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
 
 #endif /* !__ASSEMBLY__ */
 
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-ppc/futex.h b/include/asm-ppc/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-ppc/futex.h
+++ b/include/asm-ppc/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-ppc/io.h b/include/asm-ppc/io.h
index 7eb7cf6360bd..94d83998a759 100644
--- a/include/asm-ppc/io.h
+++ b/include/asm-ppc/io.h
@@ -56,7 +56,7 @@ extern unsigned long pci_dram_offset;
  * is actually performed (i.e. the data has come back) before we start
  * executing any following instructions.
  */
-extern inline int in_8(volatile unsigned char __iomem *addr)
+extern inline int in_8(const volatile unsigned char __iomem *addr)
 {
         int ret;
 
@@ -72,7 +72,7 @@ extern inline void out_8(volatile unsigned char __iomem *addr, int val)
         __asm__ __volatile__("stb%U0%X0 %1,%0; eieio" : "=m" (*addr) : "r" (val));
 }
 
-extern inline int in_le16(volatile unsigned short __iomem *addr)
+extern inline int in_le16(const volatile unsigned short __iomem *addr)
 {
         int ret;
 
@@ -83,7 +83,7 @@ extern inline int in_le16(volatile unsigned short __iomem *addr)
         return ret;
 }
 
-extern inline int in_be16(volatile unsigned short __iomem *addr)
+extern inline int in_be16(const volatile unsigned short __iomem *addr)
 {
         int ret;
 
@@ -104,7 +104,7 @@ extern inline void out_be16(volatile unsigned short __iomem *addr, int val)
         __asm__ __volatile__("sth%U0%X0 %1,%0; eieio" : "=m" (*addr) : "r" (val));
 }
 
-extern inline unsigned in_le32(volatile unsigned __iomem *addr)
+extern inline unsigned in_le32(const volatile unsigned __iomem *addr)
 {
         unsigned ret;
 
@@ -115,7 +115,7 @@ extern inline unsigned in_le32(volatile unsigned __iomem *addr)
         return ret;
 }
 
-extern inline unsigned in_be32(volatile unsigned __iomem *addr)
+extern inline unsigned in_be32(const volatile unsigned __iomem *addr)
 {
         unsigned ret;
 
@@ -139,7 +139,7 @@ extern inline void out_be32(volatile unsigned __iomem *addr, int val)
 #define readb(addr) in_8((volatile u8 *)(addr))
 #define writeb(b,addr) out_8((volatile u8 *)(addr), (b))
 #else
-static inline __u8 readb(volatile void __iomem *addr)
+static inline __u8 readb(const volatile void __iomem *addr)
 {
         return in_8(addr);
 }
@@ -150,11 +150,11 @@ static inline void writeb(__u8 b, volatile void __iomem *addr)
 #endif
 
 #if defined(CONFIG_APUS)
-static inline __u16 readw(volatile void __iomem *addr)
+static inline __u16 readw(const volatile void __iomem *addr)
 {
         return *(__force volatile __u16 *)(addr);
 }
-static inline __u32 readl(volatile void __iomem *addr)
+static inline __u32 readl(const volatile void __iomem *addr)
 {
         return *(__force volatile __u32 *)(addr);
 }
@@ -173,11 +173,11 @@ static inline void writel(__u32 b, volatile void __iomem *addr)
 #define writew(b,addr) out_le16((volatile u16 *)(addr),(b))
 #define writel(b,addr) out_le32((volatile u32 *)(addr),(b))
 #else
-static inline __u16 readw(volatile void __iomem *addr)
+static inline __u16 readw(const volatile void __iomem *addr)
 {
         return in_le16(addr);
 }
-static inline __u32 readl(volatile void __iomem *addr)
+static inline __u32 readl(const volatile void __iomem *addr)
 {
         return in_le32(addr);
 }
diff --git a/include/asm-ppc/irq.h b/include/asm-ppc/irq.h
index 55752474d0d9..bd9674807f05 100644
--- a/include/asm-ppc/irq.h
+++ b/include/asm-ppc/irq.h
@@ -138,6 +138,16 @@ irq_canonicalize(int irq)
 #define SIU_IRQ7        (14)
 #define SIU_LEVEL7      (15)
 
+#define MPC8xx_INT_FEC1         SIU_LEVEL1
+#define MPC8xx_INT_FEC2         SIU_LEVEL3
+
+#define MPC8xx_INT_SCC1         (CPM_IRQ_OFFSET + CPMVEC_SCC1)
+#define MPC8xx_INT_SCC2         (CPM_IRQ_OFFSET + CPMVEC_SCC2)
+#define MPC8xx_INT_SCC3         (CPM_IRQ_OFFSET + CPMVEC_SCC3)
+#define MPC8xx_INT_SCC4         (CPM_IRQ_OFFSET + CPMVEC_SCC4)
+#define MPC8xx_INT_SMC1         (CPM_IRQ_OFFSET + CPMVEC_SMC1)
+#define MPC8xx_INT_SMC2         (CPM_IRQ_OFFSET + CPMVEC_SMC2)
+
 /* The internal interrupts we can configure as we see fit.
  * My personal preference is CPM at level 2, which puts it above the
  * MBX PCI/ISA/IDE interrupts.
diff --git a/include/asm-ppc/macio.h b/include/asm-ppc/macio.h
index a481b772d154..b553dd4b139e 100644
--- a/include/asm-ppc/macio.h
+++ b/include/asm-ppc/macio.h
@@ -1,7 +1,6 @@
 #ifndef __MACIO_ASIC_H__
 #define __MACIO_ASIC_H__
 
-#include <linux/mod_devicetable.h>
 #include <asm/of_device.h>
 
 extern struct bus_type macio_bus_type;
diff --git a/include/asm-ppc/mpc8xx.h b/include/asm-ppc/mpc8xx.h
index dc8e59896050..208a2e11daee 100644
--- a/include/asm-ppc/mpc8xx.h
+++ b/include/asm-ppc/mpc8xx.h
@@ -97,6 +97,22 @@ extern unsigned char __res[];
 
 struct pt_regs;
 
+enum ppc_sys_devices {
+        MPC8xx_CPM_FEC1,
+        MPC8xx_CPM_FEC2,
+        MPC8xx_CPM_I2C,
+        MPC8xx_CPM_SCC1,
+        MPC8xx_CPM_SCC2,
+        MPC8xx_CPM_SCC3,
+        MPC8xx_CPM_SCC4,
+        MPC8xx_CPM_SPI,
+        MPC8xx_CPM_MCC1,
+        MPC8xx_CPM_MCC2,
+        MPC8xx_CPM_SMC1,
+        MPC8xx_CPM_SMC2,
+        MPC8xx_CPM_USB,
+};
+
 #endif /* !__ASSEMBLY__ */
 #endif /* CONFIG_8xx */
 #endif /* __CONFIG_8xx_DEFS */
diff --git a/include/asm-ppc/mv64x60.h b/include/asm-ppc/mv64x60.h
index 835930d6faa1..ee2f9188cc64 100644
--- a/include/asm-ppc/mv64x60.h
+++ b/include/asm-ppc/mv64x60.h
@@ -119,6 +119,14 @@ extern spinlock_t mv64x60_lock;
 
 #define MV64x60_64BIT_WIN_COUNT                 24
 
+/* Watchdog Platform Device, Driver Data */
+#define MV64x60_WDT_NAME                        "wdt"
+
+struct mv64x60_wdt_pdata {
+        int     timeout;        /* watchdog expiry in seconds, default 10 */
+        int     bus_clk;        /* bus clock in MHz, default 133 */
+};
+
 /*
  * Define a structure that's used to pass in config information to the
  * core routines.
@@ -225,7 +233,7 @@ struct mv64x60_chip_info {
 struct mv64x60_handle {
         u32             type;           /* type of bridge */
         u32             rev;            /* revision of bridge */
-        void            *v_base;        /* virtual base addr of bridge regs */
+        void            __iomem *v_base;/* virtual base addr of bridge regs */
         phys_addr_t     p_base;         /* physical base addr of bridge regs */
 
         u32             pci_mode_a;     /* pci 0 mode: conventional pci, pci-x*/
@@ -295,7 +303,7 @@ void mv64x60_alloc_hose(struct mv64x60_handle *bh, u32 cfg_addr,
         u32 cfg_data, struct pci_controller **hose);
 int mv64x60_get_type(struct mv64x60_handle *bh);
 int mv64x60_setup_for_chip(struct mv64x60_handle *bh);
-void *mv64x60_get_bridge_vbase(void);
+void __iomem *mv64x60_get_bridge_vbase(void);
 u32 mv64x60_get_bridge_type(void);
 u32 mv64x60_get_bridge_rev(void);
 void mv64x60_get_mem_windows(struct mv64x60_handle *bh,
diff --git a/include/asm-ppc/of_device.h b/include/asm-ppc/of_device.h
index 4b264cfd3998..575bce418f80 100644
--- a/include/asm-ppc/of_device.h
+++ b/include/asm-ppc/of_device.h
@@ -2,6 +2,7 @@
 #define __OF_DEVICE_H__
 
 #include <linux/device.h>
+#include <linux/mod_devicetable.h>
 #include <asm/prom.h>
 
 /*
@@ -55,7 +56,9 @@ extern int of_register_driver(struct of_platform_driver *drv);
 extern void of_unregister_driver(struct of_platform_driver *drv);
 extern int of_device_register(struct of_device *ofdev);
 extern void of_device_unregister(struct of_device *ofdev);
-extern struct of_device *of_platform_device_create(struct device_node *np, const char *bus_id);
+extern struct of_device *of_platform_device_create(struct device_node *np,
+                                                   const char *bus_id,
+                                                   struct device *parent);
 extern void of_release_dev(struct device *dev);
 
 #endif /* __OF_DEVICE_H__ */
diff --git a/include/asm-ppc/pgtable.h b/include/asm-ppc/pgtable.h
index 92f30b28b252..eee601bb9ada 100644
--- a/include/asm-ppc/pgtable.h
+++ b/include/asm-ppc/pgtable.h
@@ -812,15 +812,6 @@ extern void kernel_set_cachemode (unsigned long address, unsigned long size,
 #ifdef CONFIG_PHYS_64BIT
 extern int remap_pfn_range(struct vm_area_struct *vma, unsigned long from,
                         unsigned long paddr, unsigned long size, pgprot_t prot);
-static inline int io_remap_page_range(struct vm_area_struct *vma,
-                                        unsigned long vaddr,
-                                        unsigned long paddr,
-                                        unsigned long size,
-                                        pgprot_t prot)
-{
-        phys_addr_t paddr64 = fixup_bigphys_addr(paddr, size);
-        return remap_pfn_range(vma, vaddr, paddr64 >> PAGE_SHIFT, size, prot);
-}
 
 static inline int io_remap_pfn_range(struct vm_area_struct *vma,
                                         unsigned long vaddr,
@@ -832,8 +823,6 @@ static inline int io_remap_pfn_range(struct vm_area_struct *vma,
         return remap_pfn_range(vma, vaddr, paddr64 >> PAGE_SHIFT, size, prot);
 }
 #else
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 #endif
diff --git a/include/asm-ppc/ppc_sys.h b/include/asm-ppc/ppc_sys.h
index 048f7c8596ee..549f44843c5e 100644
--- a/include/asm-ppc/ppc_sys.h
+++ b/include/asm-ppc/ppc_sys.h
@@ -27,6 +27,8 @@
 #include <asm/mpc83xx.h>
 #elif defined(CONFIG_85xx)
 #include <asm/mpc85xx.h>
+#elif defined(CONFIG_8xx)
+#include <asm/mpc8xx.h>
 #elif defined(CONFIG_PPC_MPC52xx)
 #include <asm/mpc52xx.h>
 #elif defined(CONFIG_MPC10X_BRIDGE)
diff --git a/include/asm-ppc/segment.h b/include/asm-ppc/segment.h
deleted file mode 100644
index 0f2f7428d437..000000000000
--- a/include/asm-ppc/segment.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm/uaccess.h>
diff --git a/include/asm-ppc/tlbflush.h b/include/asm-ppc/tlbflush.h
index 9850f53f54b0..9afee4ffc835 100644
--- a/include/asm-ppc/tlbflush.h
+++ b/include/asm-ppc/tlbflush.h
@@ -72,7 +72,7 @@ static inline void flush_tlb_page(struct vm_area_struct *vma,
 static inline void flush_tlb_page_nohash(struct vm_area_struct *vma,
                                          unsigned long vmaddr)
         { _tlbie(vmaddr); }
-static inline void flush_tlb_range(struct mm_struct *mm,
+static inline void flush_tlb_range(struct vm_area_struct *vma,
                                 unsigned long start, unsigned long end)
         { __tlbia(); }
 static inline void flush_tlb_kernel_range(unsigned long start,
diff --git a/include/asm-ppc64/smu.h b/include/asm-ppc64/smu.h
index 10b4397af9aa..dee8eefe47bc 100644
--- a/include/asm-ppc64/smu.h
+++ b/include/asm-ppc64/smu.h
@@ -1,22 +1,379 @@
+#ifndef _SMU_H
+#define _SMU_H
+
 /*
  * Definitions for talking to the SMU chip in newer G5 PowerMacs
  */
 
 #include <linux/config.h>
+#include <linux/list.h>
+
+/*
+ * Known SMU commands
+ *
+ * Most of what is below comes from looking at the Open Firmware driver,
+ * though this is still incomplete and could use better documentation here
+ * or there...
+ */
+
+
+/*
+ * Partition info commands
+ *
+ * I do not know what those are for at this point
+ */
+#define SMU_CMD_PARTITION_COMMAND               0x3e
+
+
+/*
+ * Fan control
+ *
+ * This is a "mux" for fan control commands, first byte is the
+ * "sub" command.
+ */
+#define SMU_CMD_FAN_COMMAND                     0x4a
+
+
+/*
+ * Battery access
+ *
+ * Same command number as the PMU, could it be same syntax ?
+ */
+#define SMU_CMD_BATTERY_COMMAND                 0x6f
+#define   SMU_CMD_GET_BATTERY_INFO              0x00
+
+/*
+ * Real time clock control
+ *
+ * This is a "mux", first data byte contains the "sub" command.
+ * The "RTC" part of the SMU controls the date, time, powerup
+ * timer, but also a PRAM
+ *
+ * Dates are in BCD format on 7 bytes:
+ * [sec] [min] [hour] [weekday] [month day] [month] [year]
+ * with month being 1 based and year minus 100
+ */
+#define SMU_CMD_RTC_COMMAND                     0x8e
+#define   SMU_CMD_RTC_SET_PWRUP_TIMER           0x00 /* i: 7 bytes date */
+#define   SMU_CMD_RTC_GET_PWRUP_TIMER           0x01 /* o: 7 bytes date */
+#define   SMU_CMD_RTC_STOP_PWRUP_TIMER          0x02
+#define   SMU_CMD_RTC_SET_PRAM_BYTE_ACC         0x20 /* i: 1 byte (address?) */
+#define   SMU_CMD_RTC_SET_PRAM_AUTOINC          0x21 /* i: 1 byte (data?) */
+#define   SMU_CMD_RTC_SET_PRAM_LO_BYTES         0x22 /* i: 10 bytes */
+#define   SMU_CMD_RTC_SET_PRAM_HI_BYTES         0x23 /* i: 10 bytes */
+#define   SMU_CMD_RTC_GET_PRAM_BYTE             0x28 /* i: 1 bytes (address?) */
+#define   SMU_CMD_RTC_GET_PRAM_LO_BYTES         0x29 /* o: 10 bytes */
+#define   SMU_CMD_RTC_GET_PRAM_HI_BYTES         0x2a /* o: 10 bytes */
+#define   SMU_CMD_RTC_SET_DATETIME              0x80 /* i: 7 bytes date */
+#define   SMU_CMD_RTC_GET_DATETIME              0x81 /* o: 7 bytes date */
+
+ /*
+  * i2c commands
+  *
+  * To issue an i2c command, first is to send a parameter block to the
+  * the SMU. This is a command of type 0x9a with 9 bytes of header
+  * eventually followed by data for a write:
+  *
+  * 0: bus number (from device-tree usually, SMU has lots of busses !)
+  * 1: transfer type/format (see below)
+  * 2: device address. For combined and combined4 type transfers, this
+  *    is the "write" version of the address (bit 0x01 cleared)
+  * 3: subaddress length (0..3)
+  * 4: subaddress byte 0 (or only byte for subaddress length 1)
+  * 5: subaddress byte 1
+  * 6: subaddress byte 2
+  * 7: combined address (device address for combined mode data phase)
+  * 8: data length
+  *
+  * The transfer types are the same good old Apple ones it seems,
+  * that is:
+  *   - 0x00: Simple transfer
+  *   - 0x01: Subaddress transfer (addr write + data tx, no restart)
+  *   - 0x02: Combined transfer (addr write + restart + data tx)
+  *
+  * This is then followed by actual data for a write.
+  *
+  * At this point, the OF driver seems to have a limitation on transfer
+  * sizes of 0xd bytes on reads and 0x5 bytes on writes. I do not know
+  * wether this is just an OF limit due to some temporary buffer size
+  * or if this is an SMU imposed limit. This driver has the same limitation
+  * for now as I use a 0x10 bytes temporary buffer as well
+  *
+  * Once that is completed, a response is expected from the SMU. This is
+  * obtained via a command of type 0x9a with a length of 1 byte containing
+  * 0 as the data byte. OF also fills the rest of the data buffer with 0xff's
+  * though I can't tell yet if this is actually necessary. Once this command
+  * is complete, at this point, all I can tell is what OF does. OF tests
+  * byte 0 of the reply:
+  *   - on read, 0xfe or 0xfc : bus is busy, wait (see below) or nak ?
+  *   - on read, 0x00 or 0x01 : reply is in buffer (after the byte 0)
+  *   - on write, < 0 -> failure (immediate exit)
+  *   - else, OF just exists (without error, weird)
+  *
+  * So on read, there is this wait-for-busy thing when getting a 0xfc or
+  * 0xfe result. OF does a loop of up to 64 retries, waiting 20ms and
+  * doing the above again until either the retries expire or the result
+  * is no longer 0xfe or 0xfc
+  *
+  * The Darwin I2C driver is less subtle though. On any non-success status
+  * from the response command, it waits 5ms and tries again up to 20 times,
+  * it doesn't differenciate between fatal errors or "busy" status.
+  *
+  * This driver provides an asynchronous paramblock based i2c command
+  * interface to be used either directly by low level code or by a higher
+  * level driver interfacing to the linux i2c layer. The current
+  * implementation of this relies on working timers & timer interrupts
+  * though, so be careful of calling context for now. This may be "fixed"
+  * in the future by adding a polling facility.
+  */
+#define SMU_CMD_I2C_COMMAND                     0x9a
+          /* transfer types */
+#define   SMU_I2C_TRANSFER_SIMPLE       0x00
+#define   SMU_I2C_TRANSFER_STDSUB       0x01
+#define   SMU_I2C_TRANSFER_COMBINED     0x02
+
+/*
+ * Power supply control
+ *
+ * The "sub" command is an ASCII string in the data, the
+ * data lenght is that of the string.
+ *
+ * The VSLEW command can be used to get or set the voltage slewing.
+ *  - lenght 5 (only "VSLEW") : it returns "DONE" and 3 bytes of
+ *    reply at data offset 6, 7 and 8.
+ *  - lenght 8 ("VSLEWxyz") has 3 additional bytes appended, and is
+ *    used to set the voltage slewing point. The SMU replies with "DONE"
+ * I yet have to figure out their exact meaning of those 3 bytes in
+ * both cases.
+ *
+ */
+#define SMU_CMD_POWER_COMMAND                   0xaa
+#define   SMU_CMD_POWER_RESTART                 "RESTART"
+#define   SMU_CMD_POWER_SHUTDOWN                "SHUTDOWN"
+#define   SMU_CMD_POWER_VOLTAGE_SLEW            "VSLEW"
+
+/* Misc commands
+ *
+ * This command seem to be a grab bag of various things
+ */
+#define SMU_CMD_MISC_df_COMMAND                 0xdf
+#define   SMU_CMD_MISC_df_SET_DISPLAY_LIT       0x02 /* i: 1 byte */
+#define   SMU_CMD_MISC_df_NMI_OPTION            0x04
+
+/*
+ * Version info commands
+ *
+ * I haven't quite tried to figure out how these work
+ */
+#define SMU_CMD_VERSION_COMMAND                 0xea
+
+
+/*
+ * Misc commands
+ *
+ * This command seem to be a grab bag of various things
+ */
+#define SMU_CMD_MISC_ee_COMMAND                 0xee
+#define   SMU_CMD_MISC_ee_GET_DATABLOCK_REC     0x02
+#define   SMU_CMD_MISC_ee_LEDS_CTRL             0x04 /* i: 00 (00,01) [00] */
+#define   SMU_CMD_MISC_ee_GET_DATA              0x05 /* i: 00 , o: ?? */
+
+
+
+/*
+ * - Kernel side interface -
+ */
+
+#ifdef __KERNEL__
+
+/*
+ * Asynchronous SMU commands
+ *
+ * Fill up this structure and submit it via smu_queue_command(),
+ * and get notified by the optional done() callback, or because
+ * status becomes != 1
+ */
+
+struct smu_cmd;
+
+struct smu_cmd
+{
+        /* public */
+        u8                      cmd;            /* command */
+        int                     data_len;       /* data len */
+        int                     reply_len;      /* reply len */
+        void                    *data_buf;      /* data buffer */
+        void                    *reply_buf;     /* reply buffer */
+        int                     status;         /* command status */
+        void                    (*done)(struct smu_cmd *cmd, void *misc);
+        void                    *misc;
+
+        /* private */
+        struct list_head        link;
+};
+
+/*
+ * Queues an SMU command, all fields have to be initialized
+ */
+extern int smu_queue_cmd(struct smu_cmd *cmd);
+
+/*
+ * Simple command wrapper. This structure embeds a small buffer
+ * to ease sending simple SMU commands from the stack
+ */
+struct smu_simple_cmd
+{
+        struct smu_cmd  cmd;
+        u8              buffer[16];
+};
+
+/*
+ * Queues a simple command. All fields will be initialized by that
+ * function
+ */
+extern int smu_queue_simple(struct smu_simple_cmd *scmd, u8 command,
+                            unsigned int data_len,
+                            void (*done)(struct smu_cmd *cmd, void *misc),
+                            void *misc,
+                            ...);
+
+/*
+ * Completion helper. Pass it to smu_queue_simple or as 'done'
+ * member to smu_queue_cmd, it will call complete() on the struct
+ * completion passed in the "misc" argument
+ */
+extern void smu_done_complete(struct smu_cmd *cmd, void *misc);
 
 /*
- * Basic routines for use by architecture. To be extended as
- * we understand more of the chip
+ * Synchronous helpers. Will spin-wait for completion of a command
+ */
+extern void smu_spinwait_cmd(struct smu_cmd *cmd);
+
+static inline void smu_spinwait_simple(struct smu_simple_cmd *scmd)
+{
+        smu_spinwait_cmd(&scmd->cmd);
+}
+
+/*
+ * Poll routine to call if blocked with irqs off
+ */
+extern void smu_poll(void);
+
+
+/*
+ * Init routine, presence check....
  */
 extern int smu_init(void);
 extern int smu_present(void);
+struct of_device;
+extern struct of_device *smu_get_ofdev(void);
+
+
+/*
+ * Common command wrappers
+ */
 extern void smu_shutdown(void);
 extern void smu_restart(void);
-extern int smu_get_rtc_time(struct rtc_time *time);
-extern int smu_set_rtc_time(struct rtc_time *time);
+struct rtc_time;
+extern int smu_get_rtc_time(struct rtc_time *time, int spinwait);
+extern int smu_set_rtc_time(struct rtc_time *time, int spinwait);
 
 /*
  * SMU command buffer absolute address, exported by pmac_setup,
  * this is allocated very early during boot.
  */
 extern unsigned long smu_cmdbuf_abs;
+
+
+/*
+ * Kenrel asynchronous i2c interface
+ */
+
+/* SMU i2c header, exactly matches i2c header on wire */
+struct smu_i2c_param
+{
+        u8      bus;            /* SMU bus ID (from device tree) */
+        u8      type;           /* i2c transfer type */
+        u8      devaddr;        /* device address (includes direction) */
+        u8      sublen;         /* subaddress length */
+        u8      subaddr[3];     /* subaddress */
+        u8      caddr;          /* combined address, filled by SMU driver */
+        u8      datalen;        /* length of transfer */
+        u8      data[7];        /* data */
+};
+
+#define SMU_I2C_READ_MAX        0x0d
+#define SMU_I2C_WRITE_MAX       0x05
+
+struct smu_i2c_cmd
+{
+        /* public */
+        struct smu_i2c_param    info;
+        void                    (*done)(struct smu_i2c_cmd *cmd, void *misc);
+        void                    *misc;
+        int                     status; /* 1 = pending, 0 = ok, <0 = fail */
+
+        /* private */
+        struct smu_cmd          scmd;
+        int                     read;
+        int                     stage;
+        int                     retries;
+        u8                      pdata[0x10];
+        struct list_head        link;
+};
+
+/*
+ * Call this to queue an i2c command to the SMU. You must fill info,
+ * including info.data for a write, done and misc.
+ * For now, no polling interface is provided so you have to use completion
+ * callback.
+ */
+extern int smu_queue_i2c(struct smu_i2c_cmd *cmd);
+
+
+#endif /* __KERNEL__ */
+
+/*
+ * - Userland interface -
+ */
+
+/*
+ * A given instance of the device can be configured for 2 different
+ * things at the moment:
+ *
+ *  - sending SMU commands (default at open() time)
+ *  - receiving SMU events (not yet implemented)
+ *
+ * Commands are written with write() of a command block. They can be
+ * "driver" commands (for example to switch to event reception mode)
+ * or real SMU commands. They are made of a header followed by command
+ * data if any.
+ *
+ * For SMU commands (not for driver commands), you can then read() back
+ * a reply. The reader will be blocked or not depending on how the device
+ * file is opened. poll() isn't implemented yet. The reply will consist
+ * of a header as well, followed by the reply data if any. You should
+ * always provide a buffer large enough for the maximum reply data, I
+ * recommand one page.
+ *
+ * It is illegal to send SMU commands through a file descriptor configured
+ * for events reception
+ *
+ */
+struct smu_user_cmd_hdr
+{
+        __u32           cmdtype;
+#define SMU_CMDTYPE_SMU                 0       /* SMU command */
+#define SMU_CMDTYPE_WANTS_EVENTS        1       /* switch fd to events mode */
+
+        __u8            cmd;                    /* SMU command byte */
+        __u32           data_len;               /* Lenght of data following */
+};
+
+struct smu_user_reply_hdr
+{
+        __u32           status;                 /* Command status */
+        __u32           reply_len;              /* Lenght of data follwing */
+};
+
+#endif /*  _SMU_H */
diff --git a/include/asm-ppc64/tlbflush.h b/include/asm-ppc64/tlbflush.h
index 45411a67e082..74271d7c1d16 100644
--- a/include/asm-ppc64/tlbflush.h
+++ b/include/asm-ppc64/tlbflush.h
@@ -25,6 +25,7 @@ struct ppc64_tlb_batch {
         pte_t pte[PPC64_TLB_BATCH_NR];
         unsigned long addr[PPC64_TLB_BATCH_NR];
         unsigned long vaddr[PPC64_TLB_BATCH_NR];
+        unsigned int large;
 };
 DECLARE_PER_CPU(struct ppc64_tlb_batch, ppc64_tlb_batch);
 
diff --git a/include/asm-ppc64/uaccess.h b/include/asm-ppc64/uaccess.h
index c181a60d868c..132c1276547b 100644
--- a/include/asm-ppc64/uaccess.h
+++ b/include/asm-ppc64/uaccess.h
@@ -164,7 +164,8 @@ do {									\
 
 #define __get_user_nocheck(x,ptr,size)                          \
 ({                                                              \
-        long __gu_err, __gu_val;                                \
+        long __gu_err;                                          \
+        unsigned long __gu_val;                                 \
         might_sleep();                                          \
         __get_user_size(__gu_val,(ptr),(size),__gu_err,-EFAULT);\
         (x) = (__typeof__(*(ptr)))__gu_val;                     \
@@ -173,7 +174,8 @@ do {									\
 
 #define __get_user_check(x,ptr,size)                                    \
 ({                                                                      \
-        long __gu_err = -EFAULT, __gu_val = 0;                          \
+        long __gu_err = -EFAULT;                                        \
+        unsigned long __gu_val = 0;                                     \
         const __typeof__(*(ptr)) __user *__gu_addr = (ptr);             \
         might_sleep();                                                  \
         if (access_ok(VERIFY_READ,__gu_addr,size))                      \
diff --git a/include/asm-s390/futex.h b/include/asm-s390/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-s390/futex.h
+++ b/include/asm-s390/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-s390/sigcontext.h b/include/asm-s390/sigcontext.h
index d57bc0cebdce..803545351dd8 100644
--- a/include/asm-s390/sigcontext.h
+++ b/include/asm-s390/sigcontext.h
@@ -61,7 +61,7 @@ typedef struct
 struct sigcontext
 {
         unsigned long   oldmask[_SIGCONTEXT_NSIG_WORDS];
-        _sigregs        *sregs;
+        _sigregs        __user *sregs;
 };
 
 
diff --git a/include/asm-s390/signal.h b/include/asm-s390/signal.h
index 3d6e11c6c1fd..7084626de215 100644
--- a/include/asm-s390/signal.h
+++ b/include/asm-s390/signal.h
@@ -165,7 +165,7 @@ struct sigaction {
 #endif /* __KERNEL__ */
 
 typedef struct sigaltstack {
-        void *ss_sp;
+        void __user *ss_sp;
         int ss_flags;
         size_t ss_size;
 } stack_t;
diff --git a/include/asm-sh/futex.h b/include/asm-sh/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-sh/futex.h
+++ b/include/asm-sh/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-sh/pgtable.h b/include/asm-sh/pgtable.h
index ecb909572d3f..0f4bcaae61bd 100644
--- a/include/asm-sh/pgtable.h
+++ b/include/asm-sh/pgtable.h
@@ -277,9 +277,6 @@ typedef pte_t *pte_addr_t;
 
 #define kern_addr_valid(addr)   (1)
 
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-sh64/futex.h b/include/asm-sh64/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-sh64/futex.h
+++ b/include/asm-sh64/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-sh64/pgtable.h b/include/asm-sh64/pgtable.h
index 78ac6be2d9ef..51db4307bfaf 100644
--- a/include/asm-sh64/pgtable.h
+++ b/include/asm-sh64/pgtable.h
@@ -482,9 +482,6 @@ extern void update_mmu_cache(struct vm_area_struct * vma,
 #define PageSkip(page)          (0)
 #define kern_addr_valid(addr)   (1)
 
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-sparc/futex.h b/include/asm-sparc/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-sparc/futex.h
+++ b/include/asm-sparc/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-sparc/pgtable.h b/include/asm-sparc/pgtable.h
index 8f4f6a959651..8395ad2f1c09 100644
--- a/include/asm-sparc/pgtable.h
+++ b/include/asm-sparc/pgtable.h
@@ -82,6 +82,8 @@ extern unsigned long page_kernel;
 /* Top-level page directory */
 extern pgd_t swapper_pg_dir[1024];
 
+extern void paging_init(void);
+
 /* Page table for 0-4MB for everybody, on the Sparc this
  * holds the same as on the i386.
  */
diff --git a/include/asm-sparc64/cacheflush.h b/include/asm-sparc64/cacheflush.h
index 51b26e81d828..b3f61659ba81 100644
--- a/include/asm-sparc64/cacheflush.h
+++ b/include/asm-sparc64/cacheflush.h
@@ -4,13 +4,6 @@
 #include <linux/config.h>
 #include <asm/page.h>
 
-/* Flushing for D-cache alias handling is only needed if
- * the page size is smaller than 16K.
- */
-#if PAGE_SHIFT < 14
-#define DCACHE_ALIASING_POSSIBLE
-#endif
-
 #ifndef __ASSEMBLY__
 
 #include <linux/mm.h>
@@ -73,6 +66,11 @@ extern void flush_ptrace_access(struct vm_area_struct *, struct page *,
 #define flush_cache_vmap(start, end)            do { } while (0)
 #define flush_cache_vunmap(start, end)          do { } while (0)
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+/* internal debugging function */
+void kernel_map_pages(struct page *page, int numpages, int enable);
+#endif
+
 #endif /* !__ASSEMBLY__ */
 
 #endif /* _SPARC64_CACHEFLUSH_H */
diff --git a/include/asm-sparc64/cpudata.h b/include/asm-sparc64/cpudata.h
index 9a3a81f1cc58..74de79dca915 100644
--- a/include/asm-sparc64/cpudata.h
+++ b/include/asm-sparc64/cpudata.h
@@ -22,6 +22,16 @@ typedef struct {
         unsigned int    __pad1;
         unsigned long   *pte_cache[2];
         unsigned long   *pgd_cache;
+
+        /* Dcache line 3, rarely used */
+        unsigned int    dcache_size;
+        unsigned int    dcache_line_size;
+        unsigned int    icache_size;
+        unsigned int    icache_line_size;
+        unsigned int    ecache_size;
+        unsigned int    ecache_line_size;
+        unsigned int    __pad2;
+        unsigned int    __pad3;
 } cpuinfo_sparc;
 
 DECLARE_PER_CPU(cpuinfo_sparc, __cpu_data);
diff --git a/include/asm-sparc64/futex.h b/include/asm-sparc64/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-sparc64/futex.h
+++ b/include/asm-sparc64/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-sparc64/head.h b/include/asm-sparc64/head.h
index b63a33cf4971..0abd3a674e8f 100644
--- a/include/asm-sparc64/head.h
+++ b/include/asm-sparc64/head.h
@@ -12,9 +12,12 @@
 #define __JALAPENO_ID   0x003e0016
 
 #define CHEETAH_MANUF           0x003e
-#define CHEETAH_IMPL            0x0014
-#define CHEETAH_PLUS_IMPL       0x0015
-#define JALAPENO_IMPL           0x0016
+#define CHEETAH_IMPL            0x0014 /* Ultra-III   */
+#define CHEETAH_PLUS_IMPL       0x0015 /* Ultra-III+  */
+#define JALAPENO_IMPL           0x0016 /* Ultra-IIIi  */
+#define JAGUAR_IMPL             0x0018 /* Ultra-IV    */
+#define PANTHER_IMPL            0x0019 /* Ultra-IV+   */
+#define SERRANO_IMPL            0x0022 /* Ultra-IIIi+ */
 
 #define BRANCH_IF_CHEETAH_BASE(tmp1,tmp2,label) \
         rdpr    %ver, %tmp1;                    \
diff --git a/include/asm-sparc64/ide.h b/include/asm-sparc64/ide.h
index 4c1098474c73..c393f815b0be 100644
--- a/include/asm-sparc64/ide.h
+++ b/include/asm-sparc64/ide.h
@@ -15,6 +15,7 @@
 #include <asm/io.h>
 #include <asm/spitfire.h>
 #include <asm/cacheflush.h>
+#include <asm/page.h>
 
 #ifndef MAX_HWIFS
 # ifdef CONFIG_BLK_DEV_IDEPCI
diff --git a/include/asm-sparc64/openprom.h b/include/asm-sparc64/openprom.h
index 0a336901d585..b4959d2b0d99 100644
--- a/include/asm-sparc64/openprom.h
+++ b/include/asm-sparc64/openprom.h
@@ -186,8 +186,8 @@ struct linux_prom_registers {
 };
 
 struct linux_prom64_registers {
-        long phys_addr;
-        long reg_size;
+        unsigned long phys_addr;
+        unsigned long reg_size;
 };
 
 struct linux_prom_irqs {
diff --git a/include/asm-sparc64/oplib.h b/include/asm-sparc64/oplib.h
index a432d9e7daaa..d02f1e8ae1a6 100644
--- a/include/asm-sparc64/oplib.h
+++ b/include/asm-sparc64/oplib.h
@@ -38,6 +38,20 @@ extern int prom_stdin, prom_stdout;
  */
 extern int prom_chosen_node;
 
+/* Helper values and strings in arch/sparc64/kernel/head.S */
+extern const char prom_finddev_name[];
+extern const char prom_chosen_path[];
+extern const char prom_getprop_name[];
+extern const char prom_mmu_name[];
+extern const char prom_callmethod_name[];
+extern const char prom_translate_name[];
+extern const char prom_map_name[];
+extern const char prom_unmap_name[];
+extern int prom_mmu_ihandle_cache;
+extern unsigned int prom_boot_mapped_pc;
+extern unsigned int prom_boot_mapping_mode;
+extern unsigned long prom_boot_mapping_phys_high, prom_boot_mapping_phys_low;
+
 struct linux_mlist_p1275 {
         struct linux_mlist_p1275 *theres_more;
         unsigned long start_adr;
@@ -68,7 +82,7 @@ extern char *prom_getbootargs(void);
  * of the string is different on V0 vs. V2->higher proms.  The caller must
  * know what he/she is doing!  Returns the device descriptor, an int.
  */
-extern int prom_devopen(char *device_string);
+extern int prom_devopen(const char *device_string);
 
 /* Close a previously opened device described by the passed integer
  * descriptor.
@@ -81,27 +95,13 @@ extern int prom_devclose(int device_handle);
 extern void prom_seek(int device_handle, unsigned int seek_hival,
                       unsigned int seek_lowval);
 
-/* Machine memory configuration routine. */
-
-/* This function returns a V0 format memory descriptor table, it has three
- * entries.  One for the total amount of physical ram on the machine, one
- * for the amount of physical ram available, and one describing the virtual
- * areas which are allocated by the prom.  So, in a sense the physical
- * available is a calculation of the total physical minus the physical mapped
- * by the prom with virtual mappings.
- *
- * These lists are returned pre-sorted, this should make your life easier
- * since the prom itself is way too lazy to do such nice things.
- */
-extern struct linux_mem_p1275 *prom_meminfo(void);
-
 /* Miscellaneous routines, don't really fit in any category per se. */
 
 /* Reboot the machine with the command line passed. */
-extern void prom_reboot(char *boot_command);
+extern void prom_reboot(const char *boot_command);
 
 /* Evaluate the forth string passed. */
-extern void prom_feval(char *forth_string);
+extern void prom_feval(const char *forth_string);
 
 /* Enter the prom, with possibility of continuation with the 'go'
  * command in newer proms.
@@ -154,7 +154,7 @@ extern char prom_getchar(void);
 extern void prom_putchar(char character);
 
 /* Prom's internal routines, don't use in kernel/boot code. */
-extern void prom_printf(char *fmt, ...);
+extern void prom_printf(const char *fmt, ...);
 extern void prom_write(const char *buf, unsigned int len);
 
 /* Query for input device type */
@@ -215,7 +215,7 @@ extern int prom_getunumber(int syndrome_code,
                            char *buf, int buflen);
 
 /* Retain physical memory to the caller across soft resets. */
-extern unsigned long prom_retain(char *name,
+extern unsigned long prom_retain(const char *name,
                                  unsigned long pa_low, unsigned long pa_high,
                                  long size, long align);
 
@@ -269,28 +269,28 @@ extern int prom_getsibling(int node);
 /* Get the length, at the passed node, of the given property type.
  * Returns -1 on error (ie. no such property at this node).
  */
-extern int prom_getproplen(int thisnode, char *property);
+extern int prom_getproplen(int thisnode, const char *property);
 
 /* Fetch the requested property using the given buffer.  Returns
  * the number of bytes the prom put into your buffer or -1 on error.
  */
-extern int prom_getproperty(int thisnode, char *property,
+extern int prom_getproperty(int thisnode, const char *property,
                             char *prop_buffer, int propbuf_size);
 
 /* Acquire an integer property. */
-extern int prom_getint(int node, char *property);
+extern int prom_getint(int node, const char *property);
 
 /* Acquire an integer property, with a default value. */
-extern int prom_getintdefault(int node, char *property, int defval);
+extern int prom_getintdefault(int node, const char *property, int defval);
 
 /* Acquire a boolean property, 0=FALSE 1=TRUE. */
-extern int prom_getbool(int node, char *prop);
+extern int prom_getbool(int node, const char *prop);
 
 /* Acquire a string property, null string on error. */
-extern void prom_getstring(int node, char *prop, char *buf, int bufsize);
+extern void prom_getstring(int node, const char *prop, char *buf, int bufsize);
 
 /* Does the passed node have the given "name"? YES=1 NO=0 */
-extern int prom_nodematch(int thisnode, char *name);
+extern int prom_nodematch(int thisnode, const char *name);
 
 /* Puts in buffer a prom name in the form name@x,y or name (x for which_io 
  * and y for first regs phys address
@@ -300,7 +300,7 @@ extern int prom_getname(int node, char *buf, int buflen);
 /* Search all siblings starting at the passed node for "name" matching
  * the given string.  Returns the node on success, zero on failure.
  */
-extern int prom_searchsiblings(int node_start, char *name);
+extern int prom_searchsiblings(int node_start, const char *name);
 
 /* Return the first property type, as a string, for the given node.
  * Returns a null string on error. Buffer should be at least 32B long.
@@ -310,21 +310,21 @@ extern char *prom_firstprop(int node, char *buffer);
 /* Returns the next property after the passed property for the given
  * node.  Returns null string on failure. Buffer should be at least 32B long.
  */
-extern char *prom_nextprop(int node, char *prev_property, char *buffer);
+extern char *prom_nextprop(int node, const char *prev_property, char *buffer);
 
 /* Returns 1 if the specified node has given property. */
-extern int prom_node_has_property(int node, char *property);
+extern int prom_node_has_property(int node, const char *property);
 
 /* Returns phandle of the path specified */
-extern int prom_finddevice(char *name);
+extern int prom_finddevice(const char *name);
 
 /* Set the indicated property at the given node with the passed value.
  * Returns the number of bytes of your value that the prom took.
  */
-extern int prom_setprop(int node, char *prop_name, char *prop_value,
+extern int prom_setprop(int node, const char *prop_name, char *prop_value,
                         int value_size);
                         
-extern int prom_pathtoinode(char *path);
+extern int prom_pathtoinode(const char *path);
 extern int prom_inst2pkg(int);
 
 /* CPU probing helpers.  */
@@ -334,7 +334,7 @@ int cpu_find_by_mid(int mid, int *prom_node);
 /* Client interface level routines. */
 extern void prom_set_trap_table(unsigned long tba);
 
-extern long p1275_cmd (char *, long, ...);
+extern long p1275_cmd(const char *, long, ...);
                                    
 
 #if 0
diff --git a/include/asm-sparc64/page.h b/include/asm-sparc64/page.h
index c9f8ef208ea5..5426bb28a993 100644
--- a/include/asm-sparc64/page.h
+++ b/include/asm-sparc64/page.h
@@ -21,6 +21,13 @@
 #define PAGE_SIZE    (_AC(1,UL) << PAGE_SHIFT)
 #define PAGE_MASK    (~(PAGE_SIZE-1))
 
+/* Flushing for D-cache alias handling is only needed if
+ * the page size is smaller than 16K.
+ */
+#if PAGE_SHIFT < 14
+#define DCACHE_ALIASING_POSSIBLE
+#endif
+
 #ifdef __KERNEL__
 
 #ifndef __ASSEMBLY__
@@ -133,23 +140,6 @@ extern unsigned long page_to_pfn(struct page *);
 #define virt_to_phys __pa
 #define phys_to_virt __va
 
-/* The following structure is used to hold the physical
- * memory configuration of the machine.  This is filled in
- * probe_memory() and is later used by mem_init() to set up
- * mem_map[].  We statically allocate SPARC_PHYS_BANKS of
- * these structs, this is arbitrary.  The entry after the
- * last valid one has num_bytes==0.
- */
-
-struct sparc_phys_banks {
-        unsigned long base_addr;
-        unsigned long num_bytes;
-};
-
-#define SPARC_PHYS_BANKS 32
-
-extern struct sparc_phys_banks sp_banks[SPARC_PHYS_BANKS];
-
 #endif /* !(__ASSEMBLY__) */
 
 #define VM_DATA_DEFAULT_FLAGS   (VM_READ | VM_WRITE | VM_EXEC | \
diff --git a/include/asm-sparc64/pgalloc.h b/include/asm-sparc64/pgalloc.h
index b9b1914aae63..a96067cca963 100644
--- a/include/asm-sparc64/pgalloc.h
+++ b/include/asm-sparc64/pgalloc.h
@@ -10,6 +10,7 @@
 #include <asm/spitfire.h>
 #include <asm/cpudata.h>
 #include <asm/cacheflush.h>
+#include <asm/page.h>
 
 /* Page table allocation/freeing. */
 #ifdef CONFIG_SMP
diff --git a/include/asm-sparc64/pgtable.h b/include/asm-sparc64/pgtable.h
index a2b4f5ed4625..8c6dfc6c7af6 100644
--- a/include/asm-sparc64/pgtable.h
+++ b/include/asm-sparc64/pgtable.h
@@ -24,21 +24,23 @@
 #include <asm/processor.h>
 #include <asm/const.h>
 
-/* The kernel image occupies 0x4000000 to 0x1000000 (4MB --> 16MB).
- * The page copy blockops use 0x1000000 to 0x18000000 (16MB --> 24MB).
+/* The kernel image occupies 0x4000000 to 0x1000000 (4MB --> 32MB).
+ * The page copy blockops can use 0x2000000 to 0x10000000.
  * The PROM resides in an area spanning 0xf0000000 to 0x100000000.
- * The vmalloc area spans 0x140000000 to 0x200000000.
+ * The vmalloc area spans 0x100000000 to 0x200000000.
+ * Since modules need to be in the lowest 32-bits of the address space,
+ * we place them right before the OBP area from 0x10000000 to 0xf0000000.
  * There is a single static kernel PMD which maps from 0x0 to address
  * 0x400000000.
  */
-#define TLBTEMP_BASE            _AC(0x0000000001000000,UL)
-#define MODULES_VADDR           _AC(0x0000000002000000,UL)
-#define MODULES_LEN             _AC(0x000000007e000000,UL)
-#define MODULES_END             _AC(0x0000000080000000,UL)
-#define VMALLOC_START           _AC(0x0000000140000000,UL)
-#define VMALLOC_END             _AC(0x0000000200000000,UL)
+#define TLBTEMP_BASE            _AC(0x0000000002000000,UL)
+#define MODULES_VADDR           _AC(0x0000000010000000,UL)
+#define MODULES_LEN             _AC(0x00000000e0000000,UL)
+#define MODULES_END             _AC(0x00000000f0000000,UL)
 #define LOW_OBP_ADDRESS         _AC(0x00000000f0000000,UL)
 #define HI_OBP_ADDRESS          _AC(0x0000000100000000,UL)
+#define VMALLOC_START           _AC(0x0000000100000000,UL)
+#define VMALLOC_END             _AC(0x0000000200000000,UL)
 
 /* XXX All of this needs to be rethought so we can take advantage
  * XXX cheetah's full 64-bit virtual address space, ie. no more hole
@@ -58,13 +60,13 @@
  * table can map
  */
 #define PMD_SHIFT       (PAGE_SHIFT + (PAGE_SHIFT-3))
-#define PMD_SIZE        (1UL << PMD_SHIFT)
+#define PMD_SIZE        (_AC(1,UL) << PMD_SHIFT)
 #define PMD_MASK        (~(PMD_SIZE-1))
 #define PMD_BITS        (PAGE_SHIFT - 2)
 
 /* PGDIR_SHIFT determines what a third-level page table entry can map */
 #define PGDIR_SHIFT     (PAGE_SHIFT + (PAGE_SHIFT-3) + PMD_BITS)
-#define PGDIR_SIZE      (1UL << PGDIR_SHIFT)
+#define PGDIR_SIZE      (_AC(1,UL) << PGDIR_SHIFT)
 #define PGDIR_MASK      (~(PGDIR_SIZE-1))
 #define PGDIR_BITS      (PAGE_SHIFT - 2)
 
@@ -96,7 +98,9 @@
 #define _PAGE_NFO       _AC(0x1000000000000000,UL) /* No Fault Only          */
 #define _PAGE_IE        _AC(0x0800000000000000,UL) /* Invert Endianness      */
 #define _PAGE_SOFT2     _AC(0x07FC000000000000,UL) /* Software bits, set 2   */
-#define _PAGE_RES1      _AC(0x0003000000000000,UL) /* Reserved               */
+#define _PAGE_RES1      _AC(0x0002000000000000,UL) /* Reserved               */
+#define _PAGE_SZ32MB    _AC(0x0001000000000000,UL) /* (Panther) 32MB page    */
+#define _PAGE_SZ256MB   _AC(0x2001000000000000,UL) /* (Panther) 256MB page   */
 #define _PAGE_SN        _AC(0x0000800000000000,UL) /* (Cheetah) Snoop        */
 #define _PAGE_RES2      _AC(0x0000780000000000,UL) /* Reserved               */
 #define _PAGE_PADDR_SF  _AC(0x000001FFFFFFE000,UL) /* (Spitfire) paddr[40:13]*/
@@ -334,7 +338,11 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *p
 #define pte_clear(mm,addr,ptep)         \
         set_pte_at((mm), (addr), (ptep), __pte(0UL))
 
-extern pgd_t swapper_pg_dir[1];
+extern pgd_t swapper_pg_dir[2048];
+extern pmd_t swapper_low_pmd_dir[2048];
+
+extern void paging_init(void);
+extern unsigned long find_ecache_flush_span(unsigned long size);
 
 /* These do nothing with the way I have things setup. */
 #define mmu_lockarea(vaddr, len)                (vaddr)
diff --git a/include/asm-sparc64/uaccess.h b/include/asm-sparc64/uaccess.h
index 80a65d7e3dbf..203e8eee6351 100644
--- a/include/asm-sparc64/uaccess.h
+++ b/include/asm-sparc64/uaccess.h
@@ -70,26 +70,14 @@ static inline int access_ok(int type, const void __user * addr, unsigned long si
  * with the main instruction path.  This means when everything is well,
  * we don't even have to jump over them.  Further, they do not intrude
  * on our cache or tlb entries.
- *
- * There is a special way how to put a range of potentially faulting
- * insns (like twenty ldd/std's with now intervening other instructions)
- * You specify address of first in insn and 0 in fixup and in the next
- * exception_table_entry you specify last potentially faulting insn + 1
- * and in fixup the routine which should handle the fault.
- * That fixup code will get
- * (faulting_insn_address - first_insn_in_the_range_address)/4
- * in %g2 (ie. index of the faulting instruction in the range).
  */
 
-struct exception_table_entry
-{
-        unsigned insn, fixup;
+struct exception_table_entry {
+        unsigned int insn, fixup;
 };
 
-/* Special exable search, which handles ranges.  Returns fixup */
-unsigned long search_extables_range(unsigned long addr, unsigned long *g2);
-
 extern void __ret_efault(void);
+extern void __retl_efault(void);
 
 /* Uh, these should become the main single-value transfer routines..
  * They automatically use the right size if we just have the right
@@ -263,7 +251,7 @@ copy_from_user(void *to, const void __user *from, unsigned long size)
 {
         unsigned long ret = ___copy_from_user(to, from, size);
 
-        if (ret)
+        if (unlikely(ret))
                 ret = copy_from_user_fixup(to, from, size);
         return ret;
 }
@@ -279,7 +267,7 @@ copy_to_user(void __user *to, const void *from, unsigned long size)
 {
         unsigned long ret = ___copy_to_user(to, from, size);
 
-        if (ret)
+        if (unlikely(ret))
                 ret = copy_to_user_fixup(to, from, size);
         return ret;
 }
@@ -295,7 +283,7 @@ copy_in_user(void __user *to, void __user *from, unsigned long size)
 {
         unsigned long ret = ___copy_in_user(to, from, size);
 
-        if (ret)
+        if (unlikely(ret))
                 ret = copy_in_user_fixup(to, from, size);
         return ret;
 }
diff --git a/include/asm-um/futex.h b/include/asm-um/futex.h
index 2cac5ecd9d00..142ee2d8e0fd 100644
--- a/include/asm-um/futex.h
+++ b/include/asm-um/futex.h
@@ -1,53 +1,12 @@
-#ifndef _ASM_FUTEX_H
-#define _ASM_FUTEX_H
-
-#ifdef __KERNEL__
+#ifndef __UM_FUTEX_H
+#define __UM_FUTEX_H
 
 #include <linux/futex.h>
 #include <asm/errno.h>
+#include <asm/system.h>
+#include <asm/processor.h>
 #include <asm/uaccess.h>
 
-static inline int
-futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
-{
-        int op = (encoded_op >> 28) & 7;
-        int cmp = (encoded_op >> 24) & 15;
-        int oparg = (encoded_op << 8) >> 20;
-        int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
-        if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
-                oparg = 1 << oparg;
-
-        if (! access_ok (VERIFY_WRITE, uaddr, sizeof(int)))
-                return -EFAULT;
-
-        inc_preempt_count();
-
-        switch (op) {
-        case FUTEX_OP_SET:
-        case FUTEX_OP_ADD:
-        case FUTEX_OP_OR:
-        case FUTEX_OP_ANDN:
-        case FUTEX_OP_XOR:
-        default:
-                ret = -ENOSYS;
-        }
+#include "asm/arch/futex.h"
 
-        dec_preempt_count();
-
-        if (!ret) {
-                switch (cmp) {
-                case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
-                case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
-                case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
-                case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
-                case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
-                case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
-                default: ret = -ENOSYS;
-                }
-        }
-        return ret;
-}
-
-#endif
 #endif
diff --git a/include/asm-um/pgtable.h b/include/asm-um/pgtable.h
index ed06170e0edd..616d02b57ea9 100644
--- a/include/asm-um/pgtable.h
+++ b/include/asm-um/pgtable.h
@@ -346,7 +346,6 @@ static inline void set_pte(pte_t *pteptr, pte_t pteval)
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
         pte_set_val(pte, (pte_val(pte) & _PAGE_CHG_MASK), newprot);
-        if(pte_present(pte)) pte = pte_mknewpage(pte_mknewprot(pte));
         return pte; 
 }
 
diff --git a/include/asm-um/processor-generic.h b/include/asm-um/processor-generic.h
index b2fc94fbc2d9..2d242360c3d6 100644
--- a/include/asm-um/processor-generic.h
+++ b/include/asm-um/processor-generic.h
@@ -21,6 +21,7 @@ struct thread_struct {
          * copy_thread) to mark that we are begin called from userspace (fork /
          * vfork / clone), and reset to 0 after. It is left to 0 when called
          * from kernelspace (i.e. kernel_thread() or fork_idle(), as of 2.6.11). */
+        struct task_struct *saved_task;
         int forking;
         int nsyscalls;
         struct pt_regs regs;
diff --git a/include/asm-um/system-i386.h b/include/asm-um/system-i386.h
index ea8381de3cc9..c436263e67ba 100644
--- a/include/asm-um/system-i386.h
+++ b/include/asm-um/system-i386.h
@@ -3,6 +3,4 @@
 
 #include "asm/system-generic.h"
     
-#define __HAVE_ARCH_CMPXCHG 1
-
 #endif
diff --git a/include/asm-um/uaccess.h b/include/asm-um/uaccess.h
index 801710d00a40..2ee028b8de9d 100644
--- a/include/asm-um/uaccess.h
+++ b/include/asm-um/uaccess.h
@@ -44,7 +44,7 @@
         const __typeof__(ptr) __private_ptr = ptr; \
         __typeof__(*(__private_ptr)) __private_val; \
         int __private_ret = -EFAULT; \
-        (x) = 0; \
+        (x) = (__typeof__(*(__private_ptr)))0; \
         if (__copy_from_user(&__private_val, (__private_ptr), \
             sizeof(*(__private_ptr))) == 0) {\
                 (x) = (__typeof__(*(__private_ptr))) __private_val; \
diff --git a/include/asm-v850/futex.h b/include/asm-v850/futex.h
index 2cac5ecd9d00..9feff4ce1424 100644
--- a/include/asm-v850/futex.h
+++ b/include/asm-v850/futex.h
@@ -14,7 +14,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         int cmp = (encoded_op >> 24) & 15;
         int oparg = (encoded_op << 8) >> 20;
         int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret, tem;
+        int oldval = 0, ret;
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                 oparg = 1 << oparg;
 
diff --git a/include/asm-x86_64/desc.h b/include/asm-x86_64/desc.h
index 594e610f4a1e..68ac3c62fe3d 100644
--- a/include/asm-x86_64/desc.h
+++ b/include/asm-x86_64/desc.h
@@ -8,6 +8,8 @@
 #ifndef __ASSEMBLY__
 
 #include <linux/string.h>
+#include <linux/smp.h>
+
 #include <asm/segment.h>
 #include <asm/mmu.h>
 
diff --git a/include/asm-x86_64/msr.h b/include/asm-x86_64/msr.h
index 4d727f3f5550..5a7fe3c6c3d8 100644
--- a/include/asm-x86_64/msr.h
+++ b/include/asm-x86_64/msr.h
@@ -234,6 +234,7 @@ static inline unsigned int cpuid_edx(unsigned int op)
 #define MSR_K8_TOP_MEM1            0xC001001A
 #define MSR_K8_TOP_MEM2            0xC001001D
 #define MSR_K8_SYSCFG              0xC0010010
+#define MSR_K8_HWCR                0xC0010015
 
 /* K6 MSRs */
 #define MSR_K6_EFER                     0xC0000080
diff --git a/include/asm-x86_64/pgtable.h b/include/asm-x86_64/pgtable.h
index 1dc110ba82d6..dd8711ecaf2f 100644
--- a/include/asm-x86_64/pgtable.h
+++ b/include/asm-x86_64/pgtable.h
@@ -384,7 +384,7 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 }
 
 #define pte_index(address) \
-                ((address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
+                (((address) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
 #define pte_offset_kernel(dir, address) ((pte_t *) pmd_page_kernel(*(dir)) + \
                         pte_index(address))
 
@@ -421,9 +421,6 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 
 extern int kern_addr_valid(unsigned long addr); 
 
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-xtensa/atomic.h b/include/asm-xtensa/atomic.h
index 24f86f0e43cf..12b5732dc6e5 100644
--- a/include/asm-xtensa/atomic.h
+++ b/include/asm-xtensa/atomic.h
@@ -22,7 +22,7 @@ typedef struct { volatile int counter; } atomic_t;
 #include <asm/processor.h>
 #include <asm/system.h>
 
-#define ATOMIC_INIT(i)  ( (atomic_t) { (i) } )
+#define ATOMIC_INIT(i)  { (i) }
 
 /*
  * This Xtensa implementation assumes that the right mechanism
diff --git a/include/asm-xtensa/bitops.h b/include/asm-xtensa/bitops.h
index d395ef226c32..e76ee889e21d 100644
--- a/include/asm-xtensa/bitops.h
+++ b/include/asm-xtensa/bitops.h
@@ -174,7 +174,7 @@ static __inline__ int test_bit(int nr, const volatile void *addr)
         return 1UL & (((const volatile unsigned int *)addr)[nr>>5] >> (nr&31));
 }
 
-#if XCHAL_HAVE_NSAU
+#if XCHAL_HAVE_NSA
 
 static __inline__ int __cntlz (unsigned long x)
 {
diff --git a/include/asm-xtensa/hardirq.h b/include/asm-xtensa/hardirq.h
index e07c76c36b95..aa9c1adf68d7 100644
--- a/include/asm-xtensa/hardirq.h
+++ b/include/asm-xtensa/hardirq.h
@@ -23,6 +23,7 @@ typedef struct {
         unsigned int __nmi_count;              /* arch dependent */
 } ____cacheline_aligned irq_cpustat_t;
 
+void ack_bad_irq(unsigned int irq);
 #include <linux/irq_cpustat.h>  /* Standard mappings for irq_cpustat_t above */
 
 #endif  /* _XTENSA_HARDIRQ_H */
diff --git a/include/asm-xtensa/pgtable.h b/include/asm-xtensa/pgtable.h
index 883ebc2d75d6..987e3b802313 100644
--- a/include/asm-xtensa/pgtable.h
+++ b/include/asm-xtensa/pgtable.h
@@ -441,11 +441,11 @@ extern  void update_mmu_cache(struct vm_area_struct * vma,
                               unsigned long address, pte_t pte);
 
 /*
- * remap a physical address `phys' of size `size' with page protection `prot'
+ * remap a physical page `pfn' of size `size' with page protection `prot'
  * into virtual address `from'
  */
-#define io_remap_page_range(vma,from,phys,size,prot) \
-                remap_pfn_range(vma, from, (phys) >> PAGE_SHIFT, size, prot)
+#define io_remap_pfn_range(vma,from,pfn,size,prot) \
+                remap_pfn_range(vma, from, pfn, size, prot)
 
 
 /* No page table caches to init */
diff --git a/include/asm-xtensa/semaphore.h b/include/asm-xtensa/semaphore.h
index db740b8bc6f0..09e89ab3eb61 100644
--- a/include/asm-xtensa/semaphore.h
+++ b/include/asm-xtensa/semaphore.h
@@ -20,28 +20,19 @@ struct semaphore {
         atomic_t count;
         int sleepers;
         wait_queue_head_t wait;
-#if WAITQUEUE_DEBUG
-        long __magic;
-#endif
 };
 
-#if WAITQUEUE_DEBUG
-# define __SEM_DEBUG_INIT(name) \
-                , (int)&(name).__magic
-#else
-# define __SEM_DEBUG_INIT(name)
-#endif
-
-#define __SEMAPHORE_INITIALIZER(name,count)                     \
-        { ATOMIC_INIT(count),                                   \
-          0,                                                    \
-          __WAIT_QUEUE_HEAD_INITIALIZER((name).wait)            \
-        __SEM_DEBUG_INIT(name) }
+#define __SEMAPHORE_INITIALIZER(name,n)                                 \
+{                                                                       \
+        .count          = ATOMIC_INIT(n),                               \
+        .sleepers       = 0,                                            \
+        .wait           = __WAIT_QUEUE_HEAD_INITIALIZER((name).wait)    \
+}
 
-#define __MUTEX_INITIALIZER(name) \
+#define __MUTEX_INITIALIZER(name)                                       \
         __SEMAPHORE_INITIALIZER(name, 1)
 
-#define __DECLARE_SEMAPHORE_GENERIC(name,count) \
+#define __DECLARE_SEMAPHORE_GENERIC(name,count)                         \
         struct semaphore name = __SEMAPHORE_INITIALIZER(name,count)
 
 #define DECLARE_MUTEX(name) __DECLARE_SEMAPHORE_GENERIC(name,1)
@@ -49,17 +40,8 @@ struct semaphore {
 
 static inline void sema_init (struct semaphore *sem, int val)
 {
-/*
- *      *sem = (struct semaphore)__SEMAPHORE_INITIALIZER((*sem),val);
- *
- * i'd rather use the more flexible initialization above, but sadly
- * GCC 2.7.2.3 emits a bogus warning. EGCS doesnt. Oh well.
- */
         atomic_set(&sem->count, val);
         init_waitqueue_head(&sem->wait);
-#if WAITQUEUE_DEBUG
-        sem->__magic = (int)&sem->__magic;
-#endif
 }
 
 static inline void init_MUTEX (struct semaphore *sem)
@@ -81,9 +63,7 @@ extern spinlock_t semaphore_wake_lock;
 
 static inline void down(struct semaphore * sem)
 {
-#if WAITQUEUE_DEBUG
-        CHECK_MAGIC(sem->__magic);
-#endif
+        might_sleep();
 
         if (atomic_sub_return(1, &sem->count) < 0)
                 __down(sem);
@@ -92,9 +72,8 @@ static inline void down(struct semaphore * sem)
 static inline int down_interruptible(struct semaphore * sem)
 {
         int ret = 0;
-#if WAITQUEUE_DEBUG
-        CHECK_MAGIC(sem->__magic);
-#endif
+
+        might_sleep();
 
         if (atomic_sub_return(1, &sem->count) < 0)
                 ret = __down_interruptible(sem);
@@ -104,9 +83,6 @@ static inline int down_interruptible(struct semaphore * sem)
 static inline int down_trylock(struct semaphore * sem)
 {
         int ret = 0;
-#if WAITQUEUE_DEBUG
-        CHECK_MAGIC(sem->__magic);
-#endif
 
         if (atomic_sub_return(1, &sem->count) < 0)
                 ret = __down_trylock(sem);
@@ -119,9 +95,6 @@ static inline int down_trylock(struct semaphore * sem)
  */
 static inline void up(struct semaphore * sem)
 {
-#if WAITQUEUE_DEBUG
-        CHECK_MAGIC(sem->__magic);
-#endif
         if (atomic_add_return(1, &sem->count) <= 0)
                 __up(sem);
 }
diff --git a/include/asm-xtensa/system.h b/include/asm-xtensa/system.h
index f09393232e5e..9284867f1cb9 100644
--- a/include/asm-xtensa/system.h
+++ b/include/asm-xtensa/system.h
@@ -189,20 +189,6 @@ static inline unsigned long xchg_u32(volatile int * m, unsigned long val)
 
 #define tas(ptr) (xchg((ptr),1))
 
-#if ( __XCC__ == 1 )
-
-/* xt-xcc processes __inline__ differently than xt-gcc and decides to
- * insert an out-of-line copy of function __xchg.  This presents the
- * unresolved symbol at link time of __xchg_called_with_bad_pointer,
- * even though such a function would never be called at run-time.
- * xt-gcc always inlines __xchg, and optimizes away the undefined
- * bad_pointer function.
- */
-
-#define xchg(ptr,x) xchg_u32(ptr,x)
-
-#else  /* assume xt-gcc */
-
 #define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
 
 /*
@@ -224,8 +210,6 @@ __xchg(unsigned long x, volatile void * ptr, int size)
         return x;
 }
 
-#endif
-
 extern void set_except_vector(int n, void *addr);
 
 static inline void spill_registers(void)
diff --git a/include/linux/aio.h b/include/linux/aio.h
index a4d5af907f90..60def658b246 100644
--- a/include/linux/aio.h
+++ b/include/linux/aio.h
@@ -43,6 +43,40 @@ struct kioctx;
 #define kiocbIsKicked(iocb)     test_bit(KIF_KICKED, &(iocb)->ki_flags)
 #define kiocbIsCancelled(iocb)  test_bit(KIF_CANCELLED, &(iocb)->ki_flags)
 
+/* is there a better place to document function pointer methods? */
+/**
+ * ki_retry     -       iocb forward progress callback
+ * @kiocb:      The kiocb struct to advance by performing an operation.
+ *
+ * This callback is called when the AIO core wants a given AIO operation
+ * to make forward progress.  The kiocb argument describes the operation
+ * that is to be performed.  As the operation proceeds, perhaps partially,
+ * ki_retry is expected to update the kiocb with progress made.  Typically
+ * ki_retry is set in the AIO core and it itself calls file_operations
+ * helpers.
+ *
+ * ki_retry's return value determines when the AIO operation is completed
+ * and an event is generated in the AIO event ring.  Except the special
+ * return values described below, the value that is returned from ki_retry
+ * is transferred directly into the completion ring as the operation's
+ * resulting status.  Once this has happened ki_retry *MUST NOT* reference
+ * the kiocb pointer again.
+ *
+ * If ki_retry returns -EIOCBQUEUED it has made a promise that aio_complete()
+ * will be called on the kiocb pointer in the future.  The AIO core will
+ * not ask the method again -- ki_retry must ensure forward progress.
+ * aio_complete() must be called once and only once in the future, multiple
+ * calls may result in undefined behaviour.
+ *
+ * If ki_retry returns -EIOCBRETRY it has made a promise that kick_iocb()
+ * will be called on the kiocb pointer in the future.  This may happen
+ * through generic helpers that associate kiocb->ki_wait with a wait
+ * queue head that ki_retry uses via current->io_wait.  It can also happen
+ * with custom tracking and manual calls to kick_iocb(), though that is
+ * discouraged.  In either case, kick_iocb() must be called once and only
+ * once.  ki_retry must ensure forward progress, the AIO core will wait
+ * indefinitely for kick_iocb() to be called.
+ */
 struct kiocb {
         struct list_head        ki_run_list;
         long                    ki_flags;
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 68aba0c02e49..b2a2509bd7ea 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -51,7 +51,8 @@
 #define AUDIT_WATCH_LIST        1009    /* List all file/dir watches */
 #define AUDIT_SIGNAL_INFO       1010    /* Get info about sender of signal to auditd */
 
-#define AUDIT_FIRST_USER_MSG    1100    /* Userspace messages uninteresting to kernel */
+#define AUDIT_FIRST_USER_MSG    1100    /* Userspace messages mostly uninteresting to kernel */
+#define AUDIT_USER_AVC          1107    /* We filter this differently */
 #define AUDIT_LAST_USER_MSG     1199
  
 #define AUDIT_DAEMON_START      1200    /* Daemon startup record */
@@ -75,10 +76,15 @@
 #define AUDIT_KERNEL            2000    /* Asynchronous audit record. NOT A REQUEST. */
 
 /* Rule flags */
-#define AUDIT_PER_TASK 0x01     /* Apply rule at task creation (not syscall) */
-#define AUDIT_AT_ENTRY 0x02     /* Apply rule at syscall entry */
-#define AUDIT_AT_EXIT  0x04     /* Apply rule at syscall exit */
-#define AUDIT_PREPEND  0x10     /* Prepend to front of list */
+#define AUDIT_FILTER_USER       0x00    /* Apply rule to user-generated messages */
+#define AUDIT_FILTER_TASK       0x01    /* Apply rule at task creation (not syscall) */
+#define AUDIT_FILTER_ENTRY      0x02    /* Apply rule at syscall entry */
+#define AUDIT_FILTER_WATCH      0x03    /* Apply rule to file system watches */
+#define AUDIT_FILTER_EXIT       0x04    /* Apply rule at syscall exit */
+
+#define AUDIT_NR_FILTERS        5
+
+#define AUDIT_FILTER_PREPEND    0x10    /* Prepend to front of list */
 
 /* Rule actions */
 #define AUDIT_NEVER    0        /* Do not build context if rule matches */
@@ -199,6 +205,7 @@ struct audit_sig_info {
 struct audit_buffer;
 struct audit_context;
 struct inode;
+struct netlink_skb_parms;
 
 #define AUDITSC_INVALID 0
 #define AUDITSC_SUCCESS 1
@@ -215,7 +222,7 @@ extern void audit_syscall_entry(struct task_struct *task, int arch,
 extern void audit_syscall_exit(struct task_struct *task, int failed, long return_code);
 extern void audit_getname(const char *name);
 extern void audit_putname(const char *name);
-extern void audit_inode(const char *name, const struct inode *inode);
+extern void audit_inode(const char *name, const struct inode *inode, unsigned flags);
 
                                 /* Private API (for audit.c only) */
 extern int  audit_receive_filter(int type, int pid, int uid, int seq,
@@ -230,6 +237,7 @@ extern int audit_socketcall(int nargs, unsigned long *args);
 extern int audit_sockaddr(int len, void *addr);
 extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
 extern void audit_signal_info(int sig, struct task_struct *t);
+extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
 #else
 #define audit_alloc(t) ({ 0; })
 #define audit_free(t) do { ; } while (0)
@@ -237,7 +245,7 @@ extern void audit_signal_info(int sig, struct task_struct *t);
 #define audit_syscall_exit(t,f,r) do { ; } while (0)
 #define audit_getname(n) do { ; } while (0)
 #define audit_putname(n) do { ; } while (0)
-#define audit_inode(n,i) do { ; } while (0)
+#define audit_inode(n,i,f) do { ; } while (0)
 #define audit_receive_filter(t,p,u,s,d,l) ({ -EOPNOTSUPP; })
 #define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
 #define audit_get_loginuid(c) ({ -1; })
@@ -246,16 +254,17 @@ extern void audit_signal_info(int sig, struct task_struct *t);
 #define audit_sockaddr(len, addr) ({ 0; })
 #define audit_avc_path(dentry, mnt) ({ 0; })
 #define audit_signal_info(s,t) do { ; } while (0)
+#define audit_filter_user(cb,t) ({ 1; })
 #endif
 
 #ifdef CONFIG_AUDIT
 /* These are defined in audit.c */
                                 /* Public API */
-extern void                 audit_log(struct audit_context *ctx, int type,
-                                      const char *fmt, ...)
-                            __attribute__((format(printf,3,4)));
+extern void                 audit_log(struct audit_context *ctx, int gfp_mask,
+                                      int type, const char *fmt, ...)
+                                      __attribute__((format(printf,4,5)));
 
-extern struct audit_buffer *audit_log_start(struct audit_context *ctx,int type);
+extern struct audit_buffer *audit_log_start(struct audit_context *ctx, int gfp_mask, int type);
 extern void                 audit_log_format(struct audit_buffer *ab,
                                              const char *fmt, ...)
                             __attribute__((format(printf,2,3)));
@@ -274,9 +283,10 @@ extern void		    audit_send_reply(int pid, int seq, int type,
                                              int done, int multi,
                                              void *payload, int size);
 extern void                 audit_log_lost(const char *message);
+extern struct semaphore audit_netlink_sem;
 #else
-#define audit_log(c,t,f,...) do { ; } while (0)
-#define audit_log_start(c,t) ({ NULL; })
+#define audit_log(c,g,t,f,...) do { ; } while (0)
+#define audit_log_start(c,g,t) ({ NULL; })
 #define audit_log_vformat(b,f,a) do { ; } while (0)
 #define audit_log_format(b,f,...) do { ; } while (0)
 #define audit_log_end(b) do { ; } while (0)
diff --git a/include/linux/byteorder/generic.h b/include/linux/byteorder/generic.h
index 5fde6f4d6c1e..04bd756efc67 100644
--- a/include/linux/byteorder/generic.h
+++ b/include/linux/byteorder/generic.h
@@ -5,6 +5,10 @@
  * linux/byteorder_generic.h
  * Generic Byte-reordering support
  *
+ * The "... p" macros, like le64_to_cpup, can be used with pointers
+ * to unaligned data, but there will be a performance penalty on 
+ * some architectures.  Use get_unaligned for unaligned data.
+ *
  * Francois-Rene Rideau <fare@tunes.org> 19970707
  *    gathered all the good ideas from all asm-foo/byteorder.h into one file,
  *    cleaned them up.
diff --git a/include/linux/connector.h b/include/linux/connector.h
index 96de26301f84..86d4b0a81713 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -104,12 +104,19 @@ struct cn_queue_dev {
         struct sock *nls;
 };
 
-struct cn_callback {
+struct cn_callback_id {
         unsigned char name[CN_CBQ_NAMELEN];
-
         struct cb_id id;
+};
+
+struct cn_callback_data {
+        void (*destruct_data) (void *);
+        void *ddata;
+        
+        void *callback_priv;
         void (*callback) (void *);
-        void *priv;
+
+        void *free;
 };
 
 struct cn_callback_entry {
@@ -118,8 +125,8 @@ struct cn_callback_entry {
         struct work_struct work;
         struct cn_queue_dev *pdev;
 
-        void (*destruct_data) (void *);
-        void *ddata;
+        struct cn_callback_id id;
+        struct cn_callback_data data;
 
         int seq, group;
         struct sock *nls;
@@ -144,7 +151,7 @@ int cn_add_callback(struct cb_id *, char *, void (*callback) (void *));
 void cn_del_callback(struct cb_id *);
 int cn_netlink_send(struct cn_msg *, u32, int);
 
-int cn_queue_add_callback(struct cn_queue_dev *dev, struct cn_callback *cb);
+int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *));
 void cn_queue_del_callback(struct cn_queue_dev *dev, struct cb_id *id);
 
 struct cn_queue_dev *cn_queue_alloc_dev(char *name, struct sock *);
@@ -152,6 +159,8 @@ void cn_queue_free_dev(struct cn_queue_dev *dev);
 
 int cn_cb_equal(struct cb_id *, struct cb_id *);
 
+void cn_queue_wrapper(void *data);
+
 extern int cn_already_initialized;
 
 #endif                          /* __KERNEL__ */
diff --git a/include/linux/dccp.h b/include/linux/dccp.h
index 8bf4bacb5051..71fab4311e92 100644
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -4,16 +4,6 @@
 #include <linux/types.h>
 #include <asm/byteorder.h>
 
-/* Structure describing an Internet (DCCP) socket address. */
-struct sockaddr_dccp {
-        __u16   sdccp_family;   /* Address family   */
-        __u16   sdccp_port;     /* Port number      */
-        __u32   sdccp_addr;     /* Internet address */
-        __u32   sdccp_service;  /* Service          */
-        /* Pad to size of `struct sockaddr': 16 bytes . */
-        __u32   sdccp_pad;
-};
-
 /**
  * struct dccp_hdr - generic part of DCCP packet header
  *
@@ -188,6 +178,11 @@ enum {
 
 /* DCCP socket options */
 #define DCCP_SOCKOPT_PACKET_SIZE        1
+#define DCCP_SOCKOPT_SERVICE            2
+#define DCCP_SOCKOPT_CCID_RX_INFO       128
+#define DCCP_SOCKOPT_CCID_TX_INFO       192
+
+#define DCCP_SERVICE_LIST_MAX_LEN      32
 
 #ifdef __KERNEL__
 
@@ -337,7 +332,8 @@ static inline unsigned int dccp_hdr_len(const struct sk_buff *skb)
   */
 struct dccp_options {
         __u64   dccpo_sequence_window;
-        __u8    dccpo_ccid;
+        __u8    dccpo_rx_ccid;
+        __u8    dccpo_tx_ccid;
         __u8    dccpo_send_ack_vector;
         __u8    dccpo_send_ndp_count;
 };
@@ -360,14 +356,8 @@ static inline struct dccp_request_sock *dccp_rsk(const struct request_sock *req)
 
 extern struct inet_timewait_death_row dccp_death_row;
 
-/* Read about the ECN nonce to see why it is 253 */
-#define DCCP_MAX_ACK_VECTOR_LEN 253
-
 struct dccp_options_received {
-        u32     dccpor_ndp:24,
-                dccpor_ack_vector_len:8;
-        u32     dccpor_ack_vector_idx:10;
-        /* 22 bits hole, try to pack */
+        u32     dccpor_ndp; /* only 24 bits */
         u32     dccpor_timestamp;
         u32     dccpor_timestamp_echo;
         u32     dccpor_elapsed_time;
@@ -382,6 +372,27 @@ enum dccp_role {
         DCCP_ROLE_SERVER,
 };
 
+struct dccp_service_list {
+        __u32   dccpsl_nr;
+        __u32   dccpsl_list[0];
+};
+
+#define DCCP_SERVICE_INVALID_VALUE htonl((__u32)-1)
+
+static inline int dccp_list_has_service(const struct dccp_service_list *sl,
+                                        const u32 service)
+{
+        if (likely(sl != NULL)) {
+                u32 i = sl->dccpsl_nr;
+                while (i--)
+                        if (sl->dccpsl_list[i] == service)
+                                return 1; 
+        }
+        return 0;
+}
+
+struct dccp_ackvec;
+
 /**
  * struct dccp_sock - DCCP socket state
  *
@@ -402,7 +413,7 @@ enum dccp_role {
  * @dccps_packet_size - Set thru setsockopt
  * @dccps_role - Role of this sock, one of %dccp_role
  * @dccps_ndp_count - number of Non Data Packets since last data packet
- * @dccps_hc_rx_ackpkts - receiver half connection acked packets
+ * @dccps_hc_rx_ackvec - rx half connection ack vector
  */
 struct dccp_sock {
         /* inet_connection_sock has to be the first member of dccp_sock */
@@ -417,7 +428,8 @@ struct dccp_sock {
         __u64                           dccps_gss;
         __u64                           dccps_gsr;
         __u64                           dccps_gar;
-        unsigned long                   dccps_service;
+        __u32                           dccps_service;
+        struct dccp_service_list        *dccps_service_list;
         struct timeval                  dccps_timestamp_time;
         __u32                           dccps_timestamp_echo;
         __u32                           dccps_packet_size;
@@ -426,7 +438,7 @@ struct dccp_sock {
         __u32                           dccps_pmtu_cookie;
         __u32                           dccps_mss_cache;
         struct dccp_options             dccps_options;
-        struct dccp_ackpkts             *dccps_hc_rx_ackpkts;
+        struct dccp_ackvec              *dccps_hc_rx_ackvec;
         void                            *dccps_hc_rx_ccid_private;
         void                            *dccps_hc_tx_ccid_private;
         struct ccid                     *dccps_hc_rx_ccid;
@@ -443,6 +455,11 @@ static inline struct dccp_sock *dccp_sk(const struct sock *sk)
         return (struct dccp_sock *)sk;
 }
 
+static inline int dccp_service_not_initialized(const struct sock *sk)
+{
+        return dccp_sk(sk)->dccps_service == DCCP_SERVICE_INVALID_VALUE;
+}
+
 static inline const char *dccp_role(const struct sock *sk)
 {
         switch (dccp_sk(sk)->dccps_role) {
diff --git a/include/linux/device.h b/include/linux/device.h
index 06e5d42f2c7b..95d607a48f06 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -317,6 +317,11 @@ dev_set_drvdata (struct device *dev, void *data)
         dev->driver_data = data;
 }
 
+static inline int device_is_registered(struct device *dev)
+{
+        return klist_node_attached(&dev->knode_bus);
+}
+
 /*
  * High level routines for use by the bus drivers
  */
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 82e39cd0c4fb..c698055266d0 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -619,7 +619,7 @@ struct fb_tilemap {
         __u32 height;               /* height of each tile in scanlines */
         __u32 depth;                /* color depth of each tile */
         __u32 length;               /* number of tiles in the map */
-        __u8  *data;                /* actual tile map: a bitmap array, packed
+        const __u8 *data;           /* actual tile map: a bitmap array, packed
                                        to the nearest byte */
 };
 
diff --git a/include/linux/font.h b/include/linux/font.h
index 8fc80a7d78ac..53b129f07f6f 100644
--- a/include/linux/font.h
+++ b/include/linux/font.h
@@ -15,9 +15,9 @@
 
 struct font_desc {
     int idx;
-    char *name;
+    const char *name;
     int width, height;
-    void *data;
+    const void *data;
     int pref;
 };
 
@@ -32,7 +32,7 @@ struct font_desc {
 #define ACORN8x8_IDX    8
 #define MINI4x6_IDX     9
 
-extern struct font_desc font_vga_8x8,
+extern const struct font_desc   font_vga_8x8,
                         font_vga_8x16,
                         font_pearl_8x8,
                         font_vga_6x11,
@@ -45,11 +45,11 @@ extern struct font_desc	font_vga_8x8,
 
 /* Find a font with a specific name */
 
-extern struct font_desc *find_font(char *name);
+extern const struct font_desc *find_font(const char *name);
 
 /* Get the default font for a specific screen size */
 
-extern struct font_desc *get_default_font(int xres, int yres);
+extern const struct font_desc *get_default_font(int xres, int yres);
 
 /* Max. length for the name of a predefined font */
 #define MAX_FONT_NAME   32
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index be35332b67e6..3d49a305bf88 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -230,11 +230,6 @@ struct i2c_adapter {
         struct device dev;              /* the adapter device */
         struct class_device class_dev;  /* the class device */
 
-#ifdef CONFIG_PROC_FS 
-        /* No need to set this when you initialize the adapter          */
-        int inode;
-#endif /* def CONFIG_PROC_FS */
-
         int nr;
         struct list_head clients;
         struct list_head list;
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index fc2d4c8225aa..d21c305c6c64 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -111,7 +111,9 @@ static inline struct ethhdr *eth_hdr(const struct sk_buff *skb)
         return (struct ethhdr *)skb->mac.raw;
 }
 
+#ifdef CONFIG_SYSCTL
 extern struct ctl_table ether_table[];
 #endif
+#endif
 
 #endif  /* _LINUX_IF_ETHER_H */
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 17d0c0d40b0e..eef0876d8307 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -42,8 +42,8 @@ struct hlist_node;
 struct vlan_ethhdr {
    unsigned char        h_dest[ETH_ALEN];          /* destination eth addr      */
    unsigned char        h_source[ETH_ALEN];        /* source ether addr */
-   unsigned short       h_vlan_proto;              /* Should always be 0x8100 */
-   unsigned short       h_vlan_TCI;                /* Encapsulates priority and VLAN ID */
+   __be16               h_vlan_proto;              /* Should always be 0x8100 */
+   __be16               h_vlan_TCI;                /* Encapsulates priority and VLAN ID */
    unsigned short       h_vlan_encapsulated_proto; /* packet type ID field (or len) */
 };
 
@@ -55,8 +55,8 @@ static inline struct vlan_ethhdr *vlan_eth_hdr(const struct sk_buff *skb)
 }
 
 struct vlan_hdr {
-   unsigned short       h_vlan_TCI;                /* Encapsulates priority and VLAN ID */
-   unsigned short       h_vlan_encapsulated_proto; /* packet type ID field (or len) */
+   __be16               h_vlan_TCI;                /* Encapsulates priority and VLAN ID */
+   __be16               h_vlan_encapsulated_proto; /* packet type ID field (or len) */
 };
 
 #define VLAN_VID_MASK   0xfff
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 7e1e15f934f3..fd7af86151b1 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -142,13 +142,21 @@ static __inline__ int bad_mask(u32 mask, u32 addr)
 
 #define endfor_ifa(in_dev) }
 
+static inline struct in_device *__in_dev_get_rcu(const struct net_device *dev)
+{
+        struct in_device *in_dev = dev->ip_ptr;
+        if (in_dev)
+                in_dev = rcu_dereference(in_dev);
+        return in_dev;
+}
+
 static __inline__ struct in_device *
 in_dev_get(const struct net_device *dev)
 {
         struct in_device *in_dev;
 
         rcu_read_lock();
-        in_dev = dev->ip_ptr;
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev)
                 atomic_inc(&in_dev->refcnt);
         rcu_read_unlock();
@@ -156,7 +164,7 @@ in_dev_get(const struct net_device *dev)
 }
 
 static __inline__ struct in_device *
-__in_dev_get(const struct net_device *dev)
+__in_dev_get_rtnl(const struct net_device *dev)
 {
         return (struct in_device*)dev->ip_ptr;
 }
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index bb6f88e14061..e0b922785d98 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -372,8 +372,9 @@ static inline struct raw6_sock *raw6_sk(const struct sock *sk)
 #define inet_v6_ipv6only(__sk)          0
 #endif /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
 
-#define INET6_MATCH(__sk, __saddr, __daddr, __ports, __dif)        \
-        (((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))   && \
+#define INET6_MATCH(__sk, __hash, __saddr, __daddr, __ports, __dif)\
+        (((__sk)->sk_hash == (__hash))                          && \
+         ((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))   && \
          ((__sk)->sk_family             == AF_INET6)            && \
          ipv6_addr_equal(&inet6_sk(__sk)->daddr, (__saddr))     && \
          ipv6_addr_equal(&inet6_sk(__sk)->rcv_saddr, (__daddr)) && \
diff --git a/include/linux/joystick.h b/include/linux/joystick.h
index 06b9af77eb7f..5fd20ddd7ae3 100644
--- a/include/linux/joystick.h
+++ b/include/linux/joystick.h
@@ -111,29 +111,30 @@ struct js_corr {
 #define JS_SET_ALL              8
 
 struct JS_DATA_TYPE {
-        __s32 buttons;
-        __s32 x;
-        __s32 y;
+        int32_t buttons;
+        int32_t x;
+        int32_t y;
 };
 
 struct JS_DATA_SAVE_TYPE_32 {
-        __s32 JS_TIMEOUT;
-        __s32 BUSY;
-        __s32 JS_EXPIRETIME;
-        __s32 JS_TIMELIMIT;
+        int32_t JS_TIMEOUT;
+        int32_t BUSY;
+        int32_t JS_EXPIRETIME;
+        int32_t JS_TIMELIMIT;
         struct JS_DATA_TYPE JS_SAVE;
         struct JS_DATA_TYPE JS_CORR;
 };
 
 struct JS_DATA_SAVE_TYPE_64 {
-        __s32 JS_TIMEOUT;
-        __s32 BUSY;
-        __s64 JS_EXPIRETIME;
-        __s64 JS_TIMELIMIT;
+        int32_t JS_TIMEOUT;
+        int32_t BUSY;
+        int64_t JS_EXPIRETIME;
+        int64_t JS_TIMELIMIT;
         struct JS_DATA_TYPE JS_SAVE;
         struct JS_DATA_TYPE JS_CORR;
 };
 
+#ifdef __KERNEL__
 #if BITS_PER_LONG == 64
 #define JS_DATA_SAVE_TYPE JS_DATA_SAVE_TYPE_64
 #elif BITS_PER_LONG == 32
@@ -141,5 +142,6 @@ struct JS_DATA_SAVE_TYPE_64 {
 #else
 #error Unexpected BITS_PER_LONG
 #endif
+#endif
 
 #endif /* _LINUX_JOYSTICK_H */
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 687ba8c9973d..4367ce4db52a 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -307,8 +307,8 @@ struct sysinfo {
         char _f[20-2*sizeof(long)-sizeof(int)]; /* Padding: libc5 uses this.. */
 };
 
-extern void BUILD_BUG(void);
-#define BUILD_BUG_ON(condition) do { if (condition) BUILD_BUG(); } while(0)
+/* Force a compilation error if condition is false */
+#define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)]))
 
 #ifdef CONFIG_SYSCTL
 extern int randomize_va_space;
diff --git a/include/linux/key-ui.h b/include/linux/key-ui.h
index cc326174a808..918c34a8347e 100644
--- a/include/linux/key-ui.h
+++ b/include/linux/key-ui.h
@@ -42,11 +42,14 @@ struct keyring_list {
 /*
  * check to see whether permission is granted to use a key in the desired way
  */
-static inline int key_permission(const struct key *key, key_perm_t perm)
+static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
 {
+        struct key *key = key_ref_to_ptr(key_ref);
         key_perm_t kperm;
 
-        if (key->uid == current->fsuid)
+        if (is_key_possessed(key_ref))
+                kperm = key->perm >> 24;
+        else if (key->uid == current->fsuid)
                 kperm = key->perm >> 16;
         else if (key->gid != -1 &&
                  key->perm & KEY_GRP_ALL &&
@@ -65,11 +68,14 @@ static inline int key_permission(const struct key *key, key_perm_t perm)
  * check to see whether permission is granted to use a key in at least one of
  * the desired ways
  */
-static inline int key_any_permission(const struct key *key, key_perm_t perm)
+static inline int key_any_permission(const key_ref_t key_ref, key_perm_t perm)
 {
+        struct key *key = key_ref_to_ptr(key_ref);
         key_perm_t kperm;
 
-        if (key->uid == current->fsuid)
+        if (is_key_possessed(key_ref))
+                kperm = key->perm >> 24;
+        else if (key->uid == current->fsuid)
                 kperm = key->perm >> 16;
         else if (key->gid != -1 &&
                  key->perm & KEY_GRP_ALL &&
@@ -94,13 +100,17 @@ static inline int key_task_groups_search(struct task_struct *tsk, gid_t gid)
         return ret;
 }
 
-static inline int key_task_permission(const struct key *key,
+static inline int key_task_permission(const key_ref_t key_ref,
                                       struct task_struct *context,
                                       key_perm_t perm)
 {
+        struct key *key = key_ref_to_ptr(key_ref);
         key_perm_t kperm;
 
-        if (key->uid == context->fsuid) {
+        if (is_key_possessed(key_ref)) {
+                kperm = key->perm >> 24;
+        }
+        else if (key->uid == context->fsuid) {
                 kperm = key->perm >> 16;
         }
         else if (key->gid != -1 &&
@@ -121,9 +131,9 @@ static inline int key_task_permission(const struct key *key,
 
 }
 
-extern struct key *lookup_user_key(struct task_struct *context,
-                                   key_serial_t id, int create, int partial,
-                                   key_perm_t perm);
+extern key_ref_t lookup_user_key(struct task_struct *context,
+                                 key_serial_t id, int create, int partial,
+                                 key_perm_t perm);
 
 extern long join_session_keyring(const char *name);
 
diff --git a/include/linux/key.h b/include/linux/key.h
index 970bbd916cf4..f1efa016dbf3 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -35,11 +35,18 @@ struct key;
 
 #undef KEY_DEBUGGING
 
-#define KEY_USR_VIEW    0x00010000      /* user can view a key's attributes */
-#define KEY_USR_READ    0x00020000      /* user can read key payload / view keyring */
-#define KEY_USR_WRITE   0x00040000      /* user can update key payload / add link to keyring */
-#define KEY_USR_SEARCH  0x00080000      /* user can find a key in search / search a keyring */
-#define KEY_USR_LINK    0x00100000      /* user can create a link to a key/keyring */
+#define KEY_POS_VIEW    0x01000000      /* possessor can view a key's attributes */
+#define KEY_POS_READ    0x02000000      /* possessor can read key payload / view keyring */
+#define KEY_POS_WRITE   0x04000000      /* possessor can update key payload / add link to keyring */
+#define KEY_POS_SEARCH  0x08000000      /* possessor can find a key in search / search a keyring */
+#define KEY_POS_LINK    0x10000000      /* possessor can create a link to a key/keyring */
+#define KEY_POS_ALL     0x1f000000
+
+#define KEY_USR_VIEW    0x00010000      /* user permissions... */
+#define KEY_USR_READ    0x00020000
+#define KEY_USR_WRITE   0x00040000
+#define KEY_USR_SEARCH  0x00080000
+#define KEY_USR_LINK    0x00100000
 #define KEY_USR_ALL     0x001f0000
 
 #define KEY_GRP_VIEW    0x00000100      /* group permissions... */
@@ -67,6 +74,38 @@ struct keyring_name;
 
 /*****************************************************************************/
 /*
+ * key reference with possession attribute handling
+ *
+ * NOTE! key_ref_t is a typedef'd pointer to a type that is not actually
+ * defined. This is because we abuse the bottom bit of the reference to carry a
+ * flag to indicate whether the calling process possesses that key in one of
+ * its keyrings.
+ *
+ * the key_ref_t has been made a separate type so that the compiler can reject
+ * attempts to dereference it without proper conversion.
+ *
+ * the three functions are used to assemble and disassemble references
+ */
+typedef struct __key_reference_with_attributes *key_ref_t;
+
+static inline key_ref_t make_key_ref(const struct key *key,
+                                     unsigned long possession)
+{
+        return (key_ref_t) ((unsigned long) key | possession);
+}
+
+static inline struct key *key_ref_to_ptr(const key_ref_t key_ref)
+{
+        return (struct key *) ((unsigned long) key_ref & ~1UL);
+}
+
+static inline unsigned long is_key_possessed(const key_ref_t key_ref)
+{
+        return (unsigned long) key_ref & 1UL;
+}
+
+/*****************************************************************************/
+/*
  * authentication token / access credential / keyring
  * - types of key include:
  *   - keyrings
@@ -215,20 +254,25 @@ static inline struct key *key_get(struct key *key)
         return key;
 }
 
+static inline void key_ref_put(key_ref_t key_ref)
+{
+        key_put(key_ref_to_ptr(key_ref));
+}
+
 extern struct key *request_key(struct key_type *type,
                                const char *description,
                                const char *callout_info);
 
 extern int key_validate(struct key *key);
 
-extern struct key *key_create_or_update(struct key *keyring,
-                                        const char *type,
-                                        const char *description,
-                                        const void *payload,
-                                        size_t plen,
-                                        int not_in_quota);
+extern key_ref_t key_create_or_update(key_ref_t keyring,
+                                      const char *type,
+                                      const char *description,
+                                      const void *payload,
+                                      size_t plen,
+                                      int not_in_quota);
 
-extern int key_update(struct key *key,
+extern int key_update(key_ref_t key,
                       const void *payload,
                       size_t plen);
 
@@ -243,9 +287,9 @@ extern struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
 
 extern int keyring_clear(struct key *keyring);
 
-extern struct key *keyring_search(struct key *keyring,
-                                  struct key_type *type,
-                                  const char *description);
+extern key_ref_t keyring_search(key_ref_t keyring,
+                                struct key_type *type,
+                                const char *description);
 
 extern int keyring_add_key(struct key *keyring,
                            struct key *key);
@@ -285,6 +329,10 @@ extern void key_init(void);
 #define key_serial(k)                   0
 #define key_get(k)                      ({ NULL; })
 #define key_put(k)                      do { } while(0)
+#define key_ref_put(k)                  do { } while(0)
+#define make_key_ref(k)                 ({ NULL; })
+#define key_ref_to_ptr(k)               ({ NULL; })
+#define is_key_possessed(k)             0
 #define alloc_uid_keyring(u)            0
 #define switch_uid_keyring(u)           do { } while(0)
 #define __install_session_keyring(t, k) ({ NULL; })
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 022105c745fc..ceee1fc42c60 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -393,6 +393,7 @@ extern int ata_pci_init_one (struct pci_dev *pdev, struct ata_port_info **port_i
 extern void ata_pci_remove_one (struct pci_dev *pdev);
 #endif /* CONFIG_PCI */
 extern int ata_device_add(struct ata_probe_ent *ent);
+extern void ata_host_set_remove(struct ata_host_set *host_set);
 extern int ata_scsi_detect(Scsi_Host_Template *sht);
 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
 extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 82d7024f0765..097b3a3c693d 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -136,6 +136,7 @@ extern unsigned int kobjsize(const void *objp);
 #define VM_EXEC         0x00000004
 #define VM_SHARED       0x00000008
 
+/* mprotect() hardcodes VM_MAYREAD >> 4 == VM_READ, and so for r/w/x bits. */
 #define VM_MAYREAD      0x00000010      /* limits for mprotect() etc */
 #define VM_MAYWRITE     0x00000020
 #define VM_MAYEXEC      0x00000040
@@ -350,7 +351,8 @@ static inline void put_page(struct page *page)
  * only one copy in memory, at most, normally.
  *
  * For the non-reserved pages, page_count(page) denotes a reference count.
- *   page_count() == 0 means the page is free.
+ *   page_count() == 0 means the page is free. page->lru is then used for
+ *   freelist management in the buddy allocator.
  *   page_count() == 1 means the page is used for exactly one purpose
  *   (e.g. a private data page of one process).
  *
@@ -376,10 +378,8 @@ static inline void put_page(struct page *page)
  * attaches, plus 1 if `private' contains something, plus one for
  * the page cache itself.
  *
- * All pages belonging to an inode are in these doubly linked lists:
- * mapping->clean_pages, mapping->dirty_pages and mapping->locked_pages;
- * using the page->list list_head. These fields are also used for
- * freelist managemet (when page_count()==0).
+ * Instead of keeping dirty/clean pages in per address-space lists, we instead
+ * now tag pages as dirty/under writeback in the radix tree.
  *
  * There is also a per-mapping radix tree mapping index to the page
  * in memory if present. The tree is rooted at mapping->root.  
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index 47da39ba3f03..2f0299a448f6 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -183,7 +183,7 @@ struct of_device_id
         char    name[32];
         char    type[32];
         char    compatible[128];
-#if __KERNEL__
+#ifdef __KERNEL__
         void    *data;
 #else
         kernel_ulong_t data;
@@ -209,10 +209,11 @@ struct pcmcia_device_id {
         /* for real multi-function devices */
         __u8            function;
 
-        /* for pseude multi-function devices */
+        /* for pseudo multi-function devices */
         __u8            device_no;
 
-        __u32           prod_id_hash[4];
+        __u32           prod_id_hash[4]
+                __attribute__((aligned(sizeof(__u32))));
 
         /* not matched against in kernelspace*/
 #ifdef __KERNEL__
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 7c717907896d..368e4c825ff1 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -265,6 +265,8 @@ struct net_device
          * the interface.
          */
         char                    name[IFNAMSIZ];
+        /* device name hash chain */
+        struct hlist_node       name_hlist;
 
         /*
          *      I/O specific fields
@@ -292,6 +294,21 @@ struct net_device
 
         /* ------- Fields preinitialized in Space.c finish here ------- */
 
+        /* Net device features */
+        unsigned long           features;
+#define NETIF_F_SG              1       /* Scatter/gather IO. */
+#define NETIF_F_IP_CSUM         2       /* Can checksum only TCP/UDP over IPv4. */
+#define NETIF_F_NO_CSUM         4       /* Does not require checksum. F.e. loopack. */
+#define NETIF_F_HW_CSUM         8       /* Can checksum all the packets. */
+#define NETIF_F_HIGHDMA         32      /* Can DMA to high memory. */
+#define NETIF_F_FRAGLIST        64      /* Scatter/gather IO. */
+#define NETIF_F_HW_VLAN_TX      128     /* Transmit VLAN hw acceleration */
+#define NETIF_F_HW_VLAN_RX      256     /* Receive VLAN hw acceleration */
+#define NETIF_F_HW_VLAN_FILTER  512     /* Receive filtering on VLAN */
+#define NETIF_F_VLAN_CHALLENGED 1024    /* Device cannot handle VLAN packets */
+#define NETIF_F_TSO             2048    /* Can offload TCP/IP segmentation */
+#define NETIF_F_LLTX            4096    /* LockLess TX */
+
         struct net_device       *next_sched;
 
         /* Interface index. Unique device identifier    */
@@ -316,9 +333,6 @@ struct net_device
          * will (read: may be cleaned up at will).
          */
 
-        /* These may be needed for future network-power-down code. */
-        unsigned long           trans_start;    /* Time (in jiffies) of last Tx */
-        unsigned long           last_rx;        /* Time of last Rx      */
 
         unsigned short          flags;  /* interface flags (a la BSD)   */
         unsigned short          gflags;
@@ -328,15 +342,12 @@ struct net_device
         unsigned                mtu;    /* interface MTU value          */
         unsigned short          type;   /* interface hardware type      */
         unsigned short          hard_header_len;        /* hardware hdr length  */
-        void                    *priv;  /* pointer to private data      */
 
         struct net_device       *master; /* Pointer to master device of a group,
                                           * which this device is member of.
                                           */
 
         /* Interface address info. */
-        unsigned char           broadcast[MAX_ADDR_LEN];        /* hw bcast add */
-        unsigned char           dev_addr[MAX_ADDR_LEN]; /* hw address   */
         unsigned char           perm_addr[MAX_ADDR_LEN]; /* permanent hw address */
         unsigned char           addr_len;       /* hardware address length      */
         unsigned short          dev_id;         /* for shared network cards */
@@ -346,8 +357,6 @@ struct net_device
         int                     promiscuity;
         int                     allmulti;
 
-        int                     watchdog_timeo;
-        struct timer_list       watchdog_timer;
 
         /* Protocol specific pointers */
         
@@ -358,32 +367,62 @@ struct net_device
         void                    *ec_ptr;        /* Econet specific data */
         void                    *ax25_ptr;      /* AX.25 specific data */
 
-        struct list_head        poll_list;      /* Link to poll list    */
+/*
+ * Cache line mostly used on receive path (including eth_type_trans())
+ */
+        struct list_head        poll_list ____cacheline_aligned_in_smp;
+                                        /* Link to poll list    */
+
+        int                     (*poll) (struct net_device *dev, int *quota);
         int                     quota;
         int                     weight;
+        unsigned long           last_rx;        /* Time of last Rx      */
+        /* Interface address info used in eth_type_trans() */
+        unsigned char           dev_addr[MAX_ADDR_LEN]; /* hw address, (before bcast 
+                                                        because most packets are unicast) */
+
+        unsigned char           broadcast[MAX_ADDR_LEN];        /* hw bcast add */
 
+/*
+ * Cache line mostly used on queue transmit path (qdisc)
+ */
+        /* device queue lock */
+        spinlock_t              queue_lock ____cacheline_aligned_in_smp;
         struct Qdisc            *qdisc;
         struct Qdisc            *qdisc_sleeping;
-        struct Qdisc            *qdisc_ingress;
         struct list_head        qdisc_list;
         unsigned long           tx_queue_len;   /* Max frames per queue allowed */
 
         /* ingress path synchronizer */
         spinlock_t              ingress_lock;
+        struct Qdisc            *qdisc_ingress;
+
+/*
+ * One part is mostly used on xmit path (device)
+ */
         /* hard_start_xmit synchronizer */
-        spinlock_t              xmit_lock;
+        spinlock_t              xmit_lock ____cacheline_aligned_in_smp;
         /* cpu id of processor entered to hard_start_xmit or -1,
            if nobody entered there.
          */
         int                     xmit_lock_owner;
-        /* device queue lock */
-        spinlock_t              queue_lock;
+        void                    *priv;  /* pointer to private data      */
+        int                     (*hard_start_xmit) (struct sk_buff *skb,
+                                                    struct net_device *dev);
+        /* These may be needed for future network-power-down code. */
+        unsigned long           trans_start;    /* Time (in jiffies) of last Tx */
+
+        int                     watchdog_timeo; /* used by dev_watchdog() */
+        struct timer_list       watchdog_timer;
+
+/*
+ * refcnt is a very hot point, so align it on SMP
+ */
         /* Number of references to this device */
-        atomic_t                refcnt;
+        atomic_t                refcnt ____cacheline_aligned_in_smp;
+
         /* delayed register/unregister */
         struct list_head        todo_list;
-        /* device name hash chain */
-        struct hlist_node       name_hlist;
         /* device index hash chain */
         struct hlist_node       index_hlist;
 
@@ -396,21 +435,6 @@ struct net_device
                NETREG_RELEASED,         /* called free_netdev */
         } reg_state;
 
-        /* Net device features */
-        unsigned long           features;
-#define NETIF_F_SG              1       /* Scatter/gather IO. */
-#define NETIF_F_IP_CSUM         2       /* Can checksum only TCP/UDP over IPv4. */
-#define NETIF_F_NO_CSUM         4       /* Does not require checksum. F.e. loopack. */
-#define NETIF_F_HW_CSUM         8       /* Can checksum all the packets. */
-#define NETIF_F_HIGHDMA         32      /* Can DMA to high memory. */
-#define NETIF_F_FRAGLIST        64      /* Scatter/gather IO. */
-#define NETIF_F_HW_VLAN_TX      128     /* Transmit VLAN hw acceleration */
-#define NETIF_F_HW_VLAN_RX      256     /* Receive VLAN hw acceleration */
-#define NETIF_F_HW_VLAN_FILTER  512     /* Receive filtering on VLAN */
-#define NETIF_F_VLAN_CHALLENGED 1024    /* Device cannot handle VLAN packets */
-#define NETIF_F_TSO             2048    /* Can offload TCP/IP segmentation */
-#define NETIF_F_LLTX            4096    /* LockLess TX */
-
         /* Called after device is detached from network. */
         void                    (*uninit)(struct net_device *dev);
         /* Called after last user reference disappears. */
@@ -419,10 +443,7 @@ struct net_device
         /* Pointers to interface service routines.      */
         int                     (*open)(struct net_device *dev);
         int                     (*stop)(struct net_device *dev);
-        int                     (*hard_start_xmit) (struct sk_buff *skb,
-                                                    struct net_device *dev);
 #define HAVE_NETDEV_POLL
-        int                     (*poll) (struct net_device *dev, int *quota);
         int                     (*hard_header) (struct sk_buff *skb,
                                                 struct net_device *dev,
                                                 unsigned short type,
diff --git a/include/linux/netfilter_ipv4/ip_conntrack.h b/include/linux/netfilter_ipv4/ip_conntrack.h
index 7e033e9271a8..4ced38736813 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack.h
@@ -133,11 +133,13 @@ enum ip_conntrack_expect_events {
 
 #include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_icmp.h>
+#include <linux/netfilter_ipv4/ip_conntrack_proto_gre.h>
 #include <linux/netfilter_ipv4/ip_conntrack_sctp.h>
 
 /* per conntrack: protocol private data */
 union ip_conntrack_proto {
         /* insert conntrack proto private data here */
+        struct ip_ct_gre gre;
         struct ip_ct_sctp sctp;
         struct ip_ct_tcp tcp;
         struct ip_ct_icmp icmp;
@@ -148,6 +150,7 @@ union ip_conntrack_expect_proto {
 };
 
 /* Add protocol helper include file here */
+#include <linux/netfilter_ipv4/ip_conntrack_pptp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_amanda.h>
 #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
@@ -155,12 +158,20 @@ union ip_conntrack_expect_proto {
 /* per conntrack: application helper private data */
 union ip_conntrack_help {
         /* insert conntrack helper private data (master) here */
+        struct ip_ct_pptp_master ct_pptp_info;
         struct ip_ct_ftp_master ct_ftp_info;
         struct ip_ct_irc_master ct_irc_info;
 };
 
 #ifdef CONFIG_IP_NF_NAT_NEEDED
 #include <linux/netfilter_ipv4/ip_nat.h>
+#include <linux/netfilter_ipv4/ip_nat_pptp.h>
+
+/* per conntrack: nat application helper private data */
+union ip_conntrack_nat_help {
+        /* insert nat helper private data here */
+        struct ip_nat_pptp nat_pptp_info;
+};
 #endif
 
 #include <linux/types.h>
@@ -223,6 +234,7 @@ struct ip_conntrack
 #ifdef CONFIG_IP_NF_NAT_NEEDED
         struct {
                 struct ip_nat_info info;
+                union ip_conntrack_nat_help help;
 #if defined(CONFIG_IP_NF_TARGET_MASQUERADE) || \
         defined(CONFIG_IP_NF_TARGET_MASQUERADE_MODULE)
                 int masq_index;
@@ -320,11 +332,28 @@ extern void need_ip_conntrack(void);
 extern int invert_tuplepr(struct ip_conntrack_tuple *inverse,
                           const struct ip_conntrack_tuple *orig);
 
+extern void __ip_ct_refresh_acct(struct ip_conntrack *ct,
+                                 enum ip_conntrack_info ctinfo,
+                                 const struct sk_buff *skb,
+                                 unsigned long extra_jiffies,
+                                 int do_acct);
+
+/* Refresh conntrack for this many jiffies and do accounting */
+static inline void ip_ct_refresh_acct(struct ip_conntrack *ct, 
+                                      enum ip_conntrack_info ctinfo,
+                                      const struct sk_buff *skb,
+                                      unsigned long extra_jiffies)
+{
+        __ip_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, 1);
+}
+
 /* Refresh conntrack for this many jiffies */
-extern void ip_ct_refresh_acct(struct ip_conntrack *ct,
-                               enum ip_conntrack_info ctinfo,
-                               const struct sk_buff *skb,
-                               unsigned long extra_jiffies);
+static inline void ip_ct_refresh(struct ip_conntrack *ct,
+                                 const struct sk_buff *skb,
+                                 unsigned long extra_jiffies)
+{
+        __ip_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);
+}
 
 /* These are for NAT.  Icky. */
 /* Update TCP window tracking data when NAT mangles the packet */
@@ -372,7 +401,7 @@ extern struct ip_conntrack_expect *
 __ip_conntrack_expect_find(const struct ip_conntrack_tuple *tuple);
 
 extern struct ip_conntrack_expect *
-ip_conntrack_expect_find_get(const struct ip_conntrack_tuple *tuple);
+ip_conntrack_expect_find(const struct ip_conntrack_tuple *tuple);
 
 extern struct ip_conntrack_tuple_hash *
 __ip_conntrack_find(const struct ip_conntrack_tuple *tuple,
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_pptp.h b/include/linux/netfilter_ipv4/ip_conntrack_pptp.h
new file mode 100644
index 000000000000..816144c75de0
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ip_conntrack_pptp.h
@@ -0,0 +1,325 @@
+/* PPTP constants and structs */
+#ifndef _CONNTRACK_PPTP_H
+#define _CONNTRACK_PPTP_H
+
+/* state of the control session */
+enum pptp_ctrlsess_state {
+        PPTP_SESSION_NONE,                      /* no session present */
+        PPTP_SESSION_ERROR,                     /* some session error */
+        PPTP_SESSION_STOPREQ,                   /* stop_sess request seen */
+        PPTP_SESSION_REQUESTED,                 /* start_sess request seen */
+        PPTP_SESSION_CONFIRMED,                 /* session established */
+};
+
+/* state of the call inside the control session */
+enum pptp_ctrlcall_state {
+        PPTP_CALL_NONE,
+        PPTP_CALL_ERROR,
+        PPTP_CALL_OUT_REQ,
+        PPTP_CALL_OUT_CONF,
+        PPTP_CALL_IN_REQ,
+        PPTP_CALL_IN_REP,
+        PPTP_CALL_IN_CONF,
+        PPTP_CALL_CLEAR_REQ,
+};
+
+
+/* conntrack private data */
+struct ip_ct_pptp_master {
+        enum pptp_ctrlsess_state sstate;        /* session state */
+
+        /* everything below is going to be per-expectation in newnat,
+         * since there could be more than one call within one session */
+        enum pptp_ctrlcall_state cstate;        /* call state */
+        u_int16_t pac_call_id;                  /* call id of PAC, host byte order */
+        u_int16_t pns_call_id;                  /* call id of PNS, host byte order */
+
+        /* in pre-2.6.11 this used to be per-expect. Now it is per-conntrack
+         * and therefore imposes a fixed limit on the number of maps */
+        struct ip_ct_gre_keymap *keymap_orig, *keymap_reply;
+};
+
+/* conntrack_expect private member */
+struct ip_ct_pptp_expect {
+        enum pptp_ctrlcall_state cstate;        /* call state */
+        u_int16_t pac_call_id;                  /* call id of PAC */
+        u_int16_t pns_call_id;                  /* call id of PNS */
+};
+
+
+#ifdef __KERNEL__
+
+#define IP_CONNTR_PPTP          PPTP_CONTROL_PORT
+
+#define PPTP_CONTROL_PORT       1723
+
+#define PPTP_PACKET_CONTROL     1
+#define PPTP_PACKET_MGMT        2
+
+#define PPTP_MAGIC_COOKIE       0x1a2b3c4d
+
+struct pptp_pkt_hdr {
+        __u16   packetLength;
+        __be16  packetType;
+        __be32  magicCookie;
+};
+
+/* PptpControlMessageType values */
+#define PPTP_START_SESSION_REQUEST      1
+#define PPTP_START_SESSION_REPLY        2
+#define PPTP_STOP_SESSION_REQUEST       3
+#define PPTP_STOP_SESSION_REPLY         4
+#define PPTP_ECHO_REQUEST               5
+#define PPTP_ECHO_REPLY                 6
+#define PPTP_OUT_CALL_REQUEST           7
+#define PPTP_OUT_CALL_REPLY             8
+#define PPTP_IN_CALL_REQUEST            9
+#define PPTP_IN_CALL_REPLY              10
+#define PPTP_IN_CALL_CONNECT            11
+#define PPTP_CALL_CLEAR_REQUEST         12
+#define PPTP_CALL_DISCONNECT_NOTIFY     13
+#define PPTP_WAN_ERROR_NOTIFY           14
+#define PPTP_SET_LINK_INFO              15
+
+#define PPTP_MSG_MAX                    15
+
+/* PptpGeneralError values */
+#define PPTP_ERROR_CODE_NONE            0
+#define PPTP_NOT_CONNECTED              1
+#define PPTP_BAD_FORMAT                 2
+#define PPTP_BAD_VALUE                  3
+#define PPTP_NO_RESOURCE                4
+#define PPTP_BAD_CALLID                 5
+#define PPTP_REMOVE_DEVICE_ERROR        6
+
+struct PptpControlHeader {
+        __be16  messageType;
+        __u16   reserved;
+};
+
+/* FramingCapability Bitmap Values */
+#define PPTP_FRAME_CAP_ASYNC            0x1
+#define PPTP_FRAME_CAP_SYNC             0x2
+
+/* BearerCapability Bitmap Values */
+#define PPTP_BEARER_CAP_ANALOG          0x1
+#define PPTP_BEARER_CAP_DIGITAL         0x2
+
+struct PptpStartSessionRequest {
+        __be16  protocolVersion;
+        __u8    reserved1;
+        __u8    reserved2;
+        __be32  framingCapability;
+        __be32  bearerCapability;
+        __be16  maxChannels;
+        __be16  firmwareRevision;
+        __u8    hostName[64];
+        __u8    vendorString[64];
+};
+
+/* PptpStartSessionResultCode Values */
+#define PPTP_START_OK                   1
+#define PPTP_START_GENERAL_ERROR        2
+#define PPTP_START_ALREADY_CONNECTED    3
+#define PPTP_START_NOT_AUTHORIZED       4
+#define PPTP_START_UNKNOWN_PROTOCOL     5
+
+struct PptpStartSessionReply {
+        __be16  protocolVersion;
+        __u8    resultCode;
+        __u8    generalErrorCode;
+        __be32  framingCapability;
+        __be32  bearerCapability;
+        __be16  maxChannels;
+        __be16  firmwareRevision;
+        __u8    hostName[64];
+        __u8    vendorString[64];
+};
+
+/* PptpStopReasons */
+#define PPTP_STOP_NONE                  1
+#define PPTP_STOP_PROTOCOL              2
+#define PPTP_STOP_LOCAL_SHUTDOWN        3
+
+struct PptpStopSessionRequest {
+        __u8    reason;
+};
+
+/* PptpStopSessionResultCode */
+#define PPTP_STOP_OK                    1
+#define PPTP_STOP_GENERAL_ERROR         2
+
+struct PptpStopSessionReply {
+        __u8    resultCode;
+        __u8    generalErrorCode;
+};
+
+struct PptpEchoRequest {
+        __be32 identNumber;
+};
+
+/* PptpEchoReplyResultCode */
+#define PPTP_ECHO_OK                    1
+#define PPTP_ECHO_GENERAL_ERROR         2
+
+struct PptpEchoReply {
+        __be32  identNumber;
+        __u8    resultCode;
+        __u8    generalErrorCode;
+        __u16   reserved;
+};
+
+/* PptpFramingType */
+#define PPTP_ASYNC_FRAMING              1
+#define PPTP_SYNC_FRAMING               2
+#define PPTP_DONT_CARE_FRAMING          3
+
+/* PptpCallBearerType */
+#define PPTP_ANALOG_TYPE                1
+#define PPTP_DIGITAL_TYPE               2
+#define PPTP_DONT_CARE_BEARER_TYPE      3
+
+struct PptpOutCallRequest {
+        __be16  callID;
+        __be16  callSerialNumber;
+        __be32  minBPS;
+        __be32  maxBPS;
+        __be32  bearerType;
+        __be32  framingType;
+        __be16  packetWindow;
+        __be16  packetProcDelay;
+        __u16   reserved1;
+        __be16  phoneNumberLength;
+        __u16   reserved2;
+        __u8    phoneNumber[64];
+        __u8    subAddress[64];
+};
+
+/* PptpCallResultCode */
+#define PPTP_OUTCALL_CONNECT            1
+#define PPTP_OUTCALL_GENERAL_ERROR      2
+#define PPTP_OUTCALL_NO_CARRIER         3
+#define PPTP_OUTCALL_BUSY               4
+#define PPTP_OUTCALL_NO_DIAL_TONE       5
+#define PPTP_OUTCALL_TIMEOUT            6
+#define PPTP_OUTCALL_DONT_ACCEPT        7
+
+struct PptpOutCallReply {
+        __be16  callID;
+        __be16  peersCallID;
+        __u8    resultCode;
+        __u8    generalErrorCode;
+        __be16  causeCode;
+        __be32  connectSpeed;
+        __be16  packetWindow;
+        __be16  packetProcDelay;
+        __be32  physChannelID;
+};
+
+struct PptpInCallRequest {
+        __be16  callID;
+        __be16  callSerialNumber;
+        __be32  callBearerType;
+        __be32  physChannelID;
+        __be16  dialedNumberLength;
+        __be16  dialingNumberLength;
+        __u8    dialedNumber[64];
+        __u8    dialingNumber[64];
+        __u8    subAddress[64];
+};
+
+/* PptpInCallResultCode */
+#define PPTP_INCALL_ACCEPT              1
+#define PPTP_INCALL_GENERAL_ERROR       2
+#define PPTP_INCALL_DONT_ACCEPT         3
+
+struct PptpInCallReply {
+        __be16  callID;
+        __be16  peersCallID;
+        __u8    resultCode;
+        __u8    generalErrorCode;
+        __be16  packetWindow;
+        __be16  packetProcDelay;
+        __u16   reserved;
+};
+
+struct PptpInCallConnected {
+        __be16  peersCallID;
+        __u16   reserved;
+        __be32  connectSpeed;
+        __be16  packetWindow;
+        __be16  packetProcDelay;
+        __be32  callFramingType;
+};
+
+struct PptpClearCallRequest {
+        __be16  callID;
+        __u16   reserved;
+};
+
+struct PptpCallDisconnectNotify {
+        __be16  callID;
+        __u8    resultCode;
+        __u8    generalErrorCode;
+        __be16  causeCode;
+        __u16   reserved;
+        __u8    callStatistics[128];
+};
+
+struct PptpWanErrorNotify {
+        __be16  peersCallID;
+        __u16   reserved;
+        __be32  crcErrors;
+        __be32  framingErrors;
+        __be32  hardwareOverRuns;
+        __be32  bufferOverRuns;
+        __be32  timeoutErrors;
+        __be32  alignmentErrors;
+};
+
+struct PptpSetLinkInfo {
+        __be16  peersCallID;
+        __u16   reserved;
+        __be32  sendAccm;
+        __be32  recvAccm;
+};
+
+union pptp_ctrl_union {
+                struct PptpStartSessionRequest  sreq;
+                struct PptpStartSessionReply    srep;
+                struct PptpStopSessionRequest   streq;
+                struct PptpStopSessionReply     strep;
+                struct PptpOutCallRequest       ocreq;
+                struct PptpOutCallReply         ocack;
+                struct PptpInCallRequest        icreq;
+                struct PptpInCallReply          icack;
+                struct PptpInCallConnected      iccon;
+                struct PptpClearCallRequest     clrreq;
+                struct PptpCallDisconnectNotify disc;
+                struct PptpWanErrorNotify       wanerr;
+                struct PptpSetLinkInfo          setlink;
+};
+
+extern int
+(*ip_nat_pptp_hook_outbound)(struct sk_buff **pskb,
+                          struct ip_conntrack *ct,
+                          enum ip_conntrack_info ctinfo,
+                          struct PptpControlHeader *ctlh,
+                          union pptp_ctrl_union *pptpReq);
+
+extern int
+(*ip_nat_pptp_hook_inbound)(struct sk_buff **pskb,
+                          struct ip_conntrack *ct,
+                          enum ip_conntrack_info ctinfo,
+                          struct PptpControlHeader *ctlh,
+                          union pptp_ctrl_union *pptpReq);
+
+extern int
+(*ip_nat_pptp_hook_exp_gre)(struct ip_conntrack_expect *exp_orig,
+                            struct ip_conntrack_expect *exp_reply);
+
+extern void
+(*ip_nat_pptp_hook_expectfn)(struct ip_conntrack *ct,
+                             struct ip_conntrack_expect *exp);
+#endif /* __KERNEL__ */
+#endif /* _CONNTRACK_PPTP_H */
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h b/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
new file mode 100644
index 000000000000..8d090ef82f5f
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h
@@ -0,0 +1,114 @@
+#ifndef _CONNTRACK_PROTO_GRE_H
+#define _CONNTRACK_PROTO_GRE_H
+#include <asm/byteorder.h>
+
+/* GRE PROTOCOL HEADER */
+
+/* GRE Version field */
+#define GRE_VERSION_1701        0x0
+#define GRE_VERSION_PPTP        0x1
+
+/* GRE Protocol field */
+#define GRE_PROTOCOL_PPTP       0x880B
+
+/* GRE Flags */
+#define GRE_FLAG_C              0x80
+#define GRE_FLAG_R              0x40
+#define GRE_FLAG_K              0x20
+#define GRE_FLAG_S              0x10
+#define GRE_FLAG_A              0x80
+
+#define GRE_IS_C(f)     ((f)&GRE_FLAG_C)
+#define GRE_IS_R(f)     ((f)&GRE_FLAG_R)
+#define GRE_IS_K(f)     ((f)&GRE_FLAG_K)
+#define GRE_IS_S(f)     ((f)&GRE_FLAG_S)
+#define GRE_IS_A(f)     ((f)&GRE_FLAG_A)
+
+/* GRE is a mess: Four different standards */
+struct gre_hdr {
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        __u16   rec:3,
+                srr:1,
+                seq:1,
+                key:1,
+                routing:1,
+                csum:1,
+                version:3,
+                reserved:4,
+                ack:1;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+        __u16   csum:1,
+                routing:1,
+                key:1,
+                seq:1,
+                srr:1,
+                rec:3,
+                ack:1,
+                reserved:4,
+                version:3;
+#else
+#error "Adjust your <asm/byteorder.h> defines"
+#endif
+        __u16   protocol;
+};
+
+/* modified GRE header for PPTP */
+struct gre_hdr_pptp {
+        __u8  flags;            /* bitfield */
+        __u8  version;          /* should be GRE_VERSION_PPTP */
+        __u16 protocol;         /* should be GRE_PROTOCOL_PPTP */
+        __u16 payload_len;      /* size of ppp payload, not inc. gre header */
+        __u16 call_id;          /* peer's call_id for this session */
+        __u32 seq;              /* sequence number.  Present if S==1 */
+        __u32 ack;              /* seq number of highest packet recieved by */
+                                /*  sender in this session */
+};
+
+
+/* this is part of ip_conntrack */
+struct ip_ct_gre {
+        unsigned int stream_timeout;
+        unsigned int timeout;
+};
+
+#ifdef __KERNEL__
+struct ip_conntrack_expect;
+struct ip_conntrack;
+
+/* structure for original <-> reply keymap */
+struct ip_ct_gre_keymap {
+        struct list_head list;
+
+        struct ip_conntrack_tuple tuple;
+};
+
+/* add new tuple->key_reply pair to keymap */
+int ip_ct_gre_keymap_add(struct ip_conntrack *ct,
+                         struct ip_conntrack_tuple *t,
+                         int reply);
+
+/* delete keymap entries */
+void ip_ct_gre_keymap_destroy(struct ip_conntrack *ct);
+
+
+/* get pointer to gre key, if present */
+static inline u_int32_t *gre_key(struct gre_hdr *greh)
+{
+        if (!greh->key)
+                return NULL;
+        if (greh->csum || greh->routing)
+                return (u_int32_t *) (greh+sizeof(*greh)+4);
+        return (u_int32_t *) (greh+sizeof(*greh));
+}
+
+/* get pointer ot gre csum, if present */
+static inline u_int16_t *gre_csum(struct gre_hdr *greh)
+{
+        if (!greh->csum)
+                return NULL;
+        return (u_int16_t *) (greh+sizeof(*greh));
+}
+
+#endif /* __KERNEL__ */
+
+#endif /* _CONNTRACK_PROTO_GRE_H */
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_tuple.h b/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
index c33f0b5e0d0a..20e43f018b7c 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
@@ -17,7 +17,7 @@ union ip_conntrack_manip_proto
         u_int16_t all;
 
         struct {
-                u_int16_t port;
+                __be16 port;
         } tcp;
         struct {
                 u_int16_t port;
@@ -28,6 +28,9 @@ union ip_conntrack_manip_proto
         struct {
                 u_int16_t port;
         } sctp;
+        struct {
+                __be16 key;     /* key is 32bit, pptp only uses 16 */
+        } gre;
 };
 
 /* The manipulable part of the tuple. */
@@ -61,6 +64,10 @@ struct ip_conntrack_tuple
                         struct {
                                 u_int16_t port;
                         } sctp;
+                        struct {
+                                __be16 key;     /* key is 32bit, 
+                                                 * pptp only uses 16 */
+                        } gre;
                 } u;
 
                 /* The protocol. */
diff --git a/include/linux/netfilter_ipv4/ip_nat_core.h b/include/linux/netfilter_ipv4/ip_nat_core.h
index 3b50eb91f007..30db23f06b03 100644
--- a/include/linux/netfilter_ipv4/ip_nat_core.h
+++ b/include/linux/netfilter_ipv4/ip_nat_core.h
@@ -5,16 +5,14 @@
 
 /* This header used to share core functionality between the standalone
    NAT module, and the compatibility layer's use of NAT for masquerading. */
-extern int ip_nat_init(void);
-extern void ip_nat_cleanup(void);
 
-extern unsigned int nat_packet(struct ip_conntrack *ct,
+extern unsigned int ip_nat_packet(struct ip_conntrack *ct,
                                enum ip_conntrack_info conntrackinfo,
                                unsigned int hooknum,
                                struct sk_buff **pskb);
 
-extern int icmp_reply_translation(struct sk_buff **pskb,
-                                  struct ip_conntrack *ct,
-                                  enum ip_nat_manip_type manip,
-                                  enum ip_conntrack_dir dir);
+extern int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
+                                         struct ip_conntrack *ct,
+                                         enum ip_nat_manip_type manip,
+                                         enum ip_conntrack_dir dir);
 #endif /* _IP_NAT_CORE_H */
diff --git a/include/linux/netfilter_ipv4/ip_nat_pptp.h b/include/linux/netfilter_ipv4/ip_nat_pptp.h
new file mode 100644
index 000000000000..eaf66c2e8f93
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ip_nat_pptp.h
@@ -0,0 +1,11 @@
+/* PPTP constants and structs */
+#ifndef _NAT_PPTP_H
+#define _NAT_PPTP_H
+
+/* conntrack private data */
+struct ip_nat_pptp {
+        u_int16_t pns_call_id;          /* NAT'ed PNS call id */
+        u_int16_t pac_call_id;          /* NAT'ed PAC call id */
+};
+
+#endif /* _NAT_PPTP_H */
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index 58c72a52dc65..59f70b34e029 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -455,6 +455,9 @@ extern unsigned int ip6t_do_table(struct sk_buff **pskb,
 
 /* Check for an extension */
 extern int ip6t_ext_hdr(u8 nexthdr);
+/* find specified header and get offset to it */
+extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
+                         u8 target);
 
 #define IP6T_ALIGN(s) (((s) + (__alignof__(struct ip6t_entry)-1)) & ~(__alignof__(struct ip6t_entry)-1))
 
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 7bbd25970c9e..bdebdc564506 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -20,6 +20,7 @@
 #define NETLINK_IP6_FW          13
 #define NETLINK_DNRTMSG         14      /* DECnet routing messages */
 #define NETLINK_KOBJECT_UEVENT  15      /* Kernel messages to userspace */
+#define NETLINK_GENERIC         16
 
 #define MAX_LINKS 32            
 
diff --git a/include/linux/nfsd/xdr4.h b/include/linux/nfsd/xdr4.h
index 4d24d65c0e88..8903688890ce 100644
--- a/include/linux/nfsd/xdr4.h
+++ b/include/linux/nfsd/xdr4.h
@@ -438,17 +438,22 @@ extern int nfsd4_process_open1(struct nfsd4_open *open);
 extern int nfsd4_process_open2(struct svc_rqst *rqstp, 
                 struct svc_fh *current_fh, struct nfsd4_open *open);
 extern int nfsd4_open_confirm(struct svc_rqst *rqstp, 
-                struct svc_fh *current_fh, struct nfsd4_open_confirm *oc);
+                struct svc_fh *current_fh, struct nfsd4_open_confirm *oc,
+                struct nfs4_stateowner **);
 extern  int nfsd4_close(struct svc_rqst *rqstp, struct svc_fh *current_fh, 
-                struct nfsd4_close *close);
+                struct nfsd4_close *close,
+                struct nfs4_stateowner **replay_owner);
 extern int nfsd4_open_downgrade(struct svc_rqst *rqstp, 
-                struct svc_fh *current_fh, struct nfsd4_open_downgrade *od);
+                struct svc_fh *current_fh, struct nfsd4_open_downgrade *od,
+                struct nfs4_stateowner **replay_owner);
 extern int nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, 
-                struct nfsd4_lock *lock);
+                struct nfsd4_lock *lock,
+                struct nfs4_stateowner **replay_owner);
 extern int nfsd4_lockt(struct svc_rqst *rqstp, struct svc_fh *current_fh, 
                 struct nfsd4_lockt *lockt);
 extern int nfsd4_locku(struct svc_rqst *rqstp, struct svc_fh *current_fh, 
-                struct nfsd4_locku *locku);
+                struct nfsd4_locku *locku,
+                struct nfs4_stateowner **replay_owner);
 extern int
 nfsd4_release_lockowner(struct svc_rqst *rqstp,
                 struct nfsd4_release_lockowner *rlockowner);
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index ee0ab7a5f91b..f74ed9462475 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -185,6 +185,7 @@
 #define PCI_DEVICE_ID_LSI_61C102        0x0901
 #define PCI_DEVICE_ID_LSI_63C815        0x1000
 #define PCI_DEVICE_ID_LSI_SAS1064       0x0050
+#define PCI_DEVICE_ID_LSI_SAS1064R      0x0411
 #define PCI_DEVICE_ID_LSI_SAS1066       0x005E
 #define PCI_DEVICE_ID_LSI_SAS1068       0x0054
 #define PCI_DEVICE_ID_LSI_SAS1064A      0x005C
@@ -392,6 +393,7 @@
 #define PCI_DEVICE_ID_NS_87560_USB      0x0012
 #define PCI_DEVICE_ID_NS_83815          0x0020
 #define PCI_DEVICE_ID_NS_83820          0x0022
+#define PCI_DEVICE_ID_NS_SATURN         0x0035
 #define PCI_DEVICE_ID_NS_SCx200_BRIDGE  0x0500
 #define PCI_DEVICE_ID_NS_SCx200_SMI     0x0501
 #define PCI_DEVICE_ID_NS_SCx200_IDE     0x0502
@@ -447,6 +449,10 @@
 #define PCI_DEVICE_ID_CIRRUS_7542       0x1200
 #define PCI_DEVICE_ID_CIRRUS_7543       0x1202
 #define PCI_DEVICE_ID_CIRRUS_7541       0x1204
+#define PCI_DEVICE_ID_CIRRUS_4610       0x6001
+#define PCI_DEVICE_ID_CIRRUS_4612       0x6003
+#define PCI_DEVICE_ID_CIRRUS_4615       0x6004
+#define PCI_DEVICE_ID_CIRRUS_4281       0x6005
 
 #define PCI_VENDOR_ID_IBM               0x1014
 #define PCI_DEVICE_ID_IBM_FIRE_CORAL    0x000a
@@ -487,6 +493,7 @@
 #define PCI_DEVICE_ID_AMI_MEGARAID2     0x9060
 
 #define PCI_VENDOR_ID_AMD               0x1022
+#define PCI_DEVICE_ID_AMD_K8_NB         0x1100
 #define PCI_DEVICE_ID_AMD_LANCE         0x2000
 #define PCI_DEVICE_ID_AMD_LANCE_HOME    0x2001
 #define PCI_DEVICE_ID_AMD_SCSI          0x2020
@@ -554,6 +561,7 @@
 #define PCI_VENDOR_ID_DELL              0x1028
 #define PCI_DEVICE_ID_DELL_RACIII       0x0008
 #define PCI_DEVICE_ID_DELL_RAC4         0x0012
+#define PCI_DEVICE_ID_DELL_PERC5        0x0015
 
 #define PCI_VENDOR_ID_MATROX            0x102B
 #define PCI_DEVICE_ID_MATROX_MGA_2      0x0518
@@ -682,7 +690,9 @@
 #define PCI_DEVICE_ID_SI_6326           0x6326
 #define PCI_DEVICE_ID_SI_7001           0x7001
 #define PCI_DEVICE_ID_SI_7012           0x7012
+#define PCI_DEVICE_ID_SI_7013           0x7013
 #define PCI_DEVICE_ID_SI_7016           0x7016
+#define PCI_DEVICE_ID_SI_7018           0x7018
 
 #define PCI_VENDOR_ID_HP                0x103c
 #define PCI_DEVICE_ID_HP_VISUALIZE_EG   0x1005
@@ -713,10 +723,12 @@
 #define PCI_DEVICE_ID_HP_DIVA_EVEREST   0x1282
 #define PCI_DEVICE_ID_HP_DIVA_AUX       0x1290
 #define PCI_DEVICE_ID_HP_DIVA_RMP3      0x1301
+#define PCI_DEVICE_ID_HP_CISS           0x3210
 #define PCI_DEVICE_ID_HP_CISSA          0x3220
 #define PCI_DEVICE_ID_HP_CISSB          0x3222
-#define PCI_DEVICE_ID_HP_ZX2_IOC        0x4031
 #define PCI_DEVICE_ID_HP_CISSC          0x3230
+#define PCI_DEVICE_ID_HP_CISSD          0x3238
+#define PCI_DEVICE_ID_HP_ZX2_IOC        0x4031
 
 #define PCI_VENDOR_ID_PCTECH            0x1042
 #define PCI_DEVICE_ID_PCTECH_RZ1000     0x1000
@@ -760,6 +772,8 @@
 #define PCI_DEVICE_ID_TI_TVP4010        0x3d04
 #define PCI_DEVICE_ID_TI_TVP4020        0x3d07
 #define PCI_DEVICE_ID_TI_4450           0x8011
+#define PCI_DEVICE_ID_TI_XX21_XX11      0x8031
+#define PCI_DEVICE_ID_TI_X515           0x8036
 #define PCI_DEVICE_ID_TI_1130           0xac12
 #define PCI_DEVICE_ID_TI_1031           0xac13
 #define PCI_DEVICE_ID_TI_1131           0xac15
@@ -776,12 +790,17 @@
 #define PCI_DEVICE_ID_TI_4451           0xac42
 #define PCI_DEVICE_ID_TI_4510           0xac44
 #define PCI_DEVICE_ID_TI_4520           0xac46
+#define PCI_DEVICE_ID_TI_7510           0xac47
+#define PCI_DEVICE_ID_TI_7610           0xac48
+#define PCI_DEVICE_ID_TI_7410           0xac49
 #define PCI_DEVICE_ID_TI_1410           0xac50
 #define PCI_DEVICE_ID_TI_1420           0xac51
 #define PCI_DEVICE_ID_TI_1451A          0xac52
 #define PCI_DEVICE_ID_TI_1620           0xac54
 #define PCI_DEVICE_ID_TI_1520           0xac55
 #define PCI_DEVICE_ID_TI_1510           0xac56
+#define PCI_DEVICE_ID_TI_X620           0xac8d
+#define PCI_DEVICE_ID_TI_X420           0xac8e
 
 #define PCI_VENDOR_ID_SONY              0x104d
 #define PCI_DEVICE_ID_SONY_CXD3222      0x8039
@@ -967,6 +986,7 @@
 #define PCI_DEVICE_ID_SUN_SABRE         0xa000
 #define PCI_DEVICE_ID_SUN_HUMMINGBIRD   0xa001
 #define PCI_DEVICE_ID_SUN_TOMATILLO     0xa801
+#define PCI_DEVICE_ID_SUN_CASSINI       0xabba
 
 #define PCI_VENDOR_ID_CMD               0x1095
 #define PCI_DEVICE_ID_CMD_640           0x0640
@@ -991,6 +1011,7 @@
 #define PCI_DEVICE_ID_BROOKTREE_849A    0x0351
 #define PCI_DEVICE_ID_BROOKTREE_878_1   0x036e
 #define PCI_DEVICE_ID_BROOKTREE_878     0x0878
+#define PCI_DEVICE_ID_BROOKTREE_879     0x0879
 #define PCI_DEVICE_ID_BROOKTREE_8474    0x8474
 
 #define PCI_VENDOR_ID_SIERRA            0x10a8
@@ -1109,6 +1130,9 @@
 #define PCI_DEVICE_ID_NEOMAGIC_MAGICGRAPH_NM2160 0x0004
 #define PCI_DEVICE_ID_NEOMAGIC_MAGICMEDIA_256AV       0x0005
 #define PCI_DEVICE_ID_NEOMAGIC_MAGICGRAPH_128ZVPLUS   0x0083
+#define PCI_DEVICE_ID_NEOMAGIC_NM256AV_AUDIO 0x8005
+#define PCI_DEVICE_ID_NEOMAGIC_NM256ZX_AUDIO 0x8006
+#define PCI_DEVICE_ID_NEOMAGIC_NM256XL_PLUS_AUDIO 0x8016
 
 #define PCI_VENDOR_ID_ASP               0x10cd
 #define PCI_DEVICE_ID_ASP_ABP940        0x1200
@@ -1155,10 +1179,13 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2_SMBUS      0x0064
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2_IDE        0x0065
 #define PCI_DEVICE_ID_NVIDIA_NVENET_2           0x0066
+#define PCI_DEVICE_ID_NVIDIA_MCP2_MODEM         0x0069
 #define PCI_DEVICE_ID_NVIDIA_MCP2_AUDIO         0x006a
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2S_SMBUS     0x0084
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2S_IDE       0x0085
 #define PCI_DEVICE_ID_NVIDIA_NVENET_4           0x0086
+#define PCI_DEVICE_ID_NVIDIA_MCP2S_MODEM        0x0089
+#define PCI_DEVICE_ID_NVIDIA_CK8_AUDIO          0x008a
 #define PCI_DEVICE_ID_NVIDIA_NVENET_5           0x008c
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2S_SATA      0x008e
 #define PCI_DEVICE_ID_NVIDIA_ITNT2              0x00A0
@@ -1173,6 +1200,7 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3_SMBUS      0x00d4
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3_IDE        0x00d5
 #define PCI_DEVICE_ID_NVIDIA_NVENET_3           0x00d6
+#define PCI_DEVICE_ID_NVIDIA_MCP3_MODEM         0x00d9
 #define PCI_DEVICE_ID_NVIDIA_MCP3_AUDIO         0x00da
 #define PCI_DEVICE_ID_NVIDIA_NVENET_7           0x00df
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S           0x00e1
@@ -1180,6 +1208,7 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_SMBUS     0x00e4
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_IDE       0x00e5
 #define PCI_DEVICE_ID_NVIDIA_NVENET_6           0x00e6
+#define PCI_DEVICE_ID_NVIDIA_CK8S_AUDIO         0x00ea
 #define PCI_DEVICE_ID_NVIDIA_NFORCE3S_SATA2     0x00ee
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_SDR        0x0100
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE_DDR        0x0101
@@ -1230,6 +1259,7 @@
 #define PCI_DEVICE_ID_NVIDIA_MCP1_AUDIO         0x01b1
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_SMBUS       0x01b4
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_IDE         0x01bc
+#define PCI_DEVICE_ID_NVIDIA_MCP1_MODEM         0x01c1
 #define PCI_DEVICE_ID_NVIDIA_NVENET_1           0x01c3
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2            0x01e0
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE3           0x0200
@@ -1249,7 +1279,8 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA  0x0266
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2 0x0267
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_IDE   0x036E
-#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA  0x036F
+#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA  0x037E
+#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2 0x037F
 #define PCI_DEVICE_ID_NVIDIA_NVENET_12          0x0268
 #define PCI_DEVICE_ID_NVIDIA_NVENET_13          0x0269
 #define PCI_DEVICE_ID_NVIDIA_MCP51_AUDIO        0x026B
@@ -1334,6 +1365,13 @@
 #define PCI_DEVICE_ID_REALTEK_8169      0x8169
 
 #define PCI_VENDOR_ID_XILINX            0x10ee
+#define PCI_DEVICE_ID_RME_DIGI96        0x3fc0
+#define PCI_DEVICE_ID_RME_DIGI96_8      0x3fc1
+#define PCI_DEVICE_ID_RME_DIGI96_8_PRO  0x3fc2
+#define PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST 0x3fc3
+#define PCI_DEVICE_ID_XILINX_HAMMERFALL 0x3fc4
+#define PCI_DEVICE_ID_XILINX_HAMMERFALL_DSP 0x3fc5
+#define PCI_DEVICE_ID_XILINX_HAMMERFALL_DSP_MADI 0x3fc6
 #define PCI_DEVICE_ID_TURBOPAM          0x4020
 
 #define PCI_VENDOR_ID_TRUEVISION        0x10fa
@@ -1809,6 +1847,14 @@
 #define PCI_DEVICE_ID_ESS_ESS1968       0x1968
 #define PCI_DEVICE_ID_ESS_AUDIOPCI      0x1969
 #define PCI_DEVICE_ID_ESS_ESS1978       0x1978
+#define PCI_DEVICE_ID_ESS_ALLEGRO_1     0x1988
+#define PCI_DEVICE_ID_ESS_ALLEGRO       0x1989
+#define PCI_DEVICE_ID_ESS_CANYON3D_2LE  0x1990
+#define PCI_DEVICE_ID_ESS_CANYON3D_2    0x1992
+#define PCI_DEVICE_ID_ESS_MAESTRO3      0x1998
+#define PCI_DEVICE_ID_ESS_MAESTRO3_1    0x1999
+#define PCI_DEVICE_ID_ESS_MAESTRO3_HW   0x199a
+#define PCI_DEVICE_ID_ESS_MAESTRO3_2    0x199b
 
 #define PCI_VENDOR_ID_SATSAGEM          0x1267
 #define PCI_DEVICE_ID_SATSAGEM_NICCY    0x1016
@@ -1968,6 +2014,9 @@
 #define PCI_DEVICE_ID_LMC_SSI           0x0005
 #define PCI_DEVICE_ID_LMC_T1            0x0006
 
+#define PCI_VENDOR_ID_MARIAN            0x1382
+#define PCI_DEVICE_ID_MARIAN_PRODIF_PLUS 0x2048
+
 #define PCI_VENDOR_ID_NETGEAR           0x1385
 #define PCI_DEVICE_ID_NETGEAR_GA620     0x620a
 #define PCI_DEVICE_ID_NETGEAR_GA622     0x622a
@@ -2056,6 +2105,10 @@
 #define PCI_VENDOR_ID_TIMEDIA           0x1409
 #define PCI_DEVICE_ID_TIMEDIA_1889      0x7168
 
+#define PCI_VENDOR_ID_ICE               0x1412
+#define PCI_DEVICE_ID_ICE_1712          0x1712
+#define PCI_DEVICE_ID_VT1724            0x1724
+
 #define PCI_VENDOR_ID_OXSEMI            0x1415
 #define PCI_DEVICE_ID_OXSEMI_12PCI840   0x8403
 #define PCI_DEVICE_ID_OXSEMI_16PCI954   0x9501
@@ -2145,7 +2198,12 @@
 #define PCI_DEVICE_ID_ENE_1211          0x1211
 #define PCI_DEVICE_ID_ENE_1225          0x1225
 #define PCI_DEVICE_ID_ENE_1410          0x1410
+#define PCI_DEVICE_ID_ENE_710           0x1411
+#define PCI_DEVICE_ID_ENE_712           0x1412
 #define PCI_DEVICE_ID_ENE_1420          0x1420
+#define PCI_DEVICE_ID_ENE_720           0x1421
+#define PCI_DEVICE_ID_ENE_722           0x1422
+
 #define PCI_VENDOR_ID_CHELSIO           0x1425
 
 #define PCI_VENDOR_ID_MIPS              0x153f
@@ -2212,6 +2270,9 @@
 
 #define PCI_VENDOR_ID_INFINICON         0x1820
 
+#define PCI_VENDOR_ID_SITECOM           0x182d
+#define PCI_DEVICE_ID_SITECOM_DC105V2   0x3069
+
 #define PCI_VENDOR_ID_TOPSPIN           0x1867
 
 #define PCI_VENDOR_ID_TDI               0x192E
@@ -2536,6 +2597,7 @@
 #define PCI_DEVICE_ID_INTEL_82443BX_1   0x7191
 #define PCI_DEVICE_ID_INTEL_82443BX_2   0x7192
 #define PCI_DEVICE_ID_INTEL_440MX       0x7195
+#define PCI_DEVICE_ID_INTEL_440MX_6     0x7196
 #define PCI_DEVICE_ID_INTEL_82443MX_0   0x7198
 #define PCI_DEVICE_ID_INTEL_82443MX_1   0x7199
 #define PCI_DEVICE_ID_INTEL_82443MX_2   0x719a
@@ -2642,6 +2704,11 @@
 #define PCI_VENDOR_ID_TTTECH            0x0357
 #define PCI_DEVICE_ID_TTTECH_MC322      0x000A
 
+#define PCI_VENDOR_ID_XILINX_RME        0xea60
+#define PCI_DEVICE_ID_RME_DIGI32        0x9896
+#define PCI_DEVICE_ID_RME_DIGI32_PRO    0x9897
+#define PCI_DEVICE_ID_RME_DIGI32_8      0x9898
+
 #define PCI_VENDOR_ID_ARK               0xedd8
 #define PCI_DEVICE_ID_ARK_STING         0xa091
 #define PCI_DEVICE_ID_ARK_STINGARK      0xa099
diff --git a/include/linux/pktcdvd.h b/include/linux/pktcdvd.h
index 4b32bce9a289..2c177e4c8f22 100644
--- a/include/linux/pktcdvd.h
+++ b/include/linux/pktcdvd.h
@@ -166,6 +166,9 @@ struct packet_iosched
 /*
  * 32 buffers of 2048 bytes
  */
+#if (PAGE_SIZE % CD_FRAMESIZE) != 0
+#error "PAGE_SIZE must be a multiple of CD_FRAMESIZE"
+#endif
 #define PACKET_MAX_SIZE         32
 #define PAGES_PER_PACKET        (PACKET_MAX_SIZE * CD_FRAMESIZE / PAGE_SIZE)
 #define PACKET_MAX_SECTORS      (PACKET_MAX_SIZE * CD_FRAMESIZE >> 9)
diff --git a/include/linux/reboot.h b/include/linux/reboot.h
index 3b3266ff1a95..7ab2cdb83ef0 100644
--- a/include/linux/reboot.h
+++ b/include/linux/reboot.h
@@ -59,6 +59,10 @@ extern void machine_crash_shutdown(struct pt_regs *);
  * Architecture independent implemenations of sys_reboot commands.
  */
 
+extern void kernel_restart_prepare(char *cmd);
+extern void kernel_halt_prepare(void);
+extern void kernel_power_off_prepare(void);
+
 extern void kernel_restart(char *cmd);
 extern void kernel_halt(void);
 extern void kernel_power_off(void);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 38c8654aaa96..c3ba31f210a9 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -107,13 +107,25 @@ extern unsigned long nr_iowait(void);
 
 #include <asm/processor.h>
 
+/*
+ * Task state bitmask. NOTE! These bits are also
+ * encoded in fs/proc/array.c: get_task_state().
+ *
+ * We have two separate sets of flags: task->state
+ * is about runnability, while task->exit_state are
+ * about the task exiting. Confusing, but this way
+ * modifying one set can't modify the other one by
+ * mistake.
+ */
 #define TASK_RUNNING            0
 #define TASK_INTERRUPTIBLE      1
 #define TASK_UNINTERRUPTIBLE    2
 #define TASK_STOPPED            4
 #define TASK_TRACED             8
+/* in tsk->exit_state */
 #define EXIT_ZOMBIE             16
 #define EXIT_DEAD               32
+/* in tsk->state again */
 #define TASK_NONINTERACTIVE     64
 
 #define __set_task_state(tsk, state_value)              \
@@ -121,6 +133,17 @@ extern unsigned long nr_iowait(void);
 #define set_task_state(tsk, state_value)                \
         set_mb((tsk)->state, (state_value))
 
+/*
+ * set_current_state() includes a barrier so that the write of current->state
+ * is correctly serialised wrt the caller's subsequent test of whether to
+ * actually sleep:
+ *
+ *      set_current_state(TASK_UNINTERRUPTIBLE);
+ *      if (do_i_need_to_sleep())
+ *              schedule();
+ *
+ * If the caller does not need such serialisation then use __set_current_state()
+ */
 #define __set_current_state(state_value)                        \
         do { current->state = (state_value); } while (0)
 #define set_current_state(state_value)          \
diff --git a/include/linux/security.h b/include/linux/security.h
index 55b02e1c73f4..0e43460d374e 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1907,6 +1907,11 @@ extern int register_security	(struct security_operations *ops);
 extern int unregister_security  (struct security_operations *ops);
 extern int mod_reg_security     (const char *name, struct security_operations *ops);
 extern int mod_unreg_security   (const char *name, struct security_operations *ops);
+extern struct dentry *securityfs_create_file(const char *name, mode_t mode,
+                                             struct dentry *parent, void *data,
+                                             struct file_operations *fops);
+extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
+extern void securityfs_remove(struct dentry *dentry);
 
 
 #else /* CONFIG_SECURITY */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 2741c0c55e83..466c879f82b8 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -155,8 +155,6 @@ struct skb_shared_info {
 #define SKB_DATAREF_SHIFT 16
 #define SKB_DATAREF_MASK ((1 << SKB_DATAREF_SHIFT) - 1)
 
-extern struct timeval skb_tv_base;
-
 struct skb_timeval {
         u32     off_sec;
         u32     off_usec;
@@ -175,7 +173,7 @@ enum {
  *      @prev: Previous buffer in list
  *      @list: List we are on
  *      @sk: Socket we are owned by
- *      @tstamp: Time we arrived stored as offset to skb_tv_base
+ *      @tstamp: Time we arrived
  *      @dev: Device we arrived on/are leaving by
  *      @input_dev: Device we arrived on
  *      @h: Transport layer header
@@ -1255,10 +1253,6 @@ static inline void skb_get_timestamp(const struct sk_buff *skb, struct timeval *
 {
         stamp->tv_sec  = skb->tstamp.off_sec;
         stamp->tv_usec = skb->tstamp.off_usec;
-        if (skb->tstamp.off_sec) {
-                stamp->tv_sec  += skb_tv_base.tv_sec;
-                stamp->tv_usec += skb_tv_base.tv_usec;
-        }
 }
 
 /**
@@ -1272,8 +1266,8 @@ static inline void skb_get_timestamp(const struct sk_buff *skb, struct timeval *
  */
 static inline void skb_set_timestamp(struct sk_buff *skb, const struct timeval *stamp)
 {
-        skb->tstamp.off_sec  = stamp->tv_sec - skb_tv_base.tv_sec;
-        skb->tstamp.off_usec = stamp->tv_usec - skb_tv_base.tv_usec;
+        skb->tstamp.off_sec  = stamp->tv_sec;
+        skb->tstamp.off_usec = stamp->tv_usec;
 }
 
 extern void __net_timestamp(struct sk_buff *skb);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 425f58c8ea4a..a6f03e473737 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -508,5 +508,7 @@ asmlinkage long sys_keyctl(int cmd, unsigned long arg2, unsigned long arg3,
 
 asmlinkage long sys_ioprio_set(int which, int who, int ioprio);
 asmlinkage long sys_ioprio_get(int which, int who);
+asmlinkage long sys_set_mempolicy(int mode, unsigned long __user *nmask,
+                                        unsigned long maxnode);
 
 #endif
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 3a29a9f9b451..fc8e367f671e 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -202,7 +202,8 @@ enum
         NET_TR=14,
         NET_DECNET=15,
         NET_ECONET=16,
-        NET_SCTP=17, 
+        NET_SCTP=17,
+        NET_LLC=18,
 };
 
 /* /proc/sys/kernel/random */
@@ -522,6 +523,29 @@ enum {
         NET_IPX_FORWARDING=2
 };
 
+/* /proc/sys/net/llc */
+enum {
+        NET_LLC2=1,
+        NET_LLC_STATION=2,
+};
+
+/* /proc/sys/net/llc/llc2 */
+enum {
+        NET_LLC2_TIMEOUT=1,
+};
+
+/* /proc/sys/net/llc/station */
+enum {
+        NET_LLC_STATION_ACK_TIMEOUT=1,
+};
+
+/* /proc/sys/net/llc/llc2/timeout */
+enum {
+        NET_LLC2_ACK_TIMEOUT=1,
+        NET_LLC2_P_TIMEOUT=2,
+        NET_LLC2_REJ_TIMEOUT=3,
+        NET_LLC2_BUSY_TIMEOUT=4,
+};
 
 /* /proc/sys/net/appletalk */
 enum {
diff --git a/include/linux/tc_ematch/tc_em_meta.h b/include/linux/tc_ematch/tc_em_meta.h
index 081b1ee8516e..e21937cf91d0 100644
--- a/include/linux/tc_ematch/tc_em_meta.h
+++ b/include/linux/tc_ematch/tc_em_meta.h
@@ -71,7 +71,7 @@ enum
         TCF_META_ID_SK_SNDBUF,
         TCF_META_ID_SK_ALLOCS,
         TCF_META_ID_SK_ROUTE_CAPS,
-        TCF_META_ID_SK_HASHENT,
+        TCF_META_ID_SK_HASH,
         TCF_META_ID_SK_LINGERTIME,
         TCF_META_ID_SK_ACK_BACKLOG,
         TCF_META_ID_SK_MAX_ACK_BACKLOG,
diff --git a/include/linux/tfrc.h b/include/linux/tfrc.h
new file mode 100644
index 000000000000..7dab7831c3cb
--- /dev/null
+++ b/include/linux/tfrc.h
@@ -0,0 +1,35 @@
+#ifndef _LINUX_TFRC_H_
+#define _LINUX_TFRC_H_
+/*
+ *  include/linux/tfrc.h
+ *
+ *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
+ *  Copyright (c) 2005 Ian McDonald <iam4@cs.waikato.ac.nz>
+ *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@conectiva.com.br>
+ *  Copyright (c) 2003 Nils-Erik Mattsson, Joacim Haggmark, Magnus Erixzon
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ */
+
+#include <linux/types.h>
+
+struct tfrc_rx_info {
+        __u32 tfrcrx_x_recv;
+        __u32 tfrcrx_rtt;
+        __u32 tfrcrx_p;
+};
+
+struct tfrc_tx_info {
+        __u32 tfrctx_x;
+        __u32 tfrctx_x_recv;
+        __u32 tfrctx_x_calc;
+        __u32 tfrctx_rtt;
+        __u32 tfrctx_p;
+        __u32 tfrctx_rto;
+        __u32 tfrctx_ipi;
+};
+
+#endif /* _LINUX_TFRC_H_ */
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index f623a33b9abe..89a055761bed 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -60,12 +60,17 @@ enum v4l2_field {
          (field) == V4L2_FIELD_SEQ_BT)
 
 enum v4l2_buf_type {
-        V4L2_BUF_TYPE_VIDEO_CAPTURE  = 1,
-        V4L2_BUF_TYPE_VIDEO_OUTPUT   = 2,
-        V4L2_BUF_TYPE_VIDEO_OVERLAY  = 3,
-        V4L2_BUF_TYPE_VBI_CAPTURE    = 4,
-        V4L2_BUF_TYPE_VBI_OUTPUT     = 5,
-        V4L2_BUF_TYPE_PRIVATE        = 0x80,
+        V4L2_BUF_TYPE_VIDEO_CAPTURE      = 1,
+        V4L2_BUF_TYPE_VIDEO_OUTPUT       = 2,
+        V4L2_BUF_TYPE_VIDEO_OVERLAY      = 3,
+        V4L2_BUF_TYPE_VBI_CAPTURE        = 4,
+        V4L2_BUF_TYPE_VBI_OUTPUT         = 5,
+#if 1
+        /* Experimental Sliced VBI */
+        V4L2_BUF_TYPE_SLICED_VBI_CAPTURE = 6,
+        V4L2_BUF_TYPE_SLICED_VBI_OUTPUT  = 7,
+#endif
+        V4L2_BUF_TYPE_PRIVATE            = 0x80,
 };
 
 enum v4l2_ctrl_type {
@@ -149,20 +154,24 @@ struct v4l2_capability
 };
 
 /* Values for 'capabilities' field */
-#define V4L2_CAP_VIDEO_CAPTURE  0x00000001  /* Is a video capture device */
-#define V4L2_CAP_VIDEO_OUTPUT   0x00000002  /* Is a video output device */
-#define V4L2_CAP_VIDEO_OVERLAY  0x00000004  /* Can do video overlay */
-#define V4L2_CAP_VBI_CAPTURE    0x00000010  /* Is a VBI capture device */
-#define V4L2_CAP_VBI_OUTPUT     0x00000020  /* Is a VBI output device */
-#define V4L2_CAP_RDS_CAPTURE    0x00000100  /* RDS data capture */
+#define V4L2_CAP_VIDEO_CAPTURE          0x00000001  /* Is a video capture device */
+#define V4L2_CAP_VIDEO_OUTPUT           0x00000002  /* Is a video output device */
+#define V4L2_CAP_VIDEO_OVERLAY          0x00000004  /* Can do video overlay */
+#define V4L2_CAP_VBI_CAPTURE            0x00000010  /* Is a raw VBI capture device */
+#define V4L2_CAP_VBI_OUTPUT             0x00000020  /* Is a raw VBI output device */
+#if 1
+#define V4L2_CAP_SLICED_VBI_CAPTURE     0x00000040  /* Is a sliced VBI capture device */
+#define V4L2_CAP_SLICED_VBI_OUTPUT      0x00000080  /* Is a sliced VBI output device */
+#endif
+#define V4L2_CAP_RDS_CAPTURE            0x00000100  /* RDS data capture */
 
-#define V4L2_CAP_TUNER          0x00010000  /* has a tuner */
-#define V4L2_CAP_AUDIO          0x00020000  /* has audio support */
-#define V4L2_CAP_RADIO          0x00040000  /* is a radio device */
+#define V4L2_CAP_TUNER                  0x00010000  /* has a tuner */
+#define V4L2_CAP_AUDIO                  0x00020000  /* has audio support */
+#define V4L2_CAP_RADIO                  0x00040000  /* is a radio device */
 
-#define V4L2_CAP_READWRITE      0x01000000  /* read/write systemcalls */
-#define V4L2_CAP_ASYNCIO        0x02000000  /* async I/O */
-#define V4L2_CAP_STREAMING      0x04000000  /* streaming I/O ioctls */
+#define V4L2_CAP_READWRITE              0x01000000  /* read/write systemcalls */
+#define V4L2_CAP_ASYNCIO                0x02000000  /* async I/O */
+#define V4L2_CAP_STREAMING              0x04000000  /* streaming I/O ioctls */
 
 /*
  *      V I D E O   I M A G E   F O R M A T
@@ -809,6 +818,8 @@ struct v4l2_audioout
  *      Data services API by Michael Schimek
  */
 
+/* Raw VBI */
+
 struct v4l2_vbi_format
 {
         __u32   sampling_rate;          /* in 1 Hz */
@@ -825,6 +836,54 @@ struct v4l2_vbi_format
 #define V4L2_VBI_UNSYNC         (1<< 0)
 #define V4L2_VBI_INTERLACED     (1<< 1)
 
+#if 1
+/* Sliced VBI
+ *
+ *    This implements is a proposal V4L2 API to allow SLICED VBI
+ * required for some hardware encoders. It should change without
+ * notice in the definitive implementation.
+ */
+
+struct v4l2_sliced_vbi_format
+{
+        __u16   service_set;
+        /* service_lines[0][...] specifies lines 0-23 (1-23 used) of the first field
+           service_lines[1][...] specifies lines 0-23 (1-23 used) of the second field
+                                 (equals frame lines 313-336 for 625 line video
+                                  standards, 263-286 for 525 line standards) */
+        __u16   service_lines[2][24];
+        __u32   io_size;
+        __u32   reserved[2];            /* must be zero */
+};
+
+#define V4L2_SLICED_TELETEXT_B          (0x0001)
+#define V4L2_SLICED_VPS                 (0x0400)
+#define V4L2_SLICED_CAPTION_525         (0x1000)
+#define V4L2_SLICED_WSS_625             (0x4000)
+
+#define V4L2_SLICED_VBI_525             (V4L2_SLICED_CAPTION_525)
+#define V4L2_SLICED_VBI_625             (V4L2_SLICED_TELETEXT_B | V4L2_SLICED_VPS | V4L2_SLICED_WSS_625)
+
+struct v4l2_sliced_vbi_cap
+{
+        __u16   service_set;
+        /* service_lines[0][...] specifies lines 0-23 (1-23 used) of the first field
+           service_lines[1][...] specifies lines 0-23 (1-23 used) of the second field
+                                 (equals frame lines 313-336 for 625 line video
+                                  standards, 263-286 for 525 line standards) */
+        __u16   service_lines[2][24];
+        __u32   reserved[4];    /* must be 0 */
+};
+
+struct v4l2_sliced_vbi_data
+{
+        __u32   id;
+        __u32   field;          /* 0: first field, 1: second field */
+        __u32   line;           /* 1-23 */
+        __u32   reserved;       /* must be 0 */
+        __u8    data[48];
+};
+#endif
 
 /*
  *      A G G R E G A T E   S T R U C T U R E S
@@ -837,10 +896,13 @@ struct v4l2_format
         enum v4l2_buf_type type;
         union
         {
-                struct v4l2_pix_format  pix;  // V4L2_BUF_TYPE_VIDEO_CAPTURE
-                struct v4l2_window      win;  // V4L2_BUF_TYPE_VIDEO_OVERLAY
-                struct v4l2_vbi_format  vbi;  // V4L2_BUF_TYPE_VBI_CAPTURE
-                __u8    raw_data[200];        // user-defined
+                struct v4l2_pix_format          pix;     // V4L2_BUF_TYPE_VIDEO_CAPTURE
+                struct v4l2_window              win;     // V4L2_BUF_TYPE_VIDEO_OVERLAY
+                struct v4l2_vbi_format          vbi;     // V4L2_BUF_TYPE_VBI_CAPTURE
+#if 1
+                struct v4l2_sliced_vbi_format   sliced;  // V4L2_BUF_TYPE_SLICED_VBI_CAPTURE
+#endif
+                __u8    raw_data[200];                   // user-defined
         } fmt;
 };
 
@@ -916,6 +978,9 @@ struct v4l2_streamparm
 #define VIDIOC_ENUMAUDOUT       _IOWR ('V', 66, struct v4l2_audioout)
 #define VIDIOC_G_PRIORITY       _IOR  ('V', 67, enum v4l2_priority)
 #define VIDIOC_S_PRIORITY       _IOW  ('V', 68, enum v4l2_priority)
+#if 1
+#define VIDIOC_G_SLICED_VBI_CAP _IOR  ('V', 69, struct v4l2_sliced_vbi_cap)
+#endif
 
 /* for compatibility, will go away some day */
 #define VIDIOC_OVERLAY_OLD      _IOWR ('V', 14, int)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 371e7d3f2e6f..fa2d12b0579b 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -463,6 +463,17 @@ struct inquiry_info_with_rssi_and_pscan_mode {
         __s8     rssi;
 } __attribute__ ((packed));
 
+#define HCI_EV_EXTENDED_INQUIRY_RESULT  0x2F
+struct extended_inquiry_info {
+        bdaddr_t bdaddr;
+        __u8     pscan_rep_mode;
+        __u8     pscan_period_mode;
+        __u8     dev_class[3];
+        __u16    clock_offset;
+        __s8     rssi;
+        __u8     data[240];
+} __attribute__ ((packed));
+
 #define HCI_EV_CONN_COMPLETE    0x03
 struct hci_ev_conn_complete {
         __u8     status;
diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h
index 03df3b157960..5a2beed5a770 100644
--- a/include/net/inet6_hashtables.h
+++ b/include/net/inet6_hashtables.h
@@ -26,19 +26,18 @@
 struct inet_hashinfo;
 
 /* I have no idea if this is a good hash for v6 or not. -DaveM */
-static inline int inet6_ehashfn(const struct in6_addr *laddr, const u16 lport,
-                                const struct in6_addr *faddr, const u16 fport,
-                                const int ehash_size)
+static inline unsigned int inet6_ehashfn(const struct in6_addr *laddr, const u16 lport,
+                                const struct in6_addr *faddr, const u16 fport)
 {
-        int hashent = (lport ^ fport);
+        unsigned int hashent = (lport ^ fport);
 
         hashent ^= (laddr->s6_addr32[3] ^ faddr->s6_addr32[3]);
         hashent ^= hashent >> 16;
         hashent ^= hashent >> 8;
-        return (hashent & (ehash_size - 1));
+        return hashent;
 }
 
-static inline int inet6_sk_ehashfn(const struct sock *sk, const int ehash_size)
+static inline int inet6_sk_ehashfn(const struct sock *sk)
 {
         const struct inet_sock *inet = inet_sk(sk);
         const struct ipv6_pinfo *np = inet6_sk(sk);
@@ -46,7 +45,7 @@ static inline int inet6_sk_ehashfn(const struct sock *sk, const int ehash_size)
         const struct in6_addr *faddr = &np->daddr;
         const __u16 lport = inet->num;
         const __u16 fport = inet->dport;
-        return inet6_ehashfn(laddr, lport, faddr, fport, ehash_size);
+        return inet6_ehashfn(laddr, lport, faddr, fport);
 }
 
 /*
@@ -69,14 +68,14 @@ static inline struct sock *
         /* Optimize here for direct hit, only listening connections can
          * have wildcards anyways.
          */
-        const int hash = inet6_ehashfn(daddr, hnum, saddr, sport,
-                                       hashinfo->ehash_size);
-        struct inet_ehash_bucket *head = &hashinfo->ehash[hash];
+        unsigned int hash = inet6_ehashfn(daddr, hnum, saddr, sport);
+        struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
 
+        prefetch(head->chain.first);
         read_lock(&head->lock);
         sk_for_each(sk, node, &head->chain) {
                 /* For IPV6 do the cheaper port and family tests first. */
-                if (INET6_MATCH(sk, saddr, daddr, ports, dif))
+                if (INET6_MATCH(sk, hash, saddr, daddr, ports, dif))
                         goto hit; /* You sunk my battleship! */
         }
         /* Must check for a TIME_WAIT'er before going to listener hash. */
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 646b6ea7fe26..35f49e65e295 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -108,7 +108,7 @@ struct inet_hashinfo {
         struct inet_bind_hashbucket     *bhash;
 
         int                             bhash_size;
-        int                             ehash_size;
+        unsigned int                    ehash_size;
 
         /* All sockets in TCP_LISTEN state will be in here.  This is the only
          * table where wildcard'd TCP sockets can exist.  Hash function here
@@ -130,17 +130,16 @@ struct inet_hashinfo {
         int                             port_rover;
 };
 
-static inline int inet_ehashfn(const __u32 laddr, const __u16 lport,
-                               const __u32 faddr, const __u16 fport,
-                               const int ehash_size)
+static inline unsigned int inet_ehashfn(const __u32 laddr, const __u16 lport,
+                               const __u32 faddr, const __u16 fport)
 {
-        int h = (laddr ^ lport) ^ (faddr ^ fport);
+        unsigned int h = (laddr ^ lport) ^ (faddr ^ fport);
         h ^= h >> 16;
         h ^= h >> 8;
-        return h & (ehash_size - 1);
+        return h;
 }
 
-static inline int inet_sk_ehashfn(const struct sock *sk, const int ehash_size)
+static inline int inet_sk_ehashfn(const struct sock *sk)
 {
         const struct inet_sock *inet = inet_sk(sk);
         const __u32 laddr = inet->rcv_saddr;
@@ -148,7 +147,14 @@ static inline int inet_sk_ehashfn(const struct sock *sk, const int ehash_size)
         const __u32 faddr = inet->daddr;
         const __u16 fport = inet->dport;
 
-        return inet_ehashfn(laddr, lport, faddr, fport, ehash_size);
+        return inet_ehashfn(laddr, lport, faddr, fport);
+}
+
+static inline struct inet_ehash_bucket *inet_ehash_bucket(
+        struct inet_hashinfo *hashinfo,
+        unsigned int hash)
+{
+        return &hashinfo->ehash[hash & (hashinfo->ehash_size - 1)];
 }
 
 extern struct inet_bind_bucket *
@@ -235,9 +241,11 @@ static inline void __inet_hash(struct inet_hashinfo *hashinfo,
                 lock = &hashinfo->lhash_lock;
                 inet_listen_wlock(hashinfo);
         } else {
-                sk->sk_hashent = inet_sk_ehashfn(sk, hashinfo->ehash_size);
-                list = &hashinfo->ehash[sk->sk_hashent].chain;
-                lock = &hashinfo->ehash[sk->sk_hashent].lock;
+                struct inet_ehash_bucket *head;
+                sk->sk_hash = inet_sk_ehashfn(sk);
+                head = inet_ehash_bucket(hashinfo, sk->sk_hash);
+                list = &head->chain;
+                lock = &head->lock;
                 write_lock(lock);
         }
         __sk_add_node(sk, list);
@@ -268,9 +276,8 @@ static inline void inet_unhash(struct inet_hashinfo *hashinfo, struct sock *sk)
                 inet_listen_wlock(hashinfo);
                 lock = &hashinfo->lhash_lock;
         } else {
-                struct inet_ehash_bucket *head = &hashinfo->ehash[sk->sk_hashent];
-                lock = &head->lock;
-                write_lock_bh(&head->lock);
+                lock = &inet_ehash_bucket(hashinfo, sk->sk_hash)->lock;
+                write_lock_bh(lock);
         }
 
         if (__sk_del_node_init(sk))
@@ -337,23 +344,27 @@ sherry_cache:
 #define INET_ADDR_COOKIE(__name, __saddr, __daddr) \
         const __u64 __name = (((__u64)(__daddr)) << 32) | ((__u64)(__saddr));
 #endif /* __BIG_ENDIAN */
-#define INET_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)\
-        (((*((__u64 *)&(inet_sk(__sk)->daddr))) == (__cookie))  &&      \
+#define INET_MATCH(__sk, __hash, __cookie, __saddr, __daddr, __ports, __dif)\
+        (((__sk)->sk_hash == (__hash))                          &&      \
+         ((*((__u64 *)&(inet_sk(__sk)->daddr))) == (__cookie))  &&      \
          ((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))   &&      \
          (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-#define INET_TW_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)\
-        (((*((__u64 *)&(inet_twsk(__sk)->tw_daddr))) == (__cookie)) &&  \
+#define INET_TW_MATCH(__sk, __hash, __cookie, __saddr, __daddr, __ports, __dif)\
+        (((__sk)->sk_hash == (__hash))                          &&      \
+         ((*((__u64 *)&(inet_twsk(__sk)->tw_daddr))) == (__cookie)) &&  \
          ((*((__u32 *)&(inet_twsk(__sk)->tw_dport))) == (__ports)) &&   \
          (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
 #else /* 32-bit arch */
 #define INET_ADDR_COOKIE(__name, __saddr, __daddr)
-#define INET_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)    \
-        ((inet_sk(__sk)->daddr          == (__saddr))           &&      \
+#define INET_MATCH(__sk, __hash, __cookie, __saddr, __daddr, __ports, __dif)    \
+        (((__sk)->sk_hash == (__hash))                          &&      \
+         (inet_sk(__sk)->daddr          == (__saddr))           &&      \
          (inet_sk(__sk)->rcv_saddr      == (__daddr))           &&      \
          ((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))   &&      \
          (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-#define INET_TW_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif) \
-        ((inet_twsk(__sk)->tw_daddr     == (__saddr))           &&      \
+#define INET_TW_MATCH(__sk, __hash,__cookie, __saddr, __daddr, __ports, __dif)  \
+        (((__sk)->sk_hash == (__hash))                          &&      \
+         (inet_twsk(__sk)->tw_daddr     == (__saddr))           &&      \
          (inet_twsk(__sk)->tw_rcv_saddr == (__daddr))           &&      \
          ((*((__u32 *)&(inet_twsk(__sk)->tw_dport))) == (__ports)) &&   \
          (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
@@ -378,18 +389,19 @@ static inline struct sock *
         /* Optimize here for direct hit, only listening connections can
          * have wildcards anyways.
          */
-        const int hash = inet_ehashfn(daddr, hnum, saddr, sport, hashinfo->ehash_size);
-        struct inet_ehash_bucket *head = &hashinfo->ehash[hash];
+        unsigned int hash = inet_ehashfn(daddr, hnum, saddr, sport);
+        struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
 
+        prefetch(head->chain.first);
         read_lock(&head->lock);
         sk_for_each(sk, node, &head->chain) {
-                if (INET_MATCH(sk, acookie, saddr, daddr, ports, dif))
+                if (INET_MATCH(sk, hash, acookie, saddr, daddr, ports, dif))
                         goto hit; /* You sunk my battleship! */
         }
 
         /* Must check for a TIME_WAIT'er before going to listener hash. */
         sk_for_each(sk, node, &(head + hashinfo->ehash_size)->chain) {
-                if (INET_TW_MATCH(sk, acookie, saddr, daddr, ports, dif))
+                if (INET_TW_MATCH(sk, hash, acookie, saddr, daddr, ports, dif))
                         goto hit;
         }
         sk = NULL;
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 3b070352e869..4ade56ef3a4d 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -112,6 +112,7 @@ struct inet_timewait_sock {
 #define tw_node                 __tw_common.skc_node
 #define tw_bind_node            __tw_common.skc_bind_node
 #define tw_refcnt               __tw_common.skc_refcnt
+#define tw_hash                 __tw_common.skc_hash
 #define tw_prot                 __tw_common.skc_prot
         volatile unsigned char  tw_substate;
         /* 3 bits hole, try to pack */
@@ -126,7 +127,6 @@ struct inet_timewait_sock {
         /* And these are ours. */
         __u8                    tw_ipv6only:1;
         /* 31 bits hole, try to pack */
-        int                     tw_hashent;
         int                     tw_timeout;
         unsigned long           tw_ttd;
         struct inet_bind_bucket *tw_tb;
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index e426641c519f..06b4235aa016 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -84,6 +84,7 @@
 #define IP_VS_CONN_F_IN_SEQ     0x0400          /* must do input seq adjust */
 #define IP_VS_CONN_F_SEQ_MASK   0x0600          /* in/out sequence mask */
 #define IP_VS_CONN_F_NO_CPORT   0x0800          /* no client port set yet */
+#define IP_VS_CONN_F_TEMPLATE   0x1000          /* template, not connection */
 
 /* Move it to better place one day, for now keep it unique */
 #define NFC_IPVS_PROPERTY       0x10000
@@ -739,6 +740,8 @@ enum {
 
 extern struct ip_vs_conn *ip_vs_conn_in_get
 (int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port);
+extern struct ip_vs_conn *ip_vs_ct_in_get
+(int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port);
 extern struct ip_vs_conn *ip_vs_conn_out_get
 (int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port);
 
diff --git a/include/net/llc.h b/include/net/llc.h
index 71769a5aeef3..1adb2ef3f6f7 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -17,6 +17,8 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 
+#include <asm/atomic.h>
+
 struct net_device;
 struct packet_type;
 struct sk_buff;
@@ -44,6 +46,7 @@ struct llc_sap {
         unsigned char    state;
         unsigned char    p_bit;
         unsigned char    f_bit;
+        atomic_t         refcnt;
         int              (*rcv_func)(struct sk_buff *skb,
                                      struct net_device *dev,
                                      struct packet_type *pt,
@@ -81,13 +84,27 @@ extern struct llc_sap *llc_sap_open(unsigned char lsap,
                                                struct net_device *dev,
                                                struct packet_type *pt,
                                                struct net_device *orig_dev));
+static inline void llc_sap_hold(struct llc_sap *sap)
+{
+        atomic_inc(&sap->refcnt);
+}
+
 extern void llc_sap_close(struct llc_sap *sap);
 
+static inline void llc_sap_put(struct llc_sap *sap)
+{
+        if (atomic_dec_and_test(&sap->refcnt))
+                llc_sap_close(sap);
+}
+
 extern struct llc_sap *llc_sap_find(unsigned char sap_value);
 
 extern int llc_build_and_send_ui_pkt(struct llc_sap *sap, struct sk_buff *skb,
                                      unsigned char *dmac, unsigned char dsap);
 
+extern void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb);
+extern void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb);
+
 extern int llc_station_init(void);
 extern void llc_station_exit(void);
 
@@ -98,4 +115,17 @@ extern void llc_proc_exit(void);
 #define llc_proc_init() (0)
 #define llc_proc_exit() do { } while(0)
 #endif /* CONFIG_PROC_FS */
+#ifdef CONFIG_SYSCTL
+extern int llc_sysctl_init(void);
+extern void llc_sysctl_exit(void);
+
+extern int sysctl_llc2_ack_timeout;
+extern int sysctl_llc2_busy_timeout;
+extern int sysctl_llc2_p_timeout;
+extern int sysctl_llc2_rej_timeout;
+extern int sysctl_llc_station_ack_timeout;
+#else
+#define llc_sysctl_init() (0)
+#define llc_sysctl_exit() do { } while(0)
+#endif /* CONFIG_SYSCTL */
 #endif /* LLC_H */
diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
index 8ad3bc2c23d7..54852ff6033b 100644
--- a/include/net/llc_conn.h
+++ b/include/net/llc_conn.h
@@ -19,14 +19,14 @@
 #define LLC_EVENT                1
 #define LLC_PACKET               2
 
-#define LLC_P_TIME               2
-#define LLC_ACK_TIME             1
-#define LLC_REJ_TIME             3
-#define LLC_BUSY_TIME            3
+#define LLC2_P_TIME               2
+#define LLC2_ACK_TIME             1
+#define LLC2_REJ_TIME             3
+#define LLC2_BUSY_TIME            3
 
 struct llc_timer {
         struct timer_list timer;
-        u16               expire;       /* timer expire time */
+        unsigned long     expire;       /* timer expire time */
 };
 
 struct llc_sock {
@@ -38,6 +38,7 @@ struct llc_sock {
         struct llc_addr     laddr;              /* lsap/mac pair */
         struct llc_addr     daddr;              /* dsap/mac pair */
         struct net_device   *dev;               /* device to send to remote */
+        u32                 copied_seq;         /* head of yet unread data */
         u8                  retry_count;        /* number of retries */
         u8                  ack_must_be_send;
         u8                  first_pdu_Ns;
@@ -92,7 +93,8 @@ static __inline__ char llc_backlog_type(struct sk_buff *skb)
         return skb->cb[sizeof(skb->cb) - 1];
 }
 
-extern struct sock *llc_sk_alloc(int family, int priority, struct proto *prot);
+extern struct sock *llc_sk_alloc(int family, unsigned int __nocast priority,
+                                 struct proto *prot);
 extern void llc_sk_free(struct sock *sk);
 
 extern void llc_sk_reset(struct sock *sk);
@@ -115,5 +117,4 @@ extern void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk);
 
 extern u8 llc_data_accept_state(u8 state);
 extern void llc_build_offset_table(void);
-extern int llc_release_sockets(struct llc_sap *sap);
 #endif /* LLC_CONN_H */
diff --git a/include/net/llc_sap.h b/include/net/llc_sap.h
index 353baaa627f3..2c56dbece729 100644
--- a/include/net/llc_sap.h
+++ b/include/net/llc_sap.h
@@ -12,11 +12,15 @@
  * See the GNU General Public License for more details.
  */
 struct llc_sap;
+struct net_device;
 struct sk_buff;
+struct sock;
 
 extern void llc_sap_rtn_pdu(struct llc_sap *sap, struct sk_buff *skb);
-extern void llc_save_primitive(struct sk_buff* skb, unsigned char prim);
-extern struct sk_buff *llc_alloc_frame(void);
+extern void llc_save_primitive(struct sock *sk, struct sk_buff* skb,
+                               unsigned char prim);
+extern struct sk_buff *llc_alloc_frame(struct sock *sk,
+                                       struct net_device *dev);
 
 extern void llc_build_and_send_test_pkt(struct llc_sap *sap,
                                         struct sk_buff *skb,
diff --git a/include/net/sock.h b/include/net/sock.h
index 8c48fbecb7cf..b6440805c420 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -99,6 +99,7 @@ struct proto;
  *      @skc_node: main hash linkage for various protocol lookup tables
  *      @skc_bind_node: bind hash linkage for various protocol lookup tables
  *      @skc_refcnt: reference count
+ *      @skc_hash: hash value used with various protocol lookup tables
  *      @skc_prot: protocol handlers inside a network family
  *
  *      This is the minimal network layer representation of sockets, the header
@@ -112,6 +113,7 @@ struct sock_common {
         struct hlist_node       skc_node;
         struct hlist_node       skc_bind_node;
         atomic_t                skc_refcnt;
+        unsigned int            skc_hash;
         struct proto            *skc_prot;
 };
 
@@ -139,7 +141,6 @@ struct sock_common {
   *     @sk_no_check: %SO_NO_CHECK setting, wether or not checkup packets
   *     @sk_route_caps: route capabilities (e.g. %NETIF_F_TSO)
   *     @sk_lingertime: %SO_LINGER l_linger setting
-  *     @sk_hashent: hash entry in several tables (e.g. inet_hashinfo.ehash)
   *     @sk_backlog: always used with the per-socket spinlock held
   *     @sk_callback_lock: used with the callbacks in the end of this struct
   *     @sk_error_queue: rarely used
@@ -186,6 +187,7 @@ struct sock {
 #define sk_node                 __sk_common.skc_node
 #define sk_bind_node            __sk_common.skc_bind_node
 #define sk_refcnt               __sk_common.skc_refcnt
+#define sk_hash                 __sk_common.skc_hash
 #define sk_prot                 __sk_common.skc_prot
         unsigned char           sk_shutdown : 2,
                                 sk_no_check : 2,
@@ -208,7 +210,6 @@ struct sock {
         unsigned int            sk_allocation;
         int                     sk_sndbuf;
         int                     sk_route_caps;
-        int                     sk_hashent;
         unsigned long           sk_flags;
         unsigned long           sk_lingertime;
         /*
diff --git a/include/pcmcia/ss.h b/include/pcmcia/ss.h
index 0f7aacc33fe9..c8592c7e8eaa 100644
--- a/include/pcmcia/ss.h
+++ b/include/pcmcia/ss.h
@@ -21,6 +21,9 @@
 #include <pcmcia/cs_types.h>
 #include <pcmcia/cs.h>
 #include <pcmcia/bulkmem.h>
+#ifdef CONFIG_CARDBUS
+#include <linux/pci.h>
+#endif
 
 /* Definitions for card status flags for GetStatus */
 #define SS_WRPROT       0x0001
@@ -233,7 +236,11 @@ struct pcmcia_socket {
 
         /* so is power hook */
         int (*power_hook)(struct pcmcia_socket *sock, int operation);
-                           
+#ifdef CONFIG_CARDBUS
+        /* allows tuning the CB bridge before loading driver for the CB card */
+        void (*tune_bridge)(struct pcmcia_socket *sock, struct pci_bus *bus);
+#endif
+
         /* state thread */
         struct semaphore                skt_sem;        /* protects socket h/w state */
 
diff --git a/include/rdma/ib_mad.h b/include/rdma/ib_mad.h
index 53184a38fdf6..0e293fe733b0 100644
--- a/include/rdma/ib_mad.h
+++ b/include/rdma/ib_mad.h
@@ -108,6 +108,13 @@
 #define IB_QP1_QKEY     0x80010000
 #define IB_QP_SET_QKEY  0x80000000
 
+enum {
+        IB_MGMT_MAD_DATA = 232,
+        IB_MGMT_RMPP_DATA = 220,
+        IB_MGMT_VENDOR_DATA = 216,
+        IB_MGMT_SA_DATA = 200
+};
+
 struct ib_mad_hdr {
         u8      base_version;
         u8      mgmt_class;
@@ -149,20 +156,20 @@ struct ib_sa_hdr {
 
 struct ib_mad {
         struct ib_mad_hdr       mad_hdr;
-        u8                      data[232];
+        u8                      data[IB_MGMT_MAD_DATA];
 };
 
 struct ib_rmpp_mad {
         struct ib_mad_hdr       mad_hdr;
         struct ib_rmpp_hdr      rmpp_hdr;
-        u8                      data[220];
+        u8                      data[IB_MGMT_RMPP_DATA];
 };
 
 struct ib_sa_mad {
         struct ib_mad_hdr       mad_hdr;
         struct ib_rmpp_hdr      rmpp_hdr;
         struct ib_sa_hdr        sa_hdr;
-        u8                      data[200];
+        u8                      data[IB_MGMT_SA_DATA];
 } __attribute__ ((packed));
 
 struct ib_vendor_mad {
@@ -170,7 +177,7 @@ struct ib_vendor_mad {
         struct ib_rmpp_hdr      rmpp_hdr;
         u8                      reserved;
         u8                      oui[3];
-        u8                      data[216];
+        u8                      data[IB_MGMT_VENDOR_DATA];
 };
 
 struct ib_class_port_info
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index e16cf94870f2..e6f4c9e55df7 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -665,7 +665,6 @@ struct ib_ucontext {
         struct list_head        qp_list;
         struct list_head        srq_list;
         struct list_head        ah_list;
-        spinlock_t              lock;
 };
 
 struct ib_uobject {
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index c0e4c67d836f..7ece05666feb 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -163,6 +163,7 @@ struct scsi_target {
         unsigned int            id; /* target id ... replace
                                      * scsi_device.id eventually */
         unsigned long           create:1; /* signal that it needs to be added */
+        char                    scsi_level;
         void                    *hostdata; /* available to low-level driver */
         unsigned long           starget_data[0]; /* for the transport */
         /* starget_data must be the last element!!!! */
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index 916144be208b..69313ba7505b 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -439,6 +439,8 @@ enum scsi_host_state {
         SHOST_CANCEL,
         SHOST_DEL,
         SHOST_RECOVERY,
+        SHOST_CANCEL_RECOVERY,
+        SHOST_DEL_RECOVERY,
 };
 
 struct Scsi_Host {
@@ -465,8 +467,6 @@ struct Scsi_Host {
 
         struct list_head        eh_cmd_q;
         struct task_struct    * ehandler;  /* Error recovery thread. */
-        struct semaphore      * eh_wait;   /* The error recovery thread waits
-                                              on this. */
         struct semaphore      * eh_action; /* Wait for specific actions on the
                                           host. */
         unsigned int            eh_active:1; /* Indicates the eh thread is awake and active if
@@ -621,6 +621,13 @@ static inline struct Scsi_Host *dev_to_shost(struct device *dev)
         return container_of(dev, struct Scsi_Host, shost_gendev);
 }
 
+static inline int scsi_host_in_recovery(struct Scsi_Host *shost)
+{
+        return shost->shost_state == SHOST_RECOVERY ||
+                shost->shost_state == SHOST_CANCEL_RECOVERY ||
+                shost->shost_state == SHOST_DEL_RECOVERY;
+}
+
 extern int scsi_queue_work(struct Scsi_Host *, struct work_struct *);
 extern void scsi_flush_work(struct Scsi_Host *);
 
diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
index 115db056dc6b..b0d445437372 100644
--- a/include/scsi/scsi_transport_fc.h
+++ b/include/scsi/scsi_transport_fc.h
@@ -103,8 +103,8 @@ enum fc_port_state {
                                              incapable of reporting */
 #define FC_PORTSPEED_1GBIT              1
 #define FC_PORTSPEED_2GBIT              2
-#define FC_PORTSPEED_10GBIT             4
-#define FC_PORTSPEED_4GBIT              8
+#define FC_PORTSPEED_4GBIT              4
+#define FC_PORTSPEED_10GBIT             8
 #define FC_PORTSPEED_NOT_NEGOTIATED     (1 << 15) /* Speed not established */
 
 /*
diff --git a/include/sound/core.h b/include/sound/core.h
index 3dc41fd5c54d..26160adcdffc 100644
--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -168,6 +168,9 @@ struct _snd_card {
         wait_queue_head_t shutdown_sleep;
         struct work_struct free_workq;  /* for free in workqueue */
         struct device *dev;
+#ifdef CONFIG_SND_GENERIC_DRIVER
+        struct snd_generic_device *generic_dev;
+#endif
 
 #ifdef CONFIG_PM
         int (*pm_suspend)(snd_card_t *card, pm_message_t state);
@@ -176,9 +179,6 @@ struct _snd_card {
         unsigned int power_state;       /* power state */
         struct semaphore power_lock;    /* power lock */
         wait_queue_head_t power_sleep;
-#ifdef CONFIG_SND_GENERIC_PM
-        struct snd_generic_device *pm_dev;      /* for ISA */
-#endif
 #endif
 
 #if defined(CONFIG_SND_MIXER_OSS) || defined(CONFIG_SND_MIXER_OSS_MODULE)
@@ -348,6 +348,8 @@ int snd_card_file_remove(snd_card_t *card, struct file *file);
 #ifndef snd_card_set_dev
 #define snd_card_set_dev(card,devptr) ((card)->dev = (devptr))
 #endif
+/* register a generic device (for ISA, etc) */
+int snd_card_set_generic_dev(snd_card_t *card);
 
 /* device.c */
 
diff --git a/include/sound/cs46xx.h b/include/sound/cs46xx.h
index 9b94510eda60..b0c0e192eb56 100644
--- a/include/sound/cs46xx.h
+++ b/include/sound/cs46xx.h
@@ -29,19 +29,6 @@
 #include "ac97_codec.h"
 #include "cs46xx_dsp_spos.h"
 
-#ifndef PCI_VENDOR_ID_CIRRUS
-#define PCI_VENDOR_ID_CIRRUS            0x1013
-#endif
-#ifndef PCI_DEVICE_ID_CIRRUS_4610
-#define PCI_DEVICE_ID_CIRRUS_4610       0x6001
-#endif
-#ifndef PCI_DEVICE_ID_CIRRUS_4612
-#define PCI_DEVICE_ID_CIRRUS_4612       0x6003
-#endif
-#ifndef PCI_DEVICE_ID_CIRRUS_4615
-#define PCI_DEVICE_ID_CIRRUS_4615       0x6004
-#endif
-
 /*
  *  Direct registers
  */
@@ -1715,7 +1702,6 @@ struct _snd_cs46xx {
         void (*active_ctrl)(cs46xx_t *, int);
         void (*mixer_init)(cs46xx_t *);
 
-        struct pci_dev *acpi_dev;
         int acpi_port;
         snd_kcontrol_t *eapd_switch; /* for amplifier hack */
         int accept_valid;       /* accept mmap valid (for OSS) */
diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
index 4e3993dfcefe..67bf3f18e96a 100644
--- a/include/sound/emu10k1.h
+++ b/include/sound/emu10k1.h
@@ -35,13 +35,6 @@
 #include <linux/interrupt.h>
 #include <asm/io.h>
 
-#ifndef PCI_VENDOR_ID_CREATIVE
-#define PCI_VENDOR_ID_CREATIVE          0x1102
-#endif
-#ifndef PCI_DEVICE_ID_CREATIVE_EMU10K1
-#define PCI_DEVICE_ID_CREATIVE_EMU10K1  0x0002
-#endif
-
 /* ------------------- DEFINES -------------------- */
 
 #define EMUPAGESIZE     4096
diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index d6361dab0370..2b23a5967071 100644
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -903,13 +903,16 @@ int snd_pcm_format_unsigned(snd_pcm_format_t format);
 int snd_pcm_format_linear(snd_pcm_format_t format);
 int snd_pcm_format_little_endian(snd_pcm_format_t format);
 int snd_pcm_format_big_endian(snd_pcm_format_t format);
-/*
+#if 0 /* just for DocBook */
+/**
  * snd_pcm_format_cpu_endian - Check the PCM format is CPU-endian
  * @format: the format to check
  *
  * Returns 1 if the given PCM format is CPU-endian, 0 if
  * opposite, or a negative error code if endian not specified.
  */
+int snd_pcm_format_cpu_endian(snd_pcm_format_t format);
+#endif /* DocBook */
 #ifdef SNDRV_LITTLE_ENDIAN
 #define snd_pcm_format_cpu_endian(format) snd_pcm_format_little_endian(format)
 #else
diff --git a/include/sound/pcm_oss.h b/include/sound/pcm_oss.h
index 518728536bc6..0b67c9d105af 100644
--- a/include/sound/pcm_oss.h
+++ b/include/sound/pcm_oss.h
@@ -32,7 +32,8 @@ struct _snd_pcm_oss_setup {
                      block:1,
                      nonblock:1,
                      partialfrag:1,
-                     nosilence:1;
+                     nosilence:1,
+                     buggyptr:1;
         unsigned int periods;
         unsigned int period_size;
         snd_pcm_oss_setup_t *next;
diff --git a/include/sound/trident.h b/include/sound/trident.h
index f5254ec36e6a..a408d3925050 100644
--- a/include/sound/trident.h
+++ b/include/sound/trident.h
@@ -33,23 +33,6 @@
 //#include "ainstr_gf1.h"
 #include "ainstr_simple.h"
 
-#ifndef PCI_VENDOR_ID_TRIDENT
-#define PCI_VENDOR_ID_TRIDENT           0x1023
-#endif
-#ifndef PCI_DEVICE_ID_TRIDENT_4DWAVE_DX 
-#define PCI_DEVICE_ID_TRIDENT_4DWAVE_DX 0x2000
-#endif
-#ifndef PCI_DEVICE_ID_TRIDENT_4DWAVE_NX 
-#define PCI_DEVICE_ID_TRIDENT_4DWAVE_NX 0x2001
-#endif
-
-#ifndef PCI_VENDOR_ID_SI
-#define PCI_VENDOR_ID_SI                0x1039
-#endif
-#ifndef PCI_DEVICE_ID_SI_7018
-#define PCI_DEVICE_ID_SI_7018           0x7018
-#endif
-
 #define TRIDENT_DEVICE_ID_DX            ((PCI_VENDOR_ID_TRIDENT<<16)|PCI_DEVICE_ID_TRIDENT_4DWAVE_DX)
 #define TRIDENT_DEVICE_ID_NX            ((PCI_VENDOR_ID_TRIDENT<<16)|PCI_DEVICE_ID_TRIDENT_4DWAVE_NX)
 #define TRIDENT_DEVICE_ID_SI7018        ((PCI_VENDOR_ID_SI<<16)|PCI_DEVICE_ID_SI_7018)
diff --git a/include/sound/version.h b/include/sound/version.h
index 8d19bfabb7e0..ee32af20dba9 100644
--- a/include/sound/version.h
+++ b/include/sound/version.h
@@ -1,3 +1,3 @@
 /* include/version.h.  Generated by configure.  */
 #define CONFIG_SND_VERSION "1.0.10rc1"
-#define CONFIG_SND_DATE " (Tue Aug 30 05:31:08 2005 UTC)"
+#define CONFIG_SND_DATE " (Mon Sep 12 08:13:09 2005 UTC)"
diff --git a/include/sound/ymfpci.h b/include/sound/ymfpci.h
index 9a3c1e6c820a..c3bccbfd8d4c 100644
--- a/include/sound/ymfpci.h
+++ b/include/sound/ymfpci.h
@@ -28,28 +28,6 @@
 #include "timer.h"
 #include <linux/gameport.h>
 
-#ifndef PCI_VENDOR_ID_YAMAHA
-#define PCI_VENDOR_ID_YAMAHA            0x1073
-#endif
-#ifndef PCI_DEVICE_ID_YAMAHA_724
-#define PCI_DEVICE_ID_YAMAHA_724        0x0004
-#endif
-#ifndef PCI_DEVICE_ID_YAMAHA_724F
-#define PCI_DEVICE_ID_YAMAHA_724F       0x000d
-#endif
-#ifndef PCI_DEVICE_ID_YAMAHA_740
-#define PCI_DEVICE_ID_YAMAHA_740        0x000a
-#endif
-#ifndef PCI_DEVICE_ID_YAMAHA_740C
-#define PCI_DEVICE_ID_YAMAHA_740C       0x000c
-#endif
-#ifndef PCI_DEVICE_ID_YAMAHA_744
-#define PCI_DEVICE_ID_YAMAHA_744        0x0010
-#endif
-#ifndef PCI_DEVICE_ID_YAMAHA_754
-#define PCI_DEVICE_ID_YAMAHA_754        0x0012
-#endif
-
 /*
  *  Direct registers
  */
diff --git a/include/video/pm3fb.h b/include/video/pm3fb.h
index 8d3cef5d87a2..6f4ea808cf74 100644
--- a/include/video/pm3fb.h
+++ b/include/video/pm3fb.h
@@ -1142,9 +1142,6 @@
 /* do we want accelerated console  */
 #define PM3FB_USE_ACCEL 1
 
-/* useful ? */
-#define CHAR_IS_NUM(a)  ((((a) >= '0') && ((a) <= '9')) ? 1 : 0)
-
 /* for driver debugging ONLY */
 /* 0 = assert only, 1 = error, 2 = info, 3+ = verbose */
 /* define PM3FB_MASTER_DEBUG 1 */
diff --git a/include/video/w100fb.h b/include/video/w100fb.h
index e6da2d7ded8c..677d40326796 100644
--- a/include/video/w100fb.h
+++ b/include/video/w100fb.h
@@ -19,6 +19,7 @@ struct w100fb_par;
 
 unsigned long w100fb_gpio_read(int port);
 void w100fb_gpio_write(int port, unsigned long value);
+unsigned long w100fb_get_hsynclen(struct device *dev);
 
 /* LCD Specific Routines and Config */
 struct w100_tg_info {
diff --git a/init/initramfs.c b/init/initramfs.c
index 02c5ce64990d..0c5d9a3f951b 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -466,6 +466,14 @@ static char * __init unpack_to_rootfs(char *buf, unsigned len, int check_only)
 extern char __initramfs_start[], __initramfs_end[];
 #ifdef CONFIG_BLK_DEV_INITRD
 #include <linux/initrd.h>
+
+static void __init free_initrd(void)
+{
+        free_initrd_mem(initrd_start, initrd_end);
+        initrd_start = 0;
+        initrd_end = 0;
+}
+
 #endif
 
 void __init populate_rootfs(void)
@@ -484,7 +492,7 @@ void __init populate_rootfs(void)
                         printk(" it is\n");
                         unpack_to_rootfs((char *)initrd_start,
                                 initrd_end - initrd_start, 0);
-                        free_initrd_mem(initrd_start, initrd_end);
+                        free_initrd();
                         return;
                 }
                 printk("it isn't (%s); looks like an initrd\n", err);
@@ -493,7 +501,7 @@ void __init populate_rootfs(void)
                         sys_write(fd, (char *)initrd_start,
                                         initrd_end - initrd_start);
                         sys_close(fd);
-                        free_initrd_mem(initrd_start, initrd_end);
+                        free_initrd();
                 }
         }
 #endif
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 3a926011507b..a0f18c9cc89d 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -611,6 +611,7 @@ static struct file *do_create(struct dentry *dir, struct dentry *dentry,
                 dentry->d_fsdata = &attr;
         }
 
+        mode &= ~current->fs->umask;
         ret = vfs_create(dir->d_inode, dentry, mode, NULL);
         dentry->d_fsdata = NULL;
         if (ret)
diff --git a/kernel/audit.c b/kernel/audit.c
index 7f0699790d46..83096b67510a 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -79,6 +79,8 @@ static int	audit_rate_limit;
 
 /* Number of outstanding audit_buffers allowed. */
 static int      audit_backlog_limit = 64;
+static int      audit_backlog_wait_time = 60 * HZ;
+static int      audit_backlog_wait_overflow = 0;
 
 /* The identity of the user shutting down the audit system. */
 uid_t           audit_sig_uid = -1;
@@ -106,18 +108,12 @@ static LIST_HEAD(audit_freelist);
 static struct sk_buff_head audit_skb_queue;
 static struct task_struct *kauditd_task;
 static DECLARE_WAIT_QUEUE_HEAD(kauditd_wait);
-
-/* There are three lists of rules -- one to search at task creation
- * time, one to search at syscall entry time, and another to search at
- * syscall exit time. */
-static LIST_HEAD(audit_tsklist);
-static LIST_HEAD(audit_entlist);
-static LIST_HEAD(audit_extlist);
+static DECLARE_WAIT_QUEUE_HEAD(audit_backlog_wait);
 
 /* The netlink socket is only to be read by 1 CPU, which lets us assume
  * that list additions and deletions never happen simultaneously in
  * auditsc.c */
-static DECLARE_MUTEX(audit_netlink_sem);
+DECLARE_MUTEX(audit_netlink_sem);
 
 /* AUDIT_BUFSIZ is the size of the temporary buffer used for formatting
  * audit records.  Since printk uses a 1024 byte buffer, this buffer
@@ -137,6 +133,7 @@ struct audit_buffer {
         struct list_head     list;
         struct sk_buff       *skb;      /* formatted skb ready to send */
         struct audit_context *ctx;      /* NULL or associated context */
+        int                  gfp_mask;
 };
 
 static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
@@ -145,11 +142,6 @@ static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
         nlh->nlmsg_pid = pid;
 }
 
-struct audit_entry {
-        struct list_head  list;
-        struct audit_rule rule;
-};
-
 static void audit_panic(const char *message)
 {
         switch (audit_failure)
@@ -233,7 +225,7 @@ static int audit_set_rate_limit(int limit, uid_t loginuid)
 {
         int old          = audit_rate_limit;
         audit_rate_limit = limit;
-        audit_log(NULL, AUDIT_CONFIG_CHANGE, 
+        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE, 
                         "audit_rate_limit=%d old=%d by auid=%u",
                         audit_rate_limit, old, loginuid);
         return old;
@@ -243,7 +235,7 @@ static int audit_set_backlog_limit(int limit, uid_t loginuid)
 {
         int old          = audit_backlog_limit;
         audit_backlog_limit = limit;
-        audit_log(NULL, AUDIT_CONFIG_CHANGE,
+        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
                         "audit_backlog_limit=%d old=%d by auid=%u",
                         audit_backlog_limit, old, loginuid);
         return old;
@@ -255,7 +247,7 @@ static int audit_set_enabled(int state, uid_t loginuid)
         if (state != 0 && state != 1)
                 return -EINVAL;
         audit_enabled = state;
-        audit_log(NULL, AUDIT_CONFIG_CHANGE,
+        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
                         "audit_enabled=%d old=%d by auid=%u",
                         audit_enabled, old, loginuid);
         return old;
@@ -269,7 +261,7 @@ static int audit_set_failure(int state, uid_t loginuid)
             && state != AUDIT_FAIL_PANIC)
                 return -EINVAL;
         audit_failure = state;
-        audit_log(NULL, AUDIT_CONFIG_CHANGE,
+        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
                         "audit_failure=%d old=%d by auid=%u",
                         audit_failure, old, loginuid);
         return old;
@@ -281,6 +273,7 @@ int kauditd_thread(void *dummy)
 
         while (1) {
                 skb = skb_dequeue(&audit_skb_queue);
+                wake_up(&audit_backlog_wait);
                 if (skb) {
                         if (audit_pid) {
                                 int err = netlink_unicast(audit_sock, skb, audit_pid, 0);
@@ -290,7 +283,7 @@ int kauditd_thread(void *dummy)
                                         audit_pid = 0;
                                 }
                         } else {
-                                printk(KERN_ERR "%s\n", skb->data + NLMSG_SPACE(0));
+                                printk(KERN_NOTICE "%s\n", skb->data + NLMSG_SPACE(0));
                                 kfree_skb(skb);
                         }
                 } else {
@@ -423,7 +416,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (status_get->mask & AUDIT_STATUS_PID) {
                         int old   = audit_pid;
                         audit_pid = status_get->pid;
-                        audit_log(NULL, AUDIT_CONFIG_CHANGE,
+                        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
                                 "audit_pid=%d old=%d by auid=%u",
                                   audit_pid, old, loginuid);
                 }
@@ -435,15 +428,21 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 break;
         case AUDIT_USER:
         case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
-                ab = audit_log_start(NULL, msg_type);
-                if (!ab)
-                        break;  /* audit_panic has been called */
-                audit_log_format(ab,
-                                 "user pid=%d uid=%u auid=%u"
-                                 " msg='%.1024s'",
-                                 pid, uid, loginuid, (char *)data);
-                audit_set_pid(ab, pid);
-                audit_log_end(ab);
+                if (!audit_enabled && msg_type != AUDIT_USER_AVC)
+                        return 0;
+
+                err = audit_filter_user(&NETLINK_CB(skb), msg_type);
+                if (err == 1) {
+                        err = 0;
+                        ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
+                        if (ab) {
+                                audit_log_format(ab,
+                                                 "user pid=%d uid=%u auid=%u msg='%.1024s'",
+                                                 pid, uid, loginuid, (char *)data);
+                                audit_set_pid(ab, pid);
+                                audit_log_end(ab);
+                        }
+                }
                 break;
         case AUDIT_ADD:
         case AUDIT_DEL:
@@ -523,7 +522,7 @@ static int __init audit_init(void)
         skb_queue_head_init(&audit_skb_queue);
         audit_initialized = 1;
         audit_enabled = audit_default;
-        audit_log(NULL, AUDIT_KERNEL, "initialized");
+        audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
         return 0;
 }
 __initcall(audit_init);
@@ -561,7 +560,7 @@ static void audit_buffer_free(struct audit_buffer *ab)
 }
 
 static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
-                                                int gfp_mask, int type)
+                                                unsigned int __nocast gfp_mask, int type)
 {
         unsigned long flags;
         struct audit_buffer *ab = NULL;
@@ -587,6 +586,7 @@ static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
                 goto err;
 
         ab->ctx = ctx;
+        ab->gfp_mask = gfp_mask;
         nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));
         nlh->nlmsg_type = type;
         nlh->nlmsg_flags = 0;
@@ -606,26 +606,27 @@ err:
  * (timestamp,serial) tuple is unique for each syscall and is live from
  * syscall entry to syscall exit.
  *
- * Atomic values are only guaranteed to be 24-bit, so we count down.
- *
  * NOTE: Another possibility is to store the formatted records off the
  * audit context (for those records that have a context), and emit them
  * all at syscall exit.  However, this could delay the reporting of
  * significant errors until syscall exit (or never, if the system
  * halts). */
+
 unsigned int audit_serial(void)
 {
-        static atomic_t serial = ATOMIC_INIT(0xffffff);
-        unsigned int a, b;
+        static spinlock_t serial_lock = SPIN_LOCK_UNLOCKED;
+        static unsigned int serial = 0;
+
+        unsigned long flags;
+        unsigned int ret;
 
+        spin_lock_irqsave(&serial_lock, flags);
         do {
-                a = atomic_read(&serial);
-                if (atomic_dec_and_test(&serial))
-                        atomic_set(&serial, 0xffffff);
-                b = atomic_read(&serial);
-        } while (b != a - 1);
+                ret = ++serial;
+        } while (unlikely(!ret));
+        spin_unlock_irqrestore(&serial_lock, flags);
 
-        return 0xffffff - b;
+        return ret;
 }
 
 static inline void audit_get_stamp(struct audit_context *ctx, 
@@ -645,17 +646,43 @@ static inline void audit_get_stamp(struct audit_context *ctx,
  * syscall, then the syscall is marked as auditable and an audit record
  * will be written at syscall exit.  If there is no associated task, tsk
  * should be NULL. */
-struct audit_buffer *audit_log_start(struct audit_context *ctx, int type)
+
+struct audit_buffer *audit_log_start(struct audit_context *ctx, int gfp_mask,
+                                     int type)
 {
         struct audit_buffer     *ab     = NULL;
         struct timespec         t;
         unsigned int            serial;
+        int reserve;
+        unsigned long timeout_start = jiffies;
 
         if (!audit_initialized)
                 return NULL;
 
-        if (audit_backlog_limit
-            && skb_queue_len(&audit_skb_queue) > audit_backlog_limit) {
+        if (gfp_mask & __GFP_WAIT)
+                reserve = 0;
+        else
+                reserve = 5; /* Allow atomic callers to go up to five 
+                                entries over the normal backlog limit */
+
+        while (audit_backlog_limit
+               && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
+                if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
+                    && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {
+
+                        /* Wait for auditd to drain the queue a little */
+                        DECLARE_WAITQUEUE(wait, current);
+                        set_current_state(TASK_INTERRUPTIBLE);
+                        add_wait_queue(&audit_backlog_wait, &wait);
+
+                        if (audit_backlog_limit &&
+                            skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
+                                schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
+
+                        __set_current_state(TASK_RUNNING);
+                        remove_wait_queue(&audit_backlog_wait, &wait);
+                        continue;
+                }
                 if (audit_rate_check())
                         printk(KERN_WARNING
                                "audit: audit_backlog=%d > "
@@ -663,10 +690,12 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, int type)
                                skb_queue_len(&audit_skb_queue),
                                audit_backlog_limit);
                 audit_log_lost("backlog limit exceeded");
+                audit_backlog_wait_time = audit_backlog_wait_overflow;
+                wake_up(&audit_backlog_wait);
                 return NULL;
         }
 
-        ab = audit_buffer_alloc(ctx, GFP_ATOMIC, type);
+        ab = audit_buffer_alloc(ctx, gfp_mask, type);
         if (!ab) {
                 audit_log_lost("out of memory in audit_log_start");
                 return NULL;
@@ -690,7 +719,7 @@ static inline int audit_expand(struct audit_buffer *ab, int extra)
 {
         struct sk_buff *skb = ab->skb;
         int ret = pskb_expand_head(skb, skb_headroom(skb), extra,
-                                   GFP_ATOMIC);
+                                   ab->gfp_mask);
         if (ret < 0) {
                 audit_log_lost("out of memory in audit_expand");
                 return 0;
@@ -809,7 +838,7 @@ void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
                 audit_log_format(ab, " %s", prefix);
 
         /* We will allow 11 spaces for ' (deleted)' to be appended */
-        path = kmalloc(PATH_MAX+11, GFP_KERNEL);
+        path = kmalloc(PATH_MAX+11, ab->gfp_mask);
         if (!path) {
                 audit_log_format(ab, "<no memory>");
                 return;
@@ -841,7 +870,7 @@ void audit_log_end(struct audit_buffer *ab)
                         ab->skb = NULL;
                         wake_up_interruptible(&kauditd_wait);
                 } else {
-                        printk("%s\n", ab->skb->data + NLMSG_SPACE(0));
+                        printk(KERN_NOTICE "%s\n", ab->skb->data + NLMSG_SPACE(0));
                 }
         }
         audit_buffer_free(ab);
@@ -850,12 +879,13 @@ void audit_log_end(struct audit_buffer *ab)
 /* Log an audit record.  This is a convenience function that calls
  * audit_log_start, audit_log_vformat, and audit_log_end.  It may be
  * called in any context. */
-void audit_log(struct audit_context *ctx, int type, const char *fmt, ...)
+void audit_log(struct audit_context *ctx, int gfp_mask, int type, 
+               const char *fmt, ...)
 {
         struct audit_buffer *ab;
         va_list args;
 
-        ab = audit_log_start(ctx, type);
+        ab = audit_log_start(ctx, gfp_mask, type);
         if (ab) {
                 va_start(args, fmt);
                 audit_log_vformat(ab, fmt, args);
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index e75f84e1a1a0..88696f639aab 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -39,6 +39,9 @@
 #include <linux/audit.h>
 #include <linux/personality.h>
 #include <linux/time.h>
+#include <linux/kthread.h>
+#include <linux/netlink.h>
+#include <linux/compiler.h>
 #include <asm/unistd.h>
 
 /* 0 = no checking
@@ -95,6 +98,7 @@ struct audit_names {
         uid_t           uid;
         gid_t           gid;
         dev_t           rdev;
+        unsigned        flags;
 };
 
 struct audit_aux_data {
@@ -167,9 +171,16 @@ struct audit_context {
 /* There are three lists of rules -- one to search at task creation
  * time, one to search at syscall entry time, and another to search at
  * syscall exit time. */
-static LIST_HEAD(audit_tsklist);
-static LIST_HEAD(audit_entlist);
-static LIST_HEAD(audit_extlist);
+static struct list_head audit_filter_list[AUDIT_NR_FILTERS] = {
+        LIST_HEAD_INIT(audit_filter_list[0]),
+        LIST_HEAD_INIT(audit_filter_list[1]),
+        LIST_HEAD_INIT(audit_filter_list[2]),
+        LIST_HEAD_INIT(audit_filter_list[3]),
+        LIST_HEAD_INIT(audit_filter_list[4]),
+#if AUDIT_NR_FILTERS != 5
+#error Fix audit_filter_list initialiser
+#endif
+};
 
 struct audit_entry {
         struct list_head  list;
@@ -179,9 +190,36 @@ struct audit_entry {
 
 extern int audit_pid;
 
+/* Copy rule from user-space to kernel-space.  Called from 
+ * audit_add_rule during AUDIT_ADD. */
+static inline int audit_copy_rule(struct audit_rule *d, struct audit_rule *s)
+{
+        int i;
+
+        if (s->action != AUDIT_NEVER
+            && s->action != AUDIT_POSSIBLE
+            && s->action != AUDIT_ALWAYS)
+                return -1;
+        if (s->field_count < 0 || s->field_count > AUDIT_MAX_FIELDS)
+                return -1;
+        if ((s->flags & ~AUDIT_FILTER_PREPEND) >= AUDIT_NR_FILTERS)
+                return -1;
+
+        d->flags        = s->flags;
+        d->action       = s->action;
+        d->field_count  = s->field_count;
+        for (i = 0; i < d->field_count; i++) {
+                d->fields[i] = s->fields[i];
+                d->values[i] = s->values[i];
+        }
+        for (i = 0; i < AUDIT_BITMASK_SIZE; i++) d->mask[i] = s->mask[i];
+        return 0;
+}
+
 /* Check to see if two rules are identical.  It is called from
+ * audit_add_rule during AUDIT_ADD and 
  * audit_del_rule during AUDIT_DEL. */
-static int audit_compare_rule(struct audit_rule *a, struct audit_rule *b)
+static inline int audit_compare_rule(struct audit_rule *a, struct audit_rule *b)
 {
         int i;
 
@@ -210,19 +248,37 @@ static int audit_compare_rule(struct audit_rule *a, struct audit_rule *b)
 /* Note that audit_add_rule and audit_del_rule are called via
  * audit_receive() in audit.c, and are protected by
  * audit_netlink_sem. */
-static inline int audit_add_rule(struct audit_entry *entry,
-                                 struct list_head *list)
+static inline int audit_add_rule(struct audit_rule *rule,
+                                  struct list_head *list)
 {
-        if (entry->rule.flags & AUDIT_PREPEND) {
-                entry->rule.flags &= ~AUDIT_PREPEND;
+        struct audit_entry  *entry;
+
+        /* Do not use the _rcu iterator here, since this is the only
+         * addition routine. */
+        list_for_each_entry(entry, list, list) {
+                if (!audit_compare_rule(rule, &entry->rule)) {
+                        return -EEXIST;
+                }
+        }
+
+        if (!(entry = kmalloc(sizeof(*entry), GFP_KERNEL)))
+                return -ENOMEM;
+        if (audit_copy_rule(&entry->rule, rule)) {
+                kfree(entry);
+                return -EINVAL;
+        }
+
+        if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
+                entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
                 list_add_rcu(&entry->list, list);
         } else {
                 list_add_tail_rcu(&entry->list, list);
         }
+
         return 0;
 }
 
-static void audit_free_rule(struct rcu_head *head)
+static inline void audit_free_rule(struct rcu_head *head)
 {
         struct audit_entry *e = container_of(head, struct audit_entry, rcu);
         kfree(e);
@@ -245,82 +301,82 @@ static inline int audit_del_rule(struct audit_rule *rule,
                         return 0;
                 }
         }
-        return -EFAULT;         /* No matching rule */
+        return -ENOENT;         /* No matching rule */
 }
 
-/* Copy rule from user-space to kernel-space.  Called during
- * AUDIT_ADD. */
-static int audit_copy_rule(struct audit_rule *d, struct audit_rule *s)
+static int audit_list_rules(void *_dest)
 {
+        int pid, seq;
+        int *dest = _dest;
+        struct audit_entry *entry;
         int i;
 
-        if (s->action != AUDIT_NEVER
-            && s->action != AUDIT_POSSIBLE
-            && s->action != AUDIT_ALWAYS)
-                return -1;
-        if (s->field_count < 0 || s->field_count > AUDIT_MAX_FIELDS)
-                return -1;
+        pid = dest[0];
+        seq = dest[1];
+        kfree(dest);
 
-        d->flags        = s->flags;
-        d->action       = s->action;
-        d->field_count  = s->field_count;
-        for (i = 0; i < d->field_count; i++) {
-                d->fields[i] = s->fields[i];
-                d->values[i] = s->values[i];
+        down(&audit_netlink_sem);
+
+        /* The *_rcu iterators not needed here because we are
+           always called with audit_netlink_sem held. */
+        for (i=0; i<AUDIT_NR_FILTERS; i++) {
+                list_for_each_entry(entry, &audit_filter_list[i], list)
+                        audit_send_reply(pid, seq, AUDIT_LIST, 0, 1,
+                                         &entry->rule, sizeof(entry->rule));
         }
-        for (i = 0; i < AUDIT_BITMASK_SIZE; i++) d->mask[i] = s->mask[i];
+        audit_send_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0);
+        
+        up(&audit_netlink_sem);
         return 0;
 }
 
 int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
                                                         uid_t loginuid)
 {
-        u32                flags;
-        struct audit_entry *entry;
+        struct task_struct *tsk;
+        int *dest;
         int                err = 0;
+        unsigned listnr;
 
         switch (type) {
         case AUDIT_LIST:
-                /* The *_rcu iterators not needed here because we are
-                   always called with audit_netlink_sem held. */
-                list_for_each_entry(entry, &audit_tsklist, list)
-                        audit_send_reply(pid, seq, AUDIT_LIST, 0, 1,
-                                         &entry->rule, sizeof(entry->rule));
-                list_for_each_entry(entry, &audit_entlist, list)
-                        audit_send_reply(pid, seq, AUDIT_LIST, 0, 1,
-                                         &entry->rule, sizeof(entry->rule));
-                list_for_each_entry(entry, &audit_extlist, list)
-                        audit_send_reply(pid, seq, AUDIT_LIST, 0, 1,
-                                         &entry->rule, sizeof(entry->rule));
-                audit_send_reply(pid, seq, AUDIT_LIST, 1, 1, NULL, 0);
+                /* We can't just spew out the rules here because we might fill
+                 * the available socket buffer space and deadlock waiting for
+                 * auditctl to read from it... which isn't ever going to
+                 * happen if we're actually running in the context of auditctl
+                 * trying to _send_ the stuff */
+                 
+                dest = kmalloc(2 * sizeof(int), GFP_KERNEL);
+                if (!dest)
+                        return -ENOMEM;
+                dest[0] = pid;
+                dest[1] = seq;
+
+                tsk = kthread_run(audit_list_rules, dest, "audit_list_rules");
+                if (IS_ERR(tsk)) {
+                        kfree(dest);
+                        err = PTR_ERR(tsk);
+                }
                 break;
         case AUDIT_ADD:
-                if (!(entry = kmalloc(sizeof(*entry), GFP_KERNEL)))
-                        return -ENOMEM;
-                if (audit_copy_rule(&entry->rule, data)) {
-                        kfree(entry);
+                listnr =((struct audit_rule *)data)->flags & ~AUDIT_FILTER_PREPEND;
+                if (listnr >= AUDIT_NR_FILTERS)
                         return -EINVAL;
-                }
-                flags = entry->rule.flags;
-                if (!err && (flags & AUDIT_PER_TASK))
-                        err = audit_add_rule(entry, &audit_tsklist);
-                if (!err && (flags & AUDIT_AT_ENTRY))
-                        err = audit_add_rule(entry, &audit_entlist);
-                if (!err && (flags & AUDIT_AT_EXIT))
-                        err = audit_add_rule(entry, &audit_extlist);
-                audit_log(NULL, AUDIT_CONFIG_CHANGE, 
-                                "auid=%u added an audit rule\n", loginuid);
+
+                err = audit_add_rule(data, &audit_filter_list[listnr]);
+                if (!err)
+                        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
+                                  "auid=%u added an audit rule\n", loginuid);
                 break;
         case AUDIT_DEL:
-                flags =((struct audit_rule *)data)->flags;
-                if (!err && (flags & AUDIT_PER_TASK))
-                        err = audit_del_rule(data, &audit_tsklist);
-                if (!err && (flags & AUDIT_AT_ENTRY))
-                        err = audit_del_rule(data, &audit_entlist);
-                if (!err && (flags & AUDIT_AT_EXIT))
-                        err = audit_del_rule(data, &audit_extlist);
-                audit_log(NULL, AUDIT_CONFIG_CHANGE,
-                                "auid=%u removed an audit rule\n", loginuid);
+                listnr =((struct audit_rule *)data)->flags & ~AUDIT_FILTER_PREPEND;
+                if (listnr >= AUDIT_NR_FILTERS)
+                        return -EINVAL;
+
+                err = audit_del_rule(data, &audit_filter_list[listnr]);
+                if (!err)
+                        audit_log(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE,
+                                  "auid=%u removed an audit rule\n", loginuid);
                 break;
         default:
                 return -EINVAL;
@@ -384,8 +440,12 @@ static int audit_filter_rules(struct task_struct *tsk,
                                 result = (ctx->return_code == value);
                         break;
                 case AUDIT_SUCCESS:
-                        if (ctx && ctx->return_valid)
-                                result = (ctx->return_valid == AUDITSC_SUCCESS);
+                        if (ctx && ctx->return_valid) {
+                                if (value)
+                                        result = (ctx->return_valid == AUDITSC_SUCCESS);
+                                else
+                                        result = (ctx->return_valid == AUDITSC_FAILURE);
+                        }
                         break;
                 case AUDIT_DEVMAJOR:
                         if (ctx) {
@@ -454,7 +514,7 @@ static enum audit_state audit_filter_task(struct task_struct *tsk)
         enum audit_state   state;
 
         rcu_read_lock();
-        list_for_each_entry_rcu(e, &audit_tsklist, list) {
+        list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) {
                 if (audit_filter_rules(tsk, &e->rule, NULL, &state)) {
                         rcu_read_unlock();
                         return state;
@@ -474,20 +534,84 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
                                              struct list_head *list)
 {
         struct audit_entry *e;
+        enum audit_state state;
+
+        if (audit_pid && tsk->tgid == audit_pid)
+                return AUDIT_DISABLED;
+
+        rcu_read_lock();
+        if (!list_empty(list)) {
+                    int word = AUDIT_WORD(ctx->major);
+                    int bit  = AUDIT_BIT(ctx->major);
+
+                    list_for_each_entry_rcu(e, list, list) {
+                            if ((e->rule.mask[word] & bit) == bit
+                                && audit_filter_rules(tsk, &e->rule, ctx, &state)) {
+                                    rcu_read_unlock();
+                                    return state;
+                            }
+                    }
+        }
+        rcu_read_unlock();
+        return AUDIT_BUILD_CONTEXT;
+}
+
+static int audit_filter_user_rules(struct netlink_skb_parms *cb,
+                              struct audit_rule *rule,
+                              enum audit_state *state)
+{
+        int i;
+
+        for (i = 0; i < rule->field_count; i++) {
+                u32 field  = rule->fields[i] & ~AUDIT_NEGATE;
+                u32 value  = rule->values[i];
+                int result = 0;
+
+                switch (field) {
+                case AUDIT_PID:
+                        result = (cb->creds.pid == value);
+                        break;
+                case AUDIT_UID:
+                        result = (cb->creds.uid == value);
+                        break;
+                case AUDIT_GID:
+                        result = (cb->creds.gid == value);
+                        break;
+                case AUDIT_LOGINUID:
+                        result = (cb->loginuid == value);
+                        break;
+                }
+
+                if (rule->fields[i] & AUDIT_NEGATE)
+                        result = !result;
+                if (!result)
+                        return 0;
+        }
+        switch (rule->action) {
+        case AUDIT_NEVER:    *state = AUDIT_DISABLED;       break;
+        case AUDIT_POSSIBLE: *state = AUDIT_BUILD_CONTEXT;  break;
+        case AUDIT_ALWAYS:   *state = AUDIT_RECORD_CONTEXT; break;
+        }
+        return 1;
+}
+
+int audit_filter_user(struct netlink_skb_parms *cb, int type)
+{
+        struct audit_entry *e;
         enum audit_state   state;
-        int                word = AUDIT_WORD(ctx->major);
-        int                bit  = AUDIT_BIT(ctx->major);
+        int ret = 1;
 
         rcu_read_lock();
-        list_for_each_entry_rcu(e, list, list) {
-                if ((e->rule.mask[word] & bit) == bit
-                    && audit_filter_rules(tsk, &e->rule, ctx, &state)) {
-                        rcu_read_unlock();
-                        return state;
+        list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) {
+                if (audit_filter_user_rules(cb, &e->rule, &state)) {
+                        if (state == AUDIT_DISABLED)
+                                ret = 0;
+                        break;
                 }
         }
         rcu_read_unlock();
-        return AUDIT_BUILD_CONTEXT;
+
+        return ret; /* Audit by default */
 }
 
 /* This should be called with task_lock() held. */
@@ -504,7 +628,7 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
 
         if (context->in_syscall && !context->auditable) {
                 enum audit_state state;
-                state = audit_filter_syscall(tsk, context, &audit_extlist);
+                state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
                 if (state == AUDIT_RECORD_CONTEXT)
                         context->auditable = 1;
         }
@@ -679,13 +803,13 @@ static void audit_log_task_info(struct audit_buffer *ab)
         up_read(&mm->mmap_sem);
 }
 
-static void audit_log_exit(struct audit_context *context)
+static void audit_log_exit(struct audit_context *context, unsigned int gfp_mask)
 {
         int i;
         struct audit_buffer *ab;
         struct audit_aux_data *aux;
 
-        ab = audit_log_start(context, AUDIT_SYSCALL);
+        ab = audit_log_start(context, gfp_mask, AUDIT_SYSCALL);
         if (!ab)
                 return;         /* audit_panic has been called */
         audit_log_format(ab, "arch=%x syscall=%d",
@@ -717,7 +841,7 @@ static void audit_log_exit(struct audit_context *context)
 
         for (aux = context->aux; aux; aux = aux->next) {
 
-                ab = audit_log_start(context, aux->type);
+                ab = audit_log_start(context, GFP_KERNEL, aux->type);
                 if (!ab)
                         continue; /* audit_panic has been called */
 
@@ -754,14 +878,14 @@ static void audit_log_exit(struct audit_context *context)
         }
 
         if (context->pwd && context->pwdmnt) {
-                ab = audit_log_start(context, AUDIT_CWD);
+                ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
                 if (ab) {
                         audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt);
                         audit_log_end(ab);
                 }
         }
         for (i = 0; i < context->name_count; i++) {
-                ab = audit_log_start(context, AUDIT_PATH);
+                ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
                 if (!ab)
                         continue; /* audit_panic has been called */
 
@@ -770,6 +894,8 @@ static void audit_log_exit(struct audit_context *context)
                         audit_log_format(ab, " name=");
                         audit_log_untrustedstring(ab, context->names[i].name);
                 }
+                audit_log_format(ab, " flags=%x\n", context->names[i].flags);
+                         
                 if (context->names[i].ino != (unsigned long)-1)
                         audit_log_format(ab, " inode=%lu dev=%02x:%02x mode=%#o"
                                              " ouid=%u ogid=%u rdev=%02x:%02x",
@@ -799,9 +925,11 @@ void audit_free(struct task_struct *tsk)
                 return;
 
         /* Check for system calls that do not go through the exit
-         * function (e.g., exit_group), then free context block. */
-        if (context->in_syscall && context->auditable && context->pid != audit_pid)
-                audit_log_exit(context);
+         * function (e.g., exit_group), then free context block. 
+         * We use GFP_ATOMIC here because we might be doing this 
+         * in the context of the idle thread */
+        if (context->in_syscall && context->auditable)
+                audit_log_exit(context, GFP_ATOMIC);
 
         audit_free_context(context);
 }
@@ -876,11 +1004,11 @@ void audit_syscall_entry(struct task_struct *tsk, int arch, int major,
 
         state = context->state;
         if (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT)
-                state = audit_filter_syscall(tsk, context, &audit_entlist);
+                state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
         if (likely(state == AUDIT_DISABLED))
                 return;
 
-        context->serial     = audit_serial();
+        context->serial     = 0;
         context->ctime      = CURRENT_TIME;
         context->in_syscall = 1;
         context->auditable  = !!(state == AUDIT_RECORD_CONTEXT);
@@ -903,10 +1031,10 @@ void audit_syscall_exit(struct task_struct *tsk, int valid, long return_code)
         /* Not having a context here is ok, since the parent may have
          * called __put_task_struct. */
         if (likely(!context))
-                return;
+                goto out;
 
-        if (context->in_syscall && context->auditable && context->pid != audit_pid)
-                audit_log_exit(context);
+        if (context->in_syscall && context->auditable)
+                audit_log_exit(context, GFP_KERNEL);
 
         context->in_syscall = 0;
         context->auditable  = 0;
@@ -919,9 +1047,9 @@ void audit_syscall_exit(struct task_struct *tsk, int valid, long return_code)
         } else {
                 audit_free_names(context);
                 audit_free_aux(context);
-                audit_zero_context(context, context->state);
                 tsk->audit_context = context;
         }
+ out:
         put_task_struct(tsk);
 }
 
@@ -996,7 +1124,7 @@ void audit_putname(const char *name)
 
 /* Store the inode and device from a lookup.  Called from
  * fs/namei.c:path_lookup(). */
-void audit_inode(const char *name, const struct inode *inode)
+void audit_inode(const char *name, const struct inode *inode, unsigned flags)
 {
         int idx;
         struct audit_context *context = current->audit_context;
@@ -1022,17 +1150,20 @@ void audit_inode(const char *name, const struct inode *inode)
                 ++context->ino_count;
 #endif
         }
-        context->names[idx].ino  = inode->i_ino;
-        context->names[idx].dev  = inode->i_sb->s_dev;
-        context->names[idx].mode = inode->i_mode;
-        context->names[idx].uid  = inode->i_uid;
-        context->names[idx].gid  = inode->i_gid;
-        context->names[idx].rdev = inode->i_rdev;
+        context->names[idx].flags = flags;
+        context->names[idx].ino   = inode->i_ino;
+        context->names[idx].dev   = inode->i_sb->s_dev;
+        context->names[idx].mode  = inode->i_mode;
+        context->names[idx].uid   = inode->i_uid;
+        context->names[idx].gid   = inode->i_gid;
+        context->names[idx].rdev  = inode->i_rdev;
 }
 
 void auditsc_get_stamp(struct audit_context *ctx,
                        struct timespec *t, unsigned int *serial)
 {
+        if (!ctx->serial)
+                ctx->serial = audit_serial();
         t->tv_sec  = ctx->ctime.tv_sec;
         t->tv_nsec = ctx->ctime.tv_nsec;
         *serial    = ctx->serial;
@@ -1044,7 +1175,7 @@ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
         if (task->audit_context) {
                 struct audit_buffer *ab;
 
-                ab = audit_log_start(NULL, AUDIT_LOGIN);
+                ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
                 if (ab) {
                         audit_log_format(ab, "login pid=%d uid=%u "
                                 "old auid=%u new auid=%u",
@@ -1153,7 +1284,7 @@ void audit_signal_info(int sig, struct task_struct *t)
         extern pid_t audit_sig_pid;
         extern uid_t audit_sig_uid;
 
-        if (unlikely(audit_pid && t->pid == audit_pid)) {
+        if (unlikely(audit_pid && t->tgid == audit_pid)) {
                 if (sig == SIGTERM || sig == SIGHUP) {
                         struct audit_context *ctx = current->audit_context;
                         audit_sig_pid = current->pid;
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 79866bc6b3a1..45a5719a0104 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -968,8 +968,6 @@ static ssize_t cpuset_common_file_read(struct file *file, char __user *buf,
         char *page;
         ssize_t retval = 0;
         char *s;
-        char *start;
-        size_t n;
 
         if (!(page = (char *)__get_free_page(GFP_KERNEL)))
                 return -ENOMEM;
@@ -999,14 +997,7 @@ static ssize_t cpuset_common_file_read(struct file *file, char __user *buf,
         *s++ = '\n';
         *s = '\0';
 
-        /* Do nothing if *ppos is at the eof or beyond the eof. */
-        if (s - page <= *ppos)
-                return 0;
-
-        start = page + *ppos;
-        n = s - start;
-        retval = n - copy_to_user(buf, start, min(n, nbytes));
-        *ppos += retval;
+        retval = simple_read_from_buffer(buf, nbytes, ppos, page, s - page);
 out:
         free_page((unsigned long)page);
         return retval;
diff --git a/kernel/exit.c b/kernel/exit.c
index 6d2089a1bce7..43077732619b 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -371,6 +371,12 @@ static inline void close_files(struct files_struct * files)
         struct fdtable *fdt;
 
         j = 0;
+
+        /*
+         * It is safe to dereference the fd table without RCU or
+         * ->file_lock because this is the last reference to the
+         * files structure.
+         */
         fdt = files_fdtable(files);
         for (;;) {
                 unsigned long set;
@@ -1197,7 +1203,7 @@ static int wait_task_stopped(task_t *p, int delayed_group_leader, int noreap,
 
                 exit_code = p->exit_code;
                 if (unlikely(!exit_code) ||
-                    unlikely(p->state > TASK_STOPPED))
+                    unlikely(p->state & TASK_TRACED))
                         goto bail_ref;
                 return wait_noreap_copyout(p, pid, uid,
                                            why, (exit_code << 8) | 0x7f,
diff --git a/kernel/fork.c b/kernel/fork.c
index 8149f3602881..533ce27f4b2c 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1062,7 +1062,8 @@ static task_t *copy_process(unsigned long clone_flags,
          * parent's CPU). This avoids alot of nasty races.
          */
         p->cpus_allowed = current->cpus_allowed;
-        if (unlikely(!cpu_isset(task_cpu(p), p->cpus_allowed)))
+        if (unlikely(!cpu_isset(task_cpu(p), p->cpus_allowed) ||
+                        !cpu_online(task_cpu(p))))
                 set_task_cpu(p, smp_processor_id());
 
         /*
diff --git a/kernel/module.c b/kernel/module.c
index 4b39d3793c72..ff5c500ab625 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -20,6 +20,7 @@
 #include <linux/module.h>
 #include <linux/moduleloader.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/elf.h>
@@ -498,7 +499,7 @@ static inline int try_force(unsigned int flags)
 {
         int ret = (flags & O_TRUNC);
         if (ret)
-                tainted |= TAINT_FORCED_MODULE;
+                add_taint(TAINT_FORCED_MODULE);
         return ret;
 }
 #else
@@ -897,7 +898,7 @@ static int check_version(Elf_Shdr *sechdrs,
         if (!(tainted & TAINT_FORCED_MODULE)) {
                 printk("%s: no version for \"%s\" found: kernel tainted.\n",
                        mod->name, symname);
-                tainted |= TAINT_FORCED_MODULE;
+                add_taint(TAINT_FORCED_MODULE);
         }
         return 1;
 }
@@ -1352,7 +1353,7 @@ static void set_license(struct module *mod, const char *license)
         if (!mod->license_gplok && !(tainted & TAINT_PROPRIETARY_MODULE)) {
                 printk(KERN_WARNING "%s: module license '%s' taints kernel.\n",
                        mod->name, license);
-                tainted |= TAINT_PROPRIETARY_MODULE;
+                add_taint(TAINT_PROPRIETARY_MODULE);
         }
 }
 
@@ -1610,7 +1611,7 @@ static struct module *load_module(void __user *umod,
         modmagic = get_modinfo(sechdrs, infoindex, "vermagic");
         /* This is allowed: modprobe --force will invalidate it. */
         if (!modmagic) {
-                tainted |= TAINT_FORCED_MODULE;
+                add_taint(TAINT_FORCED_MODULE);
                 printk(KERN_WARNING "%s: no version magic, tainting kernel.\n",
                        mod->name);
         } else if (!same_magic(modmagic, vermagic)) {
@@ -1739,7 +1740,7 @@ static struct module *load_module(void __user *umod,
             (mod->num_gpl_syms && !gplcrcindex)) {
                 printk(KERN_WARNING "%s: No versions for exported symbols."
                        " Tainting kernel.\n", mod->name);
-                tainted |= TAINT_FORCED_MODULE;
+                add_taint(TAINT_FORCED_MODULE);
         }
 #endif
 
diff --git a/kernel/params.c b/kernel/params.c
index fbf173215fd2..1a8614bac5d5 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -80,8 +80,6 @@ static char *next_arg(char *args, char **param, char **val)
         int in_quote = 0, quoted = 0;
         char *next;
 
-        /* Chew any extra spaces */
-        while (*args == ' ') args++;
         if (*args == '"') {
                 args++;
                 in_quote = 1;
@@ -121,6 +119,10 @@ static char *next_arg(char *args, char **param, char **val)
                 next = args + i + 1;
         } else
                 next = args + i;
+
+        /* Chew up trailing spaces. */
+        while (*next == ' ')
+                next++;
         return next;
 }
 
@@ -135,6 +137,10 @@ int parse_args(const char *name,
 
         DEBUGP("Parsing ARGS: %s\n", args);
 
+        /* Chew leading spaces */
+        while (*args == ' ')
+                args++;
+
         while (*args) {
                 int ret;
 
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 396c7873e804..46a5e5acff97 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -29,7 +29,7 @@ config PM_DEBUG
 
 config SOFTWARE_SUSPEND
         bool "Software Suspend"
-        depends on PM && SWAP && (X86 || ((FVR || PPC32) && !SMP))
+        depends on PM && SWAP && (X86 && (!SMP || SUSPEND_SMP)) || ((FVR || PPC32) && !SMP)
         ---help---
           Enable the possibility of suspending the machine.
           It doesn't need APM.
diff --git a/kernel/power/disk.c b/kernel/power/disk.c
index 2d8bf054d036..761956e813f5 100644
--- a/kernel/power/disk.c
+++ b/kernel/power/disk.c
@@ -17,12 +17,12 @@
 #include <linux/delay.h>
 #include <linux/fs.h>
 #include <linux/mount.h>
+#include <linux/pm.h>
 
 #include "power.h"
 
 
 extern suspend_disk_method_t pm_disk_mode;
-extern struct pm_ops * pm_ops;
 
 extern int swsusp_suspend(void);
 extern int swsusp_write(void);
@@ -49,13 +49,11 @@ dev_t swsusp_resume_device;
 
 static void power_down(suspend_disk_method_t mode)
 {
-        unsigned long flags;
         int error = 0;
 
-        local_irq_save(flags);
         switch(mode) {
         case PM_DISK_PLATFORM:
-                device_shutdown();
+                kernel_power_off_prepare();
                 error = pm_ops->enter(PM_SUSPEND_DISK);
                 break;
         case PM_DISK_SHUTDOWN:
diff --git a/kernel/power/power.h b/kernel/power/power.h
index cd6a3493cc0d..6748de23e83c 100644
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -1,7 +1,7 @@
 #include <linux/suspend.h>
 #include <linux/utsname.h>
 
-/* With SUSPEND_CONSOLE defined, it suspend looks *really* cool, but
+/* With SUSPEND_CONSOLE defined suspend looks *really* cool, but
    we probably do not take enough locks for switching consoles, etc,
    so bad things might happen.
 */
@@ -9,6 +9,9 @@
 #define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1)
 #endif
 
+#define MAX_PBES        ((PAGE_SIZE - sizeof(struct new_utsname) \
+                        - 4 - 3*sizeof(unsigned long) - sizeof(int) \
+                        - sizeof(void *)) / sizeof(swp_entry_t))
 
 struct swsusp_info {
         struct new_utsname      uts;
@@ -18,7 +21,7 @@ struct swsusp_info {
         unsigned long           image_pages;
         unsigned long           pagedir_pages;
         suspend_pagedir_t       * suspend_pagedir;
-        swp_entry_t             pagedir[768];
+        swp_entry_t             pagedir[MAX_PBES];
 } __attribute__((aligned(PAGE_SIZE)));
 
 
diff --git a/kernel/power/swsusp.c b/kernel/power/swsusp.c
index d967e875ee82..acf79ac1cb6d 100644
--- a/kernel/power/swsusp.c
+++ b/kernel/power/swsusp.c
@@ -363,7 +363,7 @@ static void lock_swapdevices(void)
 }
 
 /**
- *      write_swap_page - Write one page to a fresh swap location.
+ *      write_page - Write one page to a fresh swap location.
  *      @addr:  Address we're writing.
  *      @loc:   Place to store the entry we used.
  *
@@ -402,15 +402,14 @@ static int write_page(unsigned long addr, swp_entry_t * loc)
 static void data_free(void)
 {
         swp_entry_t entry;
-        int i;
+        struct pbe * p;
 
-        for (i = 0; i < nr_copy_pages; i++) {
-                entry = (pagedir_nosave + i)->swap_address;
+        for_each_pbe(p, pagedir_nosave) {
+                entry = p->swap_address;
                 if (entry.val)
                         swap_free(entry);
                 else
                         break;
-                (pagedir_nosave + i)->swap_address = (swp_entry_t){0};
         }
 }
 
@@ -863,6 +862,9 @@ static int alloc_image_pages(void)
         return 0;
 }
 
+/* Free pages we allocated for suspend. Suspend pages are alocated
+ * before atomic copy, so we need to free them after resume.
+ */
 void swsusp_free(void)
 {
         BUG_ON(PageNosave(virt_to_page(pagedir_save)));
@@ -918,6 +920,7 @@ static int swsusp_alloc(void)
 
         pagedir_nosave = NULL;
         nr_copy_pages = calc_nr(nr_copy_pages);
+        nr_copy_pages_check = nr_copy_pages;
 
         pr_debug("suspend: (pages needed: %d + %d free: %d)\n",
                  nr_copy_pages, PAGES_FOR_IO, nr_free_pages());
@@ -928,6 +931,10 @@ static int swsusp_alloc(void)
         if (!enough_swap())
                 return -ENOSPC;
 
+        if (MAX_PBES < nr_copy_pages / PBES_PER_PAGE +
+            !!(nr_copy_pages % PBES_PER_PAGE))
+                return -ENOSPC;
+
         if (!(pagedir_save = alloc_pagedir(nr_copy_pages))) {
                 printk(KERN_ERR "suspend: Allocating pagedir failed.\n");
                 return -ENOMEM;
@@ -940,7 +947,6 @@ static int swsusp_alloc(void)
                 return error;
         }
 
-        nr_copy_pages_check = nr_copy_pages;
         return 0;
 }
 
@@ -1213,8 +1219,9 @@ static struct pbe * swsusp_pagedir_relocate(struct pbe *pblist)
                 free_pagedir(pblist);
                 free_eaten_memory();
                 pblist = NULL;
-        }
-        else
+                /* Is this even worth handling? It should never ever happen, and we
+                   have just lost user's state, anyway... */
+        } else
                 printk("swsusp: Relocated %d pages\n", rel);
 
         return pblist;
@@ -1434,9 +1441,9 @@ static int read_pagedir(struct pbe *pblist)
         }
 
         if (error)
-                free_page((unsigned long)pblist);
-
-        BUG_ON(i != swsusp_info.pagedir_pages);
+                free_pagedir(pblist);
+        else
+                BUG_ON(i != swsusp_info.pagedir_pages);
 
         return error;
 }
diff --git a/kernel/printk.c b/kernel/printk.c
index a967605bc2e3..4b8f0f9230a4 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -488,6 +488,11 @@ static int __init printk_time_setup(char *str)
 
 __setup("time", printk_time_setup);
 
+__attribute__((weak)) unsigned long long printk_clock(void)
+{
+        return sched_clock();
+}
+
 /*
  * This is printk.  It can be called from any context.  We want it to work.
  * 
@@ -565,7 +570,7 @@ asmlinkage int vprintk(const char *fmt, va_list args)
                                         loglev_char = default_message_loglevel
                                                 + '0';
                                 }
-                                t = sched_clock();
+                                t = printk_clock();
                                 nanosec_rem = do_div(t, 1000000000);
                                 tlen = sprintf(tbuf,
                                                 "<%c>[%5lu.%06lu] ",
diff --git a/kernel/sched.c b/kernel/sched.c
index 81b3a96ed2d0..1f31a528fdba 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -294,6 +294,10 @@ static inline void prepare_lock_switch(runqueue_t *rq, task_t *next)
 
 static inline void finish_lock_switch(runqueue_t *rq, task_t *prev)
 {
+#ifdef CONFIG_DEBUG_SPINLOCK
+        /* this is a valid case when another task releases the spinlock */
+        rq->lock.owner = current;
+#endif
         spin_unlock_irq(&rq->lock);
 }
 
@@ -1529,10 +1533,6 @@ static inline void finish_task_switch(runqueue_t *rq, task_t *prev)
          *              Manfred Spraul <manfred@colorfullife.com>
          */
         prev_task_flags = prev->flags;
-#ifdef CONFIG_DEBUG_SPINLOCK
-        /* this is a valid case when another task releases the spinlock */
-        rq->lock.owner = current;
-#endif
         finish_arch_switch(prev);
         finish_lock_switch(rq, prev);
         if (mm)
diff --git a/kernel/signal.c b/kernel/signal.c
index b92c3c9f8b9a..619b027e92b5 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -936,34 +936,31 @@ force_sig_specific(int sig, struct task_struct *t)
  * as soon as they're available, so putting the signal on the shared queue
  * will be equivalent to sending it to one such thread.
  */
-#define wants_signal(sig, p, mask)                      \
-        (!sigismember(&(p)->blocked, sig)               \
-         && !((p)->state & mask)                        \
-         && !((p)->flags & PF_EXITING)                  \
-         && (task_curr(p) || !signal_pending(p)))
-
+static inline int wants_signal(int sig, struct task_struct *p)
+{
+        if (sigismember(&p->blocked, sig))
+                return 0;
+        if (p->flags & PF_EXITING)
+                return 0;
+        if (sig == SIGKILL)
+                return 1;
+        if (p->state & (TASK_STOPPED | TASK_TRACED))
+                return 0;
+        return task_curr(p) || !signal_pending(p);
+}
 
 static void
 __group_complete_signal(int sig, struct task_struct *p)
 {
-        unsigned int mask;
         struct task_struct *t;
 
         /*
-         * Don't bother traced and stopped tasks (but
-         * SIGKILL will punch through that).
-         */
-        mask = TASK_STOPPED | TASK_TRACED;
-        if (sig == SIGKILL)
-                mask = 0;
-
-        /*
          * Now find a thread we can wake up to take the signal off the queue.
          *
          * If the main thread wants the signal, it gets first crack.
          * Probably the least surprising to the average bear.
          */
-        if (wants_signal(sig, p, mask))
+        if (wants_signal(sig, p))
                 t = p;
         else if (thread_group_empty(p))
                 /*
@@ -981,7 +978,7 @@ __group_complete_signal(int sig, struct task_struct *p)
                         t = p->signal->curr_target = p;
                 BUG_ON(t->tgid != p->tgid);
 
-                while (!wants_signal(sig, t, mask)) {
+                while (!wants_signal(sig, t)) {
                         t = next_thread(t);
                         if (t == p->signal->curr_target)
                                 /*
@@ -1766,7 +1763,8 @@ do_signal_stop(int signr)
                                  * stop is always done with the siglock held,
                                  * so this check has no races.
                                  */
-                                if (t->state < TASK_STOPPED) {
+                                if (!t->exit_state &&
+                                    !(t->state & (TASK_STOPPED|TASK_TRACED))) {
                                         stop_count++;
                                         signal_wake_up(t, 0);
                                 }
diff --git a/kernel/sys.c b/kernel/sys.c
index c80412be2302..2fa1ed18123c 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -361,17 +361,35 @@ out_unlock:
         return retval;
 }
 
+/**
+ *      emergency_restart - reboot the system
+ *
+ *      Without shutting down any hardware or taking any locks
+ *      reboot the system.  This is called when we know we are in
+ *      trouble so this is our best effort to reboot.  This is
+ *      safe to call in interrupt context.
+ */
 void emergency_restart(void)
 {
         machine_emergency_restart();
 }
 EXPORT_SYMBOL_GPL(emergency_restart);
 
-void kernel_restart(char *cmd)
+/**
+ *      kernel_restart - reboot the system
+ *
+ *      Shutdown everything and perform a clean reboot.
+ *      This is not safe to call in interrupt context.
+ */
+void kernel_restart_prepare(char *cmd)
 {
         notifier_call_chain(&reboot_notifier_list, SYS_RESTART, cmd);
         system_state = SYSTEM_RESTART;
         device_shutdown();
+}
+void kernel_restart(char *cmd)
+{
+        kernel_restart_prepare(cmd);
         if (!cmd) {
                 printk(KERN_EMERG "Restarting system.\n");
         } else {
@@ -382,6 +400,12 @@ void kernel_restart(char *cmd)
 }
 EXPORT_SYMBOL_GPL(kernel_restart);
 
+/**
+ *      kernel_kexec - reboot the system
+ *
+ *      Move into place and start executing a preloaded standalone
+ *      executable.  If nothing was preloaded return an error.
+ */
 void kernel_kexec(void)
 {
 #ifdef CONFIG_KEXEC
@@ -390,9 +414,7 @@ void kernel_kexec(void)
         if (!image) {
                 return;
         }
-        notifier_call_chain(&reboot_notifier_list, SYS_RESTART, NULL);
-        system_state = SYSTEM_RESTART;
-        device_shutdown();
+        kernel_restart_prepare(NULL);
         printk(KERN_EMERG "Starting new kernel\n");
         machine_shutdown();
         machine_kexec(image);
@@ -400,21 +422,39 @@ void kernel_kexec(void)
 }
 EXPORT_SYMBOL_GPL(kernel_kexec);
 
-void kernel_halt(void)
+/**
+ *      kernel_halt - halt the system
+ *
+ *      Shutdown everything and perform a clean system halt.
+ */
+void kernel_halt_prepare(void)
 {
         notifier_call_chain(&reboot_notifier_list, SYS_HALT, NULL);
         system_state = SYSTEM_HALT;
         device_shutdown();
+}
+void kernel_halt(void)
+{
+        kernel_halt_prepare();
         printk(KERN_EMERG "System halted.\n");
         machine_halt();
 }
 EXPORT_SYMBOL_GPL(kernel_halt);
 
-void kernel_power_off(void)
+/**
+ *      kernel_power_off - power_off the system
+ *
+ *      Shutdown everything and perform a clean system power_off.
+ */
+void kernel_power_off_prepare(void)
 {
         notifier_call_chain(&reboot_notifier_list, SYS_POWER_OFF, NULL);
         system_state = SYSTEM_POWER_OFF;
         device_shutdown();
+}
+void kernel_power_off(void)
+{
+        kernel_power_off_prepare();
         printk(KERN_EMERG "Power down.\n");
         machine_power_off();
 }
@@ -1728,8 +1768,7 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
                         error = put_user(current->pdeath_signal, (int __user *)arg2);
                         break;
                 case PR_GET_DUMPABLE:
-                        if (current->mm->dumpable)
-                                error = 1;
+                        error = current->mm->dumpable;
                         break;
                 case PR_SET_DUMPABLE:
                         if (arg2 < 0 || arg2 > 2) {
diff --git a/kernel/timer.c b/kernel/timer.c
index f4152fcd9f8e..3ba10fa35b60 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1151,19 +1151,22 @@ fastcall signed long __sched schedule_timeout(signed long timeout)
  out:
         return timeout < 0 ? 0 : timeout;
 }
-
 EXPORT_SYMBOL(schedule_timeout);
 
+/*
+ * We can use __set_current_state() here because schedule_timeout() calls
+ * schedule() unconditionally.
+ */
 signed long __sched schedule_timeout_interruptible(signed long timeout)
 {
-       set_current_state(TASK_INTERRUPTIBLE);
+       __set_current_state(TASK_INTERRUPTIBLE);
        return schedule_timeout(timeout);
 }
 EXPORT_SYMBOL(schedule_timeout_interruptible);
 
 signed long __sched schedule_timeout_uninterruptible(signed long timeout)
 {
-       set_current_state(TASK_UNINTERRUPTIBLE);
+       __set_current_state(TASK_UNINTERRUPTIBLE);
        return schedule_timeout(timeout);
 }
 EXPORT_SYMBOL(schedule_timeout_uninterruptible);
diff --git a/lib/dec_and_lock.c b/lib/dec_and_lock.c
index 2377af057d09..305a9663aee3 100644
--- a/lib/dec_and_lock.c
+++ b/lib/dec_and_lock.c
@@ -1,7 +1,41 @@
 #include <linux/module.h>
 #include <linux/spinlock.h>
 #include <asm/atomic.h>
+#include <asm/system.h>
 
+#ifdef __HAVE_ARCH_CMPXCHG
+/*
+ * This is an implementation of the notion of "decrement a
+ * reference count, and return locked if it decremented to zero".
+ *
+ * This implementation can be used on any architecture that
+ * has a cmpxchg, and where atomic->value is an int holding
+ * the value of the atomic (i.e. the high bits aren't used
+ * for a lock or anything like that).
+ */
+int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock)
+{
+        int counter;
+        int newcount;
+
+        for (;;) {
+                counter = atomic_read(atomic);
+                newcount = counter - 1;
+                if (!newcount)
+                        break;          /* do it the slow way */
+
+                newcount = cmpxchg(&atomic->counter, counter, newcount);
+                if (newcount == counter)
+                        return 0;
+        }
+
+        spin_lock(lock);
+        if (atomic_dec_and_test(atomic))
+                return 1;
+        spin_unlock(lock);
+        return 0;
+}
+#else
 /*
  * This is an architecture-neutral, but slow,
  * implementation of the notion of "decrement
@@ -33,5 +67,6 @@ int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock)
         spin_unlock(lock);
         return 0;
 }
+#endif
 
 EXPORT_SYMBOL(_atomic_dec_and_lock);
diff --git a/mm/Kconfig b/mm/Kconfig
index 4e9937ac3529..391ffc54d136 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -29,7 +29,7 @@ config FLATMEM_MANUAL
           If unsure, choose this option (Flat Memory) over any other.
 
 config DISCONTIGMEM_MANUAL
-        bool "Discontigious Memory"
+        bool "Discontiguous Memory"
         depends on ARCH_DISCONTIGMEM_ENABLE
         help
           This option provides enhanced support for discontiguous
@@ -52,7 +52,7 @@ config SPARSEMEM_MANUAL
           memory hotplug systems.  This is normal.
 
           For many other systems, this will be an alternative to
-          "Discontigious Memory".  This option provides some potential
+          "Discontiguous Memory".  This option provides some potential
           performance benefits, along with decreased code complexity,
           but it is newer, and more experimental.
 
diff --git a/mm/bootmem.c b/mm/bootmem.c
index 8ec4e4c2a179..c1330cc19783 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -61,17 +61,9 @@ static unsigned long __init init_bootmem_core (pg_data_t *pgdat,
 {
         bootmem_data_t *bdata = pgdat->bdata;
         unsigned long mapsize = ((end - start)+7)/8;
-        static struct pglist_data *pgdat_last;
-
-        pgdat->pgdat_next = NULL;
-        /* Add new nodes last so that bootmem always starts
-           searching in the first nodes, not the last ones */
-        if (pgdat_last)
-                pgdat_last->pgdat_next = pgdat;
-        else {
-                pgdat_list = pgdat;     
-                pgdat_last = pgdat;
-        }
+
+        pgdat->pgdat_next = pgdat_list;
+        pgdat_list = pgdat;
 
         mapsize = ALIGN(mapsize, sizeof(long));
         bdata->node_bootmem_map = phys_to_virt(mapstart << PAGE_SHIFT);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index afa06e184d88..9033f0859aa8 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -333,8 +333,13 @@ check_range(struct mm_struct *mm, unsigned long start, unsigned long end,
                 if (prev && prev->vm_end < vma->vm_start)
                         return ERR_PTR(-EFAULT);
                 if ((flags & MPOL_MF_STRICT) && !is_vm_hugetlb_page(vma)) {
+                        unsigned long endvma = vma->vm_end;
+                        if (endvma > end)
+                                endvma = end;
+                        if (vma->vm_start > start)
+                                start = vma->vm_start;
                         err = check_pgd_range(vma->vm_mm,
-                                           vma->vm_start, vma->vm_end, nodes);
+                                           start, endvma, nodes);
                         if (err) {
                                 first = ERR_PTR(err);
                                 break;
diff --git a/mm/mmap.c b/mm/mmap.c
index 12334aecf8ad..fa11d91242e8 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1640,7 +1640,7 @@ static void unmap_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
 /*
  * Get rid of page table information in the indicated region.
  *
- * Called with the page table lock held.
+ * Called with the mm semaphore held.
  */
 static void unmap_region(struct mm_struct *mm,
                 struct vm_area_struct *vma, struct vm_area_struct *prev,
@@ -1993,6 +1993,9 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
         __vma = find_vma_prepare(mm,vma->vm_start,&prev,&rb_link,&rb_parent);
         if (__vma && __vma->vm_start < vma->vm_end)
                 return -ENOMEM;
+        if ((vma->vm_flags & VM_ACCOUNT) &&
+             security_vm_enough_memory(vma_pages(vma)))
+                return -ENOMEM;
         vma_link(mm, vma, prev, rb_link, rb_parent);
         return 0;
 }
diff --git a/mm/mprotect.c b/mm/mprotect.c
index e9fbd013ad9a..57577f63b305 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -248,7 +248,8 @@ sys_mprotect(unsigned long start, size_t len, unsigned long prot)
 
                 newflags = vm_flags | (vma->vm_flags & ~(VM_READ | VM_WRITE | VM_EXEC));
 
-                if ((newflags & ~(newflags >> 4)) & 0xf) {
+                /* newflags >> 4 shift VM_MAY% in place of VM_% */
+                if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
                         error = -EACCES;
                         goto out;
                 }
diff --git a/mm/mremap.c b/mm/mremap.c
index a32fed454bd7..f343fc73a8bd 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -141,10 +141,10 @@ move_one_page(struct vm_area_struct *vma, unsigned long old_addr,
                         if (dst) {
                                 pte_t pte;
                                 pte = ptep_clear_flush(vma, old_addr, src);
+
                                 /* ZERO_PAGE can be dependant on virtual addr */
-                                if (pfn_valid(pte_pfn(pte)) &&
-                                        pte_page(pte) == ZERO_PAGE(old_addr))
-                                        pte = pte_wrprotect(mk_pte(ZERO_PAGE(new_addr), new_vma->vm_page_prot));
+                                pte = move_pte(pte, new_vma->vm_page_prot,
+                                                        old_addr, new_addr);
                                 set_pte_at(mm, new_addr, dst, pte);
                         } else
                                 error = -ENOMEM;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index c5823c395f71..ae2903339e71 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -22,6 +22,7 @@
 #include <linux/pagemap.h>
 #include <linux/bootmem.h>
 #include <linux/compiler.h>
+#include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/suspend.h>
 #include <linux/pagevec.h>
@@ -117,7 +118,7 @@ static void bad_page(const char *function, struct page *page)
         set_page_count(page, 0);
         reset_page_mapcount(page);
         page->mapping = NULL;
-        tainted |= TAINT_BAD_PAGE;
+        add_taint(TAINT_BAD_PAGE);
 }
 
 #ifndef CONFIG_HUGETLB_PAGE
diff --git a/mm/slab.c b/mm/slab.c
index 9e876d6dfad9..5cbbdfa6dd0e 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -308,12 +308,12 @@ struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
 #define SIZE_L3 (1 + MAX_NUMNODES)
 
 /*
- * This function may be completely optimized away if
+ * This function must be completely optimized away if
  * a constant is passed to it. Mostly the same as
  * what is in linux/slab.h except it returns an
  * index.
  */
-static inline int index_of(const size_t size)
+static __always_inline int index_of(const size_t size)
 {
         if (__builtin_constant_p(size)) {
                 int i = 0;
@@ -329,7 +329,8 @@ static inline int index_of(const size_t size)
                         extern void __bad_size(void);
                         __bad_size();
                 }
-        }
+        } else
+                BUG();
         return 0;
 }
 
@@ -639,7 +640,7 @@ static enum {
 
 static DEFINE_PER_CPU(struct work_struct, reap_work);
 
-static void free_block(kmem_cache_t* cachep, void** objpp, int len);
+static void free_block(kmem_cache_t* cachep, void** objpp, int len, int node);
 static void enable_cpucache (kmem_cache_t *cachep);
 static void cache_reap (void *unused);
 static int __node_shrink(kmem_cache_t *cachep, int node);
@@ -659,7 +660,7 @@ static inline kmem_cache_t *__find_general_cachep(size_t size,
         * kmem_cache_create(), or __kmalloc(), before
         * the generic caches are initialized.
         */
-        BUG_ON(csizep->cs_cachep == NULL);
+        BUG_ON(malloc_sizes[INDEX_AC].cs_cachep == NULL);
 #endif
         while (size > csizep->cs_size)
                 csizep++;
@@ -804,7 +805,7 @@ static inline void __drain_alien_cache(kmem_cache_t *cachep, struct array_cache
 
         if (ac->avail) {
                 spin_lock(&rl3->list_lock);
-                free_block(cachep, ac->entry, ac->avail);
+                free_block(cachep, ac->entry, ac->avail, node);
                 ac->avail = 0;
                 spin_unlock(&rl3->list_lock);
         }
@@ -925,7 +926,7 @@ static int __devinit cpuup_callback(struct notifier_block *nfb,
                         /* Free limit for this kmem_list3 */
                         l3->free_limit -= cachep->batchcount;
                         if (nc)
-                                free_block(cachep, nc->entry, nc->avail);
+                                free_block(cachep, nc->entry, nc->avail, node);
 
                         if (!cpus_empty(mask)) {
                                 spin_unlock(&l3->list_lock);
@@ -934,7 +935,7 @@ static int __devinit cpuup_callback(struct notifier_block *nfb,
 
                         if (l3->shared) {
                                 free_block(cachep, l3->shared->entry,
-                                                l3->shared->avail);
+                                                l3->shared->avail, node);
                                 kfree(l3->shared);
                                 l3->shared = NULL;
                         }
@@ -1882,12 +1883,13 @@ static void do_drain(void *arg)
 {
         kmem_cache_t *cachep = (kmem_cache_t*)arg;
         struct array_cache *ac;
+        int node = numa_node_id();
 
         check_irq_off();
         ac = ac_data(cachep);
-        spin_lock(&cachep->nodelists[numa_node_id()]->list_lock);
-        free_block(cachep, ac->entry, ac->avail);
-        spin_unlock(&cachep->nodelists[numa_node_id()]->list_lock);
+        spin_lock(&cachep->nodelists[node]->list_lock);
+        free_block(cachep, ac->entry, ac->avail, node);
+        spin_unlock(&cachep->nodelists[node]->list_lock);
         ac->avail = 0;
 }
 
@@ -2508,16 +2510,12 @@ cache_alloc_debugcheck_after(kmem_cache_t *cachep,
 #define cache_alloc_debugcheck_after(a,b,objp,d) (objp)
 #endif
 
-
-static inline void *__cache_alloc(kmem_cache_t *cachep, unsigned int __nocast flags)
+static inline void *____cache_alloc(kmem_cache_t *cachep, unsigned int __nocast flags)
 {
-        unsigned long save_flags;
         void* objp;
         struct array_cache *ac;
 
-        cache_alloc_debugcheck_before(cachep, flags);
-
-        local_irq_save(save_flags);
+        check_irq_off();
         ac = ac_data(cachep);
         if (likely(ac->avail)) {
                 STATS_INC_ALLOCHIT(cachep);
@@ -2527,6 +2525,18 @@ static inline void *__cache_alloc(kmem_cache_t *cachep, unsigned int __nocast fl
                 STATS_INC_ALLOCMISS(cachep);
                 objp = cache_alloc_refill(cachep, flags);
         }
+        return objp;
+}
+
+static inline void *__cache_alloc(kmem_cache_t *cachep, unsigned int __nocast flags)
+{
+        unsigned long save_flags;
+        void* objp;
+
+        cache_alloc_debugcheck_before(cachep, flags);
+
+        local_irq_save(save_flags);
+        objp = ____cache_alloc(cachep, flags);
         local_irq_restore(save_flags);
         objp = cache_alloc_debugcheck_after(cachep, flags, objp,
                                         __builtin_return_address(0));
@@ -2608,7 +2618,7 @@ done:
 /*
  * Caller needs to acquire correct kmem_list's list_lock
  */
-static void free_block(kmem_cache_t *cachep, void **objpp, int nr_objects)
+static void free_block(kmem_cache_t *cachep, void **objpp, int nr_objects, int node)
 {
         int i;
         struct kmem_list3 *l3;
@@ -2617,14 +2627,12 @@ static void free_block(kmem_cache_t *cachep, void **objpp, int nr_objects)
                 void *objp = objpp[i];
                 struct slab *slabp;
                 unsigned int objnr;
-                int nodeid = 0;
 
                 slabp = GET_PAGE_SLAB(virt_to_page(objp));
-                nodeid = slabp->nodeid;
-                l3 = cachep->nodelists[nodeid];
+                l3 = cachep->nodelists[node];
                 list_del(&slabp->list);
                 objnr = (objp - slabp->s_mem) / cachep->objsize;
-                check_spinlock_acquired_node(cachep, nodeid);
+                check_spinlock_acquired_node(cachep, node);
                 check_slabp(cachep, slabp);
 
 
@@ -2664,13 +2672,14 @@ static void cache_flusharray(kmem_cache_t *cachep, struct array_cache *ac)
 {
         int batchcount;
         struct kmem_list3 *l3;
+        int node = numa_node_id();
 
         batchcount = ac->batchcount;
 #if DEBUG
         BUG_ON(!batchcount || batchcount > ac->avail);
 #endif
         check_irq_off();
-        l3 = cachep->nodelists[numa_node_id()];
+        l3 = cachep->nodelists[node];
         spin_lock(&l3->list_lock);
         if (l3->shared) {
                 struct array_cache *shared_array = l3->shared;
@@ -2686,7 +2695,7 @@ static void cache_flusharray(kmem_cache_t *cachep, struct array_cache *ac)
                 }
         }
 
-        free_block(cachep, ac->entry, batchcount);
+        free_block(cachep, ac->entry, batchcount, node);
 free_done:
 #if STATS
         {
@@ -2751,7 +2760,7 @@ static inline void __cache_free(kmem_cache_t *cachep, void *objp)
                         } else {
                                 spin_lock(&(cachep->nodelists[nodeid])->
                                                 list_lock);
-                                free_block(cachep, &objp, 1);
+                                free_block(cachep, &objp, 1, nodeid);
                                 spin_unlock(&(cachep->nodelists[nodeid])->
                                                 list_lock);
                         }
@@ -2844,7 +2853,7 @@ void *kmem_cache_alloc_node(kmem_cache_t *cachep, unsigned int __nocast flags, i
         unsigned long save_flags;
         void *ptr;
 
-        if (nodeid == numa_node_id() || nodeid == -1)
+        if (nodeid == -1)
                 return __cache_alloc(cachep, flags);
 
         if (unlikely(!cachep->nodelists[nodeid])) {
@@ -2855,7 +2864,10 @@ void *kmem_cache_alloc_node(kmem_cache_t *cachep, unsigned int __nocast flags, i
 
         cache_alloc_debugcheck_before(cachep, flags);
         local_irq_save(save_flags);
-        ptr = __cache_alloc_node(cachep, flags, nodeid);
+        if (nodeid == numa_node_id())
+                ptr = ____cache_alloc(cachep, flags);
+        else
+                ptr = __cache_alloc_node(cachep, flags, nodeid);
         local_irq_restore(save_flags);
         ptr = cache_alloc_debugcheck_after(cachep, flags, ptr, __builtin_return_address(0));
 
@@ -3079,7 +3091,7 @@ static int alloc_kmemlist(kmem_cache_t *cachep)
 
                         if ((nc = cachep->nodelists[node]->shared))
                                 free_block(cachep, nc->entry,
-                                                        nc->avail);
+                                                        nc->avail, node);
 
                         l3->shared = new;
                         if (!cachep->nodelists[node]->alien) {
@@ -3160,7 +3172,7 @@ static int do_tune_cpucache(kmem_cache_t *cachep, int limit, int batchcount,
                 if (!ccold)
                         continue;
                 spin_lock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock);
-                free_block(cachep, ccold->entry, ccold->avail);
+                free_block(cachep, ccold->entry, ccold->avail, cpu_to_node(i));
                 spin_unlock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock);
                 kfree(ccold);
         }
@@ -3240,7 +3252,7 @@ static void drain_array_locked(kmem_cache_t *cachep,
                 if (tofree > ac->avail) {
                         tofree = (ac->avail+1)/2;
                 }
-                free_block(cachep, ac->entry, tofree);
+                free_block(cachep, ac->entry, tofree, node);
                 ac->avail -= tofree;
                 memmove(ac->entry, &(ac->entry[tofree]),
                                         sizeof(void*)*ac->avail);
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 0184f510aace..1dcaeda039f4 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1381,6 +1381,7 @@ asmlinkage long sys_swapon(const char __user * specialfile, int swap_flags)
                 error = bd_claim(bdev, sys_swapon);
                 if (error < 0) {
                         bdev = NULL;
+                        error = -EINVAL;
                         goto bad_swap;
                 }
                 p->old_block_size = block_size(bdev);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index a740778f688d..0ea71e887bb6 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1258,9 +1258,9 @@ void wakeup_kswapd(struct zone *zone, int order)
                 pgdat->kswapd_max_order = order;
         if (!cpuset_zone_allowed(zone, __GFP_HARDWALL))
                 return;
-        if (!waitqueue_active(&zone->zone_pgdat->kswapd_wait))
+        if (!waitqueue_active(&pgdat->kswapd_wait))
                 return;
-        wake_up_interruptible(&zone->zone_pgdat->kswapd_wait);
+        wake_up_interruptible(&pgdat->kswapd_wait);
 }
 
 #ifdef CONFIG_PM
diff --git a/net/802/p8022.c b/net/802/p8022.c
index b24817c63ca8..2530f35241cd 100644
--- a/net/802/p8022.c
+++ b/net/802/p8022.c
@@ -56,7 +56,7 @@ struct datalink_proto *register_8022_client(unsigned char type,
 
 void unregister_8022_client(struct datalink_proto *proto)
 {
-        llc_sap_close(proto->sap);
+        llc_sap_put(proto->sap);
         kfree(proto);
 }
 
diff --git a/net/802/psnap.c b/net/802/psnap.c
index ab80b1fab53c..4d638944d933 100644
--- a/net/802/psnap.c
+++ b/net/802/psnap.c
@@ -106,7 +106,7 @@ module_init(snap_init);
 
 static void __exit snap_exit(void)
 {
-        llc_sap_close(snap_sap);
+        llc_sap_put(snap_sap);
 }
 
 module_exit(snap_exit);
diff --git a/net/802/tr.c b/net/802/tr.c
index 1bb7dc1b85cd..1eaa3d19d8bf 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -238,7 +238,7 @@ unsigned short tr_type_trans(struct sk_buff *skb, struct net_device *dev)
                 return trllc->ethertype;
         }
 
-        return ntohs(ETH_P_802_2);
+        return ntohs(ETH_P_TR_802_2);
 }
 
 /*
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 145f5cde96cf..b74864889670 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -120,7 +120,7 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
         unsigned short vid;
         struct net_device_stats *stats;
         unsigned short vlan_TCI;
-        unsigned short proto;
+        __be16 proto;
 
         /* vlan_TCI = ntohs(get_unaligned(&vhdr->h_vlan_TCI)); */
         vlan_TCI = ntohs(vhdr->h_vlan_TCI);
diff --git a/net/Kconfig b/net/Kconfig
index 2bdd5623fdd5..60f6f321bd76 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -140,6 +140,7 @@ config BRIDGE_NETFILTER
 
           If unsure, say N.
 
+source "net/netfilter/Kconfig"
 source "net/ipv4/netfilter/Kconfig"
 source "net/ipv6/netfilter/Kconfig"
 source "net/decnet/netfilter/Kconfig"
@@ -206,8 +207,6 @@ config NET_PKTGEN
           To compile this code as a module, choose M here: the
           module will be called pktgen.
 
-source "net/netfilter/Kconfig"
-
 endmenu
 
 endmenu
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 1d31b3a3f1e5..7982656b9c83 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -100,8 +100,7 @@ static struct sock *atalk_search_socket(struct sockaddr_at *to,
                         continue;
 
                 if (to->sat_addr.s_net == ATADDR_ANYNET &&
-                    to->sat_addr.s_node == ATADDR_BCAST &&
-                    at->src_net == atif->address.s_net)
+                    to->sat_addr.s_node == ATADDR_BCAST)
                         goto found;
 
                 if (to->sat_addr.s_net == at->src_net &&
@@ -1443,8 +1442,10 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
         else
                 atif = atalk_find_interface(ddp->deh_dnet, ddp->deh_dnode);
 
-        /* Not ours, so we route the packet via the correct AppleTalk iface */
         if (!atif) {
+                /* Not ours, so we route the packet via the correct
+                 * AppleTalk iface
+                 */
                 atalk_route_packet(skb, dev, ddp, &ddphv, origlen);
                 goto out;
         }
@@ -1592,9 +1593,6 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
 
         if (usat->sat_addr.s_net || usat->sat_addr.s_node == ATADDR_ANYNODE) {
                 rt = atrtr_find(&usat->sat_addr);
-                if (!rt)
-                        return -ENETUNREACH;
-
                 dev = rt->dev;
         } else {
                 struct atalk_addr at_hint;
@@ -1603,11 +1601,12 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
                 at_hint.s_net  = at->src_net;
 
                 rt = atrtr_find(&at_hint);
-                if (!rt)
-                        return -ENETUNREACH;
-
                 dev = rt->dev;
         }
+        if (!rt)
+                return -ENETUNREACH;
+
+        dev = rt->dev;
 
         SOCK_DEBUG(sk, "SK %p: Size needed %d, device %s\n",
                         sk, size, dev->name);
@@ -1677,6 +1676,20 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
                 SOCK_DEBUG(sk, "SK %p: Loop back.\n", sk);
                 /* loop back */
                 skb_orphan(skb);
+                if (ddp->deh_dnode == ATADDR_BCAST) {
+                        struct atalk_addr at_lo;
+
+                        at_lo.s_node = 0;
+                        at_lo.s_net  = 0;
+
+                        rt = atrtr_find(&at_lo);
+                        if (!rt) {
+                                kfree_skb(skb);
+                                return -ENETUNREACH;
+                        }
+                        dev = rt->dev;
+                        skb->dev = dev;
+                }
                 ddp_dl->request(ddp_dl, skb, dev->dev_addr);
         } else {
                 SOCK_DEBUG(sk, "SK %p: send out.\n", sk);
diff --git a/net/atm/addr.c b/net/atm/addr.c
index 1c8867f7f54a..a30d0bf48063 100644
--- a/net/atm/addr.c
+++ b/net/atm/addr.c
@@ -50,8 +50,10 @@ void atm_reset_addr(struct atm_dev *dev)
         struct atm_dev_addr *this, *p;
 
         spin_lock_irqsave(&dev->lock, flags);
-        list_for_each_entry_safe(this, p, &dev->local, entry)
-            kfree(this);
+        list_for_each_entry_safe(this, p, &dev->local, entry) {
+                list_del(&this->entry);
+                kfree(this);
+        }
         spin_unlock_irqrestore(&dev->lock, flags);
         notify_sigd(dev);
 }
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 28dab55a4387..4f54c9a5e84a 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -310,7 +310,7 @@ static int clip_constructor(struct neighbour *neigh)
         if (neigh->type != RTN_UNICAST) return -EINVAL;
 
         rcu_read_lock();
-        in_dev = rcu_dereference(__in_dev_get(dev));
+        in_dev = __in_dev_get_rcu(dev);
         if (!in_dev) {
                 rcu_read_unlock();
                 return -EINVAL;
diff --git a/net/atm/common.c b/net/atm/common.c
index e93e838069e8..63feea49fb13 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -46,7 +46,7 @@ static void __vcc_insert_socket(struct sock *sk)
         struct atm_vcc *vcc = atm_sk(sk);
         struct hlist_head *head = &vcc_hash[vcc->vci &
                                         (VCC_HTABLE_SIZE - 1)];
-        sk->sk_hashent = vcc->vci & (VCC_HTABLE_SIZE - 1);
+        sk->sk_hash = vcc->vci & (VCC_HTABLE_SIZE - 1);
         sk_add_node(sk, head);
 }
 
@@ -178,8 +178,6 @@ static void vcc_destroy_socket(struct sock *sk)
                 if (vcc->push)
                         vcc->push(vcc, NULL); /* atmarpd has no push */
 
-                vcc_remove_socket(sk);  /* no more receive */
-
                 while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
                         atm_return(vcc,skb->truesize);
                         kfree_skb(skb);
@@ -188,6 +186,8 @@ static void vcc_destroy_socket(struct sock *sk)
                 module_put(vcc->dev->ops->owner);
                 atm_dev_put(vcc->dev);
         }
+
+        vcc_remove_socket(sk);
 }
 
 
diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c
index d89056ec44d4..a150198b05a3 100644
--- a/net/atm/ioctl.c
+++ b/net/atm/ioctl.c
@@ -105,17 +105,35 @@ int vcc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         if (!error)
                                 sock->state = SS_CONNECTED;
                         goto done;
-                default:
+                case ATM_SETBACKEND:
+                case ATM_NEWBACKENDIF:
+                        {
+                                atm_backend_t backend;
+                                error = get_user(backend, (atm_backend_t __user *) argp);
+                                if (error)
+                                        goto done;
+                                switch (backend) {
+                                        case ATM_BACKEND_PPP:
+                                                request_module("pppoatm");
+                                                break;
+                                        case ATM_BACKEND_BR2684:
+                                                request_module("br2684");
+                                                break;
+                                }
+                        }
+                        break;
+                case ATMMPC_CTRL:
+                case ATMMPC_DATA:
+                        request_module("mpoa");
+                        break;
+                case ATMARPD_CTRL:
+                        request_module("clip");
+                        break;
+                case ATMLEC_CTRL:
+                        request_module("lec");
                         break;
         }
 
-        if (cmd == ATMMPC_CTRL || cmd == ATMMPC_DATA)
-                request_module("mpoa");
-        if (cmd == ATMARPD_CTRL)
-                request_module("clip");
-        if (cmd == ATMLEC_CTRL)
-                request_module("lec");
-
         error = -ENOIOCTLCMD;
 
         down(&ioctl_mutex);
diff --git a/net/atm/lec.c b/net/atm/lec.c
index a0752487026d..ad840b9afba8 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -686,9 +686,19 @@ static unsigned char lec_ctrl_magic[] = {
         0x01,
         0x01 };
 
+#define LEC_DATA_DIRECT_8023  2
+#define LEC_DATA_DIRECT_8025  3
+
+static int lec_is_data_direct(struct atm_vcc *vcc)
+{ 
+        return ((vcc->sap.blli[0].l3.tr9577.snap[4] == LEC_DATA_DIRECT_8023) ||
+                (vcc->sap.blli[0].l3.tr9577.snap[4] == LEC_DATA_DIRECT_8025));
+} 
+
 static void 
 lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
 {
+        unsigned long flags;
         struct net_device *dev = (struct net_device *)vcc->proto_data;
         struct lec_priv *priv = (struct lec_priv *)dev->priv; 
 
@@ -728,7 +738,8 @@ lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
                 skb_queue_tail(&sk->sk_receive_queue, skb);
                 sk->sk_data_ready(sk, skb->len);
         } else { /* Data frame, queue to protocol handlers */
-                unsigned char *dst;
+                struct lec_arp_table *entry;
+                unsigned char *src, *dst;
 
                 atm_return(vcc,skb->truesize);
                 if (*(uint16_t *)skb->data == htons(priv->lecid) ||
@@ -741,10 +752,30 @@ lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
                         return;
                 }
 #ifdef CONFIG_TR
-                if (priv->is_trdev) dst = ((struct lecdatahdr_8025 *)skb->data)->h_dest;
+                if (priv->is_trdev)
+                        dst = ((struct lecdatahdr_8025 *) skb->data)->h_dest;
                 else
 #endif
-                dst = ((struct lecdatahdr_8023 *)skb->data)->h_dest;
+                dst = ((struct lecdatahdr_8023 *) skb->data)->h_dest;
+
+                /* If this is a Data Direct VCC, and the VCC does not match
+                 * the LE_ARP cache entry, delete the LE_ARP cache entry.
+                 */
+                spin_lock_irqsave(&priv->lec_arp_lock, flags);
+                if (lec_is_data_direct(vcc)) {
+#ifdef CONFIG_TR
+                        if (priv->is_trdev)
+                                src = ((struct lecdatahdr_8025 *) skb->data)->h_source;
+                        else
+#endif
+                        src = ((struct lecdatahdr_8023 *) skb->data)->h_source;
+                        entry = lec_arp_find(priv, src);
+                        if (entry && entry->vcc != vcc) {
+                                lec_arp_remove(priv, entry);
+                                kfree(entry);
+                        }
+                }
+                spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
 
                 if (!(dst[0]&0x01) &&   /* Never filter Multi/Broadcast */
                     !priv->is_proxy &&  /* Proxy wants all the packets */
@@ -1990,6 +2021,12 @@ lec_arp_resolve(struct lec_priv *priv, unsigned char *mac_to_find,
                         found = entry->vcc;
                         goto out;
                 }
+                /* If the LE_ARP cache entry is still pending, reset count to 0
+                 * so another LE_ARP request can be made for this frame.
+                 */
+                if (entry->status == ESI_ARP_PENDING) {
+                        entry->no_tries = 0;
+                }
                 /* Data direct VC not yet set up, check to see if the unknown
                    frame count is greater than the limit. If the limit has
                    not been reached, allow the caller to send packet to
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index f7c449ac1800..e7211a7f382c 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -217,8 +217,9 @@ void sigd_enq(struct atm_vcc *vcc,enum atmsvc_msg_type type,
 static void purge_vcc(struct atm_vcc *vcc)
 {
         if (sk_atm(vcc)->sk_family == PF_ATMSVC &&
-            !test_bit(ATM_VF_META,&vcc->flags)) {
-                set_bit(ATM_VF_RELEASED,&vcc->flags);
+            !test_bit(ATM_VF_META, &vcc->flags)) {
+                set_bit(ATM_VF_RELEASED, &vcc->flags);
+                clear_bit(ATM_VF_REGIS, &vcc->flags);
                 vcc_release_async(vcc, -EUNATCH);
         }
 }
@@ -243,8 +244,7 @@ static void sigd_close(struct atm_vcc *vcc)
                 sk_for_each(s, node, head) {
                         struct atm_vcc *vcc = atm_sk(s);
 
-                        if (vcc->dev)
-                                purge_vcc(vcc);
+                        purge_vcc(vcc);
                 }
         }
         read_unlock(&vcc_sklist_lock);
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 08e46052a3e4..d7b266136bf6 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -302,6 +302,7 @@ static int svc_listen(struct socket *sock,int backlog)
                 error = -EINVAL;
                 goto out;
         }
+        vcc_insert_socket(sk);
         set_bit(ATM_VF_WAITING, &vcc->flags);
         prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
         sigd_enq(vcc,as_listen,NULL,NULL,&vcc->local);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d6da0939216d..b61b4e8e36fd 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -558,6 +558,35 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
         hci_dev_unlock(hdev);
 }
 
+/* Extended Inquiry Result */
+static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct inquiry_data data;
+        struct extended_inquiry_info *info = (struct extended_inquiry_info *) (skb->data + 1);
+        int num_rsp = *((__u8 *) skb->data);
+
+        BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
+
+        if (!num_rsp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        for (; num_rsp; num_rsp--) {
+                bacpy(&data.bdaddr, &info->bdaddr);
+                data.pscan_rep_mode     = info->pscan_rep_mode;
+                data.pscan_period_mode  = info->pscan_period_mode;
+                data.pscan_mode         = 0x00;
+                memcpy(data.dev_class, info->dev_class, 3);
+                data.clock_offset       = info->clock_offset;
+                data.rssi               = info->rssi;
+                info++;
+                hci_inquiry_cache_update(hdev, &data);
+        }
+
+        hci_dev_unlock(hdev);
+}
+
 /* Connect Request */
 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
@@ -940,6 +969,10 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_inquiry_result_with_rssi_evt(hdev, skb);
                 break;
 
+        case HCI_EV_EXTENDED_INQUIRY_RESULT:
+                hci_extended_inquiry_result_evt(hdev, skb);
+                break;
+
         case HCI_EV_CONN_REQUEST:
                 hci_conn_request_evt(hdev, skb);
                 break;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 90e19eb6d3cc..f49e7e938bfb 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -363,6 +363,11 @@ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr
                 goto done;
         }
 
+        if (sk->sk_type != SOCK_STREAM) {
+                err = -EINVAL;
+                goto done;
+        }
+
         write_lock_bh(&rfcomm_sk_list.lock);
 
         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
@@ -393,13 +398,17 @@ static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int a
         if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_rc))
                 return -EINVAL;
 
-        if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
-                return -EBADFD;
+        lock_sock(sk);
 
-        if (sk->sk_type != SOCK_STREAM)
-                return -EINVAL;
+        if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
+                err = -EBADFD;
+                goto done;
+        }
 
-        lock_sock(sk);
+        if (sk->sk_type != SOCK_STREAM) {
+                err = -EINVAL;
+                goto done;
+        }
 
         sk->sk_state = BT_CONNECT;
         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
@@ -410,6 +419,7 @@ static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int a
                 err = bt_sock_wait_state(sk, BT_CONNECTED,
                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 
+done:
         release_sock(sk);
         return err;
 }
@@ -428,6 +438,11 @@ static int rfcomm_sock_listen(struct socket *sock, int backlog)
                 goto done;
         }
 
+        if (sk->sk_type != SOCK_STREAM) {
+                err = -EINVAL;
+                goto done;
+        }
+
         if (!rfcomm_pi(sk)->channel) {
                 bdaddr_t *src = &bt_sk(sk)->src;
                 u8 channel;
@@ -472,6 +487,11 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
                 goto done;
         }
 
+        if (sk->sk_type != SOCK_STREAM) {
+                err = -EINVAL;
+                goto done;
+        }
+
         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 
         BT_DBG("sk %p timeo %ld", sk, timeo);
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 069253f830c1..2d24fb400e0c 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -31,7 +31,8 @@ static inline int should_deliver(const struct net_bridge_port *p,
 
 int br_dev_queue_push_xmit(struct sk_buff *skb)
 {
-        if (skb->len > skb->dev->mtu) 
+        /* drop mtu oversized packets except tso */
+        if (skb->len > skb->dev->mtu && !skb_shinfo(skb)->tso_size)
                 kfree_skb(skb);
         else {
 #ifdef CONFIG_BRIDGE_NETFILTER
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 2d52fee63a8c..d8e36b775125 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -214,9 +214,11 @@ static int br_nf_pre_routing_finish(struct sk_buff *skb)
                                      .tos = RT_TOS(iph->tos)} }, .proto = 0};
 
                         if (!ip_route_output_key(&rt, &fl)) {
-                                /* Bridged-and-DNAT'ed traffic doesn't
-                                 * require ip_forwarding. */
-                                if (((struct dst_entry *)rt)->dev == dev) {
+                                /* - Bridged-and-DNAT'ed traffic doesn't
+                                 *   require ip_forwarding.
+                                 * - Deal with redirected traffic. */
+                                if (((struct dst_entry *)rt)->dev == dev ||
+                                    rt->rt_type == RTN_LOCAL) {
                                         skb->dst = (struct dst_entry *)rt;
                                         goto bridged_dnat;
                                 }
diff --git a/net/core/datagram.c b/net/core/datagram.c
index da9bf71421a7..81987df536eb 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -211,74 +211,45 @@ void skb_free_datagram(struct sock *sk, struct sk_buff *skb)
 int skb_copy_datagram_iovec(const struct sk_buff *skb, int offset,
                             struct iovec *to, int len)
 {
-        int start = skb_headlen(skb);
-        int i, copy = start - offset;
-
-        /* Copy header. */
-        if (copy > 0) {
-                if (copy > len)
-                        copy = len;
-                if (memcpy_toiovec(to, skb->data + offset, copy))
-                        goto fault;
-                if ((len -= copy) == 0)
-                        return 0;
-                offset += copy;
-        }
+        int i, err, fraglen, end = 0;
+        struct sk_buff *next = skb_shinfo(skb)->frag_list;
+next_skb:
+        fraglen = skb_headlen(skb);
+        i = -1;
 
-        /* Copy paged appendix. Hmm... why does this look so complicated? */
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                int end;
-
-                BUG_TRAP(start <= offset + len);
+        while (1) {
+                int start = end;
 
-                end = start + skb_shinfo(skb)->frags[i].size;
-                if ((copy = end - offset) > 0) {
-                        int err;
-                        u8  *vaddr;
-                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                        struct page *page = frag->page;
+                if ((end += fraglen) > offset) {
+                        int copy = end - offset, o = offset - start;
 
                         if (copy > len)
                                 copy = len;
-                        vaddr = kmap(page);
-                        err = memcpy_toiovec(to, vaddr + frag->page_offset +
-                                             offset - start, copy);
-                        kunmap(page);
+                        if (i == -1)
+                                err = memcpy_toiovec(to, skb->data + o, copy);
+                        else {
+                                skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+                                struct page *page = frag->page;
+                                void *p = kmap(page) + frag->page_offset + o;
+                                err = memcpy_toiovec(to, p, copy);
+                                kunmap(page);
+                        }
                         if (err)
                                 goto fault;
                         if (!(len -= copy))
                                 return 0;
                         offset += copy;
                 }
-                start = end;
+                if (++i >= skb_shinfo(skb)->nr_frags)
+                        break;
+                fraglen = skb_shinfo(skb)->frags[i].size;
         }
-
-        if (skb_shinfo(skb)->frag_list) {
-                struct sk_buff *list = skb_shinfo(skb)->frag_list;
-
-                for (; list; list = list->next) {
-                        int end;
-
-                        BUG_TRAP(start <= offset + len);
-
-                        end = start + list->len;
-                        if ((copy = end - offset) > 0) {
-                                if (copy > len)
-                                        copy = len;
-                                if (skb_copy_datagram_iovec(list,
-                                                            offset - start,
-                                                            to, copy))
-                                        goto fault;
-                                if ((len -= copy) == 0)
-                                        return 0;
-                                offset += copy;
-                        }
-                        start = end;
-                }
+        if (next) {
+                skb = next;
+                BUG_ON(skb_shinfo(skb)->frag_list);
+                next = skb->next;
+                goto next_skb;
         }
-        if (!len)
-                return 0;
-
 fault:
         return -EFAULT;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index c01511e3d0c1..9066c874e273 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -574,6 +574,8 @@ struct net_device *dev_getbyhwaddr(unsigned short type, char *ha)
         return dev;
 }
 
+EXPORT_SYMBOL(dev_getbyhwaddr);
+
 struct net_device *dev_getfirstbyhwtype(unsigned short type)
 {
         struct net_device *dev;
@@ -1257,6 +1259,8 @@ int dev_queue_xmit(struct sk_buff *skb)
                 if (skb_checksum_help(skb, 0))
                         goto out_kfree_skb;
 
+        spin_lock_prefetch(&dev->queue_lock);
+
         /* Disable soft irqs for various locks below. Also 
          * stops preemption for RCU. 
          */
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 39fc55edf691..4128fc76ac3a 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -61,7 +61,9 @@ static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev);
 
 static struct neigh_table *neigh_tables;
+#ifdef CONFIG_PROC_FS
 static struct file_operations neigh_stat_seq_fops;
+#endif
 
 /*
    Neighbour hash table buckets are protected with rwlock tbl->lock.
@@ -725,6 +727,13 @@ static __inline__ int neigh_max_probes(struct neighbour *n)
                 p->ucast_probes + p->app_probes + p->mcast_probes);
 }
 
+static inline void neigh_add_timer(struct neighbour *n, unsigned long when)
+{
+        if (unlikely(mod_timer(&n->timer, when))) {
+                printk("NEIGH: BUG, double timer add, state is %x\n",
+                       n->nud_state);
+        }
+}
 
 /* Called when a timer expires for a neighbour entry. */
 
@@ -809,8 +818,7 @@ static void neigh_timer_handler(unsigned long arg)
                 neigh_hold(neigh);
                 if (time_before(next, jiffies + HZ/2))
                         next = jiffies + HZ/2;
-                neigh->timer.expires = next;
-                add_timer(&neigh->timer);
+                neigh_add_timer(neigh, next);
         }
         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
                 struct sk_buff *skb = skb_peek(&neigh->arp_queue);
@@ -852,8 +860,7 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
                         atomic_set(&neigh->probes, neigh->parms->ucast_probes);
                         neigh->nud_state     = NUD_INCOMPLETE;
                         neigh_hold(neigh);
-                        neigh->timer.expires = now + 1;
-                        add_timer(&neigh->timer);
+                        neigh_add_timer(neigh, now + 1);
                 } else {
                         neigh->nud_state = NUD_FAILED;
                         write_unlock_bh(&neigh->lock);
@@ -866,8 +873,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
                 NEIGH_PRINTK2("neigh %p is delayed.\n", neigh);
                 neigh_hold(neigh);
                 neigh->nud_state = NUD_DELAY;
-                neigh->timer.expires = jiffies + neigh->parms->delay_probe_time;
-                add_timer(&neigh->timer);
+                neigh_add_timer(neigh,
+                                jiffies + neigh->parms->delay_probe_time);
         }
 
         if (neigh->nud_state == NUD_INCOMPLETE) {
@@ -1013,10 +1020,10 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                 neigh_del_timer(neigh);
                 if (new & NUD_IN_TIMER) {
                         neigh_hold(neigh);
-                        neigh->timer.expires = jiffies + 
+                        neigh_add_timer(neigh, (jiffies + 
                                                 ((new & NUD_REACHABLE) ? 
-                                                 neigh->parms->reachable_time : 0);
-                        add_timer(&neigh->timer);
+                                                 neigh->parms->reachable_time :
+                                                 0)));
                 }
                 neigh->nud_state = new;
         }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 5265dfd69928..802fe11efad0 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -703,7 +703,7 @@ int netpoll_setup(struct netpoll *np)
 
         if (!np->local_ip) {
                 rcu_read_lock();
-                in_dev = __in_dev_get(ndev);
+                in_dev = __in_dev_get_rcu(ndev);
 
                 if (!in_dev || !in_dev->ifa_list) {
                         rcu_read_unlock();
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index ef430b1e8e42..5f043d346694 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -186,7 +186,7 @@
 
 /* Used to help with determining the pkts on receive */
 #define PKTGEN_MAGIC 0xbe9be955
-#define PG_PROC_DIR "pktgen"
+#define PG_PROC_DIR "net/pktgen"
 
 #define MAX_CFLOWS  65536
 
@@ -1476,18 +1476,7 @@ static int proc_thread_write(struct file *file, const char __user *user_buffer,
 
 static int create_proc_dir(void)
 {
-        int     len;
-        /*  does proc_dir already exists */
-        len = strlen(PG_PROC_DIR);
-
-        for (pg_proc_dir = proc_net->subdir; pg_proc_dir; pg_proc_dir=pg_proc_dir->next) {
-                if ((pg_proc_dir->namelen == len) &&
-                    (! memcmp(pg_proc_dir->name, PG_PROC_DIR, len))) 
-                        break;
-        }
-        
-        if (!pg_proc_dir) 
-                pg_proc_dir = create_proc_entry(PG_PROC_DIR, S_IFDIR, proc_net);
+        pg_proc_dir = proc_mkdir(PG_PROC_DIR, NULL);
         
         if (!pg_proc_dir) 
                 return -ENODEV;
@@ -1497,7 +1486,7 @@ static int create_proc_dir(void)
 
 static int remove_proc_dir(void)
 {
-        remove_proc_entry(PG_PROC_DIR, proc_net);
+        remove_proc_entry(PG_PROC_DIR, NULL);
         return 0;
 }
 
@@ -1678,13 +1667,12 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                         struct in_device *in_dev; 
 
                         rcu_read_lock();
-                        in_dev = __in_dev_get(pkt_dev->odev);
+                        in_dev = __in_dev_get_rcu(pkt_dev->odev);
                         if (in_dev) {
                                 if (in_dev->ifa_list) {
                                         pkt_dev->saddr_min = in_dev->ifa_list->ifa_address;
                                         pkt_dev->saddr_max = pkt_dev->saddr_min;
                                 }
-                                __in_dev_put(in_dev);   
                         }
                         rcu_read_unlock();
                 }
@@ -2908,7 +2896,7 @@ static int pktgen_add_device(struct pktgen_thread *t, const char* ifname)
                 pkt_dev->udp_dst_max = 9;
 
                 strncpy(pkt_dev->ifname, ifname, 31);
-                sprintf(pkt_dev->fname, "net/%s/%s", PG_PROC_DIR, ifname);
+                sprintf(pkt_dev->fname, "%s/%s", PG_PROC_DIR, ifname);
 
                 if (! pktgen_setup_dev(pkt_dev)) {
                         printk("pktgen: ERROR: pktgen_setup_dev failed.\n");
@@ -2981,7 +2969,7 @@ static int pktgen_create_thread(const char* name, int cpu)
         spin_lock_init(&t->if_lock);
         t->cpu = cpu;
         
-        sprintf(t->fname, "net/%s/%s", PG_PROC_DIR, t->name);
+        sprintf(t->fname, "%s/%s", PG_PROC_DIR, t->name);
         t->proc_ent = create_proc_entry(t->fname, 0600, NULL);
         if (!t->proc_ent) {
                 printk("pktgen: cannot create %s procfs entry.\n", t->fname);
@@ -3064,7 +3052,7 @@ static int __init pg_init(void)
 
         create_proc_dir();
 
-        sprintf(module_fname, "net/%s/pgctrl", PG_PROC_DIR);
+        sprintf(module_fname, "%s/pgctrl", PG_PROC_DIR);
         module_proc_ent = create_proc_entry(module_fname, 0600, NULL);
         if (!module_proc_ent) {
                 printk("pktgen: ERROR: cannot create %s procfs entry.\n", module_fname);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f80a28785610..0e9431b59fb2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -71,8 +71,6 @@
 static kmem_cache_t *skbuff_head_cache __read_mostly;
 static kmem_cache_t *skbuff_fclone_cache __read_mostly;
 
-struct timeval __read_mostly skb_tv_base;
-
 /*
  *      Keep out-of-line to prevent kernel bloat.
  *      __builtin_return_address is not used because it is not always
@@ -1708,8 +1706,6 @@ void __init skb_init(void)
                                                 NULL, NULL);
         if (!skbuff_fclone_cache)
                 panic("cannot create skbuff cache");
-
-        do_gettimeofday(&skb_tv_base);
 }
 
 EXPORT_SYMBOL(___pskb_trim);
@@ -1743,4 +1739,3 @@ EXPORT_SYMBOL(skb_prepare_seq_read);
 EXPORT_SYMBOL(skb_seq_read);
 EXPORT_SYMBOL(skb_abort_seq_read);
 EXPORT_SYMBOL(skb_find_text);
-EXPORT_SYMBOL(skb_tv_base);
diff --git a/net/core/sock.c b/net/core/sock.c
index ac63b56e23b2..928d2a1d6d8e 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -660,16 +660,20 @@ struct sock *sk_alloc(int family, unsigned int __nocast priority,
                         sock_lock_init(sk);
                 }
                 
-                if (security_sk_alloc(sk, family, priority)) {
-                        if (slab != NULL)
-                                kmem_cache_free(slab, sk);
-                        else
-                                kfree(sk);
-                        sk = NULL;
-                } else
-                        __module_get(prot->owner);
+                if (security_sk_alloc(sk, family, priority))
+                        goto out_free;
+
+                if (!try_module_get(prot->owner))
+                        goto out_free;
         }
         return sk;
+
+out_free:
+        if (slab != NULL)
+                kmem_cache_free(slab, sk);
+        else
+                kfree(sk);
+        return NULL;
 }
 
 void sk_free(struct sock *sk)
diff --git a/net/dccp/Makefile b/net/dccp/Makefile
index fb97bb042455..344a8da153fc 100644
--- a/net/dccp/Makefile
+++ b/net/dccp/Makefile
@@ -3,6 +3,8 @@ obj-$(CONFIG_IP_DCCP) += dccp.o
 dccp-y := ccid.o input.o ipv4.o minisocks.o options.o output.o proto.o \
           timer.o
 
+dccp-$(CONFIG_IP_DCCP_ACKVEC) += ackvec.o
+
 obj-$(CONFIG_INET_DCCP_DIAG) += dccp_diag.o
 
 dccp_diag-y := diag.o
diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
new file mode 100644
index 000000000000..6530283eafca
--- /dev/null
+++ b/net/dccp/ackvec.c
@@ -0,0 +1,419 @@
+/*
+ *  net/dccp/ackvec.c
+ *
+ *  An implementation of the DCCP protocol
+ *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
+ *
+ *      This program is free software; you can redistribute it and/or modify it
+ *      under the terms of the GNU General Public License as published by the
+ *      Free Software Foundation; version 2 of the License;
+ */
+
+#include "ackvec.h"
+#include "dccp.h"
+
+#include <linux/dccp.h>
+#include <linux/skbuff.h>
+
+#include <net/sock.h>
+
+int dccp_insert_option_ackvec(struct sock *sk, struct sk_buff *skb)
+{
+        struct dccp_sock *dp = dccp_sk(sk);
+        struct dccp_ackvec *av = dp->dccps_hc_rx_ackvec;
+        int len = av->dccpav_vec_len + 2;
+        struct timeval now;
+        u32 elapsed_time;
+        unsigned char *to, *from;
+
+        dccp_timestamp(sk, &now);
+        elapsed_time = timeval_delta(&now, &av->dccpav_time) / 10;
+
+        if (elapsed_time != 0)
+                dccp_insert_option_elapsed_time(sk, skb, elapsed_time);
+
+        if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN)
+                return -1;
+
+        /*
+         * XXX: now we have just one ack vector sent record, so
+         * we have to wait for it to be cleared.
+         *
+         * Of course this is not acceptable, but this is just for
+         * basic testing now.
+         */
+        if (av->dccpav_ack_seqno != DCCP_MAX_SEQNO + 1)
+                return -1;
+
+        DCCP_SKB_CB(skb)->dccpd_opt_len += len;
+
+        to    = skb_push(skb, len);
+        *to++ = DCCPO_ACK_VECTOR_0;
+        *to++ = len;
+
+        len  = av->dccpav_vec_len;
+        from = av->dccpav_buf + av->dccpav_buf_head;
+
+        /* Check if buf_head wraps */
+        if (av->dccpav_buf_head + len > av->dccpav_vec_len) {
+                const u32 tailsize = (av->dccpav_vec_len - av->dccpav_buf_head);
+
+                memcpy(to, from, tailsize);
+                to   += tailsize;
+                len  -= tailsize;
+                from = av->dccpav_buf;
+        }
+
+        memcpy(to, from, len);
+        /*
+         *      From draft-ietf-dccp-spec-11.txt:
+         *
+         *      For each acknowledgement it sends, the HC-Receiver will add an
+         *      acknowledgement record.  ack_seqno will equal the HC-Receiver
+         *      sequence number it used for the ack packet; ack_ptr will equal
+         *      buf_head; ack_ackno will equal buf_ackno; and ack_nonce will
+         *      equal buf_nonce.
+         *
+         * This implemention uses just one ack record for now.
+         */
+        av->dccpav_ack_seqno = DCCP_SKB_CB(skb)->dccpd_seq;
+        av->dccpav_ack_ptr   = av->dccpav_buf_head;
+        av->dccpav_ack_ackno = av->dccpav_buf_ackno;
+        av->dccpav_ack_nonce = av->dccpav_buf_nonce;
+        av->dccpav_sent_len  = av->dccpav_vec_len;
+
+        dccp_pr_debug("%sACK Vector 0, len=%d, ack_seqno=%llu, "
+                      "ack_ackno=%llu\n",
+                      debug_prefix, av->dccpav_sent_len,
+                      (unsigned long long)av->dccpav_ack_seqno,
+                      (unsigned long long)av->dccpav_ack_ackno);
+        return -1;
+}
+
+struct dccp_ackvec *dccp_ackvec_alloc(const unsigned int len,
+                                      const unsigned int __nocast priority)
+{
+        struct dccp_ackvec *av = kmalloc(sizeof(*av) + len, priority);
+
+        if (av != NULL) {
+                av->dccpav_buf_len      = len;
+                av->dccpav_buf_head     =
+                        av->dccpav_buf_tail = av->dccpav_buf_len - 1;
+                av->dccpav_buf_ackno    =
+                        av->dccpav_ack_ackno = av->dccpav_ack_seqno = ~0LLU;
+                av->dccpav_buf_nonce = av->dccpav_buf_nonce = 0;
+                av->dccpav_ack_ptr      = 0;
+                av->dccpav_time.tv_sec  = 0;
+                av->dccpav_time.tv_usec = 0;
+                av->dccpav_sent_len     = av->dccpav_vec_len = 0;
+        }
+
+        return av;
+}
+
+void dccp_ackvec_free(struct dccp_ackvec *av)
+{
+        kfree(av);
+}
+
+static inline u8 dccp_ackvec_state(const struct dccp_ackvec *av,
+                                   const unsigned int index)
+{
+        return av->dccpav_buf[index] & DCCP_ACKVEC_STATE_MASK;
+}
+
+static inline u8 dccp_ackvec_len(const struct dccp_ackvec *av,
+                                 const unsigned int index)
+{
+        return av->dccpav_buf[index] & DCCP_ACKVEC_LEN_MASK;
+}
+
+/*
+ * If several packets are missing, the HC-Receiver may prefer to enter multiple
+ * bytes with run length 0, rather than a single byte with a larger run length;
+ * this simplifies table updates if one of the missing packets arrives.
+ */
+static inline int dccp_ackvec_set_buf_head_state(struct dccp_ackvec *av,
+                                                 const unsigned int packets,
+                                                  const unsigned char state)
+{
+        unsigned int gap;
+        signed long new_head;
+
+        if (av->dccpav_vec_len + packets > av->dccpav_buf_len)
+                return -ENOBUFS;
+
+        gap      = packets - 1;
+        new_head = av->dccpav_buf_head - packets;
+
+        if (new_head < 0) {
+                if (gap > 0) {
+                        memset(av->dccpav_buf, DCCP_ACKVEC_STATE_NOT_RECEIVED,
+                               gap + new_head + 1);
+                        gap = -new_head;
+                }
+                new_head += av->dccpav_buf_len;
+        } 
+
+        av->dccpav_buf_head = new_head;
+
+        if (gap > 0)
+                memset(av->dccpav_buf + av->dccpav_buf_head + 1,
+                       DCCP_ACKVEC_STATE_NOT_RECEIVED, gap);
+
+        av->dccpav_buf[av->dccpav_buf_head] = state;
+        av->dccpav_vec_len += packets;
+        return 0;
+}
+
+/*
+ * Implements the draft-ietf-dccp-spec-11.txt Appendix A
+ */
+int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
+                    const u64 ackno, const u8 state)
+{
+        /*
+         * Check at the right places if the buffer is full, if it is, tell the
+         * caller to start dropping packets till the HC-Sender acks our ACK
+         * vectors, when we will free up space in dccpav_buf.
+         *
+         * We may well decide to do buffer compression, etc, but for now lets
+         * just drop.
+         *
+         * From Appendix A:
+         *
+         *      Of course, the circular buffer may overflow, either when the
+         *      HC-Sender is sending data at a very high rate, when the
+         *      HC-Receiver's acknowledgements are not reaching the HC-Sender,
+         *      or when the HC-Sender is forgetting to acknowledge those acks
+         *      (so the HC-Receiver is unable to clean up old state). In this
+         *      case, the HC-Receiver should either compress the buffer (by
+         *      increasing run lengths when possible), transfer its state to
+         *      a larger buffer, or, as a last resort, drop all received
+         *      packets, without processing them whatsoever, until its buffer
+         *      shrinks again.
+         */
+
+        /* See if this is the first ackno being inserted */
+        if (av->dccpav_vec_len == 0) {
+                av->dccpav_buf[av->dccpav_buf_head] = state;
+                av->dccpav_vec_len = 1;
+        } else if (after48(ackno, av->dccpav_buf_ackno)) {
+                const u64 delta = dccp_delta_seqno(av->dccpav_buf_ackno,
+                                                   ackno);
+
+                /*
+                 * Look if the state of this packet is the same as the
+                 * previous ackno and if so if we can bump the head len.
+                 */
+                if (delta == 1 &&
+                    dccp_ackvec_state(av, av->dccpav_buf_head) == state &&
+                    (dccp_ackvec_len(av, av->dccpav_buf_head) <
+                     DCCP_ACKVEC_LEN_MASK))
+                        av->dccpav_buf[av->dccpav_buf_head]++;
+                else if (dccp_ackvec_set_buf_head_state(av, delta, state))
+                        return -ENOBUFS;
+        } else {
+                /*
+                 * A.1.2.  Old Packets
+                 *
+                 *      When a packet with Sequence Number S arrives, and
+                 *      S <= buf_ackno, the HC-Receiver will scan the table
+                 *      for the byte corresponding to S. (Indexing structures
+                 *      could reduce the complexity of this scan.)
+                 */
+                u64 delta = dccp_delta_seqno(ackno, av->dccpav_buf_ackno);
+                unsigned int index = av->dccpav_buf_head;
+
+                while (1) {
+                        const u8 len = dccp_ackvec_len(av, index);
+                        const u8 state = dccp_ackvec_state(av, index);
+                        /*
+                         * valid packets not yet in dccpav_buf have a reserved
+                         * entry, with a len equal to 0.
+                         */
+                        if (state == DCCP_ACKVEC_STATE_NOT_RECEIVED &&
+                            len == 0 && delta == 0) { /* Found our
+                                                         reserved seat! */
+                                dccp_pr_debug("Found %llu reserved seat!\n",
+                                              (unsigned long long)ackno);
+                                av->dccpav_buf[index] = state;
+                                goto out;
+                        }
+                        /* len == 0 means one packet */
+                        if (delta < len + 1)
+                                goto out_duplicate;
+
+                        delta -= len + 1;
+                        if (++index == av->dccpav_buf_len)
+                                index = 0;
+                }
+        }
+
+        av->dccpav_buf_ackno = ackno;
+        dccp_timestamp(sk, &av->dccpav_time);
+out:
+        dccp_pr_debug("");
+        return 0;
+
+out_duplicate:
+        /* Duplicate packet */
+        dccp_pr_debug("Received a dup or already considered lost "
+                      "packet: %llu\n", (unsigned long long)ackno);
+        return -EILSEQ;
+}
+
+#ifdef CONFIG_IP_DCCP_DEBUG
+void dccp_ackvector_print(const u64 ackno, const unsigned char *vector, int len)
+{
+        if (!dccp_debug)
+                return;
+
+        printk("ACK vector len=%d, ackno=%llu |", len,
+               (unsigned long long)ackno);
+
+        while (len--) {
+                const u8 state = (*vector & DCCP_ACKVEC_STATE_MASK) >> 6;
+                const u8 rl = *vector & DCCP_ACKVEC_LEN_MASK;
+
+                printk("%d,%d|", state, rl);
+                ++vector;
+        }
+
+        printk("\n");
+}
+
+void dccp_ackvec_print(const struct dccp_ackvec *av)
+{
+        dccp_ackvector_print(av->dccpav_buf_ackno,
+                             av->dccpav_buf + av->dccpav_buf_head,
+                             av->dccpav_vec_len);
+}
+#endif
+
+static void dccp_ackvec_trow_away_ack_record(struct dccp_ackvec *av)
+{
+        /*
+         * As we're keeping track of the ack vector size (dccpav_vec_len) and
+         * the sent ack vector size (dccpav_sent_len) we don't need
+         * dccpav_buf_tail at all, but keep this code here as in the future
+         * we'll implement a vector of ack records, as suggested in
+         * draft-ietf-dccp-spec-11.txt Appendix A. -acme
+         */
+#if 0
+        av->dccpav_buf_tail = av->dccpav_ack_ptr + 1;
+        if (av->dccpav_buf_tail >= av->dccpav_vec_len)
+                av->dccpav_buf_tail -= av->dccpav_vec_len;
+#endif
+        av->dccpav_vec_len -= av->dccpav_sent_len;
+}
+
+void dccp_ackvec_check_rcv_ackno(struct dccp_ackvec *av, struct sock *sk,
+                                 const u64 ackno)
+{
+        /* Check if we actually sent an ACK vector */
+        if (av->dccpav_ack_seqno == DCCP_MAX_SEQNO + 1)
+                return;
+
+        if (ackno == av->dccpav_ack_seqno) {
+#ifdef CONFIG_IP_DCCP_DEBUG
+                struct dccp_sock *dp = dccp_sk(sk);
+                const char *debug_prefix = dp->dccps_role == DCCP_ROLE_CLIENT ?
+                                        "CLIENT rx ack: " : "server rx ack: ";
+#endif
+                dccp_pr_debug("%sACK packet 0, len=%d, ack_seqno=%llu, "
+                              "ack_ackno=%llu, ACKED!\n",
+                              debug_prefix, 1,
+                              (unsigned long long)av->dccpav_ack_seqno,
+                              (unsigned long long)av->dccpav_ack_ackno);
+                dccp_ackvec_trow_away_ack_record(av);
+                av->dccpav_ack_seqno = DCCP_MAX_SEQNO + 1;
+        }
+}
+
+static void dccp_ackvec_check_rcv_ackvector(struct dccp_ackvec *av,
+                                            struct sock *sk, u64 ackno,
+                                            const unsigned char len,
+                                            const unsigned char *vector)
+{
+        unsigned char i;
+
+        /* Check if we actually sent an ACK vector */
+        if (av->dccpav_ack_seqno == DCCP_MAX_SEQNO + 1)
+                return;
+        /*
+         * We're in the receiver half connection, so if the received an ACK
+         * vector ackno (e.g. 50) before dccpav_ack_seqno (e.g. 52), we're
+         * not interested.
+         *
+         * Extra explanation with example:
+         * 
+         * if we received an ACK vector with ackno 50, it can only be acking
+         * 50, 49, 48, etc, not 52 (the seqno for the ACK vector we sent).
+         */
+        /* dccp_pr_debug("is %llu < %llu? ", ackno, av->dccpav_ack_seqno); */
+        if (before48(ackno, av->dccpav_ack_seqno)) {
+                /* dccp_pr_debug_cat("yes\n"); */
+                return;
+        }
+        /* dccp_pr_debug_cat("no\n"); */
+
+        i = len;
+        while (i--) {
+                const u8 rl = *vector & DCCP_ACKVEC_LEN_MASK;
+                u64 ackno_end_rl;
+
+                dccp_set_seqno(&ackno_end_rl, ackno - rl);
+
+                /*
+                 * dccp_pr_debug("is %llu <= %llu <= %llu? ", ackno_end_rl,
+                 * av->dccpav_ack_seqno, ackno);
+                 */
+                if (between48(av->dccpav_ack_seqno, ackno_end_rl, ackno)) {
+                        const u8 state = (*vector &
+                                          DCCP_ACKVEC_STATE_MASK) >> 6;
+                        /* dccp_pr_debug_cat("yes\n"); */
+
+                        if (state != DCCP_ACKVEC_STATE_NOT_RECEIVED) {
+#ifdef CONFIG_IP_DCCP_DEBUG
+                                struct dccp_sock *dp = dccp_sk(sk);
+                                const char *debug_prefix =
+                                        dp->dccps_role == DCCP_ROLE_CLIENT ?
+                                        "CLIENT rx ack: " : "server rx ack: ";
+#endif
+                                dccp_pr_debug("%sACK vector 0, len=%d, "
+                                              "ack_seqno=%llu, ack_ackno=%llu, "
+                                              "ACKED!\n",
+                                              debug_prefix, len,
+                                              (unsigned long long)
+                                              av->dccpav_ack_seqno,
+                                              (unsigned long long)
+                                              av->dccpav_ack_ackno);
+                                dccp_ackvec_trow_away_ack_record(av);
+                        }
+                        /*
+                         * If dccpav_ack_seqno was not received, no problem
+                         * we'll send another ACK vector.
+                         */
+                        av->dccpav_ack_seqno = DCCP_MAX_SEQNO + 1;
+                        break;
+                }
+                /* dccp_pr_debug_cat("no\n"); */
+
+                dccp_set_seqno(&ackno, ackno_end_rl - 1);
+                ++vector;
+        }
+}
+
+int dccp_ackvec_parse(struct sock *sk, const struct sk_buff *skb,
+                      const u8 opt, const u8 *value, const u8 len)
+{
+        if (len > DCCP_MAX_ACKVEC_LEN)
+                return -1;
+
+        /* dccp_ackvector_print(DCCP_SKB_CB(skb)->dccpd_ack_seq, value, len); */
+        dccp_ackvec_check_rcv_ackvector(dccp_sk(sk)->dccps_hc_rx_ackvec, sk,
+                                        DCCP_SKB_CB(skb)->dccpd_ack_seq,
+                                        len, value);
+        return 0;
+}
diff --git a/net/dccp/ackvec.h b/net/dccp/ackvec.h
new file mode 100644
index 000000000000..8ca51c9191f7
--- /dev/null
+++ b/net/dccp/ackvec.h
@@ -0,0 +1,133 @@
+#ifndef _ACKVEC_H
+#define _ACKVEC_H
+/*
+ *  net/dccp/ackvec.h
+ *
+ *  An implementation of the DCCP protocol
+ *  Copyright (c) 2005 Arnaldo Carvalho de Melo <acme@mandriva.com>
+ *
+ *      This program is free software; you can redistribute it and/or modify it
+ *      under the terms of the GNU General Public License version 2 as
+ *      published by the Free Software Foundation.
+ */
+
+#include <linux/config.h>
+#include <linux/compiler.h>
+#include <linux/time.h>
+#include <linux/types.h>
+
+/* Read about the ECN nonce to see why it is 253 */
+#define DCCP_MAX_ACKVEC_LEN 253
+
+#define DCCP_ACKVEC_STATE_RECEIVED      0
+#define DCCP_ACKVEC_STATE_ECN_MARKED    (1 << 6)
+#define DCCP_ACKVEC_STATE_NOT_RECEIVED  (3 << 6)
+
+#define DCCP_ACKVEC_STATE_MASK          0xC0 /* 11000000 */
+#define DCCP_ACKVEC_LEN_MASK            0x3F /* 00111111 */
+
+/** struct dccp_ackvec - ack vector
+ *
+ * This data structure is the one defined in the DCCP draft
+ * Appendix A.
+ *
+ * @dccpav_buf_head - circular buffer head
+ * @dccpav_buf_tail - circular buffer tail
+ * @dccpav_buf_ackno - ack # of the most recent packet acknowledgeable in the
+ *                     buffer (i.e. %dccpav_buf_head)
+ * @dccpav_buf_nonce - the one-bit sum of the ECN Nonces on all packets acked
+ *                     by the buffer with State 0
+ *
+ * Additionally, the HC-Receiver must keep some information about the
+ * Ack Vectors it has recently sent. For each packet sent carrying an
+ * Ack Vector, it remembers four variables:
+ *
+ * @dccpav_ack_seqno - the Sequence Number used for the packet
+ *                     (HC-Receiver seqno)
+ * @dccpav_ack_ptr - the value of buf_head at the time of acknowledgement.
+ * @dccpav_ack_ackno - the Acknowledgement Number used for the packet
+ *                     (HC-Sender seqno)
+ * @dccpav_ack_nonce - the one-bit sum of the ECN Nonces for all State 0.
+ *
+ * @dccpav_buf_len      - circular buffer length
+ * @dccpav_time         - the time in usecs
+ * @dccpav_buf - circular buffer of acknowledgeable packets
+ */
+struct dccp_ackvec {
+        unsigned int    dccpav_buf_head;
+        unsigned int    dccpav_buf_tail;
+        u64             dccpav_buf_ackno;
+        u64             dccpav_ack_seqno;
+        u64             dccpav_ack_ackno;
+        unsigned int    dccpav_ack_ptr;
+        unsigned int    dccpav_sent_len;
+        unsigned int    dccpav_vec_len;
+        unsigned int    dccpav_buf_len;
+        struct timeval  dccpav_time;
+        u8              dccpav_buf_nonce;
+        u8              dccpav_ack_nonce;
+        u8              dccpav_buf[0];
+};
+
+struct sock;
+struct sk_buff;
+
+#ifdef CONFIG_IP_DCCP_ACKVEC
+extern struct dccp_ackvec *dccp_ackvec_alloc(unsigned int len,
+                                          const unsigned int __nocast priority);
+extern void dccp_ackvec_free(struct dccp_ackvec *av);
+
+extern int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
+                           const u64 ackno, const u8 state);
+
+extern void dccp_ackvec_check_rcv_ackno(struct dccp_ackvec *av,
+                                        struct sock *sk, const u64 ackno);
+extern int dccp_ackvec_parse(struct sock *sk, const struct sk_buff *skb,
+                             const u8 opt, const u8 *value, const u8 len);
+
+extern int dccp_insert_option_ackvec(struct sock *sk, struct sk_buff *skb);
+
+static inline int dccp_ackvec_pending(const struct dccp_ackvec *av)
+{
+        return av->dccpav_sent_len != av->dccpav_vec_len;
+}
+#else /* CONFIG_IP_DCCP_ACKVEC */
+static inline struct dccp_ackvec *dccp_ackvec_alloc(unsigned int len,
+                                           const unsigned int __nocast priority)
+{
+        return NULL;
+}
+
+static inline void dccp_ackvec_free(struct dccp_ackvec *av)
+{
+}
+
+static inline int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
+                                  const u64 ackno, const u8 state)
+{
+        return -1;
+}
+
+static inline void dccp_ackvec_check_rcv_ackno(struct dccp_ackvec *av,
+                                               struct sock *sk, const u64 ackno)
+{
+}
+
+static inline int dccp_ackvec_parse(struct sock *sk, const struct sk_buff *skb,
+                                    const u8 opt, const u8 *value, const u8 len)
+{
+        return -1;
+}
+
+static inline int dccp_insert_option_ackvec(const struct sock *sk,
+                                            const struct sk_buff *skb)
+{
+        return -1;
+}
+
+static inline int dccp_ackvec_pending(const struct dccp_ackvec *av)
+{
+        return 0;
+}
+#endif /* CONFIG_IP_DCCP_ACKVEC */
+#endif /* _ACKVEC_H */
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index 962f1e9e2f7e..21e55142dcd3 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -14,6 +14,7 @@
  */
 
 #include <net/sock.h>
+#include <linux/compiler.h>
 #include <linux/dccp.h>
 #include <linux/list.h>
 #include <linux/module.h>
@@ -54,6 +55,14 @@ struct ccid {
                                                struct tcp_info *info);
         void            (*ccid_hc_tx_get_info)(struct sock *sk,
                                                struct tcp_info *info);
+        int             (*ccid_hc_rx_getsockopt)(struct sock *sk,
+                                                 const int optname, int len,
+                                                 u32 __user *optval,
+                                                 int __user *optlen);
+        int             (*ccid_hc_tx_getsockopt)(struct sock *sk,
+                                                 const int optname, int len,
+                                                 u32 __user *optval,
+                                                 int __user *optlen);
 };
 
 extern int         ccid_register(struct ccid *ccid);
@@ -177,4 +186,26 @@ static inline void ccid_hc_tx_get_info(struct ccid *ccid, struct sock *sk,
         if (ccid->ccid_hc_tx_get_info != NULL)
                 ccid->ccid_hc_tx_get_info(sk, info);
 }
+
+static inline int ccid_hc_rx_getsockopt(struct ccid *ccid, struct sock *sk,
+                                        const int optname, int len,
+                                        u32 __user *optval, int __user *optlen)
+{
+        int rc = -ENOPROTOOPT;
+        if (ccid->ccid_hc_rx_getsockopt != NULL)
+                rc = ccid->ccid_hc_rx_getsockopt(sk, optname, len,
+                                                 optval, optlen);
+        return rc;
+}
+
+static inline int ccid_hc_tx_getsockopt(struct ccid *ccid, struct sock *sk,
+                                        const int optname, int len,
+                                        u32 __user *optval, int __user *optlen)
+{
+        int rc = -ENOPROTOOPT;
+        if (ccid->ccid_hc_tx_getsockopt != NULL)
+                rc = ccid->ccid_hc_tx_getsockopt(sk, optname, len,
+                                                 optval, optlen);
+        return rc;
+}
 #endif /* _CCID_H */
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 38aa84986118..aa68e0ab274d 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -1120,6 +1120,60 @@ static void ccid3_hc_tx_get_info(struct sock *sk, struct tcp_info *info)
         info->tcpi_rtt = hctx->ccid3hctx_rtt;
 }
 
+static int ccid3_hc_rx_getsockopt(struct sock *sk, const int optname, int len,
+                                  u32 __user *optval, int __user *optlen)
+{
+        const struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
+        const void *val;
+        
+        /* Listen socks doesn't have a private CCID block */
+        if (sk->sk_state == DCCP_LISTEN)
+                return -EINVAL;
+
+        switch (optname) {
+        case DCCP_SOCKOPT_CCID_RX_INFO:
+                if (len < sizeof(hcrx->ccid3hcrx_tfrc))
+                        return -EINVAL;
+                len = sizeof(hcrx->ccid3hcrx_tfrc);
+                val = &hcrx->ccid3hcrx_tfrc;
+                break;
+        default:
+                return -ENOPROTOOPT;
+        }
+
+        if (put_user(len, optlen) || copy_to_user(optval, val, len))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
+                                  u32 __user *optval, int __user *optlen)
+{
+        const struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        const void *val;
+        
+        /* Listen socks doesn't have a private CCID block */
+        if (sk->sk_state == DCCP_LISTEN)
+                return -EINVAL;
+
+        switch (optname) {
+        case DCCP_SOCKOPT_CCID_TX_INFO:
+                if (len < sizeof(hctx->ccid3hctx_tfrc))
+                        return -EINVAL;
+                len = sizeof(hctx->ccid3hctx_tfrc);
+                val = &hctx->ccid3hctx_tfrc;
+                break;
+        default:
+                return -ENOPROTOOPT;
+        }
+
+        if (put_user(len, optlen) || copy_to_user(optval, val, len))
+                return -EFAULT;
+
+        return 0;
+}
+
 static struct ccid ccid3 = {
         .ccid_id                   = 3,
         .ccid_name                 = "ccid3",
@@ -1139,6 +1193,8 @@ static struct ccid ccid3 = {
         .ccid_hc_rx_packet_recv    = ccid3_hc_rx_packet_recv,
         .ccid_hc_rx_get_info       = ccid3_hc_rx_get_info,
         .ccid_hc_tx_get_info       = ccid3_hc_tx_get_info,
+        .ccid_hc_rx_getsockopt     = ccid3_hc_rx_getsockopt,
+        .ccid_hc_tx_getsockopt     = ccid3_hc_tx_getsockopt,
 };
  
 module_param(ccid3_debug, int, 0444);
diff --git a/net/dccp/ccids/ccid3.h b/net/dccp/ccids/ccid3.h
index eb248778eea3..0bde4583d091 100644
--- a/net/dccp/ccids/ccid3.h
+++ b/net/dccp/ccids/ccid3.h
@@ -40,6 +40,7 @@
 #include <linux/list.h>
 #include <linux/time.h>
 #include <linux/types.h>
+#include <linux/tfrc.h>
 
 #define TFRC_MIN_PACKET_SIZE       16
 #define TFRC_STD_PACKET_SIZE      256
@@ -93,12 +94,15 @@ struct ccid3_options_received {
   * @ccid3hctx_hist - Packet history
   */
 struct ccid3_hc_tx_sock {
-        u32                             ccid3hctx_x;
-        u32                             ccid3hctx_x_recv;
-        u32                             ccid3hctx_x_calc;
+        struct tfrc_tx_info             ccid3hctx_tfrc;
+#define ccid3hctx_x                     ccid3hctx_tfrc.tfrctx_x
+#define ccid3hctx_x_recv                ccid3hctx_tfrc.tfrctx_x_recv
+#define ccid3hctx_x_calc                ccid3hctx_tfrc.tfrctx_x_calc
+#define ccid3hctx_rtt                   ccid3hctx_tfrc.tfrctx_rtt
+#define ccid3hctx_p                     ccid3hctx_tfrc.tfrctx_p
+#define ccid3hctx_t_rto                 ccid3hctx_tfrc.tfrctx_rto
+#define ccid3hctx_t_ipi                 ccid3hctx_tfrc.tfrctx_ipi
         u16                             ccid3hctx_s;
-        u32                             ccid3hctx_rtt;
-        u32                             ccid3hctx_p;
         u8                              ccid3hctx_state;
         u8                              ccid3hctx_last_win_count;
         u8                              ccid3hctx_idle;
@@ -106,19 +110,19 @@ struct ccid3_hc_tx_sock {
         struct timer_list               ccid3hctx_no_feedback_timer;
         struct timeval                  ccid3hctx_t_ld;
         struct timeval                  ccid3hctx_t_nom;
-        u32                             ccid3hctx_t_rto;
-        u32                             ccid3hctx_t_ipi;
         u32                             ccid3hctx_delta;
         struct list_head                ccid3hctx_hist;
         struct ccid3_options_received   ccid3hctx_options_received;
 };
 
 struct ccid3_hc_rx_sock {
+        struct tfrc_rx_info     ccid3hcrx_tfrc;
+#define ccid3hcrx_x_recv        ccid3hcrx_tfrc.tfrcrx_x_recv
+#define ccid3hcrx_rtt           ccid3hcrx_tfrc.tfrcrx_rtt
+#define ccid3hcrx_p             ccid3hcrx_tfrc.tfrcrx_p
         u64                     ccid3hcrx_seqno_last_counter:48,
                                 ccid3hcrx_state:8,
                                 ccid3hcrx_last_counter:4;
-        u32                     ccid3hcrx_rtt;
-        u32                     ccid3hcrx_p;
         u32                     ccid3hcrx_bytes_recv;
         struct timeval          ccid3hcrx_tstamp_last_feedback;
         struct timeval          ccid3hcrx_tstamp_last_ack;
@@ -127,7 +131,6 @@ struct ccid3_hc_rx_sock {
         u16                     ccid3hcrx_s;
         u32                     ccid3hcrx_pinv;
         u32                     ccid3hcrx_elapsed_time;
-        u32                     ccid3hcrx_x_recv;
 };
 
 static inline struct ccid3_hc_tx_sock *ccid3_hc_tx_sk(const struct sock *sk)
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 95c4630b3b18..5871c027f9dc 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -17,6 +17,7 @@
 #include <net/snmp.h>
 #include <net/sock.h>
 #include <net/tcp.h>
+#include "ackvec.h"
 
 #ifdef CONFIG_IP_DCCP_DEBUG
 extern int dccp_debug;
@@ -258,13 +259,12 @@ extern int	   dccp_v4_send_reset(struct sock *sk,
 extern void        dccp_send_close(struct sock *sk, const int active);
 
 struct dccp_skb_cb {
-        __u8 dccpd_type;
-        __u8 dccpd_reset_code;
-        __u8 dccpd_service;
-        __u8 dccpd_ccval;
+        __u8  dccpd_type:4;
+        __u8  dccpd_ccval:4;
+        __u8  dccpd_reset_code;
+        __u16 dccpd_opt_len;
         __u64 dccpd_seq;
         __u64 dccpd_ack_seq;
-        int  dccpd_opt_len;
 };
 
 #define DCCP_SKB_CB(__skb) ((struct dccp_skb_cb *)&((__skb)->cb[0]))
@@ -359,6 +359,17 @@ static inline void dccp_update_gss(struct sock *sk, u64 seq)
                        (dp->dccps_gss -
                         dp->dccps_options.dccpo_sequence_window + 1));
 }
+                                
+static inline int dccp_ack_pending(const struct sock *sk)
+{
+        const struct dccp_sock *dp = dccp_sk(sk);
+        return dp->dccps_timestamp_echo != 0 ||
+#ifdef CONFIG_IP_DCCP_ACKVEC
+               (dp->dccps_options.dccpo_send_ack_vector &&
+                dccp_ackvec_pending(dp->dccps_hc_rx_ackvec)) ||
+#endif
+               inet_csk_ack_scheduled(sk);
+}
 
 extern void dccp_insert_options(struct sock *sk, struct sk_buff *skb);
 extern void dccp_insert_option_elapsed_time(struct sock *sk,
@@ -372,65 +383,6 @@ extern void dccp_insert_option(struct sock *sk, struct sk_buff *skb,
 
 extern struct socket *dccp_ctl_socket;
 
-#define DCCP_ACKPKTS_STATE_RECEIVED     0
-#define DCCP_ACKPKTS_STATE_ECN_MARKED   (1 << 6)
-#define DCCP_ACKPKTS_STATE_NOT_RECEIVED (3 << 6)
-
-#define DCCP_ACKPKTS_STATE_MASK         0xC0 /* 11000000 */
-#define DCCP_ACKPKTS_LEN_MASK           0x3F /* 00111111 */
-
-/** struct dccp_ackpkts - acknowledgeable packets
- *
- * This data structure is the one defined in the DCCP draft
- * Appendix A.
- *
- * @dccpap_buf_head - circular buffer head
- * @dccpap_buf_tail - circular buffer tail
- * @dccpap_buf_ackno - ack # of the most recent packet acknowledgeable in the
- *                     buffer (i.e. %dccpap_buf_head)
- * @dccpap_buf_nonce - the one-bit sum of the ECN Nonces on all packets acked
- *                     by the buffer with State 0
- *
- * Additionally, the HC-Receiver must keep some information about the
- * Ack Vectors it has recently sent. For each packet sent carrying an
- * Ack Vector, it remembers four variables:
- *
- * @dccpap_ack_seqno - the Sequence Number used for the packet
- *                     (HC-Receiver seqno)
- * @dccpap_ack_ptr - the value of buf_head at the time of acknowledgement.
- * @dccpap_ack_ackno - the Acknowledgement Number used for the packet
- *                     (HC-Sender seqno)
- * @dccpap_ack_nonce - the one-bit sum of the ECN Nonces for all State 0.
- *
- * @dccpap_buf_len - circular buffer length
- * @dccpap_time         - the time in usecs
- * @dccpap_buf - circular buffer of acknowledgeable packets
- */
-struct dccp_ackpkts {
-        unsigned int            dccpap_buf_head;
-        unsigned int            dccpap_buf_tail;
-        u64                     dccpap_buf_ackno;
-        u64                     dccpap_ack_seqno;
-        u64                     dccpap_ack_ackno;
-        unsigned int            dccpap_ack_ptr;
-        unsigned int            dccpap_buf_vector_len;
-        unsigned int            dccpap_ack_vector_len;
-        unsigned int            dccpap_buf_len;
-        struct timeval          dccpap_time;
-        u8                      dccpap_buf_nonce;
-        u8                      dccpap_ack_nonce;
-        u8                      dccpap_buf[0];
-};
-
-extern struct dccp_ackpkts *
-                dccp_ackpkts_alloc(unsigned int len,
-                                  const unsigned int __nocast priority);
-extern void dccp_ackpkts_free(struct dccp_ackpkts *ap);
-extern int dccp_ackpkts_add(struct dccp_ackpkts *ap, const struct sock *sk,
-                            u64 ackno, u8 state);
-extern void dccp_ackpkts_check_rcv_ackno(struct dccp_ackpkts *ap,
-                                         struct sock *sk, u64 ackno);
-
 extern void dccp_timestamp(const struct sock *sk, struct timeval *tv);
 
 static inline suseconds_t timeval_usecs(const struct timeval *tv)
@@ -471,15 +423,4 @@ static inline void timeval_sub_usecs(struct timeval *tv,
         }
 }
 
-#ifdef CONFIG_IP_DCCP_DEBUG
-extern void dccp_ackvector_print(const u64 ackno,
-                                 const unsigned char *vector, int len);
-extern void dccp_ackpkts_print(const struct dccp_ackpkts *ap);
-#else
-static inline void dccp_ackvector_print(const u64 ackno,
-                                        const unsigned char *vector,
-                                        int len) { }
-static inline void dccp_ackpkts_print(const struct dccp_ackpkts *ap) { }
-#endif
-
 #endif /* _DCCP_H */
diff --git a/net/dccp/input.c b/net/dccp/input.c
index c60bc3433f5e..1b6b2cb12376 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -16,6 +16,7 @@
 
 #include <net/sock.h>
 
+#include "ackvec.h"
 #include "ccid.h"
 #include "dccp.h"
 
@@ -50,7 +51,8 @@ static void dccp_rcv_closereq(struct sock *sk, struct sk_buff *skb)
                 return;
         }
 
-        dccp_set_state(sk, DCCP_CLOSING);
+        if (sk->sk_state != DCCP_CLOSING)
+                dccp_set_state(sk, DCCP_CLOSING);
         dccp_send_close(sk, 0);
 }
 
@@ -59,8 +61,8 @@ static inline void dccp_event_ack_recv(struct sock *sk, struct sk_buff *skb)
         struct dccp_sock *dp = dccp_sk(sk);
 
         if (dp->dccps_options.dccpo_send_ack_vector)
-                dccp_ackpkts_check_rcv_ackno(dp->dccps_hc_rx_ackpkts, sk,
-                                             DCCP_SKB_CB(skb)->dccpd_ack_seq);
+                dccp_ackvec_check_rcv_ackno(dp->dccps_hc_rx_ackvec, sk,
+                                            DCCP_SKB_CB(skb)->dccpd_ack_seq);
 }
 
 static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
@@ -163,37 +165,11 @@ int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
         if (DCCP_SKB_CB(skb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
                 dccp_event_ack_recv(sk, skb);
 
-        /*
-         * FIXME: check ECN to see if we should use
-         * DCCP_ACKPKTS_STATE_ECN_MARKED
-         */
-        if (dp->dccps_options.dccpo_send_ack_vector) {
-                struct dccp_ackpkts *ap = dp->dccps_hc_rx_ackpkts;
-
-                if (dccp_ackpkts_add(dp->dccps_hc_rx_ackpkts, sk,
-                                     DCCP_SKB_CB(skb)->dccpd_seq,
-                                     DCCP_ACKPKTS_STATE_RECEIVED)) {
-                        LIMIT_NETDEBUG(KERN_WARNING "DCCP: acknowledgeable "
-                                                    "packets buffer full!\n");
-                        ap->dccpap_ack_seqno = DCCP_MAX_SEQNO + 1;
-                        inet_csk_schedule_ack(sk);
-                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-                                                  TCP_DELACK_MIN,
-                                                  DCCP_RTO_MAX);
-                        goto discard;
-                }
-
-                /*
-                 * FIXME: this activation is probably wrong, have to study more
-                 * TCP delack machinery and how it fits into DCCP draft, but
-                 * for now it kinda "works" 8)
-                 */
-                if (!inet_csk_ack_scheduled(sk)) {
-                        inet_csk_schedule_ack(sk);
-                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK, 5 * HZ,
-                                                  DCCP_RTO_MAX);
-                }
-        }
+        if (dp->dccps_options.dccpo_send_ack_vector &&
+            dccp_ackvec_add(dp->dccps_hc_rx_ackvec, sk,
+                            DCCP_SKB_CB(skb)->dccpd_seq,
+                            DCCP_ACKVEC_STATE_RECEIVED))
+                goto discard;
 
         ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
         ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
@@ -383,9 +359,9 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
         }
 
 out_invalid_packet:
-        return 1; /* dccp_v4_do_rcv will send a reset, but...
-                     FIXME: the reset code should be
-                            DCCP_RESET_CODE_PACKET_ERROR */
+        /* dccp_v4_do_rcv will send a reset */
+        DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_PACKET_ERROR;
+        return 1; 
 }
 
 static int dccp_rcv_respond_partopen_state_process(struct sock *sk,
@@ -432,6 +408,7 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                            struct dccp_hdr *dh, unsigned len)
 {
         struct dccp_sock *dp = dccp_sk(sk);
+        struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
         const int old_state = sk->sk_state;
         int queued = 0;
 
@@ -472,7 +449,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 if (dh->dccph_type == DCCP_PKT_RESET)
                         goto discard;
 
-                /* Caller (dccp_v4_do_rcv) will send Reset(No Connection)*/
+                /* Caller (dccp_v4_do_rcv) will send Reset */
+                dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
                 return 1;
         }
 
@@ -486,36 +464,17 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 if (dccp_parse_options(sk, skb))
                         goto discard;
 
-                if (DCCP_SKB_CB(skb)->dccpd_ack_seq !=
-                    DCCP_PKT_WITHOUT_ACK_SEQ)
+                if (dcb->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
                         dccp_event_ack_recv(sk, skb);
 
                 ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
                 ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
 
-                /*
-                 * FIXME: check ECN to see if we should use
-                 * DCCP_ACKPKTS_STATE_ECN_MARKED
-                 */
-                if (dp->dccps_options.dccpo_send_ack_vector) {
-                        if (dccp_ackpkts_add(dp->dccps_hc_rx_ackpkts, sk,
-                                             DCCP_SKB_CB(skb)->dccpd_seq,
-                                             DCCP_ACKPKTS_STATE_RECEIVED))
-                                goto discard;
-                        /*
-                         * FIXME: this activation is probably wrong, have to
-                         * study more TCP delack machinery and how it fits into
-                         * DCCP draft, but for now it kinda "works" 8)
-                         */
-                        if ((dp->dccps_hc_rx_ackpkts->dccpap_ack_seqno ==
-                             DCCP_MAX_SEQNO + 1) &&
-                            !inet_csk_ack_scheduled(sk)) {
-                                inet_csk_schedule_ack(sk);
-                                inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
-                                                          TCP_DELACK_MIN,
-                                                          DCCP_RTO_MAX);
-                        }
-                }
+                if (dp->dccps_options.dccpo_send_ack_vector &&
+                    dccp_ackvec_add(dp->dccps_hc_rx_ackvec, sk,
+                                    DCCP_SKB_CB(skb)->dccpd_seq,
+                                    DCCP_ACKVEC_STATE_RECEIVED))
+                        goto discard;
         }
 
         /*
@@ -550,8 +509,7 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                      dh->dccph_type == DCCP_PKT_REQUEST) ||
                     (sk->sk_state == DCCP_RESPOND &&
                      dh->dccph_type == DCCP_PKT_DATA)) {
-                dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq,
-                               DCCP_PKT_SYNC);
+                dccp_send_sync(sk, dcb->dccpd_seq, DCCP_PKT_SYNC);
                 goto discard;
         } else if (dh->dccph_type == DCCP_PKT_CLOSEREQ) {
                 dccp_rcv_closereq(sk, skb);
@@ -561,8 +519,14 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 return 0;
         }
 
+        if (unlikely(dh->dccph_type == DCCP_PKT_SYNC)) {
+                dccp_send_sync(sk, dcb->dccpd_seq, DCCP_PKT_SYNCACK);
+                goto discard;
+        }
+
         switch (sk->sk_state) {
         case DCCP_CLOSED:
+                dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
                 return 1;
 
         case DCCP_REQUESTING:
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 2afaa464e7f0..ae088d1347af 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -23,6 +23,7 @@
 #include <net/tcp_states.h>
 #include <net/xfrm.h>
 
+#include "ackvec.h"
 #include "ccid.h"
 #include "dccp.h"
 
@@ -61,27 +62,27 @@ static int __dccp_v4_check_established(struct sock *sk, const __u16 lport,
         const int dif = sk->sk_bound_dev_if;
         INET_ADDR_COOKIE(acookie, saddr, daddr)
         const __u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
-        const int hash = inet_ehashfn(daddr, lport, saddr, inet->dport,
-                                      dccp_hashinfo.ehash_size);
-        struct inet_ehash_bucket *head = &dccp_hashinfo.ehash[hash];
+        unsigned int hash = inet_ehashfn(daddr, lport, saddr, inet->dport);
+        struct inet_ehash_bucket *head = inet_ehash_bucket(&dccp_hashinfo, hash);
         const struct sock *sk2;
         const struct hlist_node *node;
         struct inet_timewait_sock *tw;
 
+        prefetch(head->chain.first);
         write_lock(&head->lock);
 
         /* Check TIME-WAIT sockets first. */
         sk_for_each(sk2, node, &(head + dccp_hashinfo.ehash_size)->chain) {
                 tw = inet_twsk(sk2);
 
-                if (INET_TW_MATCH(sk2, acookie, saddr, daddr, ports, dif))
+                if (INET_TW_MATCH(sk2, hash, acookie, saddr, daddr, ports, dif))
                         goto not_unique;
         }
         tw = NULL;
 
         /* And established part... */
         sk_for_each(sk2, node, &head->chain) {
-                if (INET_MATCH(sk2, acookie, saddr, daddr, ports, dif))
+                if (INET_MATCH(sk2, hash, acookie, saddr, daddr, ports, dif))
                         goto not_unique;
         }
 
@@ -89,7 +90,7 @@ static int __dccp_v4_check_established(struct sock *sk, const __u16 lport,
          * in hash table socket with a funny identity. */
         inet->num = lport;
         inet->sport = htons(lport);
-        sk->sk_hashent = hash;
+        sk->sk_hash = hash;
         BUG_TRAP(sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sock_prot_inc_use(sk->sk_prot);
@@ -246,6 +247,9 @@ static int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr,
 
         dp->dccps_role = DCCP_ROLE_CLIENT;
 
+        if (dccp_service_not_initialized(sk))
+                return -EPROTO;
+
         if (addr_len < sizeof(struct sockaddr_in))
                 return -EINVAL;
 
@@ -661,6 +665,16 @@ static inline u64 dccp_v4_init_sequence(const struct sock *sk,
                                            dccp_hdr(skb)->dccph_sport);
 }
 
+static inline int dccp_bad_service_code(const struct sock *sk,
+                                        const __u32 service)
+{
+        const struct dccp_sock *dp = dccp_sk(sk);
+
+        if (dp->dccps_service == service)
+                return 0;
+        return !dccp_list_has_service(dp->dccps_service_list, service);
+}
+
 int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
         struct inet_request_sock *ireq;
@@ -669,13 +683,22 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         struct dccp_request_sock *dreq;
         const __u32 saddr = skb->nh.iph->saddr;
         const __u32 daddr = skb->nh.iph->daddr;
+        const __u32 service = dccp_hdr_request(skb)->dccph_req_service;
+        struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
+        __u8 reset_code = DCCP_RESET_CODE_TOO_BUSY;
         struct dst_entry *dst = NULL;
 
         /* Never answer to DCCP_PKT_REQUESTs send to broadcast or multicast */
         if (((struct rtable *)skb->dst)->rt_flags &
-            (RTCF_BROADCAST | RTCF_MULTICAST))
+            (RTCF_BROADCAST | RTCF_MULTICAST)) {
+                reset_code = DCCP_RESET_CODE_NO_CONNECTION;
                 goto drop;
+        }
 
+        if (dccp_bad_service_code(sk, service)) {
+                reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE;
+                goto drop;
+        }
         /*
          * TW buckets are converted to open requests without
          * limitations, they conserve resources and peer is
@@ -718,9 +741,9 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
          * dccp_create_openreq_child.
          */
         dreq = dccp_rsk(req);
-        dreq->dreq_isr = DCCP_SKB_CB(skb)->dccpd_seq;
-        dreq->dreq_iss = dccp_v4_init_sequence(sk, skb);
-        dreq->dreq_service = dccp_hdr_request(skb)->dccph_req_service;
+        dreq->dreq_isr     = dcb->dccpd_seq;
+        dreq->dreq_iss     = dccp_v4_init_sequence(sk, skb);
+        dreq->dreq_service = service;
 
         if (dccp_v4_send_response(sk, req, dst))
                 goto drop_and_free;
@@ -735,6 +758,7 @@ drop_and_free:
         __reqsk_free(req);
 drop:
         DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS);
+        dcb->dccpd_reset_code = reset_code;
         return -1;
 }
 
@@ -1005,7 +1029,6 @@ int dccp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
         return 0;
 
 reset:
-        DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
         dccp_v4_ctl_send_reset(skb);
 discard:
         kfree_skb(skb);
@@ -1090,45 +1113,7 @@ int dccp_v4_rcv(struct sk_buff *skb)
                 goto discard_it;
 
         dh = dccp_hdr(skb);
-#if 0
-        /*
-         * Use something like this to simulate some DATA/DATAACK loss to test
-         * dccp_ackpkts_add, you'll get something like this on a session that
-         * sends 10 DATA/DATAACK packets:
-         *
-         * ackpkts_print: 281473596467422 |0,0|3,0|0,0|3,0|0,0|3,0|0,0|3,0|0,1|
-         *
-         * 0, 0 means: DCCP_ACKPKTS_STATE_RECEIVED, RLE == just this packet
-         * 0, 1 means: DCCP_ACKPKTS_STATE_RECEIVED, RLE == two adjacent packets
-         *                                                 with the same state
-         * 3, 0 means: DCCP_ACKPKTS_STATE_NOT_RECEIVED, RLE == just this packet
-         *
-         * So...
-         *
-         * 281473596467422 was received
-         * 281473596467421 was not received
-         * 281473596467420 was received
-         * 281473596467419 was not received
-         * 281473596467418 was received
-         * 281473596467417 was not received
-         * 281473596467416 was received
-         * 281473596467415 was not received
-         * 281473596467414 was received
-         * 281473596467413 was received (this one was the 3way handshake
-         *                               RESPONSE)
-         *
-         */
-        if (dh->dccph_type == DCCP_PKT_DATA ||
-            dh->dccph_type == DCCP_PKT_DATAACK) {
-                static int discard = 0;
 
-                if (discard) {
-                        discard = 0;
-                        goto discard_it;
-                }
-                discard = 1;
-        }
-#endif
         DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(skb);
         DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type;
 
@@ -1242,11 +1227,9 @@ static int dccp_v4_init_sock(struct sock *sk)
         do_gettimeofday(&dp->dccps_epoch);
 
         if (dp->dccps_options.dccpo_send_ack_vector) {
-                dp->dccps_hc_rx_ackpkts =
-                        dccp_ackpkts_alloc(DCCP_MAX_ACK_VECTOR_LEN,
-                                           GFP_KERNEL);
-
-                if (dp->dccps_hc_rx_ackpkts == NULL)
+                dp->dccps_hc_rx_ackvec = dccp_ackvec_alloc(DCCP_MAX_ACKVEC_LEN,
+                                                           GFP_KERNEL);
+                if (dp->dccps_hc_rx_ackvec == NULL)
                         return -ENOMEM;
         }
 
@@ -1258,16 +1241,18 @@ static int dccp_v4_init_sock(struct sock *sk)
          * setsockopt(CCIDs-I-want/accept). -acme
          */
         if (likely(!dccp_ctl_socket_init)) {
-                dp->dccps_hc_rx_ccid = ccid_init(dp->dccps_options.dccpo_ccid,
+                dp->dccps_hc_rx_ccid = ccid_init(dp->dccps_options.dccpo_rx_ccid,
                                                  sk);
-                dp->dccps_hc_tx_ccid = ccid_init(dp->dccps_options.dccpo_ccid,
+                dp->dccps_hc_tx_ccid = ccid_init(dp->dccps_options.dccpo_tx_ccid,
                                                  sk);
                 if (dp->dccps_hc_rx_ccid == NULL ||
                     dp->dccps_hc_tx_ccid == NULL) {
                         ccid_exit(dp->dccps_hc_rx_ccid, sk);
                         ccid_exit(dp->dccps_hc_tx_ccid, sk);
-                        dccp_ackpkts_free(dp->dccps_hc_rx_ackpkts);
-                        dp->dccps_hc_rx_ackpkts = NULL;
+                        if (dp->dccps_options.dccpo_send_ack_vector) {
+                                dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
+                                dp->dccps_hc_rx_ackvec = NULL;
+                        }
                         dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
                         return -ENOMEM;
                 }
@@ -1280,6 +1265,7 @@ static int dccp_v4_init_sock(struct sock *sk)
         sk->sk_write_space = dccp_write_space;
         dp->dccps_mss_cache = 536;
         dp->dccps_role = DCCP_ROLE_UNDEFINED;
+        dp->dccps_service = DCCP_SERVICE_INVALID_VALUE;
 
         return 0;
 }
@@ -1301,10 +1287,17 @@ static int dccp_v4_destroy_sock(struct sock *sk)
         if (inet_csk(sk)->icsk_bind_hash != NULL)
                 inet_put_port(&dccp_hashinfo, sk);
 
+        if (dp->dccps_service_list != NULL) {
+                kfree(dp->dccps_service_list);
+                dp->dccps_service_list = NULL;
+        }
+
         ccid_hc_rx_exit(dp->dccps_hc_rx_ccid, sk);
         ccid_hc_tx_exit(dp->dccps_hc_tx_ccid, sk);
-        dccp_ackpkts_free(dp->dccps_hc_rx_ackpkts);
-        dp->dccps_hc_rx_ackpkts = NULL;
+        if (dp->dccps_options.dccpo_send_ack_vector) {
+                dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
+                dp->dccps_hc_rx_ackvec = NULL;
+        }
         ccid_exit(dp->dccps_hc_rx_ccid, sk);
         ccid_exit(dp->dccps_hc_tx_ccid, sk);
         dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 18461bc04cbe..1393461898bb 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -19,6 +19,7 @@
 #include <net/xfrm.h>
 #include <net/inet_timewait_sock.h>
 
+#include "ackvec.h"
 #include "ccid.h"
 #include "dccp.h"
 
@@ -93,22 +94,24 @@ struct sock *dccp_create_openreq_child(struct sock *sk,
                 struct inet_connection_sock *newicsk = inet_csk(sk);
                 struct dccp_sock *newdp = dccp_sk(newsk);
 
-                newdp->dccps_hc_rx_ackpkts = NULL;
-                newdp->dccps_role = DCCP_ROLE_SERVER;
-                newicsk->icsk_rto = DCCP_TIMEOUT_INIT;
+                newdp->dccps_role          = DCCP_ROLE_SERVER;
+                newdp->dccps_hc_rx_ackvec  = NULL;
+                newdp->dccps_service_list  = NULL;
+                newdp->dccps_service       = dreq->dreq_service;
+                newicsk->icsk_rto          = DCCP_TIMEOUT_INIT;
                 do_gettimeofday(&newdp->dccps_epoch);
 
                 if (newdp->dccps_options.dccpo_send_ack_vector) {
-                        newdp->dccps_hc_rx_ackpkts =
-                                dccp_ackpkts_alloc(DCCP_MAX_ACK_VECTOR_LEN,
-                                                   GFP_ATOMIC);
+                        newdp->dccps_hc_rx_ackvec =
+                                dccp_ackvec_alloc(DCCP_MAX_ACKVEC_LEN,
+                                                  GFP_ATOMIC);
                         /*
                          * XXX: We're using the same CCIDs set on the parent,
                          * i.e. sk_clone copied the master sock and left the
                          * CCID pointers for this child, that is why we do the
                          * __ccid_get calls.
                          */
-                        if (unlikely(newdp->dccps_hc_rx_ackpkts == NULL))
+                        if (unlikely(newdp->dccps_hc_rx_ackvec == NULL))
                                 goto out_free;
                 }
 
@@ -116,7 +119,7 @@ struct sock *dccp_create_openreq_child(struct sock *sk,
                                              newsk) != 0 ||
                              ccid_hc_tx_init(newdp->dccps_hc_tx_ccid,
                                              newsk) != 0)) {
-                        dccp_ackpkts_free(newdp->dccps_hc_rx_ackpkts);
+                        dccp_ackvec_free(newdp->dccps_hc_rx_ackvec);
                         ccid_hc_rx_exit(newdp->dccps_hc_rx_ccid, newsk);
                         ccid_hc_tx_exit(newdp->dccps_hc_tx_ccid, newsk);
 out_free:
diff --git a/net/dccp/options.c b/net/dccp/options.c
index d4c4242d8dd7..0a76426c9aea 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -18,19 +18,15 @@
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 
+#include "ackvec.h"
 #include "ccid.h"
 #include "dccp.h"
 
-static void dccp_ackpkts_check_rcv_ackvector(struct dccp_ackpkts *ap,
-                                             struct sock *sk,
-                                             const u64 ackno,
-                                             const unsigned char len,
-                                             const unsigned char *vector);
-
 /* stores the default values for new connection. may be changed with sysctl */
 static const struct dccp_options dccpo_default_values = {
         .dccpo_sequence_window    = DCCPF_INITIAL_SEQUENCE_WINDOW,
-        .dccpo_ccid               = DCCPF_INITIAL_CCID,
+        .dccpo_rx_ccid            = DCCPF_INITIAL_CCID,
+        .dccpo_tx_ccid            = DCCPF_INITIAL_CCID,
         .dccpo_send_ack_vector    = DCCPF_INITIAL_SEND_ACK_VECTOR,
         .dccpo_send_ndp_count     = DCCPF_INITIAL_SEND_NDP_COUNT,
 };
@@ -113,25 +109,13 @@ int dccp_parse_options(struct sock *sk, struct sk_buff *skb)
                                       opt_recv->dccpor_ndp);
                         break;
                 case DCCPO_ACK_VECTOR_0:
-                        if (len > DCCP_MAX_ACK_VECTOR_LEN)
-                                goto out_invalid_option;
-
+                case DCCPO_ACK_VECTOR_1:
                         if (pkt_type == DCCP_PKT_DATA)
                                 continue;
 
-                        opt_recv->dccpor_ack_vector_len = len;
-                        opt_recv->dccpor_ack_vector_idx = value - options;
-
-                        dccp_pr_debug("%sACK vector 0, len=%d, ack_ackno=%llu\n",
-                                      debug_prefix, len,
-                                      (unsigned long long)
-                                      DCCP_SKB_CB(skb)->dccpd_ack_seq);
-                        dccp_ackvector_print(DCCP_SKB_CB(skb)->dccpd_ack_seq,
-                                             value, len);
-                        dccp_ackpkts_check_rcv_ackvector(dp->dccps_hc_rx_ackpkts,
-                                                         sk,
-                                                 DCCP_SKB_CB(skb)->dccpd_ack_seq,
-                                                         len, value);
+                        if (dp->dccps_options.dccpo_send_ack_vector &&
+                            dccp_ackvec_parse(sk, skb, opt, value, len))
+                                goto out_invalid_option;
                         break;
                 case DCCPO_TIMESTAMP:
                         if (len != 4)
@@ -352,86 +336,6 @@ void dccp_insert_option_elapsed_time(struct sock *sk,
 
 EXPORT_SYMBOL_GPL(dccp_insert_option_elapsed_time);
 
-static void dccp_insert_option_ack_vector(struct sock *sk, struct sk_buff *skb)
-{
-        struct dccp_sock *dp = dccp_sk(sk);
-#ifdef CONFIG_IP_DCCP_DEBUG
-        const char *debug_prefix = dp->dccps_role == DCCP_ROLE_CLIENT ?
-                                        "CLIENT TX opt: " : "server TX opt: ";
-#endif
-        struct dccp_ackpkts *ap = dp->dccps_hc_rx_ackpkts;
-        int len = ap->dccpap_buf_vector_len + 2;
-        struct timeval now;
-        u32 elapsed_time;
-        unsigned char *to, *from;
-
-        dccp_timestamp(sk, &now);
-        elapsed_time = timeval_delta(&now, &ap->dccpap_time) / 10;
-
-        if (elapsed_time != 0)
-                dccp_insert_option_elapsed_time(sk, skb, elapsed_time);
-
-        if (DCCP_SKB_CB(skb)->dccpd_opt_len + len > DCCP_MAX_OPT_LEN) {
-                LIMIT_NETDEBUG(KERN_INFO "DCCP: packet too small to "
-                                         "insert ACK Vector!\n");
-                return;
-        }
-
-        /*
-         * XXX: now we have just one ack vector sent record, so
-         * we have to wait for it to be cleared.
-         *
-         * Of course this is not acceptable, but this is just for
-         * basic testing now.
-         */
-        if (ap->dccpap_ack_seqno != DCCP_MAX_SEQNO + 1)
-                return;
-
-        DCCP_SKB_CB(skb)->dccpd_opt_len += len;
-
-        to    = skb_push(skb, len);
-        *to++ = DCCPO_ACK_VECTOR_0;
-        *to++ = len;
-
-        len  = ap->dccpap_buf_vector_len;
-        from = ap->dccpap_buf + ap->dccpap_buf_head;
-
-        /* Check if buf_head wraps */
-        if (ap->dccpap_buf_head + len > ap->dccpap_buf_len) {
-                const unsigned int tailsize = (ap->dccpap_buf_len -
-                                               ap->dccpap_buf_head);
-
-                memcpy(to, from, tailsize);
-                to   += tailsize;
-                len  -= tailsize;
-                from = ap->dccpap_buf;
-        }
-
-        memcpy(to, from, len);
-        /*
-         *      From draft-ietf-dccp-spec-11.txt:
-         *
-         *      For each acknowledgement it sends, the HC-Receiver will add an
-         *      acknowledgement record.  ack_seqno will equal the HC-Receiver
-         *      sequence number it used for the ack packet; ack_ptr will equal
-         *      buf_head; ack_ackno will equal buf_ackno; and ack_nonce will
-         *      equal buf_nonce.
-         *
-         * This implemention uses just one ack record for now.
-         */
-        ap->dccpap_ack_seqno      = DCCP_SKB_CB(skb)->dccpd_seq;
-        ap->dccpap_ack_ptr        = ap->dccpap_buf_head;
-        ap->dccpap_ack_ackno      = ap->dccpap_buf_ackno;
-        ap->dccpap_ack_nonce      = ap->dccpap_buf_nonce;
-        ap->dccpap_ack_vector_len = ap->dccpap_buf_vector_len;
-
-        dccp_pr_debug("%sACK Vector 0, len=%d, ack_seqno=%llu, "
-                      "ack_ackno=%llu\n",
-                      debug_prefix, ap->dccpap_ack_vector_len,
-                      (unsigned long long) ap->dccpap_ack_seqno,
-                      (unsigned long long) ap->dccpap_ack_ackno);
-}
-
 void dccp_timestamp(const struct sock *sk, struct timeval *tv)
 {
         const struct dccp_sock *dp = dccp_sk(sk);
@@ -528,9 +432,8 @@ void dccp_insert_options(struct sock *sk, struct sk_buff *skb)
 
         if (!dccp_packet_without_ack(skb)) {
                 if (dp->dccps_options.dccpo_send_ack_vector &&
-                    (dp->dccps_hc_rx_ackpkts->dccpap_buf_ackno !=
-                     DCCP_MAX_SEQNO + 1))
-                        dccp_insert_option_ack_vector(sk, skb);
+                    dccp_ackvec_pending(dp->dccps_hc_rx_ackvec))
+                        dccp_insert_option_ackvec(sk, skb);
                 if (dp->dccps_timestamp_echo != 0)
                         dccp_insert_option_timestamp_echo(sk, skb);
         }
@@ -557,331 +460,3 @@ void dccp_insert_options(struct sock *sk, struct sk_buff *skb)
                 }
         }
 }
-
-struct dccp_ackpkts *dccp_ackpkts_alloc(const unsigned int len,
-                                        const unsigned int __nocast priority)
-{
-        struct dccp_ackpkts *ap = kmalloc(sizeof(*ap) + len, priority);
-
-        if (ap != NULL) {
-#ifdef CONFIG_IP_DCCP_DEBUG
-                memset(ap->dccpap_buf, 0xFF, len);
-#endif
-                ap->dccpap_buf_len   = len;
-                ap->dccpap_buf_head  =
-                        ap->dccpap_buf_tail =
-                                ap->dccpap_buf_len - 1;
-                ap->dccpap_buf_ackno =
-                        ap->dccpap_ack_ackno =
-                                ap->dccpap_ack_seqno = DCCP_MAX_SEQNO + 1;
-                ap->dccpap_buf_nonce = ap->dccpap_buf_nonce = 0;
-                ap->dccpap_ack_ptr   = 0;
-                ap->dccpap_time.tv_sec = 0;
-                ap->dccpap_time.tv_usec = 0;
-                ap->dccpap_buf_vector_len = ap->dccpap_ack_vector_len = 0;
-        }
-
-        return ap;
-}
-
-void dccp_ackpkts_free(struct dccp_ackpkts *ap)
-{
-        if (ap != NULL) {
-#ifdef CONFIG_IP_DCCP_DEBUG
-                memset(ap, 0xFF, sizeof(*ap) + ap->dccpap_buf_len);
-#endif
-                kfree(ap);
-        }
-}
-
-static inline u8 dccp_ackpkts_state(const struct dccp_ackpkts *ap,
-                                    const unsigned int index)
-{
-        return ap->dccpap_buf[index] & DCCP_ACKPKTS_STATE_MASK;
-}
-
-static inline u8 dccp_ackpkts_len(const struct dccp_ackpkts *ap,
-                                  const unsigned int index)
-{
-        return ap->dccpap_buf[index] & DCCP_ACKPKTS_LEN_MASK;
-}
-
-/*
- * If several packets are missing, the HC-Receiver may prefer to enter multiple
- * bytes with run length 0, rather than a single byte with a larger run length;
- * this simplifies table updates if one of the missing packets arrives.
- */
-static inline int dccp_ackpkts_set_buf_head_state(struct dccp_ackpkts *ap,
-                                                  const unsigned int packets,
-                                                  const unsigned char state)
-{
-        unsigned int gap;
-        signed long new_head;
-
-        if (ap->dccpap_buf_vector_len + packets > ap->dccpap_buf_len)
-                return -ENOBUFS;
-
-        gap      = packets - 1;
-        new_head = ap->dccpap_buf_head - packets;
-
-        if (new_head < 0) {
-                if (gap > 0) {
-                        memset(ap->dccpap_buf, DCCP_ACKPKTS_STATE_NOT_RECEIVED,
-                               gap + new_head + 1);
-                        gap = -new_head;
-                }
-                new_head += ap->dccpap_buf_len;
-        } 
-
-        ap->dccpap_buf_head = new_head;
-
-        if (gap > 0)
-                memset(ap->dccpap_buf + ap->dccpap_buf_head + 1,
-                       DCCP_ACKPKTS_STATE_NOT_RECEIVED, gap);
-
-        ap->dccpap_buf[ap->dccpap_buf_head] = state;
-        ap->dccpap_buf_vector_len += packets;
-        return 0;
-}
-
-/*
- * Implements the draft-ietf-dccp-spec-11.txt Appendix A
- */
-int dccp_ackpkts_add(struct dccp_ackpkts *ap, const struct sock *sk,
-                     u64 ackno, u8 state)
-{
-        /*
-         * Check at the right places if the buffer is full, if it is, tell the
-         * caller to start dropping packets till the HC-Sender acks our ACK
-         * vectors, when we will free up space in dccpap_buf.
-         *
-         * We may well decide to do buffer compression, etc, but for now lets
-         * just drop.
-         *
-         * From Appendix A:
-         *
-         *      Of course, the circular buffer may overflow, either when the
-         *      HC-Sender is sending data at a very high rate, when the
-         *      HC-Receiver's acknowledgements are not reaching the HC-Sender,
-         *      or when the HC-Sender is forgetting to acknowledge those acks
-         *      (so the HC-Receiver is unable to clean up old state). In this
-         *      case, the HC-Receiver should either compress the buffer (by
-         *      increasing run lengths when possible), transfer its state to
-         *      a larger buffer, or, as a last resort, drop all received
-         *      packets, without processing them whatsoever, until its buffer
-         *      shrinks again.
-         */
-
-        /* See if this is the first ackno being inserted */
-        if (ap->dccpap_buf_vector_len == 0) {
-                ap->dccpap_buf[ap->dccpap_buf_head] = state;
-                ap->dccpap_buf_vector_len = 1;
-        } else if (after48(ackno, ap->dccpap_buf_ackno)) {
-                const u64 delta = dccp_delta_seqno(ap->dccpap_buf_ackno,
-                                                   ackno);
-
-                /*
-                 * Look if the state of this packet is the same as the
-                 * previous ackno and if so if we can bump the head len.
-                 */
-                if (delta == 1 &&
-                    dccp_ackpkts_state(ap, ap->dccpap_buf_head) == state &&
-                    (dccp_ackpkts_len(ap, ap->dccpap_buf_head) <
-                     DCCP_ACKPKTS_LEN_MASK))
-                        ap->dccpap_buf[ap->dccpap_buf_head]++;
-                else if (dccp_ackpkts_set_buf_head_state(ap, delta, state))
-                        return -ENOBUFS;
-        } else {
-                /*
-                 * A.1.2.  Old Packets
-                 *
-                 *      When a packet with Sequence Number S arrives, and
-                 *      S <= buf_ackno, the HC-Receiver will scan the table
-                 *      for the byte corresponding to S. (Indexing structures
-                 *      could reduce the complexity of this scan.)
-                 */
-                u64 delta = dccp_delta_seqno(ackno, ap->dccpap_buf_ackno);
-                unsigned int index = ap->dccpap_buf_head;
-
-                while (1) {
-                        const u8 len = dccp_ackpkts_len(ap, index);
-                        const u8 state = dccp_ackpkts_state(ap, index);
-                        /*
-                         * valid packets not yet in dccpap_buf have a reserved
-                         * entry, with a len equal to 0.
-                         */
-                        if (state == DCCP_ACKPKTS_STATE_NOT_RECEIVED &&
-                            len == 0 && delta == 0) { /* Found our
-                                                         reserved seat! */
-                                dccp_pr_debug("Found %llu reserved seat!\n",
-                                              (unsigned long long) ackno);
-                                ap->dccpap_buf[index] = state;
-                                goto out;
-                        }
-                        /* len == 0 means one packet */
-                        if (delta < len + 1)
-                                goto out_duplicate;
-
-                        delta -= len + 1;
-                        if (++index == ap->dccpap_buf_len)
-                                index = 0;
-                }
-        }
-
-        ap->dccpap_buf_ackno = ackno;
-        dccp_timestamp(sk, &ap->dccpap_time);
-out:
-        dccp_pr_debug("");
-        dccp_ackpkts_print(ap);
-        return 0;
-
-out_duplicate:
-        /* Duplicate packet */
-        dccp_pr_debug("Received a dup or already considered lost "
-                      "packet: %llu\n", (unsigned long long) ackno);
-        return -EILSEQ;
-}
-
-#ifdef CONFIG_IP_DCCP_DEBUG
-void dccp_ackvector_print(const u64 ackno, const unsigned char *vector,
-                          int len)
-{
-        if (!dccp_debug)
-                return;
-
-        printk("ACK vector len=%d, ackno=%llu |", len,
-               (unsigned long long) ackno);
-
-        while (len--) {
-                const u8 state = (*vector & DCCP_ACKPKTS_STATE_MASK) >> 6;
-                const u8 rl = (*vector & DCCP_ACKPKTS_LEN_MASK);
-
-                printk("%d,%d|", state, rl);
-                ++vector;
-        }
-
-        printk("\n");
-}
-
-void dccp_ackpkts_print(const struct dccp_ackpkts *ap)
-{
-        dccp_ackvector_print(ap->dccpap_buf_ackno,
-                             ap->dccpap_buf + ap->dccpap_buf_head,
-                             ap->dccpap_buf_vector_len);
-}
-#endif
-
-static void dccp_ackpkts_trow_away_ack_record(struct dccp_ackpkts *ap)
-{
-        /*
-         * As we're keeping track of the ack vector size
-         * (dccpap_buf_vector_len) and the sent ack vector size
-         * (dccpap_ack_vector_len) we don't need dccpap_buf_tail at all, but
-         * keep this code here as in the future we'll implement a vector of
-         * ack records, as suggested in draft-ietf-dccp-spec-11.txt
-         * Appendix A. -acme
-         */
-#if 0
-        ap->dccpap_buf_tail = ap->dccpap_ack_ptr + 1;
-        if (ap->dccpap_buf_tail >= ap->dccpap_buf_len)
-                ap->dccpap_buf_tail -= ap->dccpap_buf_len;
-#endif
-        ap->dccpap_buf_vector_len -= ap->dccpap_ack_vector_len;
-}
-
-void dccp_ackpkts_check_rcv_ackno(struct dccp_ackpkts *ap, struct sock *sk,
-                                 u64 ackno)
-{
-        /* Check if we actually sent an ACK vector */
-        if (ap->dccpap_ack_seqno == DCCP_MAX_SEQNO + 1)
-                return;
-
-        if (ackno == ap->dccpap_ack_seqno) {
-#ifdef CONFIG_IP_DCCP_DEBUG
-                struct dccp_sock *dp = dccp_sk(sk);
-                const char *debug_prefix = dp->dccps_role == DCCP_ROLE_CLIENT ?
-                                        "CLIENT rx ack: " : "server rx ack: ";
-#endif
-                dccp_pr_debug("%sACK packet 0, len=%d, ack_seqno=%llu, "
-                              "ack_ackno=%llu, ACKED!\n",
-                              debug_prefix, 1,
-                              (unsigned long long) ap->dccpap_ack_seqno,
-                              (unsigned long long) ap->dccpap_ack_ackno);
-                dccp_ackpkts_trow_away_ack_record(ap);
-                ap->dccpap_ack_seqno = DCCP_MAX_SEQNO + 1;
-        }
-}
-
-static void dccp_ackpkts_check_rcv_ackvector(struct dccp_ackpkts *ap,
-                                             struct sock *sk, u64 ackno,
-                                             const unsigned char len,
-                                             const unsigned char *vector)
-{
-        unsigned char i;
-
-        /* Check if we actually sent an ACK vector */
-        if (ap->dccpap_ack_seqno == DCCP_MAX_SEQNO + 1)
-                return;
-        /*
-         * We're in the receiver half connection, so if the received an ACK
-         * vector ackno (e.g. 50) before dccpap_ack_seqno (e.g. 52), we're
-         * not interested.
-         *
-         * Extra explanation with example:
-         * 
-         * if we received an ACK vector with ackno 50, it can only be acking
-         * 50, 49, 48, etc, not 52 (the seqno for the ACK vector we sent).
-         */
-        /* dccp_pr_debug("is %llu < %llu? ", ackno, ap->dccpap_ack_seqno); */
-        if (before48(ackno, ap->dccpap_ack_seqno)) {
-                /* dccp_pr_debug_cat("yes\n"); */
-                return;
-        }
-        /* dccp_pr_debug_cat("no\n"); */
-
-        i = len;
-        while (i--) {
-                const u8 rl = (*vector & DCCP_ACKPKTS_LEN_MASK);
-                u64 ackno_end_rl;
-
-                dccp_set_seqno(&ackno_end_rl, ackno - rl);
-
-                /*
-                 * dccp_pr_debug("is %llu <= %llu <= %llu? ", ackno_end_rl,
-                 * ap->dccpap_ack_seqno, ackno);
-                 */
-                if (between48(ap->dccpap_ack_seqno, ackno_end_rl, ackno)) {
-                        const u8 state = (*vector &
-                                          DCCP_ACKPKTS_STATE_MASK) >> 6;
-                        /* dccp_pr_debug_cat("yes\n"); */
-
-                        if (state != DCCP_ACKPKTS_STATE_NOT_RECEIVED) {
-#ifdef CONFIG_IP_DCCP_DEBUG
-                                struct dccp_sock *dp = dccp_sk(sk);
-                                const char *debug_prefix =
-                                        dp->dccps_role == DCCP_ROLE_CLIENT ?
-                                        "CLIENT rx ack: " : "server rx ack: ";
-#endif
-                                dccp_pr_debug("%sACK vector 0, len=%d, "
-                                              "ack_seqno=%llu, ack_ackno=%llu, "
-                                              "ACKED!\n",
-                                              debug_prefix, len,
-                                              (unsigned long long)
-                                              ap->dccpap_ack_seqno,
-                                              (unsigned long long)
-                                              ap->dccpap_ack_ackno);
-                                dccp_ackpkts_trow_away_ack_record(ap);
-                        }
-                        /*
-                         * If dccpap_ack_seqno was not received, no problem
-                         * we'll send another ACK vector.
-                         */
-                        ap->dccpap_ack_seqno = DCCP_MAX_SEQNO + 1;
-                        break;
-                }
-                /* dccp_pr_debug_cat("no\n"); */
-
-                dccp_set_seqno(&ackno, ackno_end_rl - 1);
-                ++vector;
-        }
-}
diff --git a/net/dccp/output.c b/net/dccp/output.c
index ea6d0e91e511..4786bdcddcc9 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -16,6 +16,7 @@
 
 #include <net/sock.h>
 
+#include "ackvec.h"
 #include "ccid.h"
 #include "dccp.h"
 
@@ -85,7 +86,7 @@ int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 switch (dcb->dccpd_type) {
                 case DCCP_PKT_REQUEST:
                         dccp_hdr_request(skb)->dccph_req_service =
-                                                        dcb->dccpd_service;
+                                                        dp->dccps_service;
                         break;
                 case DCCP_PKT_RESET:
                         dccp_hdr_reset(skb)->dccph_reset_code =
@@ -225,7 +226,6 @@ int dccp_write_xmit(struct sock *sk, struct sk_buff *skb, long *timeo)
                 err = dccp_wait_for_ccid(sk, skb, timeo);
 
         if (err == 0) {
-                const struct dccp_ackpkts *ap = dp->dccps_hc_rx_ackpkts;
                 struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
                 const int len = skb->len;
 
@@ -236,15 +236,7 @@ int dccp_write_xmit(struct sock *sk, struct sk_buff *skb, long *timeo)
                                                   inet_csk(sk)->icsk_rto,
                                                   DCCP_RTO_MAX);
                         dcb->dccpd_type = DCCP_PKT_DATAACK;
-                        /*
-                         * FIXME: we really should have a
-                         * dccps_ack_pending or use icsk.
-                         */
-                } else if (inet_csk_ack_scheduled(sk) ||
-                           dp->dccps_timestamp_echo != 0 ||
-                           (dp->dccps_options.dccpo_send_ack_vector &&
-                            ap->dccpap_buf_ackno != DCCP_MAX_SEQNO + 1 &&
-                            ap->dccpap_ack_seqno == DCCP_MAX_SEQNO + 1))
+                } else if (dccp_ack_pending(sk))
                         dcb->dccpd_type = DCCP_PKT_DATAACK;
                 else
                         dcb->dccpd_type = DCCP_PKT_DATA;
@@ -270,6 +262,7 @@ struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
                                    struct request_sock *req)
 {
         struct dccp_hdr *dh;
+        struct dccp_request_sock *dreq;
         const int dccp_header_size = sizeof(struct dccp_hdr) +
                                      sizeof(struct dccp_hdr_ext) +
                                      sizeof(struct dccp_hdr_response);
@@ -285,8 +278,9 @@ struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
         skb->dst = dst_clone(dst);
         skb->csum = 0;
 
+        dreq = dccp_rsk(req);
         DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_RESPONSE;
-        DCCP_SKB_CB(skb)->dccpd_seq  = dccp_rsk(req)->dreq_iss;
+        DCCP_SKB_CB(skb)->dccpd_seq  = dreq->dreq_iss;
         dccp_insert_options(sk, skb);
 
         skb->h.raw = skb_push(skb, dccp_header_size);
@@ -300,8 +294,9 @@ struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
                            DCCP_SKB_CB(skb)->dccpd_opt_len) / 4;
         dh->dccph_type  = DCCP_PKT_RESPONSE;
         dh->dccph_x     = 1;
-        dccp_hdr_set_seq(dh, dccp_rsk(req)->dreq_iss);
-        dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), dccp_rsk(req)->dreq_isr);
+        dccp_hdr_set_seq(dh, dreq->dreq_iss);
+        dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), dreq->dreq_isr);
+        dccp_hdr_response(skb)->dccph_resp_service = dreq->dreq_service;
 
         dh->dccph_checksum = dccp_v4_checksum(skb, inet_rsk(req)->loc_addr,
                                               inet_rsk(req)->rmt_addr);
@@ -397,9 +392,6 @@ int dccp_connect(struct sock *sk)
         skb_reserve(skb, MAX_DCCP_HEADER);
 
         DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_REQUEST;
-        /* FIXME: set service to something meaningful, coming
-         * from userspace*/
-        DCCP_SKB_CB(skb)->dccpd_service = 0;
         skb->csum = 0;
         skb_set_owner_w(skb, sk);
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 18a0e69c9dc7..a1cfd0e9e3bc 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -94,7 +94,15 @@ EXPORT_SYMBOL_GPL(dccp_state_name);
 
 static inline int dccp_listen_start(struct sock *sk)
 {
-        dccp_sk(sk)->dccps_role = DCCP_ROLE_LISTEN;
+        struct dccp_sock *dp = dccp_sk(sk);
+
+        dp->dccps_role = DCCP_ROLE_LISTEN;
+        /*
+         * Apps need to use setsockopt(DCCP_SOCKOPT_SERVICE)
+         * before calling listen()
+         */
+        if (dccp_service_not_initialized(sk))
+                return -EPROTO;
         return inet_csk_listen_start(sk, TCP_SYNQ_HSIZE);
 }
 
@@ -202,6 +210,42 @@ int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg)
         return -ENOIOCTLCMD;
 }
 
+static int dccp_setsockopt_service(struct sock *sk, const u32 service,
+                                   char __user *optval, int optlen)
+{
+        struct dccp_sock *dp = dccp_sk(sk);
+        struct dccp_service_list *sl = NULL;
+
+        if (service == DCCP_SERVICE_INVALID_VALUE || 
+            optlen > DCCP_SERVICE_LIST_MAX_LEN * sizeof(u32))
+                return -EINVAL;
+
+        if (optlen > sizeof(service)) {
+                sl = kmalloc(optlen, GFP_KERNEL);
+                if (sl == NULL)
+                        return -ENOMEM;
+
+                sl->dccpsl_nr = optlen / sizeof(u32) - 1;
+                if (copy_from_user(sl->dccpsl_list,
+                                   optval + sizeof(service),
+                                   optlen - sizeof(service)) ||
+                    dccp_list_has_service(sl, DCCP_SERVICE_INVALID_VALUE)) {
+                        kfree(sl);
+                        return -EFAULT;
+                }
+        }
+
+        lock_sock(sk);
+        dp->dccps_service = service;
+
+        if (dp->dccps_service_list != NULL)
+                kfree(dp->dccps_service_list);
+
+        dp->dccps_service_list = sl;
+        release_sock(sk);
+        return 0;
+}
+
 int dccp_setsockopt(struct sock *sk, int level, int optname,
                     char __user *optval, int optlen)
 {
@@ -218,8 +262,10 @@ int dccp_setsockopt(struct sock *sk, int level, int optname,
         if (get_user(val, (int __user *)optval))
                 return -EFAULT;
 
-        lock_sock(sk);
+        if (optname == DCCP_SOCKOPT_SERVICE)
+                return dccp_setsockopt_service(sk, val, optval, optlen);
 
+        lock_sock(sk);
         dp = dccp_sk(sk);
         err = 0;
 
@@ -236,6 +282,37 @@ int dccp_setsockopt(struct sock *sk, int level, int optname,
         return err;
 }
 
+static int dccp_getsockopt_service(struct sock *sk, int len,
+                                   u32 __user *optval,
+                                   int __user *optlen)
+{
+        const struct dccp_sock *dp = dccp_sk(sk);
+        const struct dccp_service_list *sl;
+        int err = -ENOENT, slen = 0, total_len = sizeof(u32);
+
+        lock_sock(sk);
+        if (dccp_service_not_initialized(sk))
+                goto out;
+
+        if ((sl = dp->dccps_service_list) != NULL) {
+                slen = sl->dccpsl_nr * sizeof(u32);
+                total_len += slen;
+        }
+
+        err = -EINVAL;
+        if (total_len > len)
+                goto out;
+
+        err = 0;
+        if (put_user(total_len, optlen) ||
+            put_user(dp->dccps_service, optval) ||
+            (sl != NULL && copy_to_user(optval + 1, sl->dccpsl_list, slen)))
+                err = -EFAULT;
+out:
+        release_sock(sk);
+        return err;
+}
+
 int dccp_getsockopt(struct sock *sk, int level, int optname,
                     char __user *optval, int __user *optlen)
 {
@@ -248,8 +325,7 @@ int dccp_getsockopt(struct sock *sk, int level, int optname,
         if (get_user(len, optlen))
                 return -EFAULT;
 
-        len = min_t(unsigned int, len, sizeof(int));
-        if (len < 0)
+        if (len < sizeof(int))
                 return -EINVAL;
 
         dp = dccp_sk(sk);
@@ -257,7 +333,17 @@ int dccp_getsockopt(struct sock *sk, int level, int optname,
         switch (optname) {
         case DCCP_SOCKOPT_PACKET_SIZE:
                 val = dp->dccps_packet_size;
+                len = sizeof(dp->dccps_packet_size);
                 break;
+        case DCCP_SOCKOPT_SERVICE:
+                return dccp_getsockopt_service(sk, len,
+                                               (u32 __user *)optval, optlen);
+        case 128 ... 191:
+                return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
+                                             len, (u32 __user *)optval, optlen);
+        case 192 ... 255:
+                return ccid_hc_tx_getsockopt(dp->dccps_hc_tx_ccid, sk, optname,
+                                             len, (u32 __user *)optval, optlen);
         default:
                 return -ENOPROTOOPT;
         }
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 4a62093eb343..34fdac51df96 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -406,7 +406,7 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                 unsigned long network = 0;
 
                 rcu_read_lock();
-                idev = __in_dev_get(dev);
+                idev = __in_dev_get_rcu(dev);
                 if (idev) {
                         if (idev->ifa_list)
                                 network = ntohl(idev->ifa_list->ifa_address) & 
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 87a052a9a84f..68a5ca866442 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -146,6 +146,19 @@ int eth_rebuild_header(struct sk_buff *skb)
         return 0;
 }
 
+static inline unsigned int compare_eth_addr(const unsigned char *__a, const unsigned char *__b)
+{
+        const unsigned short *dest = (unsigned short *) __a;
+        const unsigned short *devaddr = (unsigned short *) __b;
+        unsigned int res;
+
+        BUILD_BUG_ON(ETH_ALEN != 6);
+        res = ((dest[0] ^ devaddr[0]) |
+               (dest[1] ^ devaddr[1]) |
+               (dest[2] ^ devaddr[2])) != 0;
+
+        return res;
+}
 
 /*
  *      Determine the packet's protocol ID. The rule here is that we 
@@ -158,16 +171,15 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
         struct ethhdr *eth;
         unsigned char *rawp;
         
-        skb->mac.raw=skb->data;
+        skb->mac.raw = skb->data;
         skb_pull(skb,ETH_HLEN);
         eth = eth_hdr(skb);
         
-        if(*eth->h_dest&1)
-        {
-                if(memcmp(eth->h_dest,dev->broadcast, ETH_ALEN)==0)
-                        skb->pkt_type=PACKET_BROADCAST;
+        if (*eth->h_dest&1) {
+                if (!compare_eth_addr(eth->h_dest, dev->broadcast))
+                        skb->pkt_type = PACKET_BROADCAST;
                 else
-                        skb->pkt_type=PACKET_MULTICAST;
+                        skb->pkt_type = PACKET_MULTICAST;
         }
         
         /*
@@ -178,10 +190,9 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
          *      seems to set IFF_PROMISC.
          */
          
-        else if(1 /*dev->flags&IFF_PROMISC*/)
-        {
-                if(memcmp(eth->h_dest,dev->dev_addr, ETH_ALEN))
-                        skb->pkt_type=PACKET_OTHERHOST;
+        else if(1 /*dev->flags&IFF_PROMISC*/) {
+                if (unlikely(compare_eth_addr(eth->h_dest, dev->dev_addr)))
+                        skb->pkt_type = PACKET_OTHERHOST;
         }
         
         if (ntohs(eth->h_proto) >= 1536)
diff --git a/net/ieee80211/ieee80211_module.c b/net/ieee80211/ieee80211_module.c
index 03a47343ddc7..6059e9e37123 100644
--- a/net/ieee80211/ieee80211_module.c
+++ b/net/ieee80211/ieee80211_module.c
@@ -230,7 +230,7 @@ static int __init ieee80211_init(void)
         struct proc_dir_entry *e;
 
         ieee80211_debug_level = debug;
-        ieee80211_proc = create_proc_entry(DRV_NAME, S_IFDIR, proc_net);
+        ieee80211_proc = proc_mkdir(DRV_NAME, proc_net);
         if (ieee80211_proc == NULL) {
                 IEEE80211_ERROR("Unable to create " DRV_NAME
                                 " proc directory\n");
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 8bf312bdea13..b425748f02d7 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -241,7 +241,7 @@ static int arp_constructor(struct neighbour *neigh)
         neigh->type = inet_addr_type(addr);
 
         rcu_read_lock();
-        in_dev = rcu_dereference(__in_dev_get(dev));
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev == NULL) {
                 rcu_read_unlock();
                 return -EINVAL;
@@ -697,12 +697,6 @@ void arp_send(int type, int ptype, u32 dest_ip,
         arp_xmit(skb);
 }
 
-static void parp_redo(struct sk_buff *skb)
-{
-        nf_reset(skb);
-        arp_rcv(skb, skb->dev, NULL, skb->dev);
-}
-
 /*
  *      Process an arp request.
  */
@@ -922,6 +916,11 @@ out:
         return 0;
 }
 
+static void parp_redo(struct sk_buff *skb)
+{
+        arp_process(skb);
+}
+
 
 /*
  *      Receive an arp request from the device layer.
@@ -990,8 +989,8 @@ static int arp_req_set(struct arpreq *r, struct net_device * dev)
                         ipv4_devconf.proxy_arp = 1;
                         return 0;
                 }
-                if (__in_dev_get(dev)) {
-                        __in_dev_get(dev)->cnf.proxy_arp = 1;
+                if (__in_dev_get_rtnl(dev)) {
+                        __in_dev_get_rtnl(dev)->cnf.proxy_arp = 1;
                         return 0;
                 }
                 return -ENXIO;
@@ -1096,8 +1095,8 @@ static int arp_req_delete(struct arpreq *r, struct net_device * dev)
                                 ipv4_devconf.proxy_arp = 0;
                                 return 0;
                         }
-                        if (__in_dev_get(dev)) {
-                                __in_dev_get(dev)->cnf.proxy_arp = 0;
+                        if (__in_dev_get_rtnl(dev)) {
+                                __in_dev_get_rtnl(dev)->cnf.proxy_arp = 0;
                                 return 0;
                         }
                         return -ENXIO;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index ba2895ae8151..74f2207e131a 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -351,7 +351,7 @@ static int inet_insert_ifa(struct in_ifaddr *ifa)
 
 static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
 {
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
         ASSERT_RTNL();
 
@@ -449,7 +449,7 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
                 goto out;
 
         rc = -ENOBUFS;
-        if ((in_dev = __in_dev_get(dev)) == NULL) {
+        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL) {
                 in_dev = inetdev_init(dev);
                 if (!in_dev)
                         goto out;
@@ -584,7 +584,7 @@ int devinet_ioctl(unsigned int cmd, void __user *arg)
         if (colon)
                 *colon = ':';
 
-        if ((in_dev = __in_dev_get(dev)) != NULL) {
+        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
                 if (tryaddrmatch) {
                         /* Matthias Andree */
                         /* compare label and address (4.4BSD style) */
@@ -748,7 +748,7 @@ rarok:
 
 static int inet_gifconf(struct net_device *dev, char __user *buf, int len)
 {
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
         struct in_ifaddr *ifa;
         struct ifreq ifr;
         int done = 0;
@@ -791,7 +791,7 @@ u32 inet_select_addr(const struct net_device *dev, u32 dst, int scope)
         struct in_device *in_dev;
 
         rcu_read_lock();
-        in_dev = __in_dev_get(dev);
+        in_dev = __in_dev_get_rcu(dev);
         if (!in_dev)
                 goto no_in_dev;
 
@@ -818,7 +818,7 @@ no_in_dev:
         read_lock(&dev_base_lock);
         rcu_read_lock();
         for (dev = dev_base; dev; dev = dev->next) {
-                if ((in_dev = __in_dev_get(dev)) == NULL)
+                if ((in_dev = __in_dev_get_rcu(dev)) == NULL)
                         continue;
 
                 for_primary_ifa(in_dev) {
@@ -887,7 +887,7 @@ u32 inet_confirm_addr(const struct net_device *dev, u32 dst, u32 local, int scop
 
         if (dev) {
                 rcu_read_lock();
-                if ((in_dev = __in_dev_get(dev)))
+                if ((in_dev = __in_dev_get_rcu(dev)))
                         addr = confirm_addr_indev(in_dev, dst, local, scope);
                 rcu_read_unlock();
 
@@ -897,7 +897,7 @@ u32 inet_confirm_addr(const struct net_device *dev, u32 dst, u32 local, int scop
         read_lock(&dev_base_lock);
         rcu_read_lock();
         for (dev = dev_base; dev; dev = dev->next) {
-                if ((in_dev = __in_dev_get(dev))) {
+                if ((in_dev = __in_dev_get_rcu(dev))) {
                         addr = confirm_addr_indev(in_dev, dst, local, scope);
                         if (addr)
                                 break;
@@ -957,7 +957,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                          void *ptr)
 {
         struct net_device *dev = ptr;
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
         ASSERT_RTNL();
 
@@ -1078,7 +1078,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                 if (idx > s_idx)
                         s_ip_idx = 0;
                 rcu_read_lock();
-                if ((in_dev = __in_dev_get(dev)) == NULL) {
+                if ((in_dev = __in_dev_get_rcu(dev)) == NULL) {
                         rcu_read_unlock();
                         continue;
                 }
@@ -1149,7 +1149,7 @@ void inet_forward_change(void)
         for (dev = dev_base; dev; dev = dev->next) {
                 struct in_device *in_dev;
                 rcu_read_lock();
-                in_dev = __in_dev_get(dev);
+                in_dev = __in_dev_get_rcu(dev);
                 if (in_dev)
                         in_dev->cnf.forwarding = on;
                 rcu_read_unlock();
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 4e1379f71269..e61bc7177eb1 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -173,7 +173,7 @@ int fib_validate_source(u32 src, u32 dst, u8 tos, int oif,
 
         no_addr = rpf = 0;
         rcu_read_lock();
-        in_dev = __in_dev_get(dev);
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev) {
                 no_addr = in_dev->ifa_list == NULL;
                 rpf = IN_DEV_RPFILTER(in_dev);
@@ -607,7 +607,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
 static int fib_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
         struct net_device *dev = ptr;
-        struct in_device *in_dev = __in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
         if (event == NETDEV_UNREGISTER) {
                 fib_disable_ip(dev, 2);
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index d41219e8037c..186f20c4a45e 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1087,7 +1087,7 @@ fib_convert_rtentry(int cmd, struct nlmsghdr *nl, struct rtmsg *rtm,
                 rta->rta_oif = &dev->ifindex;
                 if (colon) {
                         struct in_ifaddr *ifa;
-                        struct in_device *in_dev = __in_dev_get(dev);
+                        struct in_device *in_dev = __in_dev_get_rtnl(dev);
                         if (!in_dev)
                                 return -ENODEV;
                         *colon = ':';
@@ -1268,7 +1268,7 @@ int fib_sync_up(struct net_device *dev)
                         }
                         if (nh->nh_dev == NULL || !(nh->nh_dev->flags&IFF_UP))
                                 continue;
-                        if (nh->nh_dev != dev || __in_dev_get(dev) == NULL)
+                        if (nh->nh_dev != dev || !__in_dev_get_rtnl(dev))
                                 continue;
                         alive++;
                         spin_lock_bh(&fib_multipath_lock);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 1b63b4824164..50c0519cd70d 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -43,7 +43,7 @@
  *              2 of the License, or (at your option) any later version.
  */
 
-#define VERSION "0.403"
+#define VERSION "0.404"
 
 #include <linux/config.h>
 #include <asm/uaccess.h>
@@ -224,7 +224,7 @@ static inline int tkey_mismatch(t_key a, int offset, t_key b)
   Consider a node 'n' and its parent 'tp'.
 
   If n is a leaf, every bit in its key is significant. Its presence is 
-  necessitaded by path compression, since during a tree traversal (when 
+  necessitated by path compression, since during a tree traversal (when 
   searching for a leaf - unless we are doing an insertion) we will completely 
   ignore all skipped bits we encounter. Thus we need to verify, at the end of 
   a potentially successful search, that we have indeed been walking the 
@@ -836,11 +836,12 @@ static void trie_init(struct trie *t)
 #endif
 }
 
-/* readside most use rcu_read_lock currently dump routines
+/* readside must use rcu_read_lock currently dump routines
  via get_fa_head and dump */
 
-static struct leaf_info *find_leaf_info(struct hlist_head *head, int plen)
+static struct leaf_info *find_leaf_info(struct leaf *l, int plen)
 {
+        struct hlist_head *head = &l->list;
         struct hlist_node *node;
         struct leaf_info *li;
 
@@ -853,7 +854,7 @@ static struct leaf_info *find_leaf_info(struct hlist_head *head, int plen)
 
 static inline struct list_head * get_fa_head(struct leaf *l, int plen)
 {
-        struct leaf_info *li = find_leaf_info(&l->list, plen);
+        struct leaf_info *li = find_leaf_info(l, plen);
 
         if (!li)
                 return NULL;
@@ -1085,7 +1086,7 @@ fib_insert_node(struct trie *t, int *err, u32 key, int plen)
         }
 
         if (tp && tp->pos + tp->bits > 32)
-                printk("ERROR tp=%p pos=%d, bits=%d, key=%0x plen=%d\n",
+                printk(KERN_WARNING "fib_trie tp=%p pos=%d, bits=%d, key=%0x plen=%d\n",
                        tp, tp->pos, tp->bits, key, plen);
 
         /* Rebalance the trie */
@@ -1248,7 +1249,7 @@ err:
 }
 
 
-/* should be clalled with rcu_read_lock */
+/* should be called with rcu_read_lock */
 static inline int check_leaf(struct trie *t, struct leaf *l,
                              t_key key, int *plen, const struct flowi *flp,
                              struct fib_result *res)
@@ -1590,7 +1591,7 @@ fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
         rtmsg_fib(RTM_DELROUTE, htonl(key), fa, plen, tb->tb_id, nlhdr, req);
 
         l = fib_find_node(t, key);
-        li = find_leaf_info(&l->list, plen);
+        li = find_leaf_info(l, plen);
 
         list_del_rcu(&fa->fa_list);
 
@@ -1714,7 +1715,6 @@ static int fn_trie_flush(struct fib_table *tb)
 
         t->revision++;
 
-        rcu_read_lock();
         for (h = 0; (l = nextleaf(t, l)) != NULL; h++) {
                 found += trie_flush_leaf(t, l);
 
@@ -1722,7 +1722,6 @@ static int fn_trie_flush(struct fib_table *tb)
                         trie_leaf_remove(t, ll->key);
                 ll = l;
         }
-        rcu_read_unlock();  
 
         if (ll && hlist_empty(&ll->list))
                 trie_leaf_remove(t, ll->key);
@@ -1833,16 +1832,7 @@ static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fi
                         i++;
                         continue;
                 }
-                if (fa->fa_info->fib_nh == NULL) {
-                        printk("Trie error _fib_nh=NULL in fa[%d] k=%08x plen=%d\n", i, key, plen);
-                        i++;
-                        continue;
-                }
-                if (fa->fa_info == NULL) {
-                        printk("Trie error fa_info=NULL in fa[%d] k=%08x plen=%d\n", i, key, plen);
-                        i++;
-                        continue;
-                }
+                BUG_ON(!fa->fa_info);
 
                 if (fib_dump_info(skb, NETLINK_CB(cb->skb).pid,
                                   cb->nlh->nlmsg_seq,
@@ -1965,7 +1955,7 @@ struct fib_table * __init fib_hash_init(int id)
                 trie_main = t;
 
         if (id == RT_TABLE_LOCAL)
-                printk("IPv4 FIB: Using LC-trie version %s\n", VERSION);
+                printk(KERN_INFO "IPv4 FIB: Using LC-trie version %s\n", VERSION);
 
         return tb;
 }
@@ -2029,7 +2019,7 @@ static struct node *fib_trie_get_first(struct fib_trie_iter *iter,
                 iter->tnode = (struct tnode *) n;
                 iter->trie = t;
                 iter->index = 0;
-                iter->depth = 0;
+                iter->depth = 1;
                 return n;
         }
         return NULL;
@@ -2274,11 +2264,12 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
                                 seq_puts(seq, "<local>:\n");
                         else
                                 seq_puts(seq, "<main>:\n");
-                } else {
-                        seq_indent(seq, iter->depth-1);
-                        seq_printf(seq, "  +-- %d.%d.%d.%d/%d\n",
-                                   NIPQUAD(prf), tn->pos);
-                }
+                } 
+                seq_indent(seq, iter->depth-1);
+                seq_printf(seq, "  +-- %d.%d.%d.%d/%d %d %d %d\n",
+                           NIPQUAD(prf), tn->pos, tn->bits, tn->full_children, 
+                           tn->empty_children);
+                
         } else {
                 struct leaf *l = (struct leaf *) n;
                 int i;
@@ -2287,7 +2278,7 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
                 seq_indent(seq, iter->depth);
                 seq_printf(seq, "  |-- %d.%d.%d.%d\n", NIPQUAD(val));
                 for (i = 32; i >= 0; i--) {
-                        struct leaf_info *li = find_leaf_info(&l->list, i);
+                        struct leaf_info *li = find_leaf_info(l, i);
                         if (li) {
                                 struct fib_alias *fa;
                                 list_for_each_entry_rcu(fa, &li->falh, fa_list) {
@@ -2383,7 +2374,7 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
                 return 0;
 
         for (i=32; i>=0; i--) {
-                struct leaf_info *li = find_leaf_info(&l->list, i);
+                struct leaf_info *li = find_leaf_info(l, i);
                 struct fib_alias *fa;
                 u32 mask, prefix;
 
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 24eb56ae1b5a..90dca711ac9f 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -188,7 +188,7 @@ struct icmp_err icmp_err_convert[] = {
 
 /* Control parameters for ECHO replies. */
 int sysctl_icmp_echo_ignore_all;
-int sysctl_icmp_echo_ignore_broadcasts;
+int sysctl_icmp_echo_ignore_broadcasts = 1;
 
 /* Control parameter - ignore bogus broadcast responses? */
 int sysctl_icmp_ignore_bogus_error_responses;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 44607f4767b8..8b6d3939e1e6 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1323,7 +1323,7 @@ static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
         }
         if (dev) {
                 imr->imr_ifindex = dev->ifindex;
-                idev = __in_dev_get(dev);
+                idev = __in_dev_get_rtnl(dev);
         }
         return idev;
 }
@@ -1603,7 +1603,7 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc)
         }
         pmc->sources = NULL;
         pmc->sfmode = MCAST_EXCLUDE;
-        pmc->sfcount[MCAST_EXCLUDE] = 0;
+        pmc->sfcount[MCAST_INCLUDE] = 0;
         pmc->sfcount[MCAST_EXCLUDE] = 1;
 }
 
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 4d1502a49852..f9076ef3a1a8 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -20,7 +20,7 @@ void __inet_twsk_kill(struct inet_timewait_sock *tw, struct inet_hashinfo *hashi
         struct inet_bind_hashbucket *bhead;
         struct inet_bind_bucket *tb;
         /* Unlink from established hashes. */
-        struct inet_ehash_bucket *ehead = &hashinfo->ehash[tw->tw_hashent];
+        struct inet_ehash_bucket *ehead = inet_ehash_bucket(hashinfo, tw->tw_hash);
 
         write_lock(&ehead->lock);
         if (hlist_unhashed(&tw->tw_node)) {
@@ -60,7 +60,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
 {
         const struct inet_sock *inet = inet_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
-        struct inet_ehash_bucket *ehead = &hashinfo->ehash[sk->sk_hashent];
+        struct inet_ehash_bucket *ehead = inet_ehash_bucket(hashinfo, sk->sk_hash);
         struct inet_bind_hashbucket *bhead;
         /* Step 1: Put TW into bind hash. Original socket stays there too.
            Note, that any socket with inet->num != 0 MUST be bound in
@@ -106,7 +106,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                 tw->tw_dport        = inet->dport;
                 tw->tw_family       = sk->sk_family;
                 tw->tw_reuse        = sk->sk_reuse;
-                tw->tw_hashent      = sk->sk_hashent;
+                tw->tw_hash         = sk->sk_hash;
                 tw->tw_ipv6only     = 0;
                 tw->tw_prot         = sk->sk_prot_creator;
                 atomic_set(&tw->tw_refcnt, 1);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index f0d5740d7e22..896ce3f8f53a 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1104,10 +1104,10 @@ static int ipgre_open(struct net_device *dev)
                         return -EADDRNOTAVAIL;
                 dev = rt->u.dst.dev;
                 ip_rt_put(rt);
-                if (__in_dev_get(dev) == NULL)
+                if (__in_dev_get_rtnl(dev) == NULL)
                         return -EADDRNOTAVAIL;
                 t->mlink = dev->ifindex;
-                ip_mc_inc_group(__in_dev_get(dev), t->parms.iph.daddr);
+                ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr);
         }
         return 0;
 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9dbf5909f3a6..302b7eb507c9 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -149,7 +149,7 @@ struct net_device *ipmr_new_tunnel(struct vifctl *v)
                 if (err == 0 && (dev = __dev_get_by_name(p.name)) != NULL) {
                         dev->flags |= IFF_MULTICAST;
 
-                        in_dev = __in_dev_get(dev);
+                        in_dev = __in_dev_get_rtnl(dev);
                         if (in_dev == NULL && (in_dev = inetdev_init(dev)) == NULL)
                                 goto failure;
                         in_dev->cnf.rp_filter = 0;
@@ -278,7 +278,7 @@ static int vif_delete(int vifi)
 
         dev_set_allmulti(dev, -1);
 
-        if ((in_dev = __in_dev_get(dev)) != NULL) {
+        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
                 in_dev->cnf.mc_forwarding--;
                 ip_rt_multicast_event(in_dev);
         }
@@ -421,7 +421,7 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
                 return -EINVAL;
         }
 
-        if ((in_dev = __in_dev_get(dev)) == NULL)
+        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
                 return -EADDRNOTAVAIL;
         in_dev->cnf.mc_forwarding++;
         dev_set_allmulti(dev, +1);
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index e11952ea17af..f828fa2eb7de 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -196,6 +196,7 @@ static inline struct ip_vs_conn *__ip_vs_conn_in_get
         list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                 if (s_addr==cp->caddr && s_port==cp->cport &&
                     d_port==cp->vport && d_addr==cp->vaddr &&
+                    ((!s_port) ^ (!(cp->flags & IP_VS_CONN_F_NO_CPORT))) &&
                     protocol==cp->protocol) {
                         /* HIT */
                         atomic_inc(&cp->refcnt);
@@ -227,6 +228,40 @@ struct ip_vs_conn *ip_vs_conn_in_get
         return cp;
 }
 
+/* Get reference to connection template */
+struct ip_vs_conn *ip_vs_ct_in_get
+(int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port)
+{
+        unsigned hash;
+        struct ip_vs_conn *cp;
+
+        hash = ip_vs_conn_hashkey(protocol, s_addr, s_port);
+
+        ct_read_lock(hash);
+
+        list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
+                if (s_addr==cp->caddr && s_port==cp->cport &&
+                    d_port==cp->vport && d_addr==cp->vaddr &&
+                    cp->flags & IP_VS_CONN_F_TEMPLATE &&
+                    protocol==cp->protocol) {
+                        /* HIT */
+                        atomic_inc(&cp->refcnt);
+                        goto out;
+                }
+        }
+        cp = NULL;
+
+  out:
+        ct_read_unlock(hash);
+
+        IP_VS_DBG(7, "template lookup/in %s %u.%u.%u.%u:%d->%u.%u.%u.%u:%d %s\n",
+                  ip_vs_proto_name(protocol),
+                  NIPQUAD(s_addr), ntohs(s_port),
+                  NIPQUAD(d_addr), ntohs(d_port),
+                  cp?"hit":"not hit");
+
+        return cp;
+}
 
 /*
  *  Gets ip_vs_conn associated with supplied parameters in the ip_vs_conn_tab.
@@ -367,7 +402,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
                   atomic_read(&dest->refcnt));
 
         /* Update the connection counters */
-        if (cp->cport || (cp->flags & IP_VS_CONN_F_NO_CPORT)) {
+        if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
                 /* It is a normal connection, so increase the inactive
                    connection counter because it is in TCP SYNRECV
                    state (inactive) or other protocol inacive state */
@@ -406,7 +441,7 @@ static inline void ip_vs_unbind_dest(struct ip_vs_conn *cp)
                   atomic_read(&dest->refcnt));
 
         /* Update the connection counters */
-        if (cp->cport || (cp->flags & IP_VS_CONN_F_NO_CPORT)) {
+        if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
                 /* It is a normal connection, so decrease the inactconns
                    or activeconns counter */
                 if (cp->flags & IP_VS_CONN_F_INACTIVE) {
@@ -467,7 +502,7 @@ int ip_vs_check_template(struct ip_vs_conn *ct)
                 /*
                  * Invalidate the connection template
                  */
-                if (ct->cport) {
+                if (ct->vport != 65535) {
                         if (ip_vs_conn_unhash(ct)) {
                                 ct->dport = 65535;
                                 ct->vport = 65535;
@@ -776,7 +811,7 @@ void ip_vs_random_dropentry(void)
                 ct_write_lock_bh(hash);
 
                 list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
-                        if (!cp->cport && !(cp->flags & IP_VS_CONN_F_NO_CPORT))
+                        if (cp->flags & IP_VS_CONN_F_TEMPLATE)
                                 /* connection template */
                                 continue;
 
diff --git a/net/ipv4/ipvs/ip_vs_core.c b/net/ipv4/ipvs/ip_vs_core.c
index 3ac7eeca04ac..981cc3244ef2 100644
--- a/net/ipv4/ipvs/ip_vs_core.c
+++ b/net/ipv4/ipvs/ip_vs_core.c
@@ -243,10 +243,10 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         if (ports[1] == svc->port) {
                 /* Check if a template already exists */
                 if (svc->port != FTPPORT)
-                        ct = ip_vs_conn_in_get(iph->protocol, snet, 0,
+                        ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
                                                iph->daddr, ports[1]);
                 else
-                        ct = ip_vs_conn_in_get(iph->protocol, snet, 0,
+                        ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
                                                iph->daddr, 0);
 
                 if (!ct || !ip_vs_check_template(ct)) {
@@ -272,14 +272,14 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                                                     iph->daddr,
                                                     ports[1],
                                                     dest->addr, dest->port,
-                                                    0,
+                                                    IP_VS_CONN_F_TEMPLATE,
                                                     dest);
                         else
                                 ct = ip_vs_conn_new(iph->protocol,
                                                     snet, 0,
                                                     iph->daddr, 0,
                                                     dest->addr, 0,
-                                                    0,
+                                                    IP_VS_CONN_F_TEMPLATE,
                                                     dest);
                         if (ct == NULL)
                                 return NULL;
@@ -298,10 +298,10 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                  * port zero template: <protocol,caddr,0,vaddr,0,daddr,0>
                  */
                 if (svc->fwmark)
-                        ct = ip_vs_conn_in_get(IPPROTO_IP, snet, 0,
+                        ct = ip_vs_ct_in_get(IPPROTO_IP, snet, 0,
                                                htonl(svc->fwmark), 0);
                 else
-                        ct = ip_vs_conn_in_get(iph->protocol, snet, 0,
+                        ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
                                                iph->daddr, 0);
 
                 if (!ct || !ip_vs_check_template(ct)) {
@@ -326,14 +326,14 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                                                     snet, 0,
                                                     htonl(svc->fwmark), 0,
                                                     dest->addr, 0,
-                                                    0,
+                                                    IP_VS_CONN_F_TEMPLATE,
                                                     dest);
                         else
                                 ct = ip_vs_conn_new(iph->protocol,
                                                     snet, 0,
                                                     iph->daddr, 0,
                                                     dest->addr, 0,
-                                                    0,
+                                                    IP_VS_CONN_F_TEMPLATE,
                                                     dest);
                         if (ct == NULL)
                                 return NULL;
diff --git a/net/ipv4/ipvs/ip_vs_sync.c b/net/ipv4/ipvs/ip_vs_sync.c
index 574d1f509b46..2e5ced3d8062 100644
--- a/net/ipv4/ipvs/ip_vs_sync.c
+++ b/net/ipv4/ipvs/ip_vs_sync.c
@@ -297,16 +297,24 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
 
         p = (char *)buffer + sizeof(struct ip_vs_sync_mesg);
         for (i=0; i<m->nr_conns; i++) {
+                unsigned flags;
+
                 s = (struct ip_vs_sync_conn *)p;
-                cp = ip_vs_conn_in_get(s->protocol,
-                                       s->caddr, s->cport,
-                                       s->vaddr, s->vport);
+                flags = ntohs(s->flags);
+                if (!(flags & IP_VS_CONN_F_TEMPLATE))
+                        cp = ip_vs_conn_in_get(s->protocol,
+                                               s->caddr, s->cport,
+                                               s->vaddr, s->vport);
+                else
+                        cp = ip_vs_ct_in_get(s->protocol,
+                                               s->caddr, s->cport,
+                                               s->vaddr, s->vport);
                 if (!cp) {
                         cp = ip_vs_conn_new(s->protocol,
                                             s->caddr, s->cport,
                                             s->vaddr, s->vport,
                                             s->daddr, s->dport,
-                                            ntohs(s->flags), NULL);
+                                            flags, NULL);
                         if (!cp) {
                                 IP_VS_ERR("ip_vs_conn_new failed\n");
                                 return;
@@ -315,11 +323,11 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
                 } else if (!cp->dest) {
                         /* it is an entry created by the synchronization */
                         cp->state = ntohs(s->state);
-                        cp->flags = ntohs(s->flags) | IP_VS_CONN_F_HASHED;
+                        cp->flags = flags | IP_VS_CONN_F_HASHED;
                 }       /* Note that we don't touch its state and flags
                            if it is a normal entry. */
 
-                if (ntohs(s->flags) & IP_VS_CONN_F_SEQ_MASK) {
+                if (flags & IP_VS_CONN_F_SEQ_MASK) {
                         opt = (struct ip_vs_sync_conn_options *)&s[1];
                         memcpy(&cp->in_seq, opt, sizeof(*opt));
                         p += FULL_CONN_SIZE;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 30aa8e2ee214..2cd7e7d1ac90 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -51,6 +51,14 @@ config IP_NF_CONNTRACK_EVENTS
           
           IF unsure, say `N'.
 
+config IP_NF_CONNTRACK_NETLINK
+        tristate 'Connection tracking netlink interface'
+        depends on IP_NF_CONNTRACK && NETFILTER_NETLINK
+        depends on IP_NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
+        help
+          This option enables support for a netlink-based userspace interface
+
+
 config IP_NF_CT_PROTO_SCTP
         tristate  'SCTP protocol connection tracking support (EXPERIMENTAL)'
         depends on IP_NF_CONNTRACK && EXPERIMENTAL
@@ -129,6 +137,22 @@ config IP_NF_AMANDA
 
           To compile it as a module, choose M here.  If unsure, say Y.
 
+config IP_NF_PPTP
+        tristate  'PPTP protocol support'
+        help
+          This module adds support for PPTP (Point to Point Tunnelling
+          Protocol, RFC2637) conncection tracking and NAT. 
+        
+          If you are running PPTP sessions over a stateful firewall or NAT
+          box, you may want to enable this feature.  
+        
+          Please note that not all PPTP modes of operation are supported yet.
+          For more info, read top of the file
+          net/ipv4/netfilter/ip_conntrack_pptp.c
+        
+          If you want to compile it as a module, say M here and read
+          Documentation/modules.txt.  If unsure, say `N'.
+
 config IP_NF_QUEUE
         tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
         help
@@ -513,6 +537,17 @@ config IP_NF_TARGET_TCPMSS
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP_NF_TARGET_NFQUEUE
+        tristate "NFQUEUE Target Support"
+        depends on IP_NF_IPTABLES
+        help
+          This Target replaced the old obsolete QUEUE target.
+
+          As opposed to QUEUE, it supports 65535 different queues,
+          not just one.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 # NAT + specific targets
 config IP_NF_NAT
         tristate "Full NAT"
@@ -613,6 +648,12 @@ config IP_NF_NAT_AMANDA
         default IP_NF_NAT if IP_NF_AMANDA=y
         default m if IP_NF_AMANDA=m
 
+config IP_NF_NAT_PPTP
+        tristate
+        depends on IP_NF_NAT!=n && IP_NF_PPTP!=n
+        default IP_NF_NAT if IP_NF_PPTP=y
+        default m if IP_NF_PPTP=m
+
 # mangle + specific targets
 config IP_NF_MANGLE
         tristate "Packet mangling"
@@ -774,11 +815,5 @@ config IP_NF_ARP_MANGLE
           Allows altering the ARP packet payload: source and destination
           hardware and network addresses.
 
-config IP_NF_CONNTRACK_NETLINK
-        tristate 'Connection tracking netlink interface'
-        depends on IP_NF_CONNTRACK && NETFILTER_NETLINK
-        help
-          This option enables support for a netlink-based userspace interface
-
 endmenu
 
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 1ba0db746817..dab4b58dd31e 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -4,7 +4,11 @@
 
 # objects for the standalone - connection tracking / NAT
 ip_conntrack-objs       := ip_conntrack_standalone.o ip_conntrack_core.o ip_conntrack_proto_generic.o ip_conntrack_proto_tcp.o ip_conntrack_proto_udp.o ip_conntrack_proto_icmp.o
-iptable_nat-objs        := ip_nat_standalone.o ip_nat_rule.o ip_nat_core.o ip_nat_helper.o ip_nat_proto_unknown.o ip_nat_proto_tcp.o ip_nat_proto_udp.o ip_nat_proto_icmp.o
+ip_nat-objs     := ip_nat_core.o ip_nat_helper.o ip_nat_proto_unknown.o ip_nat_proto_tcp.o ip_nat_proto_udp.o ip_nat_proto_icmp.o
+iptable_nat-objs        := ip_nat_rule.o ip_nat_standalone.o
+
+ip_conntrack_pptp-objs  := ip_conntrack_helper_pptp.o ip_conntrack_proto_gre.o
+ip_nat_pptp-objs        := ip_nat_helper_pptp.o ip_nat_proto_gre.o
 
 # connection tracking
 obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o
@@ -17,6 +21,7 @@ obj-$(CONFIG_IP_NF_CONNTRACK_NETLINK) += ip_conntrack_netlink.o
 obj-$(CONFIG_IP_NF_CT_PROTO_SCTP) += ip_conntrack_proto_sctp.o
 
 # connection tracking helpers
+obj-$(CONFIG_IP_NF_PPTP) += ip_conntrack_pptp.o
 obj-$(CONFIG_IP_NF_AMANDA) += ip_conntrack_amanda.o
 obj-$(CONFIG_IP_NF_TFTP) += ip_conntrack_tftp.o
 obj-$(CONFIG_IP_NF_FTP) += ip_conntrack_ftp.o
@@ -24,6 +29,7 @@ obj-$(CONFIG_IP_NF_IRC) += ip_conntrack_irc.o
 obj-$(CONFIG_IP_NF_NETBIOS_NS) += ip_conntrack_netbios_ns.o
 
 # NAT helpers 
+obj-$(CONFIG_IP_NF_NAT_PPTP) += ip_nat_pptp.o
 obj-$(CONFIG_IP_NF_NAT_AMANDA) += ip_nat_amanda.o
 obj-$(CONFIG_IP_NF_NAT_TFTP) += ip_nat_tftp.o
 obj-$(CONFIG_IP_NF_NAT_FTP) += ip_nat_ftp.o
@@ -35,7 +41,7 @@ obj-$(CONFIG_IP_NF_IPTABLES) += ip_tables.o
 # the three instances of ip_tables
 obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o
 obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o
-obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o
+obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o ip_nat.o
 obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 
 # matches
@@ -87,6 +93,7 @@ obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
 obj-$(CONFIG_IP_NF_TARGET_NOTRACK) += ipt_NOTRACK.o
 obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
 obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
+obj-$(CONFIG_IP_NF_TARGET_NFQUEUE) += ipt_NFQUEUE.o
 
 # generic ARP tables
 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
@@ -96,4 +103,3 @@ obj-$(CONFIG_IP_NF_ARP_MANGLE) += arpt_mangle.o
 obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o
 
 obj-$(CONFIG_IP_NF_QUEUE) += ip_queue.o
-obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ipt_NFQUEUE.o
diff --git a/net/ipv4/netfilter/ip_conntrack_amanda.c b/net/ipv4/netfilter/ip_conntrack_amanda.c
index dc20881004bc..fa3f914117ec 100644
--- a/net/ipv4/netfilter/ip_conntrack_amanda.c
+++ b/net/ipv4/netfilter/ip_conntrack_amanda.c
@@ -65,7 +65,7 @@ static int help(struct sk_buff **pskb,
 
         /* increase the UDP timeout of the master connection as replies from
          * Amanda clients to the server can be quite delayed */
-        ip_ct_refresh_acct(ct, ctinfo, NULL, master_timeout * HZ);
+        ip_ct_refresh(ct, *pskb, master_timeout * HZ);
 
         /* No data? */
         dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 19cba16e6e1e..ea65dd3e517a 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -233,7 +233,7 @@ __ip_conntrack_expect_find(const struct ip_conntrack_tuple *tuple)
 
 /* Just find a expectation corresponding to a tuple. */
 struct ip_conntrack_expect *
-ip_conntrack_expect_find_get(const struct ip_conntrack_tuple *tuple)
+ip_conntrack_expect_find(const struct ip_conntrack_tuple *tuple)
 {
         struct ip_conntrack_expect *i;
         
@@ -1112,42 +1112,46 @@ void ip_conntrack_helper_unregister(struct ip_conntrack_helper *me)
         synchronize_net();
 }
 
-static inline void ct_add_counters(struct ip_conntrack *ct,
-                                   enum ip_conntrack_info ctinfo,
-                                   const struct sk_buff *skb)
-{
-#ifdef CONFIG_IP_NF_CT_ACCT
-        if (skb) {
-                ct->counters[CTINFO2DIR(ctinfo)].packets++;
-                ct->counters[CTINFO2DIR(ctinfo)].bytes += 
-                                        ntohs(skb->nh.iph->tot_len);
-        }
-#endif
-}
-
-/* Refresh conntrack for this many jiffies and do accounting (if skb != NULL) */
-void ip_ct_refresh_acct(struct ip_conntrack *ct, 
+/* Refresh conntrack for this many jiffies and do accounting if do_acct is 1 */
+void __ip_ct_refresh_acct(struct ip_conntrack *ct, 
                         enum ip_conntrack_info ctinfo,
                         const struct sk_buff *skb,
-                        unsigned long extra_jiffies)
+                        unsigned long extra_jiffies,
+                        int do_acct)
 {
+        int do_event = 0;
+
         IP_NF_ASSERT(ct->timeout.data == (unsigned long)ct);
+        IP_NF_ASSERT(skb);
+
+        write_lock_bh(&ip_conntrack_lock);
 
         /* If not in hash table, timer will not be active yet */
         if (!is_confirmed(ct)) {
                 ct->timeout.expires = extra_jiffies;
-                ct_add_counters(ct, ctinfo, skb);
+                do_event = 1;
         } else {
-                write_lock_bh(&ip_conntrack_lock);
                 /* Need del_timer for race avoidance (may already be dying). */
                 if (del_timer(&ct->timeout)) {
                         ct->timeout.expires = jiffies + extra_jiffies;
                         add_timer(&ct->timeout);
-                        ip_conntrack_event_cache(IPCT_REFRESH, skb);
+                        do_event = 1;
                 }
-                ct_add_counters(ct, ctinfo, skb);
-                write_unlock_bh(&ip_conntrack_lock);
         }
+
+#ifdef CONFIG_IP_NF_CT_ACCT
+        if (do_acct) {
+                ct->counters[CTINFO2DIR(ctinfo)].packets++;
+                ct->counters[CTINFO2DIR(ctinfo)].bytes += 
+                                                ntohs(skb->nh.iph->tot_len);
+        }
+#endif
+
+        write_unlock_bh(&ip_conntrack_lock);
+
+        /* must be unlocked when calling event cache */
+        if (do_event)
+                ip_conntrack_event_cache(IPCT_REFRESH, skb);
 }
 
 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
diff --git a/net/ipv4/netfilter/ip_conntrack_ftp.c b/net/ipv4/netfilter/ip_conntrack_ftp.c
index 1b79ec36085f..d77d6b3f5f80 100644
--- a/net/ipv4/netfilter/ip_conntrack_ftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_ftp.c
@@ -29,9 +29,9 @@ static char *ftp_buffer;
 static DEFINE_SPINLOCK(ip_ftp_lock);
 
 #define MAX_PORTS 8
-static int ports[MAX_PORTS];
+static short ports[MAX_PORTS];
 static int ports_c;
-module_param_array(ports, int, &ports_c, 0400);
+module_param_array(ports, short, &ports_c, 0400);
 
 static int loose;
 module_param(loose, int, 0600);
@@ -450,7 +450,7 @@ out_update_nl:
 }
 
 static struct ip_conntrack_helper ftp[MAX_PORTS];
-static char ftp_names[MAX_PORTS][10];
+static char ftp_names[MAX_PORTS][sizeof("ftp-65535")];
 
 /* Not __exit: called from init() */
 static void fini(void)
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
new file mode 100644
index 000000000000..926a6684643d
--- /dev/null
+++ b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
@@ -0,0 +1,806 @@
+/*
+ * ip_conntrack_pptp.c  - Version 3.0
+ *
+ * Connection tracking support for PPTP (Point to Point Tunneling Protocol).
+ * PPTP is a a protocol for creating virtual private networks.
+ * It is a specification defined by Microsoft and some vendors
+ * working with Microsoft.  PPTP is built on top of a modified
+ * version of the Internet Generic Routing Encapsulation Protocol.
+ * GRE is defined in RFC 1701 and RFC 1702.  Documentation of
+ * PPTP can be found in RFC 2637
+ *
+ * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org>
+ *
+ * Development of this code funded by Astaro AG (http://www.astaro.com/)
+ *
+ * Limitations:
+ *       - We blindly assume that control connections are always
+ *         established in PNS->PAC direction.  This is a violation
+ *         of RFFC2673
+ *       - We can only support one single call within each session
+ *
+ * TODO:
+ *       - testing of incoming PPTP calls 
+ *
+ * Changes: 
+ *      2002-02-05 - Version 1.3
+ *        - Call ip_conntrack_unexpect_related() from 
+ *          pptp_destroy_siblings() to destroy expectations in case
+ *          CALL_DISCONNECT_NOTIFY or tcp fin packet was seen
+ *          (Philip Craig <philipc@snapgear.com>)
+ *        - Add Version information at module loadtime
+ *      2002-02-10 - Version 1.6
+ *        - move to C99 style initializers
+ *        - remove second expectation if first arrives
+ *      2004-10-22 - Version 2.0
+ *        - merge Mandrake's 2.6.x port with recent 2.6.x API changes
+ *        - fix lots of linear skb assumptions from Mandrake's port
+ *      2005-06-10 - Version 2.1
+ *        - use ip_conntrack_expect_free() instead of kfree() on the
+ *          expect's (which are from the slab for quite some time)
+ *      2005-06-10 - Version 3.0
+ *        - port helper to post-2.6.11 API changes,
+ *          funded by Oxcoda NetBox Blue (http://www.netboxblue.com/)
+ *      2005-07-30 - Version 3.1
+ *        - port helper to 2.6.13 API changes
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/netfilter.h>
+#include <linux/ip.h>
+#include <net/checksum.h>
+#include <net/tcp.h>
+
+#include <linux/netfilter_ipv4/ip_conntrack.h>
+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
+#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
+#include <linux/netfilter_ipv4/ip_conntrack_proto_gre.h>
+#include <linux/netfilter_ipv4/ip_conntrack_pptp.h>
+
+#define IP_CT_PPTP_VERSION "3.1"
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
+MODULE_DESCRIPTION("Netfilter connection tracking helper module for PPTP");
+
+static DEFINE_SPINLOCK(ip_pptp_lock);
+
+int
+(*ip_nat_pptp_hook_outbound)(struct sk_buff **pskb,
+                          struct ip_conntrack *ct,
+                          enum ip_conntrack_info ctinfo,
+                          struct PptpControlHeader *ctlh,
+                          union pptp_ctrl_union *pptpReq);
+
+int
+(*ip_nat_pptp_hook_inbound)(struct sk_buff **pskb,
+                          struct ip_conntrack *ct,
+                          enum ip_conntrack_info ctinfo,
+                          struct PptpControlHeader *ctlh,
+                          union pptp_ctrl_union *pptpReq);
+
+int
+(*ip_nat_pptp_hook_exp_gre)(struct ip_conntrack_expect *expect_orig,
+                            struct ip_conntrack_expect *expect_reply);
+
+void
+(*ip_nat_pptp_hook_expectfn)(struct ip_conntrack *ct,
+                             struct ip_conntrack_expect *exp);
+
+#if 0
+/* PptpControlMessageType names */
+const char *pptp_msg_name[] = {
+        "UNKNOWN_MESSAGE",
+        "START_SESSION_REQUEST",
+        "START_SESSION_REPLY",
+        "STOP_SESSION_REQUEST",
+        "STOP_SESSION_REPLY",
+        "ECHO_REQUEST",
+        "ECHO_REPLY",
+        "OUT_CALL_REQUEST",
+        "OUT_CALL_REPLY",
+        "IN_CALL_REQUEST",
+        "IN_CALL_REPLY",
+        "IN_CALL_CONNECT",
+        "CALL_CLEAR_REQUEST",
+        "CALL_DISCONNECT_NOTIFY",
+        "WAN_ERROR_NOTIFY",
+        "SET_LINK_INFO"
+};
+EXPORT_SYMBOL(pptp_msg_name);
+#define DEBUGP(format, args...) printk(KERN_DEBUG "%s:%s: " format, __FILE__, __FUNCTION__, ## args)
+#else
+#define DEBUGP(format, args...)
+#endif
+
+#define SECS *HZ
+#define MINS * 60 SECS
+#define HOURS * 60 MINS
+
+#define PPTP_GRE_TIMEOUT                (10 MINS)
+#define PPTP_GRE_STREAM_TIMEOUT         (5 HOURS)
+
+static void pptp_expectfn(struct ip_conntrack *ct,
+                         struct ip_conntrack_expect *exp)
+{
+        DEBUGP("increasing timeouts\n");
+
+        /* increase timeout of GRE data channel conntrack entry */
+        ct->proto.gre.timeout = PPTP_GRE_TIMEOUT;
+        ct->proto.gre.stream_timeout = PPTP_GRE_STREAM_TIMEOUT;
+
+        /* Can you see how rusty this code is, compared with the pre-2.6.11
+         * one? That's what happened to my shiny newnat of 2002 ;( -HW */
+
+        if (!ip_nat_pptp_hook_expectfn) {
+                struct ip_conntrack_tuple inv_t;
+                struct ip_conntrack_expect *exp_other;
+
+                /* obviously this tuple inversion only works until you do NAT */
+                invert_tuplepr(&inv_t, &exp->tuple);
+                DEBUGP("trying to unexpect other dir: ");
+                DUMP_TUPLE(&inv_t);
+        
+                exp_other = ip_conntrack_expect_find(&inv_t);
+                if (exp_other) {
+                        /* delete other expectation.  */
+                        DEBUGP("found\n");
+                        ip_conntrack_unexpect_related(exp_other);
+                        ip_conntrack_expect_put(exp_other);
+                } else {
+                        DEBUGP("not found\n");
+                }
+        } else {
+                /* we need more than simple inversion */
+                ip_nat_pptp_hook_expectfn(ct, exp);
+        }
+}
+
+static int destroy_sibling_or_exp(const struct ip_conntrack_tuple *t)
+{
+        struct ip_conntrack_tuple_hash *h;
+        struct ip_conntrack_expect *exp;
+
+        DEBUGP("trying to timeout ct or exp for tuple ");
+        DUMP_TUPLE(t);
+
+        h = ip_conntrack_find_get(t, NULL);
+        if (h)  {
+                struct ip_conntrack *sibling = tuplehash_to_ctrack(h);
+                DEBUGP("setting timeout of conntrack %p to 0\n", sibling);
+                sibling->proto.gre.timeout = 0;
+                sibling->proto.gre.stream_timeout = 0;
+                if (del_timer(&sibling->timeout))
+                        sibling->timeout.function((unsigned long)sibling);
+                ip_conntrack_put(sibling);
+                return 1;
+        } else {
+                exp = ip_conntrack_expect_find(t);
+                if (exp) {
+                        DEBUGP("unexpect_related of expect %p\n", exp);
+                        ip_conntrack_unexpect_related(exp);
+                        ip_conntrack_expect_put(exp);
+                        return 1;
+                }
+        }
+
+        return 0;
+}
+
+
+/* timeout GRE data connections */
+static void pptp_destroy_siblings(struct ip_conntrack *ct)
+{
+        struct ip_conntrack_tuple t;
+
+        /* Since ct->sibling_list has literally rusted away in 2.6.11, 
+         * we now need another way to find out about our sibling
+         * contrack and expects... -HW */
+
+        /* try original (pns->pac) tuple */
+        memcpy(&t, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, sizeof(t));
+        t.dst.protonum = IPPROTO_GRE;
+        t.src.u.gre.key = htons(ct->help.ct_pptp_info.pns_call_id);
+        t.dst.u.gre.key = htons(ct->help.ct_pptp_info.pac_call_id);
+
+        if (!destroy_sibling_or_exp(&t))
+                DEBUGP("failed to timeout original pns->pac ct/exp\n");
+
+        /* try reply (pac->pns) tuple */
+        memcpy(&t, &ct->tuplehash[IP_CT_DIR_REPLY].tuple, sizeof(t));
+        t.dst.protonum = IPPROTO_GRE;
+        t.src.u.gre.key = htons(ct->help.ct_pptp_info.pac_call_id);
+        t.dst.u.gre.key = htons(ct->help.ct_pptp_info.pns_call_id);
+
+        if (!destroy_sibling_or_exp(&t))
+                DEBUGP("failed to timeout reply pac->pns ct/exp\n");
+}
+
+/* expect GRE connections (PNS->PAC and PAC->PNS direction) */
+static inline int
+exp_gre(struct ip_conntrack *master,
+        u_int32_t seq,
+        __be16 callid,
+        __be16 peer_callid)
+{
+        struct ip_conntrack_tuple inv_tuple;
+        struct ip_conntrack_tuple exp_tuples[] = {
+                /* tuple in original direction, PNS->PAC */
+                { .src = { .ip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip,
+                           .u = { .gre = { .key = peer_callid } }
+                         },
+                  .dst = { .ip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip,
+                           .u = { .gre = { .key = callid } },
+                           .protonum = IPPROTO_GRE
+                         },
+                 },
+                /* tuple in reply direction, PAC->PNS */
+                { .src = { .ip = master->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip,
+                           .u = { .gre = { .key = callid } }
+                         },
+                  .dst = { .ip = master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip,
+                           .u = { .gre = { .key = peer_callid } },
+                           .protonum = IPPROTO_GRE
+                         },
+                 }
+        };
+        struct ip_conntrack_expect *exp_orig, *exp_reply;
+        int ret = 1;
+
+        exp_orig = ip_conntrack_expect_alloc(master);
+        if (exp_orig == NULL)
+                goto out;
+
+        exp_reply = ip_conntrack_expect_alloc(master);
+        if (exp_reply == NULL)
+                goto out_put_orig;
+
+        memcpy(&exp_orig->tuple, &exp_tuples[0], sizeof(exp_orig->tuple));
+
+        exp_orig->mask.src.ip = 0xffffffff;
+        exp_orig->mask.src.u.all = 0;
+        exp_orig->mask.dst.u.all = 0;
+        exp_orig->mask.dst.u.gre.key = htons(0xffff);
+        exp_orig->mask.dst.ip = 0xffffffff;
+        exp_orig->mask.dst.protonum = 0xff;
+                
+        exp_orig->master = master;
+        exp_orig->expectfn = pptp_expectfn;
+        exp_orig->flags = 0;
+
+        exp_orig->dir = IP_CT_DIR_ORIGINAL;
+
+        /* both expectations are identical apart from tuple */
+        memcpy(exp_reply, exp_orig, sizeof(*exp_reply));
+        memcpy(&exp_reply->tuple, &exp_tuples[1], sizeof(exp_reply->tuple));
+
+        exp_reply->dir = !exp_orig->dir;
+
+        if (ip_nat_pptp_hook_exp_gre)
+                ret = ip_nat_pptp_hook_exp_gre(exp_orig, exp_reply);
+        else {
+
+                DEBUGP("calling expect_related PNS->PAC");
+                DUMP_TUPLE(&exp_orig->tuple);
+
+                if (ip_conntrack_expect_related(exp_orig) != 0) {
+                        DEBUGP("cannot expect_related()\n");
+                        goto out_put_both;
+                }
+
+                DEBUGP("calling expect_related PAC->PNS");
+                DUMP_TUPLE(&exp_reply->tuple);
+
+                if (ip_conntrack_expect_related(exp_reply) != 0) {
+                        DEBUGP("cannot expect_related()\n");
+                        goto out_unexpect_orig;
+                }
+
+                /* Add GRE keymap entries */
+                if (ip_ct_gre_keymap_add(master, &exp_reply->tuple, 0) != 0) {
+                        DEBUGP("cannot keymap_add() exp\n");
+                        goto out_unexpect_both;
+                }
+
+                invert_tuplepr(&inv_tuple, &exp_reply->tuple);
+                if (ip_ct_gre_keymap_add(master, &inv_tuple, 1) != 0) {
+                        ip_ct_gre_keymap_destroy(master);
+                        DEBUGP("cannot keymap_add() exp_inv\n");
+                        goto out_unexpect_both;
+                }
+                ret = 0;
+        }
+
+out_put_both:
+        ip_conntrack_expect_put(exp_reply);
+out_put_orig:
+        ip_conntrack_expect_put(exp_orig);
+out:
+        return ret;
+
+out_unexpect_both:
+        ip_conntrack_unexpect_related(exp_reply);
+out_unexpect_orig:
+        ip_conntrack_unexpect_related(exp_orig);
+        goto out_put_both;
+}
+
+static inline int 
+pptp_inbound_pkt(struct sk_buff **pskb,
+                 struct tcphdr *tcph,
+                 unsigned int nexthdr_off,
+                 unsigned int datalen,
+                 struct ip_conntrack *ct,
+                 enum ip_conntrack_info ctinfo)
+{
+        struct PptpControlHeader _ctlh, *ctlh;
+        unsigned int reqlen;
+        union pptp_ctrl_union _pptpReq, *pptpReq;
+        struct ip_ct_pptp_master *info = &ct->help.ct_pptp_info;
+        u_int16_t msg;
+        __be16 *cid, *pcid;
+        u_int32_t seq;  
+
+        ctlh = skb_header_pointer(*pskb, nexthdr_off, sizeof(_ctlh), &_ctlh);
+        if (!ctlh) {
+                DEBUGP("error during skb_header_pointer\n");
+                return NF_ACCEPT;
+        }
+        nexthdr_off += sizeof(_ctlh);
+        datalen -= sizeof(_ctlh);
+
+        reqlen = datalen;
+        if (reqlen > sizeof(*pptpReq))
+                reqlen = sizeof(*pptpReq);
+        pptpReq = skb_header_pointer(*pskb, nexthdr_off, reqlen, &_pptpReq);
+        if (!pptpReq) {
+                DEBUGP("error during skb_header_pointer\n");
+                return NF_ACCEPT;
+        }
+
+        msg = ntohs(ctlh->messageType);
+        DEBUGP("inbound control message %s\n", pptp_msg_name[msg]);
+
+        switch (msg) {
+        case PPTP_START_SESSION_REPLY:
+                if (reqlen < sizeof(_pptpReq.srep)) {
+                        DEBUGP("%s: short packet\n", pptp_msg_name[msg]);
+                        break;
+                }
+
+                /* server confirms new control session */
+                if (info->sstate < PPTP_SESSION_REQUESTED) {
+                        DEBUGP("%s without START_SESS_REQUEST\n",
+                                pptp_msg_name[msg]);
+                        break;
+                }
+                if (pptpReq->srep.resultCode == PPTP_START_OK)
+                        info->sstate = PPTP_SESSION_CONFIRMED;
+                else 
+                        info->sstate = PPTP_SESSION_ERROR;
+                break;
+
+        case PPTP_STOP_SESSION_REPLY:
+                if (reqlen < sizeof(_pptpReq.strep)) {
+                        DEBUGP("%s: short packet\n", pptp_msg_name[msg]);
+                        break;
+                }
+
+                /* server confirms end of control session */
+                if (info->sstate > PPTP_SESSION_STOPREQ) {
+                        DEBUGP("%s without STOP_SESS_REQUEST\n",
+                                pptp_msg_name[msg]);
+                        break;
+                }
+                if (pptpReq->strep.resultCode == PPTP_STOP_OK)
+                        info->sstate = PPTP_SESSION_NONE;
+                else
+                        info->sstate = PPTP_SESSION_ERROR;
+                break;
+
+        case PPTP_OUT_CALL_REPLY:
+                if (reqlen < sizeof(_pptpReq.ocack)) {
+                        DEBUGP("%s: short packet\n", pptp_msg_name[msg]);
+                        break;
+                }
+
+                /* server accepted call, we now expect GRE frames */
+                if (info->sstate != PPTP_SESSION_CONFIRMED) {
+                        DEBUGP("%s but no session\n", pptp_msg_name[msg]);
+                        break;
+                }
+                if (info->cstate != PPTP_CALL_OUT_REQ &&
+                    info->cstate != PPTP_CALL_OUT_CONF) {
+                        DEBUGP("%s without OUTCALL_REQ\n", pptp_msg_name[msg]);
+                        break;
+                }
+                if (pptpReq->ocack.resultCode != PPTP_OUTCALL_CONNECT) {
+                        info->cstate = PPTP_CALL_NONE;
+                        break;
+                }
+
+                cid = &pptpReq->ocack.callID;
+                pcid = &pptpReq->ocack.peersCallID;
+
+                info->pac_call_id = ntohs(*cid);
+                
+                if (htons(info->pns_call_id) != *pcid) {
+                        DEBUGP("%s for unknown callid %u\n",
+                                pptp_msg_name[msg], ntohs(*pcid));
+                        break;
+                }
+
+                DEBUGP("%s, CID=%X, PCID=%X\n", pptp_msg_name[msg], 
+                        ntohs(*cid), ntohs(*pcid));
+                
+                info->cstate = PPTP_CALL_OUT_CONF;
+
+                seq = ntohl(tcph->seq) + sizeof(struct pptp_pkt_hdr)
+                                       + sizeof(struct PptpControlHeader)
+                                       + ((void *)pcid - (void *)pptpReq);
+                        
+                if (exp_gre(ct, seq, *cid, *pcid) != 0)
+                        printk("ip_conntrack_pptp: error during exp_gre\n");
+                break;
+
+        case PPTP_IN_CALL_REQUEST:
+                if (reqlen < sizeof(_pptpReq.icack)) {
+                        DEBUGP("%s: short packet\n", pptp_msg_name[msg]);
+                        break;
+                }
+
+                /* server tells us about incoming call request */
+                if (info->sstate != PPTP_SESSION_CONFIRMED) {
+                        DEBUGP("%s but no session\n", pptp_msg_name[msg]);
+                        break;
+                }
+                pcid = &pptpReq->icack.peersCallID;
+                DEBUGP("%s, PCID=%X\n", pptp_msg_name[msg], ntohs(*pcid));
+                info->cstate = PPTP_CALL_IN_REQ;
+                info->pac_call_id = ntohs(*pcid);
+                break;
+
+        case PPTP_IN_CALL_CONNECT:
+                if (reqlen < sizeof(_pptpReq.iccon)) {
+                        DEBUGP("%s: short packet\n", pptp_msg_name[msg]);
+                        break;
+                }
+
+                /* server tells us about incoming call established */
+                if (info->sstate != PPTP_SESSION_CONFIRMED) {
+                        DEBUGP("%s but no session\n", pptp_msg_name[msg]);
+                        break;
+                }
+                if (info->sstate != PPTP_CALL_IN_REP
+                    && info->sstate != PPTP_CALL_IN_CONF) {
+                        DEBUGP("%s but never sent IN_CALL_REPLY\n",
+                                pptp_msg_name[msg]);
+                        break;
+                }
+
+                pcid = &pptpReq->iccon.peersCallID;
+                cid = &info->pac_call_id;
+
+                if (info->pns_call_id != ntohs(*pcid)) {
+                        DEBUGP("%s for unknown CallID %u\n", 
+                                pptp_msg_name[msg], ntohs(*pcid));
+                        break;
+                }
+
+                DEBUGP("%s, PCID=%X\n", pptp_msg_name[msg], ntohs(*pcid));
+                info->cstate = PPTP_CALL_IN_CONF;
+
+                /* we expect a GRE connection from PAC to PNS */
+                seq = ntohl(tcph->seq) + sizeof(struct pptp_pkt_hdr)
+                                       + sizeof(struct PptpControlHeader)
+                                       + ((void *)pcid - (void *)pptpReq);
+                        
+                if (exp_gre(ct, seq, *cid, *pcid) != 0)
+                        printk("ip_conntrack_pptp: error during exp_gre\n");
+
+                break;
+
+        case PPTP_CALL_DISCONNECT_NOTIFY:
+                if (reqlen < sizeof(_pptpReq.disc)) {
+                        DEBUGP("%s: short packet\n", pptp_msg_name[msg]);
+                        break;
+                }
+
+                /* server confirms disconnect */
+                cid = &pptpReq->disc.callID;
+                DEBUGP("%s, CID=%X\n", pptp_msg_name[msg], ntohs(*cid));
+                info->cstate = PPTP_CALL_NONE;
+
+                /* untrack this call id, unexpect GRE packets */
+                pptp_destroy_siblings(ct);
+                break;
+
+        case PPTP_WAN_ERROR_NOTIFY:
+                break;
+
+        case PPTP_ECHO_REQUEST:
+        case PPTP_ECHO_REPLY:
+                /* I don't have to explain these ;) */
+                break;
+        default:
+                DEBUGP("invalid %s (TY=%d)\n", (msg <= PPTP_MSG_MAX)
+                        ? pptp_msg_name[msg]:pptp_msg_name[0], msg);
+                break;
+        }
+
+
+        if (ip_nat_pptp_hook_inbound)
+                return ip_nat_pptp_hook_inbound(pskb, ct, ctinfo, ctlh,
+                                                pptpReq);
+
+        return NF_ACCEPT;
+
+}
+
+static inline int
+pptp_outbound_pkt(struct sk_buff **pskb,
+                  struct tcphdr *tcph,
+                  unsigned int nexthdr_off,
+                  unsigned int datalen,
+                  struct ip_conntrack *ct,
+                  enum ip_conntrack_info ctinfo)
+{
+        struct PptpControlHeader _ctlh, *ctlh;
+        unsigned int reqlen;
+        union pptp_ctrl_union _pptpReq, *pptpReq;
+        struct ip_ct_pptp_master *info = &ct->help.ct_pptp_info;
+        u_int16_t msg;
+        __be16 *cid, *pcid;
+
+        ctlh = skb_header_pointer(*pskb, nexthdr_off, sizeof(_ctlh), &_ctlh);
+        if (!ctlh)
+                return NF_ACCEPT;
+        nexthdr_off += sizeof(_ctlh);
+        datalen -= sizeof(_ctlh);
+        
+        reqlen = datalen;
+        if (reqlen > sizeof(*pptpReq))
+                reqlen = sizeof(*pptpReq);
+        pptpReq = skb_header_pointer(*pskb, nexthdr_off, reqlen, &_pptpReq);
+        if (!pptpReq)
+                return NF_ACCEPT;
+
+        msg = ntohs(ctlh->messageType);
+        DEBUGP("outbound control message %s\n", pptp_msg_name[msg]);
+
+        switch (msg) {
+        case PPTP_START_SESSION_REQUEST:
+                /* client requests for new control session */
+                if (info->sstate != PPTP_SESSION_NONE) {
+                        DEBUGP("%s but we already have one",
+                                pptp_msg_name[msg]);
+                }
+                info->sstate = PPTP_SESSION_REQUESTED;
+                break;
+        case PPTP_STOP_SESSION_REQUEST:
+                /* client requests end of control session */
+                info->sstate = PPTP_SESSION_STOPREQ;
+                break;
+
+        case PPTP_OUT_CALL_REQUEST:
+                if (reqlen < sizeof(_pptpReq.ocreq)) {
+                        DEBUGP("%s: short packet\n", pptp_msg_name[msg]);
+                        /* FIXME: break; */
+                }
+
+                /* client initiating connection to server */
+                if (info->sstate != PPTP_SESSION_CONFIRMED) {
+                        DEBUGP("%s but no session\n",
+                                pptp_msg_name[msg]);
+                        break;
+                }
+                info->cstate = PPTP_CALL_OUT_REQ;
+                /* track PNS call id */
+                cid = &pptpReq->ocreq.callID;
+                DEBUGP("%s, CID=%X\n", pptp_msg_name[msg], ntohs(*cid));
+                info->pns_call_id = ntohs(*cid);
+                break;
+        case PPTP_IN_CALL_REPLY:
+                if (reqlen < sizeof(_pptpReq.icack)) {
+                        DEBUGP("%s: short packet\n", pptp_msg_name[msg]);
+                        break;
+                }
+
+                /* client answers incoming call */
+                if (info->cstate != PPTP_CALL_IN_REQ
+                    && info->cstate != PPTP_CALL_IN_REP) {
+                        DEBUGP("%s without incall_req\n", 
+                                pptp_msg_name[msg]);
+                        break;
+                }
+                if (pptpReq->icack.resultCode != PPTP_INCALL_ACCEPT) {
+                        info->cstate = PPTP_CALL_NONE;
+                        break;
+                }
+                pcid = &pptpReq->icack.peersCallID;
+                if (info->pac_call_id != ntohs(*pcid)) {
+                        DEBUGP("%s for unknown call %u\n", 
+                                pptp_msg_name[msg], ntohs(*pcid));
+                        break;
+                }
+                DEBUGP("%s, CID=%X\n", pptp_msg_name[msg], ntohs(*pcid));
+                /* part two of the three-way handshake */
+                info->cstate = PPTP_CALL_IN_REP;
+                info->pns_call_id = ntohs(pptpReq->icack.callID);
+                break;
+
+        case PPTP_CALL_CLEAR_REQUEST:
+                /* client requests hangup of call */
+                if (info->sstate != PPTP_SESSION_CONFIRMED) {
+                        DEBUGP("CLEAR_CALL but no session\n");
+                        break;
+                }
+                /* FUTURE: iterate over all calls and check if
+                 * call ID is valid.  We don't do this without newnat,
+                 * because we only know about last call */
+                info->cstate = PPTP_CALL_CLEAR_REQ;
+                break;
+        case PPTP_SET_LINK_INFO:
+                break;
+        case PPTP_ECHO_REQUEST:
+        case PPTP_ECHO_REPLY:
+                /* I don't have to explain these ;) */
+                break;
+        default:
+                DEBUGP("invalid %s (TY=%d)\n", (msg <= PPTP_MSG_MAX)? 
+                        pptp_msg_name[msg]:pptp_msg_name[0], msg);
+                /* unknown: no need to create GRE masq table entry */
+                break;
+        }
+        
+        if (ip_nat_pptp_hook_outbound)
+                return ip_nat_pptp_hook_outbound(pskb, ct, ctinfo, ctlh,
+                                                 pptpReq);
+
+        return NF_ACCEPT;
+}
+
+
+/* track caller id inside control connection, call expect_related */
+static int 
+conntrack_pptp_help(struct sk_buff **pskb,
+                    struct ip_conntrack *ct, enum ip_conntrack_info ctinfo)
+
+{
+        struct pptp_pkt_hdr _pptph, *pptph;
+        struct tcphdr _tcph, *tcph;
+        u_int32_t tcplen = (*pskb)->len - (*pskb)->nh.iph->ihl * 4;
+        u_int32_t datalen;
+        int dir = CTINFO2DIR(ctinfo);
+        struct ip_ct_pptp_master *info = &ct->help.ct_pptp_info;
+        unsigned int nexthdr_off;
+
+        int oldsstate, oldcstate;
+        int ret;
+
+        /* don't do any tracking before tcp handshake complete */
+        if (ctinfo != IP_CT_ESTABLISHED 
+            && ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY) {
+                DEBUGP("ctinfo = %u, skipping\n", ctinfo);
+                return NF_ACCEPT;
+        }
+        
+        nexthdr_off = (*pskb)->nh.iph->ihl*4;
+        tcph = skb_header_pointer(*pskb, nexthdr_off, sizeof(_tcph), &_tcph);
+        BUG_ON(!tcph);
+        nexthdr_off += tcph->doff * 4;
+        datalen = tcplen - tcph->doff * 4;
+
+        if (tcph->fin || tcph->rst) {
+                DEBUGP("RST/FIN received, timeouting GRE\n");
+                /* can't do this after real newnat */
+                info->cstate = PPTP_CALL_NONE;
+
+                /* untrack this call id, unexpect GRE packets */
+                pptp_destroy_siblings(ct);
+        }
+
+        pptph = skb_header_pointer(*pskb, nexthdr_off, sizeof(_pptph), &_pptph);
+        if (!pptph) {
+                DEBUGP("no full PPTP header, can't track\n");
+                return NF_ACCEPT;
+        }
+        nexthdr_off += sizeof(_pptph);
+        datalen -= sizeof(_pptph);
+
+        /* if it's not a control message we can't do anything with it */
+        if (ntohs(pptph->packetType) != PPTP_PACKET_CONTROL ||
+            ntohl(pptph->magicCookie) != PPTP_MAGIC_COOKIE) {
+                DEBUGP("not a control packet\n");
+                return NF_ACCEPT;
+        }
+
+        oldsstate = info->sstate;
+        oldcstate = info->cstate;
+
+        spin_lock_bh(&ip_pptp_lock);
+
+        /* FIXME: We just blindly assume that the control connection is always
+         * established from PNS->PAC.  However, RFC makes no guarantee */
+        if (dir == IP_CT_DIR_ORIGINAL)
+                /* client -> server (PNS -> PAC) */
+                ret = pptp_outbound_pkt(pskb, tcph, nexthdr_off, datalen, ct,
+                                        ctinfo);
+        else
+                /* server -> client (PAC -> PNS) */
+                ret = pptp_inbound_pkt(pskb, tcph, nexthdr_off, datalen, ct,
+                                       ctinfo);
+        DEBUGP("sstate: %d->%d, cstate: %d->%d\n",
+                oldsstate, info->sstate, oldcstate, info->cstate);
+        spin_unlock_bh(&ip_pptp_lock);
+
+        return ret;
+}
+
+/* control protocol helper */
+static struct ip_conntrack_helper pptp = { 
+        .list = { NULL, NULL },
+        .name = "pptp", 
+        .me = THIS_MODULE,
+        .max_expected = 2,
+        .timeout = 5 * 60,
+        .tuple = { .src = { .ip = 0, 
+                            .u = { .tcp = { .port =  
+                                    __constant_htons(PPTP_CONTROL_PORT) } } 
+                          }, 
+                   .dst = { .ip = 0, 
+                            .u = { .all = 0 },
+                            .protonum = IPPROTO_TCP
+                          } 
+                 },
+        .mask = { .src = { .ip = 0, 
+                           .u = { .tcp = { .port = __constant_htons(0xffff) } } 
+                         }, 
+                  .dst = { .ip = 0, 
+                           .u = { .all = 0 },
+                           .protonum = 0xff 
+                         } 
+                },
+        .help = conntrack_pptp_help
+};
+
+extern void __exit ip_ct_proto_gre_fini(void);
+extern int __init ip_ct_proto_gre_init(void);
+
+/* ip_conntrack_pptp initialization */
+static int __init init(void)
+{
+        int retcode;
+ 
+        retcode = ip_ct_proto_gre_init();
+        if (retcode < 0)
+                return retcode;
+
+        DEBUGP(" registering helper\n");
+        if ((retcode = ip_conntrack_helper_register(&pptp))) {
+                printk(KERN_ERR "Unable to register conntrack application "
+                                "helper for pptp: %d\n", retcode);
+                ip_ct_proto_gre_fini();
+                return retcode;
+        }
+
+        printk("ip_conntrack_pptp version %s loaded\n", IP_CT_PPTP_VERSION);
+        return 0;
+}
+
+static void __exit fini(void)
+{
+        ip_conntrack_helper_unregister(&pptp);
+        ip_ct_proto_gre_fini();
+        printk("ip_conntrack_pptp version %s unloaded\n", IP_CT_PPTP_VERSION);
+}
+
+module_init(init);
+module_exit(fini);
+
+EXPORT_SYMBOL(ip_nat_pptp_hook_outbound);
+EXPORT_SYMBOL(ip_nat_pptp_hook_inbound);
+EXPORT_SYMBOL(ip_nat_pptp_hook_exp_gre);
+EXPORT_SYMBOL(ip_nat_pptp_hook_expectfn);
diff --git a/net/ipv4/netfilter/ip_conntrack_irc.c b/net/ipv4/netfilter/ip_conntrack_irc.c
index d7a8a98c05e1..15457415a4f3 100644
--- a/net/ipv4/netfilter/ip_conntrack_irc.c
+++ b/net/ipv4/netfilter/ip_conntrack_irc.c
@@ -34,7 +34,7 @@
 #include <linux/moduleparam.h>
 
 #define MAX_PORTS 8
-static int ports[MAX_PORTS];
+static short ports[MAX_PORTS];
 static int ports_c;
 static int max_dcc_channels = 8;
 static unsigned int dcc_timeout = 300;
@@ -52,7 +52,7 @@ EXPORT_SYMBOL_GPL(ip_nat_irc_hook);
 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
 MODULE_DESCRIPTION("IRC (DCC) connection tracking helper");
 MODULE_LICENSE("GPL");
-module_param_array(ports, int, &ports_c, 0400);
+module_param_array(ports, short, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "port numbers of IRC servers");
 module_param(max_dcc_channels, int, 0400);
 MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per IRC session");
@@ -240,7 +240,7 @@ static int help(struct sk_buff **pskb,
 }
 
 static struct ip_conntrack_helper irc_helpers[MAX_PORTS];
-static char irc_names[MAX_PORTS][10];
+static char irc_names[MAX_PORTS][sizeof("irc-65535")];
 
 static void fini(void);
 
diff --git a/net/ipv4/netfilter/ip_conntrack_netbios_ns.c b/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
index bb7246683b74..186646eb249f 100644
--- a/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
+++ b/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
@@ -23,7 +23,6 @@
 #include <linux/inetdevice.h>
 #include <linux/in.h>
 #include <linux/ip.h>
-#include <linux/udp.h>
 #include <net/route.h>
 
 #include <linux/netfilter.h>
@@ -31,6 +30,8 @@
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
 
+#define NMBD_PORT       137
+
 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 MODULE_DESCRIPTION("NetBIOS name service broadcast connection tracking helper");
 MODULE_LICENSE("GPL");
@@ -44,7 +45,6 @@ static int help(struct sk_buff **pskb,
 {
         struct ip_conntrack_expect *exp;
         struct iphdr *iph = (*pskb)->nh.iph;
-        struct udphdr _uh, *uh;
         struct rtable *rt = (struct rtable *)(*pskb)->dst;
         struct in_device *in_dev;
         u_int32_t mask = 0;
@@ -58,7 +58,7 @@ static int help(struct sk_buff **pskb,
                 goto out;
 
         rcu_read_lock();
-        in_dev = __in_dev_get(rt->u.dst.dev);
+        in_dev = __in_dev_get_rcu(rt->u.dst.dev);
         if (in_dev != NULL) {
                 for_primary_ifa(in_dev) {
                         if (ifa->ifa_broadcast == iph->daddr) {
@@ -72,20 +72,15 @@ static int help(struct sk_buff **pskb,
         if (mask == 0)
                 goto out;
 
-        uh = skb_header_pointer(*pskb, iph->ihl * 4, sizeof(_uh), &_uh);
-        BUG_ON(uh == NULL);
-
         exp = ip_conntrack_expect_alloc(ct);
         if (exp == NULL)
                 goto out;
-        memset(&exp->tuple, 0, sizeof(exp->tuple));
-        exp->tuple.src.ip         = iph->daddr & mask;
-        exp->tuple.dst.ip         = iph->saddr;
-        exp->tuple.dst.u.udp.port = uh->source;
-        exp->tuple.dst.protonum   = IPPROTO_UDP;
 
-        memset(&exp->mask, 0, sizeof(exp->mask));
+        exp->tuple                = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+        exp->tuple.src.u.udp.port = ntohs(NMBD_PORT);
+
         exp->mask.src.ip          = mask;
+        exp->mask.src.u.udp.port  = 0xFFFF;
         exp->mask.dst.ip          = 0xFFFFFFFF;
         exp->mask.dst.u.udp.port  = 0xFFFF;
         exp->mask.dst.protonum    = 0xFF;
@@ -96,7 +91,7 @@ static int help(struct sk_buff **pskb,
         ip_conntrack_expect_related(exp);
         ip_conntrack_expect_put(exp);
 
-        ip_ct_refresh_acct(ct, ctinfo, NULL, timeout * HZ);
+        ip_ct_refresh(ct, *pskb, timeout * HZ);
 out:
         return NF_ACCEPT;
 }
@@ -107,7 +102,7 @@ static struct ip_conntrack_helper helper = {
                 .src = {
                         .u = {
                                 .udp = {
-                                        .port   = __constant_htons(137),
+                                        .port   = __constant_htons(NMBD_PORT),
                                 }
                         }
                 },
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 15aef3564742..b08a432efcf8 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -1270,7 +1270,7 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        exp = ip_conntrack_expect_find_get(&tuple);
+        exp = ip_conntrack_expect_find(&tuple);
         if (!exp)
                 return -ENOENT;
 
@@ -1318,7 +1318,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                         return err;
 
                 /* bump usage count to 2 */
-                exp = ip_conntrack_expect_find_get(&tuple);
+                exp = ip_conntrack_expect_find(&tuple);
                 if (!exp)
                         return -ENOENT;
 
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_gre.c b/net/ipv4/netfilter/ip_conntrack_proto_gre.c
new file mode 100644
index 000000000000..744abb9d377a
--- /dev/null
+++ b/net/ipv4/netfilter/ip_conntrack_proto_gre.c
@@ -0,0 +1,328 @@
+/*
+ * ip_conntrack_proto_gre.c - Version 3.0 
+ *
+ * Connection tracking protocol helper module for GRE.
+ *
+ * GRE is a generic encapsulation protocol, which is generally not very
+ * suited for NAT, as it has no protocol-specific part as port numbers.
+ *
+ * It has an optional key field, which may help us distinguishing two 
+ * connections between the same two hosts.
+ *
+ * GRE is defined in RFC 1701 and RFC 1702, as well as RFC 2784 
+ *
+ * PPTP is built on top of a modified version of GRE, and has a mandatory
+ * field called "CallID", which serves us for the same purpose as the key
+ * field in plain GRE.
+ *
+ * Documentation about PPTP can be found in RFC 2637
+ *
+ * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org>
+ *
+ * Development of this code funded by Astaro AG (http://www.astaro.com/)
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/timer.h>
+#include <linux/netfilter.h>
+#include <linux/ip.h>
+#include <linux/in.h>
+#include <linux/list.h>
+
+static DEFINE_RWLOCK(ip_ct_gre_lock);
+#define ASSERT_READ_LOCK(x)
+#define ASSERT_WRITE_LOCK(x)
+
+#include <linux/netfilter_ipv4/listhelp.h>
+#include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
+#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
+
+#include <linux/netfilter_ipv4/ip_conntrack_proto_gre.h>
+#include <linux/netfilter_ipv4/ip_conntrack_pptp.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
+MODULE_DESCRIPTION("netfilter connection tracking protocol helper for GRE");
+
+/* shamelessly stolen from ip_conntrack_proto_udp.c */
+#define GRE_TIMEOUT             (30*HZ)
+#define GRE_STREAM_TIMEOUT      (180*HZ)
+
+#if 0
+#define DEBUGP(format, args...) printk(KERN_DEBUG "%s:%s: " format, __FILE__, __FUNCTION__, ## args)
+#define DUMP_TUPLE_GRE(x) printk("%u.%u.%u.%u:0x%x -> %u.%u.%u.%u:0x%x\n", \
+                        NIPQUAD((x)->src.ip), ntohs((x)->src.u.gre.key), \
+                        NIPQUAD((x)->dst.ip), ntohs((x)->dst.u.gre.key))
+#else
+#define DEBUGP(x, args...)
+#define DUMP_TUPLE_GRE(x)
+#endif
+                                
+/* GRE KEYMAP HANDLING FUNCTIONS */
+static LIST_HEAD(gre_keymap_list);
+
+static inline int gre_key_cmpfn(const struct ip_ct_gre_keymap *km,
+                                const struct ip_conntrack_tuple *t)
+{
+        return ((km->tuple.src.ip == t->src.ip) &&
+                (km->tuple.dst.ip == t->dst.ip) &&
+                (km->tuple.dst.protonum == t->dst.protonum) &&
+                (km->tuple.dst.u.all == t->dst.u.all));
+}
+
+/* look up the source key for a given tuple */
+static u_int32_t gre_keymap_lookup(struct ip_conntrack_tuple *t)
+{
+        struct ip_ct_gre_keymap *km;
+        u_int32_t key = 0;
+
+        read_lock_bh(&ip_ct_gre_lock);
+        km = LIST_FIND(&gre_keymap_list, gre_key_cmpfn,
+                        struct ip_ct_gre_keymap *, t);
+        if (km)
+                key = km->tuple.src.u.gre.key;
+        read_unlock_bh(&ip_ct_gre_lock);
+        
+        DEBUGP("lookup src key 0x%x up key for ", key);
+        DUMP_TUPLE_GRE(t);
+
+        return key;
+}
+
+/* add a single keymap entry, associate with specified master ct */
+int
+ip_ct_gre_keymap_add(struct ip_conntrack *ct,
+                     struct ip_conntrack_tuple *t, int reply)
+{
+        struct ip_ct_gre_keymap **exist_km, *km, *old;
+
+        if (!ct->helper || strcmp(ct->helper->name, "pptp")) {
+                DEBUGP("refusing to add GRE keymap to non-pptp session\n");
+                return -1;
+        }
+
+        if (!reply) 
+                exist_km = &ct->help.ct_pptp_info.keymap_orig;
+        else
+                exist_km = &ct->help.ct_pptp_info.keymap_reply;
+
+        if (*exist_km) {
+                /* check whether it's a retransmission */
+                old = LIST_FIND(&gre_keymap_list, gre_key_cmpfn,
+                                struct ip_ct_gre_keymap *, t);
+                if (old == *exist_km) {
+                        DEBUGP("retransmission\n");
+                        return 0;
+                }
+
+                DEBUGP("trying to override keymap_%s for ct %p\n", 
+                        reply? "reply":"orig", ct);
+                return -EEXIST;
+        }
+
+        km = kmalloc(sizeof(*km), GFP_ATOMIC);
+        if (!km)
+                return -ENOMEM;
+
+        memcpy(&km->tuple, t, sizeof(*t));
+        *exist_km = km;
+
+        DEBUGP("adding new entry %p: ", km);
+        DUMP_TUPLE_GRE(&km->tuple);
+
+        write_lock_bh(&ip_ct_gre_lock);
+        list_append(&gre_keymap_list, km);
+        write_unlock_bh(&ip_ct_gre_lock);
+
+        return 0;
+}
+
+/* destroy the keymap entries associated with specified master ct */
+void ip_ct_gre_keymap_destroy(struct ip_conntrack *ct)
+{
+        DEBUGP("entering for ct %p\n", ct);
+
+        if (!ct->helper || strcmp(ct->helper->name, "pptp")) {
+                DEBUGP("refusing to destroy GRE keymap to non-pptp session\n");
+                return;
+        }
+
+        write_lock_bh(&ip_ct_gre_lock);
+        if (ct->help.ct_pptp_info.keymap_orig) {
+                DEBUGP("removing %p from list\n", 
+                        ct->help.ct_pptp_info.keymap_orig);
+                list_del(&ct->help.ct_pptp_info.keymap_orig->list);
+                kfree(ct->help.ct_pptp_info.keymap_orig);
+                ct->help.ct_pptp_info.keymap_orig = NULL;
+        }
+        if (ct->help.ct_pptp_info.keymap_reply) {
+                DEBUGP("removing %p from list\n",
+                        ct->help.ct_pptp_info.keymap_reply);
+                list_del(&ct->help.ct_pptp_info.keymap_reply->list);
+                kfree(ct->help.ct_pptp_info.keymap_reply);
+                ct->help.ct_pptp_info.keymap_reply = NULL;
+        }
+        write_unlock_bh(&ip_ct_gre_lock);
+}
+
+
+/* PUBLIC CONNTRACK PROTO HELPER FUNCTIONS */
+
+/* invert gre part of tuple */
+static int gre_invert_tuple(struct ip_conntrack_tuple *tuple,
+                            const struct ip_conntrack_tuple *orig)
+{
+        tuple->dst.u.gre.key = orig->src.u.gre.key;
+        tuple->src.u.gre.key = orig->dst.u.gre.key;
+
+        return 1;
+}
+
+/* gre hdr info to tuple */
+static int gre_pkt_to_tuple(const struct sk_buff *skb,
+                           unsigned int dataoff,
+                           struct ip_conntrack_tuple *tuple)
+{
+        struct gre_hdr_pptp _pgrehdr, *pgrehdr;
+        u_int32_t srckey;
+        struct gre_hdr _grehdr, *grehdr;
+
+        /* first only delinearize old RFC1701 GRE header */
+        grehdr = skb_header_pointer(skb, dataoff, sizeof(_grehdr), &_grehdr);
+        if (!grehdr || grehdr->version != GRE_VERSION_PPTP) {
+                /* try to behave like "ip_conntrack_proto_generic" */
+                tuple->src.u.all = 0;
+                tuple->dst.u.all = 0;
+                return 1;
+        }
+
+        /* PPTP header is variable length, only need up to the call_id field */
+        pgrehdr = skb_header_pointer(skb, dataoff, 8, &_pgrehdr);
+        if (!pgrehdr)
+                return 1;
+
+        if (ntohs(grehdr->protocol) != GRE_PROTOCOL_PPTP) {
+                DEBUGP("GRE_VERSION_PPTP but unknown proto\n");
+                return 0;
+        }
+
+        tuple->dst.u.gre.key = pgrehdr->call_id;
+        srckey = gre_keymap_lookup(tuple);
+        tuple->src.u.gre.key = srckey;
+
+        return 1;
+}
+
+/* print gre part of tuple */
+static int gre_print_tuple(struct seq_file *s,
+                           const struct ip_conntrack_tuple *tuple)
+{
+        return seq_printf(s, "srckey=0x%x dstkey=0x%x ", 
+                          ntohs(tuple->src.u.gre.key),
+                          ntohs(tuple->dst.u.gre.key));
+}
+
+/* print private data for conntrack */
+static int gre_print_conntrack(struct seq_file *s,
+                               const struct ip_conntrack *ct)
+{
+        return seq_printf(s, "timeout=%u, stream_timeout=%u ",
+                          (ct->proto.gre.timeout / HZ),
+                          (ct->proto.gre.stream_timeout / HZ));
+}
+
+/* Returns verdict for packet, and may modify conntrack */
+static int gre_packet(struct ip_conntrack *ct,
+                      const struct sk_buff *skb,
+                      enum ip_conntrack_info conntrackinfo)
+{
+        /* If we've seen traffic both ways, this is a GRE connection.
+         * Extend timeout. */
+        if (ct->status & IPS_SEEN_REPLY) {
+                ip_ct_refresh_acct(ct, conntrackinfo, skb,
+                                   ct->proto.gre.stream_timeout);
+                /* Also, more likely to be important, and not a probe. */
+                set_bit(IPS_ASSURED_BIT, &ct->status);
+                ip_conntrack_event_cache(IPCT_STATUS, skb);
+        } else
+                ip_ct_refresh_acct(ct, conntrackinfo, skb,
+                                   ct->proto.gre.timeout);
+        
+        return NF_ACCEPT;
+}
+
+/* Called when a new connection for this protocol found. */
+static int gre_new(struct ip_conntrack *ct,
+                   const struct sk_buff *skb)
+{ 
+        DEBUGP(": ");
+        DUMP_TUPLE_GRE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+
+        /* initialize to sane value.  Ideally a conntrack helper
+         * (e.g. in case of pptp) is increasing them */
+        ct->proto.gre.stream_timeout = GRE_STREAM_TIMEOUT;
+        ct->proto.gre.timeout = GRE_TIMEOUT;
+
+        return 1;
+}
+
+/* Called when a conntrack entry has already been removed from the hashes
+ * and is about to be deleted from memory */
+static void gre_destroy(struct ip_conntrack *ct)
+{
+        struct ip_conntrack *master = ct->master;
+        DEBUGP(" entering\n");
+
+        if (!master)
+                DEBUGP("no master !?!\n");
+        else
+                ip_ct_gre_keymap_destroy(master);
+}
+
+/* protocol helper struct */
+static struct ip_conntrack_protocol gre = { 
+        .proto           = IPPROTO_GRE,
+        .name            = "gre", 
+        .pkt_to_tuple    = gre_pkt_to_tuple,
+        .invert_tuple    = gre_invert_tuple,
+        .print_tuple     = gre_print_tuple,
+        .print_conntrack = gre_print_conntrack,
+        .packet          = gre_packet,
+        .new             = gre_new,
+        .destroy         = gre_destroy,
+        .me              = THIS_MODULE,
+#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
+    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
+        .tuple_to_nfattr = ip_ct_port_tuple_to_nfattr,
+        .nfattr_to_tuple = ip_ct_port_nfattr_to_tuple,
+#endif
+};
+
+/* ip_conntrack_proto_gre initialization */
+int __init ip_ct_proto_gre_init(void)
+{
+        return ip_conntrack_protocol_register(&gre);
+}
+
+void __exit ip_ct_proto_gre_fini(void)
+{
+        struct list_head *pos, *n;
+
+        /* delete all keymap entries */
+        write_lock_bh(&ip_ct_gre_lock);
+        list_for_each_safe(pos, n, &gre_keymap_list) {
+                DEBUGP("deleting keymap %p at module unload time\n", pos);
+                list_del(pos);
+                kfree(pos);
+        }
+        write_unlock_bh(&ip_ct_gre_lock);
+
+        ip_conntrack_protocol_unregister(&gre); 
+}
+
+EXPORT_SYMBOL(ip_ct_gre_keymap_add);
+EXPORT_SYMBOL(ip_ct_gre_keymap_destroy);
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
index a875f35e576d..59a4a0111dd3 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
@@ -416,6 +416,7 @@ static int sctp_packet(struct ip_conntrack *conntrack,
                 && newconntrack == SCTP_CONNTRACK_ESTABLISHED) {
                 DEBUGP("Setting assured bit\n");
                 set_bit(IPS_ASSURED_BIT, &conntrack->status);
+                ip_conntrack_event_cache(IPCT_STATUS, skb);
         }
 
         return NF_ACCEPT;
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index 1985abc59d24..121760d6cc50 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -1014,7 +1014,8 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                 /* Set ASSURED if we see see valid ack in ESTABLISHED 
                    after SYN_RECV or a valid answer for a picked up 
                    connection. */
-                        set_bit(IPS_ASSURED_BIT, &conntrack->status);
+                set_bit(IPS_ASSURED_BIT, &conntrack->status);
+                ip_conntrack_event_cache(IPCT_STATUS, skb);
         }
         ip_ct_refresh_acct(conntrack, ctinfo, skb, timeout);
 
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index ae3e3e655db5..dd476b191f4b 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -989,15 +989,15 @@ EXPORT_SYMBOL(need_ip_conntrack);
 EXPORT_SYMBOL(ip_conntrack_helper_register);
 EXPORT_SYMBOL(ip_conntrack_helper_unregister);
 EXPORT_SYMBOL(ip_ct_iterate_cleanup);
-EXPORT_SYMBOL(ip_ct_refresh_acct);
+EXPORT_SYMBOL(__ip_ct_refresh_acct);
 
 EXPORT_SYMBOL(ip_conntrack_expect_alloc);
 EXPORT_SYMBOL(ip_conntrack_expect_put);
-EXPORT_SYMBOL_GPL(ip_conntrack_expect_find_get);
+EXPORT_SYMBOL_GPL(__ip_conntrack_expect_find);
+EXPORT_SYMBOL_GPL(ip_conntrack_expect_find);
 EXPORT_SYMBOL(ip_conntrack_expect_related);
 EXPORT_SYMBOL(ip_conntrack_unexpect_related);
 EXPORT_SYMBOL_GPL(ip_conntrack_expect_list);
-EXPORT_SYMBOL_GPL(__ip_conntrack_expect_find);
 EXPORT_SYMBOL_GPL(ip_ct_unlink_expect);
 
 EXPORT_SYMBOL(ip_conntrack_tuple_taken);
diff --git a/net/ipv4/netfilter/ip_conntrack_tftp.c b/net/ipv4/netfilter/ip_conntrack_tftp.c
index d2b590533452..a78736b8525d 100644
--- a/net/ipv4/netfilter/ip_conntrack_tftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_tftp.c
@@ -26,9 +26,9 @@ MODULE_DESCRIPTION("tftp connection tracking helper");
 MODULE_LICENSE("GPL");
 
 #define MAX_PORTS 8
-static int ports[MAX_PORTS];
+static short ports[MAX_PORTS];
 static int ports_c;
-module_param_array(ports, int, &ports_c, 0400);
+module_param_array(ports, short, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "port numbers of tftp servers");
 
 #if 0
@@ -100,7 +100,7 @@ static int tftp_help(struct sk_buff **pskb,
 }
 
 static struct ip_conntrack_helper tftp[MAX_PORTS];
-static char tftp_names[MAX_PORTS][10];
+static char tftp_names[MAX_PORTS][sizeof("tftp-65535")];
 
 static void fini(void)
 {
diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
index 1adedb743f60..c5e3abd24672 100644
--- a/net/ipv4/netfilter/ip_nat_core.c
+++ b/net/ipv4/netfilter/ip_nat_core.c
@@ -74,12 +74,14 @@ ip_nat_proto_find_get(u_int8_t protonum)
 
         return p;
 }
+EXPORT_SYMBOL_GPL(ip_nat_proto_find_get);
 
 void
 ip_nat_proto_put(struct ip_nat_protocol *p)
 {
         module_put(p->me);
 }
+EXPORT_SYMBOL_GPL(ip_nat_proto_put);
 
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
@@ -111,6 +113,7 @@ ip_nat_cheat_check(u_int32_t oldvalinv, u_int32_t newval, u_int16_t oldcheck)
         return csum_fold(csum_partial((char *)diffs, sizeof(diffs),
                                       oldcheck^0xFFFF));
 }
+EXPORT_SYMBOL(ip_nat_cheat_check);
 
 /* Is this tuple already taken? (not by us) */
 int
@@ -127,6 +130,7 @@ ip_nat_used_tuple(const struct ip_conntrack_tuple *tuple,
         invert_tuplepr(&reply, tuple);
         return ip_conntrack_tuple_taken(&reply, ignored_conntrack);
 }
+EXPORT_SYMBOL(ip_nat_used_tuple);
 
 /* If we source map this tuple so reply looks like reply_tuple, will
  * that meet the constraints of range. */
@@ -347,6 +351,7 @@ ip_nat_setup_info(struct ip_conntrack *conntrack,
 
         return NF_ACCEPT;
 }
+EXPORT_SYMBOL(ip_nat_setup_info);
 
 /* Returns true if succeeded. */
 static int
@@ -387,10 +392,10 @@ manip_pkt(u_int16_t proto,
 }
 
 /* Do packet manipulations according to ip_nat_setup_info. */
-unsigned int nat_packet(struct ip_conntrack *ct,
-                        enum ip_conntrack_info ctinfo,
-                        unsigned int hooknum,
-                        struct sk_buff **pskb)
+unsigned int ip_nat_packet(struct ip_conntrack *ct,
+                           enum ip_conntrack_info ctinfo,
+                           unsigned int hooknum,
+                           struct sk_buff **pskb)
 {
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         unsigned long statusbit;
@@ -417,12 +422,13 @@ unsigned int nat_packet(struct ip_conntrack *ct,
         }
         return NF_ACCEPT;
 }
+EXPORT_SYMBOL_GPL(ip_nat_packet);
 
 /* Dir is direction ICMP is coming from (opposite to packet it contains) */
-int icmp_reply_translation(struct sk_buff **pskb,
-                           struct ip_conntrack *ct,
-                           enum ip_nat_manip_type manip,
-                           enum ip_conntrack_dir dir)
+int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
+                                  struct ip_conntrack *ct,
+                                  enum ip_nat_manip_type manip,
+                                  enum ip_conntrack_dir dir)
 {
         struct {
                 struct icmphdr icmp;
@@ -509,6 +515,7 @@ int icmp_reply_translation(struct sk_buff **pskb,
 
         return 1;
 }
+EXPORT_SYMBOL_GPL(ip_nat_icmp_reply_translation);
 
 /* Protocol registration. */
 int ip_nat_protocol_register(struct ip_nat_protocol *proto)
@@ -525,6 +532,7 @@ int ip_nat_protocol_register(struct ip_nat_protocol *proto)
         write_unlock_bh(&ip_nat_lock);
         return ret;
 }
+EXPORT_SYMBOL(ip_nat_protocol_register);
 
 /* Noone stores the protocol anywhere; simply delete it. */
 void ip_nat_protocol_unregister(struct ip_nat_protocol *proto)
@@ -536,6 +544,7 @@ void ip_nat_protocol_unregister(struct ip_nat_protocol *proto)
         /* Someone could be still looking at the proto in a bh. */
         synchronize_net();
 }
+EXPORT_SYMBOL(ip_nat_protocol_unregister);
 
 #if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
     defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
@@ -578,9 +587,11 @@ ip_nat_port_nfattr_to_range(struct nfattr *tb[], struct ip_nat_range *range)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(ip_nat_port_nfattr_to_range);
+EXPORT_SYMBOL_GPL(ip_nat_port_range_to_nfattr);
 #endif
 
-int __init ip_nat_init(void)
+static int __init ip_nat_init(void)
 {
         size_t i;
 
@@ -622,10 +633,14 @@ static int clean_nat(struct ip_conntrack *i, void *data)
         return 0;
 }
 
-/* Not __exit: called from ip_nat_standalone.c:init_or_cleanup() --RR */
-void ip_nat_cleanup(void)
+static void __exit ip_nat_cleanup(void)
 {
         ip_ct_iterate_cleanup(&clean_nat, NULL);
         ip_conntrack_destroyed = NULL;
         vfree(bysource);
 }
+
+MODULE_LICENSE("GPL");
+
+module_init(ip_nat_init);
+module_exit(ip_nat_cleanup);
diff --git a/net/ipv4/netfilter/ip_nat_helper.c b/net/ipv4/netfilter/ip_nat_helper.c
index d2dd5d313556..5d506e0564d5 100644
--- a/net/ipv4/netfilter/ip_nat_helper.c
+++ b/net/ipv4/netfilter/ip_nat_helper.c
@@ -199,6 +199,7 @@ ip_nat_mangle_tcp_packet(struct sk_buff **pskb,
         }
         return 1;
 }
+EXPORT_SYMBOL(ip_nat_mangle_tcp_packet);
                         
 /* Generic function for mangling variable-length address changes inside
  * NATed UDP connections (like the CONNECT DATA XXXXX MESG XXXXX INDEX XXXXX
@@ -256,6 +257,7 @@ ip_nat_mangle_udp_packet(struct sk_buff **pskb,
 
         return 1;
 }
+EXPORT_SYMBOL(ip_nat_mangle_udp_packet);
 
 /* Adjust one found SACK option including checksum correction */
 static void
@@ -399,6 +401,7 @@ ip_nat_seq_adjust(struct sk_buff **pskb,
 
         return 1;
 }
+EXPORT_SYMBOL(ip_nat_seq_adjust);
 
 /* Setup NAT on this expected conntrack so it follows master. */
 /* If we fail to get a free NAT slot, we'll get dropped on confirm */
@@ -425,3 +428,4 @@ void ip_nat_follow_master(struct ip_conntrack *ct,
         /* hook doesn't matter, but it has to do destination manip */
         ip_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING);
 }
+EXPORT_SYMBOL(ip_nat_follow_master);
diff --git a/net/ipv4/netfilter/ip_nat_helper_pptp.c b/net/ipv4/netfilter/ip_nat_helper_pptp.c
new file mode 100644
index 000000000000..3cdd0684d30d
--- /dev/null
+++ b/net/ipv4/netfilter/ip_nat_helper_pptp.c
@@ -0,0 +1,401 @@
+/*
+ * ip_nat_pptp.c        - Version 3.0
+ *
+ * NAT support for PPTP (Point to Point Tunneling Protocol).
+ * PPTP is a a protocol for creating virtual private networks.
+ * It is a specification defined by Microsoft and some vendors
+ * working with Microsoft.  PPTP is built on top of a modified
+ * version of the Internet Generic Routing Encapsulation Protocol.
+ * GRE is defined in RFC 1701 and RFC 1702.  Documentation of
+ * PPTP can be found in RFC 2637
+ *
+ * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org>
+ *
+ * Development of this code funded by Astaro AG (http://www.astaro.com/)
+ *
+ * TODO: - NAT to a unique tuple, not to TCP source port
+ *         (needs netfilter tuple reservation)
+ *
+ * Changes:
+ *     2002-02-10 - Version 1.3
+ *       - Use ip_nat_mangle_tcp_packet() because of cloned skb's
+ *         in local connections (Philip Craig <philipc@snapgear.com>)
+ *       - add checks for magicCookie and pptp version
+ *       - make argument list of pptp_{out,in}bound_packet() shorter
+ *       - move to C99 style initializers
+ *       - print version number at module loadtime
+ *     2003-09-22 - Version 1.5
+ *       - use SNATed tcp sourceport as callid, since we get called before
+ *         TCP header is mangled (Philip Craig <philipc@snapgear.com>)
+ *     2004-10-22 - Version 2.0
+ *       - kernel 2.6.x version
+ *     2005-06-10 - Version 3.0
+ *       - kernel >= 2.6.11 version,
+ *         funded by Oxcoda NetBox Blue (http://www.netboxblue.com/)
+ * 
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <net/tcp.h>
+
+#include <linux/netfilter_ipv4/ip_nat.h>
+#include <linux/netfilter_ipv4/ip_nat_rule.h>
+#include <linux/netfilter_ipv4/ip_nat_helper.h>
+#include <linux/netfilter_ipv4/ip_nat_pptp.h>
+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
+#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
+#include <linux/netfilter_ipv4/ip_conntrack_proto_gre.h>
+#include <linux/netfilter_ipv4/ip_conntrack_pptp.h>
+
+#define IP_NAT_PPTP_VERSION "3.0"
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
+MODULE_DESCRIPTION("Netfilter NAT helper module for PPTP");
+
+
+#if 0
+extern const char *pptp_msg_name[];
+#define DEBUGP(format, args...) printk(KERN_DEBUG "%s:%s: " format, __FILE__, \
+                                       __FUNCTION__, ## args)
+#else
+#define DEBUGP(format, args...)
+#endif
+
+static void pptp_nat_expected(struct ip_conntrack *ct,
+                              struct ip_conntrack_expect *exp)
+{
+        struct ip_conntrack *master = ct->master;
+        struct ip_conntrack_expect *other_exp;
+        struct ip_conntrack_tuple t;
+        struct ip_ct_pptp_master *ct_pptp_info;
+        struct ip_nat_pptp *nat_pptp_info;
+
+        ct_pptp_info = &master->help.ct_pptp_info;
+        nat_pptp_info = &master->nat.help.nat_pptp_info;
+
+        /* And here goes the grand finale of corrosion... */
+
+        if (exp->dir == IP_CT_DIR_ORIGINAL) {
+                DEBUGP("we are PNS->PAC\n");
+                /* therefore, build tuple for PAC->PNS */
+                t.src.ip = master->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;
+                t.src.u.gre.key = htons(master->help.ct_pptp_info.pac_call_id);
+                t.dst.ip = master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;
+                t.dst.u.gre.key = htons(master->help.ct_pptp_info.pns_call_id);
+                t.dst.protonum = IPPROTO_GRE;
+        } else {
+                DEBUGP("we are PAC->PNS\n");
+                /* build tuple for PNS->PAC */
+                t.src.ip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
+                t.src.u.gre.key = 
+                        htons(master->nat.help.nat_pptp_info.pns_call_id);
+                t.dst.ip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;
+                t.dst.u.gre.key = 
+                        htons(master->nat.help.nat_pptp_info.pac_call_id);
+                t.dst.protonum = IPPROTO_GRE;
+        }
+
+        DEBUGP("trying to unexpect other dir: ");
+        DUMP_TUPLE(&t);
+        other_exp = ip_conntrack_expect_find(&t);
+        if (other_exp) {
+                ip_conntrack_unexpect_related(other_exp);
+                ip_conntrack_expect_put(other_exp);
+                DEBUGP("success\n");
+        } else {
+                DEBUGP("not found!\n");
+        }
+
+        ip_nat_follow_master(ct, exp);
+}
+
+/* outbound packets == from PNS to PAC */
+static int
+pptp_outbound_pkt(struct sk_buff **pskb,
+                  struct ip_conntrack *ct,
+                  enum ip_conntrack_info ctinfo,
+                  struct PptpControlHeader *ctlh,
+                  union pptp_ctrl_union *pptpReq)
+
+{
+        struct ip_ct_pptp_master *ct_pptp_info = &ct->help.ct_pptp_info;
+        struct ip_nat_pptp *nat_pptp_info = &ct->nat.help.nat_pptp_info;
+
+        u_int16_t msg, *cid = NULL, new_callid;
+
+        new_callid = htons(ct_pptp_info->pns_call_id);
+        
+        switch (msg = ntohs(ctlh->messageType)) {
+                case PPTP_OUT_CALL_REQUEST:
+                        cid = &pptpReq->ocreq.callID;
+                        /* FIXME: ideally we would want to reserve a call ID
+                         * here.  current netfilter NAT core is not able to do
+                         * this :( For now we use TCP source port. This breaks
+                         * multiple calls within one control session */
+
+                        /* save original call ID in nat_info */
+                        nat_pptp_info->pns_call_id = ct_pptp_info->pns_call_id;
+
+                        /* don't use tcph->source since we are at a DSTmanip
+                         * hook (e.g. PREROUTING) and pkt is not mangled yet */
+                        new_callid = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port;
+
+                        /* save new call ID in ct info */
+                        ct_pptp_info->pns_call_id = ntohs(new_callid);
+                        break;
+                case PPTP_IN_CALL_REPLY:
+                        cid = &pptpReq->icreq.callID;
+                        break;
+                case PPTP_CALL_CLEAR_REQUEST:
+                        cid = &pptpReq->clrreq.callID;
+                        break;
+                default:
+                        DEBUGP("unknown outbound packet 0x%04x:%s\n", msg,
+                              (msg <= PPTP_MSG_MAX)? 
+                              pptp_msg_name[msg]:pptp_msg_name[0]);
+                        /* fall through */
+
+                case PPTP_SET_LINK_INFO:
+                        /* only need to NAT in case PAC is behind NAT box */
+                case PPTP_START_SESSION_REQUEST:
+                case PPTP_START_SESSION_REPLY:
+                case PPTP_STOP_SESSION_REQUEST:
+                case PPTP_STOP_SESSION_REPLY:
+                case PPTP_ECHO_REQUEST:
+                case PPTP_ECHO_REPLY:
+                        /* no need to alter packet */
+                        return NF_ACCEPT;
+        }
+
+        /* only OUT_CALL_REQUEST, IN_CALL_REPLY, CALL_CLEAR_REQUEST pass
+         * down to here */
+
+        IP_NF_ASSERT(cid);
+
+        DEBUGP("altering call id from 0x%04x to 0x%04x\n",
+                ntohs(*cid), ntohs(new_callid));
+
+        /* mangle packet */
+        if (ip_nat_mangle_tcp_packet(pskb, ct, ctinfo,
+                (void *)cid - ((void *)ctlh - sizeof(struct pptp_pkt_hdr)),
+                                        sizeof(new_callid), 
+                                        (char *)&new_callid,
+                                        sizeof(new_callid)) == 0)
+                return NF_DROP;
+
+        return NF_ACCEPT;
+}
+
+static int
+pptp_exp_gre(struct ip_conntrack_expect *expect_orig,
+             struct ip_conntrack_expect *expect_reply)
+{
+        struct ip_ct_pptp_master *ct_pptp_info = 
+                                &expect_orig->master->help.ct_pptp_info;
+        struct ip_nat_pptp *nat_pptp_info = 
+                                &expect_orig->master->nat.help.nat_pptp_info;
+
+        struct ip_conntrack *ct = expect_orig->master;
+
+        struct ip_conntrack_tuple inv_t;
+        struct ip_conntrack_tuple *orig_t, *reply_t;
+
+        /* save original PAC call ID in nat_info */
+        nat_pptp_info->pac_call_id = ct_pptp_info->pac_call_id;
+
+        /* alter expectation */
+        orig_t = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+        reply_t = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+
+        /* alter expectation for PNS->PAC direction */
+        invert_tuplepr(&inv_t, &expect_orig->tuple);
+        expect_orig->saved_proto.gre.key = htons(nat_pptp_info->pac_call_id);
+        expect_orig->tuple.src.u.gre.key = htons(nat_pptp_info->pns_call_id);
+        expect_orig->tuple.dst.u.gre.key = htons(ct_pptp_info->pac_call_id);
+        inv_t.src.ip = reply_t->src.ip;
+        inv_t.dst.ip = reply_t->dst.ip;
+        inv_t.src.u.gre.key = htons(nat_pptp_info->pac_call_id);
+        inv_t.dst.u.gre.key = htons(ct_pptp_info->pns_call_id);
+
+        if (!ip_conntrack_expect_related(expect_orig)) {
+                DEBUGP("successfully registered expect\n");
+        } else {
+                DEBUGP("can't expect_related(expect_orig)\n");
+                return 1;
+        }
+
+        /* alter expectation for PAC->PNS direction */
+        invert_tuplepr(&inv_t, &expect_reply->tuple);
+        expect_reply->saved_proto.gre.key = htons(nat_pptp_info->pns_call_id);
+        expect_reply->tuple.src.u.gre.key = htons(nat_pptp_info->pac_call_id);
+        expect_reply->tuple.dst.u.gre.key = htons(ct_pptp_info->pns_call_id);
+        inv_t.src.ip = orig_t->src.ip;
+        inv_t.dst.ip = orig_t->dst.ip;
+        inv_t.src.u.gre.key = htons(nat_pptp_info->pns_call_id);
+        inv_t.dst.u.gre.key = htons(ct_pptp_info->pac_call_id);
+
+        if (!ip_conntrack_expect_related(expect_reply)) {
+                DEBUGP("successfully registered expect\n");
+        } else {
+                DEBUGP("can't expect_related(expect_reply)\n");
+                ip_conntrack_unexpect_related(expect_orig);
+                return 1;
+        }
+
+        if (ip_ct_gre_keymap_add(ct, &expect_reply->tuple, 0) < 0) {
+                DEBUGP("can't register original keymap\n");
+                ip_conntrack_unexpect_related(expect_orig);
+                ip_conntrack_unexpect_related(expect_reply);
+                return 1;
+        }
+
+        if (ip_ct_gre_keymap_add(ct, &inv_t, 1) < 0) {
+                DEBUGP("can't register reply keymap\n");
+                ip_conntrack_unexpect_related(expect_orig);
+                ip_conntrack_unexpect_related(expect_reply);
+                ip_ct_gre_keymap_destroy(ct);
+                return 1;
+        }
+
+        return 0;
+}
+
+/* inbound packets == from PAC to PNS */
+static int
+pptp_inbound_pkt(struct sk_buff **pskb,
+                 struct ip_conntrack *ct,
+                 enum ip_conntrack_info ctinfo,
+                 struct PptpControlHeader *ctlh,
+                 union pptp_ctrl_union *pptpReq)
+{
+        struct ip_nat_pptp *nat_pptp_info = &ct->nat.help.nat_pptp_info;
+        u_int16_t msg, new_cid = 0, new_pcid, *pcid = NULL, *cid = NULL;
+
+        int ret = NF_ACCEPT, rv;
+
+        new_pcid = htons(nat_pptp_info->pns_call_id);
+
+        switch (msg = ntohs(ctlh->messageType)) {
+        case PPTP_OUT_CALL_REPLY:
+                pcid = &pptpReq->ocack.peersCallID;     
+                cid = &pptpReq->ocack.callID;
+                break;
+        case PPTP_IN_CALL_CONNECT:
+                pcid = &pptpReq->iccon.peersCallID;
+                break;
+        case PPTP_IN_CALL_REQUEST:
+                /* only need to nat in case PAC is behind NAT box */
+                break;
+        case PPTP_WAN_ERROR_NOTIFY:
+                pcid = &pptpReq->wanerr.peersCallID;
+                break;
+        case PPTP_CALL_DISCONNECT_NOTIFY:
+                pcid = &pptpReq->disc.callID;
+                break;
+        case PPTP_SET_LINK_INFO:
+                pcid = &pptpReq->setlink.peersCallID;
+                break;
+
+        default:
+                DEBUGP("unknown inbound packet %s\n", (msg <= PPTP_MSG_MAX)? 
+                        pptp_msg_name[msg]:pptp_msg_name[0]);
+                /* fall through */
+
+        case PPTP_START_SESSION_REQUEST:
+        case PPTP_START_SESSION_REPLY:
+        case PPTP_STOP_SESSION_REQUEST:
+        case PPTP_STOP_SESSION_REPLY:
+        case PPTP_ECHO_REQUEST:
+        case PPTP_ECHO_REPLY:
+                /* no need to alter packet */
+                return NF_ACCEPT;
+        }
+
+        /* only OUT_CALL_REPLY, IN_CALL_CONNECT, IN_CALL_REQUEST,
+         * WAN_ERROR_NOTIFY, CALL_DISCONNECT_NOTIFY pass down here */
+
+        /* mangle packet */
+        IP_NF_ASSERT(pcid);
+        DEBUGP("altering peer call id from 0x%04x to 0x%04x\n",
+                ntohs(*pcid), ntohs(new_pcid));
+        
+        rv = ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, 
+                                      (void *)pcid - ((void *)ctlh - sizeof(struct pptp_pkt_hdr)),
+                                      sizeof(new_pcid), (char *)&new_pcid, 
+                                      sizeof(new_pcid));
+        if (rv != NF_ACCEPT) 
+                return rv;
+
+        if (new_cid) {
+                IP_NF_ASSERT(cid);
+                DEBUGP("altering call id from 0x%04x to 0x%04x\n",
+                        ntohs(*cid), ntohs(new_cid));
+                rv = ip_nat_mangle_tcp_packet(pskb, ct, ctinfo, 
+                                              (void *)cid - ((void *)ctlh - sizeof(struct pptp_pkt_hdr)), 
+                                              sizeof(new_cid),
+                                              (char *)&new_cid, 
+                                              sizeof(new_cid));
+                if (rv != NF_ACCEPT)
+                        return rv;
+        }
+
+        /* check for earlier return value of 'switch' above */
+        if (ret != NF_ACCEPT)
+                return ret;
+
+        /* great, at least we don't need to resize packets */
+        return NF_ACCEPT;
+}
+
+
+extern int __init ip_nat_proto_gre_init(void);
+extern void __exit ip_nat_proto_gre_fini(void);
+
+static int __init init(void)
+{
+        int ret;
+
+        DEBUGP("%s: registering NAT helper\n", __FILE__);
+
+        ret = ip_nat_proto_gre_init();
+        if (ret < 0)
+                return ret;
+
+        BUG_ON(ip_nat_pptp_hook_outbound);
+        ip_nat_pptp_hook_outbound = &pptp_outbound_pkt;
+
+        BUG_ON(ip_nat_pptp_hook_inbound);
+        ip_nat_pptp_hook_inbound = &pptp_inbound_pkt;
+
+        BUG_ON(ip_nat_pptp_hook_exp_gre);
+        ip_nat_pptp_hook_exp_gre = &pptp_exp_gre;
+
+        BUG_ON(ip_nat_pptp_hook_expectfn);
+        ip_nat_pptp_hook_expectfn = &pptp_nat_expected;
+
+        printk("ip_nat_pptp version %s loaded\n", IP_NAT_PPTP_VERSION);
+        return 0;
+}
+
+static void __exit fini(void)
+{
+        DEBUGP("cleanup_module\n" );
+
+        ip_nat_pptp_hook_expectfn = NULL;
+        ip_nat_pptp_hook_exp_gre = NULL;
+        ip_nat_pptp_hook_inbound = NULL;
+        ip_nat_pptp_hook_outbound = NULL;
+
+        ip_nat_proto_gre_fini();
+        /* Make sure noone calls it, meanwhile */
+        synchronize_net();
+
+        printk("ip_nat_pptp version %s unloaded\n", IP_NAT_PPTP_VERSION);
+}
+
+module_init(init);
+module_exit(fini);
diff --git a/net/ipv4/netfilter/ip_nat_proto_gre.c b/net/ipv4/netfilter/ip_nat_proto_gre.c
new file mode 100644
index 000000000000..7c1285401672
--- /dev/null
+++ b/net/ipv4/netfilter/ip_nat_proto_gre.c
@@ -0,0 +1,214 @@
+/*
+ * ip_nat_proto_gre.c - Version 2.0
+ *
+ * NAT protocol helper module for GRE.
+ *
+ * GRE is a generic encapsulation protocol, which is generally not very
+ * suited for NAT, as it has no protocol-specific part as port numbers.
+ *
+ * It has an optional key field, which may help us distinguishing two 
+ * connections between the same two hosts.
+ *
+ * GRE is defined in RFC 1701 and RFC 1702, as well as RFC 2784 
+ *
+ * PPTP is built on top of a modified version of GRE, and has a mandatory
+ * field called "CallID", which serves us for the same purpose as the key
+ * field in plain GRE.
+ *
+ * Documentation about PPTP can be found in RFC 2637
+ *
+ * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org>
+ *
+ * Development of this code funded by Astaro AG (http://www.astaro.com/)
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/ip.h>
+#include <linux/netfilter_ipv4/ip_nat.h>
+#include <linux/netfilter_ipv4/ip_nat_rule.h>
+#include <linux/netfilter_ipv4/ip_nat_protocol.h>
+#include <linux/netfilter_ipv4/ip_conntrack_proto_gre.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
+MODULE_DESCRIPTION("Netfilter NAT protocol helper module for GRE");
+
+#if 0
+#define DEBUGP(format, args...) printk(KERN_DEBUG "%s:%s: " format, __FILE__, \
+                                       __FUNCTION__, ## args)
+#else
+#define DEBUGP(x, args...)
+#endif
+
+/* is key in given range between min and max */
+static int
+gre_in_range(const struct ip_conntrack_tuple *tuple,
+             enum ip_nat_manip_type maniptype,
+             const union ip_conntrack_manip_proto *min,
+             const union ip_conntrack_manip_proto *max)
+{
+        u_int32_t key;
+
+        if (maniptype == IP_NAT_MANIP_SRC)
+                key = tuple->src.u.gre.key;
+        else
+                key = tuple->dst.u.gre.key;
+
+        return ntohl(key) >= ntohl(min->gre.key)
+                && ntohl(key) <= ntohl(max->gre.key);
+}
+
+/* generate unique tuple ... */
+static int 
+gre_unique_tuple(struct ip_conntrack_tuple *tuple,
+                 const struct ip_nat_range *range,
+                 enum ip_nat_manip_type maniptype,
+                 const struct ip_conntrack *conntrack)
+{
+        static u_int16_t key;
+        u_int16_t *keyptr;
+        unsigned int min, i, range_size;
+
+        if (maniptype == IP_NAT_MANIP_SRC)
+                keyptr = &tuple->src.u.gre.key;
+        else
+                keyptr = &tuple->dst.u.gre.key;
+
+        if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {
+                DEBUGP("%p: NATing GRE PPTP\n", conntrack);
+                min = 1;
+                range_size = 0xffff;
+        } else {
+                min = ntohl(range->min.gre.key);
+                range_size = ntohl(range->max.gre.key) - min + 1;
+        }
+
+        DEBUGP("min = %u, range_size = %u\n", min, range_size); 
+
+        for (i = 0; i < range_size; i++, key++) {
+                *keyptr = htonl(min + key % range_size);
+                if (!ip_nat_used_tuple(tuple, conntrack))
+                        return 1;
+        }
+
+        DEBUGP("%p: no NAT mapping\n", conntrack);
+
+        return 0;
+}
+
+/* manipulate a GRE packet according to maniptype */
+static int
+gre_manip_pkt(struct sk_buff **pskb,
+              unsigned int iphdroff,
+              const struct ip_conntrack_tuple *tuple,
+              enum ip_nat_manip_type maniptype)
+{
+        struct gre_hdr *greh;
+        struct gre_hdr_pptp *pgreh;
+        struct iphdr *iph = (struct iphdr *)((*pskb)->data + iphdroff);
+        unsigned int hdroff = iphdroff + iph->ihl*4;
+
+        /* pgreh includes two optional 32bit fields which are not required
+         * to be there.  That's where the magic '8' comes from */
+        if (!skb_make_writable(pskb, hdroff + sizeof(*pgreh)-8))
+                return 0;
+
+        greh = (void *)(*pskb)->data + hdroff;
+        pgreh = (struct gre_hdr_pptp *) greh;
+
+        /* we only have destination manip of a packet, since 'source key' 
+         * is not present in the packet itself */
+        if (maniptype == IP_NAT_MANIP_DST) {
+                /* key manipulation is always dest */
+                switch (greh->version) {
+                case 0:
+                        if (!greh->key) {
+                                DEBUGP("can't nat GRE w/o key\n");
+                                break;
+                        }
+                        if (greh->csum) {
+                                /* FIXME: Never tested this code... */
+                                *(gre_csum(greh)) = 
+                                        ip_nat_cheat_check(~*(gre_key(greh)),
+                                                        tuple->dst.u.gre.key,
+                                                        *(gre_csum(greh)));
+                        }
+                        *(gre_key(greh)) = tuple->dst.u.gre.key;
+                        break;
+                case GRE_VERSION_PPTP:
+                        DEBUGP("call_id -> 0x%04x\n", 
+                                ntohl(tuple->dst.u.gre.key));
+                        pgreh->call_id = htons(ntohl(tuple->dst.u.gre.key));
+                        break;
+                default:
+                        DEBUGP("can't nat unknown GRE version\n");
+                        return 0;
+                        break;
+                }
+        }
+        return 1;
+}
+
+/* print out a nat tuple */
+static unsigned int 
+gre_print(char *buffer, 
+          const struct ip_conntrack_tuple *match,
+          const struct ip_conntrack_tuple *mask)
+{
+        unsigned int len = 0;
+
+        if (mask->src.u.gre.key)
+                len += sprintf(buffer + len, "srckey=0x%x ", 
+                                ntohl(match->src.u.gre.key));
+
+        if (mask->dst.u.gre.key)
+                len += sprintf(buffer + len, "dstkey=0x%x ",
+                                ntohl(match->src.u.gre.key));
+
+        return len;
+}
+
+/* print a range of keys */
+static unsigned int 
+gre_print_range(char *buffer, const struct ip_nat_range *range)
+{
+        if (range->min.gre.key != 0 
+            || range->max.gre.key != 0xFFFF) {
+                if (range->min.gre.key == range->max.gre.key)
+                        return sprintf(buffer, "key 0x%x ",
+                                        ntohl(range->min.gre.key));
+                else
+                        return sprintf(buffer, "keys 0x%u-0x%u ",
+                                        ntohl(range->min.gre.key),
+                                        ntohl(range->max.gre.key));
+        } else
+                return 0;
+}
+
+/* nat helper struct */
+static struct ip_nat_protocol gre = { 
+        .name           = "GRE", 
+        .protonum       = IPPROTO_GRE,
+        .manip_pkt      = gre_manip_pkt,
+        .in_range       = gre_in_range,
+        .unique_tuple   = gre_unique_tuple,
+        .print          = gre_print,
+        .print_range    = gre_print_range,
+#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
+    defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
+        .range_to_nfattr        = ip_nat_port_range_to_nfattr,
+        .nfattr_to_range        = ip_nat_port_nfattr_to_range,
+#endif
+};
+                                  
+int __init ip_nat_proto_gre_init(void)
+{
+        return ip_nat_protocol_register(&gre);
+}
+
+void __exit ip_nat_proto_gre_fini(void)
+{
+        ip_nat_protocol_unregister(&gre);
+}
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index 0ff368b131f6..30cd4e18c129 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -108,8 +108,8 @@ ip_nat_fn(unsigned int hooknum,
         case IP_CT_RELATED:
         case IP_CT_RELATED+IP_CT_IS_REPLY:
                 if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {
-                        if (!icmp_reply_translation(pskb, ct, maniptype,
-                                                    CTINFO2DIR(ctinfo)))
+                        if (!ip_nat_icmp_reply_translation(pskb, ct, maniptype,
+                                                           CTINFO2DIR(ctinfo)))
                                 return NF_DROP;
                         else
                                 return NF_ACCEPT;
@@ -152,7 +152,7 @@ ip_nat_fn(unsigned int hooknum,
         }
 
         IP_NF_ASSERT(info);
-        return nat_packet(ct, ctinfo, hooknum, pskb);
+        return ip_nat_packet(ct, ctinfo, hooknum, pskb);
 }
 
 static unsigned int
@@ -325,15 +325,10 @@ static int init_or_cleanup(int init)
                 printk("ip_nat_init: can't setup rules.\n");
                 goto cleanup_nothing;
         }
-        ret = ip_nat_init();
-        if (ret < 0) {
-                printk("ip_nat_init: can't setup rules.\n");
-                goto cleanup_rule_init;
-        }
         ret = nf_register_hook(&ip_nat_in_ops);
         if (ret < 0) {
                 printk("ip_nat_init: can't register in hook.\n");
-                goto cleanup_nat;
+                goto cleanup_rule_init;
         }
         ret = nf_register_hook(&ip_nat_out_ops);
         if (ret < 0) {
@@ -374,8 +369,6 @@ static int init_or_cleanup(int init)
         nf_unregister_hook(&ip_nat_out_ops);
  cleanup_inops:
         nf_unregister_hook(&ip_nat_in_ops);
- cleanup_nat:
-        ip_nat_cleanup();
  cleanup_rule_init:
         ip_nat_rule_cleanup();
  cleanup_nothing:
@@ -395,14 +388,4 @@ static void __exit fini(void)
 module_init(init);
 module_exit(fini);
 
-EXPORT_SYMBOL(ip_nat_setup_info);
-EXPORT_SYMBOL(ip_nat_protocol_register);
-EXPORT_SYMBOL(ip_nat_protocol_unregister);
-EXPORT_SYMBOL_GPL(ip_nat_proto_find_get);
-EXPORT_SYMBOL_GPL(ip_nat_proto_put);
-EXPORT_SYMBOL(ip_nat_cheat_check);
-EXPORT_SYMBOL(ip_nat_mangle_tcp_packet);
-EXPORT_SYMBOL(ip_nat_mangle_udp_packet);
-EXPORT_SYMBOL(ip_nat_used_tuple);
-EXPORT_SYMBOL(ip_nat_follow_master);
 MODULE_LICENSE("GPL");
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index d54f14d926f6..36339eb39e17 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -240,8 +240,8 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
 
         pmsg->packet_id       = (unsigned long )entry;
         pmsg->data_len        = data_len;
-        pmsg->timestamp_sec   = skb_tv_base.tv_sec + entry->skb->tstamp.off_sec;
-        pmsg->timestamp_usec  = skb_tv_base.tv_usec + entry->skb->tstamp.off_usec;
+        pmsg->timestamp_sec   = entry->skb->tstamp.off_sec;
+        pmsg->timestamp_usec  = entry->skb->tstamp.off_usec;
         pmsg->mark            = entry->skb->nfmark;
         pmsg->hook            = entry->info->hook;
         pmsg->hw_protocol     = entry->skb->protocol;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 7d38913754b1..9bcb398fbc1f 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -13,6 +13,7 @@
 #include <linux/config.h>
 #include <linux/proc_fs.h>
 #include <linux/jhash.h>
+#include <linux/bitops.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
@@ -30,7 +31,7 @@
 #include <linux/netfilter_ipv4/ipt_CLUSTERIP.h>
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 
-#define CLUSTERIP_VERSION "0.7"
+#define CLUSTERIP_VERSION "0.8"
 
 #define DEBUG_CLUSTERIP
 
@@ -49,13 +50,14 @@ MODULE_DESCRIPTION("iptables target for CLUSTERIP");
 struct clusterip_config {
         struct list_head list;                  /* list of all configs */
         atomic_t refcount;                      /* reference count */
+        atomic_t entries;                       /* number of entries/rules
+                                                 * referencing us */
 
         u_int32_t clusterip;                    /* the IP address */
         u_int8_t clustermac[ETH_ALEN];          /* the MAC address */
         struct net_device *dev;                 /* device */
         u_int16_t num_total_nodes;              /* total number of nodes */
-        u_int16_t num_local_nodes;              /* number of local nodes */
-        u_int16_t local_nodes[CLUSTERIP_MAX_NODES];     /* node number array */
+        unsigned long local_nodes;              /* node number array */
 
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *pde;             /* proc dir entry */
@@ -66,8 +68,7 @@ struct clusterip_config {
 
 static LIST_HEAD(clusterip_configs);
 
-/* clusterip_lock protects the clusterip_configs list _AND_ the configurable
- * data within all structurses (num_local_nodes, local_nodes[]) */
+/* clusterip_lock protects the clusterip_configs list */
 static DEFINE_RWLOCK(clusterip_lock);
 
 #ifdef CONFIG_PROC_FS
@@ -76,23 +77,48 @@ static struct proc_dir_entry *clusterip_procdir;
 #endif
 
 static inline void
-clusterip_config_get(struct clusterip_config *c) {
+clusterip_config_get(struct clusterip_config *c)
+{
         atomic_inc(&c->refcount);
 }
 
 static inline void
-clusterip_config_put(struct clusterip_config *c) {
-        if (atomic_dec_and_test(&c->refcount)) {
+clusterip_config_put(struct clusterip_config *c)
+{
+        if (atomic_dec_and_test(&c->refcount))
+                kfree(c);
+}
+
+/* increase the count of entries(rules) using/referencing this config */
+static inline void
+clusterip_config_entry_get(struct clusterip_config *c)
+{
+        atomic_inc(&c->entries);
+}
+
+/* decrease the count of entries using/referencing this config.  If last
+ * entry(rule) is removed, remove the config from lists, but don't free it
+ * yet, since proc-files could still be holding references */
+static inline void
+clusterip_config_entry_put(struct clusterip_config *c)
+{
+        if (atomic_dec_and_test(&c->entries)) {
                 write_lock_bh(&clusterip_lock);
                 list_del(&c->list);
                 write_unlock_bh(&clusterip_lock);
+
                 dev_mc_delete(c->dev, c->clustermac, ETH_ALEN, 0);
                 dev_put(c->dev);
-                kfree(c);
+
+                /* In case anyone still accesses the file, the open/close
+                 * functions are also incrementing the refcount on their own,
+                 * so it's safe to remove the entry even if it's in use. */
+#ifdef CONFIG_PROC_FS
+                remove_proc_entry(c->pde->name, c->pde->parent);
+#endif
         }
 }
 
-
 static struct clusterip_config *
 __clusterip_config_find(u_int32_t clusterip)
 {
@@ -111,7 +137,7 @@ __clusterip_config_find(u_int32_t clusterip)
 }
 
 static inline struct clusterip_config *
-clusterip_config_find_get(u_int32_t clusterip)
+clusterip_config_find_get(u_int32_t clusterip, int entry)
 {
         struct clusterip_config *c;
 
@@ -122,11 +148,24 @@ clusterip_config_find_get(u_int32_t clusterip)
                 return NULL;
         }
         atomic_inc(&c->refcount);
+        if (entry)
+                atomic_inc(&c->entries);
         read_unlock_bh(&clusterip_lock);
 
         return c;
 }
 
+static void
+clusterip_config_init_nodelist(struct clusterip_config *c,
+                               const struct ipt_clusterip_tgt_info *i)
+{
+        int n;
+
+        for (n = 0; n < i->num_local_nodes; n++) {
+                set_bit(i->local_nodes[n] - 1, &c->local_nodes);
+        }
+}
+
 static struct clusterip_config *
 clusterip_config_init(struct ipt_clusterip_tgt_info *i, u_int32_t ip,
                         struct net_device *dev)
@@ -143,11 +182,11 @@ clusterip_config_init(struct ipt_clusterip_tgt_info *i, u_int32_t ip,
         c->clusterip = ip;
         memcpy(&c->clustermac, &i->clustermac, ETH_ALEN);
         c->num_total_nodes = i->num_total_nodes;
-        c->num_local_nodes = i->num_local_nodes;
-        memcpy(&c->local_nodes, &i->local_nodes, sizeof(c->local_nodes));
+        clusterip_config_init_nodelist(c, i);
         c->hash_mode = i->hash_mode;
         c->hash_initval = i->hash_initval;
         atomic_set(&c->refcount, 1);
+        atomic_set(&c->entries, 1);
 
 #ifdef CONFIG_PROC_FS
         /* create proc dir entry */
@@ -171,53 +210,28 @@ clusterip_config_init(struct ipt_clusterip_tgt_info *i, u_int32_t ip,
 static int
 clusterip_add_node(struct clusterip_config *c, u_int16_t nodenum)
 {
-        int i;
-
-        write_lock_bh(&clusterip_lock);
 
-        if (c->num_local_nodes >= CLUSTERIP_MAX_NODES
-            || nodenum > CLUSTERIP_MAX_NODES) {
-                write_unlock_bh(&clusterip_lock);
+        if (nodenum == 0 ||
+            nodenum > c->num_total_nodes)
                 return 1;
-        }
-
-        /* check if we alrady have this number in our array */
-        for (i = 0; i < c->num_local_nodes; i++) {
-                if (c->local_nodes[i] == nodenum) {
-                        write_unlock_bh(&clusterip_lock);
-                        return 1;
-                }
-        }
 
-        c->local_nodes[c->num_local_nodes++] = nodenum;
+        /* check if we already have this number in our bitfield */
+        if (test_and_set_bit(nodenum - 1, &c->local_nodes))
+                return 1;
 
-        write_unlock_bh(&clusterip_lock);
         return 0;
 }
 
 static int
 clusterip_del_node(struct clusterip_config *c, u_int16_t nodenum)
 {
-        int i;
-
-        write_lock_bh(&clusterip_lock);
-
-        if (c->num_local_nodes <= 1 || nodenum > CLUSTERIP_MAX_NODES) {
-                write_unlock_bh(&clusterip_lock);
+        if (nodenum == 0 ||
+            nodenum > c->num_total_nodes)
                 return 1;
-        }
                 
-        for (i = 0; i < c->num_local_nodes; i++) {
-                if (c->local_nodes[i] == nodenum) {
-                        int size = sizeof(u_int16_t)*(c->num_local_nodes-(i+1));
-                        memmove(&c->local_nodes[i], &c->local_nodes[i+1], size);
-                        c->num_local_nodes--;
-                        write_unlock_bh(&clusterip_lock);
-                        return 0;
-                }
-        }
+        if (test_and_clear_bit(nodenum - 1, &c->local_nodes))
+                return 0;
 
-        write_unlock_bh(&clusterip_lock);
         return 1;
 }
 
@@ -285,25 +299,7 @@ clusterip_hashfn(struct sk_buff *skb, struct clusterip_config *config)
 static inline int
 clusterip_responsible(struct clusterip_config *config, u_int32_t hash)
 {
-        int i;
-
-        read_lock_bh(&clusterip_lock);
-
-        if (config->num_local_nodes == 0) {
-                read_unlock_bh(&clusterip_lock);
-                return 0;
-        }
-
-        for (i = 0; i < config->num_local_nodes; i++) {
-                if (config->local_nodes[i] == hash) {
-                        read_unlock_bh(&clusterip_lock);
-                        return 1;
-                }
-        }
-
-        read_unlock_bh(&clusterip_lock);
-
-        return 0;
+        return test_bit(hash - 1, &config->local_nodes);
 }
 
 /*********************************************************************** 
@@ -415,8 +411,26 @@ checkentry(const char *tablename,
 
         /* FIXME: further sanity checks */
 
-        config = clusterip_config_find_get(e->ip.dst.s_addr);
-        if (!config) {
+        config = clusterip_config_find_get(e->ip.dst.s_addr, 1);
+        if (config) {
+                if (cipinfo->config != NULL) {
+                        /* Case A: This is an entry that gets reloaded, since
+                         * it still has a cipinfo->config pointer. Simply
+                         * increase the entry refcount and return */
+                        if (cipinfo->config != config) {
+                                printk(KERN_ERR "CLUSTERIP: Reloaded entry "
+                                       "has invalid config pointer!\n");
+                                return 0;
+                        }
+                        clusterip_config_entry_get(cipinfo->config);
+                } else {
+                        /* Case B: This is a new rule referring to an existing
+                         * clusterip config. */
+                        cipinfo->config = config;
+                        clusterip_config_entry_get(cipinfo->config);
+                }
+        } else {
+                /* Case C: This is a completely new clusterip config */
                 if (!(cipinfo->flags & CLUSTERIP_FLAG_NEW)) {
                         printk(KERN_WARNING "CLUSTERIP: no config found for %u.%u.%u.%u, need 'new'\n", NIPQUAD(e->ip.dst.s_addr));
                         return 0;
@@ -443,10 +457,9 @@ checkentry(const char *tablename,
                         }
                         dev_mc_add(config->dev,config->clustermac, ETH_ALEN, 0);
                 }
+                cipinfo->config = config;
         }
 
-        cipinfo->config = config;
-
         return 1;
 }
 
@@ -455,13 +468,10 @@ static void destroy(void *matchinfo, unsigned int matchinfosize)
 {
         struct ipt_clusterip_tgt_info *cipinfo = matchinfo;
 
-        /* we first remove the proc entry and then drop the reference
-         * count.  In case anyone still accesses the file, the open/close
-         * functions are also incrementing the refcount on their own */
-#ifdef CONFIG_PROC_FS
-        remove_proc_entry(cipinfo->config->pde->name,
-                          cipinfo->config->pde->parent);
-#endif
+        /* if no more entries are referencing the config, remove it
+         * from the list and destroy the proc entry */
+        clusterip_config_entry_put(cipinfo->config);
+
         clusterip_config_put(cipinfo->config);
 }
 
@@ -533,7 +543,7 @@ arp_mangle(unsigned int hook,
 
         /* if there is no clusterip configuration for the arp reply's 
          * source ip, we don't want to mangle it */
-        c = clusterip_config_find_get(payload->src_ip);
+        c = clusterip_config_find_get(payload->src_ip, 0);
         if (!c)
                 return NF_ACCEPT;
 
@@ -574,56 +584,69 @@ static struct nf_hook_ops cip_arp_ops = {
 
 #ifdef CONFIG_PROC_FS
 
+struct clusterip_seq_position {
+        unsigned int pos;       /* position */
+        unsigned int weight;    /* number of bits set == size */
+        unsigned int bit;       /* current bit */
+        unsigned long val;      /* current value */
+};
+
 static void *clusterip_seq_start(struct seq_file *s, loff_t *pos)
 {
         struct proc_dir_entry *pde = s->private;
         struct clusterip_config *c = pde->data;
-        unsigned int *nodeidx;
-
-        read_lock_bh(&clusterip_lock);
-        if (*pos >= c->num_local_nodes)
+        unsigned int weight;
+        u_int32_t local_nodes;
+        struct clusterip_seq_position *idx;
+
+        /* FIXME: possible race */
+        local_nodes = c->local_nodes;
+        weight = hweight32(local_nodes);
+        if (*pos >= weight)
                 return NULL;
 
-        nodeidx = kmalloc(sizeof(unsigned int), GFP_KERNEL);
-        if (!nodeidx)
+        idx = kmalloc(sizeof(struct clusterip_seq_position), GFP_KERNEL);
+        if (!idx)
                 return ERR_PTR(-ENOMEM);
 
-        *nodeidx = *pos;
-        return nodeidx;
+        idx->pos = *pos;
+        idx->weight = weight;
+        idx->bit = ffs(local_nodes);
+        idx->val = local_nodes;
+        clear_bit(idx->bit - 1, &idx->val);
+
+        return idx;
 }
 
 static void *clusterip_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct proc_dir_entry *pde = s->private;
-        struct clusterip_config *c = pde->data;
-        unsigned int *nodeidx = (unsigned int *)v;
+        struct clusterip_seq_position *idx = (struct clusterip_seq_position *)v;
 
-        *pos = ++(*nodeidx);
-        if (*pos >= c->num_local_nodes) {
+        *pos = ++idx->pos;
+        if (*pos >= idx->weight) {
                 kfree(v);
                 return NULL;
         }
-        return nodeidx;
+        idx->bit = ffs(idx->val);
+        clear_bit(idx->bit - 1, &idx->val);
+        return idx;
 }
 
 static void clusterip_seq_stop(struct seq_file *s, void *v)
 {
         kfree(v);
-
-        read_unlock_bh(&clusterip_lock);
 }
 
 static int clusterip_seq_show(struct seq_file *s, void *v)
 {
-        struct proc_dir_entry *pde = s->private;
-        struct clusterip_config *c = pde->data;
-        unsigned int *nodeidx = (unsigned int *)v;
+        struct clusterip_seq_position *idx = (struct clusterip_seq_position *)v;
 
-        if (*nodeidx != 0) 
+        if (idx->pos != 0) 
                 seq_putc(s, ',');
-        seq_printf(s, "%u", c->local_nodes[*nodeidx]);
 
-        if (*nodeidx == c->num_local_nodes-1)
+        seq_printf(s, "%u", idx->bit);
+
+        if (idx->pos == idx->weight - 1)
                 seq_putc(s, '\n');
 
         return 0;
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 2f3e181c8e97..275a174c6fe6 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -90,6 +90,12 @@ masquerade_target(struct sk_buff **pskb,
         IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
                             || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
 
+        /* Source address is 0.0.0.0 - locally generated packet that is
+         * probably not supposed to be masqueraded.
+         */
+        if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip == 0)
+                return NF_ACCEPT;
+
         mr = targinfo;
         rt = (struct rtable *)(*pskb)->dst;
         newsrc = inet_select_addr(out, rt->rt_gateway, RT_SCOPE_UNIVERSE);
diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index d2e13447678e..5245bfd33d52 100644
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -88,14 +88,18 @@ redirect_target(struct sk_buff **pskb,
                 newdst = htonl(0x7F000001);
         else {
                 struct in_device *indev;
+                struct in_ifaddr *ifa;
 
-                /* Device might not have an associated in_device. */
-                indev = (struct in_device *)(*pskb)->dev->ip_ptr;
-                if (indev == NULL || indev->ifa_list == NULL)
-                        return NF_DROP;
+                newdst = 0;
+                
+                rcu_read_lock();
+                indev = __in_dev_get_rcu((*pskb)->dev);
+                if (indev && (ifa = indev->ifa_list))
+                        newdst = ifa->ifa_local;
+                rcu_read_unlock();
 
-                /* Grab first address on interface. */
-                newdst = indev->ifa_list->ifa_local;
+                if (!newdst)
+                        return NF_DROP;
         }
 
         /* Transfer from original range. */
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index e2c14f3cb2fc..2883ccd8a91d 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -225,8 +225,8 @@ static void ipt_ulog_packet(unsigned int hooknum,
 
         /* copy hook, prefix, timestamp, payload, etc. */
         pm->data_len = copy_len;
-        pm->timestamp_sec = skb_tv_base.tv_sec + skb->tstamp.off_sec;
-        pm->timestamp_usec = skb_tv_base.tv_usec + skb->tstamp.off_usec;
+        pm->timestamp_sec = skb->tstamp.off_sec;
+        pm->timestamp_usec = skb->tstamp.off_usec;
         pm->mark = skb->nfmark;
         pm->hook = hooknum;
         if (prefix != NULL)
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 304bb0a1d4f0..4b0d7e4d6269 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -361,7 +361,7 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
 
                         if (type && code) {
                                 get_user(fl->fl_icmp_type, type);
-                                __get_user(fl->fl_icmp_code, code);
+                                get_user(fl->fl_icmp_code, code);
                                 probed = 1;
                         }
                         break;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 8549f26e2495..381dd6a6aebb 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2128,7 +2128,7 @@ int ip_route_input(struct sk_buff *skb, u32 daddr, u32 saddr,
                 struct in_device *in_dev;
 
                 rcu_read_lock();
-                if ((in_dev = __in_dev_get(dev)) != NULL) {
+                if ((in_dev = __in_dev_get_rcu(dev)) != NULL) {
                         int our = ip_check_mc(in_dev, daddr, saddr,
                                 skb->nh.iph->protocol);
                         if (our
@@ -2443,7 +2443,9 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)
                 err = -ENODEV;
                 if (dev_out == NULL)
                         goto out;
-                if (__in_dev_get(dev_out) == NULL) {
+
+                /* RACE: Check return value of inet_select_addr instead. */
+                if (__in_dev_get_rtnl(dev_out) == NULL) {
                         dev_put(dev_out);
                         goto out;       /* Wrong error code */
                 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 29222b964951..677419d0c9ad 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -355,8 +355,6 @@ static void tcp_clamp_window(struct sock *sk, struct tcp_sock *tp)
                         app_win -= icsk->icsk_ack.rcv_mss;
                 app_win = max(app_win, 2U*tp->advmss);
 
-                if (!ofo_win)
-                        tp->window_clamp = min(tp->window_clamp, app_win);
                 tp->rcv_ssthresh = min(tp->window_clamp, 2U*tp->advmss);
         }
 }
@@ -979,14 +977,19 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                         if (!before(TCP_SKB_CB(skb)->seq, end_seq))
                                 break;
 
+                        in_sack = !after(start_seq, TCP_SKB_CB(skb)->seq) &&
+                                !before(end_seq, TCP_SKB_CB(skb)->end_seq);
+
                         pcount = tcp_skb_pcount(skb);
 
-                        if (pcount > 1 &&
-                            (after(start_seq, TCP_SKB_CB(skb)->seq) ||
-                             before(end_seq, TCP_SKB_CB(skb)->end_seq))) {
+                        if (pcount > 1 && !in_sack &&
+                            after(TCP_SKB_CB(skb)->end_seq, start_seq)) {
                                 unsigned int pkt_len;
 
-                                if (after(start_seq, TCP_SKB_CB(skb)->seq))
+                                in_sack = !after(start_seq,
+                                                 TCP_SKB_CB(skb)->seq);
+
+                                if (!in_sack)
                                         pkt_len = (start_seq -
                                                    TCP_SKB_CB(skb)->seq);
                                 else
@@ -999,9 +1002,6 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
 
                         fack_count += pcount;
 
-                        in_sack = !after(start_seq, TCP_SKB_CB(skb)->seq) &&
-                                !before(end_seq, TCP_SKB_CB(skb)->end_seq);
-
                         sacked = TCP_SKB_CB(skb)->sacked;
 
                         /* Account D-SACK for retransmitted packet. */
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 13dfb391cdf1..c85819d8474b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -130,19 +130,20 @@ static int __tcp_v4_check_established(struct sock *sk, __u16 lport,
         int dif = sk->sk_bound_dev_if;
         INET_ADDR_COOKIE(acookie, saddr, daddr)
         const __u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
-        const int hash = inet_ehashfn(daddr, lport, saddr, inet->dport, tcp_hashinfo.ehash_size);
-        struct inet_ehash_bucket *head = &tcp_hashinfo.ehash[hash];
+        unsigned int hash = inet_ehashfn(daddr, lport, saddr, inet->dport);
+        struct inet_ehash_bucket *head = inet_ehash_bucket(&tcp_hashinfo, hash);
         struct sock *sk2;
         const struct hlist_node *node;
         struct inet_timewait_sock *tw;
 
+        prefetch(head->chain.first);
         write_lock(&head->lock);
 
         /* Check TIME-WAIT sockets first. */
         sk_for_each(sk2, node, &(head + tcp_hashinfo.ehash_size)->chain) {
                 tw = inet_twsk(sk2);
 
-                if (INET_TW_MATCH(sk2, acookie, saddr, daddr, ports, dif)) {
+                if (INET_TW_MATCH(sk2, hash, acookie, saddr, daddr, ports, dif)) {
                         const struct tcp_timewait_sock *tcptw = tcp_twsk(sk2);
                         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -179,7 +180,7 @@ static int __tcp_v4_check_established(struct sock *sk, __u16 lport,
 
         /* And established part... */
         sk_for_each(sk2, node, &head->chain) {
-                if (INET_MATCH(sk2, acookie, saddr, daddr, ports, dif))
+                if (INET_MATCH(sk2, hash, acookie, saddr, daddr, ports, dif))
                         goto not_unique;
         }
 
@@ -188,7 +189,7 @@ unique:
          * in hash table socket with a funny identity. */
         inet->num = lport;
         inet->sport = htons(lport);
-        sk->sk_hashent = hash;
+        sk->sk_hash = hash;
         BUG_TRAP(sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sock_prot_inc_use(sk->sk_prot);
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index a88db28b0af7..b1a63b2c6b4a 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -384,7 +384,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 newtp->frto_counter = 0;
                 newtp->frto_highmark = 0;
 
-                newicsk->icsk_ca_ops = &tcp_reno;
+                newicsk->icsk_ca_ops = &tcp_init_congestion_ops;
 
                 tcp_set_ca_state(newsk, TCP_CA_Open);
                 tcp_init_xmit_timers(newsk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index c10e4435e3b1..c5b911f9b662 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -190,7 +190,7 @@ void tcp_select_initial_window(int __space, __u32 mss,
         }
 
         /* Set initial window to value enough for senders,
-         * following RFC1414. Senders, not following this RFC,
+         * following RFC2414. Senders, not following this RFC,
          * will be satisfied with 2.
          */
         if (mss > (1<<*rcv_wscale)) {
@@ -435,6 +435,8 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         int nsize, old_factor;
         u16 flags;
 
+        BUG_ON(len >= skb->len);
+
         nsize = skb_headlen(skb) - len;
         if (nsize < 0)
                 nsize = 0;
@@ -459,9 +461,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         flags = TCP_SKB_CB(skb)->flags;
         TCP_SKB_CB(skb)->flags = flags & ~(TCPCB_FLAG_FIN|TCPCB_FLAG_PSH);
         TCP_SKB_CB(buff)->flags = flags;
-        TCP_SKB_CB(buff)->sacked =
-                (TCP_SKB_CB(skb)->sacked &
-                 (TCPCB_LOST | TCPCB_EVER_RETRANS | TCPCB_AT_TAIL));
+        TCP_SKB_CB(buff)->sacked = TCP_SKB_CB(skb)->sacked;
         TCP_SKB_CB(skb)->sacked &= ~TCPCB_AT_TAIL;
 
         if (!skb_shinfo(skb)->nr_frags && skb->ip_summed != CHECKSUM_HW) {
@@ -499,11 +499,26 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
                         tcp_skb_pcount(buff);
 
                 tp->packets_out -= diff;
+
+                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
+                        tp->sacked_out -= diff;
+                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
+                        tp->retrans_out -= diff;
+
                 if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST) {
                         tp->lost_out -= diff;
                         tp->left_out -= diff;
                 }
+
                 if (diff > 0) {
+                        /* Adjust Reno SACK estimate. */
+                        if (!tp->rx_opt.sack_ok) {
+                                tp->sacked_out -= diff;
+                                if ((int)tp->sacked_out < 0)
+                                        tp->sacked_out = 0;
+                                tcp_sync_left_out(tp);
+                        }
+
                         tp->fackets_out -= diff;
                         if ((int)tp->fackets_out < 0)
                                 tp->fackets_out = 0;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2fea3f4402a0..a970b4727ce8 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1806,7 +1806,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
         }
 
         for (dev = dev_base; dev != NULL; dev = dev->next) {
-                struct in_device * in_dev = __in_dev_get(dev);
+                struct in_device * in_dev = __in_dev_get_rtnl(dev);
                 if (in_dev && (dev->flags & IFF_UP)) {
                         struct in_ifaddr * ifa;
 
@@ -3520,6 +3520,8 @@ int __init addrconf_init(void)
         if (err)
                 return err;
 
+        ip6_null_entry.rt6i_idev = in6_dev_get(&loopback_dev);
+
         register_netdevice_notifier(&ipv6_dev_notf);
 
 #ifdef CONFIG_IPV6_PRIVACY
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 2f589f24c093..563b442ffab8 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -666,7 +666,7 @@ slow_path:
                  */
                 fh->nexthdr = nexthdr;
                 fh->reserved = 0;
-                if (frag_id) {
+                if (!frag_id) {
                         ipv6_select_ident(skb, fh);
                         frag_id = fh->identification;
                 } else
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 29fed6e58d0a..519899fb11d5 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1968,7 +1968,7 @@ static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
         }
         pmc->mca_sources = NULL;
         pmc->mca_sfmode = MCAST_EXCLUDE;
-        pmc->mca_sfcount[MCAST_EXCLUDE] = 0;
+        pmc->mca_sfcount[MCAST_INCLUDE] = 0;
         pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
 }
 
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 216fbe1ac65c..bb7ccfe33f23 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -209,6 +209,17 @@ config IP6_NF_TARGET_REJECT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP6_NF_TARGET_NFQUEUE
+        tristate "NFQUEUE Target Support"
+        depends on IP_NF_IPTABLES
+        help
+          This Target replaced the old obsolete QUEUE target.
+
+          As opposed to QUEUE, it supports 65535 different queues,
+          not just one.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 #  if [ "$CONFIG_IP6_NF_FILTER" != "n" ]; then
 #    dep_tristate '    REJECT target support' CONFIG_IP6_NF_TARGET_REJECT $CONFIG_IP6_NF_FILTER
 #    if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index bd9a16a5cbba..2b2c370e8b1c 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -21,9 +21,9 @@ obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
 obj-$(CONFIG_IP6_NF_TARGET_MARK) += ip6t_MARK.o
 obj-$(CONFIG_IP6_NF_TARGET_HL) += ip6t_HL.o
+obj-$(CONFIG_IP6_NF_TARGET_NFQUEUE) += ip6t_NFQUEUE.o
 obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
 obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
 obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
 obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
-obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ip6t_NFQUEUE.o
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index aa11cf366efa..5027bbe6415e 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -238,8 +238,8 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
 
         pmsg->packet_id       = (unsigned long )entry;
         pmsg->data_len        = data_len;
-        pmsg->timestamp_sec   = skb_tv_base.tv_sec + entry->skb->tstamp.off_sec;
-        pmsg->timestamp_usec  = skb_tv_base.tv_usec + entry->skb->tstamp.off_usec;
+        pmsg->timestamp_sec   = entry->skb->tstamp.off_sec;
+        pmsg->timestamp_usec  = entry->skb->tstamp.off_usec;
         pmsg->mark            = entry->skb->nfmark;
         pmsg->hook            = entry->info->hook;
         pmsg->hw_protocol     = entry->skb->protocol;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 1cb8adb2787f..2da514b16d95 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1955,6 +1955,57 @@ static void __exit fini(void)
 #endif
 }
 
+/*
+ * find specified header up to transport protocol header.
+ * If found target header, the offset to the header is set to *offset
+ * and return 0. otherwise, return -1.
+ *
+ * Notes: - non-1st Fragment Header isn't skipped.
+ *        - ESP header isn't skipped.
+ *        - The target header may be trancated.
+ */
+int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset, u8 target)
+{
+        unsigned int start = (u8*)(skb->nh.ipv6h + 1) - skb->data;
+        u8 nexthdr = skb->nh.ipv6h->nexthdr;
+        unsigned int len = skb->len - start;
+
+        while (nexthdr != target) {
+                struct ipv6_opt_hdr _hdr, *hp;
+                unsigned int hdrlen;
+
+                if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE)
+                        return -1;
+                hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
+                if (hp == NULL)
+                        return -1;
+                if (nexthdr == NEXTHDR_FRAGMENT) {
+                        unsigned short _frag_off, *fp;
+                        fp = skb_header_pointer(skb,
+                                                start+offsetof(struct frag_hdr,
+                                                               frag_off),
+                                                sizeof(_frag_off),
+                                                &_frag_off);
+                        if (fp == NULL)
+                                return -1;
+
+                        if (ntohs(*fp) & ~0x7)
+                                return -1;
+                        hdrlen = 8;
+                } else if (nexthdr == NEXTHDR_AUTH)
+                        hdrlen = (hp->hdrlen + 2) << 2; 
+                else
+                        hdrlen = ipv6_optlen(hp); 
+
+                nexthdr = hp->nexthdr;
+                len -= hdrlen;
+                start += hdrlen;
+        }
+
+        *offset = start;
+        return 0;
+}
+
 EXPORT_SYMBOL(ip6t_register_table);
 EXPORT_SYMBOL(ip6t_unregister_table);
 EXPORT_SYMBOL(ip6t_do_table);
@@ -1963,6 +2014,7 @@ EXPORT_SYMBOL(ip6t_unregister_match);
 EXPORT_SYMBOL(ip6t_register_target);
 EXPORT_SYMBOL(ip6t_unregister_target);
 EXPORT_SYMBOL(ip6t_ext_hdr);
+EXPORT_SYMBOL(ipv6_find_hdr);
 
 module_init(init);
 module_exit(fini);
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index d5b94f142bba..dde37793d20b 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -48,92 +48,21 @@ match(const struct sk_buff *skb,
       unsigned int protoff,
       int *hotdrop)
 {
-        struct ip_auth_hdr *ah = NULL, _ah;
+        struct ip_auth_hdr *ah, _ah;
         const struct ip6t_ah *ahinfo = matchinfo;
-        unsigned int temp;
-        int len;
-        u8 nexthdr;
         unsigned int ptr;
         unsigned int hdrlen = 0;
 
-        /*DEBUGP("IPv6 AH entered\n");*/
-        /* if (opt->auth == 0) return 0;
-        * It does not filled on output */
-
-        /* type of the 1st exthdr */
-        nexthdr = skb->nh.ipv6h->nexthdr;
-        /* pointer to the 1st exthdr */
-        ptr = sizeof(struct ipv6hdr);
-        /* available length */
-        len = skb->len - ptr;
-        temp = 0;
-
-        while (ip6t_ext_hdr(nexthdr)) {
-                struct ipv6_opt_hdr _hdr, *hp;
-
-                DEBUGP("ipv6_ah header iteration \n");
-
-                /* Is there enough space for the next ext header? */
-                if (len < sizeof(struct ipv6_opt_hdr))
-                        return 0;
-                /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE)
-                        break;
-                /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP)
-                        break;
-
-                hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-                BUG_ON(hp == NULL);
-
-                /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT)
-                        hdrlen = 8;
-                else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-                /* AH -> evaluate */
-                if (nexthdr == NEXTHDR_AUTH) {
-                        temp |= MASK_AH;
-                        break;
-                }
-
-                
-                /* set the flag */
-                switch (nexthdr) {
-                case NEXTHDR_HOP:
-                case NEXTHDR_ROUTING:
-                case NEXTHDR_FRAGMENT:
-                case NEXTHDR_AUTH:
-                case NEXTHDR_DEST:
-                        break;
-                default:
-                        DEBUGP("ipv6_ah match: unknown nextheader %u\n",nexthdr);
-                        return 0;
-                }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if (ptr > skb->len) {
-                        DEBUGP("ipv6_ah: new pointer too large! \n");
-                        break;
-                }
-        }
-
-        /* AH header not found */
-        if (temp != MASK_AH)
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH) < 0)
                 return 0;
 
-        if (len < sizeof(struct ip_auth_hdr)){
+        ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah);
+        if (ah == NULL) {
                 *hotdrop = 1;
                 return 0;
         }
 
-        ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah);
-        BUG_ON(ah == NULL);
+        hdrlen = (ah->hdrlen + 2) << 2;
 
         DEBUGP("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
         DEBUGP("RES %04X ", ah->reserved);
diff --git a/net/ipv6/netfilter/ip6t_dst.c b/net/ipv6/netfilter/ip6t_dst.c
index 540925e4a7a8..c450a635e54b 100644
--- a/net/ipv6/netfilter/ip6t_dst.c
+++ b/net/ipv6/netfilter/ip6t_dst.c
@@ -63,8 +63,6 @@ match(const struct sk_buff *skb,
        struct ipv6_opt_hdr _optsh, *oh;
        const struct ip6t_opts *optinfo = matchinfo;
        unsigned int temp;
-       unsigned int len;
-       u8 nexthdr;
        unsigned int ptr;
        unsigned int hdrlen = 0;
        unsigned int ret = 0;
@@ -72,97 +70,25 @@ match(const struct sk_buff *skb,
        u8 _optlen, *lp = NULL;
        unsigned int optlen;
        
-       /* type of the 1st exthdr */
-       nexthdr = skb->nh.ipv6h->nexthdr;
-       /* pointer to the 1st exthdr */
-       ptr = sizeof(struct ipv6hdr);
-       /* available length */
-       len = skb->len - ptr;
-       temp = 0;
-
-        while (ip6t_ext_hdr(nexthdr)) {
-               struct ipv6_opt_hdr _hdr, *hp;
-
-              DEBUGP("ipv6_opts header iteration \n");
-
-              /* Is there enough space for the next ext header? */
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return 0;
-              /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE) {
-                     break;
-              }
-              /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP) {
-                     break;
-              }
-
-              hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-              BUG_ON(hp == NULL);
-
-              /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                        hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-              /* OPTS -> evaluate */
 #if HOPBYHOP
-                if (nexthdr == NEXTHDR_HOP) {
-                     temp |= MASK_HOPOPTS;
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_HOP) < 0)
 #else
-                if (nexthdr == NEXTHDR_DEST) {
-                     temp |= MASK_DSTOPTS;
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_DEST) < 0)
 #endif
-                     break;
-              }
-
+                return 0;
 
-              /* set the flag */
-              switch (nexthdr){
-                     case NEXTHDR_HOP:
-                     case NEXTHDR_ROUTING:
-                     case NEXTHDR_FRAGMENT:
-                     case NEXTHDR_AUTH:
-                     case NEXTHDR_DEST:
-                            break;
-                     default:
-                            DEBUGP("ipv6_opts match: unknown nextheader %u\n",nexthdr);
-                            return 0;
-                            break;
-              }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if ( ptr > skb->len ) {
-                        DEBUGP("ipv6_opts: new pointer is too large! \n");
-                        break;
-                }
-        }
-
-       /* OPTIONS header not found */
-#if HOPBYHOP
-       if ( temp != MASK_HOPOPTS ) return 0;
-#else
-       if ( temp != MASK_DSTOPTS ) return 0;
-#endif
-
-       if (len < (int)sizeof(struct ipv6_opt_hdr)){
+       oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
+       if (oh == NULL){
                *hotdrop = 1;
                 return 0;
        }
 
-       if (len < hdrlen){
+       hdrlen = ipv6_optlen(oh);
+       if (skb->len - ptr < hdrlen){
                /* Packet smaller than it's length field */
                 return 0;
        }
 
-       oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
-       BUG_ON(oh == NULL);
-
        DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
 
        DEBUGP("len %02X %04X %02X ",
diff --git a/net/ipv6/netfilter/ip6t_esp.c b/net/ipv6/netfilter/ip6t_esp.c
index e39dd236fd8e..24bc0cde43a1 100644
--- a/net/ipv6/netfilter/ip6t_esp.c
+++ b/net/ipv6/netfilter/ip6t_esp.c
@@ -48,87 +48,22 @@ match(const struct sk_buff *skb,
       unsigned int protoff,
       int *hotdrop)
 {
-        struct ip_esp_hdr _esp, *eh = NULL;
+        struct ip_esp_hdr _esp, *eh;
         const struct ip6t_esp *espinfo = matchinfo;
-        unsigned int temp;
-        int len;
-        u8 nexthdr;
         unsigned int ptr;
 
         /* Make sure this isn't an evil packet */
         /*DEBUGP("ipv6_esp entered \n");*/
 
-        /* type of the 1st exthdr */
-        nexthdr = skb->nh.ipv6h->nexthdr;
-        /* pointer to the 1st exthdr */
-        ptr = sizeof(struct ipv6hdr);
-        /* available length */
-        len = skb->len - ptr;
-        temp = 0;
-
-        while (ip6t_ext_hdr(nexthdr)) {
-                struct ipv6_opt_hdr _hdr, *hp;
-                int hdrlen;
-
-                DEBUGP("ipv6_esp header iteration \n");
-
-                /* Is there enough space for the next ext header? */
-                if (len < sizeof(struct ipv6_opt_hdr))
-                        return 0;
-                /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE)
-                        break;
-                /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP) {
-                        temp |= MASK_ESP;
-                        break;
-                }
-
-                hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-                BUG_ON(hp == NULL);
-
-                /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT)
-                        hdrlen = 8;
-                else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-                /* set the flag */
-                switch (nexthdr) {
-                case NEXTHDR_HOP:
-                case NEXTHDR_ROUTING:
-                case NEXTHDR_FRAGMENT:
-                case NEXTHDR_AUTH:
-                case NEXTHDR_DEST:
-                        break;
-                default:
-                        DEBUGP("ipv6_esp match: unknown nextheader %u\n",nexthdr);
-                        return 0;
-                }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if (ptr > skb->len) {
-                        DEBUGP("ipv6_esp: new pointer too large! \n");
-                        break;
-                }
-        }
-
-        /* ESP header not found */
-        if (temp != MASK_ESP)
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ESP) < 0)
                 return 0;
 
-        if (len < sizeof(struct ip_esp_hdr)) {
+        eh = skb_header_pointer(skb, ptr, sizeof(_esp), &_esp);
+        if (eh == NULL) {
                 *hotdrop = 1;
                 return 0;
         }
 
-        eh = skb_header_pointer(skb, ptr, sizeof(_esp), &_esp);
-        BUG_ON(eh == NULL);
-
         DEBUGP("IPv6 ESP SPI %u %08X\n", ntohl(eh->spi), ntohl(eh->spi));
 
         return (eh != NULL)
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 4bfa30a9bc80..085d5f8eea29 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -48,90 +48,18 @@ match(const struct sk_buff *skb,
       unsigned int protoff,
       int *hotdrop)
 {
-       struct frag_hdr _frag, *fh = NULL;
+       struct frag_hdr _frag, *fh;
        const struct ip6t_frag *fraginfo = matchinfo;
-       unsigned int temp;
-       int len;
-       u8 nexthdr;
        unsigned int ptr;
-       unsigned int hdrlen = 0;
-
-       /* type of the 1st exthdr */
-       nexthdr = skb->nh.ipv6h->nexthdr;
-       /* pointer to the 1st exthdr */
-       ptr = sizeof(struct ipv6hdr);
-       /* available length */
-       len = skb->len - ptr;
-       temp = 0;
-
-        while (ip6t_ext_hdr(nexthdr)) {
-               struct ipv6_opt_hdr _hdr, *hp;
-
-              DEBUGP("ipv6_frag header iteration \n");
-
-              /* Is there enough space for the next ext header? */
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return 0;
-              /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE) {
-                     break;
-              }
-              /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP) {
-                     break;
-              }
-
-              hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-              BUG_ON(hp == NULL);
-
-              /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                        hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-              /* FRAG -> evaluate */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                     temp |= MASK_FRAGMENT;
-                     break;
-              }
-
-
-              /* set the flag */
-              switch (nexthdr){
-                     case NEXTHDR_HOP:
-                     case NEXTHDR_ROUTING:
-                     case NEXTHDR_FRAGMENT:
-                     case NEXTHDR_AUTH:
-                     case NEXTHDR_DEST:
-                            break;
-                     default:
-                            DEBUGP("ipv6_frag match: unknown nextheader %u\n",nexthdr);
-                            return 0;
-                            break;
-              }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if ( ptr > skb->len ) {
-                        DEBUGP("ipv6_frag: new pointer too large! \n");
-                        break;
-                }
-        }
-
-       /* FRAG header not found */
-       if ( temp != MASK_FRAGMENT ) return 0;
-
-       if (len < sizeof(struct frag_hdr)){
-               *hotdrop = 1;
-                return 0;
-       }
 
-       fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
-       BUG_ON(fh == NULL);
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT) < 0)
+                return 0;
+
+        fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
+        if (fh == NULL){
+                *hotdrop = 1;
+                return 0;
+        }
 
        DEBUGP("INFO %04X ", fh->frag_off);
        DEBUGP("OFFSET %04X ", ntohs(fh->frag_off) & ~0x7);
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 27f3650d127e..1d09485111d0 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -63,8 +63,6 @@ match(const struct sk_buff *skb,
        struct ipv6_opt_hdr _optsh, *oh;
        const struct ip6t_opts *optinfo = matchinfo;
        unsigned int temp;
-       unsigned int len;
-       u8 nexthdr;
        unsigned int ptr;
        unsigned int hdrlen = 0;
        unsigned int ret = 0;
@@ -72,97 +70,25 @@ match(const struct sk_buff *skb,
        u8 _optlen, *lp = NULL;
        unsigned int optlen;
        
-       /* type of the 1st exthdr */
-       nexthdr = skb->nh.ipv6h->nexthdr;
-       /* pointer to the 1st exthdr */
-       ptr = sizeof(struct ipv6hdr);
-       /* available length */
-       len = skb->len - ptr;
-       temp = 0;
-
-        while (ip6t_ext_hdr(nexthdr)) {
-               struct ipv6_opt_hdr _hdr, *hp;
-
-              DEBUGP("ipv6_opts header iteration \n");
-
-              /* Is there enough space for the next ext header? */
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return 0;
-              /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE) {
-                     break;
-              }
-              /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP) {
-                     break;
-              }
-
-              hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-              BUG_ON(hp == NULL);
-
-              /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                        hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-              /* OPTS -> evaluate */
 #if HOPBYHOP
-                if (nexthdr == NEXTHDR_HOP) {
-                     temp |= MASK_HOPOPTS;
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_HOP) < 0)
 #else
-                if (nexthdr == NEXTHDR_DEST) {
-                     temp |= MASK_DSTOPTS;
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_DEST) < 0)
 #endif
-                     break;
-              }
-
+                return 0;
 
-              /* set the flag */
-              switch (nexthdr){
-                     case NEXTHDR_HOP:
-                     case NEXTHDR_ROUTING:
-                     case NEXTHDR_FRAGMENT:
-                     case NEXTHDR_AUTH:
-                     case NEXTHDR_DEST:
-                            break;
-                     default:
-                            DEBUGP("ipv6_opts match: unknown nextheader %u\n",nexthdr);
-                            return 0;
-                            break;
-              }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if ( ptr > skb->len ) {
-                        DEBUGP("ipv6_opts: new pointer is too large! \n");
-                        break;
-                }
-        }
-
-       /* OPTIONS header not found */
-#if HOPBYHOP
-       if ( temp != MASK_HOPOPTS ) return 0;
-#else
-       if ( temp != MASK_DSTOPTS ) return 0;
-#endif
-
-       if (len < (int)sizeof(struct ipv6_opt_hdr)){
+       oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
+       if (oh == NULL){
                *hotdrop = 1;
                 return 0;
        }
 
-       if (len < hdrlen){
+       hdrlen = ipv6_optlen(oh);
+       if (skb->len - ptr < hdrlen){
                /* Packet smaller than it's length field */
                 return 0;
        }
 
-       oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
-       BUG_ON(oh == NULL);
-
        DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
 
        DEBUGP("len %02X %04X %02X ",
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 2bb670037df3..beb2fd5cebbb 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -50,98 +50,29 @@ match(const struct sk_buff *skb,
       unsigned int protoff,
       int *hotdrop)
 {
-       struct ipv6_rt_hdr _route, *rh = NULL;
+       struct ipv6_rt_hdr _route, *rh;
        const struct ip6t_rt *rtinfo = matchinfo;
        unsigned int temp;
-       unsigned int len;
-       u8 nexthdr;
        unsigned int ptr;
        unsigned int hdrlen = 0;
        unsigned int ret = 0;
        struct in6_addr *ap, _addr;
 
-       /* type of the 1st exthdr */
-       nexthdr = skb->nh.ipv6h->nexthdr;
-       /* pointer to the 1st exthdr */
-       ptr = sizeof(struct ipv6hdr);
-       /* available length */
-       len = skb->len - ptr;
-       temp = 0;
+        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING) < 0)
+                return 0;
 
-        while (ip6t_ext_hdr(nexthdr)) {
-               struct ipv6_opt_hdr _hdr, *hp;
-
-              DEBUGP("ipv6_rt header iteration \n");
-
-              /* Is there enough space for the next ext header? */
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return 0;
-              /* No more exthdr -> evaluate */
-                if (nexthdr == NEXTHDR_NONE) {
-                     break;
-              }
-              /* ESP -> evaluate */
-                if (nexthdr == NEXTHDR_ESP) {
-                     break;
-              }
-
-              hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
-              BUG_ON(hp == NULL);
-
-              /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                        hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH)
-                        hdrlen = (hp->hdrlen+2)<<2;
-                else
-                        hdrlen = ipv6_optlen(hp);
-
-              /* ROUTING -> evaluate */
-                if (nexthdr == NEXTHDR_ROUTING) {
-                     temp |= MASK_ROUTING;
-                     break;
-              }
-
-
-              /* set the flag */
-              switch (nexthdr){
-                     case NEXTHDR_HOP:
-                     case NEXTHDR_ROUTING:
-                     case NEXTHDR_FRAGMENT:
-                     case NEXTHDR_AUTH:
-                     case NEXTHDR_DEST:
-                            break;
-                     default:
-                            DEBUGP("ipv6_rt match: unknown nextheader %u\n",nexthdr);
-                            return 0;
-                            break;
-              }
-
-                nexthdr = hp->nexthdr;
-                len -= hdrlen;
-                ptr += hdrlen;
-                if ( ptr > skb->len ) {
-                        DEBUGP("ipv6_rt: new pointer is too large! \n");
-                        break;
-                }
-        }
-
-       /* ROUTING header not found */
-       if ( temp != MASK_ROUTING ) return 0;
-
-       if (len < (int)sizeof(struct ipv6_rt_hdr)){
+       rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
+       if (rh == NULL){
                *hotdrop = 1;
                 return 0;
        }
 
-       if (len < hdrlen){
+       hdrlen = ipv6_optlen(rh);
+       if (skb->len - ptr < hdrlen){
                /* Pcket smaller than its length field */
                 return 0;
        }
 
-       rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
-       BUG_ON(rh == NULL);
-
        DEBUGP("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
        DEBUGP("TYPE %04X ", rh->type);
        DEBUGP("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 5aa3691c578d..a1265a320b11 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -627,7 +627,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
 
                         if (type && code) {
                                 get_user(fl->fl_icmp_type, type);
-                                __get_user(fl->fl_icmp_code, code);
+                                get_user(fl->fl_icmp_code, code);
                                 probed = 1;
                         }
                         break;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 80643e6b346b..d693cb988b78 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -209,9 +209,11 @@ static __inline__ void __tcp_v6_hash(struct sock *sk)
                 lock = &tcp_hashinfo.lhash_lock;
                 inet_listen_wlock(&tcp_hashinfo);
         } else {
-                sk->sk_hashent = inet6_sk_ehashfn(sk, tcp_hashinfo.ehash_size);
-                list = &tcp_hashinfo.ehash[sk->sk_hashent].chain;
-                lock = &tcp_hashinfo.ehash[sk->sk_hashent].lock;
+                unsigned int hash;
+                sk->sk_hash = hash = inet6_sk_ehashfn(sk);
+                hash &= (tcp_hashinfo.ehash_size - 1);
+                list = &tcp_hashinfo.ehash[hash].chain;
+                lock = &tcp_hashinfo.ehash[hash].lock;
                 write_lock(lock);
         }
 
@@ -322,13 +324,13 @@ static int __tcp_v6_check_established(struct sock *sk, const __u16 lport,
         const struct in6_addr *saddr = &np->daddr;
         const int dif = sk->sk_bound_dev_if;
         const u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
-        const int hash = inet6_ehashfn(daddr, inet->num, saddr, inet->dport,
-                                       tcp_hashinfo.ehash_size);
-        struct inet_ehash_bucket *head = &tcp_hashinfo.ehash[hash];
+        unsigned int hash = inet6_ehashfn(daddr, inet->num, saddr, inet->dport);
+        struct inet_ehash_bucket *head = inet_ehash_bucket(&tcp_hashinfo, hash);
         struct sock *sk2;
         const struct hlist_node *node;
         struct inet_timewait_sock *tw;
 
+        prefetch(head->chain.first);
         write_lock(&head->lock);
 
         /* Check TIME-WAIT sockets first. */
@@ -365,14 +367,14 @@ static int __tcp_v6_check_established(struct sock *sk, const __u16 lport,
 
         /* And established part... */
         sk_for_each(sk2, node, &head->chain) {
-                if (INET6_MATCH(sk2, saddr, daddr, ports, dif))
+                if (INET6_MATCH(sk2, hash, saddr, daddr, ports, dif))
                         goto not_unique;
         }
 
 unique:
         BUG_TRAP(sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
-        sk->sk_hashent = hash;
+        sk->sk_hash = hash;
         sock_prot_inc_use(sk->sk_prot);
         write_unlock(&head->lock);
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 69b146843a20..e4cad11f284a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -405,9 +405,8 @@ static struct sock *udp_v6_mcast_next(struct sock *sk,
                                 continue;
 
                         if (!ipv6_addr_any(&np->rcv_saddr)) {
-                                if (ipv6_addr_equal(&np->rcv_saddr, loc_addr))
-                                        return s;
-                                continue;
+                                if (!ipv6_addr_equal(&np->rcv_saddr, loc_addr))
+                                        continue;
                         }
                         if(!inet6_mc_check(s, loc_addr, rmt_addr))
                                 continue;
@@ -640,6 +639,7 @@ static int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int tclass = -1;
         int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
         int err;
+        int connected = 0;
 
         /* destination address check */
         if (sin6) {
@@ -749,6 +749,7 @@ do_udp_sendmsg:
                 fl->fl_ip_dport = inet->dport;
                 daddr = &np->daddr;
                 fl->fl6_flowlabel = np->flow_label;
+                connected = 1;
         }
 
         if (!fl->oif)
@@ -771,6 +772,7 @@ do_udp_sendmsg:
                 }
                 if (!(opt->opt_nflen|opt->opt_flen))
                         opt = NULL;
+                connected = 0;
         }
         if (opt == NULL)
                 opt = np->opt;
@@ -788,10 +790,13 @@ do_udp_sendmsg:
                 ipv6_addr_copy(&final, &fl->fl6_dst);
                 ipv6_addr_copy(&fl->fl6_dst, rt0->addr);
                 final_p = &final;
+                connected = 0;
         }
 
-        if (!fl->oif && ipv6_addr_is_multicast(&fl->fl6_dst))
+        if (!fl->oif && ipv6_addr_is_multicast(&fl->fl6_dst)) {
                 fl->oif = np->mcast_oif;
+                connected = 0;
+        }
 
         err = ip6_dst_lookup(sk, &dst, fl);
         if (err)
@@ -847,10 +852,16 @@ do_append_data:
         else if (!corkreq)
                 err = udp_v6_push_pending_frames(sk, up);
 
-        if (dst)
-                ip6_dst_store(sk, dst,
-                              ipv6_addr_equal(&fl->fl6_dst, &np->daddr) ?
-                              &np->daddr : NULL);
+        if (dst) {
+                if (connected) {
+                        ip6_dst_store(sk, dst,
+                                      ipv6_addr_equal(&fl->fl6_dst, &np->daddr) ?
+                                      &np->daddr : NULL);
+                } else {
+                        dst_release(dst);
+                }
+        }
+
         if (err > 0)
                 err = np->recverr ? net_xmit_errno(err) : 0;
         release_sock(sk);
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 071cd2cefd8a..953e255d2bc8 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -310,7 +310,7 @@ void irlan_eth_send_gratuitous_arp(struct net_device *dev)
 #ifdef CONFIG_INET
         IRDA_DEBUG(4, "IrLAN: Sending gratuitous ARP\n");
         rcu_read_lock();
-        in_dev = __in_dev_get(dev);
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev == NULL)
                 goto out;
         if (in_dev->ifa_list)
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index 6602d901f8b1..8aff254cb418 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -38,7 +38,7 @@
 #include <net/irda/parameters.h>
 #include <net/irda/irttp.h>
 
-static struct irttp_cb *irttp = NULL;
+static struct irttp_cb *irttp;
 
 static void __irttp_close_tsap(struct tsap_cb *self);
 
@@ -86,12 +86,9 @@ static pi_param_info_t param_info = { pi_major_call_table, 1, 0x0f, 4 };
  */
 int __init irttp_init(void)
 {
-        /* Initialize the irttp structure. */
-        if (irttp == NULL) {
-                irttp = kmalloc(sizeof(struct irttp_cb), GFP_KERNEL);
-                if (irttp == NULL)
-                        return -ENOMEM;
-        }
+        irttp = kmalloc(sizeof(struct irttp_cb), GFP_KERNEL);
+        if (irttp == NULL)
+                return -ENOMEM;
         memset(irttp, 0, sizeof(struct irttp_cb));
 
         irttp->magic = TTP_MAGIC;
@@ -100,6 +97,7 @@ int __init irttp_init(void)
         if (!irttp->tsaps) {
                 IRDA_ERROR("%s: can't allocate IrTTP hashbin!\n",
                            __FUNCTION__);
+                kfree(irttp);
                 return -ENOMEM;
         }
 
@@ -115,7 +113,6 @@ int __init irttp_init(void)
 void __exit irttp_cleanup(void) 
 {
         /* Check for main structure */
-        IRDA_ASSERT(irttp != NULL, return;);
         IRDA_ASSERT(irttp->magic == TTP_MAGIC, return;);
 
         /*
@@ -382,7 +379,6 @@ struct tsap_cb *irttp_open_tsap(__u8 stsap_sel, int credit, notify_t *notify)
         struct lsap_cb *lsap;
         notify_t ttp_notify;
 
-        IRDA_ASSERT(irttp != NULL, return NULL;);
         IRDA_ASSERT(irttp->magic == TTP_MAGIC, return NULL;);
 
         /* The IrLMP spec (IrLMP 1.1 p10) says that we have the right to
@@ -1880,8 +1876,6 @@ static int irttp_seq_open(struct inode *inode, struct file *file)
         struct seq_file *seq;
         int rc = -ENOMEM;
         struct irttp_iter_state *s;
-       
-        IRDA_ASSERT(irttp != NULL, return -EINVAL;);
 
         s = kmalloc(sizeof(*s), GFP_KERNEL);
         if (!s)
diff --git a/net/llc/Makefile b/net/llc/Makefile
index 5ebd4ed2bd42..4e260cff3c5d 100644
--- a/net/llc/Makefile
+++ b/net/llc/Makefile
@@ -22,3 +22,4 @@ llc2-y := llc_if.o llc_c_ev.o llc_c_ac.o llc_conn.o llc_c_st.o llc_pdu.o \
           llc_sap.o llc_s_ac.o llc_s_ev.o llc_s_st.o af_llc.o llc_station.o
 
 llc2-$(CONFIG_PROC_FS) += llc_proc.o
+llc2-$(CONFIG_SYSCTL)  += sysctl_net_llc.o
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 66f55e514b56..59d02cbbeb9e 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -21,6 +21,7 @@
  * See the GNU General Public License for more details.
  */
 #include <linux/config.h>
+#include <linux/compiler.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/rtnetlink.h>
@@ -37,10 +38,9 @@ static u16 llc_ui_sap_link_no_max[256];
 static struct sockaddr_llc llc_ui_addrnull;
 static struct proto_ops llc_ui_ops;
 
-static int llc_ui_wait_for_conn(struct sock *sk, int timeout);
-static int llc_ui_wait_for_disc(struct sock *sk, int timeout);
-static int llc_ui_wait_for_data(struct sock *sk, int timeout);
-static int llc_ui_wait_for_busy_core(struct sock *sk, int timeout);
+static int llc_ui_wait_for_conn(struct sock *sk, long timeout);
+static int llc_ui_wait_for_disc(struct sock *sk, long timeout);
+static int llc_ui_wait_for_busy_core(struct sock *sk, long timeout);
 
 #if 0
 #define dprintk(args...) printk(KERN_DEBUG args)
@@ -116,12 +116,12 @@ static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
         struct llc_sock* llc = llc_sk(sk);
         int rc = 0;
 
-        if (llc_data_accept_state(llc->state) || llc->p_flag) {
-                int timeout = sock_sndtimeo(sk, noblock);
+        if (unlikely(llc_data_accept_state(llc->state) || llc->p_flag)) {
+                long timeout = sock_sndtimeo(sk, noblock);
 
                 rc = llc_ui_wait_for_busy_core(sk, timeout);
         }
-        if (!rc)
+        if (unlikely(!rc))
                 rc = llc_build_and_send_pkt(sk, skb);
         return rc;
 }
@@ -155,7 +155,7 @@ static int llc_ui_create(struct socket *sock, int protocol)
         struct sock *sk;
         int rc = -ESOCKTNOSUPPORT;
 
-        if (sock->type == SOCK_DGRAM || sock->type == SOCK_STREAM) {
+        if (likely(sock->type == SOCK_DGRAM || sock->type == SOCK_STREAM)) {
                 rc = -ENOMEM;
                 sk = llc_sk_alloc(PF_LLC, GFP_KERNEL, &llc_proto);
                 if (sk) {
@@ -177,7 +177,7 @@ static int llc_ui_release(struct socket *sock)
         struct sock *sk = sock->sk;
         struct llc_sock *llc;
 
-        if (!sk)
+        if (unlikely(sk == NULL))
                 goto out;
         sock_hold(sk);
         lock_sock(sk);
@@ -189,10 +189,6 @@ static int llc_ui_release(struct socket *sock)
         if (!sock_flag(sk, SOCK_ZAPPED))
                 llc_sap_remove_socket(llc->sap, sk);
         release_sock(sk);
-        if (llc->sap && hlist_empty(&llc->sap->sk_list.list)) {
-                llc_release_sockets(llc->sap);
-                llc_sap_close(llc->sap);
-        }
         if (llc->dev)
                 dev_put(llc->dev);
         sock_put(sk);
@@ -221,6 +217,7 @@ static int llc_ui_autoport(void)
                                 llc_ui_sap_last_autoport = i + 2;
                                 goto out;
                         }
+                        llc_sap_put(sap);
                 }
                 llc_ui_sap_last_autoport = LLC_SAP_DYN_START;
                 tries++;
@@ -231,20 +228,13 @@ out:
 }
 
 /**
- *      llc_ui_autobind - Bind a socket to a specific address.
- *      @sk: Socket to bind an address to.
- *      @addr: Address the user wants the socket bound to.
+ *      llc_ui_autobind - automatically bind a socket to a sap
+ *      @sock: socket to bind
+ *      @addr: address to connect to
+ *
+ *      Used by llc_ui_connect and llc_ui_sendmsg when the user hasn't
+ *      specifically used llc_ui_bind to bind to an specific address/sap
  *
- *      Bind a socket to a specific address. For llc a user is able to bind to
- *      a specific sap only or mac + sap. If the user only specifies a sap and
- *      a null dmac (all zeros) the user is attempting to bind to an entire
- *      sap. This will stop anyone else on the local system from using that
- *      sap.  If someone else has a mac + sap open the bind to null + sap will
- *      fail.
- *      If the user desires to bind to a specific mac + sap, it is possible to
- *      have multiple sap connections via multiple macs.
- *      Bind and autobind for that matter must enforce the correct sap usage
- *      otherwise all hell will break loose.
  *      Returns: 0 upon success, negative otherwise.
  */
 static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
@@ -285,11 +275,7 @@ out:
  *      @addrlen: Length of the uaddr structure.
  *
  *      Bind a socket to a specific address. For llc a user is able to bind to
- *      a specific sap only or mac + sap. If the user only specifies a sap and
- *      a null dmac (all zeros) the user is attempting to bind to an entire
- *      sap. This will stop anyone else on the local system from using that
- *      sap. If someone else has a mac + sap open the bind to null + sap will
- *      fail.
+ *      a specific sap only or mac + sap.
  *      If the user desires to bind to a specific mac + sap, it is possible to
  *      have multiple sap connections via multiple macs.
  *      Bind and autobind for that matter must enforce the correct sap usage
@@ -305,10 +291,16 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         int rc = -EINVAL;
 
         dprintk("%s: binding %02X\n", __FUNCTION__, addr->sllc_sap);
-        if (!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr))
+        if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
                 goto out;
         rc = -EAFNOSUPPORT;
-        if (addr->sllc_family != AF_LLC)
+        if (unlikely(addr->sllc_family != AF_LLC))
+                goto out;
+        rc = -ENODEV;
+        rtnl_lock();
+        llc->dev = dev_getbyhwaddr(addr->sllc_arphrd, addr->sllc_mac);
+        rtnl_unlock();
+        if (!llc->dev)
                 goto out;
         if (!addr->sllc_sap) {
                 rc = -EUSERS;
@@ -322,6 +314,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 rc = -EBUSY; /* some other network layer is using the sap */
                 if (!sap)
                         goto out;
+                llc_sap_hold(sap);
         } else {
                 struct llc_addr laddr, daddr;
                 struct sock *ask;
@@ -338,7 +331,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 ask = llc_lookup_established(sap, &daddr, &laddr);
                 if (ask) {
                         sock_put(ask);
-                        goto out;
+                        goto out_put;
                 }
         }
         llc->laddr.lsap = addr->sllc_sap;
@@ -348,6 +341,8 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         llc_sap_add_socket(sap, sk);
         sock_reset_flag(sk, SOCK_ZAPPED);
         rc = 0;
+out_put:
+        llc_sap_put(sap);
 out:
         return rc;
 }
@@ -369,7 +364,7 @@ static int llc_ui_shutdown(struct socket *sock, int how)
         int rc = -ENOTCONN;
 
         lock_sock(sk);
-        if (sk->sk_state != TCP_ESTABLISHED)
+        if (unlikely(sk->sk_state != TCP_ESTABLISHED))
                 goto out;
         rc = -EINVAL;
         if (how != 2)
@@ -404,14 +399,18 @@ static int llc_ui_connect(struct socket *sock, struct sockaddr *uaddr,
         struct sock *sk = sock->sk;
         struct llc_sock *llc = llc_sk(sk);
         struct sockaddr_llc *addr = (struct sockaddr_llc *)uaddr;
-        struct net_device *dev;
         int rc = -EINVAL;
 
         lock_sock(sk);
-        if (addrlen != sizeof(*addr))
+        if (unlikely(addrlen != sizeof(*addr)))
                 goto out;
         rc = -EAFNOSUPPORT;
-        if (addr->sllc_family != AF_LLC)
+        if (unlikely(addr->sllc_family != AF_LLC))
+                goto out;
+        if (unlikely(sk->sk_type != SOCK_STREAM))
+                goto out;
+        rc = -EALREADY;
+        if (unlikely(sock->state == SS_CONNECTING))
                 goto out;
         /* bind connection to sap if user hasn't done it. */
         if (sock_flag(sk, SOCK_ZAPPED)) {
@@ -419,19 +418,13 @@ static int llc_ui_connect(struct socket *sock, struct sockaddr *uaddr,
                 rc = llc_ui_autobind(sock, addr);
                 if (rc)
                         goto out;
-                llc->daddr.lsap = addr->sllc_sap;
-                memcpy(llc->daddr.mac, addr->sllc_mac, IFHWADDRLEN);
         }
-        dev = llc->dev;
-        if (sk->sk_type != SOCK_STREAM)
-                goto out;
-        rc = -EALREADY;
-        if (sock->state == SS_CONNECTING)
-                goto out;
+        llc->daddr.lsap = addr->sllc_sap;
+        memcpy(llc->daddr.mac, addr->sllc_mac, IFHWADDRLEN);
         sock->state = SS_CONNECTING;
         sk->sk_state   = TCP_SYN_SENT;
         llc->link   = llc_ui_next_link_no(llc->sap->laddr.lsap);
-        rc = llc_establish_connection(sk, dev->dev_addr,
+        rc = llc_establish_connection(sk, llc->dev->dev_addr,
                                       addr->sllc_mac, addr->sllc_sap);
         if (rc) {
                 dprintk("%s: llc_ui_send_conn failed :-(\n", __FUNCTION__);
@@ -439,12 +432,30 @@ static int llc_ui_connect(struct socket *sock, struct sockaddr *uaddr,
                 sk->sk_state = TCP_CLOSE;
                 goto out;
         }
-        rc = llc_ui_wait_for_conn(sk, sk->sk_rcvtimeo);
-        if (rc)
-                dprintk("%s: llc_ui_wait_for_conn failed=%d\n", __FUNCTION__, rc);
+
+        if (sk->sk_state == TCP_SYN_SENT) {
+                const long timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
+
+                if (!timeo || !llc_ui_wait_for_conn(sk, timeo))
+                        goto out;
+
+                rc = sock_intr_errno(timeo);
+                if (signal_pending(current))
+                        goto out;
+        }
+
+        if (sk->sk_state == TCP_CLOSE)
+                goto sock_error;
+
+        sock->state = SS_CONNECTED;
+        rc = 0;
 out:
         release_sock(sk);
         return rc;
+sock_error:
+        rc = sock_error(sk) ? : -ECONNABORTED;
+        sock->state = SS_UNCONNECTED;
+        goto out;
 }
 
 /**
@@ -461,10 +472,10 @@ static int llc_ui_listen(struct socket *sock, int backlog)
         int rc = -EINVAL;
 
         lock_sock(sk);
-        if (sock->state != SS_UNCONNECTED)
+        if (unlikely(sock->state != SS_UNCONNECTED))
                 goto out;
         rc = -EOPNOTSUPP;
-        if (sk->sk_type != SOCK_STREAM)
+        if (unlikely(sk->sk_type != SOCK_STREAM))
                 goto out;
         rc = -EAGAIN;
         if (sock_flag(sk, SOCK_ZAPPED))
@@ -483,20 +494,14 @@ out:
         return rc;
 }
 
-static int llc_ui_wait_for_disc(struct sock *sk, int timeout)
+static int llc_ui_wait_for_disc(struct sock *sk, long timeout)
 {
-        DECLARE_WAITQUEUE(wait, current);
-        int rc;
+        DEFINE_WAIT(wait);
+        int rc = 0;
 
-        add_wait_queue_exclusive(sk->sk_sleep, &wait);
-        for (;;) {
-                __set_current_state(TASK_INTERRUPTIBLE);
-                rc = 0;
-                if (sk->sk_state != TCP_CLOSE) {
-                        release_sock(sk);
-                        timeout = schedule_timeout(timeout);
-                        lock_sock(sk);
-                } else
+        while (1) {
+                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                if (sk_wait_event(sk, &timeout, sk->sk_state == TCP_CLOSE))
                         break;
                 rc = -ERESTARTSYS;
                 if (signal_pending(current))
@@ -504,65 +509,40 @@ static int llc_ui_wait_for_disc(struct sock *sk, int timeout)
                 rc = -EAGAIN;
                 if (!timeout)
                         break;
+                rc = 0;
         }
-        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        finish_wait(sk->sk_sleep, &wait);
         return rc;
 }
 
-static int llc_ui_wait_for_conn(struct sock *sk, int timeout)
+static int llc_ui_wait_for_conn(struct sock *sk, long timeout)
 {
-        DECLARE_WAITQUEUE(wait, current);
-        int rc;
+        DEFINE_WAIT(wait);
 
-        add_wait_queue_exclusive(sk->sk_sleep, &wait);
-        for (;;) {
-                __set_current_state(TASK_INTERRUPTIBLE);
-                rc = -EAGAIN;
-                if (sk->sk_state == TCP_CLOSE)
-                        break;
-                rc = 0;
-                if (sk->sk_state != TCP_ESTABLISHED) {
-                        release_sock(sk);
-                        timeout = schedule_timeout(timeout);
-                        lock_sock(sk);
-                } else
+        while (1) {
+                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                if (sk_wait_event(sk, &timeout, sk->sk_state != TCP_SYN_SENT))
                         break;
-                rc = -ERESTARTSYS;
-                if (signal_pending(current))
-                        break;
-                rc = -EAGAIN;
-                if (!timeout)
+                if (signal_pending(current) || !timeout)
                         break;
         }
-        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
-        return rc;
+        finish_wait(sk->sk_sleep, &wait);
+        return timeout;
 }
 
-static int llc_ui_wait_for_data(struct sock *sk, int timeout)
+static int llc_ui_wait_for_busy_core(struct sock *sk, long timeout)
 {
-        DECLARE_WAITQUEUE(wait, current);
-        int rc = 0;
+        DEFINE_WAIT(wait);
+        struct llc_sock *llc = llc_sk(sk);
+        int rc;
 
-        add_wait_queue_exclusive(sk->sk_sleep, &wait);
-        for (;;) {
-                __set_current_state(TASK_INTERRUPTIBLE);
-                if (sk->sk_shutdown & RCV_SHUTDOWN)
-                        break;
-                /*
-                 * Well, if we have backlog, try to process it now.
-                 */
-                if (sk->sk_backlog.tail) {
-                        release_sock(sk);
-                        lock_sock(sk);
-                }
+        while (1) {
+                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
                 rc = 0;
-                if (skb_queue_empty(&sk->sk_receive_queue)) {
-                        release_sock(sk);
-                        timeout = schedule_timeout(timeout);
-                        lock_sock(sk);
-                } else
+                if (sk_wait_event(sk, &timeout,
+                                  (sk->sk_shutdown & RCV_SHUTDOWN) ||
+                                  (!llc_data_accept_state(llc->state) &&
+                                   !llc->p_flag)))
                         break;
                 rc = -ERESTARTSYS;
                 if (signal_pending(current))
@@ -571,40 +551,35 @@ static int llc_ui_wait_for_data(struct sock *sk, int timeout)
                 if (!timeout)
                         break;
         }
-        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        finish_wait(sk->sk_sleep, &wait);
         return rc;
 }
 
-static int llc_ui_wait_for_busy_core(struct sock *sk, int timeout)
+static int llc_wait_data(struct sock *sk, long timeo)
 {
-        DECLARE_WAITQUEUE(wait, current);
-        struct llc_sock *llc = llc_sk(sk);
         int rc;
 
-        add_wait_queue_exclusive(sk->sk_sleep, &wait);
-        for (;;) {
-                dprintk("%s: looping...\n", __FUNCTION__);
-                __set_current_state(TASK_INTERRUPTIBLE);
-                rc = -ENOTCONN;
-                if (sk->sk_shutdown & RCV_SHUTDOWN)
+        while (1) {
+                /*
+                 * POSIX 1003.1g mandates this order.
+                 */
+                if (sk->sk_err) {
+                        rc = sock_error(sk);
                         break;
+                }
                 rc = 0;
-                if (llc_data_accept_state(llc->state) || llc->p_flag) {
-                        release_sock(sk);
-                        timeout = schedule_timeout(timeout);
-                        lock_sock(sk);
-                } else
+                if (sk->sk_shutdown & RCV_SHUTDOWN)
                         break;
-                rc = -ERESTARTSYS;
+                rc = -EAGAIN;
+                if (!timeo)
+                        break;
+                rc = sock_intr_errno(timeo);
                 if (signal_pending(current))
                         break;
-                rc = -EAGAIN;
-                if (!timeout)
+                rc = 0;
+                if (sk_wait_data(sk, &timeo))
                         break;
         }
-        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
         return rc;
 }
 
@@ -627,15 +602,18 @@ static int llc_ui_accept(struct socket *sock, struct socket *newsock, int flags)
         dprintk("%s: accepting on %02X\n", __FUNCTION__,
                 llc_sk(sk)->laddr.lsap);
         lock_sock(sk);
-        if (sk->sk_type != SOCK_STREAM)
+        if (unlikely(sk->sk_type != SOCK_STREAM))
                 goto out;
         rc = -EINVAL;
-        if (sock->state != SS_UNCONNECTED || sk->sk_state != TCP_LISTEN)
+        if (unlikely(sock->state != SS_UNCONNECTED ||
+                     sk->sk_state != TCP_LISTEN))
                 goto out;
         /* wait for a connection to arrive. */
-        rc = llc_ui_wait_for_data(sk, sk->sk_rcvtimeo);
-        if (rc)
-                goto out;
+        if (skb_queue_empty(&sk->sk_receive_queue)) {
+                rc = llc_wait_data(sk, sk->sk_rcvtimeo);
+                if (rc)
+                        goto out;
+        }
         dprintk("%s: got a new connection on %02X\n", __FUNCTION__,
                 llc_sk(sk)->laddr.lsap);
         skb = skb_dequeue(&sk->sk_receive_queue);
@@ -657,7 +635,6 @@ static int llc_ui_accept(struct socket *sock, struct socket *newsock, int flags)
         /* put original socket back into a clean listen state. */
         sk->sk_state = TCP_LISTEN;
         sk->sk_ack_backlog--;
-        skb->sk = NULL;
         dprintk("%s: ok success on %02X, client on %02X\n", __FUNCTION__,
                 llc_sk(sk)->addr.sllc_sap, newllc->daddr.lsap);
 frees:
@@ -671,56 +648,167 @@ out:
  *      llc_ui_recvmsg - copy received data to the socket user.
  *      @sock: Socket to copy data from.
  *      @msg: Various user space related information.
- *      @size: Size of user buffer.
+ *      @len: Size of user buffer.
  *      @flags: User specified flags.
  *
  *      Copy received data to the socket user.
  *      Returns non-negative upon success, negative otherwise.
  */
 static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
-                          struct msghdr *msg, size_t size, int flags)
+                          struct msghdr *msg, size_t len, int flags)
 {
-        struct sock *sk = sock->sk;
         struct sockaddr_llc *uaddr = (struct sockaddr_llc *)msg->msg_name;
-        struct sk_buff *skb;
+        const int nonblock = flags & MSG_DONTWAIT;
+        struct sk_buff *skb = NULL;
+        struct sock *sk = sock->sk;
+        struct llc_sock *llc = llc_sk(sk);
         size_t copied = 0;
-        int rc = -ENOMEM, timeout;
-        int noblock = flags & MSG_DONTWAIT;
+        u32 peek_seq = 0;
+        u32 *seq;
+        unsigned long used;
+        int target;     /* Read at least this many bytes */
+        long timeo;
 
-        dprintk("%s: receiving in %02X from %02X\n", __FUNCTION__,
-                llc_sk(sk)->laddr.lsap, llc_sk(sk)->daddr.lsap);
         lock_sock(sk);
-        timeout = sock_rcvtimeo(sk, noblock);
-        rc = llc_ui_wait_for_data(sk, timeout);
-        if (rc) {
-                dprintk("%s: llc_ui_wait_for_data failed recv "
-                        "in %02X from %02X\n", __FUNCTION__,
-                        llc_sk(sk)->laddr.lsap, llc_sk(sk)->daddr.lsap);
+        copied = -ENOTCONN;
+        if (sk->sk_state == TCP_LISTEN)
                 goto out;
-        }
-        skb = skb_dequeue(&sk->sk_receive_queue);
-        if (!skb) /* shutdown */
-                goto out;
-        copied = skb->len;
-        if (copied > size)
-                copied = size;
-        rc = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
-        if (rc)
-                goto dgram_free;
-        if (skb->len > copied) {
-                skb_pull(skb, copied);
-                skb_queue_head(&sk->sk_receive_queue, skb);
-        }
-        if (uaddr)
-                memcpy(uaddr, llc_ui_skb_cb(skb), sizeof(*uaddr));
-        msg->msg_namelen = sizeof(*uaddr);
-        if (!skb->next) {
-dgram_free:
-                kfree_skb(skb);
-        }
+
+        timeo = sock_rcvtimeo(sk, nonblock);
+
+        seq = &llc->copied_seq;
+        if (flags & MSG_PEEK) {
+                peek_seq = llc->copied_seq;
+                seq = &peek_seq;
+        }
+
+        target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
+        copied = 0;
+
+        do {
+                u32 offset;
+
+                /*
+                 * We need to check signals first, to get correct SIGURG
+                 * handling. FIXME: Need to check this doesn't impact 1003.1g
+                 * and move it down to the bottom of the loop
+                 */
+                if (signal_pending(current)) {
+                        if (copied)
+                                break;
+                        copied = timeo ? sock_intr_errno(timeo) : -EAGAIN;
+                        break;
+                }
+
+                /* Next get a buffer. */
+
+                skb = skb_peek(&sk->sk_receive_queue);
+                if (skb) {
+                        offset = *seq;
+                        goto found_ok_skb;
+                }
+                /* Well, if we have backlog, try to process it now yet. */
+
+                if (copied >= target && !sk->sk_backlog.tail)
+                        break;
+
+                if (copied) {
+                        if (sk->sk_err ||
+                            sk->sk_state == TCP_CLOSE ||
+                            (sk->sk_shutdown & RCV_SHUTDOWN) ||
+                            !timeo ||
+                            (flags & MSG_PEEK))
+                                break;
+                } else {
+                        if (sock_flag(sk, SOCK_DONE))
+                                break;
+
+                        if (sk->sk_err) {
+                                copied = sock_error(sk);
+                                break;
+                        }
+                        if (sk->sk_shutdown & RCV_SHUTDOWN)
+                                break;
+
+                        if (sk->sk_state == TCP_CLOSE) {
+                                if (!sock_flag(sk, SOCK_DONE)) {
+                                        /*
+                                         * This occurs when user tries to read
+                                         * from never connected socket.
+                                         */
+                                        copied = -ENOTCONN;
+                                        break;
+                                }
+                                break;
+                        }
+                        if (!timeo) {
+                                copied = -EAGAIN;
+                                break;
+                        }
+                }
+
+                if (copied >= target) { /* Do not sleep, just process backlog. */
+                        release_sock(sk);
+                        lock_sock(sk);
+                } else
+                        sk_wait_data(sk, &timeo);
+
+                if ((flags & MSG_PEEK) && peek_seq != llc->copied_seq) {
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "LLC(%s:%d): Application "
+                                                  "bug, race in MSG_PEEK.\n",
+                                       current->comm, current->pid);
+                        peek_seq = llc->copied_seq;
+                }
+                continue;
+        found_ok_skb:
+                /* Ok so how much can we use? */
+                used = skb->len - offset;
+                if (len < used)
+                        used = len;
+
+                if (!(flags & MSG_TRUNC)) {
+                        int rc = skb_copy_datagram_iovec(skb, offset,
+                                                         msg->msg_iov, used);
+                        if (rc) {
+                                /* Exception. Bailout! */
+                                if (!copied)
+                                        copied = -EFAULT;
+                                break;
+                        }
+                }
+
+                *seq += used;
+                copied += used;
+                len -= used;
+
+                if (used + offset < skb->len)
+                        continue;
+
+                if (!(flags & MSG_PEEK)) {
+                        sk_eat_skb(sk, skb);
+                        *seq = 0;
+                }
+        } while (len > 0);
+
+        /* 
+         * According to UNIX98, msg_name/msg_namelen are ignored
+         * on connected socket. -ANK
+         * But... af_llc still doesn't have separate sets of methods for
+         * SOCK_DGRAM and SOCK_STREAM :-( So we have to do this test, will
+         * eventually fix this tho :-) -acme
+         */
+        if (sk->sk_type == SOCK_DGRAM)
+                goto copy_uaddr;
 out:
         release_sock(sk);
-        return rc ? : copied;
+        return copied;
+copy_uaddr:
+        if (uaddr != NULL && skb != NULL) {
+                memcpy(uaddr, llc_ui_skb_cb(skb), sizeof(*uaddr));
+                msg->msg_namelen = sizeof(*uaddr);
+        }
+        goto out;
 }
 
 /**
@@ -740,7 +828,6 @@ static int llc_ui_sendmsg(struct kiocb *iocb, struct socket *sock,
         struct sockaddr_llc *addr = (struct sockaddr_llc *)msg->msg_name;
         int flags = msg->msg_flags;
         int noblock = flags & MSG_DONTWAIT;
-        struct net_device *dev;
         struct sk_buff *skb;
         size_t size = 0;
         int rc = -EINVAL, copied = 0, hdrlen;
@@ -763,19 +850,17 @@ static int llc_ui_sendmsg(struct kiocb *iocb, struct socket *sock,
                 if (rc)
                         goto release;
         }
-        dev = llc->dev;
-        hdrlen = dev->hard_header_len + llc_ui_header_len(sk, addr);
+        hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
         size = hdrlen + len;
-        if (size > dev->mtu)
-                size = dev->mtu;
+        if (size > llc->dev->mtu)
+                size = llc->dev->mtu;
         copied = size - hdrlen;
         release_sock(sk);
         skb = sock_alloc_send_skb(sk, size, noblock, &rc);
         lock_sock(sk);
         if (!skb)
                 goto release;
-        skb->sk       = sk;
-        skb->dev      = dev;
+        skb->dev      = llc->dev;
         skb->protocol = llc_proto_type(addr->sllc_arphrd);
         skb_reserve(skb, hdrlen); 
         rc = memcpy_fromiovec(skb_put(skb, copied), msg->msg_iov, copied);
@@ -800,15 +885,13 @@ static int llc_ui_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
                 goto out;
         rc = llc_ui_send_data(sk, skb, noblock);
-        if (rc)
-                dprintk("%s: llc_ui_send_data failed: %d\n", __FUNCTION__, rc);
 out:
-        if (rc)
+        if (rc) {
                 kfree_skb(skb);
 release:
-        if (rc)
                 dprintk("%s: failed sending from %02X to %02X: %d\n",
                         __FUNCTION__, llc->laddr.lsap, llc->daddr.lsap, rc);
+        }
         release_sock(sk);
         return rc ? : copied;
 }
@@ -895,7 +978,7 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
         int rc = -EINVAL, opt;
 
         lock_sock(sk);
-        if (level != SOL_LLC || optlen != sizeof(int))
+        if (unlikely(level != SOL_LLC || optlen != sizeof(int)))
                 goto out;
         rc = get_user(opt, (int __user *)optval);
         if (rc)
@@ -915,22 +998,22 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
         case LLC_OPT_ACK_TMR_EXP:
                 if (opt > LLC_OPT_MAX_ACK_TMR_EXP)
                         goto out;
-                llc->ack_timer.expire = opt;
+                llc->ack_timer.expire = opt * HZ;
                 break;
         case LLC_OPT_P_TMR_EXP:
                 if (opt > LLC_OPT_MAX_P_TMR_EXP)
                         goto out;
-                llc->pf_cycle_timer.expire = opt;
+                llc->pf_cycle_timer.expire = opt * HZ;
                 break;
         case LLC_OPT_REJ_TMR_EXP:
                 if (opt > LLC_OPT_MAX_REJ_TMR_EXP)
                         goto out;
-                llc->rej_sent_timer.expire = opt;
+                llc->rej_sent_timer.expire = opt * HZ;
                 break;
         case LLC_OPT_BUSY_TMR_EXP:
                 if (opt > LLC_OPT_MAX_BUSY_TMR_EXP)
                         goto out;
-                llc->busy_state_timer.expire = opt;
+                llc->busy_state_timer.expire = opt * HZ;
                 break;
         case LLC_OPT_TX_WIN:
                 if (opt > LLC_OPT_MAX_WIN)
@@ -970,7 +1053,7 @@ static int llc_ui_getsockopt(struct socket *sock, int level, int optname,
         int val = 0, len = 0, rc = -EINVAL;
 
         lock_sock(sk);
-        if (level != SOL_LLC)
+        if (unlikely(level != SOL_LLC))
                 goto out;
         rc = get_user(len, optlen);
         if (rc)
@@ -980,17 +1063,17 @@ static int llc_ui_getsockopt(struct socket *sock, int level, int optname,
                 goto out;
         switch (optname) {
         case LLC_OPT_RETRY:
-                val = llc->n2;                          break;
+                val = llc->n2;                                  break;
         case LLC_OPT_SIZE:
-                val = llc->n1;                          break;
+                val = llc->n1;                                  break;
         case LLC_OPT_ACK_TMR_EXP:
-                val = llc->ack_timer.expire;            break;
+                val = llc->ack_timer.expire / HZ;               break;
         case LLC_OPT_P_TMR_EXP:
-                val = llc->pf_cycle_timer.expire;       break;
+                val = llc->pf_cycle_timer.expire / HZ;          break;
         case LLC_OPT_REJ_TMR_EXP:
-                val = llc->rej_sent_timer.expire;       break;
+                val = llc->rej_sent_timer.expire / HZ;          break;
         case LLC_OPT_BUSY_TMR_EXP:
-                val = llc->busy_state_timer.expire;     break;
+                val = llc->busy_state_timer.expire / HZ;        break;
         case LLC_OPT_TX_WIN:
                 val = llc->k;                           break;
         case LLC_OPT_RX_WIN:
@@ -1034,8 +1117,12 @@ static struct proto_ops llc_ui_ops = {
         .sendpage    = sock_no_sendpage,
 };
 
-extern void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb);
-extern void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb);
+static char llc_proc_err_msg[] __initdata =
+        KERN_CRIT "LLC: Unable to register the proc_fs entries\n";
+static char llc_sysctl_err_msg[] __initdata =
+        KERN_CRIT "LLC: Unable to register the sysctl entries\n";
+static char llc_sock_err_msg[] __initdata =
+        KERN_CRIT "LLC: Unable to register the network family\n";
 
 static int __init llc2_init(void)
 {
@@ -1048,13 +1135,28 @@ static int __init llc2_init(void)
         llc_station_init();
         llc_ui_sap_last_autoport = LLC_SAP_DYN_START;
         rc = llc_proc_init();
-        if (rc != 0)
+        if (rc != 0) {
+                printk(llc_proc_err_msg);
                 goto out_unregister_llc_proto;
-        sock_register(&llc_ui_family_ops);
+        }
+        rc = llc_sysctl_init();
+        if (rc) {
+                printk(llc_sysctl_err_msg);
+                goto out_proc;
+        }
+        rc = sock_register(&llc_ui_family_ops);
+        if (rc) {
+                printk(llc_sock_err_msg);
+                goto out_sysctl;
+        }
         llc_add_pack(LLC_DEST_SAP, llc_sap_handler);
         llc_add_pack(LLC_DEST_CONN, llc_conn_handler);
 out:
         return rc;
+out_sysctl:
+        llc_sysctl_exit();
+out_proc:
+        llc_proc_exit();
 out_unregister_llc_proto:
         proto_unregister(&llc_proto);
         goto out;
@@ -1067,6 +1169,7 @@ static void __exit llc2_exit(void)
         llc_remove_pack(LLC_DEST_CONN);
         sock_unregister(PF_LLC);
         llc_proc_exit();
+        llc_sysctl_exit();
         proto_unregister(&llc_proto);
 }
 
diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
index b218be4c10ec..b0bcfb1f12dd 100644
--- a/net/llc/llc_c_ac.c
+++ b/net/llc/llc_c_ac.c
@@ -60,23 +60,10 @@ int llc_conn_ac_clear_remote_busy(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ac_conn_ind(struct sock *sk, struct sk_buff *skb)
 {
-        int rc = -ENOTCONN;
-        u8 dsap;
-        struct llc_sap *sap;
-
-        llc_pdu_decode_dsap(skb, &dsap);
-        sap = llc_sap_find(dsap);
-        if (sap) {
-                struct llc_conn_state_ev *ev = llc_conn_ev(skb);
-                struct llc_sock *llc = llc_sk(sk);
+        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
-                llc_pdu_decode_sa(skb, llc->daddr.mac);
-                llc_pdu_decode_da(skb, llc->laddr.mac);
-                llc->dev = skb->dev;
-                ev->ind_prim = LLC_CONN_PRIM;
-                rc = 0;
-        }
-        return rc;
+        ev->ind_prim = LLC_CONN_PRIM;
+        return 0;
 }
 
 int llc_conn_ac_conn_confirm(struct sock *sk, struct sk_buff *skb)
@@ -120,10 +107,8 @@ int llc_conn_ac_disc_ind(struct sock *sk, struct sk_buff *skb)
                         reason = LLC_DISC_REASON_RX_DISC_CMD_PDU;
         } else if (ev->type == LLC_CONN_EV_TYPE_ACK_TMR)
                 reason = LLC_DISC_REASON_ACK_TMR_EXP;
-        else {
-                reason = 0;
+        else
                 rc = -EINVAL;
-        }
         if (!rc) {
                 ev->reason   = reason;
                 ev->ind_prim = LLC_DISC_PRIM;
@@ -160,9 +145,6 @@ int llc_conn_ac_rst_ind(struct sock *sk, struct sk_buff *skb)
                            LLC_U_PDU_CMD(pdu) == LLC_2_PDU_CMD_SABME) {
                         reason = LLC_RESET_REASON_REMOTE;
                         rc = 0;
-                } else {
-                        reason = 0;
-                        rc  = 1;
                 }
                 break;
         case LLC_CONN_EV_TYPE_ACK_TMR:
@@ -172,8 +154,7 @@ int llc_conn_ac_rst_ind(struct sock *sk, struct sk_buff *skb)
                 if (llc->retry_count > llc->n2) {
                         reason = LLC_RESET_REASON_LOCAL;
                         rc = 0;
-                } else
-                        rc = 1;
+                }
                 break;
         }
         if (!rc) {
@@ -217,18 +198,17 @@ int llc_conn_ac_stop_rej_tmr_if_data_flag_eq_2(struct sock *sk,
 int llc_conn_ac_send_disc_cmd_p_set_x(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_CMD);
                 llc_pdu_init_as_disc_cmd(nskb, 1);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
                 llc_conn_ac_set_p_flag_1(sk, skb);
@@ -243,20 +223,19 @@ free:
 int llc_conn_ac_send_dm_rsp_f_set_p(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
                 u8 f_bit;
 
-                nskb->dev = llc->dev;
                 llc_pdu_decode_pf_bit(skb, &f_bit);
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
                 llc_pdu_init_as_dm_rsp(nskb, f_bit);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -270,19 +249,17 @@ free:
 int llc_conn_ac_send_dm_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
-                u8 f_bit = 1;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
-                llc_pdu_init_as_dm_rsp(nskb, f_bit);
+                llc_pdu_init_as_dm_rsp(nskb, 1);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -306,17 +283,16 @@ int llc_conn_ac_send_frmr_rsp_f_set_x(struct sock *sk, struct sk_buff *skb)
                 llc_pdu_decode_pf_bit(skb, &f_bit);
         else
                 f_bit = 0;
-        nskb = llc_alloc_frame();
+        nskb = llc_alloc_frame(sk, llc->dev);
         if (nskb) {
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
                 llc_pdu_init_as_frmr_rsp(nskb, pdu, f_bit, llc->vS,
                                          llc->vR, INCORRECT);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -330,21 +306,19 @@ free:
 int llc_conn_ac_resend_frmr_rsp_f_set_0(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                u8 f_bit = 0;
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
                 struct llc_pdu_sn *pdu = (struct llc_pdu_sn *)&llc->rx_pdu_hdr;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
-                llc_pdu_init_as_frmr_rsp(nskb, pdu, f_bit, llc->vS,
+                llc_pdu_init_as_frmr_rsp(nskb, pdu, 0, llc->vS,
                                          llc->vR, INCORRECT);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -360,21 +334,20 @@ int llc_conn_ac_resend_frmr_rsp_f_set_p(struct sock *sk, struct sk_buff *skb)
         u8 f_bit;
         int rc = -ENOBUFS;
         struct sk_buff *nskb;
+        struct llc_sock *llc = llc_sk(sk);
 
         llc_pdu_decode_pf_bit(skb, &f_bit);
-        nskb = llc_alloc_frame();
+        nskb = llc_alloc_frame(sk, llc->dev);
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
                 struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
                 llc_pdu_init_as_frmr_rsp(nskb, pdu, f_bit, llc->vS,
                                          llc->vR, INCORRECT);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -395,7 +368,7 @@ int llc_conn_ac_send_i_cmd_p_set_1(struct sock *sk, struct sk_buff *skb)
                             llc->daddr.lsap, LLC_PDU_CMD);
         llc_pdu_init_as_i_cmd(skb, 1, llc->vS, llc->vR);
         rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
-        if (!rc) {
+        if (likely(!rc)) {
                 llc_conn_send_pdu(sk, skb);
                 llc_conn_ac_inc_vs_by_1(sk, skb);
         }
@@ -412,7 +385,7 @@ static int llc_conn_ac_send_i_cmd_p_set_0(struct sock *sk, struct sk_buff *skb)
                             llc->daddr.lsap, LLC_PDU_CMD);
         llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR);
         rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
-        if (!rc) {
+        if (likely(!rc)) {
                 llc_conn_send_pdu(sk, skb);
                 llc_conn_ac_inc_vs_by_1(sk, skb);
         }
@@ -429,7 +402,7 @@ int llc_conn_ac_send_i_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
                             llc->daddr.lsap, LLC_PDU_CMD);
         llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR);
         rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
-        if (!rc) {
+        if (likely(!rc)) {
                 llc_conn_send_pdu(sk, skb);
                 llc_conn_ac_inc_vs_by_1(sk, skb);
         }
@@ -451,18 +424,17 @@ int llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(struct sock *sk,
         u8 nr;
         struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
                 llc_pdu_init_as_rr_rsp(nskb, 0, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (!rc)
+                if (likely(!rc))
                         llc_conn_send_pdu(sk, nskb);
                 else
                         kfree_skb(skb);
@@ -487,18 +459,17 @@ int llc_conn_ac_resend_i_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 int llc_conn_ac_send_rej_cmd_p_set_1(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_CMD);
                 llc_pdu_init_as_rej_cmd(nskb, 1, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -512,19 +483,17 @@ free:
 int llc_conn_ac_send_rej_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                u8 f_bit = 1;
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
-                llc_pdu_init_as_rej_rsp(nskb, f_bit, llc->vR);
+                llc_pdu_init_as_rej_rsp(nskb, 1, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -538,19 +507,17 @@ free:
 int llc_conn_ac_send_rej_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
-                u8 f_bit = 0;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
-                llc_pdu_init_as_rej_rsp(nskb, f_bit, llc->vR);
+                llc_pdu_init_as_rej_rsp(nskb, 0, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -564,18 +531,17 @@ free:
 int llc_conn_ac_send_rnr_cmd_p_set_1(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_CMD);
                 llc_pdu_init_as_rnr_cmd(nskb, 1, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -589,19 +555,17 @@ free:
 int llc_conn_ac_send_rnr_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
-                u8 f_bit = 1;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
-                llc_pdu_init_as_rnr_rsp(nskb, f_bit, llc->vR);
+                llc_pdu_init_as_rnr_rsp(nskb, 1, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -615,19 +579,17 @@ free:
 int llc_conn_ac_send_rnr_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                u8 f_bit = 0;
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
-                llc_pdu_init_as_rnr_rsp(nskb, f_bit, llc->vR);
+                llc_pdu_init_as_rnr_rsp(nskb, 0, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -645,7 +607,7 @@ int llc_conn_ac_set_remote_busy(struct sock *sk, struct sk_buff *skb)
         if (!llc->remote_busy_flag) {
                 llc->remote_busy_flag = 1;
                 mod_timer(&llc->busy_state_timer.timer,
-                         jiffies + llc->busy_state_timer.expire * HZ);
+                         jiffies + llc->busy_state_timer.expire);
         }
         return 0;
 }
@@ -653,18 +615,17 @@ int llc_conn_ac_set_remote_busy(struct sock *sk, struct sk_buff *skb)
 int llc_conn_ac_opt_send_rnr_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
                 llc_pdu_init_as_rnr_rsp(nskb, 0, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -678,18 +639,17 @@ free:
 int llc_conn_ac_send_rr_cmd_p_set_1(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_CMD);
                 llc_pdu_init_as_rr_cmd(nskb, 1, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -703,19 +663,18 @@ free:
 int llc_conn_ac_send_rr_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
                 u8 f_bit = 1;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
                 llc_pdu_init_as_rr_rsp(nskb, f_bit, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -729,19 +688,17 @@ free:
 int llc_conn_ac_send_ack_rsp_f_set_1(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
-                u8 f_bit = 1;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
-                llc_pdu_init_as_rr_rsp(nskb, f_bit, llc->vR);
+                llc_pdu_init_as_rr_rsp(nskb, 1, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -755,18 +712,17 @@ free:
 int llc_conn_ac_send_rr_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
                 llc_pdu_init_as_rr_rsp(nskb, 0, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -780,18 +736,17 @@ free:
 int llc_conn_ac_send_ack_xxx_x_set_0(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
                 llc_pdu_init_as_rr_rsp(nskb, 0, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -815,8 +770,8 @@ void llc_conn_set_p_flag(struct sock *sk, u8 value)
 int llc_conn_ac_send_sabme_cmd_p_set_x(struct sock *sk, struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
         struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
                 struct llc_sap *sap = llc->sap;
@@ -824,12 +779,11 @@ int llc_conn_ac_send_sabme_cmd_p_set_x(struct sock *sk, struct sk_buff *skb)
 
                 if (llc->dev->flags & IFF_LOOPBACK)
                         dmac = llc->dev->dev_addr;
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_CMD);
                 llc_pdu_init_as_sabme_cmd(nskb, 1);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, dmac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
                 llc_conn_set_p_flag(sk, 1);
@@ -845,11 +799,11 @@ int llc_conn_ac_send_ua_rsp_f_set_p(struct sock *sk, struct sk_buff *skb)
 {
         u8 f_bit;
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         llc_pdu_decode_pf_bit(skb, &f_bit);
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
                 nskb->dev = llc->dev;
@@ -857,7 +811,7 @@ int llc_conn_ac_send_ua_rsp_f_set_p(struct sock *sk, struct sk_buff *skb)
                                     llc->daddr.lsap, LLC_PDU_RSP);
                 llc_pdu_init_as_ua_rsp(nskb, f_bit);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -886,7 +840,7 @@ int llc_conn_ac_start_p_timer(struct sock *sk, struct sk_buff *skb)
 
         llc_conn_set_p_flag(sk, 1);
         mod_timer(&llc->pf_cycle_timer.timer,
-                  jiffies + llc->pf_cycle_timer.expire * HZ);
+                  jiffies + llc->pf_cycle_timer.expire);
         return 0;
 }
 
@@ -957,7 +911,7 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk,
                             llc->daddr.lsap, LLC_PDU_RSP);
         llc_pdu_init_as_i_cmd(skb, llc->ack_pf, llc->vS, llc->vR);
         rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
-        if (!rc) {
+        if (likely(!rc)) {
                 llc_conn_send_pdu(sk, skb);
                 llc_conn_ac_inc_vs_by_1(sk, skb);
         }
@@ -1001,18 +955,17 @@ static int llc_conn_ac_send_rr_rsp_f_set_ackpf(struct sock *sk,
                                                struct sk_buff *skb)
 {
         int rc = -ENOBUFS;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct llc_sock *llc = llc_sk(sk);
+        struct sk_buff *nskb = llc_alloc_frame(sk, llc->dev);
 
         if (nskb) {
-                struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                nskb->dev = llc->dev;
                 llc_pdu_header_init(nskb, LLC_PDU_TYPE_S, sap->laddr.lsap,
                                     llc->daddr.lsap, LLC_PDU_RSP);
                 llc_pdu_init_as_rr_rsp(nskb, llc->ack_pf, llc->vR);
                 rc = llc_mac_hdr_init(nskb, llc->dev->dev_addr, llc->daddr.mac);
-                if (rc)
+                if (unlikely(rc))
                         goto free;
                 llc_conn_send_pdu(sk, nskb);
         }
@@ -1165,7 +1118,7 @@ int llc_conn_ac_start_ack_timer(struct sock *sk, struct sk_buff *skb)
 {
         struct llc_sock *llc = llc_sk(sk);
 
-        mod_timer(&llc->ack_timer.timer, jiffies + llc->ack_timer.expire * HZ);
+        mod_timer(&llc->ack_timer.timer, jiffies + llc->ack_timer.expire);
         return 0;
 }
 
@@ -1174,7 +1127,7 @@ int llc_conn_ac_start_rej_timer(struct sock *sk, struct sk_buff *skb)
         struct llc_sock *llc = llc_sk(sk);
 
         mod_timer(&llc->rej_sent_timer.timer,
-                  jiffies + llc->rej_sent_timer.expire * HZ);
+                  jiffies + llc->rej_sent_timer.expire);
         return 0;
 }
 
@@ -1185,7 +1138,7 @@ int llc_conn_ac_start_ack_tmr_if_not_running(struct sock *sk,
 
         if (!timer_pending(&llc->ack_timer.timer))
                 mod_timer(&llc->ack_timer.timer,
-                          jiffies + llc->ack_timer.expire * HZ);
+                          jiffies + llc->ack_timer.expire);
         return 0;
 }
 
@@ -1233,7 +1186,7 @@ int llc_conn_ac_upd_nr_received(struct sock *sk, struct sk_buff *skb)
                 }
                 if (unacked)
                         mod_timer(&llc->ack_timer.timer,
-                                  jiffies + llc->ack_timer.expire * HZ);
+                                  jiffies + llc->ack_timer.expire);
         } else if (llc->failed_data_req) {
                 u8 f_bit;
 
@@ -1354,13 +1307,13 @@ int llc_conn_ac_set_vs_nr(struct sock *sk, struct sk_buff *skb)
         return 0;
 }
 
-int llc_conn_ac_inc_vs_by_1(struct sock *sk, struct sk_buff *skb)
+static int llc_conn_ac_inc_vs_by_1(struct sock *sk, struct sk_buff *skb)
 {
         llc_sk(sk)->vS = (llc_sk(sk)->vS + 1) % 128;
         return 0;
 }
 
-void llc_conn_pf_cycle_tmr_cb(unsigned long timeout_data)
+static void llc_conn_tmr_common_cb(unsigned long timeout_data, u8 type)
 {
         struct sock *sk = (struct sock *)timeout_data;
         struct sk_buff *skb = alloc_skb(0, GFP_ATOMIC);
@@ -1369,59 +1322,31 @@ void llc_conn_pf_cycle_tmr_cb(unsigned long timeout_data)
         if (skb) {
                 struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
-                skb->sk  = sk;
-                ev->type = LLC_CONN_EV_TYPE_P_TMR;
+                skb_set_owner_r(skb, sk);
+                ev->type = type;
                 llc_process_tmr_ev(sk, skb);
         }
         bh_unlock_sock(sk);
 }
 
-void llc_conn_busy_tmr_cb(unsigned long timeout_data)
+void llc_conn_pf_cycle_tmr_cb(unsigned long timeout_data)
 {
-        struct sock *sk = (struct sock *)timeout_data;
-        struct sk_buff *skb = alloc_skb(0, GFP_ATOMIC);
-
-        bh_lock_sock(sk);
-        if (skb) {
-                struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        llc_conn_tmr_common_cb(timeout_data, LLC_CONN_EV_TYPE_P_TMR);
+}
 
-                skb->sk  = sk;
-                ev->type = LLC_CONN_EV_TYPE_BUSY_TMR;
-                llc_process_tmr_ev(sk, skb);
-        }
-        bh_unlock_sock(sk);
+void llc_conn_busy_tmr_cb(unsigned long timeout_data)
+{
+        llc_conn_tmr_common_cb(timeout_data, LLC_CONN_EV_TYPE_BUSY_TMR);
 }
 
 void llc_conn_ack_tmr_cb(unsigned long timeout_data)
 {
-        struct sock* sk = (struct sock *)timeout_data;
-        struct sk_buff *skb = alloc_skb(0, GFP_ATOMIC);
-
-        bh_lock_sock(sk);
-        if (skb) {
-                struct llc_conn_state_ev *ev = llc_conn_ev(skb);
-
-                skb->sk  = sk;
-                ev->type = LLC_CONN_EV_TYPE_ACK_TMR;
-                llc_process_tmr_ev(sk, skb);
-        }
-        bh_unlock_sock(sk);
+        llc_conn_tmr_common_cb(timeout_data, LLC_CONN_EV_TYPE_ACK_TMR);
 }
 
 void llc_conn_rej_tmr_cb(unsigned long timeout_data)
 {
-        struct sock *sk = (struct sock *)timeout_data;
-        struct sk_buff *skb = alloc_skb(0, GFP_ATOMIC);
-
-        bh_lock_sock(sk);
-        if (skb) {
-                struct llc_conn_state_ev *ev = llc_conn_ev(skb);
-
-                skb->sk  = sk;
-                ev->type = LLC_CONN_EV_TYPE_REJ_TMR;
-                llc_process_tmr_ev(sk, skb);
-        }
-        bh_unlock_sock(sk);
+        llc_conn_tmr_common_cb(timeout_data, LLC_CONN_EV_TYPE_REJ_TMR);
 }
 
 int llc_conn_ac_rst_vs(struct sock *sk, struct sk_buff *skb)
diff --git a/net/llc/llc_c_ev.c b/net/llc/llc_c_ev.c
index d5bdb53a348f..c5deda246614 100644
--- a/net/llc/llc_c_ev.c
+++ b/net/llc/llc_c_ev.c
@@ -37,6 +37,7 @@
 #include <net/llc_conn.h>
 #include <net/llc_sap.h>
 #include <net/sock.h>
+#include <net/llc_c_ac.h>
 #include <net/llc_c_ev.h>
 #include <net/llc_pdu.h>
 
@@ -46,8 +47,6 @@
 #define dprintk(args...)
 #endif
 
-extern u16 llc_circular_between(u8 a, u8 b, u8 c);
-
 /**
  *      llc_util_ns_inside_rx_window - check if sequence number is in rx window
  *      @ns: sequence number of received pdu.
@@ -99,7 +98,7 @@ out:
 
 int llc_conn_ev_conn_req(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->prim == LLC_CONN_PRIM &&
                ev->prim_type == LLC_PRIM_TYPE_REQ ? 0 : 1;
@@ -107,7 +106,7 @@ int llc_conn_ev_conn_req(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_data_req(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->prim == LLC_DATA_PRIM &&
                ev->prim_type == LLC_PRIM_TYPE_REQ ? 0 : 1;
@@ -115,7 +114,7 @@ int llc_conn_ev_data_req(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_disc_req(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->prim == LLC_DISC_PRIM &&
                ev->prim_type == LLC_PRIM_TYPE_REQ ? 0 : 1;
@@ -123,7 +122,7 @@ int llc_conn_ev_disc_req(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rst_req(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->prim == LLC_RESET_PRIM &&
                ev->prim_type == LLC_PRIM_TYPE_REQ ? 0 : 1;
@@ -131,7 +130,7 @@ int llc_conn_ev_rst_req(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_local_busy_detected(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->type == LLC_CONN_EV_TYPE_SIMPLE &&
                ev->prim_type == LLC_CONN_EV_LOCAL_BUSY_DETECTED ? 0 : 1;
@@ -139,7 +138,7 @@ int llc_conn_ev_local_busy_detected(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_local_busy_cleared(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->type == LLC_CONN_EV_TYPE_SIMPLE &&
                ev->prim_type == LLC_CONN_EV_LOCAL_BUSY_CLEARED ? 0 : 1;
@@ -152,7 +151,7 @@ int llc_conn_ev_rx_bad_pdu(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_disc_cmd_pbit_set_x(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
+        const struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
         return LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_U(pdu) &&
                LLC_U_PDU_CMD(pdu) == LLC_2_PDU_CMD_DISC ? 0 : 1;
@@ -160,7 +159,7 @@ int llc_conn_ev_rx_disc_cmd_pbit_set_x(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_dm_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
+        const struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_U(pdu) &&
                LLC_U_PDU_RSP(pdu) == LLC_2_PDU_RSP_DM ? 0 : 1;
@@ -168,7 +167,7 @@ int llc_conn_ev_rx_dm_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_frmr_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
+        const struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_U(pdu) &&
                LLC_U_PDU_RSP(pdu) == LLC_2_PDU_RSP_FRMR ? 0 : 1;
@@ -176,7 +175,7 @@ int llc_conn_ev_rx_frmr_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_i_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return llc_conn_space(sk, skb) &&
                LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
@@ -186,7 +185,7 @@ int llc_conn_ev_rx_i_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_i_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return llc_conn_space(sk, skb) &&
                LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
@@ -197,9 +196,9 @@ int llc_conn_ev_rx_i_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb)
 int llc_conn_ev_rx_i_cmd_pbit_set_0_unexpd_ns(struct sock *sk,
                                               struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-        u8 vr = llc_sk(sk)->vR;
-        u8 ns = LLC_I_GET_NS(pdu);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const u8 vr = llc_sk(sk)->vR;
+        const u8 ns = LLC_I_GET_NS(pdu);
 
         return LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
                LLC_I_PF_IS_0(pdu) && ns != vr &&
@@ -209,9 +208,9 @@ int llc_conn_ev_rx_i_cmd_pbit_set_0_unexpd_ns(struct sock *sk,
 int llc_conn_ev_rx_i_cmd_pbit_set_1_unexpd_ns(struct sock *sk,
                                               struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-        u8 vr = llc_sk(sk)->vR;
-        u8 ns = LLC_I_GET_NS(pdu);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const u8 vr = llc_sk(sk)->vR;
+        const u8 ns = LLC_I_GET_NS(pdu);
 
         return LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
                LLC_I_PF_IS_1(pdu) && ns != vr &&
@@ -221,10 +220,11 @@ int llc_conn_ev_rx_i_cmd_pbit_set_1_unexpd_ns(struct sock *sk,
 int llc_conn_ev_rx_i_cmd_pbit_set_x_inval_ns(struct sock *sk,
                                              struct sk_buff *skb)
 {
-        struct llc_pdu_sn * pdu = llc_pdu_sn_hdr(skb);
-        u8 vr = llc_sk(sk)->vR;
-        u8 ns = LLC_I_GET_NS(pdu);
-        u16 rc = LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_I(pdu) && ns != vr &&
+        const struct llc_pdu_sn * pdu = llc_pdu_sn_hdr(skb);
+        const u8 vr = llc_sk(sk)->vR;
+        const u8 ns = LLC_I_GET_NS(pdu);
+        const u16 rc = LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
+                ns != vr &&
                  llc_util_ns_inside_rx_window(ns, vr, llc_sk(sk)->rw) ? 0 : 1;
         if (!rc)
                 dprintk("%s: matched, state=%d, ns=%d, vr=%d\n",
@@ -234,7 +234,7 @@ int llc_conn_ev_rx_i_cmd_pbit_set_x_inval_ns(struct sock *sk,
 
 int llc_conn_ev_rx_i_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return llc_conn_space(sk, skb) &&
                LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
@@ -244,7 +244,7 @@ int llc_conn_ev_rx_i_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_i_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
                LLC_I_PF_IS_1(pdu) &&
@@ -253,7 +253,7 @@ int llc_conn_ev_rx_i_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_i_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return llc_conn_space(sk, skb) &&
                LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
@@ -263,9 +263,9 @@ int llc_conn_ev_rx_i_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb)
 int llc_conn_ev_rx_i_rsp_fbit_set_0_unexpd_ns(struct sock *sk,
                                               struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-        u8 vr = llc_sk(sk)->vR;
-        u8 ns = LLC_I_GET_NS(pdu);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const u8 vr = llc_sk(sk)->vR;
+        const u8 ns = LLC_I_GET_NS(pdu);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
                LLC_I_PF_IS_0(pdu) && ns != vr &&
@@ -275,9 +275,9 @@ int llc_conn_ev_rx_i_rsp_fbit_set_0_unexpd_ns(struct sock *sk,
 int llc_conn_ev_rx_i_rsp_fbit_set_1_unexpd_ns(struct sock *sk,
                                               struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-        u8 vr = llc_sk(sk)->vR;
-        u8 ns = LLC_I_GET_NS(pdu);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const u8 vr = llc_sk(sk)->vR;
+        const u8 ns = LLC_I_GET_NS(pdu);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
                LLC_I_PF_IS_1(pdu) && ns != vr &&
@@ -287,9 +287,9 @@ int llc_conn_ev_rx_i_rsp_fbit_set_1_unexpd_ns(struct sock *sk,
 int llc_conn_ev_rx_i_rsp_fbit_set_x_unexpd_ns(struct sock *sk,
                                               struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-        u8 vr = llc_sk(sk)->vR;
-        u8 ns = LLC_I_GET_NS(pdu);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const u8 vr = llc_sk(sk)->vR;
+        const u8 ns = LLC_I_GET_NS(pdu);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_I(pdu) && ns != vr &&
                !llc_util_ns_inside_rx_window(ns, vr, llc_sk(sk)->rw) ? 0 : 1;
@@ -298,10 +298,11 @@ int llc_conn_ev_rx_i_rsp_fbit_set_x_unexpd_ns(struct sock *sk,
 int llc_conn_ev_rx_i_rsp_fbit_set_x_inval_ns(struct sock *sk,
                                              struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-        u8 vr = llc_sk(sk)->vR;
-        u8 ns = LLC_I_GET_NS(pdu);
-        u16 rc = LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_I(pdu) && ns != vr &&
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const u8 vr = llc_sk(sk)->vR;
+        const u8 ns = LLC_I_GET_NS(pdu);
+        const u16 rc = LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_I(pdu) &&
+                ns != vr &&
                  llc_util_ns_inside_rx_window(ns, vr, llc_sk(sk)->rw) ? 0 : 1;
         if (!rc)
                 dprintk("%s: matched, state=%d, ns=%d, vr=%d\n",
@@ -311,7 +312,7 @@ int llc_conn_ev_rx_i_rsp_fbit_set_x_inval_ns(struct sock *sk,
 
 int llc_conn_ev_rx_rej_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PF_IS_0(pdu) &&
@@ -320,7 +321,7 @@ int llc_conn_ev_rx_rej_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rej_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PF_IS_1(pdu) &&
@@ -329,7 +330,7 @@ int llc_conn_ev_rx_rej_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rej_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PF_IS_0(pdu) &&
@@ -338,7 +339,7 @@ int llc_conn_ev_rx_rej_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rej_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PF_IS_1(pdu) &&
@@ -347,7 +348,7 @@ int llc_conn_ev_rx_rej_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rej_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
+        const struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PDU_RSP(pdu) == LLC_2_PDU_RSP_REJ ? 0 : 1;
@@ -355,7 +356,7 @@ int llc_conn_ev_rx_rej_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rnr_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PF_IS_0(pdu) &&
@@ -364,7 +365,7 @@ int llc_conn_ev_rx_rnr_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rnr_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PF_IS_1(pdu) &&
@@ -373,7 +374,7 @@ int llc_conn_ev_rx_rnr_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rnr_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PF_IS_0(pdu) &&
@@ -382,7 +383,7 @@ int llc_conn_ev_rx_rnr_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rnr_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PF_IS_1(pdu) &&
@@ -391,7 +392,7 @@ int llc_conn_ev_rx_rnr_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rr_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PF_IS_0(pdu) &&
@@ -400,7 +401,7 @@ int llc_conn_ev_rx_rr_cmd_pbit_set_0(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rr_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
                LLC_S_PF_IS_1(pdu) &&
@@ -409,7 +410,7 @@ int llc_conn_ev_rx_rr_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rr_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return llc_conn_space(sk, skb) &&
                LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
@@ -419,7 +420,7 @@ int llc_conn_ev_rx_rr_rsp_fbit_set_0(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_rr_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         return llc_conn_space(sk, skb) &&
                LLC_PDU_IS_RSP(pdu) && LLC_PDU_TYPE_IS_S(pdu) &&
@@ -429,7 +430,7 @@ int llc_conn_ev_rx_rr_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_rx_sabme_cmd_pbit_set_x(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
+        const struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
         return LLC_PDU_IS_CMD(pdu) && LLC_PDU_TYPE_IS_U(pdu) &&
                LLC_U_PDU_CMD(pdu) == LLC_2_PDU_CMD_SABME ? 0 : 1;
@@ -446,7 +447,7 @@ int llc_conn_ev_rx_ua_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb)
 int llc_conn_ev_rx_xxx_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb)
 {
         u16 rc = 1;
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
         if (LLC_PDU_IS_CMD(pdu)) {
                 if (LLC_PDU_TYPE_IS_I(pdu) || LLC_PDU_TYPE_IS_S(pdu)) {
@@ -461,7 +462,7 @@ int llc_conn_ev_rx_xxx_cmd_pbit_set_1(struct sock *sk, struct sk_buff *skb)
 int llc_conn_ev_rx_xxx_cmd_pbit_set_x(struct sock *sk, struct sk_buff *skb)
 {
         u16 rc = 1;
-        struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
+        const struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
         if (LLC_PDU_IS_CMD(pdu)) {
                 if (LLC_PDU_TYPE_IS_I(pdu) || LLC_PDU_TYPE_IS_S(pdu))
@@ -477,32 +478,10 @@ int llc_conn_ev_rx_xxx_cmd_pbit_set_x(struct sock *sk, struct sk_buff *skb)
         return rc;
 }
 
-int llc_conn_ev_rx_xxx_rsp_fbit_set_1(struct sock *sk, struct sk_buff *skb)
-{
-        u16 rc = 1;
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-
-        if (LLC_PDU_IS_RSP(pdu)) {
-                if (LLC_PDU_TYPE_IS_I(pdu) || LLC_PDU_TYPE_IS_S(pdu)) {
-                        if (LLC_I_PF_IS_1(pdu))
-                                rc = 0;
-                } else if (LLC_PDU_TYPE_IS_U(pdu))
-                        switch (LLC_U_PDU_RSP(pdu)) {
-                        case LLC_2_PDU_RSP_UA:
-                        case LLC_2_PDU_RSP_DM:
-                        case LLC_2_PDU_RSP_FRMR:
-                                if (LLC_U_PF_IS_1(pdu))
-                                        rc = 0;
-                                break;
-                        }
-        }
-        return rc;
-}
-
 int llc_conn_ev_rx_xxx_rsp_fbit_set_x(struct sock *sk, struct sk_buff *skb)
 {
         u16 rc = 1;
-        struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
+        const struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
         if (LLC_PDU_IS_RSP(pdu)) {
                 if (LLC_PDU_TYPE_IS_I(pdu) || LLC_PDU_TYPE_IS_S(pdu))
@@ -524,9 +503,9 @@ int llc_conn_ev_rx_zzz_cmd_pbit_set_x_inval_nr(struct sock *sk,
                                                struct sk_buff *skb)
 {
         u16 rc = 1;
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-        u8 vs = llc_sk(sk)->vS;
-        u8 nr = LLC_I_GET_NR(pdu);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const u8 vs = llc_sk(sk)->vS;
+        const u8 nr = LLC_I_GET_NR(pdu);
 
         if (LLC_PDU_IS_CMD(pdu) &&
             (LLC_PDU_TYPE_IS_I(pdu) || LLC_PDU_TYPE_IS_S(pdu)) &&
@@ -542,9 +521,9 @@ int llc_conn_ev_rx_zzz_rsp_fbit_set_x_inval_nr(struct sock *sk,
                                                struct sk_buff *skb)
 {
         u16 rc = 1;
-        struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-        u8 vs = llc_sk(sk)->vS;
-        u8 nr = LLC_I_GET_NR(pdu);
+        const struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+        const u8 vs = llc_sk(sk)->vS;
+        const u8 nr = LLC_I_GET_NR(pdu);
 
         if (LLC_PDU_IS_RSP(pdu) &&
             (LLC_PDU_TYPE_IS_I(pdu) || LLC_PDU_TYPE_IS_S(pdu)) &&
@@ -563,28 +542,28 @@ int llc_conn_ev_rx_any_frame(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_p_tmr_exp(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->type != LLC_CONN_EV_TYPE_P_TMR;
 }
 
 int llc_conn_ev_ack_tmr_exp(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->type != LLC_CONN_EV_TYPE_ACK_TMR;
 }
 
 int llc_conn_ev_rej_tmr_exp(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->type != LLC_CONN_EV_TYPE_REJ_TMR;
 }
 
 int llc_conn_ev_busy_tmr_exp(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->type != LLC_CONN_EV_TYPE_BUSY_TMR;
 }
@@ -596,7 +575,7 @@ int llc_conn_ev_init_p_f_cycle(struct sock *sk, struct sk_buff *skb)
 
 int llc_conn_ev_tx_buffer_full(struct sock *sk, struct sk_buff *skb)
 {
-        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+        const struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         return ev->type == LLC_CONN_EV_TYPE_SIMPLE &&
                ev->prim_type == LLC_CONN_EV_TX_BUFF_FULL ? 0 : 1;
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 4c644bc70eae..042b24a8ca4c 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -40,6 +40,11 @@ static struct llc_conn_state_trans *llc_qualify_conn_ev(struct sock *sk,
 /* Offset table on connection states transition diagram */
 static int llc_offset_table[NBR_CONN_STATES][NBR_CONN_EV];
 
+int sysctl_llc2_ack_timeout = LLC2_ACK_TIME * HZ;
+int sysctl_llc2_p_timeout = LLC2_P_TIME * HZ;
+int sysctl_llc2_rej_timeout = LLC2_REJ_TIME * HZ;
+int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
+
 /**
  *      llc_conn_state_process - sends event to connection state machine
  *      @sk: connection
@@ -53,7 +58,7 @@ static int llc_offset_table[NBR_CONN_STATES][NBR_CONN_EV];
 int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
-        struct llc_sock *llc = llc_sk(sk);
+        struct llc_sock *llc = llc_sk(skb->sk);
         struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
         /*
@@ -63,13 +68,16 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
          */
         skb_get(skb);
         ev->ind_prim = ev->cfm_prim = 0;
-        rc = llc_conn_service(sk, skb); /* sending event to state machine */
-        if (rc) {
+        /*
+         * Send event to state machine
+         */
+        rc = llc_conn_service(skb->sk, skb);
+        if (unlikely(rc != 0)) {
                 printk(KERN_ERR "%s: llc_conn_service failed\n", __FUNCTION__);
                 goto out_kfree_skb;
         }
 
-        if (!ev->ind_prim && !ev->cfm_prim) {
+        if (unlikely(!ev->ind_prim && !ev->cfm_prim)) {
                 /* indicate or confirm not required */
                 /* XXX this is not very pretty, perhaps we should store
                  * XXX indicate/confirm-needed state in the llc_conn_state_ev
@@ -80,13 +88,13 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
                 goto out_skb_put;
         }
 
-        if (ev->ind_prim && ev->cfm_prim) /* Paranoia */
+        if (unlikely(ev->ind_prim && ev->cfm_prim)) /* Paranoia */
                 skb_get(skb);
 
         switch (ev->ind_prim) {
         case LLC_DATA_PRIM:
-                llc_save_primitive(skb, LLC_DATA_PRIM);
-                if (sock_queue_rcv_skb(sk, skb)) {
+                llc_save_primitive(sk, skb, LLC_DATA_PRIM);
+                if (unlikely(sock_queue_rcv_skb(sk, skb))) {
                         /*
                          * shouldn't happen
                          */
@@ -95,13 +103,14 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
                         kfree_skb(skb);
                 }
                 break;
-        case LLC_CONN_PRIM: {
-                struct sock *parent = skb->sk;
-
-                skb->sk = sk;
-                skb_queue_tail(&parent->sk_receive_queue, skb);
-                sk->sk_state_change(parent);
-        }
+        case LLC_CONN_PRIM:
+                /*
+                 * Can't be sock_queue_rcv_skb, because we have to leave the
+                 * skb->sk pointing to the newly created struct sock in
+                 * llc_conn_handler. -acme
+                 */
+                skb_queue_tail(&sk->sk_receive_queue, skb);
+                sk->sk_state_change(sk);
                 break;
         case LLC_DISC_PRIM:
                 sock_hold(sk);
@@ -111,8 +120,8 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
                         sk->sk_socket->state  = SS_UNCONNECTED;
                         sk->sk_state          = TCP_CLOSE;
                         if (!sock_flag(sk, SOCK_DEAD)) {
-                                sk->sk_state_change(sk);
                                 sock_set_flag(sk, SOCK_DEAD);
+                                sk->sk_state_change(sk);
                         }
                 }
                 kfree_skb(skb);
@@ -465,7 +474,7 @@ static int llc_exec_conn_trans_actions(struct sock *sk,
 }
 
 /**
- *      llc_lookup_established - Finds connection for the remote/local sap/mac
+ *      __llc_lookup_established - Finds connection for the remote/local sap/mac
  *      @sap: SAP
  *      @daddr: address of remote LLC (MAC + SAP)
  *      @laddr: address of local LLC (MAC + SAP)
@@ -473,14 +482,16 @@ static int llc_exec_conn_trans_actions(struct sock *sk,
  *      Search connection list of the SAP and finds connection using the remote
  *      mac, remote sap, local mac, and local sap. Returns pointer for
  *      connection found, %NULL otherwise.
+ *      Caller has to make sure local_bh is disabled.
  */
-struct sock *llc_lookup_established(struct llc_sap *sap, struct llc_addr *daddr,
-                                    struct llc_addr *laddr)
+static struct sock *__llc_lookup_established(struct llc_sap *sap,
+                                             struct llc_addr *daddr,
+                                             struct llc_addr *laddr)
 {
         struct sock *rc;
         struct hlist_node *node;
 
-        read_lock_bh(&sap->sk_list.lock);
+        read_lock(&sap->sk_list.lock);
         sk_for_each(rc, node, &sap->sk_list.list) {
                 struct llc_sock *llc = llc_sk(rc);
 
@@ -494,10 +505,22 @@ struct sock *llc_lookup_established(struct llc_sap *sap, struct llc_addr *daddr,
         }
         rc = NULL;
 found:
-        read_unlock_bh(&sap->sk_list.lock);
+        read_unlock(&sap->sk_list.lock);
         return rc;
 }
 
+struct sock *llc_lookup_established(struct llc_sap *sap,
+                                    struct llc_addr *daddr,
+                                    struct llc_addr *laddr)
+{
+        struct sock *sk;
+
+        local_bh_disable();
+        sk = __llc_lookup_established(sap, daddr, laddr);
+        local_bh_enable();
+        return sk;
+}
+
 /**
  *      llc_lookup_listener - Finds listener for local MAC + SAP
  *      @sap: SAP
@@ -506,6 +529,7 @@ found:
  *      Search connection list of the SAP and finds connection listening on
  *      local mac, and local sap. Returns pointer for parent socket found,
  *      %NULL otherwise.
+ *      Caller has to make sure local_bh is disabled.
  */
 static struct sock *llc_lookup_listener(struct llc_sap *sap,
                                         struct llc_addr *laddr)
@@ -513,7 +537,7 @@ static struct sock *llc_lookup_listener(struct llc_sap *sap,
         struct sock *rc;
         struct hlist_node *node;
 
-        read_lock_bh(&sap->sk_list.lock);
+        read_lock(&sap->sk_list.lock);
         sk_for_each(rc, node, &sap->sk_list.list) {
                 struct llc_sock *llc = llc_sk(rc);
 
@@ -527,10 +551,19 @@ static struct sock *llc_lookup_listener(struct llc_sap *sap,
         }
         rc = NULL;
 found:
-        read_unlock_bh(&sap->sk_list.lock);
+        read_unlock(&sap->sk_list.lock);
         return rc;
 }
 
+static struct sock *__llc_lookup(struct llc_sap *sap,
+                                 struct llc_addr *daddr,
+                                 struct llc_addr *laddr)
+{
+        struct sock *sk = __llc_lookup_established(sap, daddr, laddr);
+
+        return sk ? : llc_lookup_listener(sap, laddr);
+}
+
 /**
  *      llc_data_accept_state - designates if in this state data can be sent.
  *      @state: state of connection.
@@ -544,14 +577,14 @@ u8 llc_data_accept_state(u8 state)
 }
 
 /**
- *      find_next_offset - finds offset for next category of transitions
+ *      llc_find_next_offset - finds offset for next category of transitions
  *      @state: state table.
  *      @offset: start offset.
  *
  *      Finds offset of next category of transitions in transition table.
  *      Returns the start index of next category.
  */
-static u16 find_next_offset(struct llc_conn_state *state, u16 offset)
+static u16 __init llc_find_next_offset(struct llc_conn_state *state, u16 offset)
 {
         u16 cnt = 0;
         struct llc_conn_state_trans **next_trans;
@@ -578,8 +611,8 @@ void __init llc_build_offset_table(void)
                 next_offset = 0;
                 for (ev_type = 0; ev_type < NBR_CONN_EV; ev_type++) {
                         llc_offset_table[state][ev_type] = next_offset;
-                        next_offset += find_next_offset(curr_state,
-                                                        next_offset) + 1;
+                        next_offset += llc_find_next_offset(curr_state,
+                                                            next_offset) + 1;
                 }
         }
 }
@@ -623,6 +656,7 @@ static int llc_find_offset(int state, int ev_type)
  */
 void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk)
 {
+        llc_sap_hold(sap);
         write_lock_bh(&sap->sk_list.lock);
         llc_sk(sk)->sap = sap;
         sk_add_node(sk, &sap->sk_list.list);
@@ -642,6 +676,7 @@ void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk)
         write_lock_bh(&sap->sk_list.lock);
         sk_del_node_init(sk);
         write_unlock_bh(&sap->sk_list.lock);
+        llc_sap_put(sap);
 }
 
 /**
@@ -654,15 +689,34 @@ void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk)
 static int llc_conn_rcv(struct sock* sk, struct sk_buff *skb)
 {
         struct llc_conn_state_ev *ev = llc_conn_ev(skb);
-        struct llc_sock *llc = llc_sk(sk);
 
-        if (!llc->dev)
-                llc->dev = skb->dev;
         ev->type   = LLC_CONN_EV_TYPE_PDU;
         ev->reason = 0;
         return llc_conn_state_process(sk, skb);
 }
 
+static struct sock *llc_create_incoming_sock(struct sock *sk,
+                                             struct net_device *dev,
+                                             struct llc_addr *saddr,
+                                             struct llc_addr *daddr)
+{
+        struct sock *newsk = llc_sk_alloc(sk->sk_family, GFP_ATOMIC,
+                                          sk->sk_prot);
+        struct llc_sock *newllc, *llc = llc_sk(sk);
+
+        if (!newsk)
+                goto out;
+        newllc = llc_sk(newsk);
+        memcpy(&newllc->laddr, daddr, sizeof(newllc->laddr));
+        memcpy(&newllc->daddr, saddr, sizeof(newllc->daddr));
+        newllc->dev = dev;
+        dev_hold(dev);
+        llc_sap_add_socket(llc->sap, newsk);
+        llc_sap_hold(llc->sap);
+out:
+        return newsk;
+}
+
 void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
 {
         struct llc_addr saddr, daddr;
@@ -673,35 +727,35 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
         llc_pdu_decode_da(skb, daddr.mac);
         llc_pdu_decode_dsap(skb, &daddr.lsap);
 
-        sk = llc_lookup_established(sap, &saddr, &daddr);
-        if (!sk) {
+        sk = __llc_lookup(sap, &saddr, &daddr);
+        if (!sk)
+                goto drop;
+
+        bh_lock_sock(sk);
+        /*
+         * This has to be done here and not at the upper layer ->accept
+         * method because of the way the PROCOM state machine works:
+         * it needs to set several state variables (see, for instance,
+         * llc_adm_actions_2 in net/llc/llc_c_st.c) and send a packet to
+         * the originator of the new connection, and this state has to be
+         * in the newly created struct sock private area. -acme
+         */
+        if (unlikely(sk->sk_state == TCP_LISTEN)) {
+                struct sock *newsk = llc_create_incoming_sock(sk, skb->dev,
+                                                              &saddr, &daddr);
+                if (!newsk)
+                        goto drop_unlock;
+                skb_set_owner_r(skb, newsk);
+        } else {
                 /*
-                 * Didn't find an active connection; verify if there
-                 * is a listening socket for this llc addr
+                 * Can't be skb_set_owner_r, this will be done at the
+                 * llc_conn_state_process function, later on, when we will use
+                 * skb_queue_rcv_skb to send it to upper layers, this is
+                 * another trick required to cope with how the PROCOM state
+                 * machine works. -acme
                  */
-                struct llc_sock *llc;
-                struct sock *parent = llc_lookup_listener(sap, &daddr);
-
-                if (!parent) {
-                        dprintk("llc_lookup_listener failed!\n");
-                        goto drop;
-                }
-
-                sk = llc_sk_alloc(parent->sk_family, GFP_ATOMIC, parent->sk_prot);
-                if (!sk) {
-                        sock_put(parent);
-                        goto drop;
-                }
-                llc = llc_sk(sk);
-                memcpy(&llc->laddr, &daddr, sizeof(llc->laddr));
-                memcpy(&llc->daddr, &saddr, sizeof(llc->daddr));
-                llc_sap_add_socket(sap, sk);
-                sock_hold(sk);
-                sock_put(parent);
-                skb->sk = parent;
-        } else
                 skb->sk = sk;
-        bh_lock_sock(sk);
+        }
         if (!sock_owned_by_user(sk))
                 llc_conn_rcv(sk, skb);
         else {
@@ -709,11 +763,16 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
                 llc_set_backlog_type(skb, LLC_PACKET);
                 sk_add_backlog(sk, skb);
         }
+out:
         bh_unlock_sock(sk);
         sock_put(sk);
         return;
 drop:
         kfree_skb(skb);
+        return;
+drop_unlock:
+        kfree_skb(skb);
+        goto out;
 }
 
 #undef LLC_REFCNT_DEBUG
@@ -722,32 +781,6 @@ static atomic_t llc_sock_nr;
 #endif
 
 /**
- *      llc_release_sockets - releases all sockets in a sap
- *      @sap: sap to release its sockets
- *
- *      Releases all connections of a sap. Returns 0 if all actions complete
- *      successfully, nonzero otherwise
- */
-int llc_release_sockets(struct llc_sap *sap)
-{
-        int rc = 0;
-        struct sock *sk;
-        struct hlist_node *node;
-
-        write_lock_bh(&sap->sk_list.lock);
-
-        sk_for_each(sk, node, &sap->sk_list.list) {
-                llc_sk(sk)->state = LLC_CONN_STATE_TEMP;
-
-                if (llc_send_disc(sk))
-                        rc = 1;
-        }
-
-        write_unlock_bh(&sap->sk_list.lock);
-        return rc;
-}
-
-/**
  *      llc_backlog_rcv - Processes rx frames and expired timers.
  *      @sk: LLC sock (p8022 connection)
  *      @skb: queued rx frame or event
@@ -762,14 +795,14 @@ static int llc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
         int rc = 0;
         struct llc_sock *llc = llc_sk(sk);
 
-        if (llc_backlog_type(skb) == LLC_PACKET) {
-                if (llc->state > 1) /* not closed */
+        if (likely(llc_backlog_type(skb) == LLC_PACKET)) {
+                if (likely(llc->state > 1)) /* not closed */
                         rc = llc_conn_rcv(sk, skb);
                 else
                         goto out_kfree_skb;
         } else if (llc_backlog_type(skb) == LLC_EVENT) {
                 /* timer expiration event */
-                if (llc->state > 1)  /* not closed */
+                if (likely(llc->state > 1))  /* not closed */
                         rc = llc_conn_state_process(sk, skb);
                 else
                         goto out_kfree_skb;
@@ -799,22 +832,22 @@ static void llc_sk_init(struct sock* sk)
         llc->dec_step = llc->connect_step = 1;
 
         init_timer(&llc->ack_timer.timer);
-        llc->ack_timer.expire         = LLC_ACK_TIME;
+        llc->ack_timer.expire         = sysctl_llc2_ack_timeout;
         llc->ack_timer.timer.data     = (unsigned long)sk;
         llc->ack_timer.timer.function = llc_conn_ack_tmr_cb;
 
         init_timer(&llc->pf_cycle_timer.timer);
-        llc->pf_cycle_timer.expire         = LLC_P_TIME;
+        llc->pf_cycle_timer.expire         = sysctl_llc2_p_timeout;
         llc->pf_cycle_timer.timer.data     = (unsigned long)sk;
         llc->pf_cycle_timer.timer.function = llc_conn_pf_cycle_tmr_cb;
 
         init_timer(&llc->rej_sent_timer.timer);
-        llc->rej_sent_timer.expire         = LLC_REJ_TIME;
+        llc->rej_sent_timer.expire         = sysctl_llc2_rej_timeout;
         llc->rej_sent_timer.timer.data     = (unsigned long)sk;
         llc->rej_sent_timer.timer.function = llc_conn_rej_tmr_cb;
 
         init_timer(&llc->busy_state_timer.timer);
-        llc->busy_state_timer.expire         = LLC_BUSY_TIME;
+        llc->busy_state_timer.expire         = sysctl_llc2_busy_timeout;
         llc->busy_state_timer.timer.data     = (unsigned long)sk;
         llc->busy_state_timer.timer.function = llc_conn_busy_tmr_cb;
 
@@ -834,7 +867,8 @@ static void llc_sk_init(struct sock* sk)
  *      Allocates a LLC sock and initializes it. Returns the new LLC sock
  *      or %NULL if there's no memory available for one
  */
-struct sock *llc_sk_alloc(int family, int priority, struct proto *prot)
+struct sock *llc_sk_alloc(int family, unsigned int __nocast priority,
+                         struct proto *prot)
 {
         struct sock *sk = sk_alloc(family, priority, prot, 1);
 
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index 9727455bf0e7..ab0fcd32fd84 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -40,6 +40,7 @@ static struct llc_sap *llc_sap_alloc(void)
                 sap->state = LLC_SAP_STATE_ACTIVE;
                 memcpy(sap->laddr.mac, llc_station_mac_sa, ETH_ALEN);
                 rwlock_init(&sap->sk_list.lock);
+                atomic_set(&sap->refcnt, 1);
         }
         return sap;
 }
@@ -52,9 +53,7 @@ static struct llc_sap *llc_sap_alloc(void)
  */
 static void llc_add_sap(struct llc_sap *sap)
 {
-        write_lock_bh(&llc_sap_list_lock);
         list_add_tail(&sap->node, &llc_sap_list);
-        write_unlock_bh(&llc_sap_list_lock);
 }
 
 /**
@@ -70,11 +69,25 @@ static void llc_del_sap(struct llc_sap *sap)
         write_unlock_bh(&llc_sap_list_lock);
 }
 
+static struct llc_sap *__llc_sap_find(unsigned char sap_value)
+{
+        struct llc_sap* sap;
+
+        list_for_each_entry(sap, &llc_sap_list, node)
+                if (sap->laddr.lsap == sap_value)
+                        goto out;
+        sap = NULL;
+out:
+        return sap;
+}
+
 /**
  *      llc_sap_find - searchs a SAP in station
  *      @sap_value: sap to be found
  *
  *      Searchs for a sap in the sap list of the LLC's station upon the sap ID.
+ *      If the sap is found it will be refcounted and the user will have to do
+ *      a llc_sap_put after use.
  *      Returns the sap or %NULL if not found.
  */
 struct llc_sap *llc_sap_find(unsigned char sap_value)
@@ -82,11 +95,9 @@ struct llc_sap *llc_sap_find(unsigned char sap_value)
         struct llc_sap* sap;
 
         read_lock_bh(&llc_sap_list_lock);
-        list_for_each_entry(sap, &llc_sap_list, node)
-                if (sap->laddr.lsap == sap_value)
-                        goto out;
-        sap = NULL;
-out:
+        sap = __llc_sap_find(sap_value);
+        if (sap)
+                llc_sap_hold(sap);
         read_unlock_bh(&llc_sap_list_lock);
         return sap;
 }
@@ -106,19 +117,20 @@ struct llc_sap *llc_sap_open(unsigned char lsap,
                                          struct packet_type *pt,
                                          struct net_device *orig_dev))
 {
-        struct llc_sap *sap = llc_sap_find(lsap);
+        struct llc_sap *sap = NULL;
 
-        if (sap) { /* SAP already exists */
-                sap = NULL;
+        write_lock_bh(&llc_sap_list_lock);
+        if (__llc_sap_find(lsap)) /* SAP already exists */
                 goto out;
-        }
         sap = llc_sap_alloc();
         if (!sap)
                 goto out;
         sap->laddr.lsap = lsap;
         sap->rcv_func   = func;
+        llc_sap_hold(sap);
         llc_add_sap(sap);
 out:
+        write_unlock_bh(&llc_sap_list_lock);
         return sap;
 }
 
diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
index 0f84f66018e4..ba90f7f0801a 100644
--- a/net/llc/llc_if.c
+++ b/net/llc/llc_if.c
@@ -47,14 +47,11 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
         int rc = -ECONNABORTED;
         struct llc_sock *llc = llc_sk(sk);
 
-        if (llc->state == LLC_CONN_STATE_ADM)
+        if (unlikely(llc->state == LLC_CONN_STATE_ADM))
                 goto out;
         rc = -EBUSY;
-        if (llc_data_accept_state(llc->state)) { /* data_conn_refuse */
-                llc->failed_data_req = 1;
-                goto out;
-        }
-        if (llc->p_flag) {
+        if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */
+                     llc->p_flag)) {
                 llc->failed_data_req = 1;
                 goto out;
         }
@@ -110,6 +107,7 @@ int llc_establish_connection(struct sock *sk, u8 *lmac, u8 *dmac, u8 dsap)
                 ev->type      = LLC_CONN_EV_TYPE_PRIM;
                 ev->prim      = LLC_CONN_PRIM;
                 ev->prim_type = LLC_PRIM_TYPE_REQ;
+                skb_set_owner_w(skb, sk);
                 rc = llc_conn_state_process(sk, skb);
         }
 out_put:
@@ -144,6 +142,7 @@ int llc_send_disc(struct sock *sk)
         skb = alloc_skb(0, GFP_ATOMIC);
         if (!skb)
                 goto out;
+        skb_set_owner_w(skb, sk);
         sk->sk_state  = TCP_CLOSING;
         ev            = llc_conn_ev(skb);
         ev->type      = LLC_CONN_EV_TYPE_PRIM;
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 13b46240b7a1..8f3addf0724c 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -99,15 +99,19 @@ out:
 static inline int llc_fixup_skb(struct sk_buff *skb)
 {
         u8 llc_len = 2;
-        struct llc_pdu_sn *pdu;
+        struct llc_pdu_un *pdu;
 
-        if (!pskb_may_pull(skb, sizeof(*pdu)))
+        if (unlikely(!pskb_may_pull(skb, sizeof(*pdu))))
                 return 0;
 
-        pdu = (struct llc_pdu_sn *)skb->data;
+        pdu = (struct llc_pdu_un *)skb->data;
         if ((pdu->ctrl_1 & LLC_PDU_TYPE_MASK) == LLC_PDU_TYPE_U)
                 llc_len = 1;
         llc_len += 2;
+
+        if (unlikely(!pskb_may_pull(skb, llc_len)))
+                return 0;
+
         skb->h.raw += llc_len;
         skb_pull(skb, llc_len);
         if (skb->protocol == htons(ETH_P_802_2)) {
@@ -166,17 +170,22 @@ int llc_rcv(struct sk_buff *skb, struct net_device *dev,
          */
         if (sap->rcv_func) {
                 sap->rcv_func(skb, dev, pt, orig_dev);
-                goto out;
+                goto out_put;
         }
         dest = llc_pdu_type(skb);
         if (unlikely(!dest || !llc_type_handlers[dest - 1]))
-                goto drop;
+                goto drop_put;
         llc_type_handlers[dest - 1](sap, skb);
+out_put:
+        llc_sap_put(sap);
 out:
         return 0;
 drop:
         kfree_skb(skb);
         goto out;
+drop_put:
+        kfree_skb(skb);
+        goto out_put;
 handle_station:
         if (!llc_station_handler)
                 goto drop;
diff --git a/net/llc/llc_output.c b/net/llc/llc_output.c
index ab5784cf163e..b4d55b6abb67 100644
--- a/net/llc/llc_output.c
+++ b/net/llc/llc_output.c
@@ -98,7 +98,7 @@ int llc_build_and_send_ui_pkt(struct llc_sap *sap, struct sk_buff *skb,
                             dsap, LLC_PDU_CMD);
         llc_pdu_init_as_ui_cmd(skb);
         rc = llc_mac_hdr_init(skb, skb->dev->dev_addr, dmac);
-        if (!rc)
+        if (likely(!rc))
                 rc = dev_queue_xmit(skb);
         return rc;
 }
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index 36e8db3fa1a2..bd531cb235a7 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -134,7 +134,7 @@ static int llc_seq_socket_show(struct seq_file *seq, void *v)
         llc_ui_format_mac(seq, llc->daddr.mac);
         seq_printf(seq, "@%02X %8d %8d %2d %3d %4d\n", llc->daddr.lsap,
                    atomic_read(&sk->sk_wmem_alloc),
-                   atomic_read(&sk->sk_rmem_alloc),
+                   atomic_read(&sk->sk_rmem_alloc) - llc->copied_seq,
                    sk->sk_state,
                    sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_uid : -1,
                    llc->link);
diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c
index ed8ba7de6122..bb3580fb8cfe 100644
--- a/net/llc/llc_s_ac.c
+++ b/net/llc/llc_s_ac.c
@@ -58,7 +58,7 @@ int llc_sap_action_send_ui(struct llc_sap *sap, struct sk_buff *skb)
                             ev->daddr.lsap, LLC_PDU_CMD);
         llc_pdu_init_as_ui_cmd(skb);
         rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
-        if (!rc)
+        if (likely(!rc))
                 rc = dev_queue_xmit(skb);
         return rc;
 }
@@ -81,7 +81,7 @@ int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb)
                             ev->daddr.lsap, LLC_PDU_CMD);
         llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0);
         rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
-        if (!rc)
+        if (likely(!rc))
                 rc = dev_queue_xmit(skb);
         return rc;
 }
@@ -103,15 +103,14 @@ int llc_sap_action_send_xid_r(struct llc_sap *sap, struct sk_buff *skb)
         llc_pdu_decode_sa(skb, mac_da);
         llc_pdu_decode_da(skb, mac_sa);
         llc_pdu_decode_ssap(skb, &dsap);
-        nskb = llc_alloc_frame();
+        nskb = llc_alloc_frame(NULL, skb->dev);
         if (!nskb)
                 goto out;
-        nskb->dev = skb->dev;
         llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap, dsap,
                             LLC_PDU_RSP);
         llc_pdu_init_as_xid_rsp(nskb, LLC_XID_NULL_CLASS_2, 0);
         rc = llc_mac_hdr_init(nskb, mac_sa, mac_da);
-        if (!rc)
+        if (likely(!rc))
                 rc = dev_queue_xmit(nskb);
 out:
         return rc;
@@ -135,7 +134,7 @@ int llc_sap_action_send_test_c(struct llc_sap *sap, struct sk_buff *skb)
                             ev->daddr.lsap, LLC_PDU_CMD);
         llc_pdu_init_as_test_cmd(skb);
         rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
-        if (!rc)
+        if (likely(!rc))
                 rc = dev_queue_xmit(skb);
         return rc;
 }
@@ -149,15 +148,14 @@ int llc_sap_action_send_test_r(struct llc_sap *sap, struct sk_buff *skb)
         llc_pdu_decode_sa(skb, mac_da);
         llc_pdu_decode_da(skb, mac_sa);
         llc_pdu_decode_ssap(skb, &dsap);
-        nskb = llc_alloc_frame();
+        nskb = llc_alloc_frame(NULL, skb->dev);
         if (!nskb)
                 goto out;
-        nskb->dev = skb->dev;
         llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, sap->laddr.lsap, dsap,
                             LLC_PDU_RSP);
         llc_pdu_init_as_test_rsp(nskb, skb);
         rc = llc_mac_hdr_init(nskb, mac_sa, mac_da);
-        if (!rc)
+        if (likely(!rc))
                 rc = dev_queue_xmit(nskb);
 out:
         return rc;
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 34228ef14985..4029ceee9b91 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -26,11 +26,12 @@
 
 /**
  *      llc_alloc_frame - allocates sk_buff for frame
+ *      @dev: network device this skb will be sent over
  *
  *      Allocates an sk_buff for frame and initializes sk_buff fields.
  *      Returns allocated skb or %NULL when out of memory.
  */
-struct sk_buff *llc_alloc_frame(void)
+struct sk_buff *llc_alloc_frame(struct sock *sk, struct net_device *dev)
 {
         struct sk_buff *skb = alloc_skb(128, GFP_ATOMIC);
 
@@ -38,18 +39,23 @@ struct sk_buff *llc_alloc_frame(void)
                 skb_reserve(skb, 50);
                 skb->nh.raw   = skb->h.raw = skb->data;
                 skb->protocol = htons(ETH_P_802_2);
-                skb->dev      = dev_base->next;
+                skb->dev      = dev;
                 skb->mac.raw  = skb->head;
+                if (sk != NULL)
+                        skb_set_owner_w(skb, sk);
         }
         return skb;
 }
 
-void llc_save_primitive(struct sk_buff* skb, u8 prim)
+void llc_save_primitive(struct sock *sk, struct sk_buff* skb, u8 prim)
 {
-        struct sockaddr_llc *addr = llc_ui_skb_cb(skb);
+        struct sockaddr_llc *addr;
 
+        if (skb->sk->sk_type == SOCK_STREAM) /* See UNIX98 */
+                return;
        /* save primitive for use by the user. */
-        addr->sllc_family = skb->sk->sk_family;
+        addr              = llc_ui_skb_cb(skb);
+        addr->sllc_family = sk->sk_family;
         addr->sllc_arphrd = skb->dev->type;
         addr->sllc_test   = prim == LLC_TEST_PRIM;
         addr->sllc_xid    = prim == LLC_XID_PRIM;
@@ -189,7 +195,7 @@ static void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb)
                 if (skb->sk->sk_state == TCP_LISTEN)
                         kfree_skb(skb);
                 else {
-                        llc_save_primitive(skb, ev->prim);
+                        llc_save_primitive(skb->sk, skb, ev->prim);
 
                         /* queue skb to the user. */
                         if (sock_queue_rcv_skb(skb->sk, skb))
@@ -308,7 +314,7 @@ void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb)
 
         sk = llc_lookup_dgram(sap, &laddr);
         if (sk) {
-                skb->sk = sk;
+                skb_set_owner_r(skb, sk);
                 llc_sap_rcv(sap, skb);
                 sock_put(sk);
         } else
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index 8fe48a24bad5..f37dbf8ef126 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -50,6 +50,10 @@ struct llc_station {
         struct sk_buff_head         mac_pdu_q;
 };
 
+#define LLC_STATION_ACK_TIME (3 * HZ)
+
+int sysctl_llc_station_ack_timeout = LLC_STATION_ACK_TIME;
+
 /* Types of events (possible values in 'ev->type') */
 #define LLC_STATION_EV_TYPE_SIMPLE      1
 #define LLC_STATION_EV_TYPE_CONDITION   2
@@ -218,7 +222,8 @@ static void llc_station_send_pdu(struct sk_buff *skb)
 
 static int llc_station_ac_start_ack_timer(struct sk_buff *skb)
 {
-        mod_timer(&llc_main_station.ack_timer, jiffies + LLC_ACK_TIME * HZ);
+        mod_timer(&llc_main_station.ack_timer,
+                  jiffies + sysctl_llc_station_ack_timeout);
         return 0;
 }
 
@@ -249,14 +254,14 @@ static int llc_station_ac_inc_xid_r_cnt_by_1(struct sk_buff *skb)
 static int llc_station_ac_send_null_dsap_xid_c(struct sk_buff *skb)
 {
         int rc = 1;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct sk_buff *nskb = llc_alloc_frame(NULL, skb->dev);
 
         if (!nskb)
                 goto out;
         llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, 0, 0, LLC_PDU_CMD);
         llc_pdu_init_as_xid_cmd(nskb, LLC_XID_NULL_CLASS_2, 127);
         rc = llc_mac_hdr_init(nskb, llc_station_mac_sa, llc_station_mac_sa);
-        if (rc)
+        if (unlikely(rc))
                 goto free;
         llc_station_send_pdu(nskb);
 out:
@@ -270,18 +275,17 @@ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
 {
         u8 mac_da[ETH_ALEN], dsap;
         int rc = 1;
-        struct sk_buff* nskb = llc_alloc_frame();
+        struct sk_buff* nskb = llc_alloc_frame(NULL, skb->dev);
 
         if (!nskb)
                 goto out;
         rc = 0;
-        nskb->dev = skb->dev;
         llc_pdu_decode_sa(skb, mac_da);
         llc_pdu_decode_ssap(skb, &dsap);
         llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, 0, dsap, LLC_PDU_RSP);
         llc_pdu_init_as_xid_rsp(nskb, LLC_XID_NULL_CLASS_2, 127);
         rc = llc_mac_hdr_init(nskb, llc_station_mac_sa, mac_da);
-        if (rc)
+        if (unlikely(rc))
                 goto free;
         llc_station_send_pdu(nskb);
 out:
@@ -295,18 +299,17 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)
 {
         u8 mac_da[ETH_ALEN], dsap;
         int rc = 1;
-        struct sk_buff *nskb = llc_alloc_frame();
+        struct sk_buff *nskb = llc_alloc_frame(NULL, skb->dev);
 
         if (!nskb)
                 goto out;
         rc = 0;
-        nskb->dev = skb->dev;
         llc_pdu_decode_sa(skb, mac_da);
         llc_pdu_decode_ssap(skb, &dsap);
         llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, 0, dsap, LLC_PDU_RSP);
         llc_pdu_init_as_test_rsp(nskb, skb);
         rc = llc_mac_hdr_init(nskb, llc_station_mac_sa, mac_da);
-        if (rc)
+        if (unlikely(rc))
                 goto free;
         llc_station_send_pdu(nskb);
 out:
@@ -689,7 +692,8 @@ int __init llc_station_init(void)
         init_timer(&llc_main_station.ack_timer);
         llc_main_station.ack_timer.data     = (unsigned long)&llc_main_station;
         llc_main_station.ack_timer.function = llc_station_ack_tmr_cb;
-
+        llc_main_station.ack_timer.expires  = jiffies +
+                                                sysctl_llc_station_ack_timeout;
         skb = alloc_skb(0, GFP_ATOMIC);
         if (!skb)
                 goto out;
@@ -697,7 +701,6 @@ int __init llc_station_init(void)
         llc_set_station_handler(llc_station_rcv);
         ev = llc_station_ev(skb);
         memset(ev, 0, sizeof(*ev));
-        llc_main_station.ack_timer.expires = jiffies + 3 * HZ;
         llc_main_station.maximum_retry  = 1;
         llc_main_station.state          = LLC_STATION_STATE_DOWN;
         ev->type        = LLC_STATION_EV_TYPE_SIMPLE;
diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c
new file mode 100644
index 000000000000..d1eaddb13633
--- /dev/null
+++ b/net/llc/sysctl_net_llc.c
@@ -0,0 +1,131 @@
+/*
+ * sysctl_net_llc.c: sysctl interface to LLC net subsystem.
+ * 
+ * Arnaldo Carvalho de Melo <acme@conectiva.com.br>
+ */
+
+#include <linux/config.h>
+#include <linux/mm.h>
+#include <linux/init.h>
+#include <linux/sysctl.h>
+#include <net/llc.h>
+
+#ifndef CONFIG_SYSCTL
+#error This file should not be compiled without CONFIG_SYSCTL defined
+#endif
+
+static struct ctl_table llc2_timeout_table[] = {
+        {
+                .ctl_name       = NET_LLC2_ACK_TIMEOUT,
+                .procname       = "ack",
+                .data           = &sysctl_llc2_ack_timeout,
+                .maxlen         = sizeof(long),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_jiffies,
+                .strategy       = &sysctl_jiffies,
+        },
+        {
+                .ctl_name       = NET_LLC2_BUSY_TIMEOUT,
+                .procname       = "busy",
+                .data           = &sysctl_llc2_busy_timeout,
+                .maxlen         = sizeof(long),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_jiffies,
+                .strategy       = &sysctl_jiffies,
+        },
+        {
+                .ctl_name       = NET_LLC2_P_TIMEOUT,
+                .procname       = "p",
+                .data           = &sysctl_llc2_p_timeout,
+                .maxlen         = sizeof(long),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_jiffies,
+                .strategy       = &sysctl_jiffies,
+        },
+        {
+                .ctl_name       = NET_LLC2_REJ_TIMEOUT,
+                .procname       = "rej",
+                .data           = &sysctl_llc2_rej_timeout,
+                .maxlen         = sizeof(long),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_jiffies,
+                .strategy       = &sysctl_jiffies,
+        },
+        { 0 },
+};
+
+static struct ctl_table llc_station_table[] = {
+        {
+                .ctl_name       = NET_LLC_STATION_ACK_TIMEOUT,
+                .procname       = "ack_timeout",
+                .data           = &sysctl_llc_station_ack_timeout,
+                .maxlen         = sizeof(long),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_jiffies,
+                .strategy       = &sysctl_jiffies,
+        },
+        { 0 },
+};
+
+static struct ctl_table llc2_dir_timeout_table[] = {
+        {
+                .ctl_name       = NET_LLC2,
+                .procname       = "timeout",
+                .mode           = 0555,
+                .child          = llc2_timeout_table,
+        },
+        { 0 },
+};
+
+static struct ctl_table llc_table[] = {
+        {
+                .ctl_name       = NET_LLC2,
+                .procname       = "llc2",
+                .mode           = 0555,
+                .child          = llc2_dir_timeout_table,
+        },
+        {
+                .ctl_name       = NET_LLC_STATION,
+                .procname       = "station",
+                .mode           = 0555,
+                .child          = llc_station_table,
+        },
+        { 0 },
+};
+
+static struct ctl_table llc_dir_table[] = {
+        {
+                .ctl_name       = NET_LLC,
+                .procname       = "llc",
+                .mode           = 0555,
+                .child          = llc_table,
+        },
+        { 0 },
+};
+
+static struct ctl_table llc_root_table[] = {
+        {
+                .ctl_name       = CTL_NET,
+                .procname       = "net",
+                .mode           = 0555,
+                .child          = llc_dir_table,
+        },
+        { 0 },
+};
+
+static struct ctl_table_header *llc_table_header;
+
+int __init llc_sysctl_init(void)
+{
+        llc_table_header = register_sysctl_table(llc_root_table, 1);
+
+        return llc_table_header ? 0 : -ENOMEM;
+}
+
+void llc_sysctl_exit(void)
+{
+        if (llc_table_header) {
+                unregister_sysctl_table(llc_table_header);
+                llc_table_header = NULL;
+        }
+}
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index ff5601ceedcb..efcd10f996ba 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -494,8 +494,8 @@ __build_packet_message(struct nfulnl_instance *inst,
         if (skb->tstamp.off_sec) {
                 struct nfulnl_msg_packet_timestamp ts;
 
-                ts.sec = cpu_to_be64(skb_tv_base.tv_sec + skb->tstamp.off_sec);
-                ts.usec = cpu_to_be64(skb_tv_base.tv_usec + skb->tstamp.off_usec);
+                ts.sec = cpu_to_be64(skb->tstamp.off_sec);
+                ts.usec = cpu_to_be64(skb->tstamp.off_usec);
 
                 NFA_PUT(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts);
         }
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index f81fe8c52e99..eaa44c49567b 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -492,8 +492,8 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
         if (entry->skb->tstamp.off_sec) {
                 struct nfqnl_msg_packet_timestamp ts;
 
-                ts.sec = cpu_to_be64(skb_tv_base.tv_sec + entry->skb->tstamp.off_sec);
-                ts.usec = cpu_to_be64(skb_tv_base.tv_usec + entry->skb->tstamp.off_usec);
+                ts.sec = cpu_to_be64(entry->skb->tstamp.off_sec);
+                ts.usec = cpu_to_be64(entry->skb->tstamp.off_usec);
 
                 NFA_PUT(skb, NFQA_TIMESTAMP, sizeof(ts), &ts);
         }
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8690f171c1ef..499ae3df4a44 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -36,6 +36,11 @@
  *      Michal Ostrowski        :       Module initialization cleanup.
  *         Ulises Alonso        :       Frame number limit removal and 
  *                                      packet_set_ring memory leak.
+ *              Eric Biederman  :       Allow for > 8 byte hardware addresses.
+ *                                      The convention is that longer addresses
+ *                                      will simply extend the hardware address
+ *                                      byte arrays at the end of sockaddr_ll 
+ *                                      and packet_mreq.
  *
  *              This program is free software; you can redistribute it and/or
  *              modify it under the terms of the GNU General Public License
@@ -161,7 +166,17 @@ struct packet_mclist
         int                     count;
         unsigned short          type;
         unsigned short          alen;
-        unsigned char           addr[8];
+        unsigned char           addr[MAX_ADDR_LEN];
+};
+/* identical to struct packet_mreq except it has
+ * a longer address field.
+ */
+struct packet_mreq_max
+{
+        int             mr_ifindex;
+        unsigned short  mr_type;
+        unsigned short  mr_alen;
+        unsigned char   mr_address[MAX_ADDR_LEN];
 };
 #endif
 #ifdef CONFIG_PACKET_MMAP
@@ -639,8 +654,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 __net_timestamp(skb);
                 sock_enable_timestamp(sk);
         }
-        h->tp_sec = skb_tv_base.tv_sec + skb->tstamp.off_sec;
-        h->tp_usec = skb_tv_base.tv_usec + skb->tstamp.off_usec;
+        h->tp_sec = skb->tstamp.off_sec;
+        h->tp_usec = skb->tstamp.off_usec;
 
         sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h)));
         sll->sll_halen = 0;
@@ -716,6 +731,8 @@ static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
                 err = -EINVAL;
                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
                         goto out;
+                if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
+                        goto out;
                 ifindex = saddr->sll_ifindex;
                 proto   = saddr->sll_protocol;
                 addr    = saddr->sll_addr;
@@ -1045,6 +1062,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct sk_buff *skb;
         int copied, err;
+        struct sockaddr_ll *sll;
 
         err = -EINVAL;
         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
@@ -1057,16 +1075,6 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
 #endif
 
         /*
-         *      If the address length field is there to be filled in, we fill
-         *      it in now.
-         */
-
-        if (sock->type == SOCK_PACKET)
-                msg->msg_namelen = sizeof(struct sockaddr_pkt);
-        else
-                msg->msg_namelen = sizeof(struct sockaddr_ll);
-
-        /*
          *      Call the generic datagram receiver. This handles all sorts
          *      of horrible races and re-entrancy so we can forget about it
          *      in the protocol layers.
@@ -1087,6 +1095,17 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
                 goto out;
 
         /*
+         *      If the address length field is there to be filled in, we fill
+         *      it in now.
+         */
+
+        sll = (struct sockaddr_ll*)skb->cb;
+        if (sock->type == SOCK_PACKET)
+                msg->msg_namelen = sizeof(struct sockaddr_pkt);
+        else
+                msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
+
+        /*
          *      You lose any data beyond the buffer you gave. If it worries a
          *      user program they can ask the device for its MTU anyway.
          */
@@ -1166,7 +1185,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
                 sll->sll_halen = 0;
         }
-        *uaddr_len = sizeof(*sll);
+        *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
 
         return 0;
 }
@@ -1199,7 +1218,7 @@ static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, i
         }
 }
 
-static int packet_mc_add(struct sock *sk, struct packet_mreq *mreq)
+static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
 {
         struct packet_sock *po = pkt_sk(sk);
         struct packet_mclist *ml, *i;
@@ -1249,7 +1268,7 @@ done:
         return err;
 }
 
-static int packet_mc_drop(struct sock *sk, struct packet_mreq *mreq)
+static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
 {
         struct packet_mclist *ml, **mlp;
 
@@ -1315,11 +1334,17 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
         case PACKET_ADD_MEMBERSHIP:     
         case PACKET_DROP_MEMBERSHIP:
         {
-                struct packet_mreq mreq;
-                if (optlen<sizeof(mreq))
+                struct packet_mreq_max mreq;
+                int len = optlen;
+                memset(&mreq, 0, sizeof(mreq));
+                if (len < sizeof(struct packet_mreq))
                         return -EINVAL;
-                if (copy_from_user(&mreq,optval,sizeof(mreq)))
+                if (len > sizeof(mreq))
+                        len = sizeof(mreq);
+                if (copy_from_user(&mreq,optval,len))
                         return -EFAULT;
+                if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address)))
+                        return -EINVAL;
                 if (optname == PACKET_ADD_MEMBERSHIP)
                         ret = packet_mc_add(sk, &mreq);
                 else
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 5acb1680524a..829fdbc4400b 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1472,22 +1472,25 @@ static const char banner[] = KERN_INFO "F6FBB/G4KLX ROSE for Linux. Version 0.62
 static int __init rose_proto_init(void)
 {
         int i;
-        int rc = proto_register(&rose_proto, 0);
+        int rc;
 
+        if (rose_ndevs > 0x7FFFFFFF/sizeof(struct net_device *)) {
+                printk(KERN_ERR "ROSE: rose_proto_init - rose_ndevs parameter to large\n");
+                rc = -EINVAL;
+                goto out;
+        }
+
+        rc = proto_register(&rose_proto, 0);
         if (rc != 0)
                 goto out;
 
         rose_callsign = null_ax25_address;
 
-        if (rose_ndevs > 0x7FFFFFFF/sizeof(struct net_device *)) {
-                printk(KERN_ERR "ROSE: rose_proto_init - rose_ndevs parameter to large\n");
-                return -1;
-        }
-
         dev_rose = kmalloc(rose_ndevs * sizeof(struct net_device *), GFP_KERNEL);
         if (dev_rose == NULL) {
                 printk(KERN_ERR "ROSE: rose_proto_init - unable to allocate device structure\n");
-                return -1;
+                rc = -ENOMEM;
+                goto out_proto_unregister;
         }
 
         memset(dev_rose, 0x00, rose_ndevs * sizeof(struct net_device*));
@@ -1500,10 +1503,12 @@ static int __init rose_proto_init(void)
                                    name, rose_setup);
                 if (!dev) {
                         printk(KERN_ERR "ROSE: rose_proto_init - unable to allocate memory\n");
+                        rc = -ENOMEM;
                         goto fail;
                 }
-                if (register_netdev(dev)) {
-                        printk(KERN_ERR "ROSE: netdevice regeistration failed\n");
+                rc = register_netdev(dev);
+                if (rc) {
+                        printk(KERN_ERR "ROSE: netdevice registration failed\n");
                         free_netdev(dev);
                         goto fail;
                 }
@@ -1536,8 +1541,9 @@ fail:
                 free_netdev(dev_rose[i]);
         }
         kfree(dev_rose);
+out_proto_unregister:
         proto_unregister(&rose_proto);
-        return -ENOMEM;
+        goto out;
 }
 module_init(rose_proto_init);
 
diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index 00eae5f9a01a..cf68a59fdc5a 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -393,10 +393,10 @@ META_COLLECTOR(int_sk_route_caps)
         dst->value = skb->sk->sk_route_caps;
 }
 
-META_COLLECTOR(int_sk_hashent)
+META_COLLECTOR(int_sk_hash)
 {
         SKIP_NONLOCAL(skb);
-        dst->value = skb->sk->sk_hashent;
+        dst->value = skb->sk->sk_hash;
 }
 
 META_COLLECTOR(int_sk_lingertime)
@@ -515,7 +515,7 @@ static struct meta_ops __meta_ops[TCF_META_TYPE_MAX+1][TCF_META_ID_MAX+1] = {
                 [META_ID(SK_FORWARD_ALLOCS)]    = META_FUNC(int_sk_fwd_alloc),
                 [META_ID(SK_ALLOCS)]            = META_FUNC(int_sk_alloc),
                 [META_ID(SK_ROUTE_CAPS)]        = META_FUNC(int_sk_route_caps),
-                [META_ID(SK_HASHENT)]           = META_FUNC(int_sk_hashent),
+                [META_ID(SK_HASH)]              = META_FUNC(int_sk_hash),
                 [META_ID(SK_LINGERTIME)]        = META_FUNC(int_sk_lingertime),
                 [META_ID(SK_ACK_BACKLOG)]       = META_FUNC(int_sk_ack_bl),
                 [META_ID(SK_MAX_ACK_BACKLOG)]   = META_FUNC(int_sk_max_ack_bl),
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index e7025be77691..f01d1c9002a1 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -147,7 +147,7 @@ static void sctp_v4_copy_addrlist(struct list_head *addrlist,
         struct sctp_sockaddr_entry *addr;
 
         rcu_read_lock();
-        if ((in_dev = __in_dev_get(dev)) == NULL) {
+        if ((in_dev = __in_dev_get_rcu(dev)) == NULL) {
                 rcu_read_unlock();
                 return;
         }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 86073df418f5..505c7de10c50 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2414,6 +2414,17 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
         skb_pull(chunk->skb, sizeof(sctp_shutdownhdr_t));
         chunk->subh.shutdown_hdr = sdh;
 
+        /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
+         * When a peer sends a SHUTDOWN, SCTP delivers this notification to
+         * inform the application that it should cease sending data.
+         */
+        ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
+        if (!ev) {
+                disposition = SCTP_DISPOSITION_NOMEM;
+                goto out;       
+        }
+        sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
+
         /* Upon the reception of the SHUTDOWN, the peer endpoint shall
          *  - enter the SHUTDOWN-RECEIVED state,
          *  - stop accepting new data from its SCTP user
@@ -2439,17 +2450,6 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
         sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
                         SCTP_U32(chunk->subh.shutdown_hdr->cum_tsn_ack));
 
-        /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
-         * When a peer sends a SHUTDOWN, SCTP delivers this notification to
-         * inform the application that it should cease sending data.
-         */
-        ev = sctp_ulpevent_make_shutdown_event(asoc, 0, GFP_ATOMIC);
-        if (!ev) {
-                disposition = SCTP_DISPOSITION_NOMEM;
-                goto out;       
-        }
-        sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
-
 out:
         return disposition;
 }
diff --git a/net/socket.c b/net/socket.c
index c699e93c33d7..3145103cdf54 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1145,8 +1145,11 @@ static int __sock_create(int family, int type, int protocol, struct socket **res
         if (!try_module_get(net_families[family]->owner))
                 goto out_release;
 
-        if ((err = net_families[family]->create(sock, protocol)) < 0)
+        if ((err = net_families[family]->create(sock, protocol)) < 0) {
+                sock->ops = NULL;
                 goto out_module_put;
+        }
+
         /*
          * Now to bump the refcnt of the [loadable] module that owns this
          * socket at sock_release time we decrement its refcnt.
@@ -1360,16 +1363,16 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, int _
         newsock->type = sock->type;
         newsock->ops = sock->ops;
 
-        err = security_socket_accept(sock, newsock);
-        if (err)
-                goto out_release;
-
         /*
          * We don't need try_module_get here, as the listening socket (sock)
          * has the protocol module (sock->ops->owner) held.
          */
         __module_get(newsock->ops->owner);
 
+        err = security_socket_accept(sock, newsock);
+        if (err)
+                goto out_release;
+
         err = sock->ops->accept(sock, newsock, sock->file->f_flags);
         if (err < 0)
                 goto out_release;
@@ -1700,7 +1703,9 @@ asmlinkage long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
         struct socket *sock;
         char address[MAX_SOCK_ADDR];
         struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
-        unsigned char ctl[sizeof(struct cmsghdr) + 20]; /* 20 is size of ipv6_pktinfo */
+        unsigned char ctl[sizeof(struct cmsghdr) + 20]
+                        __attribute__ ((aligned (sizeof(__kernel_size_t))));
+                        /* 20 is size of ipv6_pktinfo */
         unsigned char *ctl_buf = ctl;
         struct msghdr msg_sys;
         int err, ctl_len, iov_size, total_len;
@@ -1862,7 +1867,8 @@ asmlinkage long sys_recvmsg(int fd, struct msghdr __user *msg, unsigned int flag
                 if (err < 0)
                         goto out_freeiov;
         }
-        err = __put_user(msg_sys.msg_flags, COMPAT_FLAGS(msg));
+        err = __put_user((msg_sys.msg_flags & ~MSG_CMSG_COMPAT),
+                         COMPAT_FLAGS(msg));
         if (err)
                 goto out_freeiov;
         if (MSG_CMSG_COMPAT & flags)
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 51885b5f744e..30ec3efc48a6 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -512,15 +512,14 @@ svc_sock_setbufsize(struct socket *sock, unsigned int snd, unsigned int rcv)
 static void
 svc_udp_data_ready(struct sock *sk, int count)
 {
-        struct svc_sock *svsk = (struct svc_sock *)(sk->sk_user_data);
+        struct svc_sock *svsk = (struct svc_sock *)sk->sk_user_data;
 
-        if (!svsk)
-                goto out;
-        dprintk("svc: socket %p(inet %p), count=%d, busy=%d\n",
-                svsk, sk, count, test_bit(SK_BUSY, &svsk->sk_flags));
-        set_bit(SK_DATA, &svsk->sk_flags);
-        svc_sock_enqueue(svsk);
- out:
+        if (svsk) {
+                dprintk("svc: socket %p(inet %p), count=%d, busy=%d\n",
+                        svsk, sk, count, test_bit(SK_BUSY, &svsk->sk_flags));
+                set_bit(SK_DATA, &svsk->sk_flags);
+                svc_sock_enqueue(svsk);
+        }
         if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
                 wake_up_interruptible(sk->sk_sleep);
 }
@@ -540,7 +539,7 @@ svc_write_space(struct sock *sk)
         }
 
         if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) {
-                printk(KERN_WARNING "RPC svc_write_space: some sleeping on %p\n",
+                dprintk("RPC svc_write_space: someone sleeping on %p\n",
                        svsk);
                 wake_up_interruptible(sk->sk_sleep);
         }
@@ -692,31 +691,29 @@ svc_udp_init(struct svc_sock *svsk)
 static void
 svc_tcp_listen_data_ready(struct sock *sk, int count_unused)
 {
-        struct svc_sock *svsk;
+        struct svc_sock *svsk = (struct svc_sock *)sk->sk_user_data;
 
         dprintk("svc: socket %p TCP (listen) state change %d\n",
-                        sk, sk->sk_state);
+                sk, sk->sk_state);
 
-        if  (sk->sk_state != TCP_LISTEN) {
-                /*
-                 * This callback may called twice when a new connection
-                 * is established as a child socket inherits everything
-                 * from a parent LISTEN socket.
-                 * 1) data_ready method of the parent socket will be called
-                 *    when one of child sockets become ESTABLISHED.
-                 * 2) data_ready method of the child socket may be called
-                 *    when it receives data before the socket is accepted.
-                 * In case of 2, we should ignore it silently.
-                 */
-                goto out;
-        }
-        if (!(svsk = (struct svc_sock *) sk->sk_user_data)) {
-                printk("svc: socket %p: no user data\n", sk);
-                goto out;
+        /*
+         * This callback may called twice when a new connection
+         * is established as a child socket inherits everything
+         * from a parent LISTEN socket.
+         * 1) data_ready method of the parent socket will be called
+         *    when one of child sockets become ESTABLISHED.
+         * 2) data_ready method of the child socket may be called
+         *    when it receives data before the socket is accepted.
+         * In case of 2, we should ignore it silently.
+         */
+        if (sk->sk_state == TCP_LISTEN) {
+                if (svsk) {
+                        set_bit(SK_CONN, &svsk->sk_flags);
+                        svc_sock_enqueue(svsk);
+                } else
+                        printk("svc: socket %p: no user data\n", sk);
         }
-        set_bit(SK_CONN, &svsk->sk_flags);
-        svc_sock_enqueue(svsk);
- out:
+
         if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
                 wake_up_interruptible_all(sk->sk_sleep);
 }
@@ -727,18 +724,17 @@ svc_tcp_listen_data_ready(struct sock *sk, int count_unused)
 static void
 svc_tcp_state_change(struct sock *sk)
 {
-        struct svc_sock *svsk;
+        struct svc_sock *svsk = (struct svc_sock *)sk->sk_user_data;
 
         dprintk("svc: socket %p TCP (connected) state change %d (svsk %p)\n",
-                        sk, sk->sk_state, sk->sk_user_data);
+                sk, sk->sk_state, sk->sk_user_data);
 
-        if (!(svsk = (struct svc_sock *) sk->sk_user_data)) {
+        if (!svsk)
                 printk("svc: socket %p: no user data\n", sk);
-                goto out;
+        else {
+                set_bit(SK_CLOSE, &svsk->sk_flags);
+                svc_sock_enqueue(svsk);
         }
-        set_bit(SK_CLOSE, &svsk->sk_flags);
-        svc_sock_enqueue(svsk);
- out:
         if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
                 wake_up_interruptible_all(sk->sk_sleep);
 }
@@ -746,15 +742,14 @@ svc_tcp_state_change(struct sock *sk)
 static void
 svc_tcp_data_ready(struct sock *sk, int count)
 {
-        struct svc_sock *       svsk;
+        struct svc_sock *svsk = (struct svc_sock *)sk->sk_user_data;
 
         dprintk("svc: socket %p TCP data ready (svsk %p)\n",
-                        sk, sk->sk_user_data);
-        if (!(svsk = (struct svc_sock *)(sk->sk_user_data)))
-                goto out;
-        set_bit(SK_DATA, &svsk->sk_flags);
-        svc_sock_enqueue(svsk);
- out:
+                sk, sk->sk_user_data);
+        if (svsk) {
+                set_bit(SK_DATA, &svsk->sk_flags);
+                svc_sock_enqueue(svsk);
+        }
         if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
                 wake_up_interruptible(sk->sk_sleep);
 }
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index c5241fcbb966..55538f6b60ff 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -16,6 +16,8 @@
 #include <linux/mm.h>
 #include <linux/sysctl.h>
 
+#include <net/sock.h>
+
 #ifdef CONFIG_INET
 #include <net/ip.h>
 #endif
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index d8ee38aede26..f2ee673329a7 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -295,11 +295,13 @@ static int do_pcmcia_entry(const char *filename,
 {
         unsigned int i;
 
+        id->match_flags = TO_NATIVE(id->match_flags);
         id->manf_id = TO_NATIVE(id->manf_id);
         id->card_id = TO_NATIVE(id->card_id);
         id->func_id = TO_NATIVE(id->func_id);
         id->function = TO_NATIVE(id->function);
         id->device_no = TO_NATIVE(id->device_no);
+
         for (i=0; i<4; i++) {
                 id->prod_id_hash[i] = TO_NATIVE(id->prod_id_hash[i]);
        }
diff --git a/security/Kconfig b/security/Kconfig
index dcf04a09185d..64d3f1e9ca85 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -35,6 +35,7 @@ config KEYS_DEBUG_PROC_KEYS
 
 config SECURITY
         bool "Enable different security models"
+        depends on SYSFS
         help
           This allows you to choose different security modules to be
           configured into your kernel.
diff --git a/security/Makefile b/security/Makefile
index 197cc2f3f1ec..8cbbf2f36709 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -11,7 +11,7 @@ obj-y		+= commoncap.o
 endif
 
 # Object file lists
-obj-$(CONFIG_SECURITY)                  += security.o dummy.o
+obj-$(CONFIG_SECURITY)                  += security.o dummy.o inode.o
 # Must precede capability.o in order to stack properly.
 obj-$(CONFIG_SECURITY_SELINUX)          += selinux/built-in.o
 obj-$(CONFIG_SECURITY_CAPABILITIES)     += commoncap.o capability.o
diff --git a/security/inode.c b/security/inode.c
new file mode 100644
index 000000000000..a5964502ae30
--- /dev/null
+++ b/security/inode.c
@@ -0,0 +1,347 @@
+/*
+ *  inode.c - securityfs
+ *
+ *  Copyright (C) 2005 Greg Kroah-Hartman <gregkh@suse.de>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License version
+ *      2 as published by the Free Software Foundation.
+ *
+ *  Based on fs/debugfs/inode.c which had the following copyright notice:
+ *    Copyright (C) 2004 Greg Kroah-Hartman <greg@kroah.com>
+ *    Copyright (C) 2004 IBM Inc.
+ */
+
+/* #define DEBUG */
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/mount.h>
+#include <linux/pagemap.h>
+#include <linux/init.h>
+#include <linux/namei.h>
+#include <linux/security.h>
+
+#define SECURITYFS_MAGIC        0x73636673
+
+static struct vfsmount *mount;
+static int mount_count;
+
+/*
+ * TODO:
+ *   I think I can get rid of these default_file_ops, but not quite sure...
+ */
+static ssize_t default_read_file(struct file *file, char __user *buf,
+                                 size_t count, loff_t *ppos)
+{
+        return 0;
+}
+
+static ssize_t default_write_file(struct file *file, const char __user *buf,
+                                   size_t count, loff_t *ppos)
+{
+        return count;
+}
+
+static int default_open(struct inode *inode, struct file *file)
+{
+        if (inode->u.generic_ip)
+                file->private_data = inode->u.generic_ip;
+
+        return 0;
+}
+
+static struct file_operations default_file_ops = {
+        .read =         default_read_file,
+        .write =        default_write_file,
+        .open =         default_open,
+};
+
+static struct inode *get_inode(struct super_block *sb, int mode, dev_t dev)
+{
+        struct inode *inode = new_inode(sb);
+
+        if (inode) {
+                inode->i_mode = mode;
+                inode->i_uid = 0;
+                inode->i_gid = 0;
+                inode->i_blksize = PAGE_CACHE_SIZE;
+                inode->i_blocks = 0;
+                inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+                switch (mode & S_IFMT) {
+                default:
+                        init_special_inode(inode, mode, dev);
+                        break;
+                case S_IFREG:
+                        inode->i_fop = &default_file_ops;
+                        break;
+                case S_IFDIR:
+                        inode->i_op = &simple_dir_inode_operations;
+                        inode->i_fop = &simple_dir_operations;
+
+                        /* directory inodes start off with i_nlink == 2 (for "." entry) */
+                        inode->i_nlink++;
+                        break;
+                }
+        }
+        return inode;
+}
+
+/* SMP-safe */
+static int mknod(struct inode *dir, struct dentry *dentry,
+                         int mode, dev_t dev)
+{
+        struct inode *inode;
+        int error = -EPERM;
+
+        if (dentry->d_inode)
+                return -EEXIST;
+
+        inode = get_inode(dir->i_sb, mode, dev);
+        if (inode) {
+                d_instantiate(dentry, inode);
+                dget(dentry);
+                error = 0;
+        }
+        return error;
+}
+
+static int mkdir(struct inode *dir, struct dentry *dentry, int mode)
+{
+        int res;
+
+        mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR;
+        res = mknod(dir, dentry, mode, 0);
+        if (!res)
+                dir->i_nlink++;
+        return res;
+}
+
+static int create(struct inode *dir, struct dentry *dentry, int mode)
+{
+        mode = (mode & S_IALLUGO) | S_IFREG;
+        return mknod(dir, dentry, mode, 0);
+}
+
+static inline int positive(struct dentry *dentry)
+{
+        return dentry->d_inode && !d_unhashed(dentry);
+}
+
+static int fill_super(struct super_block *sb, void *data, int silent)
+{
+        static struct tree_descr files[] = {{""}};
+
+        return simple_fill_super(sb, SECURITYFS_MAGIC, files);
+}
+
+static struct super_block *get_sb(struct file_system_type *fs_type,
+                                        int flags, const char *dev_name,
+                                        void *data)
+{
+        return get_sb_single(fs_type, flags, data, fill_super);
+}
+
+static struct file_system_type fs_type = {
+        .owner =        THIS_MODULE,
+        .name =         "securityfs",
+        .get_sb =       get_sb,
+        .kill_sb =      kill_litter_super,
+};
+
+static int create_by_name(const char *name, mode_t mode,
+                          struct dentry *parent,
+                          struct dentry **dentry)
+{
+        int error = 0;
+
+        *dentry = NULL;
+
+        /* If the parent is not specified, we create it in the root.
+         * We need the root dentry to do this, which is in the super
+         * block. A pointer to that is in the struct vfsmount that we
+         * have around.
+         */
+        if (!parent ) {
+                if (mount && mount->mnt_sb) {
+                        parent = mount->mnt_sb->s_root;
+                }
+        }
+        if (!parent) {
+                pr_debug("securityfs: Ah! can not find a parent!\n");
+                return -EFAULT;
+        }
+
+        down(&parent->d_inode->i_sem);
+        *dentry = lookup_one_len(name, parent, strlen(name));
+        if (!IS_ERR(dentry)) {
+                if ((mode & S_IFMT) == S_IFDIR)
+                        error = mkdir(parent->d_inode, *dentry, mode);
+                else
+                        error = create(parent->d_inode, *dentry, mode);
+        } else
+                error = PTR_ERR(dentry);
+        up(&parent->d_inode->i_sem);
+
+        return error;
+}
+
+/**
+ * securityfs_create_file - create a file in the securityfs filesystem
+ *
+ * @name: a pointer to a string containing the name of the file to create.
+ * @mode: the permission that the file should have
+ * @parent: a pointer to the parent dentry for this file.  This should be a
+ *          directory dentry if set.  If this paramater is NULL, then the
+ *          file will be created in the root of the securityfs filesystem.
+ * @data: a pointer to something that the caller will want to get to later
+ *        on.  The inode.u.generic_ip pointer will point to this value on
+ *        the open() call.
+ * @fops: a pointer to a struct file_operations that should be used for
+ *        this file.
+ *
+ * This is the basic "create a file" function for securityfs.  It allows for a
+ * wide range of flexibility in createing a file, or a directory (if you
+ * want to create a directory, the securityfs_create_dir() function is
+ * recommended to be used instead.)
+ *
+ * This function will return a pointer to a dentry if it succeeds.  This
+ * pointer must be passed to the securityfs_remove() function when the file is
+ * to be removed (no automatic cleanup happens if your module is unloaded,
+ * you are responsible here.)  If an error occurs, NULL will be returned.
+ *
+ * If securityfs is not enabled in the kernel, the value -ENODEV will be
+ * returned.  It is not wise to check for this value, but rather, check for
+ * NULL or !NULL instead as to eliminate the need for #ifdef in the calling
+ * code.
+ */
+struct dentry *securityfs_create_file(const char *name, mode_t mode,
+                                   struct dentry *parent, void *data,
+                                   struct file_operations *fops)
+{
+        struct dentry *dentry = NULL;
+        int error;
+
+        pr_debug("securityfs: creating file '%s'\n",name);
+
+        error = simple_pin_fs("securityfs", &mount, &mount_count);
+        if (error) {
+                dentry = ERR_PTR(error);
+                goto exit;
+        }
+
+        error = create_by_name(name, mode, parent, &dentry);
+        if (error) {
+                dentry = ERR_PTR(error);
+                simple_release_fs(&mount, &mount_count);
+                goto exit;
+        }
+
+        if (dentry->d_inode) {
+                if (fops)
+                        dentry->d_inode->i_fop = fops;
+                if (data)
+                        dentry->d_inode->u.generic_ip = data;
+        }
+exit:
+        return dentry;
+}
+EXPORT_SYMBOL_GPL(securityfs_create_file);
+
+/**
+ * securityfs_create_dir - create a directory in the securityfs filesystem
+ *
+ * @name: a pointer to a string containing the name of the directory to
+ *        create.
+ * @parent: a pointer to the parent dentry for this file.  This should be a
+ *          directory dentry if set.  If this paramater is NULL, then the
+ *          directory will be created in the root of the securityfs filesystem.
+ *
+ * This function creates a directory in securityfs with the given name.
+ *
+ * This function will return a pointer to a dentry if it succeeds.  This
+ * pointer must be passed to the securityfs_remove() function when the file is
+ * to be removed (no automatic cleanup happens if your module is unloaded,
+ * you are responsible here.)  If an error occurs, NULL will be returned.
+ *
+ * If securityfs is not enabled in the kernel, the value -ENODEV will be
+ * returned.  It is not wise to check for this value, but rather, check for
+ * NULL or !NULL instead as to eliminate the need for #ifdef in the calling
+ * code.
+ */
+struct dentry *securityfs_create_dir(const char *name, struct dentry *parent)
+{
+        return securityfs_create_file(name,
+                                      S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
+                                      parent, NULL, NULL);
+}
+EXPORT_SYMBOL_GPL(securityfs_create_dir);
+
+/**
+ * securityfs_remove - removes a file or directory from the securityfs filesystem
+ *
+ * @dentry: a pointer to a the dentry of the file or directory to be
+ *          removed.
+ *
+ * This function removes a file or directory in securityfs that was previously
+ * created with a call to another securityfs function (like
+ * securityfs_create_file() or variants thereof.)
+ *
+ * This function is required to be called in order for the file to be
+ * removed, no automatic cleanup of files will happen when a module is
+ * removed, you are responsible here.
+ */
+void securityfs_remove(struct dentry *dentry)
+{
+        struct dentry *parent;
+
+        if (!dentry)
+                return;
+
+        parent = dentry->d_parent;
+        if (!parent || !parent->d_inode)
+                return;
+
+        down(&parent->d_inode->i_sem);
+        if (positive(dentry)) {
+                if (dentry->d_inode) {
+                        if (S_ISDIR(dentry->d_inode->i_mode))
+                                simple_rmdir(parent->d_inode, dentry);
+                        else
+                                simple_unlink(parent->d_inode, dentry);
+                        dput(dentry);
+                }
+        }
+        up(&parent->d_inode->i_sem);
+        simple_release_fs(&mount, &mount_count);
+}
+EXPORT_SYMBOL_GPL(securityfs_remove);
+
+static decl_subsys(security, NULL, NULL);
+
+static int __init securityfs_init(void)
+{
+        int retval;
+
+        kset_set_kset_s(&security_subsys, kernel_subsys);
+        retval = subsystem_register(&security_subsys);
+        if (retval)
+                return retval;
+
+        retval = register_filesystem(&fs_type);
+        if (retval)
+                subsystem_unregister(&security_subsys);
+        return retval;
+}
+
+static void __exit securityfs_exit(void)
+{
+        simple_release_fs(&mount, &mount_count);
+        unregister_filesystem(&fs_type);
+        subsystem_unregister(&security_subsys);
+}
+
+core_initcall(securityfs_init);
+module_exit(securityfs_exit);
+MODULE_LICENSE("GPL");
+
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 46c8602661c9..db99ed434f3a 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -71,26 +71,26 @@ extern void keyring_publish_name(struct key *keyring);
 
 extern int __key_link(struct key *keyring, struct key *key);
 
-extern struct key *__keyring_search_one(struct key *keyring,
-                                        const struct key_type *type,
-                                        const char *description,
-                                        key_perm_t perm);
+extern key_ref_t __keyring_search_one(key_ref_t keyring_ref,
+                                      const struct key_type *type,
+                                      const char *description,
+                                      key_perm_t perm);
 
 extern struct key *keyring_search_instkey(struct key *keyring,
                                           key_serial_t target_id);
 
 typedef int (*key_match_func_t)(const struct key *, const void *);
 
-extern struct key *keyring_search_aux(struct key *keyring,
-                                      struct task_struct *tsk,
-                                      struct key_type *type,
-                                      const void *description,
-                                      key_match_func_t match);
+extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
+                                    struct task_struct *tsk,
+                                    struct key_type *type,
+                                    const void *description,
+                                    key_match_func_t match);
 
-extern struct key *search_process_keyrings(struct key_type *type,
-                                           const void *description,
-                                           key_match_func_t match,
-                                           struct task_struct *tsk);
+extern key_ref_t search_process_keyrings(struct key_type *type,
+                                         const void *description,
+                                         key_match_func_t match,
+                                         struct task_struct *tsk);
 
 extern struct key *find_keyring_by_name(const char *name, key_serial_t bound);
 
diff --git a/security/keys/key.c b/security/keys/key.c
index fb89f9844465..2182be9e9309 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -693,14 +693,15 @@ void key_type_put(struct key_type *ktype)
  * - the key has an incremented refcount
  * - we need to put the key if we get an error
  */
-static inline struct key *__key_update(struct key *key, const void *payload,
-                                       size_t plen)
+static inline key_ref_t __key_update(key_ref_t key_ref,
+                                     const void *payload, size_t plen)
 {
+        struct key *key = key_ref_to_ptr(key_ref);
         int ret;
 
         /* need write permission on the key to update it */
         ret = -EACCES;
-        if (!key_permission(key, KEY_WRITE))
+        if (!key_permission(key_ref, KEY_WRITE))
                 goto error;
 
         ret = -EEXIST;
@@ -719,12 +720,12 @@ static inline struct key *__key_update(struct key *key, const void *payload,
 
         if (ret < 0)
                 goto error;
- out:
-        return key;
+out:
+        return key_ref;
 
- error:
+error:
         key_put(key);
-        key = ERR_PTR(ret);
+        key_ref = ERR_PTR(ret);
         goto out;
 
 } /* end __key_update() */
@@ -734,52 +735,56 @@ static inline struct key *__key_update(struct key *key, const void *payload,
  * search the specified keyring for a key of the same description; if one is
  * found, update it, otherwise add a new one
  */
-struct key *key_create_or_update(struct key *keyring,
-                                 const char *type,
-                                 const char *description,
-                                 const void *payload,
-                                 size_t plen,
-                                 int not_in_quota)
+key_ref_t key_create_or_update(key_ref_t keyring_ref,
+                               const char *type,
+                               const char *description,
+                               const void *payload,
+                               size_t plen,
+                               int not_in_quota)
 {
         struct key_type *ktype;
-        struct key *key = NULL;
+        struct key *keyring, *key = NULL;
         key_perm_t perm;
+        key_ref_t key_ref;
         int ret;
 
-        key_check(keyring);
-
         /* look up the key type to see if it's one of the registered kernel
          * types */
         ktype = key_type_lookup(type);
         if (IS_ERR(ktype)) {
-                key = ERR_PTR(-ENODEV);
+                key_ref = ERR_PTR(-ENODEV);
                 goto error;
         }
 
-        ret = -EINVAL;
+        key_ref = ERR_PTR(-EINVAL);
         if (!ktype->match || !ktype->instantiate)
                 goto error_2;
 
+        keyring = key_ref_to_ptr(keyring_ref);
+
+        key_check(keyring);
+
+        down_write(&keyring->sem);
+
+        /* if we're going to allocate a new key, we're going to have
+         * to modify the keyring */
+        key_ref = ERR_PTR(-EACCES);
+        if (!key_permission(keyring_ref, KEY_WRITE))
+                goto error_3;
+
         /* search for an existing key of the same type and description in the
          * destination keyring
          */
-        down_write(&keyring->sem);
-
-        key = __keyring_search_one(keyring, ktype, description, 0);
-        if (!IS_ERR(key))
+        key_ref = __keyring_search_one(keyring_ref, ktype, description, 0);
+        if (!IS_ERR(key_ref))
                 goto found_matching_key;
 
-        /* if we're going to allocate a new key, we're going to have to modify
-         * the keyring */
-        ret = -EACCES;
-        if (!key_permission(keyring, KEY_WRITE))
-                goto error_3;
-
         /* decide on the permissions we want */
-        perm = KEY_USR_VIEW | KEY_USR_SEARCH | KEY_USR_LINK;
+        perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK;
+        perm |= KEY_USR_VIEW | KEY_USR_SEARCH | KEY_USR_LINK;
 
         if (ktype->read)
-                perm |= KEY_USR_READ;
+                perm |= KEY_POS_READ | KEY_USR_READ;
 
         if (ktype == &key_type_keyring || ktype->update)
                 perm |= KEY_USR_WRITE;
@@ -788,7 +793,7 @@ struct key *key_create_or_update(struct key *keyring,
         key = key_alloc(ktype, description, current->fsuid, current->fsgid,
                         perm, not_in_quota);
         if (IS_ERR(key)) {
-                ret = PTR_ERR(key);
+                key_ref = ERR_PTR(PTR_ERR(key));
                 goto error_3;
         }
 
@@ -796,15 +801,18 @@ struct key *key_create_or_update(struct key *keyring,
         ret = __key_instantiate_and_link(key, payload, plen, keyring, NULL);
         if (ret < 0) {
                 key_put(key);
-                key = ERR_PTR(ret);
+                key_ref = ERR_PTR(ret);
+                goto error_3;
         }
 
+        key_ref = make_key_ref(key, is_key_possessed(keyring_ref));
+
  error_3:
         up_write(&keyring->sem);
  error_2:
         key_type_put(ktype);
  error:
-        return key;
+        return key_ref;
 
  found_matching_key:
         /* we found a matching key, so we're going to try to update it
@@ -813,7 +821,7 @@ struct key *key_create_or_update(struct key *keyring,
         up_write(&keyring->sem);
         key_type_put(ktype);
 
-        key = __key_update(key, payload, plen);
+        key_ref = __key_update(key_ref, payload, plen);
         goto error;
 
 } /* end key_create_or_update() */
@@ -824,15 +832,16 @@ EXPORT_SYMBOL(key_create_or_update);
 /*
  * update a key
  */
-int key_update(struct key *key, const void *payload, size_t plen)
+int key_update(key_ref_t key_ref, const void *payload, size_t plen)
 {
+        struct key *key = key_ref_to_ptr(key_ref);
         int ret;
 
         key_check(key);
 
         /* the key must be writable */
         ret = -EACCES;
-        if (!key_permission(key, KEY_WRITE))
+        if (!key_permission(key_ref, KEY_WRITE))
                 goto error;
 
         /* attempt to update it if supported */
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index a6516a64b297..4c670ee6acf9 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -34,7 +34,7 @@ asmlinkage long sys_add_key(const char __user *_type,
                             size_t plen,
                             key_serial_t ringid)
 {
-        struct key *keyring, *key;
+        key_ref_t keyring_ref, key_ref;
         char type[32], *description;
         void *payload;
         long dlen, ret;
@@ -86,25 +86,25 @@ asmlinkage long sys_add_key(const char __user *_type,
         }
 
         /* find the target keyring (which must be writable) */
-        keyring = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
-        if (IS_ERR(keyring)) {
-                ret = PTR_ERR(keyring);
+        keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
+        if (IS_ERR(keyring_ref)) {
+                ret = PTR_ERR(keyring_ref);
                 goto error3;
         }
 
         /* create or update the requested key and add it to the target
          * keyring */
-        key = key_create_or_update(keyring, type, description,
-                                   payload, plen, 0);
-        if (!IS_ERR(key)) {
-                ret = key->serial;
-                key_put(key);
+        key_ref = key_create_or_update(keyring_ref, type, description,
+                                       payload, plen, 0);
+        if (!IS_ERR(key_ref)) {
+                ret = key_ref_to_ptr(key_ref)->serial;
+                key_ref_put(key_ref);
         }
         else {
-                ret = PTR_ERR(key);
+                ret = PTR_ERR(key_ref);
         }
 
-        key_put(keyring);
+        key_ref_put(keyring_ref);
  error3:
         kfree(payload);
  error2:
@@ -131,7 +131,8 @@ asmlinkage long sys_request_key(const char __user *_type,
                                 key_serial_t destringid)
 {
         struct key_type *ktype;
-        struct key *key, *dest;
+        struct key *key;
+        key_ref_t dest_ref;
         char type[32], *description, *callout_info;
         long dlen, ret;
 
@@ -187,11 +188,11 @@ asmlinkage long sys_request_key(const char __user *_type,
         }
 
         /* get the destination keyring if specified */
-        dest = NULL;
+        dest_ref = NULL;
         if (destringid) {
-                dest = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
-                if (IS_ERR(dest)) {
-                        ret = PTR_ERR(dest);
+                dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
+                if (IS_ERR(dest_ref)) {
+                        ret = PTR_ERR(dest_ref);
                         goto error3;
                 }
         }
@@ -204,7 +205,8 @@ asmlinkage long sys_request_key(const char __user *_type,
         }
 
         /* do the search */
-        key = request_key_and_link(ktype, description, callout_info, dest);
+        key = request_key_and_link(ktype, description, callout_info,
+                                   key_ref_to_ptr(dest_ref));
         if (IS_ERR(key)) {
                 ret = PTR_ERR(key);
                 goto error5;
@@ -216,7 +218,7 @@ asmlinkage long sys_request_key(const char __user *_type,
  error5:
         key_type_put(ktype);
  error4:
-        key_put(dest);
+        key_ref_put(dest_ref);
  error3:
         kfree(callout_info);
  error2:
@@ -234,17 +236,17 @@ asmlinkage long sys_request_key(const char __user *_type,
  */
 long keyctl_get_keyring_ID(key_serial_t id, int create)
 {
-        struct key *key;
+        key_ref_t key_ref;
         long ret;
 
-        key = lookup_user_key(NULL, id, create, 0, KEY_SEARCH);
-        if (IS_ERR(key)) {
-                ret = PTR_ERR(key);
+        key_ref = lookup_user_key(NULL, id, create, 0, KEY_SEARCH);
+        if (IS_ERR(key_ref)) {
+                ret = PTR_ERR(key_ref);
                 goto error;
         }
 
-        ret = key->serial;
-        key_put(key);
+        ret = key_ref_to_ptr(key_ref)->serial;
+        key_ref_put(key_ref);
  error:
         return ret;
 
@@ -302,7 +304,7 @@ long keyctl_update_key(key_serial_t id,
                        const void __user *_payload,
                        size_t plen)
 {
-        struct key *key;
+        key_ref_t key_ref;
         void *payload;
         long ret;
 
@@ -324,16 +326,16 @@ long keyctl_update_key(key_serial_t id,
         }
 
         /* find the target key (which must be writable) */
-        key = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
-        if (IS_ERR(key)) {
-                ret = PTR_ERR(key);
+        key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
+        if (IS_ERR(key_ref)) {
+                ret = PTR_ERR(key_ref);
                 goto error2;
         }
 
         /* update the key */
-        ret = key_update(key, payload, plen);
+        ret = key_update(key_ref, payload, plen);
 
-        key_put(key);
+        key_ref_put(key_ref);
  error2:
         kfree(payload);
  error:
@@ -349,19 +351,19 @@ long keyctl_update_key(key_serial_t id,
  */
 long keyctl_revoke_key(key_serial_t id)
 {
-        struct key *key;
+        key_ref_t key_ref;
         long ret;
 
-        key = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
-        if (IS_ERR(key)) {
-                ret = PTR_ERR(key);
+        key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
+        if (IS_ERR(key_ref)) {
+                ret = PTR_ERR(key_ref);
                 goto error;
         }
 
-        key_revoke(key);
+        key_revoke(key_ref_to_ptr(key_ref));
         ret = 0;
 
-        key_put(key);
+        key_ref_put(key_ref);
  error:
         return ret;
 
@@ -375,18 +377,18 @@ long keyctl_revoke_key(key_serial_t id)
  */
 long keyctl_keyring_clear(key_serial_t ringid)
 {
-        struct key *keyring;
+        key_ref_t keyring_ref;
         long ret;
 
-        keyring = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
-        if (IS_ERR(keyring)) {
-                ret = PTR_ERR(keyring);
+        keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
+        if (IS_ERR(keyring_ref)) {
+                ret = PTR_ERR(keyring_ref);
                 goto error;
         }
 
-        ret = keyring_clear(keyring);
+        ret = keyring_clear(key_ref_to_ptr(keyring_ref));
 
-        key_put(keyring);
+        key_ref_put(keyring_ref);
  error:
         return ret;
 
@@ -401,26 +403,26 @@ long keyctl_keyring_clear(key_serial_t ringid)
  */
 long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
 {
-        struct key *keyring, *key;
+        key_ref_t keyring_ref, key_ref;
         long ret;
 
-        keyring = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
-        if (IS_ERR(keyring)) {
-                ret = PTR_ERR(keyring);
+        keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
+        if (IS_ERR(keyring_ref)) {
+                ret = PTR_ERR(keyring_ref);
                 goto error;
         }
 
-        key = lookup_user_key(NULL, id, 1, 0, KEY_LINK);
-        if (IS_ERR(key)) {
-                ret = PTR_ERR(key);
+        key_ref = lookup_user_key(NULL, id, 1, 0, KEY_LINK);
+        if (IS_ERR(key_ref)) {
+                ret = PTR_ERR(key_ref);
                 goto error2;
         }
 
-        ret = key_link(keyring, key);
+        ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
 
-        key_put(key);
+        key_ref_put(key_ref);
  error2:
-        key_put(keyring);
+        key_ref_put(keyring_ref);
  error:
         return ret;
 
@@ -435,26 +437,26 @@ long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
  */
 long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
 {
-        struct key *keyring, *key;
+        key_ref_t keyring_ref, key_ref;
         long ret;
 
-        keyring = lookup_user_key(NULL, ringid, 0, 0, KEY_WRITE);
-        if (IS_ERR(keyring)) {
-                ret = PTR_ERR(keyring);
+        keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_WRITE);
+        if (IS_ERR(keyring_ref)) {
+                ret = PTR_ERR(keyring_ref);
                 goto error;
         }
 
-        key = lookup_user_key(NULL, id, 0, 0, 0);
-        if (IS_ERR(key)) {
-                ret = PTR_ERR(key);
+        key_ref = lookup_user_key(NULL, id, 0, 0, 0);
+        if (IS_ERR(key_ref)) {
+                ret = PTR_ERR(key_ref);
                 goto error2;
         }
 
-        ret = key_unlink(keyring, key);
+        ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
 
-        key_put(key);
+        key_ref_put(key_ref);
  error2:
-        key_put(keyring);
+        key_ref_put(keyring_ref);
  error:
         return ret;
 
@@ -476,24 +478,26 @@ long keyctl_describe_key(key_serial_t keyid,
                          size_t buflen)
 {
         struct key *key, *instkey;
+        key_ref_t key_ref;
         char *tmpbuf;
         long ret;
 
-        key = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW);
-        if (IS_ERR(key)) {
+        key_ref = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW);
+        if (IS_ERR(key_ref)) {
                 /* viewing a key under construction is permitted if we have the
                  * authorisation token handy */
-                if (PTR_ERR(key) == -EACCES) {
+                if (PTR_ERR(key_ref) == -EACCES) {
                         instkey = key_get_instantiation_authkey(keyid);
                         if (!IS_ERR(instkey)) {
                                 key_put(instkey);
-                                key = lookup_user_key(NULL, keyid, 0, 1, 0);
-                                if (!IS_ERR(key))
+                                key_ref = lookup_user_key(NULL, keyid,
+                                                          0, 1, 0);
+                                if (!IS_ERR(key_ref))
                                         goto okay;
                         }
                 }
 
-                ret = PTR_ERR(key);
+                ret = PTR_ERR(key_ref);
                 goto error;
         }
 
@@ -504,13 +508,16 @@ okay:
         if (!tmpbuf)
                 goto error2;
 
+        key = key_ref_to_ptr(key_ref);
+
         ret = snprintf(tmpbuf, PAGE_SIZE - 1,
-                       "%s;%d;%d;%06x;%s",
-                       key->type->name,
-                       key->uid,
-                       key->gid,
-                       key->perm,
-                       key->description ? key->description :""
+                       "%s;%d;%d;%08x;%s",
+                       key_ref_to_ptr(key_ref)->type->name,
+                       key_ref_to_ptr(key_ref)->uid,
+                       key_ref_to_ptr(key_ref)->gid,
+                       key_ref_to_ptr(key_ref)->perm,
+                       key_ref_to_ptr(key_ref)->description ?
+                       key_ref_to_ptr(key_ref)->description : ""
                        );
 
         /* include a NUL char at the end of the data */
@@ -530,7 +537,7 @@ okay:
 
         kfree(tmpbuf);
  error2:
-        key_put(key);
+        key_ref_put(key_ref);
  error:
         return ret;
 
@@ -552,7 +559,7 @@ long keyctl_keyring_search(key_serial_t ringid,
                            key_serial_t destringid)
 {
         struct key_type *ktype;
-        struct key *keyring, *key, *dest;
+        key_ref_t keyring_ref, key_ref, dest_ref;
         char type[32], *description;
         long dlen, ret;
 
@@ -581,18 +588,18 @@ long keyctl_keyring_search(key_serial_t ringid,
                 goto error2;
 
         /* get the keyring at which to begin the search */
-        keyring = lookup_user_key(NULL, ringid, 0, 0, KEY_SEARCH);
-        if (IS_ERR(keyring)) {
-                ret = PTR_ERR(keyring);
+        keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_SEARCH);
+        if (IS_ERR(keyring_ref)) {
+                ret = PTR_ERR(keyring_ref);
                 goto error2;
         }
 
         /* get the destination keyring if specified */
-        dest = NULL;
+        dest_ref = NULL;
         if (destringid) {
-                dest = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
-                if (IS_ERR(dest)) {
-                        ret = PTR_ERR(dest);
+                dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
+                if (IS_ERR(dest_ref)) {
+                        ret = PTR_ERR(dest_ref);
                         goto error3;
                 }
         }
@@ -605,9 +612,9 @@ long keyctl_keyring_search(key_serial_t ringid,
         }
 
         /* do the search */
-        key = keyring_search(keyring, ktype, description);
-        if (IS_ERR(key)) {
-                ret = PTR_ERR(key);
+        key_ref = keyring_search(keyring_ref, ktype, description);
+        if (IS_ERR(key_ref)) {
+                ret = PTR_ERR(key_ref);
 
                 /* treat lack or presence of a negative key the same */
                 if (ret == -EAGAIN)
@@ -616,26 +623,26 @@ long keyctl_keyring_search(key_serial_t ringid,
         }
 
         /* link the resulting key to the destination keyring if we can */
-        if (dest) {
+        if (dest_ref) {
                 ret = -EACCES;
-                if (!key_permission(key, KEY_LINK))
+                if (!key_permission(key_ref, KEY_LINK))
                         goto error6;
 
-                ret = key_link(dest, key);
+                ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref));
                 if (ret < 0)
                         goto error6;
         }
 
-        ret = key->serial;
+        ret = key_ref_to_ptr(key_ref)->serial;
 
  error6:
-        key_put(key);
+        key_ref_put(key_ref);
  error5:
         key_type_put(ktype);
  error4:
-        key_put(dest);
+        key_ref_put(dest_ref);
  error3:
-        key_put(keyring);
+        key_ref_put(keyring_ref);
  error2:
         kfree(description);
  error:
@@ -645,16 +652,6 @@ long keyctl_keyring_search(key_serial_t ringid,
 
 /*****************************************************************************/
 /*
- * see if the key we're looking at is the target key
- */
-static int keyctl_read_key_same(const struct key *key, const void *target)
-{
-        return key == target;
-
-} /* end keyctl_read_key_same() */
-
-/*****************************************************************************/
-/*
  * read a user key's payload
  * - the keyring must be readable or the key must be searchable from the
  *   process's keyrings
@@ -665,38 +662,33 @@ static int keyctl_read_key_same(const struct key *key, const void *target)
  */
 long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
 {
-        struct key *key, *skey;
+        struct key *key;
+        key_ref_t key_ref;
         long ret;
 
         /* find the key first */
-        key = lookup_user_key(NULL, keyid, 0, 0, 0);
-        if (!IS_ERR(key)) {
-                /* see if we can read it directly */
-                if (key_permission(key, KEY_READ))
-                        goto can_read_key;
-
-                /* we can't; see if it's searchable from this process's
-                 * keyrings
-                 * - we automatically take account of the fact that it may be
-                 *   dangling off an instantiation key
-                 */
-                skey = search_process_keyrings(key->type, key,
-                                               keyctl_read_key_same, current);
-                if (!IS_ERR(skey))
-                        goto can_read_key2;
-
-                ret = PTR_ERR(skey);
-                if (ret == -EAGAIN)
-                        ret = -EACCES;
-                goto error2;
+        key_ref = lookup_user_key(NULL, keyid, 0, 0, 0);
+        if (IS_ERR(key_ref)) {
+                ret = -ENOKEY;
+                goto error;
         }
 
-        ret = -ENOKEY;
-        goto error;
+        key = key_ref_to_ptr(key_ref);
+
+        /* see if we can read it directly */
+        if (key_permission(key_ref, KEY_READ))
+                goto can_read_key;
+
+        /* we can't; see if it's searchable from this process's keyrings
+         * - we automatically take account of the fact that it may be
+         *   dangling off an instantiation key
+         */
+        if (!is_key_possessed(key_ref)) {
+                ret = -EACCES;
+                goto error2;
+        }
 
         /* the key is probably readable - now try to read it */
- can_read_key2:
-        key_put(skey);
  can_read_key:
         ret = key_validate(key);
         if (ret == 0) {
@@ -727,18 +719,21 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
 long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
 {
         struct key *key;
+        key_ref_t key_ref;
         long ret;
 
         ret = 0;
         if (uid == (uid_t) -1 && gid == (gid_t) -1)
                 goto error;
 
-        key = lookup_user_key(NULL, id, 1, 1, 0);
-        if (IS_ERR(key)) {
-                ret = PTR_ERR(key);
+        key_ref = lookup_user_key(NULL, id, 1, 1, 0);
+        if (IS_ERR(key_ref)) {
+                ret = PTR_ERR(key_ref);
                 goto error;
         }
 
+        key = key_ref_to_ptr(key_ref);
+
         /* make the changes with the locks held to prevent chown/chown races */
         ret = -EACCES;
         down_write(&key->sem);
@@ -784,18 +779,21 @@ long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
 long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
 {
         struct key *key;
+        key_ref_t key_ref;
         long ret;
 
         ret = -EINVAL;
-        if (perm & ~(KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
+        if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
                 goto error;
 
-        key = lookup_user_key(NULL, id, 1, 1, 0);
-        if (IS_ERR(key)) {
-                ret = PTR_ERR(key);
+        key_ref = lookup_user_key(NULL, id, 1, 1, 0);
+        if (IS_ERR(key_ref)) {
+                ret = PTR_ERR(key_ref);
                 goto error;
         }
 
+        key = key_ref_to_ptr(key_ref);
+
         /* make the changes with the locks held to prevent chown/chmod races */
         ret = -EACCES;
         down_write(&key->sem);
@@ -824,7 +822,8 @@ long keyctl_instantiate_key(key_serial_t id,
                             key_serial_t ringid)
 {
         struct request_key_auth *rka;
-        struct key *instkey, *keyring;
+        struct key *instkey;
+        key_ref_t keyring_ref;
         void *payload;
         long ret;
 
@@ -857,21 +856,21 @@ long keyctl_instantiate_key(key_serial_t id,
 
         /* find the destination keyring amongst those belonging to the
          * requesting task */
-        keyring = NULL;
+        keyring_ref = NULL;
         if (ringid) {
-                keyring = lookup_user_key(rka->context, ringid, 1, 0,
-                                          KEY_WRITE);
-                if (IS_ERR(keyring)) {
-                        ret = PTR_ERR(keyring);
+                keyring_ref = lookup_user_key(rka->context, ringid, 1, 0,
+                                              KEY_WRITE);
+                if (IS_ERR(keyring_ref)) {
+                        ret = PTR_ERR(keyring_ref);
                         goto error3;
                 }
         }
 
         /* instantiate the key and link it into a keyring */
         ret = key_instantiate_and_link(rka->target_key, payload, plen,
-                                       keyring, instkey);
+                                       key_ref_to_ptr(keyring_ref), instkey);
 
-        key_put(keyring);
+        key_ref_put(keyring_ref);
  error3:
         key_put(instkey);
  error2:
@@ -889,7 +888,8 @@ long keyctl_instantiate_key(key_serial_t id,
 long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
 {
         struct request_key_auth *rka;
-        struct key *instkey, *keyring;
+        struct key *instkey;
+        key_ref_t keyring_ref;
         long ret;
 
         /* find the instantiation authorisation key */
@@ -903,19 +903,20 @@ long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
 
         /* find the destination keyring if present (which must also be
          * writable) */
-        keyring = NULL;
+        keyring_ref = NULL;
         if (ringid) {
-                keyring = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
-                if (IS_ERR(keyring)) {
-                        ret = PTR_ERR(keyring);
+                keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
+                if (IS_ERR(keyring_ref)) {
+                        ret = PTR_ERR(keyring_ref);
                         goto error2;
                 }
         }
 
         /* instantiate the key and link it into a keyring */
-        ret = key_negate_and_link(rka->target_key, timeout, keyring, instkey);
+        ret = key_negate_and_link(rka->target_key, timeout,
+                                  key_ref_to_ptr(keyring_ref), instkey);
 
-        key_put(keyring);
+        key_ref_put(keyring_ref);
  error2:
         key_put(instkey);
  error:
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 9c208c756df8..0639396dd441 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -309,7 +309,7 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
         int ret;
 
         keyring = key_alloc(&key_type_keyring, description,
-                            uid, gid, KEY_USR_ALL, not_in_quota);
+                            uid, gid, KEY_POS_ALL | KEY_USR_ALL, not_in_quota);
 
         if (!IS_ERR(keyring)) {
                 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
@@ -333,12 +333,13 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
  * - we rely on RCU to prevent the keyring lists from disappearing on us
  * - we return -EAGAIN if we didn't find any matching key
  * - we return -ENOKEY if we only found negative matching keys
+ * - we propagate the possession attribute from the keyring ref to the key ref
  */
-struct key *keyring_search_aux(struct key *keyring,
-                               struct task_struct *context,
-                               struct key_type *type,
-                               const void *description,
-                               key_match_func_t match)
+key_ref_t keyring_search_aux(key_ref_t keyring_ref,
+                             struct task_struct *context,
+                             struct key_type *type,
+                             const void *description,
+                             key_match_func_t match)
 {
         struct {
                 struct keyring_list *keylist;
@@ -347,29 +348,33 @@ struct key *keyring_search_aux(struct key *keyring,
 
         struct keyring_list *keylist;
         struct timespec now;
-        struct key *key;
+        unsigned long possessed;
+        struct key *keyring, *key;
+        key_ref_t key_ref;
         long err;
         int sp, kix;
 
+        keyring = key_ref_to_ptr(keyring_ref);
+        possessed = is_key_possessed(keyring_ref);
         key_check(keyring);
 
-        rcu_read_lock();
-
         /* top keyring must have search permission to begin the search */
-        key = ERR_PTR(-EACCES);
-        if (!key_task_permission(keyring, context, KEY_SEARCH))
+        key_ref = ERR_PTR(-EACCES);
+        if (!key_task_permission(keyring_ref, context, KEY_SEARCH))
                 goto error;
 
-        key = ERR_PTR(-ENOTDIR);
+        key_ref = ERR_PTR(-ENOTDIR);
         if (keyring->type != &key_type_keyring)
                 goto error;
 
+        rcu_read_lock();
+
         now = current_kernel_time();
         err = -EAGAIN;
         sp = 0;
 
         /* start processing a new keyring */
- descend:
+descend:
         if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
                 goto not_this_keyring;
 
@@ -397,7 +402,8 @@ struct key *keyring_search_aux(struct key *keyring,
                         continue;
 
                 /* key must have search permissions */
-                if (!key_task_permission(key, context, KEY_SEARCH))
+                if (!key_task_permission(make_key_ref(key, possessed),
+                                         context, KEY_SEARCH))
                         continue;
 
                 /* we set a different error code if we find a negative key */
@@ -411,7 +417,7 @@ struct key *keyring_search_aux(struct key *keyring,
 
         /* search through the keyrings nested in this one */
         kix = 0;
- ascend:
+ascend:
         for (; kix < keylist->nkeys; kix++) {
                 key = keylist->keys[kix];
                 if (key->type != &key_type_keyring)
@@ -423,7 +429,8 @@ struct key *keyring_search_aux(struct key *keyring,
                 if (sp >= KEYRING_SEARCH_MAX_DEPTH)
                         continue;
 
-                if (!key_task_permission(key, context, KEY_SEARCH))
+                if (!key_task_permission(make_key_ref(key, possessed),
+                                         context, KEY_SEARCH))
                         continue;
 
                 /* stack the current position */
@@ -438,7 +445,7 @@ struct key *keyring_search_aux(struct key *keyring,
 
         /* the keyring we're looking at was disqualified or didn't contain a
          * matching key */
- not_this_keyring:
+not_this_keyring:
         if (sp > 0) {
                 /* resume the processing of a keyring higher up in the tree */
                 sp--;
@@ -447,16 +454,18 @@ struct key *keyring_search_aux(struct key *keyring,
                 goto ascend;
         }
 
-        key = ERR_PTR(err);
-        goto error;
+        key_ref = ERR_PTR(err);
+        goto error_2;
 
         /* we found a viable match */
- found:
+found:
         atomic_inc(&key->usage);
         key_check(key);
- error:
+        key_ref = make_key_ref(key, possessed);
+error_2:
         rcu_read_unlock();
-        return key;
+error:
+        return key_ref;
 
 } /* end keyring_search_aux() */
 
@@ -469,9 +478,9 @@ struct key *keyring_search_aux(struct key *keyring,
  * - we return -EAGAIN if we didn't find any matching key
  * - we return -ENOKEY if we only found negative matching keys
  */
-struct key *keyring_search(struct key *keyring,
-                           struct key_type *type,
-                           const char *description)
+key_ref_t keyring_search(key_ref_t keyring,
+                         struct key_type *type,
+                         const char *description)
 {
         if (!type->match)
                 return ERR_PTR(-ENOKEY);
@@ -488,15 +497,19 @@ EXPORT_SYMBOL(keyring_search);
  * search the given keyring only (no recursion)
  * - keyring must be locked by caller
  */
-struct key *__keyring_search_one(struct key *keyring,
-                                 const struct key_type *ktype,
-                                 const char *description,
-                                 key_perm_t perm)
+key_ref_t __keyring_search_one(key_ref_t keyring_ref,
+                               const struct key_type *ktype,
+                               const char *description,
+                               key_perm_t perm)
 {
         struct keyring_list *klist;
-        struct key *key;
+        unsigned long possessed;
+        struct key *keyring, *key;
         int loop;
 
+        keyring = key_ref_to_ptr(keyring_ref);
+        possessed = is_key_possessed(keyring_ref);
+
         rcu_read_lock();
 
         klist = rcu_dereference(keyring->payload.subscriptions);
@@ -507,21 +520,21 @@ struct key *__keyring_search_one(struct key *keyring,
                         if (key->type == ktype &&
                             (!key->type->match ||
                              key->type->match(key, description)) &&
-                            key_permission(key, perm) &&
+                            key_permission(make_key_ref(key, possessed),
+                                           perm) &&
                             !test_bit(KEY_FLAG_REVOKED, &key->flags)
                             )
                                 goto found;
                 }
         }
 
-        key = ERR_PTR(-ENOKEY);
-        goto error;
+        rcu_read_unlock();
+        return ERR_PTR(-ENOKEY);
 
  found:
         atomic_inc(&key->usage);
- error:
         rcu_read_unlock();
-        return key;
+        return make_key_ref(key, possessed);
 
 } /* end __keyring_search_one() */
 
@@ -603,7 +616,8 @@ struct key *find_keyring_by_name(const char *name, key_serial_t bound)
                         if (strcmp(keyring->description, name) != 0)
                                 continue;
 
-                        if (!key_permission(keyring, KEY_SEARCH))
+                        if (!key_permission(make_key_ref(keyring, 0),
+                                            KEY_SEARCH))
                                 continue;
 
                         /* found a potential candidate, but we still need to
diff --git a/security/keys/proc.c b/security/keys/proc.c
index c55cf1fd0826..12b750e51fbf 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -167,7 +167,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
 #define showflag(KEY, LETTER, FLAG) \
         (test_bit(FLAG, &(KEY)->flags) ? LETTER : '-')
 
-        seq_printf(m, "%08x %c%c%c%c%c%c %5d %4s %06x %5d %5d %-9.9s ",
+        seq_printf(m, "%08x %c%c%c%c%c%c %5d %4s %08x %5d %5d %-9.9s ",
                    key->serial,
                    showflag(key, 'I', KEY_FLAG_INSTANTIATED),
                    showflag(key, 'R', KEY_FLAG_REVOKED),
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index c089f78fb94e..d42d2158ce13 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -39,7 +39,7 @@ struct key root_user_keyring = {
         .type           = &key_type_keyring,
         .user           = &root_key_user,
         .sem            = __RWSEM_INITIALIZER(root_user_keyring.sem),
-        .perm           = KEY_USR_ALL,
+        .perm           = KEY_POS_ALL | KEY_USR_ALL,
         .flags          = 1 << KEY_FLAG_INSTANTIATED,
         .description    = "_uid.0",
 #ifdef KEY_DEBUGGING
@@ -54,7 +54,7 @@ struct key root_session_keyring = {
         .type           = &key_type_keyring,
         .user           = &root_key_user,
         .sem            = __RWSEM_INITIALIZER(root_session_keyring.sem),
-        .perm           = KEY_USR_ALL,
+        .perm           = KEY_POS_ALL | KEY_USR_ALL,
         .flags          = 1 << KEY_FLAG_INSTANTIATED,
         .description    = "_uid_ses.0",
 #ifdef KEY_DEBUGGING
@@ -98,7 +98,7 @@ int alloc_uid_keyring(struct user_struct *user)
         user->session_keyring = session_keyring;
         ret = 0;
 
- error:
+error:
         return ret;
 
 } /* end alloc_uid_keyring() */
@@ -156,7 +156,7 @@ int install_thread_keyring(struct task_struct *tsk)
         ret = 0;
 
         key_put(old);
- error:
+error:
         return ret;
 
 } /* end install_thread_keyring() */
@@ -193,7 +193,7 @@ int install_process_keyring(struct task_struct *tsk)
         }
 
         ret = 0;
- error:
+error:
         return ret;
 
 } /* end install_process_keyring() */
@@ -236,7 +236,7 @@ static int install_session_keyring(struct task_struct *tsk,
         /* we're using RCU on the pointer */
         synchronize_rcu();
         key_put(old);
- error:
+error:
         return ret;
 
 } /* end install_session_keyring() */
@@ -376,13 +376,13 @@ void key_fsgid_changed(struct task_struct *tsk)
  * - we return -EAGAIN if we didn't find any matching key
  * - we return -ENOKEY if we found only negative matching keys
  */
-struct key *search_process_keyrings(struct key_type *type,
-                                    const void *description,
-                                    key_match_func_t match,
-                                    struct task_struct *context)
+key_ref_t search_process_keyrings(struct key_type *type,
+                                  const void *description,
+                                  key_match_func_t match,
+                                  struct task_struct *context)
 {
         struct request_key_auth *rka;
-        struct key *key, *ret, *err, *instkey;
+        key_ref_t key_ref, ret, err, instkey_ref;
 
         /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
          * searchable, but we failed to find a key or we found a negative key;
@@ -391,46 +391,48 @@ struct key *search_process_keyrings(struct key_type *type,
          *
          * in terms of priority: success > -ENOKEY > -EAGAIN > other error
          */
-        key = NULL;
+        key_ref = NULL;
         ret = NULL;
         err = ERR_PTR(-EAGAIN);
 
         /* search the thread keyring first */
         if (context->thread_keyring) {
-                key = keyring_search_aux(context->thread_keyring,
-                                         context, type, description, match);
-                if (!IS_ERR(key))
+                key_ref = keyring_search_aux(
+                        make_key_ref(context->thread_keyring, 1),
+                        context, type, description, match);
+                if (!IS_ERR(key_ref))
                         goto found;
 
-                switch (PTR_ERR(key)) {
+                switch (PTR_ERR(key_ref)) {
                 case -EAGAIN: /* no key */
                         if (ret)
                                 break;
                 case -ENOKEY: /* negative key */
-                        ret = key;
+                        ret = key_ref;
                         break;
                 default:
-                        err = key;
+                        err = key_ref;
                         break;
                 }
         }
 
         /* search the process keyring second */
         if (context->signal->process_keyring) {
-                key = keyring_search_aux(context->signal->process_keyring,
-                                         context, type, description, match);
-                if (!IS_ERR(key))
+                key_ref = keyring_search_aux(
+                        make_key_ref(context->signal->process_keyring, 1),
+                        context, type, description, match);
+                if (!IS_ERR(key_ref))
                         goto found;
 
-                switch (PTR_ERR(key)) {
+                switch (PTR_ERR(key_ref)) {
                 case -EAGAIN: /* no key */
                         if (ret)
                                 break;
                 case -ENOKEY: /* negative key */
-                        ret = key;
+                        ret = key_ref;
                         break;
                 default:
-                        err = key;
+                        err = key_ref;
                         break;
                 }
         }
@@ -438,23 +440,25 @@ struct key *search_process_keyrings(struct key_type *type,
         /* search the session keyring */
         if (context->signal->session_keyring) {
                 rcu_read_lock();
-                key = keyring_search_aux(
-                        rcu_dereference(context->signal->session_keyring),
+                key_ref = keyring_search_aux(
+                        make_key_ref(rcu_dereference(
+                                             context->signal->session_keyring),
+                                     1),
                         context, type, description, match);
                 rcu_read_unlock();
 
-                if (!IS_ERR(key))
+                if (!IS_ERR(key_ref))
                         goto found;
 
-                switch (PTR_ERR(key)) {
+                switch (PTR_ERR(key_ref)) {
                 case -EAGAIN: /* no key */
                         if (ret)
                                 break;
                 case -ENOKEY: /* negative key */
-                        ret = key;
+                        ret = key_ref;
                         break;
                 default:
-                        err = key;
+                        err = key_ref;
                         break;
                 }
 
@@ -465,51 +469,54 @@ struct key *search_process_keyrings(struct key_type *type,
                         goto no_key;
 
                 rcu_read_lock();
-                instkey = __keyring_search_one(
-                        rcu_dereference(context->signal->session_keyring),
+                instkey_ref = __keyring_search_one(
+                        make_key_ref(rcu_dereference(
+                                             context->signal->session_keyring),
+                                     1),
                         &key_type_request_key_auth, NULL, 0);
                 rcu_read_unlock();
 
-                if (IS_ERR(instkey))
+                if (IS_ERR(instkey_ref))
                         goto no_key;
 
-                rka = instkey->payload.data;
+                rka = key_ref_to_ptr(instkey_ref)->payload.data;
 
-                key = search_process_keyrings(type, description, match,
-                                              rka->context);
-                key_put(instkey);
+                key_ref = search_process_keyrings(type, description, match,
+                                                  rka->context);
+                key_ref_put(instkey_ref);
 
-                if (!IS_ERR(key))
+                if (!IS_ERR(key_ref))
                         goto found;
 
-                switch (PTR_ERR(key)) {
+                switch (PTR_ERR(key_ref)) {
                 case -EAGAIN: /* no key */
                         if (ret)
                                 break;
                 case -ENOKEY: /* negative key */
-                        ret = key;
+                        ret = key_ref;
                         break;
                 default:
-                        err = key;
+                        err = key_ref;
                         break;
                 }
         }
         /* or search the user-session keyring */
         else {
-                key = keyring_search_aux(context->user->session_keyring,
-                                         context, type, description, match);
-                if (!IS_ERR(key))
+                key_ref = keyring_search_aux(
+                        make_key_ref(context->user->session_keyring, 1),
+                        context, type, description, match);
+                if (!IS_ERR(key_ref))
                         goto found;
 
-                switch (PTR_ERR(key)) {
+                switch (PTR_ERR(key_ref)) {
                 case -EAGAIN: /* no key */
                         if (ret)
                                 break;
                 case -ENOKEY: /* negative key */
-                        ret = key;
+                        ret = key_ref;
                         break;
                 default:
-                        err = key;
+                        err = key_ref;
                         break;
                 }
         }
@@ -517,29 +524,40 @@ struct key *search_process_keyrings(struct key_type *type,
 
 no_key:
         /* no key - decide on the error we're going to go for */
-        key = ret ? ret : err;
+        key_ref = ret ? ret : err;
 
 found:
-        return key;
+        return key_ref;
 
 } /* end search_process_keyrings() */
 
 /*****************************************************************************/
 /*
+ * see if the key we're looking at is the target key
+ */
+static int lookup_user_key_possessed(const struct key *key, const void *target)
+{
+        return key == target;
+
+} /* end lookup_user_key_possessed() */
+
+/*****************************************************************************/
+/*
  * lookup a key given a key ID from userspace with a given permissions mask
  * - don't create special keyrings unless so requested
  * - partially constructed keys aren't found unless requested
  */
-struct key *lookup_user_key(struct task_struct *context, key_serial_t id,
-                            int create, int partial, key_perm_t perm)
+key_ref_t lookup_user_key(struct task_struct *context, key_serial_t id,
+                          int create, int partial, key_perm_t perm)
 {
+        key_ref_t key_ref, skey_ref;
         struct key *key;
         int ret;
 
         if (!context)
                 context = current;
 
-        key = ERR_PTR(-ENOKEY);
+        key_ref = ERR_PTR(-ENOKEY);
 
         switch (id) {
         case KEY_SPEC_THREAD_KEYRING:
@@ -556,6 +574,7 @@ struct key *lookup_user_key(struct task_struct *context, key_serial_t id,
 
                 key = context->thread_keyring;
                 atomic_inc(&key->usage);
+                key_ref = make_key_ref(key, 1);
                 break;
 
         case KEY_SPEC_PROCESS_KEYRING:
@@ -572,6 +591,7 @@ struct key *lookup_user_key(struct task_struct *context, key_serial_t id,
 
                 key = context->signal->process_keyring;
                 atomic_inc(&key->usage);
+                key_ref = make_key_ref(key, 1);
                 break;
 
         case KEY_SPEC_SESSION_KEYRING:
@@ -579,7 +599,7 @@ struct key *lookup_user_key(struct task_struct *context, key_serial_t id,
                         /* always install a session keyring upon access if one
                          * doesn't exist yet */
                         ret = install_session_keyring(
-                               context, context->user->session_keyring);
+                                context, context->user->session_keyring);
                         if (ret < 0)
                                 goto error;
                 }
@@ -588,16 +608,19 @@ struct key *lookup_user_key(struct task_struct *context, key_serial_t id,
                 key = rcu_dereference(context->signal->session_keyring);
                 atomic_inc(&key->usage);
                 rcu_read_unlock();
+                key_ref = make_key_ref(key, 1);
                 break;
 
         case KEY_SPEC_USER_KEYRING:
                 key = context->user->uid_keyring;
                 atomic_inc(&key->usage);
+                key_ref = make_key_ref(key, 1);
                 break;
 
         case KEY_SPEC_USER_SESSION_KEYRING:
                 key = context->user->session_keyring;
                 atomic_inc(&key->usage);
+                key_ref = make_key_ref(key, 1);
                 break;
 
         case KEY_SPEC_GROUP_KEYRING:
@@ -606,13 +629,28 @@ struct key *lookup_user_key(struct task_struct *context, key_serial_t id,
                 goto error;
 
         default:
-                key = ERR_PTR(-EINVAL);
+                key_ref = ERR_PTR(-EINVAL);
                 if (id < 1)
                         goto error;
 
                 key = key_lookup(id);
-                if (IS_ERR(key))
+                if (IS_ERR(key)) {
+                        key_ref = ERR_PTR(PTR_ERR(key));
                         goto error;
+                }
+
+                key_ref = make_key_ref(key, 0);
+
+                /* check to see if we possess the key */
+                skey_ref = search_process_keyrings(key->type, key,
+                                                   lookup_user_key_possessed,
+                                                   current);
+
+                if (!IS_ERR(skey_ref)) {
+                        key_put(key);
+                        key_ref = skey_ref;
+                }
+
                 break;
         }
 
@@ -630,15 +668,15 @@ struct key *lookup_user_key(struct task_struct *context, key_serial_t id,
         /* check the permissions */
         ret = -EACCES;
 
-        if (!key_task_permission(key, context, perm))
+        if (!key_task_permission(key_ref, context, perm))
                 goto invalid_key;
 
- error:
-        return key;
+error:
+        return key_ref;
 
- invalid_key:
-        key_put(key);
-        key = ERR_PTR(ret);
+invalid_key:
+        key_ref_put(key_ref);
+        key_ref = ERR_PTR(ret);
         goto error;
 
 } /* end lookup_user_key() */
@@ -694,9 +732,9 @@ long join_session_keyring(const char *name)
         ret = keyring->serial;
         key_put(keyring);
 
- error2:
+error2:
         up(&key_session_sem);
- error:
+error:
         return ret;
 
 } /* end join_session_keyring() */
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 90c1506d007c..e6dd366d43a3 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -129,7 +129,7 @@ static struct key *__request_key_construction(struct key_type *type,
 
         /* create a key and add it to the queue */
         key = key_alloc(type, description,
-                        current->fsuid, current->fsgid, KEY_USR_ALL, 0);
+                        current->fsuid, current->fsgid, KEY_POS_ALL, 0);
         if (IS_ERR(key))
                 goto alloc_failed;
 
@@ -365,14 +365,24 @@ struct key *request_key_and_link(struct key_type *type,
 {
         struct key_user *user;
         struct key *key;
+        key_ref_t key_ref;
 
         kenter("%s,%s,%s,%p",
                type->name, description, callout_info, dest_keyring);
 
         /* search all the process keyrings for a key */
-        key = search_process_keyrings(type, description, type->match, current);
+        key_ref = search_process_keyrings(type, description, type->match,
+                                          current);
 
-        if (PTR_ERR(key) == -EAGAIN) {
+        kdebug("search 1: %p", key_ref);
+
+        if (!IS_ERR(key_ref)) {
+                key = key_ref_to_ptr(key_ref);
+        }
+        else if (PTR_ERR(key_ref) != -EAGAIN) {
+                key = ERR_PTR(PTR_ERR(key_ref));
+        }
+        else  {
                 /* the search failed, but the keyrings were searchable, so we
                  * should consult userspace if we can */
                 key = ERR_PTR(-ENOKEY);
@@ -384,7 +394,7 @@ struct key *request_key_and_link(struct key_type *type,
                 if (!user)
                         goto nomem;
 
-                do {
+                for (;;) {
                         if (signal_pending(current))
                                 goto interrupted;
 
@@ -397,10 +407,22 @@ struct key *request_key_and_link(struct key_type *type,
 
                         /* someone else made the key we want, so we need to
                          * search again as it might now be available to us */
-                        key = search_process_keyrings(type, description,
-                                                      type->match, current);
+                        key_ref = search_process_keyrings(type, description,
+                                                          type->match,
+                                                          current);
+
+                        kdebug("search 2: %p", key_ref);
 
-                } while (PTR_ERR(key) == -EAGAIN);
+                        if (!IS_ERR(key_ref)) {
+                                key = key_ref_to_ptr(key_ref);
+                                break;
+                        }
+
+                        if (PTR_ERR(key_ref) != -EAGAIN) {
+                                key = ERR_PTR(PTR_ERR(key_ref));
+                                break;
+                        }
+                }
 
                 key_user_put(user);
 
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index f22264632229..1ecd3d3fa9f8 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -126,7 +126,7 @@ struct key *request_key_auth_new(struct key *target, struct key **_rkakey)
 
         rkakey = key_alloc(&key_type_request_key_auth, desc,
                            current->fsuid, current->fsgid,
-                           KEY_USR_VIEW, 1);
+                           KEY_POS_VIEW | KEY_USR_VIEW, 1);
         if (IS_ERR(rkakey)) {
                 key_put(keyring);
                 kleave("= %ld", PTR_ERR(rkakey));
diff --git a/security/seclvl.c b/security/seclvl.c
index 96b1f2122f67..1caac0164643 100644
--- a/security/seclvl.c
+++ b/security/seclvl.c
@@ -119,69 +119,6 @@ MODULE_PARM_DESC(hideHash, "When set to 0, reading seclvl/passwd from sysfs "
         } while (0)
 
 /**
- * kobject stuff
- */
-
-struct subsystem seclvl_subsys;
-
-struct seclvl_obj {
-        char *name;
-        struct list_head slot_list;
-        struct kobject kobj;
-};
-
-/**
- * There is a seclvl_attribute struct for each file in sysfs.
- *
- * In our case, we have one of these structs for "passwd" and another
- * for "seclvl".
- */
-struct seclvl_attribute {
-        struct attribute attr;
-        ssize_t(*show) (struct seclvl_obj *, char *);
-        ssize_t(*store) (struct seclvl_obj *, const char *, size_t);
-};
-
-/**
- * When this function is called, one of the files in sysfs is being
- * written to.  attribute->store is a function pointer to whatever the
- * struct seclvl_attribute store function pointer points to.  It is
- * unique for "passwd" and "seclvl".
- */
-static ssize_t
-seclvl_attr_store(struct kobject *kobj,
-                  struct attribute *attr, const char *buf, size_t len)
-{
-        struct seclvl_obj *obj = container_of(kobj, struct seclvl_obj, kobj);
-        struct seclvl_attribute *attribute =
-            container_of(attr, struct seclvl_attribute, attr);
-        return attribute->store ? attribute->store(obj, buf, len) : -EIO;
-}
-
-static ssize_t
-seclvl_attr_show(struct kobject *kobj, struct attribute *attr, char *buf)
-{
-        struct seclvl_obj *obj = container_of(kobj, struct seclvl_obj, kobj);
-        struct seclvl_attribute *attribute =
-            container_of(attr, struct seclvl_attribute, attr);
-        return attribute->show ? attribute->show(obj, buf) : -EIO;
-}
-
-/**
- * Callback function pointers for show and store
- */
-static struct sysfs_ops seclvlfs_sysfs_ops = {
-        .show = seclvl_attr_show,
-        .store = seclvl_attr_store,
-};
-
-static struct kobj_type seclvl_ktype = {
-        .sysfs_ops = &seclvlfs_sysfs_ops
-};
-
-decl_subsys(seclvl, &seclvl_ktype, NULL);
-
-/**
  * The actual security level.  Ranges between -1 and 2 inclusive.
  */
 static int seclvl;
@@ -213,97 +150,44 @@ static int seclvl_sanity(int reqlvl)
 }
 
 /**
- * Called whenever the user reads the sysfs handle to this kernel
- * object
- */
-static ssize_t seclvl_read_file(struct seclvl_obj *obj, char *buff)
-{
-        return snprintf(buff, PAGE_SIZE, "%d\n", seclvl);
-}
-
-/**
  * security level advancement rules:
  *   Valid levels are -1 through 2, inclusive.
  *   From -1, stuck.  [ in case compiled into kernel ]
  *   From 0 or above, can only increment.
  */
-static int do_seclvl_advance(int newlvl)
+static void do_seclvl_advance(void *data, u64 val)
 {
-        if (newlvl <= seclvl) {
-                seclvl_printk(1, KERN_WARNING, "Cannot advance to seclvl "
-                              "[%d]\n", newlvl);
-                return -EINVAL;
-        }
+        int ret;
+        int newlvl = (int)val;
+
+        ret = seclvl_sanity(newlvl);
+        if (ret)
+                return;
+
         if (newlvl > 2) {
                 seclvl_printk(1, KERN_WARNING, "Cannot advance to seclvl "
                               "[%d]\n", newlvl);
-                return -EINVAL;
+                return;
         }
         if (seclvl == -1) {
                 seclvl_printk(1, KERN_WARNING, "Not allowed to advance to "
                               "seclvl [%d]\n", seclvl);
-                return -EPERM;
+                return;
         }
-        seclvl = newlvl;
-        return 0;
+        seclvl = newlvl;  /* would it be more "correct" to set *data? */
+        return;
 }
 
-/**
- * Called whenever the user writes to the sysfs handle to this kernel
- * object (seclvl/seclvl).  It expects a single-digit number.
- */
-static ssize_t
-seclvl_write_file(struct seclvl_obj *obj, const char *buff, size_t count)
+static u64 seclvl_int_get(void *data)
 {
-        unsigned long val;
-        if (count > 2 || (count == 2 && buff[1] != '\n')) {
-                seclvl_printk(1, KERN_WARNING, "Invalid value passed to "
-                              "seclvl: [%s]\n", buff);
-                return -EINVAL;
-        }
-        val = buff[0] - 48;
-        if (seclvl_sanity(val)) {
-                seclvl_printk(1, KERN_WARNING, "Illegal secure level "
-                              "requested: [%d]\n", (int)val);
-                return -EPERM;
-        }
-        if (do_seclvl_advance(val)) {
-                seclvl_printk(0, KERN_ERR, "Failure advancing security level "
-                              "to %lu\n", val);
-        }
-        return count;
+        return *(int *)data;
 }
 
-/* Generate sysfs_attr_seclvl */
-static struct seclvl_attribute sysfs_attr_seclvl =
-__ATTR(seclvl, (S_IFREG | S_IRUGO | S_IWUSR), seclvl_read_file,
-       seclvl_write_file);
+DEFINE_SIMPLE_ATTRIBUTE(seclvl_file_ops, seclvl_int_get, do_seclvl_advance, "%lld\n");
 
 static unsigned char hashedPassword[SHA1_DIGEST_SIZE];
 
 /**
- * Called whenever the user reads the sysfs passwd handle.
- */
-static ssize_t seclvl_read_passwd(struct seclvl_obj *obj, char *buff)
-{
-        /* So just how good *is* your password? :-) */
-        char tmp[3];
-        int i = 0;
-        buff[0] = '\0';
-        if (hideHash) {
-                /* Security through obscurity */
-                return 0;
-        }
-        while (i < SHA1_DIGEST_SIZE) {
-                snprintf(tmp, 3, "%02x", hashedPassword[i]);
-                strncat(buff, tmp, 2);
-                i++;
-        }
-        strcat(buff, "\n");
-        return ((SHA1_DIGEST_SIZE * 2) + 1);
-}
-
-/**
  * Converts a block of plaintext of into its SHA1 hashed value.
  *
  * It would be nice if crypto had a wrapper to do this for us linear
@@ -347,12 +231,15 @@ plaintext_to_sha1(unsigned char *hash, const char *plaintext, int len)
  * object.  It hashes the password and compares the hashed results.
  */
 static ssize_t
-seclvl_write_passwd(struct seclvl_obj *obj, const char *buff, size_t count)
+passwd_write_file(struct file * file, const char __user * buf,
+                                size_t count, loff_t *ppos)
 {
         int i;
         unsigned char tmp[SHA1_DIGEST_SIZE];
+        char *page;
         int rc;
         int len;
+
         if (!*passwd && !*sha1_passwd) {
                 seclvl_printk(0, KERN_ERR, "Attempt to password-unlock the "
                               "seclvl module, but neither a plain text "
@@ -363,32 +250,45 @@ seclvl_write_passwd(struct seclvl_obj *obj, const char *buff, size_t count)
                               "maintainer about this event.\n");
                 return -EINVAL;
         }
-        len = strlen(buff);
+
+        if (count < 0 || count >= PAGE_SIZE)
+                return -EINVAL;
+        if (*ppos != 0)
+                return -EINVAL;
+        page = (char *)get_zeroed_page(GFP_KERNEL);
+        if (!page)
+                return -ENOMEM;
+        len = -EFAULT;
+        if (copy_from_user(page, buf, count))
+                goto out;
+        
+        len = strlen(page);
         /* ``echo "secret" > seclvl/passwd'' includes a newline */
-        if (buff[len - 1] == '\n') {
+        if (page[len - 1] == '\n')
                 len--;
-        }
         /* Hash the password, then compare the hashed values */
-        if ((rc = plaintext_to_sha1(tmp, buff, len))) {
+        if ((rc = plaintext_to_sha1(tmp, page, len))) {
                 seclvl_printk(0, KERN_ERR, "Error hashing password: rc = "
                               "[%d]\n", rc);
                 return rc;
         }
         for (i = 0; i < SHA1_DIGEST_SIZE; i++) {
-                if (hashedPassword[i] != tmp[i]) {
+                if (hashedPassword[i] != tmp[i])
                         return -EPERM;
-                }
         }
         seclvl_printk(0, KERN_INFO,
                       "Password accepted; seclvl reduced to 0.\n");
         seclvl = 0;
-        return count;
+        len = count;
+
+out:
+        free_page((unsigned long)page);
+        return len;
 }
 
-/* Generate sysfs_attr_passwd */
-static struct seclvl_attribute sysfs_attr_passwd =
-__ATTR(passwd, (S_IFREG | S_IRUGO | S_IWUSR), seclvl_read_passwd,
-       seclvl_write_passwd);
+static struct file_operations passwd_file_ops = {
+        .write = passwd_write_file,
+};
 
 /**
  * Explicitely disallow ptrace'ing the init process.
@@ -579,9 +479,8 @@ static void seclvl_file_free_security(struct file *filp)
  */
 static int seclvl_umount(struct vfsmount *mnt, int flags)
 {
-        if (current->pid == 1) {
+        if (current->pid == 1)
                 return 0;
-        }
         if (seclvl == 2) {
                 seclvl_printk(1, KERN_WARNING, "Attempt to unmount in secure "
                               "level %d\n", seclvl);
@@ -647,22 +546,34 @@ static int processPassword(void)
 }
 
 /**
- * Sysfs registrations
+ * securityfs registrations
  */
-static int doSysfsRegistrations(void)
+struct dentry *dir_ino, *seclvl_ino, *passwd_ino;
+
+static int seclvlfs_register(void)
 {
-        int rc = 0;
-        if ((rc = subsystem_register(&seclvl_subsys))) {
-                seclvl_printk(0, KERN_WARNING,
-                              "Error [%d] registering seclvl subsystem\n", rc);
-                return rc;
-        }
-        sysfs_create_file(&seclvl_subsys.kset.kobj, &sysfs_attr_seclvl.attr);
+        dir_ino = securityfs_create_dir("seclvl", NULL);
+        if (!dir_ino)
+                return -EFAULT;
+
+        seclvl_ino = securityfs_create_file("seclvl", S_IRUGO | S_IWUSR,
+                                dir_ino, &seclvl, &seclvl_file_ops);
+        if (!seclvl_ino)
+                goto out_deldir;
         if (*passwd || *sha1_passwd) {
-                sysfs_create_file(&seclvl_subsys.kset.kobj,
-                                  &sysfs_attr_passwd.attr);
+                passwd_ino = securityfs_create_file("passwd", S_IRUGO | S_IWUSR,
+                                dir_ino, NULL, &passwd_file_ops);
+                if (!passwd_ino)
+                        goto out_delf;
         }
         return 0;
+
+out_deldir:
+        securityfs_remove(dir_ino);
+out_delf:
+        securityfs_remove(seclvl_ino);
+
+        return -EFAULT;
 }
 
 /**
@@ -677,8 +588,6 @@ static int __init seclvl_init(void)
                 rc = -EINVAL;
                 goto exit;
         }
-        sysfs_attr_seclvl.attr.owner = THIS_MODULE;
-        sysfs_attr_passwd.attr.owner = THIS_MODULE;
         if (initlvl < -1 || initlvl > 2) {
                 seclvl_printk(0, KERN_ERR, "Error: bad initial securelevel "
                               "[%d].\n", initlvl);
@@ -706,7 +615,7 @@ static int __init seclvl_init(void)
                 }               /* if primary module registered */
                 secondary = 1;
         }                       /* if we registered ourselves with the security framework */
-        if ((rc = doSysfsRegistrations())) {
+        if ((rc = seclvlfs_register())) {
                 seclvl_printk(0, KERN_ERR, "Error registering with sysfs\n");
                 goto exit;
         }
@@ -724,12 +633,10 @@ static int __init seclvl_init(void)
  */
 static void __exit seclvl_exit(void)
 {
-        sysfs_remove_file(&seclvl_subsys.kset.kobj, &sysfs_attr_seclvl.attr);
-        if (*passwd || *sha1_passwd) {
-                sysfs_remove_file(&seclvl_subsys.kset.kobj,
-                                  &sysfs_attr_passwd.attr);
-        }
-        subsystem_unregister(&seclvl_subsys);
+        securityfs_remove(seclvl_ino);
+        if (*passwd || *sha1_passwd)
+                securityfs_remove(passwd_ino);
+        securityfs_remove(dir_ino);
         if (secondary == 1) {
                 mod_unreg_security(MY_NAME, &seclvl_ops);
         } else if (unregister_security(&seclvl_ops)) {
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index cf6020f85403..12e4fb72bf0f 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -242,7 +242,7 @@ void __init avc_init(void)
         avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
                                              0, SLAB_PANIC, NULL, NULL);
 
-        audit_log(current->audit_context, AUDIT_KERNEL, "AVC INITIALIZED\n");
+        audit_log(current->audit_context, GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n");
 }
 
 int avc_get_hash_stats(char *page)
@@ -550,7 +550,7 @@ void avc_audit(u32 ssid, u32 tsid,
                         return;
         }
 
-        ab = audit_log_start(current->audit_context, AUDIT_AVC);
+        ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_AVC);
         if (!ab)
                 return;         /* audit_panic has been called */
         audit_log_format(ab, "avc:  %s ", denied ? "denied" : "granted");
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f40c8221ec1b..b13be15165f5 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -630,6 +630,16 @@ static inline u16 inode_mode_to_security_class(umode_t mode)
         return SECCLASS_FILE;
 }
 
+static inline int default_protocol_stream(int protocol)
+{
+        return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
+}
+
+static inline int default_protocol_dgram(int protocol)
+{
+        return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
+}
+
 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 {
         switch (family) {
@@ -646,10 +656,16 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc
         case PF_INET6:
                 switch (type) {
                 case SOCK_STREAM:
-                        return SECCLASS_TCP_SOCKET;
+                        if (default_protocol_stream(protocol))
+                                return SECCLASS_TCP_SOCKET;
+                        else
+                                return SECCLASS_RAWIP_SOCKET;
                 case SOCK_DGRAM:
-                        return SECCLASS_UDP_SOCKET;
-                case SOCK_RAW:
+                        if (default_protocol_dgram(protocol))
+                                return SECCLASS_UDP_SOCKET;
+                        else
+                                return SECCLASS_RAWIP_SOCKET;
+                default:
                         return SECCLASS_RAWIP_SOCKET;
                 }
                 break;
@@ -2970,6 +2986,8 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
 
         /*
          * If PF_INET or PF_INET6, check name_bind permission for the port.
+         * Multiple address binding for SCTP is not supported yet: we just
+         * check the first address now.
          */
         family = sock->sk->sk_family;
         if (family == PF_INET || family == PF_INET6) {
@@ -3014,12 +3032,12 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                                 goto out;
                 }
                 
-                switch(sk->sk_protocol) {
-                case IPPROTO_TCP:
+                switch(isec->sclass) {
+                case SECCLASS_TCP_SOCKET:
                         node_perm = TCP_SOCKET__NODE_BIND;
                         break;
                         
-                case IPPROTO_UDP:
+                case SECCLASS_UDP_SOCKET:
                         node_perm = UDP_SOCKET__NODE_BIND;
                         break;
                         
@@ -3389,7 +3407,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
         if (err) {
                 if (err == -EINVAL) {
-                        audit_log(current->audit_context, AUDIT_SELINUX_ERR,
+                        audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
                                   "SELinux:  unrecognized netlink message"
                                   " type=%hu for sclass=%hu\n",
                                   nlh->nlmsg_type, isec->sclass);
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 92b89dc99bcd..aecdded55e74 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -381,7 +381,7 @@ static int security_validtrans_handle_fail(struct context *ocontext,
                 goto out;
         if (context_struct_to_string(tcontext, &t, &tlen) < 0)
                 goto out;
-        audit_log(current->audit_context, AUDIT_SELINUX_ERR,
+        audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
                   "security_validate_transition:  denied for"
                   " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
                   o, n, t, policydb.p_class_val_to_name[tclass-1]);
@@ -787,7 +787,7 @@ static int compute_sid_handle_invalid_context(
                 goto out;
         if (context_struct_to_string(newcontext, &n, &nlen) < 0)
                 goto out;
-        audit_log(current->audit_context, AUDIT_SELINUX_ERR,
+        audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
                   "security_compute_sid:  invalid context %s"
                   " for scontext=%s"
                   " tcontext=%s"
diff --git a/sound/arm/Kconfig b/sound/arm/Kconfig
index 2e4a5e0d16db..0864a7ce414d 100644
--- a/sound/arm/Kconfig
+++ b/sound/arm/Kconfig
@@ -7,6 +7,7 @@ config SND_SA11XX_UDA1341
         tristate "SA11xx UDA1341TS driver (iPaq H3600)"
         depends on ARCH_SA1100 && SND && L3
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here if you have a Compaq iPaq H3x00 handheld computer
           and want to use its Philips UDA 1341 audio chip.
diff --git a/sound/arm/aaci.c b/sound/arm/aaci.c
index 98877030d579..b2d5db20ec8c 100644
--- a/sound/arm/aaci.c
+++ b/sound/arm/aaci.c
@@ -650,7 +650,7 @@ static int aaci_do_resume(snd_card_t *card, unsigned int state)
         return 0;
 }
 
-static int aaci_suspend(struct amba_device *dev, u32 state)
+static int aaci_suspend(struct amba_device *dev, pm_message_t state)
 {
         snd_card_t *card = amba_get_drvdata(dev);
         return card ? aaci_do_suspend(card) : 0;
@@ -900,6 +900,8 @@ static int __devinit aaci_probe(struct amba_device *dev, void *id)
         if (ret)
                 goto out;
 
+        snd_card_set_dev(aaci->card, &dev->dev);
+
         ret = snd_card_register(aaci->card);
         if (ret == 0) {
                 dev_info(&dev->dev, "%s, fifo %d\n", aaci->card->longname,
diff --git a/sound/arm/sa11xx-uda1341.c b/sound/arm/sa11xx-uda1341.c
index 174bc032d1ad..6ee912259cc5 100644
--- a/sound/arm/sa11xx-uda1341.c
+++ b/sound/arm/sa11xx-uda1341.c
@@ -21,7 +21,7 @@
  *                              merged HAL layer (patches from Brian)
  */
 
-/* $Id: sa11xx-uda1341.c,v 1.21 2005/01/28 19:34:04 tiwai Exp $ */
+/* $Id: sa11xx-uda1341.c,v 1.23 2005/09/09 13:22:34 tiwai Exp $ */
 
 /***************************************************************************************************
 *
@@ -918,7 +918,7 @@ static int __init sa11xx_uda1341_init(void)
         if (card == NULL)
                 return -ENOMEM;
 
-        sa11xx_uda1341 = kcalloc(1, sizeof(*sa11xx_uda1341), GFP_KERNEL);
+        sa11xx_uda1341 = kzalloc(sizeof(*sa11xx_uda1341), GFP_KERNEL);
         if (sa11xx_uda1341 == NULL)
                 return -ENOMEM; 
         spin_lock_init(&chip->s[0].dma_lock);
@@ -946,6 +946,9 @@ static int __init sa11xx_uda1341_init(void)
         strcpy(card->shortname, "H3600 UDA1341TS");
         sprintf(card->longname, "Compaq iPAQ H3600 with Philips UDA1341TS");
         
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto nodev;
+
         if ((err = snd_card_register(card)) == 0) {
                 printk( KERN_INFO "iPAQ audio support initialized\n" );
                 return 0;
diff --git a/sound/core/Kconfig b/sound/core/Kconfig
index d1e800b9866d..48cf45cfd0b7 100644
--- a/sound/core/Kconfig
+++ b/sound/core/Kconfig
@@ -99,6 +99,18 @@ config SND_RTCTIMER
           To compile this driver as a module, choose M here: the module
           will be called snd-rtctimer.
 
+config SND_SEQ_RTCTIMER_DEFAULT
+        bool "Use RTC as default sequencer timer"
+        depends on SND_RTCTIMER && SND_SEQUENCER
+        default y
+        help
+          Say Y here to use the RTC timer as the default sequencer
+          timer.  This is strongly recommended because it ensures
+          precise MIDI timing even when the system timer runs at less
+          than 1000 Hz.
+
+          If in doubt, say Y.
+
 config SND_VERBOSE_PRINTK
         bool "Verbose printk"
         depends on SND
@@ -128,6 +140,6 @@ config SND_DEBUG_DETECT
           Say Y here to enable extra-verbose log messages printed when
           detecting devices.
 
-config SND_GENERIC_PM
+config SND_GENERIC_DRIVER
         bool
         depends on SND
diff --git a/sound/core/control.c b/sound/core/control.c
index 227f3cf02771..736edf358e05 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -69,7 +69,7 @@ static int snd_ctl_open(struct inode *inode, struct file *file)
                 err = -EFAULT;
                 goto __error2;
         }
-        ctl = kcalloc(1, sizeof(*ctl), GFP_KERNEL);
+        ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
         if (ctl == NULL) {
                 err = -ENOMEM;
                 goto __error;
@@ -162,7 +162,7 @@ void snd_ctl_notify(snd_card_t *card, unsigned int mask, snd_ctl_elem_id_t *id)
                                 goto _found;
                         }
                 }
-                ev = kcalloc(1, sizeof(*ev), GFP_ATOMIC);
+                ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
                 if (ev) {
                         ev->id = *id;
                         ev->mask = mask;
@@ -195,7 +195,7 @@ snd_kcontrol_t *snd_ctl_new(snd_kcontrol_t * control, unsigned int access)
         
         snd_runtime_check(control != NULL, return NULL);
         snd_runtime_check(control->count > 0, return NULL);
-        kctl = kcalloc(1, sizeof(*kctl) + sizeof(snd_kcontrol_volatile_t) * control->count, GFP_KERNEL);
+        kctl = kzalloc(sizeof(*kctl) + sizeof(snd_kcontrol_volatile_t) * control->count, GFP_KERNEL);
         if (kctl == NULL)
                 return NULL;
         *kctl = *control;
@@ -521,7 +521,7 @@ static int snd_ctl_card_info(snd_card_t * card, snd_ctl_file_t * ctl,
 {
         snd_ctl_card_info_t *info;
 
-        info = kcalloc(1, sizeof(*info), GFP_KERNEL);
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (! info)
                 return -ENOMEM;
         down_read(&snd_ioctl_rwsem);
@@ -929,7 +929,7 @@ static int snd_ctl_elem_add(snd_ctl_file_t *file, snd_ctl_elem_info_t *info, int
                 return -EINVAL;
         }
         private_size *= info->count;
-        ue = kcalloc(1, sizeof(struct user_element) + private_size, GFP_KERNEL);
+        ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL);
         if (ue == NULL)
                 return -ENOMEM;
         ue->info = *info;
@@ -1185,7 +1185,7 @@ static int _snd_ctl_register_ioctl(snd_kctl_ioctl_func_t fcn, struct list_head *
 {
         snd_kctl_ioctl_t *pn;
 
-        pn = kcalloc(1, sizeof(snd_kctl_ioctl_t), GFP_KERNEL);
+        pn = kzalloc(sizeof(snd_kctl_ioctl_t), GFP_KERNEL);
         if (pn == NULL)
                 return -ENOMEM;
         pn->fioctl = fcn;
diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 7fdabea4bfc8..207c7de5129c 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -92,7 +92,7 @@ static int snd_ctl_elem_info_compat(snd_ctl_file_t *ctl, struct sndrv_ctl_elem_i
         struct sndrv_ctl_elem_info *data;
         int err;
 
-        data = kcalloc(1, sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (! data)
                 return -ENOMEM;
 
@@ -271,7 +271,7 @@ static int snd_ctl_elem_read_user_compat(snd_card_t *card,
         struct sndrv_ctl_elem_value *data;
         int err, type, count;
 
-        data = kcalloc(1, sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (data == NULL)
                 return -ENOMEM;
 
@@ -291,7 +291,7 @@ static int snd_ctl_elem_write_user_compat(snd_ctl_file_t *file,
         struct sndrv_ctl_elem_value *data;
         int err, type, count;
 
-        data = kcalloc(1, sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (data == NULL)
                 return -ENOMEM;
 
@@ -313,7 +313,7 @@ static int snd_ctl_elem_add_compat(snd_ctl_file_t *file,
         struct sndrv_ctl_elem_info *data;
         int err;
 
-        data = kcalloc(1, sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (! data)
                 return -ENOMEM;
 
diff --git a/sound/core/device.c b/sound/core/device.c
index ca00ad7740c9..1f509f56e60c 100644
--- a/sound/core/device.c
+++ b/sound/core/device.c
@@ -49,7 +49,7 @@ int snd_device_new(snd_card_t *card, snd_device_type_t type,
         snd_assert(card != NULL, return -ENXIO);
         snd_assert(device_data != NULL, return -ENXIO);
         snd_assert(ops != NULL, return -ENXIO);
-        dev = kcalloc(1, sizeof(*dev), GFP_KERNEL);
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         if (dev == NULL)
                 return -ENOMEM;
         dev->card = card;
diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index 997dd41c584e..9383f1294fb5 100644
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -359,7 +359,7 @@ int snd_hwdep_new(snd_card_t * card, char *id, int device, snd_hwdep_t ** rhwdep
         snd_assert(rhwdep != NULL, return -EINVAL);
         *rhwdep = NULL;
         snd_assert(card != NULL, return -ENXIO);
-        hwdep = kcalloc(1, sizeof(*hwdep), GFP_KERNEL);
+        hwdep = kzalloc(sizeof(*hwdep), GFP_KERNEL);
         if (hwdep == NULL)
                 return -ENOMEM;
         hwdep->card = card;
diff --git a/sound/core/info.c b/sound/core/info.c
index 7f8bdf7b0058..37024d68a26e 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -295,7 +295,7 @@ static int snd_info_entry_open(struct inode *inode, struct file *file)
                         goto __error;
                 }
         }
-        data = kcalloc(1, sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (data == NULL) {
                 err = -ENOMEM;
                 goto __error;
@@ -304,7 +304,7 @@ static int snd_info_entry_open(struct inode *inode, struct file *file)
         switch (entry->content) {
         case SNDRV_INFO_CONTENT_TEXT:
                 if (mode == O_RDONLY || mode == O_RDWR) {
-                        buffer = kcalloc(1, sizeof(*buffer), GFP_KERNEL);
+                        buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
                         if (buffer == NULL) {
                                 kfree(data);
                                 err = -ENOMEM;
@@ -323,7 +323,7 @@ static int snd_info_entry_open(struct inode *inode, struct file *file)
                         data->rbuffer = buffer;
                 }
                 if (mode == O_WRONLY || mode == O_RDWR) {
-                        buffer = kcalloc(1, sizeof(*buffer), GFP_KERNEL);
+                        buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
                         if (buffer == NULL) {
                                 if (mode == O_RDWR) {
                                         vfree(data->rbuffer->buffer);
@@ -752,7 +752,7 @@ char *snd_info_get_str(char *dest, char *src, int len)
 static snd_info_entry_t *snd_info_create_entry(const char *name)
 {
         snd_info_entry_t *entry;
-        entry = kcalloc(1, sizeof(*entry), GFP_KERNEL);
+        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
         if (entry == NULL)
                 return NULL;
         entry->name = kstrdup(name, GFP_KERNEL);
diff --git a/sound/core/init.c b/sound/core/init.c
index d72f58f450ce..a5702014a704 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -72,7 +72,7 @@ snd_card_t *snd_card_new(int idx, const char *xid,
 
         if (extra_size < 0)
                 extra_size = 0;
-        card = kcalloc(1, sizeof(*card) + extra_size, GFP_KERNEL);
+        card = kzalloc(sizeof(*card) + extra_size, GFP_KERNEL);
         if (card == NULL)
                 return NULL;
         if (xid) {
@@ -226,8 +226,10 @@ int snd_card_disconnect(snd_card_t * card)
         return 0;       
 }
 
-#if defined(CONFIG_PM) && defined(CONFIG_SND_GENERIC_PM)
-static void snd_generic_device_unregister(struct snd_generic_device *dev);
+#ifdef CONFIG_SND_GENERIC_DRIVER
+static void snd_generic_device_unregister(snd_card_t *card);
+#else
+#define snd_generic_device_unregister(x) /*NOP*/
 #endif
 
 /**
@@ -253,14 +255,7 @@ int snd_card_free(snd_card_t * card)
 
 #ifdef CONFIG_PM
         wake_up(&card->power_sleep);
-#ifdef CONFIG_SND_GENERIC_PM
-        if (card->pm_dev) {
-                snd_generic_device_unregister(card->pm_dev);
-                card->pm_dev = NULL;
-        }
-#endif
 #endif
-
         /* wait, until all devices are ready for the free operation */
         wait_event(card->shutdown_sleep, card->files == NULL);
 
@@ -288,6 +283,7 @@ int snd_card_free(snd_card_t * card)
                 snd_printk(KERN_WARNING "unable to free card info\n");
                 /* Not fatal error */
         }
+        snd_generic_device_unregister(card);
         while (card->s_f_ops) {
                 s_f_ops = card->s_f_ops;
                 card->s_f_ops = s_f_ops->next;
@@ -665,6 +661,96 @@ int snd_card_file_remove(snd_card_t *card, struct file *file)
         return 0;
 }
 
+#ifdef CONFIG_SND_GENERIC_DRIVER
+/*
+ * generic device without a proper bus using platform_device
+ * (e.g. ISA)
+ */
+struct snd_generic_device {
+        struct platform_device pdev;
+        snd_card_t *card;
+};
+
+#define get_snd_generic_card(dev)       container_of(to_platform_device(dev), struct snd_generic_device, pdev)->card
+
+#define SND_GENERIC_NAME        "snd_generic"
+
+#ifdef CONFIG_PM
+static int snd_generic_suspend(struct device *dev, pm_message_t state, u32 level);
+static int snd_generic_resume(struct device *dev, u32 level);
+#endif
+
+/* initialized in sound.c */
+struct device_driver snd_generic_driver = {
+        .name           = SND_GENERIC_NAME,
+        .bus            = &platform_bus_type,
+#ifdef CONFIG_PM
+        .suspend        = snd_generic_suspend,
+        .resume         = snd_generic_resume,
+#endif
+};
+
+void snd_generic_device_release(struct device *dev)
+{
+}
+
+static int snd_generic_device_register(snd_card_t *card)
+{
+        struct snd_generic_device *dev;
+        int err;
+
+        if (card->generic_dev)
+                return 0; /* already registered */
+
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (! dev) {
+                snd_printk(KERN_ERR "can't allocate generic_device\n");
+                return -ENOMEM;
+        }
+
+        dev->pdev.name = SND_GENERIC_NAME;
+        dev->pdev.id = card->number;
+        dev->pdev.dev.release = snd_generic_device_release;
+        dev->card = card;
+        if ((err = platform_device_register(&dev->pdev)) < 0) {
+                kfree(dev);
+                return err;
+        }
+        card->generic_dev = dev;
+        return 0;
+}
+
+static void snd_generic_device_unregister(snd_card_t *card)
+{
+        struct snd_generic_device *dev = card->generic_dev;
+        if (dev) {
+                platform_device_unregister(&dev->pdev);
+                kfree(dev);
+                card->generic_dev = NULL;
+        }
+}
+
+/**
+ * snd_card_set_generic_dev - assign the generic device to the card
+ * @card: soundcard structure
+ *
+ * Assigns a generic device to the card.  This function is provided as the
+ * last resort, for devices without any proper bus.  Thus this won't override
+ * the device already assigned to the card.
+ * 
+ * Returns zero if successful, or a negative error code.
+ */
+int snd_card_set_generic_dev(snd_card_t *card)
+{
+        int err;
+        if ((err = snd_generic_device_register(card)) < 0)
+                return err;
+        if (! card->dev)
+                snd_card_set_dev(card, &card->generic_dev->pdev.dev);
+        return 0;
+}
+#endif /* CONFIG_SND_GENERIC_DRIVER */
+
 #ifdef CONFIG_PM
 /**
  *  snd_power_wait - wait until the power-state is changed.
@@ -730,75 +816,7 @@ int snd_card_set_pm_callback(snd_card_t *card,
         return 0;
 }
 
-#ifdef CONFIG_SND_GENERIC_PM
-/*
- * use platform_device for generic power-management without a proper bus
- * (e.g. ISA)
- */
-struct snd_generic_device {
-        struct platform_device pdev;
-        snd_card_t *card;
-};
-
-#define get_snd_generic_card(dev)       container_of(to_platform_device(dev), struct snd_generic_device, pdev)->card
-
-#define SND_GENERIC_NAME        "snd_generic_pm"
-
-static int snd_generic_suspend(struct device *dev, pm_message_t state, u32 level);
-static int snd_generic_resume(struct device *dev, u32 level);
-
-static struct device_driver snd_generic_driver = {
-        .name           = SND_GENERIC_NAME,
-        .bus            = &platform_bus_type,
-        .suspend        = snd_generic_suspend,
-        .resume         = snd_generic_resume,
-};
-
-static int generic_driver_registered;
-
-static void generic_driver_unregister(void)
-{
-        if (generic_driver_registered) {
-                generic_driver_registered--;
-                if (! generic_driver_registered)
-                        driver_unregister(&snd_generic_driver);
-        }
-}
-
-static struct snd_generic_device *snd_generic_device_register(snd_card_t *card)
-{
-        struct snd_generic_device *dev;
-
-        if (! generic_driver_registered) {
-                if (driver_register(&snd_generic_driver) < 0)
-                        return NULL;
-        }
-        generic_driver_registered++;
-
-        dev = kcalloc(1, sizeof(*dev), GFP_KERNEL);
-        if (! dev) {
-                generic_driver_unregister();
-                return NULL;
-        }
-
-        dev->pdev.name = SND_GENERIC_NAME;
-        dev->pdev.id = card->number;
-        dev->card = card;
-        if (platform_device_register(&dev->pdev) < 0) {
-                kfree(dev);
-                generic_driver_unregister();
-                return NULL;
-        }
-        return dev;
-}
-
-static void snd_generic_device_unregister(struct snd_generic_device *dev)
-{
-        platform_device_unregister(&dev->pdev);
-        kfree(dev);
-        generic_driver_unregister();
-}
-
+#ifdef CONFIG_SND_GENERIC_DRIVER
 /* suspend/resume callbacks for snd_generic platform device */
 static int snd_generic_suspend(struct device *dev, pm_message_t state, u32 level)
 {
@@ -846,13 +864,12 @@ int snd_card_set_generic_pm_callback(snd_card_t *card,
                                  int (*resume)(snd_card_t *),
                                  void *private_data)
 {
-        card->pm_dev = snd_generic_device_register(card);
-        if (! card->pm_dev)
-                return -ENOMEM;
-        snd_card_set_pm_callback(card, suspend, resume, private_data);
-        return 0;
+        int err;
+        if ((err = snd_generic_device_register(card)) < 0)
+                return err;
+        return snd_card_set_pm_callback(card, suspend, resume, private_data);
 }
-#endif /* CONFIG_SND_GENERIC_PM */
+#endif /* CONFIG_SND_GENERIC_DRIVER */
 
 #ifdef CONFIG_PCI
 int snd_card_pci_suspend(struct pci_dev *dev, pm_message_t state)
diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c
index 39a54a415528..91124ddbdda9 100644
--- a/sound/core/memalloc.c
+++ b/sound/core/memalloc.c
@@ -590,7 +590,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer,
 
                 alloced = 0;
                 pci = NULL;
-                while ((pci = pci_find_device(vendor, device, pci)) != NULL) {
+                while ((pci = pci_get_device(vendor, device, pci)) != NULL) {
                         if (mask > 0 && mask < 0xffffffff) {
                                 if (pci_set_dma_mask(pci, mask) < 0 ||
                                     pci_set_consistent_dma_mask(pci, mask) < 0) {
@@ -604,6 +604,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer,
                                 if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
                                                         size, &dmab) < 0) {
                                         printk(KERN_ERR "snd-page-alloc: cannot allocate buffer pages (size = %d)\n", size);
+                                        pci_dev_put(pci);
                                         return (int)count;
                                 }
                                 snd_dma_reserve_buf(&dmab, snd_dma_pci_buf_id(pci));
diff --git a/sound/core/memory.c b/sound/core/memory.c
index 291b4769bde3..8fa888fc53a0 100644
--- a/sound/core/memory.c
+++ b/sound/core/memory.c
@@ -249,7 +249,7 @@ int __exit snd_memory_info_done(void)
 int copy_to_user_fromio(void __user *dst, const volatile void __iomem *src, size_t count)
 {
 #if defined(__i386__) || defined(CONFIG_SPARC32)
-        return copy_to_user(dst, (const void*)src, count) ? -EFAULT : 0;
+        return copy_to_user(dst, (const void __force*)src, count) ? -EFAULT : 0;
 #else
         char buf[256];
         while (count) {
@@ -280,7 +280,7 @@ int copy_to_user_fromio(void __user *dst, const volatile void __iomem *src, size
 int copy_from_user_toio(volatile void __iomem *dst, const void __user *src, size_t count)
 {
 #if defined(__i386__) || defined(CONFIG_SPARC32)
-        return copy_from_user((void*)dst, src, count) ? -EFAULT : 0;
+        return copy_from_user((void __force *)dst, src, count) ? -EFAULT : 0;
 #else
         char buf[256];
         while (count) {
diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index 98fc0766f885..69e1059112d1 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -53,7 +53,7 @@ static int snd_mixer_oss_open(struct inode *inode, struct file *file)
         err = snd_card_file_add(card, file);
         if (err < 0)
                 return err;
-        fmixer = kcalloc(1, sizeof(*fmixer), GFP_KERNEL);
+        fmixer = kzalloc(sizeof(*fmixer), GFP_KERNEL);
         if (fmixer == NULL) {
                 snd_card_file_remove(card, file);
                 return -ENOMEM;
@@ -517,8 +517,8 @@ static void snd_mixer_oss_get_volume1_vol(snd_mixer_oss_file_t *fmixer,
                 up_read(&card->controls_rwsem);
                 return;
         }
-        uinfo = kcalloc(1, sizeof(*uinfo), GFP_KERNEL);
-        uctl = kcalloc(1, sizeof(*uctl), GFP_KERNEL);
+        uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+        uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
         if (uinfo == NULL || uctl == NULL)
                 goto __unalloc;
         snd_runtime_check(!kctl->info(kctl, uinfo), goto __unalloc);
@@ -551,8 +551,8 @@ static void snd_mixer_oss_get_volume1_sw(snd_mixer_oss_file_t *fmixer,
                 up_read(&card->controls_rwsem);
                 return;
         }
-        uinfo = kcalloc(1, sizeof(*uinfo), GFP_KERNEL);
-        uctl = kcalloc(1, sizeof(*uctl), GFP_KERNEL);
+        uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+        uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
         if (uinfo == NULL || uctl == NULL)
                 goto __unalloc;
         snd_runtime_check(!kctl->info(kctl, uinfo), goto __unalloc);
@@ -612,8 +612,8 @@ static void snd_mixer_oss_put_volume1_vol(snd_mixer_oss_file_t *fmixer,
         down_read(&card->controls_rwsem);
         if ((kctl = snd_ctl_find_numid(card, numid)) == NULL)
                 return;
-        uinfo = kcalloc(1, sizeof(*uinfo), GFP_KERNEL);
-        uctl = kcalloc(1, sizeof(*uctl), GFP_KERNEL);
+        uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+        uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
         if (uinfo == NULL || uctl == NULL)
                 goto __unalloc;
         snd_runtime_check(!kctl->info(kctl, uinfo), goto __unalloc);
@@ -649,8 +649,8 @@ static void snd_mixer_oss_put_volume1_sw(snd_mixer_oss_file_t *fmixer,
                 up_read(&fmixer->card->controls_rwsem);
                 return;
         }
-        uinfo = kcalloc(1, sizeof(*uinfo), GFP_KERNEL);
-        uctl = kcalloc(1, sizeof(*uctl), GFP_KERNEL);
+        uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+        uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
         if (uinfo == NULL || uctl == NULL)
                 goto __unalloc;
         snd_runtime_check(!kctl->info(kctl, uinfo), goto __unalloc);
@@ -768,8 +768,8 @@ static int snd_mixer_oss_get_recsrc2(snd_mixer_oss_file_t *fmixer, unsigned int
         snd_ctl_elem_value_t *uctl;
         int err, idx;
         
-        uinfo = kcalloc(1, sizeof(*uinfo), GFP_KERNEL);
-        uctl = kcalloc(1, sizeof(*uctl), GFP_KERNEL);
+        uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+        uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
         if (uinfo == NULL || uctl == NULL) {
                 err = -ENOMEM;
                 goto __unlock;
@@ -813,8 +813,8 @@ static int snd_mixer_oss_put_recsrc2(snd_mixer_oss_file_t *fmixer, unsigned int
         int err;
         unsigned int idx;
 
-        uinfo = kcalloc(1, sizeof(*uinfo), GFP_KERNEL);
-        uctl = kcalloc(1, sizeof(*uctl), GFP_KERNEL);
+        uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+        uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
         if (uinfo == NULL || uctl == NULL) {
                 err = -ENOMEM;
                 goto __unlock;
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index a13bd7bb4c9f..842c28b2ed55 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -850,7 +850,9 @@ static ssize_t snd_pcm_oss_write1(snd_pcm_substream_t *substream, const char __u
                                         return xfer > 0 ? xfer : -EAGAIN;
                         }
                 } else {
-                        tmp = snd_pcm_oss_write2(substream, (const char *)buf, runtime->oss.period_bytes, 0);
+                        tmp = snd_pcm_oss_write2(substream,
+                                                 (const char __force *)buf,
+                                                 runtime->oss.period_bytes, 0);
                         if (tmp <= 0)
                                 return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp;
                         runtime->oss.bytes += tmp;
@@ -926,7 +928,8 @@ static ssize_t snd_pcm_oss_read1(snd_pcm_substream_t *substream, char __user *bu
                         xfer += tmp;
                         runtime->oss.buffer_used -= tmp;
                 } else {
-                        tmp = snd_pcm_oss_read2(substream, (char *)buf, runtime->oss.period_bytes, 0);
+                        tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
+                                                runtime->oss.period_bytes, 0);
                         if (tmp <= 0)
                                 return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp;
                         runtime->oss.bytes += tmp;
@@ -1540,7 +1543,11 @@ static int snd_pcm_oss_get_ptr(snd_pcm_oss_file_t *pcm_oss_file, int stream, str
         } else {
                 delay = snd_pcm_oss_bytes(substream, delay);
                 if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                        info.blocks = (runtime->oss.buffer_bytes - delay - fixup) / runtime->oss.period_bytes;
+                        snd_pcm_oss_setup_t *setup = substream->oss.setup;
+                        if (setup && setup->buggyptr)
+                                info.blocks = (runtime->oss.buffer_bytes - delay - fixup) / runtime->oss.period_bytes;
+                        else
+                                info.blocks = (delay + fixup) / runtime->oss.period_bytes;
                         info.bytes = (runtime->oss.bytes - delay) & INT_MAX;
                 } else {
                         delay += fixup;
@@ -1733,7 +1740,7 @@ static int snd_pcm_oss_open_file(struct file *file,
         snd_assert(rpcm_oss_file != NULL, return -EINVAL);
         *rpcm_oss_file = NULL;
 
-        pcm_oss_file = kcalloc(1, sizeof(*pcm_oss_file), GFP_KERNEL);
+        pcm_oss_file = kzalloc(sizeof(*pcm_oss_file), GFP_KERNEL);
         if (pcm_oss_file == NULL)
                 return -ENOMEM;
 
@@ -2347,6 +2354,8 @@ static void snd_pcm_oss_proc_write(snd_info_entry_t *entry,
                                 template.partialfrag = 1;
                         } else if (!strcmp(str, "no-silence")) {
                                 template.nosilence = 1;
+                        } else if (!strcmp(str, "buggy-ptr")) {
+                                template.buggyptr = 1;
                         }
                 } while (*str);
                 if (setup == NULL) {
diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
index 6430410c6c04..fc23373c000d 100644
--- a/sound/core/oss/pcm_plugin.c
+++ b/sound/core/oss/pcm_plugin.c
@@ -171,7 +171,7 @@ int snd_pcm_plugin_build(snd_pcm_plug_t *plug,
         
         snd_assert(plug != NULL, return -ENXIO);
         snd_assert(src_format != NULL && dst_format != NULL, return -ENXIO);
-        plugin = kcalloc(1, sizeof(*plugin) + extra, GFP_KERNEL);
+        plugin = kzalloc(sizeof(*plugin) + extra, GFP_KERNEL);
         if (plugin == NULL)
                 return -ENOMEM;
         plugin->name = name;
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 9f4c9209b271..1be470e942ef 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -597,7 +597,7 @@ int snd_pcm_new_stream(snd_pcm_t *pcm, int stream, int substream_count)
         }
         prev = NULL;
         for (idx = 0, prev = NULL; idx < substream_count; idx++) {
-                substream = kcalloc(1, sizeof(*substream), GFP_KERNEL);
+                substream = kzalloc(sizeof(*substream), GFP_KERNEL);
                 if (substream == NULL)
                         return -ENOMEM;
                 substream->pcm = pcm;
@@ -657,7 +657,7 @@ int snd_pcm_new(snd_card_t * card, char *id, int device,
         snd_assert(rpcm != NULL, return -EINVAL);
         *rpcm = NULL;
         snd_assert(card != NULL, return -ENXIO);
-        pcm = kcalloc(1, sizeof(*pcm), GFP_KERNEL);
+        pcm = kzalloc(sizeof(*pcm), GFP_KERNEL);
         if (pcm == NULL)
                 return -ENOMEM;
         pcm->card = card;
@@ -795,7 +795,7 @@ int snd_pcm_open_substream(snd_pcm_t *pcm, int stream,
         if (substream == NULL)
                 return -EAGAIN;
 
-        runtime = kcalloc(1, sizeof(*runtime), GFP_KERNEL);
+        runtime = kzalloc(sizeof(*runtime), GFP_KERNEL);
         if (runtime == NULL)
                 return -ENOMEM;
 
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 0082914a7e33..0503980c23d9 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -524,6 +524,9 @@ void snd_interval_mul(const snd_interval_t *a, const snd_interval_t *b, snd_inte
 
 /**
  * snd_interval_div - refine the interval value with division
+ * @a: dividend
+ * @b: divisor
+ * @c: quotient
  *
  * c = a / b
  *
@@ -555,7 +558,11 @@ void snd_interval_div(const snd_interval_t *a, const snd_interval_t *b, snd_inte
 
 /**
  * snd_interval_muldivk - refine the interval value
- *
+ * @a: dividend 1
+ * @b: dividend 2
+ * @k: divisor (as integer)
+ * @c: result
+  *
  * c = a * b / k
  *
  * Returns non-zero if the value is changed, zero if not changed.
@@ -582,6 +589,10 @@ void snd_interval_muldivk(const snd_interval_t *a, const snd_interval_t *b,
 
 /**
  * snd_interval_mulkdiv - refine the interval value
+ * @a: dividend 1
+ * @k: dividend 2 (as integer)
+ * @b: divisor
+ * @c: result
  *
  * c = a * k / b
  *
@@ -618,6 +629,11 @@ void snd_interval_mulkdiv(const snd_interval_t *a, unsigned int k,
 
 /**
  * snd_interval_ratnum - refine the interval value
+ * @i: interval to refine
+ * @rats_count: number of ratnum_t 
+ * @rats: ratnum_t array
+ * @nump: pointer to store the resultant numerator
+ * @denp: pointer to store the resultant denominator
  *
  * Returns non-zero if the value is changed, zero if not changed.
  */
@@ -715,6 +731,11 @@ int snd_interval_ratnum(snd_interval_t *i,
 
 /**
  * snd_interval_ratden - refine the interval value
+ * @i: interval to refine
+ * @rats_count: number of ratden_t
+ * @rats: ratden_t array
+ * @nump: pointer to store the resultant numerator
+ * @denp: pointer to store the resultant denominator
  *
  * Returns non-zero if the value is changed, zero if not changed.
  */
@@ -936,6 +957,11 @@ int snd_pcm_hw_rule_add(snd_pcm_runtime_t *runtime, unsigned int cond,
 
 /**
  * snd_pcm_hw_constraint_mask
+ * @runtime: PCM runtime instance
+ * @var: hw_params variable to apply the mask
+ * @mask: the bitmap mask
+ *
+ * Apply the constraint of the given bitmap mask to a mask parameter.
  */
 int snd_pcm_hw_constraint_mask(snd_pcm_runtime_t *runtime, snd_pcm_hw_param_t var,
                                u_int32_t mask)
@@ -951,6 +977,11 @@ int snd_pcm_hw_constraint_mask(snd_pcm_runtime_t *runtime, snd_pcm_hw_param_t va
 
 /**
  * snd_pcm_hw_constraint_mask64
+ * @runtime: PCM runtime instance
+ * @var: hw_params variable to apply the mask
+ * @mask: the 64bit bitmap mask
+ *
+ * Apply the constraint of the given bitmap mask to a mask parameter.
  */
 int snd_pcm_hw_constraint_mask64(snd_pcm_runtime_t *runtime, snd_pcm_hw_param_t var,
                                  u_int64_t mask)
@@ -967,6 +998,10 @@ int snd_pcm_hw_constraint_mask64(snd_pcm_runtime_t *runtime, snd_pcm_hw_param_t
 
 /**
  * snd_pcm_hw_constraint_integer
+ * @runtime: PCM runtime instance
+ * @var: hw_params variable to apply the integer constraint
+ *
+ * Apply the constraint of integer to an interval parameter.
  */
 int snd_pcm_hw_constraint_integer(snd_pcm_runtime_t *runtime, snd_pcm_hw_param_t var)
 {
@@ -976,6 +1011,12 @@ int snd_pcm_hw_constraint_integer(snd_pcm_runtime_t *runtime, snd_pcm_hw_param_t
 
 /**
  * snd_pcm_hw_constraint_minmax
+ * @runtime: PCM runtime instance
+ * @var: hw_params variable to apply the range
+ * @min: the minimal value
+ * @max: the maximal value
+ * 
+ * Apply the min/max range constraint to an interval parameter.
  */
 int snd_pcm_hw_constraint_minmax(snd_pcm_runtime_t *runtime, snd_pcm_hw_param_t var,
                                  unsigned int min, unsigned int max)
@@ -999,6 +1040,12 @@ static int snd_pcm_hw_rule_list(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_constraint_list
+ * @runtime: PCM runtime instance
+ * @cond: condition bits
+ * @var: hw_params variable to apply the list constraint
+ * @l: list
+ * 
+ * Apply the list of constraints to an interval parameter.
  */
 int snd_pcm_hw_constraint_list(snd_pcm_runtime_t *runtime,
                                unsigned int cond,
@@ -1027,6 +1074,10 @@ static int snd_pcm_hw_rule_ratnums(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_constraint_ratnums
+ * @runtime: PCM runtime instance
+ * @cond: condition bits
+ * @var: hw_params variable to apply the ratnums constraint
+ * @r: ratnums_t constriants
  */
 int snd_pcm_hw_constraint_ratnums(snd_pcm_runtime_t *runtime, 
                                   unsigned int cond,
@@ -1054,6 +1105,10 @@ static int snd_pcm_hw_rule_ratdens(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_constraint_ratdens
+ * @runtime: PCM runtime instance
+ * @cond: condition bits
+ * @var: hw_params variable to apply the ratdens constraint
+ * @r: ratdens_t constriants
  */
 int snd_pcm_hw_constraint_ratdens(snd_pcm_runtime_t *runtime, 
                                   unsigned int cond,
@@ -1079,6 +1134,10 @@ static int snd_pcm_hw_rule_msbits(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_constraint_msbits
+ * @runtime: PCM runtime instance
+ * @cond: condition bits
+ * @width: sample bits width
+ * @msbits: msbits width
  */
 int snd_pcm_hw_constraint_msbits(snd_pcm_runtime_t *runtime, 
                                  unsigned int cond,
@@ -1101,6 +1160,10 @@ static int snd_pcm_hw_rule_step(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_constraint_step
+ * @runtime: PCM runtime instance
+ * @cond: condition bits
+ * @var: hw_params variable to apply the step constraint
+ * @step: step size
  */
 int snd_pcm_hw_constraint_step(snd_pcm_runtime_t *runtime,
                                unsigned int cond,
@@ -1126,6 +1189,9 @@ static int snd_pcm_hw_rule_pow2(snd_pcm_hw_params_t *params, snd_pcm_hw_rule_t *
 
 /**
  * snd_pcm_hw_constraint_pow2
+ * @runtime: PCM runtime instance
+ * @cond: condition bits
+ * @var: hw_params variable to apply the power-of-2 constraint
  */
 int snd_pcm_hw_constraint_pow2(snd_pcm_runtime_t *runtime,
                                unsigned int cond,
@@ -1162,7 +1228,7 @@ static void _snd_pcm_hw_param_any(snd_pcm_hw_params_t *params,
 }
 
 #if 0
-/**
+/*
  * snd_pcm_hw_param_any
  */
 int snd_pcm_hw_param_any(snd_pcm_t *pcm, snd_pcm_hw_params_t *params,
@@ -1185,7 +1251,7 @@ void _snd_pcm_hw_params_any(snd_pcm_hw_params_t *params)
 }
 
 #if 0
-/**
+/*
  * snd_pcm_hw_params_any
  *
  * Fill PARAMS with full configuration space boundaries
@@ -1199,6 +1265,9 @@ int snd_pcm_hw_params_any(snd_pcm_t *pcm, snd_pcm_hw_params_t *params)
 
 /**
  * snd_pcm_hw_param_value
+ * @params: the hw_params instance
+ * @var: parameter to retrieve
+ * @dir: pointer to the direction (-1,0,1) or NULL
  *
  * Return the value for field PAR if it's fixed in configuration space 
  *  defined by PARAMS. Return -EINVAL otherwise
@@ -1228,6 +1297,9 @@ static int snd_pcm_hw_param_value(const snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_param_value_min
+ * @params: the hw_params instance
+ * @var: parameter to retrieve
+ * @dir: pointer to the direction (-1,0,1) or NULL
  *
  * Return the minimum value for field PAR.
  */
@@ -1251,6 +1323,9 @@ unsigned int snd_pcm_hw_param_value_min(const snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_param_value_max
+ * @params: the hw_params instance
+ * @var: parameter to retrieve
+ * @dir: pointer to the direction (-1,0,1) or NULL
  *
  * Return the maximum value for field PAR.
  */
@@ -1302,7 +1377,7 @@ int _snd_pcm_hw_param_setinteger(snd_pcm_hw_params_t *params,
 }
         
 #if 0
-/**
+/*
  * snd_pcm_hw_param_setinteger
  *
  * Inside configuration space defined by PARAMS remove from PAR all 
@@ -1347,6 +1422,10 @@ static int _snd_pcm_hw_param_first(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_param_first
+ * @pcm: PCM instance
+ * @params: the hw_params instance
+ * @var: parameter to retrieve
+ * @dir: pointer to the direction (-1,0,1) or NULL
  *
  * Inside configuration space defined by PARAMS remove from PAR all 
  * values > minimum. Reduce configuration space accordingly.
@@ -1388,6 +1467,10 @@ static int _snd_pcm_hw_param_last(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_param_last
+ * @pcm: PCM instance
+ * @params: the hw_params instance
+ * @var: parameter to retrieve
+ * @dir: pointer to the direction (-1,0,1) or NULL
  *
  * Inside configuration space defined by PARAMS remove from PAR all 
  * values < maximum. Reduce configuration space accordingly.
@@ -1439,6 +1522,11 @@ int _snd_pcm_hw_param_min(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_param_min
+ * @pcm: PCM instance
+ * @params: the hw_params instance
+ * @var: parameter to retrieve
+ * @val: minimal value
+ * @dir: pointer to the direction (-1,0,1) or NULL
  *
  * Inside configuration space defined by PARAMS remove from PAR all 
  * values < VAL. Reduce configuration space accordingly.
@@ -1494,6 +1582,11 @@ static int _snd_pcm_hw_param_max(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_param_max
+ * @pcm: PCM instance
+ * @params: the hw_params instance
+ * @var: parameter to retrieve
+ * @val: maximal value
+ * @dir: pointer to the direction (-1,0,1) or NULL
  *
  * Inside configuration space defined by PARAMS remove from PAR all 
  *  values >= VAL + 1. Reduce configuration space accordingly.
@@ -1565,6 +1658,11 @@ int _snd_pcm_hw_param_set(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_param_set
+ * @pcm: PCM instance
+ * @params: the hw_params instance
+ * @var: parameter to retrieve
+ * @val: value to set
+ * @dir: pointer to the direction (-1,0,1) or NULL
  *
  * Inside configuration space defined by PARAMS remove from PAR all 
  * values != VAL. Reduce configuration space accordingly.
@@ -1599,6 +1697,10 @@ static int _snd_pcm_hw_param_mask(snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_param_mask
+ * @pcm: PCM instance
+ * @params: the hw_params instance
+ * @var: parameter to retrieve
+ * @val: mask to apply
  *
  * Inside configuration space defined by PARAMS remove from PAR all values
  * not contained in MASK. Reduce configuration space accordingly.
@@ -1671,6 +1773,11 @@ static int boundary_nearer(int min, int mindir,
 
 /**
  * snd_pcm_hw_param_near
+ * @pcm: PCM instance
+ * @params: the hw_params instance
+ * @var: parameter to retrieve
+ * @best: value to set
+ * @dir: pointer to the direction (-1,0,1) or NULL
  *
  * Inside configuration space defined by PARAMS set PAR to the available value
  * nearest to VAL. Reduce configuration space accordingly.
@@ -1747,6 +1854,8 @@ int snd_pcm_hw_param_near(snd_pcm_t *pcm, snd_pcm_hw_params_t *params,
 
 /**
  * snd_pcm_hw_param_choose
+ * @pcm: PCM instance
+ * @params: the hw_params instance
  *
  * Choose one configuration from configuration space defined by PARAMS
  * The configuration chosen is that obtained fixing in this order:
diff --git a/sound/core/pcm_memory.c b/sound/core/pcm_memory.c
index 9a174fb96565..b3f5344f60be 100644
--- a/sound/core/pcm_memory.c
+++ b/sound/core/pcm_memory.c
@@ -244,7 +244,7 @@ int snd_pcm_lib_preallocate_pages(snd_pcm_substream_t *substream,
 
 /**
  * snd_pcm_lib_preallocate_pages_for_all - pre-allocation for continous memory type (all substreams)
- * @substream: the pcm substream instance
+ * @pcm: the pcm instance
  * @type: DMA type (SNDRV_DMA_TYPE_*)
  * @data: DMA type dependant data
  * @size: the requested pre-allocation size in bytes
@@ -321,7 +321,7 @@ int snd_pcm_lib_malloc_pages(snd_pcm_substream_t *substream, size_t size)
         if (substream->dma_buffer.area != NULL && substream->dma_buffer.bytes >= size) {
                 dmab = &substream->dma_buffer; /* use the pre-allocated buffer */
         } else {
-                dmab = kcalloc(1, sizeof(*dmab), GFP_KERNEL);
+                dmab = kzalloc(sizeof(*dmab), GFP_KERNEL);
                 if (! dmab)
                         return -ENOMEM;
                 dmab->dev = substream->dma_buffer.dev;
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 03c17159dd8e..67abebabf83e 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -859,6 +859,7 @@ static struct action_ops snd_pcm_action_start = {
 
 /**
  * snd_pcm_start
+ * @substream: the PCM substream instance
  *
  * Start all linked streams.
  */
@@ -908,6 +909,8 @@ static struct action_ops snd_pcm_action_stop = {
 
 /**
  * snd_pcm_stop
+ * @substream: the PCM substream instance
+ * @state: PCM state after stopping the stream
  *
  * Try to stop all running streams in the substream group.
  * The state of each stream is changed to the given value after that unconditionally.
@@ -919,6 +922,7 @@ int snd_pcm_stop(snd_pcm_substream_t *substream, int state)
 
 /**
  * snd_pcm_drain_done
+ * @substream: the PCM substream
  *
  * Stop the DMA only when the given stream is playback.
  * The state is changed to SETUP.
@@ -1040,6 +1044,7 @@ static struct action_ops snd_pcm_action_suspend = {
 
 /**
  * snd_pcm_suspend
+ * @substream: the PCM substream
  *
  * Trigger SUSPEND to all linked streams.
  * After this call, all streams are changed to SUSPENDED state.
@@ -1057,6 +1062,7 @@ int snd_pcm_suspend(snd_pcm_substream_t *substream)
 
 /**
  * snd_pcm_suspend_all
+ * @pcm: the PCM instance
  *
  * Trigger SUSPEND to all substreams in the given pcm.
  * After this call, all streams are changed to SUSPENDED state.
@@ -1272,6 +1278,9 @@ static struct action_ops snd_pcm_action_prepare = {
 
 /**
  * snd_pcm_prepare
+ * @substream: the PCM substream instance
+ *
+ * Prepare the PCM substream to be triggerable.
  */
 int snd_pcm_prepare(snd_pcm_substream_t *substream)
 {
@@ -1992,7 +2001,7 @@ static int snd_pcm_open_file(struct file *file,
         snd_assert(rpcm_file != NULL, return -EINVAL);
         *rpcm_file = NULL;
 
-        pcm_file = kcalloc(1, sizeof(*pcm_file), GFP_KERNEL);
+        pcm_file = kzalloc(sizeof(*pcm_file), GFP_KERNEL);
         if (pcm_file == NULL) {
                 return -ENOMEM;
         }
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index edba4118271c..7c20eafecb8a 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -101,7 +101,7 @@ static int snd_rawmidi_runtime_create(snd_rawmidi_substream_t * substream)
 {
         snd_rawmidi_runtime_t *runtime;
 
-        if ((runtime = kcalloc(1, sizeof(*runtime), GFP_KERNEL)) == NULL)
+        if ((runtime = kzalloc(sizeof(*runtime), GFP_KERNEL)) == NULL)
                 return -ENOMEM;
         spin_lock_init(&runtime->lock);
         init_waitqueue_head(&runtime->sleep);
@@ -984,7 +984,9 @@ static ssize_t snd_rawmidi_read(struct file *file, char __user *buf, size_t coun
                         spin_lock_irq(&runtime->lock);
                 }
                 spin_unlock_irq(&runtime->lock);
-                count1 = snd_rawmidi_kernel_read1(substream, (unsigned char *)buf, count, 0);
+                count1 = snd_rawmidi_kernel_read1(substream,
+                                                  (unsigned char __force *)buf,
+                                                  count, 0);
                 if (count1 < 0)
                         return result > 0 ? result : count1;
                 result += count1;
@@ -1107,7 +1109,7 @@ int snd_rawmidi_transmit_ack(snd_rawmidi_substream_t * substream, int count)
 /**
  * snd_rawmidi_transmit - copy from the buffer to the device
  * @substream: the rawmidi substream
- * @buf: the buffer pointer
+ * @buffer: the buffer pointer
  * @count: the data size to transfer
  * 
  * Copies data from the buffer to the device and advances the pointer.
@@ -1213,7 +1215,9 @@ static ssize_t snd_rawmidi_write(struct file *file, const char __user *buf, size
                         spin_lock_irq(&runtime->lock);
                 }
                 spin_unlock_irq(&runtime->lock);
-                count1 = snd_rawmidi_kernel_write1(substream, (unsigned char *)buf, count, 0);
+                count1 = snd_rawmidi_kernel_write1(substream,
+                                                   (unsigned char __force *)buf,
+                                                   count, 0);
                 if (count1 < 0)
                         return result > 0 ? result : count1;
                 result += count1;
@@ -1370,7 +1374,7 @@ static int snd_rawmidi_alloc_substreams(snd_rawmidi_t *rmidi,
 
         INIT_LIST_HEAD(&stream->substreams);
         for (idx = 0; idx < count; idx++) {
-                substream = kcalloc(1, sizeof(*substream), GFP_KERNEL);
+                substream = kzalloc(sizeof(*substream), GFP_KERNEL);
                 if (substream == NULL)
                         return -ENOMEM;
                 substream->stream = direction;
@@ -1413,7 +1417,7 @@ int snd_rawmidi_new(snd_card_t * card, char *id, int device,
         snd_assert(rrawmidi != NULL, return -EINVAL);
         *rrawmidi = NULL;
         snd_assert(card != NULL, return -ENXIO);
-        rmidi = kcalloc(1, sizeof(*rmidi), GFP_KERNEL);
+        rmidi = kzalloc(sizeof(*rmidi), GFP_KERNEL);
         if (rmidi == NULL)
                 return -ENOMEM;
         rmidi->card = card;
diff --git a/sound/core/seq/instr/ainstr_gf1.c b/sound/core/seq/instr/ainstr_gf1.c
index 32e91c6b25fe..207c2c54bf1d 100644
--- a/sound/core/seq/instr/ainstr_gf1.c
+++ b/sound/core/seq/instr/ainstr_gf1.c
@@ -61,7 +61,7 @@ static int snd_seq_gf1_copy_wave_from_stream(snd_gf1_ops_t *ops,
                 return -EFAULT;
         *data += sizeof(xp);
         *len -= sizeof(xp);
-        wp = kcalloc(1, sizeof(*wp), gfp_mask);
+        wp = kzalloc(sizeof(*wp), gfp_mask);
         if (wp == NULL)
                 return -ENOMEM;
         wp->share_id[0] = le32_to_cpu(xp.share_id[0]);
diff --git a/sound/core/seq/instr/ainstr_iw.c b/sound/core/seq/instr/ainstr_iw.c
index 2622b8679ca7..b3cee092b1a4 100644
--- a/sound/core/seq/instr/ainstr_iw.c
+++ b/sound/core/seq/instr/ainstr_iw.c
@@ -92,7 +92,7 @@ static int snd_seq_iwffff_copy_env_from_stream(__u32 req_stype,
                 points_size = (le16_to_cpu(rx.nattack) + le16_to_cpu(rx.nrelease)) * 2 * sizeof(__u16);
                 if (points_size > *len)
                         return -EINVAL;
-                rp = kcalloc(1, sizeof(*rp) + points_size, gfp_mask);
+                rp = kzalloc(sizeof(*rp) + points_size, gfp_mask);
                 if (rp == NULL)
                         return -ENOMEM;
                 rp->nattack = le16_to_cpu(rx.nattack);
@@ -139,7 +139,7 @@ static int snd_seq_iwffff_copy_wave_from_stream(snd_iwffff_ops_t *ops,
                 return -EFAULT;
         *data += sizeof(xp);
         *len -= sizeof(xp);
-        wp = kcalloc(1, sizeof(*wp), gfp_mask);
+        wp = kzalloc(sizeof(*wp), gfp_mask);
         if (wp == NULL)
                 return -ENOMEM;
         wp->share_id[0] = le32_to_cpu(xp.share_id[0]);
@@ -273,7 +273,7 @@ static int snd_seq_iwffff_put(void *private_data, snd_seq_kinstr_t *instr,
                         snd_seq_iwffff_instr_free(ops, ip, atomic);
                         return -EINVAL;
                 }
-                lp = kcalloc(1, sizeof(*lp), gfp_mask);
+                lp = kzalloc(sizeof(*lp), gfp_mask);
                 if (lp == NULL) {
                         snd_seq_iwffff_instr_free(ops, ip, atomic);
                         return -ENOMEM;
diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
index bac4b4f1a94e..1ab1cf8158c8 100644
--- a/sound/core/seq/oss/seq_oss_init.c
+++ b/sound/core/seq/oss/seq_oss_init.c
@@ -193,7 +193,7 @@ snd_seq_oss_open(struct file *file, int level)
         int i, rc;
         seq_oss_devinfo_t *dp;
 
-        if ((dp = kcalloc(1, sizeof(*dp), GFP_KERNEL)) == NULL) {
+        if ((dp = kzalloc(sizeof(*dp), GFP_KERNEL)) == NULL) {
                 snd_printk(KERN_ERR "can't malloc device info\n");
                 return -ENOMEM;
         }
diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
index 9aece6c65dbc..f0e95c8f2eef 100644
--- a/sound/core/seq/oss/seq_oss_midi.c
+++ b/sound/core/seq/oss/seq_oss_midi.c
@@ -76,8 +76,8 @@ snd_seq_oss_midi_lookup_ports(int client)
         snd_seq_client_info_t *clinfo;
         snd_seq_port_info_t *pinfo;
 
-        clinfo = kcalloc(1, sizeof(*clinfo), GFP_KERNEL);
-        pinfo = kcalloc(1, sizeof(*pinfo), GFP_KERNEL);
+        clinfo = kzalloc(sizeof(*clinfo), GFP_KERNEL);
+        pinfo = kzalloc(sizeof(*pinfo), GFP_KERNEL);
         if (! clinfo || ! pinfo) {
                 kfree(clinfo);
                 kfree(pinfo);
@@ -172,7 +172,7 @@ snd_seq_oss_midi_check_new_port(snd_seq_port_info_t *pinfo)
         /*
          * allocate midi info record
          */
-        if ((mdev = kcalloc(1, sizeof(*mdev), GFP_KERNEL)) == NULL) {
+        if ((mdev = kzalloc(sizeof(*mdev), GFP_KERNEL)) == NULL) {
                 snd_printk(KERN_ERR "can't malloc midi info\n");
                 return -ENOMEM;
         }
diff --git a/sound/core/seq/oss/seq_oss_readq.c b/sound/core/seq/oss/seq_oss_readq.c
index 0a6f2a64f692..55571e15cd38 100644
--- a/sound/core/seq/oss/seq_oss_readq.c
+++ b/sound/core/seq/oss/seq_oss_readq.c
@@ -46,7 +46,7 @@ snd_seq_oss_readq_new(seq_oss_devinfo_t *dp, int maxlen)
 {
         seq_oss_readq_t *q;
 
-        if ((q = kcalloc(1, sizeof(*q), GFP_KERNEL)) == NULL) {
+        if ((q = kzalloc(sizeof(*q), GFP_KERNEL)) == NULL) {
                 snd_printk(KERN_ERR "can't malloc read queue\n");
                 return NULL;
         }
diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
index 1a7736cbf3a4..8257fce2ca1b 100644
--- a/sound/core/seq/oss/seq_oss_synth.c
+++ b/sound/core/seq/oss/seq_oss_synth.c
@@ -103,7 +103,7 @@ snd_seq_oss_synth_register(snd_seq_device_t *dev)
         snd_seq_oss_reg_t *reg = SNDRV_SEQ_DEVICE_ARGPTR(dev);
         unsigned long flags;
 
-        if ((rec = kcalloc(1, sizeof(*rec), GFP_KERNEL)) == NULL) {
+        if ((rec = kzalloc(sizeof(*rec), GFP_KERNEL)) == NULL) {
                 snd_printk(KERN_ERR "can't malloc synth info\n");
                 return -ENOMEM;
         }
@@ -499,7 +499,7 @@ snd_seq_oss_synth_sysex(seq_oss_devinfo_t *dp, int dev, unsigned char *buf, snd_
 
         sysex = dp->synths[dev].sysex;
         if (sysex == NULL) {
-                sysex = kcalloc(1, sizeof(*sysex), GFP_KERNEL);
+                sysex = kzalloc(sizeof(*sysex), GFP_KERNEL);
                 if (sysex == NULL)
                         return -ENOMEM;
                 dp->synths[dev].sysex = sysex;
diff --git a/sound/core/seq/oss/seq_oss_timer.c b/sound/core/seq/oss/seq_oss_timer.c
index 42ca9493fa60..64d594b3170f 100644
--- a/sound/core/seq/oss/seq_oss_timer.c
+++ b/sound/core/seq/oss/seq_oss_timer.c
@@ -46,7 +46,7 @@ snd_seq_oss_timer_new(seq_oss_devinfo_t *dp)
 {
         seq_oss_timer_t *rec;
 
-        rec = kcalloc(1, sizeof(*rec), GFP_KERNEL);
+        rec = kzalloc(sizeof(*rec), GFP_KERNEL);
         if (rec == NULL)
                 return NULL;
 
diff --git a/sound/core/seq/oss/seq_oss_writeq.c b/sound/core/seq/oss/seq_oss_writeq.c
index 87f85f7ee814..b20378024547 100644
--- a/sound/core/seq/oss/seq_oss_writeq.c
+++ b/sound/core/seq/oss/seq_oss_writeq.c
@@ -38,7 +38,7 @@ snd_seq_oss_writeq_new(seq_oss_devinfo_t *dp, int maxlen)
         seq_oss_writeq_t *q;
         snd_seq_client_pool_t pool;
 
-        if ((q = kcalloc(1, sizeof(*q), GFP_KERNEL)) == NULL)
+        if ((q = kzalloc(sizeof(*q), GFP_KERNEL)) == NULL)
                 return NULL;
         q->dp = dp;
         q->maxlen = maxlen;
diff --git a/sound/core/seq/seq.c b/sound/core/seq/seq.c
index 7449d2a62629..24644150f24b 100644
--- a/sound/core/seq/seq.c
+++ b/sound/core/seq/seq.c
@@ -43,7 +43,13 @@ int seq_client_load[64] = {[0 ... 63] = -1};
 int seq_default_timer_class = SNDRV_TIMER_CLASS_GLOBAL;
 int seq_default_timer_sclass = SNDRV_TIMER_SCLASS_NONE;
 int seq_default_timer_card = -1;
-int seq_default_timer_device = SNDRV_TIMER_GLOBAL_SYSTEM;
+int seq_default_timer_device =
+#ifdef CONFIG_SND_SEQ_RTCTIMER_DEFAULT
+        SNDRV_TIMER_GLOBAL_RTC
+#else
+        SNDRV_TIMER_GLOBAL_SYSTEM
+#endif
+        ;
 int seq_default_timer_subdevice = 0;
 int seq_default_timer_resolution = 0;   /* Hz */
 
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index d8f76afd284b..a886db94b1fa 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -203,7 +203,7 @@ static client_t *seq_create_client1(int client_index, int poolsize)
         client_t *client;
 
         /* init client data */
-        client = kcalloc(1, sizeof(*client), GFP_KERNEL);
+        client = kzalloc(sizeof(*client), GFP_KERNEL);
         if (client == NULL)
                 return NULL;
         client->pool = snd_seq_pool_new(poolsize);
@@ -413,7 +413,9 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count, l
                         }
                         count -= sizeof(snd_seq_event_t);
                         buf += sizeof(snd_seq_event_t);
-                        err = snd_seq_expand_var_event(&cell->event, count, (char *)buf, 0, sizeof(snd_seq_event_t));
+                        err = snd_seq_expand_var_event(&cell->event, count,
+                                                       (char __force *)buf, 0,
+                                                       sizeof(snd_seq_event_t));
                         if (err < 0)
                                 break;
                         result += err;
@@ -1009,7 +1011,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, size_t c
                         }
                         /* set user space pointer */
                         event.data.ext.len = extlen | SNDRV_SEQ_EXT_USRPTR;
-                        event.data.ext.ptr = (char*)buf + sizeof(snd_seq_event_t);
+                        event.data.ext.ptr = (char __force *)buf
+                                                + sizeof(snd_seq_event_t);
                         len += extlen; /* increment data length */
                 } else {
 #ifdef CONFIG_COMPAT
diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c
index 4d80f39612e8..252b52731003 100644
--- a/sound/core/seq/seq_device.c
+++ b/sound/core/seq/seq_device.c
@@ -200,7 +200,7 @@ int snd_seq_device_new(snd_card_t *card, int device, char *id, int argsize,
         if (ops == NULL)
                 return -ENOMEM;
 
-        dev = kcalloc(1, sizeof(*dev)*2 + argsize, GFP_KERNEL);
+        dev = kzalloc(sizeof(*dev)*2 + argsize, GFP_KERNEL);
         if (dev == NULL) {
                 unlock_driver(ops);
                 return -ENOMEM;
diff --git a/sound/core/seq/seq_dummy.c b/sound/core/seq/seq_dummy.c
index ea945a5d2a0b..5dd0e6a19e50 100644
--- a/sound/core/seq/seq_dummy.c
+++ b/sound/core/seq/seq_dummy.c
@@ -153,7 +153,7 @@ create_port(int idx, int type)
         snd_seq_port_callback_t pcb;
         snd_seq_dummy_port_t *rec;
 
-        if ((rec = kcalloc(1, sizeof(*rec), GFP_KERNEL)) == NULL)
+        if ((rec = kzalloc(sizeof(*rec), GFP_KERNEL)) == NULL)
                 return NULL;
 
         rec->client = my_client;
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
index 3b7647ca7ad9..4767cfdc361f 100644
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -33,7 +33,7 @@ fifo_t *snd_seq_fifo_new(int poolsize)
 {
         fifo_t *f;
 
-        f = kcalloc(1, sizeof(*f), GFP_KERNEL);
+        f = kzalloc(sizeof(*f), GFP_KERNEL);
         if (f == NULL) {
                 snd_printd("malloc failed for snd_seq_fifo_new() \n");
                 return NULL;
diff --git a/sound/core/seq/seq_instr.c b/sound/core/seq/seq_instr.c
index 5b40ea2ba8f4..019d43a462d7 100644
--- a/sound/core/seq/seq_instr.c
+++ b/sound/core/seq/seq_instr.c
@@ -53,7 +53,7 @@ static snd_seq_kinstr_t *snd_seq_instr_new(int add_len, int atomic)
 {
         snd_seq_kinstr_t *instr;
         
-        instr = kcalloc(1, sizeof(snd_seq_kinstr_t) + add_len, atomic ? GFP_ATOMIC : GFP_KERNEL);
+        instr = kzalloc(sizeof(snd_seq_kinstr_t) + add_len, atomic ? GFP_ATOMIC : GFP_KERNEL);
         if (instr == NULL)
                 return NULL;
         instr->add_len = add_len;
@@ -77,7 +77,7 @@ snd_seq_kinstr_list_t *snd_seq_instr_list_new(void)
 {
         snd_seq_kinstr_list_t *list;
 
-        list = kcalloc(1, sizeof(snd_seq_kinstr_list_t), GFP_KERNEL);
+        list = kzalloc(sizeof(snd_seq_kinstr_list_t), GFP_KERNEL);
         if (list == NULL)
                 return NULL;
         spin_lock_init(&list->lock);
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index 03acb2d519ba..d4d7d326c4b1 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -452,7 +452,7 @@ pool_t *snd_seq_pool_new(int poolsize)
         pool_t *pool;
 
         /* create pool block */
-        pool = kcalloc(1, sizeof(*pool), GFP_KERNEL);
+        pool = kzalloc(sizeof(*pool), GFP_KERNEL);
         if (pool == NULL) {
                 snd_printd("seq: malloc failed for pool\n");
                 return NULL;
diff --git a/sound/core/seq/seq_midi.c b/sound/core/seq/seq_midi.c
index 4374829ea770..b4674ae3bc30 100644
--- a/sound/core/seq/seq_midi.c
+++ b/sound/core/seq/seq_midi.c
@@ -322,7 +322,7 @@ snd_seq_midisynth_register_port(snd_seq_device_t *dev)
         client = synths[card->number];
         if (client == NULL) {
                 newclient = 1;
-                client = kcalloc(1, sizeof(*client), GFP_KERNEL);
+                client = kzalloc(sizeof(*client), GFP_KERNEL);
                 if (client == NULL) {
                         up(&register_mutex);
                         kfree(info);
diff --git a/sound/core/seq/seq_midi_event.c b/sound/core/seq/seq_midi_event.c
index 603b63716db6..2dc1aecfb426 100644
--- a/sound/core/seq/seq_midi_event.c
+++ b/sound/core/seq/seq_midi_event.c
@@ -118,7 +118,7 @@ int snd_midi_event_new(int bufsize, snd_midi_event_t **rdev)
         snd_midi_event_t *dev;
 
         *rdev = NULL;
-        dev = kcalloc(1, sizeof(*dev), GFP_KERNEL);
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         if (dev == NULL)
                 return -ENOMEM;
         if (bufsize > 0) {
diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index b976951fc100..57ec31df0d15 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -141,7 +141,7 @@ client_port_t *snd_seq_create_port(client_t *client, int port)
         }
 
         /* create a new port */
-        new_port = kcalloc(1, sizeof(*new_port), GFP_KERNEL);
+        new_port = kzalloc(sizeof(*new_port), GFP_KERNEL);
         if (! new_port) {
                 snd_printd("malloc failed for registering client port\n");
                 return NULL;    /* failure, out of memory */
@@ -488,7 +488,7 @@ int snd_seq_port_connect(client_t *connector,
         unsigned long flags;
         int exclusive;
 
-        subs = kcalloc(1, sizeof(*subs), GFP_KERNEL);
+        subs = kzalloc(sizeof(*subs), GFP_KERNEL);
         if (! subs)
                 return -ENOMEM;
 
diff --git a/sound/core/seq/seq_prioq.c b/sound/core/seq/seq_prioq.c
index a519732ed833..cd641bca9945 100644
--- a/sound/core/seq/seq_prioq.c
+++ b/sound/core/seq/seq_prioq.c
@@ -59,7 +59,7 @@ prioq_t *snd_seq_prioq_new(void)
 {
         prioq_t *f;
 
-        f = kcalloc(1, sizeof(*f), GFP_KERNEL);
+        f = kzalloc(sizeof(*f), GFP_KERNEL);
         if (f == NULL) {
                 snd_printd("oops: malloc failed for snd_seq_prioq_new()\n");
                 return NULL;
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 98de2e711fde..5f5c3cb37cbf 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -111,7 +111,7 @@ static queue_t *queue_new(int owner, int locked)
 {
         queue_t *q;
 
-        q = kcalloc(1, sizeof(*q), GFP_KERNEL);
+        q = kzalloc(sizeof(*q), GFP_KERNEL);
         if (q == NULL) {
                 snd_printd("malloc failed for snd_seq_queue_new()\n");
                 return NULL;
diff --git a/sound/core/seq/seq_system.c b/sound/core/seq/seq_system.c
index e8f0a6683d50..0d9eff85ab88 100644
--- a/sound/core/seq/seq_system.c
+++ b/sound/core/seq/seq_system.c
@@ -126,8 +126,8 @@ int __init snd_seq_system_client_init(void)
         snd_seq_client_info_t *inf;
         snd_seq_port_info_t *port;
 
-        inf = kcalloc(1, sizeof(*inf), GFP_KERNEL);
-        port = kcalloc(1, sizeof(*port), GFP_KERNEL);
+        inf = kzalloc(sizeof(*inf), GFP_KERNEL);
+        port = kzalloc(sizeof(*port), GFP_KERNEL);
         if (! inf || ! port) {
                 kfree(inf);
                 kfree(port);
diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
index a7f76fc95280..b57a3c07ff6f 100644
--- a/sound/core/seq/seq_timer.c
+++ b/sound/core/seq/seq_timer.c
@@ -60,7 +60,7 @@ seq_timer_t *snd_seq_timer_new(void)
 {
         seq_timer_t *tmr;
         
-        tmr = kcalloc(1, sizeof(*tmr), GFP_KERNEL);
+        tmr = kzalloc(sizeof(*tmr), GFP_KERNEL);
         if (tmr == NULL) {
                 snd_printd("malloc failed for snd_seq_timer_new() \n");
                 return NULL;
diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
index a66484b5cf0e..e4f512aa7426 100644
--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -205,7 +205,7 @@ static int snd_virmidi_input_open(snd_rawmidi_substream_t * substream)
         snd_virmidi_t *vmidi;
         unsigned long flags;
 
-        vmidi = kcalloc(1, sizeof(*vmidi), GFP_KERNEL);
+        vmidi = kzalloc(sizeof(*vmidi), GFP_KERNEL);
         if (vmidi == NULL)
                 return -ENOMEM;
         vmidi->substream = substream;
@@ -233,7 +233,7 @@ static int snd_virmidi_output_open(snd_rawmidi_substream_t * substream)
         snd_rawmidi_runtime_t *runtime = substream->runtime;
         snd_virmidi_t *vmidi;
 
-        vmidi = kcalloc(1, sizeof(*vmidi), GFP_KERNEL);
+        vmidi = kzalloc(sizeof(*vmidi), GFP_KERNEL);
         if (vmidi == NULL)
                 return -ENOMEM;
         vmidi->substream = substream;
@@ -508,7 +508,7 @@ int snd_virmidi_new(snd_card_t *card, int device, snd_rawmidi_t **rrmidi)
                                    &rmidi)) < 0)
                 return err;
         strcpy(rmidi->name, rmidi->id);
-        rdev = kcalloc(1, sizeof(*rdev), GFP_KERNEL);
+        rdev = kzalloc(sizeof(*rdev), GFP_KERNEL);
         if (rdev == NULL) {
                 snd_device_free(card, rmidi);
                 return -ENOMEM;
diff --git a/sound/core/sound.c b/sound/core/sound.c
index 3271e9245490..9e76bddb2c0b 100644
--- a/sound/core/sound.c
+++ b/sound/core/sound.c
@@ -328,6 +328,10 @@ int __exit snd_minor_info_done(void)
  *  INIT PART
  */
 
+#ifdef CONFIG_SND_GENERIC_DRIVER
+extern struct device_driver snd_generic_driver;
+#endif
+
 static int __init alsa_sound_init(void)
 {
         short controlnum;
@@ -354,6 +358,9 @@ static int __init alsa_sound_init(void)
                 return -ENOMEM;
         }
         snd_info_minor_register();
+#ifdef CONFIG_SND_GENERIC_DRIVER
+        driver_register(&snd_generic_driver);
+#endif
         for (controlnum = 0; controlnum < cards_limit; controlnum++)
                 devfs_mk_cdev(MKDEV(major, controlnum<<5), S_IFCHR | device_mode, "snd/controlC%d", controlnum);
 #ifndef MODULE
@@ -369,6 +376,9 @@ static void __exit alsa_sound_exit(void)
         for (controlnum = 0; controlnum < cards_limit; controlnum++)
                 devfs_remove("snd/controlC%d", controlnum);
 
+#ifdef CONFIG_SND_GENERIC_DRIVER
+        driver_unregister(&snd_generic_driver);
+#endif
         snd_info_minor_unregister();
         snd_info_done();
         snd_memory_done();
@@ -416,10 +426,13 @@ EXPORT_SYMBOL(snd_card_register);
 EXPORT_SYMBOL(snd_component_add);
 EXPORT_SYMBOL(snd_card_file_add);
 EXPORT_SYMBOL(snd_card_file_remove);
+#ifdef CONFIG_SND_GENERIC_DRIVER
+EXPORT_SYMBOL(snd_card_set_generic_dev);
+#endif
 #ifdef CONFIG_PM
 EXPORT_SYMBOL(snd_power_wait);
 EXPORT_SYMBOL(snd_card_set_pm_callback);
-#if defined(CONFIG_PM) && defined(CONFIG_SND_GENERIC_PM)
+#ifdef CONFIG_SND_GENERIC_DRIVER
 EXPORT_SYMBOL(snd_card_set_generic_pm_callback);
 #endif
 #ifdef CONFIG_PCI
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 4104f6e292e9..22b104624084 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -98,7 +98,7 @@ static void snd_timer_reschedule(snd_timer_t * timer, unsigned long ticks_left);
 static snd_timer_instance_t *snd_timer_instance_new(char *owner, snd_timer_t *timer)
 {
         snd_timer_instance_t *timeri;
-        timeri = kcalloc(1, sizeof(*timeri), GFP_KERNEL);
+        timeri = kzalloc(sizeof(*timeri), GFP_KERNEL);
         if (timeri == NULL)
                 return NULL;
         timeri->owner = kstrdup(owner, GFP_KERNEL);
@@ -764,7 +764,7 @@ int snd_timer_new(snd_card_t *card, char *id, snd_timer_id_t *tid, snd_timer_t *
         snd_assert(tid != NULL, return -EINVAL);
         snd_assert(rtimer != NULL, return -EINVAL);
         *rtimer = NULL;
-        timer = kcalloc(1, sizeof(*timer), GFP_KERNEL);
+        timer = kzalloc(sizeof(*timer), GFP_KERNEL);
         if (timer == NULL)
                 return -ENOMEM;
         timer->tmr_class = tid->dev_class;
@@ -1017,7 +1017,7 @@ static int snd_timer_register_system(void)
                 return err;
         strcpy(timer->name, "system timer");
         timer->hw = snd_timer_system;
-        priv = kcalloc(1, sizeof(*priv), GFP_KERNEL);
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (priv == NULL) {
                 snd_timer_free(timer);
                 return -ENOMEM;
@@ -1202,7 +1202,7 @@ static int snd_timer_user_open(struct inode *inode, struct file *file)
 {
         snd_timer_user_t *tu;
         
-        tu = kcalloc(1, sizeof(*tu), GFP_KERNEL);
+        tu = kzalloc(sizeof(*tu), GFP_KERNEL);
         if (tu == NULL)
                 return -ENOMEM;
         spin_lock_init(&tu->qlock);
@@ -1513,7 +1513,7 @@ static int snd_timer_user_info(struct file *file, snd_timer_info_t __user *_info
         t = tu->timeri->timer;
         snd_assert(t != NULL, return -ENXIO);
 
-        info = kcalloc(1, sizeof(*info), GFP_KERNEL);
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (! info)
                 return -ENOMEM;
         info->card = t->card ? t->card->number : -1;
diff --git a/sound/drivers/Kconfig b/sound/drivers/Kconfig
index 3b2bee19e2c0..efcb4eb2d1a0 100644
--- a/sound/drivers/Kconfig
+++ b/sound/drivers/Kconfig
@@ -29,6 +29,7 @@ config SND_DUMMY
         tristate "Dummy (/dev/null) soundcard"
         depends on SND
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include the dummy driver.  This driver does
           nothing, but emulates various mixer controls and PCM devices.
@@ -44,6 +45,7 @@ config SND_VIRMIDI
         depends on SND_SEQUENCER
         select SND_TIMER
         select SND_RAWMIDI
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include the virtual MIDI driver.  This driver
           allows to connect applications using raw MIDI devices to
@@ -59,6 +61,7 @@ config SND_MTPAV
         depends on SND
         select SND_TIMER
         select SND_RAWMIDI
+        select SND_GENERIC_DRIVER
         help
           To use a MOTU MidiTimePiece AV multiport MIDI adapter
           connected to the parallel port, say Y here and make sure that
@@ -72,6 +75,7 @@ config SND_SERIAL_U16550
         depends on SND
         select SND_TIMER
         select SND_RAWMIDI
+        select SND_GENERIC_DRIVER
         help
           To include support for MIDI serial port interfaces, say Y here
           and read <file:Documentation/sound/alsa/serial-u16550.txt>.
@@ -88,6 +92,7 @@ config SND_MPU401
         tristate "Generic MPU-401 UART driver"
         depends on SND
         select SND_MPU401_UART
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for MIDI ports compatible with
           the Roland MPU-401 interface in UART mode.
diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
index a61640cf7ae7..64ef7f62851d 100644
--- a/sound/drivers/dummy.c
+++ b/sound/drivers/dummy.c
@@ -337,7 +337,7 @@ static int snd_card_dummy_playback_open(snd_pcm_substream_t * substream)
         snd_card_dummy_pcm_t *dpcm;
         int err;
 
-        dpcm = kcalloc(1, sizeof(*dpcm), GFP_KERNEL);
+        dpcm = kzalloc(sizeof(*dpcm), GFP_KERNEL);
         if (dpcm == NULL)
                 return -ENOMEM;
         init_timer(&dpcm->timer);
@@ -368,7 +368,7 @@ static int snd_card_dummy_capture_open(snd_pcm_substream_t * substream)
         snd_card_dummy_pcm_t *dpcm;
         int err;
 
-        dpcm = kcalloc(1, sizeof(*dpcm), GFP_KERNEL);
+        dpcm = kzalloc(sizeof(*dpcm), GFP_KERNEL);
         if (dpcm == NULL)
                 return -ENOMEM;
         init_timer(&dpcm->timer);
@@ -600,6 +600,10 @@ static int __init snd_card_dummy_probe(int dev)
         strcpy(card->driver, "Dummy");
         strcpy(card->shortname, "Dummy");
         sprintf(card->longname, "Dummy %i", dev + 1);
+
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto __nodev;
+
         if ((err = snd_card_register(card)) == 0) {
                 snd_dummy_cards[dev] = card;
                 return 0;
diff --git a/sound/drivers/mpu401/mpu401.c b/sound/drivers/mpu401/mpu401.c
index cb36ecb78697..54e2ff9b5ca1 100644
--- a/sound/drivers/mpu401/mpu401.c
+++ b/sound/drivers/mpu401/mpu401.c
@@ -77,20 +77,26 @@ static int snd_mpu401_create(int dev, snd_card_t **rcard)
                 strcat(card->longname, "polled");
         }
 
-        if (snd_mpu401_uart_new(card, 0,
-                                MPU401_HW_MPU401,
-                                port[dev], 0,
-                                irq[dev], irq[dev] >= 0 ? SA_INTERRUPT : 0, NULL) < 0) {
+        if ((err = snd_mpu401_uart_new(card, 0,
+                                       MPU401_HW_MPU401,
+                                       port[dev], 0,
+                                       irq[dev], irq[dev] >= 0 ? SA_INTERRUPT : 0, NULL)) < 0) {
                 printk(KERN_ERR "MPU401 not detected at 0x%lx\n", port[dev]);
-                snd_card_free(card);
-                return -ENODEV;
-        }
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
+                goto _err;
         }
+
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
+
         *rcard = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __devinit snd_mpu401_probe(int dev)
diff --git a/sound/drivers/mpu401/mpu401_uart.c b/sound/drivers/mpu401/mpu401_uart.c
index 0f83c5241b6b..fe3f921ffbe3 100644
--- a/sound/drivers/mpu401/mpu401_uart.c
+++ b/sound/drivers/mpu401/mpu401_uart.c
@@ -463,7 +463,7 @@ int snd_mpu401_uart_new(snd_card_t * card, int device,
                 *rrawmidi = NULL;
         if ((err = snd_rawmidi_new(card, "MPU-401U", device, 1, 1, &rmidi)) < 0)
                 return err;
-        mpu = kcalloc(1, sizeof(*mpu), GFP_KERNEL);
+        mpu = kzalloc(sizeof(*mpu), GFP_KERNEL);
         if (mpu == NULL) {
                 snd_device_free(card, rmidi);
                 return -ENOMEM;
diff --git a/sound/drivers/mtpav.c b/sound/drivers/mtpav.c
index 1280a57c49eb..3a25c89d2983 100644
--- a/sound/drivers/mtpav.c
+++ b/sound/drivers/mtpav.c
@@ -688,7 +688,7 @@ static int snd_mtpav_get_RAWMIDI(mtpav_t * mcard)
 
 static mtpav_t *new_mtpav(void)
 {
-        mtpav_t *ncrd = kcalloc(1, sizeof(*ncrd), GFP_KERNEL);
+        mtpav_t *ncrd = kzalloc(sizeof(*ncrd), GFP_KERNEL);
         if (ncrd != NULL) {
                 spin_lock_init(&ncrd->spinlock);
 
@@ -757,6 +757,9 @@ static int __init alsa_card_mtpav_init(void)
         if (err < 0)
                 goto __error;
 
+        if ((err = snd_card_set_generic_dev(mtp_card->card)) < 0)
+                goto __error;
+
         err = snd_card_register(mtp_card->card);        // don't snd_card_register until AFTER all cards reources done!
 
         //printk("snd_card_register returned %d\n", err);
diff --git a/sound/drivers/opl3/opl3_lib.c b/sound/drivers/opl3/opl3_lib.c
index c313e5205cb8..1f84d78260de 100644
--- a/sound/drivers/opl3/opl3_lib.c
+++ b/sound/drivers/opl3/opl3_lib.c
@@ -354,7 +354,7 @@ int snd_opl3_new(snd_card_t *card,
         int err;
 
         *ropl3 = NULL;
-        opl3 = kcalloc(1, sizeof(*opl3), GFP_KERNEL);
+        opl3 = kzalloc(sizeof(*opl3), GFP_KERNEL);
         if (opl3 == NULL)
                 return -ENOMEM;
 
diff --git a/sound/drivers/opl3/opl3_oss.c b/sound/drivers/opl3/opl3_oss.c
index 33da334ae981..21a2b409d6d3 100644
--- a/sound/drivers/opl3/opl3_oss.c
+++ b/sound/drivers/opl3/opl3_oss.c
@@ -241,7 +241,7 @@ static int snd_opl3_load_patch_seq_oss(snd_seq_oss_arg_t *arg, int format,
                 }
 
                 size = sizeof(*put) + sizeof(fm_xinstrument_t);
-                put = kcalloc(1, size, GFP_KERNEL);
+                put = kzalloc(size, GFP_KERNEL);
                 if (put == NULL)
                         return -ENOMEM;
                 /* build header */
diff --git a/sound/drivers/opl4/opl4_lib.c b/sound/drivers/opl4/opl4_lib.c
index 8261464dade8..380c2c704c54 100644
--- a/sound/drivers/opl4/opl4_lib.c
+++ b/sound/drivers/opl4/opl4_lib.c
@@ -204,7 +204,7 @@ int snd_opl4_create(snd_card_t *card,
         if (ropl4)
                 *ropl4 = NULL;
 
-        opl4 = kcalloc(1, sizeof(*opl4), GFP_KERNEL);
+        opl4 = kzalloc(sizeof(*opl4), GFP_KERNEL);
         if (!opl4)
                 return -ENOMEM;
 
diff --git a/sound/drivers/serial-u16550.c b/sound/drivers/serial-u16550.c
index 986df35fb829..416172ea1f47 100644
--- a/sound/drivers/serial-u16550.c
+++ b/sound/drivers/serial-u16550.c
@@ -779,7 +779,7 @@ static int __init snd_uart16550_create(snd_card_t * card,
         int err;
 
 
-        if ((uart = kcalloc(1, sizeof(*uart), GFP_KERNEL)) == NULL)
+        if ((uart = kzalloc(sizeof(*uart), GFP_KERNEL)) == NULL)
                 return -ENOMEM;
         uart->adaptor = adaptor;
         uart->card = card;
@@ -928,15 +928,11 @@ static int __init snd_serial_probe(int dev)
                                         base[dev],
                                         adaptor[dev],
                                         droponfull[dev],
-                                        &uart)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                        &uart)) < 0)
+                goto _err;
 
-        if ((err = snd_uart16550_rmidi(uart, 0, outs[dev], ins[dev], &uart->rmidi)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_uart16550_rmidi(uart, 0, outs[dev], ins[dev], &uart->rmidi)) < 0)
+                goto _err;
 
         sprintf(card->longname, "%s at 0x%lx, irq %d speed %d div %d outs %d ins %d adaptor %s droponfull %d",
                 card->shortname,
@@ -949,12 +945,18 @@ static int __init snd_serial_probe(int dev)
                 adaptor_names[uart->adaptor],
                 uart->drop_on_full);
 
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
+
         snd_serial_cards[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __init alsa_card_serial_init(void)
diff --git a/sound/drivers/virmidi.c b/sound/drivers/virmidi.c
index 5937711e9505..af12185ab8a2 100644
--- a/sound/drivers/virmidi.c
+++ b/sound/drivers/virmidi.c
@@ -116,6 +116,10 @@ static int __init snd_card_virmidi_probe(int dev)
         strcpy(card->driver, "VirMIDI");
         strcpy(card->shortname, "VirMIDI");
         sprintf(card->longname, "Virtual MIDI Card %i", dev + 1);
+
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto __nodev;
+
         if ((err = snd_card_register(card)) == 0) {
                 snd_virmidi_cards[dev] = card;
                 return 0;
diff --git a/sound/drivers/vx/vx_core.c b/sound/drivers/vx/vx_core.c
index c6fa5afa3e9a..4697b1d75cbb 100644
--- a/sound/drivers/vx/vx_core.c
+++ b/sound/drivers/vx/vx_core.c
@@ -782,7 +782,7 @@ vx_core_t *snd_vx_create(snd_card_t *card, struct snd_vx_hardware *hw,
 
         snd_assert(card && hw && ops, return NULL);
 
-        chip = kcalloc(1, sizeof(*chip) + extra_size, GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip) + extra_size, GFP_KERNEL);
         if (! chip) {
                 snd_printk(KERN_ERR "vx_core: no memory\n");
                 return NULL;
diff --git a/sound/drivers/vx/vx_pcm.c b/sound/drivers/vx/vx_pcm.c
index d4becf44e247..c2312d912fc7 100644
--- a/sound/drivers/vx/vx_pcm.c
+++ b/sound/drivers/vx/vx_pcm.c
@@ -473,7 +473,7 @@ static int vx_alloc_pipe(vx_core_t *chip, int capture,
                 return err;
 
         /* initialize the pipe record */
-        pipe = kcalloc(1, sizeof(*pipe), GFP_KERNEL);
+        pipe = kzalloc(sizeof(*pipe), GFP_KERNEL);
         if (! pipe) {
                 /* release the pipe */
                 vx_init_rmh(&rmh, CMD_FREE_PIPE);
diff --git a/sound/i2c/cs8427.c b/sound/i2c/cs8427.c
index a3fda859dd15..a21f7d541f86 100644
--- a/sound/i2c/cs8427.c
+++ b/sound/i2c/cs8427.c
@@ -200,7 +200,7 @@ int snd_cs8427_create(snd_i2c_bus_t *bus,
 
         if ((err = snd_i2c_device_create(bus, "CS8427", CS8427_ADDR | (addr & 7), &device)) < 0)
                 return err;
-        chip = device->private_data = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = device->private_data = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 snd_i2c_device_free(device);
                 return -ENOMEM;
diff --git a/sound/i2c/i2c.c b/sound/i2c/i2c.c
index e8fa7e1a68e8..e4e505b9d88b 100644
--- a/sound/i2c/i2c.c
+++ b/sound/i2c/i2c.c
@@ -81,7 +81,7 @@ int snd_i2c_bus_create(snd_card_t *card, const char *name, snd_i2c_bus_t *master
         };
 
         *ri2c = NULL;
-        bus = kcalloc(1, sizeof(*bus), GFP_KERNEL);
+        bus = kzalloc(sizeof(*bus), GFP_KERNEL);
         if (bus == NULL)
                 return -ENOMEM;
         init_MUTEX(&bus->lock_mutex);
@@ -108,7 +108,7 @@ int snd_i2c_device_create(snd_i2c_bus_t *bus, const char *name, unsigned char ad
 
         *rdevice = NULL;
         snd_assert(bus != NULL, return -EINVAL);
-        device = kcalloc(1, sizeof(*device), GFP_KERNEL);
+        device = kzalloc(sizeof(*device), GFP_KERNEL);
         if (device == NULL)
                 return -ENOMEM;
         device->addr = addr;
diff --git a/sound/i2c/l3/uda1341.c b/sound/i2c/l3/uda1341.c
index e13122f3fc50..103a7dcd0dde 100644
--- a/sound/i2c/l3/uda1341.c
+++ b/sound/i2c/l3/uda1341.c
@@ -17,7 +17,7 @@
  * 2002-05-12   Tomas Kasparek  another code cleanup
  */
 
-/* $Id: uda1341.c,v 1.15 2005/01/03 12:05:20 tiwai Exp $ */
+/* $Id: uda1341.c,v 1.16 2005/09/09 13:22:34 tiwai Exp $ */
 
 #include <sound/driver.h>
 #include <linux/module.h>
@@ -670,7 +670,7 @@ int __init snd_chip_uda1341_mixer_new(snd_card_t *card, struct l3_client **clnt)
 
         snd_assert(card != NULL, return -EINVAL);
 
-        uda1341 = kcalloc(1, sizeof(*uda1341), GFP_KERNEL);
+        uda1341 = kzalloc(sizeof(*uda1341), GFP_KERNEL);
         if (uda1341 == NULL)
                 return -ENOMEM;
          
@@ -707,7 +707,7 @@ static int uda1341_attach(struct l3_client *clnt)
 {
         struct uda1341 *uda;
 
-        uda = kcalloc(1, sizeof(*uda), 0, GFP_KERNEL);
+        uda = kzalloc(sizeof(*uda), 0, GFP_KERNEL);
         if (!uda)
                 return -ENOMEM;
 
diff --git a/sound/i2c/other/ak4114.c b/sound/i2c/other/ak4114.c
index 5adde308a00f..af5eadcddd92 100644
--- a/sound/i2c/other/ak4114.c
+++ b/sound/i2c/other/ak4114.c
@@ -92,7 +92,7 @@ int snd_ak4114_create(snd_card_t *card,
                 .dev_free =     snd_ak4114_dev_free,
         };
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
         spin_lock_init(&chip->lock);
diff --git a/sound/i2c/other/ak4117.c b/sound/i2c/other/ak4117.c
index 0419c4336a55..d51b51dd86d6 100644
--- a/sound/i2c/other/ak4117.c
+++ b/sound/i2c/other/ak4117.c
@@ -83,7 +83,7 @@ int snd_ak4117_create(snd_card_t *card, ak4117_read_t *read, ak4117_write_t *wri
                 .dev_free =     snd_ak4117_dev_free,
         };
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
         spin_lock_init(&chip->lock);
diff --git a/sound/i2c/tea6330t.c b/sound/i2c/tea6330t.c
index 2da8d7f157f4..fd65da654267 100644
--- a/sound/i2c/tea6330t.c
+++ b/sound/i2c/tea6330t.c
@@ -281,7 +281,7 @@ int snd_tea6330t_update_mixer(snd_card_t * card,
         u8 default_treble, default_bass;
         unsigned char bytes[7];
 
-        tea = kcalloc(1, sizeof(*tea), GFP_KERNEL);
+        tea = kzalloc(sizeof(*tea), GFP_KERNEL);
         if (tea == NULL)
                 return -ENOMEM;
         if ((err = snd_i2c_device_create(bus, "TEA6330T", TEA6330T_ADDR, &device)) < 0) {
diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig
index 5c3948311528..5d6c300ac0d5 100644
--- a/sound/isa/Kconfig
+++ b/sound/isa/Kconfig
@@ -6,12 +6,12 @@ menu "ISA devices"
 config SND_AD1848_LIB
         tristate
         select SND_PCM
-        select SND_GENERIC_PM
+        select SND_GENERIC_DRIVER
 
 config SND_CS4231_LIB
         tristate
         select SND_PCM
-        select SND_GENERIC_PM
+        select SND_GENERIC_DRIVER
 
 config SND_AD1816A
         tristate "Analog Devices SoundPort AD1816A"
@@ -97,6 +97,7 @@ config SND_ES1688
         select SND_OPL3_LIB
         select SND_MPU401_UART
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for ESS AudioDrive ES688 or
           ES1688 chips.
@@ -110,7 +111,7 @@ config SND_ES18XX
         select SND_OPL3_LIB
         select SND_MPU401_UART
         select SND_PCM
-        select SND_GENERIC_PM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for ESS AudioDrive ES18xx chips.
 
@@ -126,6 +127,7 @@ config SND_GUSCLASSIC
         select SND_RAWMIDI
         select SND_PCM
         select SND_GUS_SYNTH
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for Gravis UltraSound Classic
           soundcards.
@@ -140,6 +142,7 @@ config SND_GUSEXTREME
         select SND_MPU401_UART
         select SND_PCM
         select SND_GUS_SYNTH
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for Gravis UltraSound Extreme
           soundcards.
@@ -153,6 +156,7 @@ config SND_GUSMAX
         select SND_RAWMIDI
         select SND_CS4231_LIB
         select SND_GUS_SYNTH
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for Gravis UltraSound MAX
           soundcards.
@@ -166,7 +170,7 @@ config SND_INTERWAVE
         select SND_RAWMIDI
         select SND_CS4231_LIB
         select SND_GUS_SYNTH
-        select ISAPNP
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for AMD InterWave based
           soundcards (Gravis UltraSound Plug & Play, STB SoundRage32,
@@ -181,7 +185,7 @@ config SND_INTERWAVE_STB
         select SND_RAWMIDI
         select SND_CS4231_LIB
         select SND_GUS_SYNTH
-        select ISAPNP
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for AMD InterWave based
           soundcards with a TEA6330T bass and treble regulator
@@ -224,6 +228,7 @@ config SND_OPTI93X
         select SND_OPL3_LIB
         select SND_MPU401_UART
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for soundcards based on Opti
           82C93x chips.
@@ -237,6 +242,7 @@ config SND_SB8
         select SND_OPL3_LIB
         select SND_RAWMIDI
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for Creative Sound Blaster 1.0/
           2.0/Pro (8-bit) or 100% compatible soundcards.
@@ -250,6 +256,7 @@ config SND_SB16
         select SND_OPL3_LIB
         select SND_MPU401_UART
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for Sound Blaster 16 soundcards
           (including the Plug and Play version).
@@ -263,6 +270,7 @@ config SND_SBAWE
         select SND_OPL3_LIB
         select SND_MPU401_UART
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for Sound Blaster AWE soundcards
           (including the Plug and Play version).
diff --git a/sound/isa/ad1816a/ad1816a_lib.c b/sound/isa/ad1816a/ad1816a_lib.c
index ae860360ecf9..27a9dcfbba00 100644
--- a/sound/isa/ad1816a/ad1816a_lib.c
+++ b/sound/isa/ad1816a/ad1816a_lib.c
@@ -591,7 +591,7 @@ int snd_ad1816a_create(snd_card_t *card,
 
         *rchip = NULL;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
         chip->irq = -1;
diff --git a/sound/isa/ad1848/ad1848.c b/sound/isa/ad1848/ad1848.c
index 8c399340cd72..3ebcc482b07a 100644
--- a/sound/isa/ad1848/ad1848.c
+++ b/sound/isa/ad1848/ad1848.c
@@ -91,35 +91,36 @@ static int __init snd_card_ad1848_probe(int dev)
                                      irq[dev],
                                      dma1[dev],
                                      thinkpad[dev] ? AD1848_HW_THINKPAD : AD1848_HW_DETECT,
-                                     &chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                     &chip)) < 0)
+                goto _err;
+
+        if ((err = snd_ad1848_pcm(chip, 0, &pcm)) < 0)
+                goto _err;
+
+        if ((err = snd_ad1848_mixer(chip)) < 0)
+                goto _err;
 
-        if ((err = snd_ad1848_pcm(chip, 0, &pcm)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_ad1848_mixer(chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
         strcpy(card->driver, "AD1848");
         strcpy(card->shortname, pcm->name);
 
         sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d",
                 pcm->name, chip->port, irq[dev], dma1[dev]);
 
-        if (thinkpad[dev]) {
+        if (thinkpad[dev])
                 strcat(card->longname, " [Thinkpad]");
-        }
 
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
+
         snd_ad1848_cards[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __init alsa_card_ad1848_init(void)
diff --git a/sound/isa/ad1848/ad1848_lib.c b/sound/isa/ad1848/ad1848_lib.c
index bc642dc94547..303861cd03cd 100644
--- a/sound/isa/ad1848/ad1848_lib.c
+++ b/sound/isa/ad1848/ad1848_lib.c
@@ -890,7 +890,7 @@ int snd_ad1848_create(snd_card_t * card,
         int err;
 
         *rchip = NULL;
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
         spin_lock_init(&chip->reg_lock);
diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
index 1fce8b9f37cf..5252206ea388 100644
--- a/sound/isa/cmi8330.c
+++ b/sound/isa/cmi8330.c
@@ -438,33 +438,37 @@ static int __devinit snd_cmi8330_pcm(snd_card_t *card, struct snd_cmi8330 *chip)
 /*
  */
 
+#ifdef CONFIG_PNP
+#define is_isapnp_selected(dev)         isapnp[dev]
+#else
+#define is_isapnp_selected(dev)         0
+#endif
+
+#define PFX     "cmi8330: "
+
 static int __devinit snd_cmi8330_probe(int dev,
                                        struct pnp_card_link *pcard,
                                        const struct pnp_card_device_id *pid)
 {
         snd_card_t *card;
         struct snd_cmi8330 *acard;
-        unsigned long flags;
         int i, err;
 
-#ifdef CONFIG_PNP
-        if (!isapnp[dev]) {
-#endif
+        if (! is_isapnp_selected(dev)) {
                 if (wssport[dev] == SNDRV_AUTO_PORT) {
-                        snd_printk("specify wssport\n");
+                        snd_printk(KERN_ERR PFX "specify wssport\n");
                         return -EINVAL;
                 }
                 if (sbport[dev] == SNDRV_AUTO_PORT) {
-                        snd_printk("specify sbport\n");
+                        snd_printk(KERN_ERR PFX "specify sbport\n");
                         return -EINVAL;
                 }
-#ifdef CONFIG_PNP
         }
-#endif
+
         card = snd_card_new(index[dev], id[dev], THIS_MODULE,
                             sizeof(struct snd_cmi8330));
         if (card == NULL) {
-                snd_printk("could not get a new card\n");
+                snd_printk(KERN_ERR PFX "could not get a new card\n");
                 return -ENOMEM;
         }
         acard = (struct snd_cmi8330 *)card->private_data;
@@ -473,9 +477,8 @@ static int __devinit snd_cmi8330_probe(int dev,
 #ifdef CONFIG_PNP
         if (isapnp[dev]) {
                 if ((err = snd_cmi8330_pnp(dev, acard, pcard, pid)) < 0) {
-                        snd_printk("PnP detection failed\n");
-                        snd_card_free(card);
-                        return err;
+                        snd_printk(KERN_ERR PFX "PnP detection failed\n");
+                        goto _err;
                 }
                 snd_card_set_dev(card, &pcard->card->dev);
         }
@@ -487,14 +490,13 @@ static int __devinit snd_cmi8330_probe(int dev,
                                      wssdma[dev],
                                      AD1848_HW_DETECT,
                                      &acard->wss)) < 0) {
-                snd_printk("(AD1848) device busy??\n");
-                snd_card_free(card);
-                return err;
+                snd_printk(KERN_ERR PFX "(AD1848) device busy??\n");
+                goto _err;
         }
         if (acard->wss->hardware != AD1848_HW_CMI8330) {
-                snd_printk("(AD1848) not found during probe\n");
-                snd_card_free(card);
-                return -ENODEV;
+                snd_printk(KERN_ERR PFX "(AD1848) not found during probe\n");
+                err = -ENODEV;
+                goto _err;
         }
 
         if ((err = snd_sbdsp_create(card, sbport[dev],
@@ -503,32 +505,26 @@ static int __devinit snd_cmi8330_probe(int dev,
                                     sbdma8[dev],
                                     sbdma16[dev],
                                     SB_HW_AUTO, &acard->sb)) < 0) {
-                snd_printk("(SB16) device busy??\n");
-                snd_card_free(card);
-                return err;
+                snd_printk(KERN_ERR PFX "(SB16) device busy??\n");
+                goto _err;
         }
         if (acard->sb->hardware != SB_HW_16) {
-                snd_printk("(SB16) not found during probe\n");
-                snd_card_free(card);
-                return -ENODEV;
+                snd_printk(KERN_ERR PFX "(SB16) not found during probe\n");
+                goto _err;
         }
 
-        spin_lock_irqsave(&acard->wss->reg_lock, flags);
         snd_ad1848_out(acard->wss, AD1848_MISC_INFO, 0x40); /* switch on MODE2 */
         for (i = CMI8330_RMUX3D; i <= CMI8330_CDINGAIN; i++)
                 snd_ad1848_out(acard->wss, i, snd_cmi8330_image[i - CMI8330_RMUX3D]);
-        spin_unlock_irqrestore(&acard->wss->reg_lock, flags);
 
         if ((err = snd_cmi8330_mixer(card, acard)) < 0) {
-                snd_printk("failed to create mixers\n");
-                snd_card_free(card);
-                return err;
+                snd_printk(KERN_ERR PFX "failed to create mixers\n");
+                goto _err;
         }
 
         if ((err = snd_cmi8330_pcm(card, acard)) < 0) {
-                snd_printk("failed to create pcms\n");
-                snd_card_free(card);
-                return err;
+                snd_printk(KERN_ERR PFX "failed to create pcms\n");
+                goto _err;
         }
 
         strcpy(card->driver, "CMI8330/C3D");
@@ -539,16 +535,21 @@ static int __devinit snd_cmi8330_probe(int dev,
                 wssirq[dev],
                 wssdma[dev]);
 
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
 
         if (pcard)
                 pnp_set_card_drvdata(pcard, card);
         else
                 snd_cmi8330_legacy[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 #ifdef CONFIG_PNP
@@ -594,10 +595,8 @@ static int __init alsa_card_cmi8330_init(void)
         for (dev = 0; dev < SNDRV_CARDS; dev++) {
                 if (!enable[dev])
                         continue;
-#ifdef CONFIG_PNP
-                if (isapnp[dev])
+                if (is_isapnp_selected(dev))
                         continue;
-#endif
                 if (snd_cmi8330_probe(dev, NULL, NULL) >= 0)
                         cards++;
         }
diff --git a/sound/isa/cs423x/cs4231.c b/sound/isa/cs423x/cs4231.c
index 7640837659ea..9be5416bcb92 100644
--- a/sound/isa/cs423x/cs4231.c
+++ b/sound/isa/cs423x/cs4231.c
@@ -76,15 +76,15 @@ static int __init snd_card_cs4231_probe(int dev)
         int err;
 
         if (port[dev] == SNDRV_AUTO_PORT) {
-                snd_printk("specify port\n");
+                snd_printk(KERN_ERR "specify port\n");
                 return -EINVAL;
         }
         if (irq[dev] == SNDRV_AUTO_IRQ) {
-                snd_printk("specify irq\n");
+                snd_printk(KERN_ERR "specify irq\n");
                 return -EINVAL;
         }
         if (dma1[dev] == SNDRV_AUTO_DMA) {
-                snd_printk("specify dma1\n");
+                snd_printk(KERN_ERR "specify dma1\n");
                 return -EINVAL;
         }
         card = snd_card_new(index[dev], id[dev], THIS_MODULE, 0);
@@ -96,15 +96,11 @@ static int __init snd_card_cs4231_probe(int dev)
                                      dma1[dev],
                                      dma2[dev],
                                      CS4231_HW_DETECT,
-                                     0, &chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                     0, &chip)) < 0)
+                goto _err;
 
-        if ((err = snd_cs4231_pcm(chip, 0, &pcm)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_cs4231_pcm(chip, 0, &pcm)) < 0)
+                goto _err;
 
         strcpy(card->driver, "CS4231");
         strcpy(card->shortname, pcm->name);
@@ -113,14 +109,10 @@ static int __init snd_card_cs4231_probe(int dev)
         if (dma2[dev] >= 0)
                 sprintf(card->longname + strlen(card->longname), "&%d", dma2[dev]);
 
-        if ((err = snd_cs4231_mixer(chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_cs4231_timer(chip, 0, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_cs4231_mixer(chip)) < 0)
+                goto _err;
+        if ((err = snd_cs4231_timer(chip, 0, NULL)) < 0)
+                goto _err;
 
         if (mpu_port[dev] > 0 && mpu_port[dev] != SNDRV_AUTO_PORT) {
                 if (mpu_irq[dev] == SNDRV_AUTO_IRQ)
@@ -130,14 +122,20 @@ static int __init snd_card_cs4231_probe(int dev)
                                         mpu_irq[dev],
                                         mpu_irq[dev] >= 0 ? SA_INTERRUPT : 0,
                                         NULL) < 0)
-                        printk(KERN_ERR "cs4231: MPU401 not detected\n");
-        }
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
+                        printk(KERN_WARNING "cs4231: MPU401 not detected\n");
         }
+
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
         snd_cs4231_cards[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __init alsa_card_cs4231_init(void)
diff --git a/sound/isa/cs423x/cs4231_lib.c b/sound/isa/cs423x/cs4231_lib.c
index 3199941edd9b..32318258cd8e 100644
--- a/sound/isa/cs423x/cs4231_lib.c
+++ b/sound/isa/cs423x/cs4231_lib.c
@@ -1480,7 +1480,7 @@ static int snd_cs4231_new(snd_card_t * card,
         cs4231_t *chip;
 
         *rchip = NULL;
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
         chip->hardware = hardware;
diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c
index 39f4eff44f5c..d28315dc72f7 100644
--- a/sound/isa/cs423x/cs4236.c
+++ b/sound/isa/cs423x/cs4236.c
@@ -387,6 +387,12 @@ static void snd_card_cs4236_free(snd_card_t *card)
         }
 }
 
+#ifdef CONFIG_PNP
+#define is_isapnp_selected(dev)         isapnp[dev]
+#else
+#define is_isapnp_selected(dev)         0
+#endif
+
 static int __devinit snd_card_cs423x_probe(int dev, struct pnp_card_link *pcard,
                                            const struct pnp_card_device_id *pid)
 {
@@ -397,20 +403,16 @@ static int __devinit snd_card_cs423x_probe(int dev, struct pnp_card_link *pcard,
         opl3_t *opl3;
         int err;
 
-#ifdef CONFIG_PNP
-        if (!isapnp[dev]) {
-#endif
+        if (! is_isapnp_selected(dev)) {
                 if (port[dev] == SNDRV_AUTO_PORT) {
-                        snd_printk("specify port\n");
+                        snd_printk(KERN_ERR "specify port\n");
                         return -EINVAL;
                 }
                 if (cport[dev] == SNDRV_AUTO_PORT) {
-                        snd_printk("specify cport\n");
+                        snd_printk(KERN_ERR "specify cport\n");
                         return -EINVAL;
                 }
-#ifdef CONFIG_PNP
         }
-#endif
         card = snd_card_new(index[dev], id[dev], THIS_MODULE,
                             sizeof(struct snd_card_cs4236));
         if (card == NULL)
@@ -421,8 +423,7 @@ static int __devinit snd_card_cs423x_probe(int dev, struct pnp_card_link *pcard,
         if (isapnp[dev]) {
                 if ((err = snd_card_cs4236_pnp(dev, acard, pcard, pid))<0) {
                         printk(KERN_ERR "isapnp detection failed and probing for " IDENT " is not supported\n");
-                        snd_card_free(card);
-                        return -ENXIO;
+                        goto _err;
                 }
                 snd_card_set_dev(card, &pcard->card->dev);
         }
@@ -430,8 +431,8 @@ static int __devinit snd_card_cs423x_probe(int dev, struct pnp_card_link *pcard,
         if (sb_port[dev] > 0 && sb_port[dev] != SNDRV_AUTO_PORT)
                 if ((acard->res_sb_port = request_region(sb_port[dev], 16, IDENT " SB")) == NULL) {
                         printk(KERN_ERR IDENT ": unable to register SB port at 0x%lx\n", sb_port[dev]);
-                        snd_card_free(card);
-                        return -ENOMEM;
+                        err = -EBUSY;
+                        goto _err;
                 }
 
 #ifdef CS4232
@@ -443,18 +444,14 @@ static int __devinit snd_card_cs423x_probe(int dev, struct pnp_card_link *pcard,
                                      dma2[dev],
                                      CS4231_HW_DETECT,
                                      0,
-                                     &chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_cs4231_pcm(chip, 0, &pcm)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_cs4231_mixer(chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                     &chip)) < 0)
+                goto _err;
+
+        if ((err = snd_cs4231_pcm(chip, 0, &pcm)) < 0)
+                goto _err;
+
+        if ((err = snd_cs4231_mixer(chip)) < 0)
+                goto _err;
 
 #else /* CS4236 */
         if ((err = snd_cs4236_create(card,
@@ -465,18 +462,14 @@ static int __devinit snd_card_cs423x_probe(int dev, struct pnp_card_link *pcard,
                                      dma2[dev],
                                      CS4231_HW_DETECT,
                                      0,
-                                     &chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_cs4236_pcm(chip, 0, &pcm)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_cs4236_mixer(chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                     &chip)) < 0)
+                goto _err;
+
+        if ((err = snd_cs4236_pcm(chip, 0, &pcm)) < 0)
+                goto _err;
+
+        if ((err = snd_cs4236_mixer(chip)) < 0)
+                goto _err;
 #endif
         strcpy(card->driver, pcm->name);
         strcpy(card->shortname, pcm->name);
@@ -488,21 +481,17 @@ static int __devinit snd_card_cs423x_probe(int dev, struct pnp_card_link *pcard,
         if (dma2[dev] >= 0)
                 sprintf(card->longname + strlen(card->longname), "&%d", dma2[dev]);
 
-        if ((err = snd_cs4231_timer(chip, 0, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_cs4231_timer(chip, 0, NULL)) < 0)
+                goto _err;
 
         if (fm_port[dev] > 0 && fm_port[dev] != SNDRV_AUTO_PORT) {
                 if (snd_opl3_create(card,
                                     fm_port[dev], fm_port[dev] + 2,
                                     OPL3_HW_OPL3_CS, 0, &opl3) < 0) {
-                        printk(KERN_ERR IDENT ": OPL3 not detected\n");
+                        printk(KERN_WARNING IDENT ": OPL3 not detected\n");
                 } else {
-                        if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0) {
-                                snd_card_free(card);
-                                return err;
-                        }
+                        if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0)
+                                goto _err;
                 }
         }
 
@@ -513,17 +502,23 @@ static int __devinit snd_card_cs423x_probe(int dev, struct pnp_card_link *pcard,
                                         mpu_port[dev], 0,
                                         mpu_irq[dev],
                                         mpu_irq[dev] >= 0 ? SA_INTERRUPT : 0, NULL) < 0)
-                        printk(KERN_ERR IDENT ": MPU401 not detected\n");
-        }
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
+                        printk(KERN_WARNING IDENT ": MPU401 not detected\n");
         }
+
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
         if (pcard)
                 pnp_set_card_drvdata(pcard, card);
         else
                 snd_cs4236_legacy[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 #ifdef CONFIG_PNP
@@ -569,10 +564,8 @@ static int __init alsa_card_cs423x_init(void)
         for (dev = 0; dev < SNDRV_CARDS; dev++) {
                 if (!enable[dev])
                         continue;
-#ifdef CONFIG_PNP
-                if (isapnp[dev])
+                if (is_isapnp_selected(dev))
                         continue;
-#endif
                 if (snd_card_cs423x_probe(dev, NULL, NULL) >= 0)
                         cards++;
         }
diff --git a/sound/isa/es1688/es1688.c b/sound/isa/es1688/es1688.c
index c5eaec087b46..26a7d335ed8e 100644
--- a/sound/isa/es1688/es1688.c
+++ b/sound/isa/es1688/es1688.c
@@ -70,6 +70,7 @@ MODULE_PARM_DESC(dma8, "8-bit DMA # for ESx688 driver.");
 
 static snd_card_t *snd_audiodrive_cards[SNDRV_CARDS] = SNDRV_DEFAULT_PTR;
 
+#define PFX     "es1688: "
 
 static int __init snd_audiodrive_probe(int dev)
 {
@@ -89,47 +90,41 @@ static int __init snd_audiodrive_probe(int dev)
         xirq = irq[dev];
         if (xirq == SNDRV_AUTO_IRQ) {
                 if ((xirq = snd_legacy_find_free_irq(possible_irqs)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free IRQ\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free IRQ\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
         xmpu_irq = mpu_irq[dev];
         xdma = dma8[dev];
         if (xdma == SNDRV_AUTO_DMA) {
                 if ((xdma = snd_legacy_find_free_dma(possible_dmas)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free DMA\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
 
         if ((err = snd_es1688_create(card, port[dev], mpu_port[dev],
                                      xirq, xmpu_irq, xdma,
-                                     ES1688_HW_AUTO, &chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_es1688_pcm(chip, 0, &pcm)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_es1688_mixer(chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                     ES1688_HW_AUTO, &chip)) < 0)
+                goto _err;
+
+        if ((err = snd_es1688_pcm(chip, 0, &pcm)) < 0)
+                goto _err;
+
+        if ((err = snd_es1688_mixer(chip)) < 0)
+                goto _err;
 
         strcpy(card->driver, "ES1688");
         strcpy(card->shortname, pcm->name);
         sprintf(card->longname, "%s at 0x%lx, irq %i, dma %i", pcm->name, chip->port, xirq, xdma);
 
         if ((snd_opl3_create(card, chip->port, chip->port + 2, OPL3_HW_OPL3, 0, &opl3)) < 0) {
-                printk(KERN_ERR "es1688: opl3 not detected at 0x%lx\n", chip->port);
+                printk(KERN_WARNING PFX "opl3 not detected at 0x%lx\n", chip->port);
         } else {
-                if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0) {
-                        snd_card_free(card);
-                        return err;
-                }
+                if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0)
+                        goto _err;
         }
 
         if (xmpu_irq >= 0 && xmpu_irq != SNDRV_AUTO_IRQ && chip->mpu_port > 0) {
@@ -137,18 +132,22 @@ static int __init snd_audiodrive_probe(int dev)
                                                chip->mpu_port, 0,
                                                xmpu_irq,
                                                SA_INTERRUPT,
-                                               NULL)) < 0) {
-                        snd_card_free(card);
-                        return err;
-                }
-        }
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
+                                               NULL)) < 0)
+                        goto _err;
         }
+
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
+
         snd_audiodrive_cards[dev] = card;
         return 0;
 
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __init snd_audiodrive_legacy_auto_probe(unsigned long xport)
diff --git a/sound/isa/es1688/es1688_lib.c b/sound/isa/es1688/es1688_lib.c
index 17f68d07d9b2..aac898765c02 100644
--- a/sound/isa/es1688/es1688_lib.c
+++ b/sound/isa/es1688/es1688_lib.c
@@ -649,7 +649,7 @@ int snd_es1688_create(snd_card_t * card,
         int err;
 
         *rchip = NULL;
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
         chip->irq = -1;
diff --git a/sound/isa/es18xx.c b/sound/isa/es18xx.c
index 1d832b2adb7c..d0ea19f42703 100644
--- a/sound/isa/es18xx.c
+++ b/sound/isa/es18xx.c
@@ -1686,7 +1686,7 @@ static int __devinit snd_es18xx_new_device(snd_card_t * card,
         int err;
 
         *rchip = NULL;
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
         spin_lock_init(&chip->reg_lock);
@@ -1988,6 +1988,12 @@ static int __devinit snd_audiodrive_pnp(int dev, struct snd_audiodrive *acard,
 }
 #endif /* CONFIG_PNP */
 
+#ifdef CONFIG_PNP
+#define is_isapnp_selected(dev)         isapnp[dev]
+#else
+#define is_isapnp_selected(dev)         0
+#endif
+
 static int __devinit snd_audiodrive_probe(int dev, struct pnp_card_link *pcard,
                                           const struct pnp_card_device_id *pid)
 {
@@ -1996,7 +2002,6 @@ static int __devinit snd_audiodrive_probe(int dev, struct pnp_card_link *pcard,
         int xirq, xdma1, xdma2;
         snd_card_t *card;
         struct snd_audiodrive *acard;
-        snd_rawmidi_t *rmidi = NULL;
         es18xx_t *chip;
         opl3_t *opl3;
         int err;
@@ -2019,25 +2024,25 @@ static int __devinit snd_audiodrive_probe(int dev, struct pnp_card_link *pcard,
         xirq = irq[dev];
         if (xirq == SNDRV_AUTO_IRQ) {
                 if ((xirq = snd_legacy_find_free_irq(possible_irqs)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free IRQ\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free IRQ\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
         xdma1 = dma1[dev];
         if (xdma1 == SNDRV_AUTO_DMA) {
                 if ((xdma1 = snd_legacy_find_free_dma(possible_dmas)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free DMA1\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA1\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
         xdma2 = dma2[dev];
         if (xdma2 == SNDRV_AUTO_DMA) {
                 if ((xdma2 = snd_legacy_find_free_dma(possible_dmas)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free DMA2\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA2\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
 
@@ -2046,10 +2051,8 @@ static int __devinit snd_audiodrive_probe(int dev, struct pnp_card_link *pcard,
                                          mpu_port[dev],
                                          fm_port[dev],
                                          xirq, xdma1, xdma2,
-                                         &chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                         &chip)) < 0)
+                goto _err;
 
         sprintf(card->driver, "ES%x", chip->version);
         sprintf(card->shortname, "ESS AudioDrive ES%x", chip->version);
@@ -2064,23 +2067,18 @@ static int __devinit snd_audiodrive_probe(int dev, struct pnp_card_link *pcard,
                         chip->port,
                         xirq, xdma1);
 
-        if ((err = snd_es18xx_pcm(chip, 0, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_es18xx_mixer(chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_es18xx_pcm(chip, 0, NULL)) < 0)
+                goto _err;
+
+        if ((err = snd_es18xx_mixer(chip)) < 0)
+                goto _err;
 
         if (fm_port[dev] > 0 && fm_port[dev] != SNDRV_AUTO_PORT) {
                 if (snd_opl3_create(card, chip->fm_port, chip->fm_port + 2, OPL3_HW_OPL3, 0, &opl3) < 0) {
-                        snd_printk(KERN_ERR PFX "opl3 not detected at 0x%lx\n", chip->fm_port);
+                        snd_printk(KERN_WARNING PFX "opl3 not detected at 0x%lx\n", chip->fm_port);
                 } else {
-                        if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0) {
-                                snd_card_free(card);
-                                return err;
-                        }
+                        if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0)
+                                goto _err;
                 }
         }
 
@@ -2088,25 +2086,28 @@ static int __devinit snd_audiodrive_probe(int dev, struct pnp_card_link *pcard,
                 if ((err = snd_mpu401_uart_new(card, 0, MPU401_HW_ES18XX,
                                                chip->mpu_port, 0,
                                                xirq, 0,
-                                               &rmidi)) < 0) {
-                        snd_card_free(card);
-                        return err;
-                }
-                chip->rmidi = rmidi;
+                                               &chip->rmidi)) < 0)
+                        goto _err;
         }
 
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
         /* Power Management */
         snd_card_set_isa_pm_callback(card, snd_es18xx_suspend, snd_es18xx_resume, chip);
 
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
+
         if (pcard)
                 pnp_set_card_drvdata(pcard, card);
         else
                 snd_audiodrive_legacy[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __devinit snd_audiodrive_probe_legacy_port(unsigned long xport)
@@ -2117,10 +2118,8 @@ static int __devinit snd_audiodrive_probe_legacy_port(unsigned long xport)
         for ( ; dev < SNDRV_CARDS; dev++) {
                 if (!enable[dev] || port[dev] != SNDRV_AUTO_PORT)
                         continue;
-#ifdef CONFIG_PNP
-                if (isapnp[dev])
+                if (is_isapnp_selected(dev))
                         continue;
-#endif
                 port[dev] = xport;
                 res = snd_audiodrive_probe(dev, NULL, NULL);
                 if (res < 0)
@@ -2177,10 +2176,8 @@ static int __init alsa_card_es18xx_init(void)
         for (dev = 0; dev < SNDRV_CARDS; dev++) {
                 if (!enable[dev] || port[dev] == SNDRV_AUTO_PORT)
                         continue;
-#ifdef CONFIG_PNP
-                if (isapnp[dev])
+                if (is_isapnp_selected(dev))
                         continue;
-#endif
                 if (snd_audiodrive_probe(dev, NULL, NULL) >= 0)
                         cards++;
         }
diff --git a/sound/isa/gus/gus_main.c b/sound/isa/gus/gus_main.c
index a636d9ce3502..8f2872f8e8f6 100644
--- a/sound/isa/gus/gus_main.c
+++ b/sound/isa/gus/gus_main.c
@@ -157,7 +157,7 @@ int snd_gus_create(snd_card_t * card,
         };
 
         *rgus = NULL;
-        gus = kcalloc(1, sizeof(*gus), GFP_KERNEL);
+        gus = kzalloc(sizeof(*gus), GFP_KERNEL);
         if (gus == NULL)
                 return -ENOMEM;
         gus->gf1.irq = -1;
diff --git a/sound/isa/gus/gus_mem_proc.c b/sound/isa/gus/gus_mem_proc.c
index 886763f12132..7f96ac237f3c 100644
--- a/sound/isa/gus/gus_mem_proc.c
+++ b/sound/isa/gus/gus_mem_proc.c
@@ -98,7 +98,7 @@ int snd_gf1_mem_proc_init(snd_gus_card_t * gus)
 
         for (idx = 0; idx < 4; idx++) {
                 if (gus->gf1.mem_alloc.banks_8[idx].size > 0) {
-                        priv = kcalloc(1, sizeof(*priv), GFP_KERNEL);
+                        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
                         if (priv == NULL)
                                 return -ENOMEM;
                         priv->gus = gus;
@@ -115,7 +115,7 @@ int snd_gf1_mem_proc_init(snd_gus_card_t * gus)
         }
         for (idx = 0; idx < 4; idx++) {
                 if (gus->gf1.rom_present & (1 << idx)) {
-                        priv = kcalloc(1, sizeof(*priv), GFP_KERNEL);
+                        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
                         if (priv == NULL)
                                 return -ENOMEM;
                         priv->rom = 1;
diff --git a/sound/isa/gus/gus_pcm.c b/sound/isa/gus/gus_pcm.c
index b75066ab46fc..beb01365dc46 100644
--- a/sound/isa/gus/gus_pcm.c
+++ b/sound/isa/gus/gus_pcm.c
@@ -666,7 +666,7 @@ static int snd_gf1_pcm_playback_open(snd_pcm_substream_t *substream)
         snd_pcm_runtime_t *runtime = substream->runtime;
         int err;
 
-        pcmp = kcalloc(1, sizeof(*pcmp), GFP_KERNEL);
+        pcmp = kzalloc(sizeof(*pcmp), GFP_KERNEL);
         if (pcmp == NULL)
                 return -ENOMEM;
         pcmp->gus = gus;
diff --git a/sound/isa/gus/gusclassic.c b/sound/isa/gus/gusclassic.c
index a99fa5040b46..39cef38835ca 100644
--- a/sound/isa/gus/gusclassic.c
+++ b/sound/isa/gus/gusclassic.c
@@ -72,40 +72,24 @@ MODULE_PARM_DESC(pcm_channels, "Reserved PCM channels for GUS Classic driver.");
 
 static snd_card_t *snd_gusclassic_cards[SNDRV_CARDS] = SNDRV_DEFAULT_PTR;
 
+#define PFX     "gusclassic: "
 
 static int __init snd_gusclassic_detect(snd_gus_card_t * gus)
 {
-        snd_gf1_i_write8(gus, SNDRV_GF1_GB_RESET, 0);   /* reset GF1 */
-#ifdef CONFIG_SND_DEBUG_DETECT
-        {
-                unsigned char d;
+        unsigned char d;
 
-                if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 0) {
-                        snd_printk("[0x%lx] check 1 failed - 0x%x\n", gus->gf1.port, d);
-                        return -ENODEV;
-                }
-        }
-#else
-        if ((snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET) & 0x07) != 0)
+        snd_gf1_i_write8(gus, SNDRV_GF1_GB_RESET, 0);   /* reset GF1 */
+        if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 0) {
+                snd_printdd("[0x%lx] check 1 failed - 0x%x\n", gus->gf1.port, d);
                 return -ENODEV;
-#endif
+        }
         udelay(160);
         snd_gf1_i_write8(gus, SNDRV_GF1_GB_RESET, 1);   /* release reset */
         udelay(160);
-#ifdef CONFIG_SND_DEBUG_DETECT
-        {
-                unsigned char d;
-
-                if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 1) {
-                        snd_printk("[0x%lx] check 2 failed - 0x%x\n", gus->gf1.port, d);
-                        return -ENODEV;
-                }
-        }
-#else
-        if ((snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET) & 0x07) != 1)
+        if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 1) {
+                snd_printdd("[0x%lx] check 2 failed - 0x%x\n", gus->gf1.port, d);
                 return -ENODEV;
-#endif
-
+        }
         return 0;
 }
 
@@ -137,25 +121,25 @@ static int __init snd_gusclassic_probe(int dev)
         xirq = irq[dev];
         if (xirq == SNDRV_AUTO_IRQ) {
                 if ((xirq = snd_legacy_find_free_irq(possible_irqs)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free IRQ\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free IRQ\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
         xdma1 = dma1[dev];
         if (xdma1 == SNDRV_AUTO_DMA) {
                 if ((xdma1 = snd_legacy_find_free_dma(possible_dmas)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free DMA1\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA1\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
         xdma2 = dma2[dev];
         if (xdma2 == SNDRV_AUTO_DMA) {
                 if ((xdma2 = snd_legacy_find_free_dma(possible_dmas)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free DMA2\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA2\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
 
@@ -164,47 +148,48 @@ static int __init snd_gusclassic_probe(int dev)
                                   port[dev],
                                   xirq, xdma1, xdma2,
                                   0, channels[dev], pcm_channels[dev],
-                                  0, &gus)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_gusclassic_detect(gus)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                  0, &gus)) < 0)
+                goto _err;
+
+        if ((err = snd_gusclassic_detect(gus)) < 0)
+                goto _err;
+
         snd_gusclassic_init(dev, gus);
-        if ((err = snd_gus_initialize(gus)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_gus_initialize(gus)) < 0)
+                goto _err;
+
         if (gus->max_flag || gus->ess_flag) {
-                snd_printdd("GUS Classic or ACE soundcard was not detected at 0x%lx\n", gus->gf1.port);
-                snd_card_free(card);
-                return -ENODEV;
-        }
-        if ((err = snd_gf1_new_mixer(gus)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_gf1_pcm_new(gus, 0, 0, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
+                snd_printk(KERN_ERR PFX "GUS Classic or ACE soundcard was not detected at 0x%lx\n", gus->gf1.port);
+                err = -ENODEV;
+                goto _err;
         }
+
+        if ((err = snd_gf1_new_mixer(gus)) < 0)
+                goto _err;
+
+        if ((err = snd_gf1_pcm_new(gus, 0, 0, NULL)) < 0)
+                goto _err;
+
         if (!gus->ace_flag) {
-                if ((err = snd_gf1_rawmidi_new(gus, 0, NULL)) < 0) {
-                        snd_card_free(card);
-                        return err;
-                }
+                if ((err = snd_gf1_rawmidi_new(gus, 0, NULL)) < 0)
+                        goto _err;
         }
         sprintf(card->longname + strlen(card->longname), " at 0x%lx, irq %d, dma %d", gus->gf1.port, xirq, xdma1);
         if (dma2 >= 0)
                 sprintf(card->longname + strlen(card->longname), "&%d", xdma2);
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
+
         snd_gusclassic_cards[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __init snd_gusclassic_legacy_auto_probe(unsigned long xport)
diff --git a/sound/isa/gus/gusextreme.c b/sound/isa/gus/gusextreme.c
index bc6fecb18dcf..d2e7cb1df537 100644
--- a/sound/isa/gus/gusextreme.c
+++ b/sound/isa/gus/gusextreme.c
@@ -87,6 +87,7 @@ MODULE_PARM_DESC(pcm_channels, "Reserved PCM channels for GUS Extreme driver.");
 
 static snd_card_t *snd_gusextreme_cards[SNDRV_CARDS] = SNDRV_DEFAULT_PTR;
 
+#define PFX     "gusextreme: "
 
 static int __init snd_gusextreme_detect(int dev,
                                         snd_card_t * card,
@@ -94,6 +95,7 @@ static int __init snd_gusextreme_detect(int dev,
                                         es1688_t *es1688)
 {
         unsigned long flags;
+        unsigned char d;
 
         /*
          * This is main stuff - enable access to GF1 chip...
@@ -123,36 +125,17 @@ static int __init snd_gusextreme_detect(int dev,
         udelay(100);
 
         snd_gf1_i_write8(gus, SNDRV_GF1_GB_RESET, 0);   /* reset GF1 */
-#ifdef CONFIG_SND_DEBUG_DETECT
-        {
-                unsigned char d;
-
-                if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 0) {
-                        snd_printk("[0x%lx] check 1 failed - 0x%x\n", gus->gf1.port, d);
-                        return -EIO;
-                }
-        }
-#else
-        if ((snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET) & 0x07) != 0)
+        if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 0) {
+                snd_printdd("[0x%lx] check 1 failed - 0x%x\n", gus->gf1.port, d);
                 return -EIO;
-#endif
+        }
         udelay(160);
         snd_gf1_i_write8(gus, SNDRV_GF1_GB_RESET, 1);   /* release reset */
         udelay(160);
-#ifdef CONFIG_SND_DEBUG_DETECT
-        {
-                unsigned char d;
-
-                if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 1) {
-                        snd_printk("[0x%lx] check 2 failed - 0x%x\n", gus->gf1.port, d);
-                        return -EIO;
-                }
-        }
-#else
-        if ((snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET) & 0x07) != 1)
+        if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 1) {
+                snd_printdd("[0x%lx] check 2 failed - 0x%x\n", gus->gf1.port, d);
                 return -EIO;
-#endif
-
+        }
         return 0;
 }
 
@@ -205,7 +188,7 @@ static int __init snd_gusextreme_probe(int dev)
         xgf1_irq = gf1_irq[dev];
         if (xgf1_irq == SNDRV_AUTO_IRQ) {
                 if ((xgf1_irq = snd_legacy_find_free_irq(possible_gf1_irqs)) < 0) {
-                        snd_printk("unable to find a free IRQ for GF1\n");
+                        snd_printk(KERN_ERR PFX "unable to find a free IRQ for GF1\n");
                         err = -EBUSY;
                         goto out;
                 }
@@ -213,7 +196,7 @@ static int __init snd_gusextreme_probe(int dev)
         xess_irq = irq[dev];
         if (xess_irq == SNDRV_AUTO_IRQ) {
                 if ((xess_irq = snd_legacy_find_free_irq(possible_ess_irqs)) < 0) {
-                        snd_printk("unable to find a free IRQ for ES1688\n");
+                        snd_printk(KERN_ERR PFX "unable to find a free IRQ for ES1688\n");
                         err = -EBUSY;
                         goto out;
                 }
@@ -226,7 +209,7 @@ static int __init snd_gusextreme_probe(int dev)
         xgf1_dma = dma1[dev];
         if (xgf1_dma == SNDRV_AUTO_DMA) {
                 if ((xgf1_dma = snd_legacy_find_free_dma(possible_gf1_dmas)) < 0) {
-                        snd_printk("unable to find a free DMA for GF1\n");
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA for GF1\n");
                         err = -EBUSY;
                         goto out;
                 }
@@ -234,7 +217,7 @@ static int __init snd_gusextreme_probe(int dev)
         xess_dma = dma8[dev];
         if (xess_dma == SNDRV_AUTO_DMA) {
                 if ((xess_dma = snd_legacy_find_free_dma(possible_ess_dmas)) < 0) {
-                        snd_printk("unable to find a free DMA for ES1688\n");
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA for ES1688\n");
                         err = -EBUSY;
                         goto out;
                 }
@@ -264,7 +247,7 @@ static int __init snd_gusextreme_probe(int dev)
                 goto out;
 
         if (!gus->ess_flag) {
-                snd_printdd("GUS Extreme soundcard was not detected at 0x%lx\n", gus->gf1.port);
+                snd_printk(KERN_ERR PFX "GUS Extreme soundcard was not detected at 0x%lx\n", gus->gf1.port);
                 err = -ENODEV;
                 goto out;
         }
@@ -287,7 +270,7 @@ static int __init snd_gusextreme_probe(int dev)
 
         if (snd_opl3_create(card, es1688->port, es1688->port + 2,
                             OPL3_HW_OPL3, 0, &opl3) < 0) {
-                printk(KERN_ERR "gusextreme: opl3 not detected at 0x%lx\n", es1688->port);
+                printk(KERN_ERR PFX "gusextreme: opl3 not detected at 0x%lx\n", es1688->port);
         } else {
                 if ((err = snd_opl3_hwdep_new(opl3, 0, 2, NULL)) < 0)
                         goto out;
@@ -303,6 +286,10 @@ static int __init snd_gusextreme_probe(int dev)
 
         sprintf(card->longname, "Gravis UltraSound Extreme at 0x%lx, irq %i&%i, dma %i&%i",
                 es1688->port, xgf1_irq, xess_irq, xgf1_dma, xess_dma);
+
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto out;
+
         if ((err = snd_card_register(card)) < 0)
                 goto out;
 
diff --git a/sound/isa/gus/gusmax.c b/sound/isa/gus/gusmax.c
index 400ff34710fb..0bb44b519340 100644
--- a/sound/isa/gus/gusmax.c
+++ b/sound/isa/gus/gusmax.c
@@ -82,39 +82,25 @@ struct snd_gusmax {
 
 static snd_card_t *snd_gusmax_cards[SNDRV_CARDS] = SNDRV_DEFAULT_PTR;
 
+#define PFX     "gusmax: "
 
 static int __init snd_gusmax_detect(snd_gus_card_t * gus)
 {
-        snd_gf1_i_write8(gus, SNDRV_GF1_GB_RESET, 0);   /* reset GF1 */
-#ifdef CONFIG_SND_DEBUG_DETECT
-        {
-                unsigned char d;
+        unsigned char d;
 
-                if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 0) {
-                        snd_printk("[0x%lx] check 1 failed - 0x%x\n", gus->gf1.port, d);
-                        return -ENODEV;
-                }
-        }
-#else
-        if ((snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET) & 0x07) != 0)
+        snd_gf1_i_write8(gus, SNDRV_GF1_GB_RESET, 0);   /* reset GF1 */
+        if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 0) {
+                snd_printdd("[0x%lx] check 1 failed - 0x%x\n", gus->gf1.port, d);
                 return -ENODEV;
-#endif
+        }
         udelay(160);
         snd_gf1_i_write8(gus, SNDRV_GF1_GB_RESET, 1);   /* release reset */
         udelay(160);
-#ifdef CONFIG_SND_DEBUG_DETECT
-        {
-                unsigned char d;
-
-                if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 1) {
-                        snd_printk("[0x%lx] check 2 failed - 0x%x\n", gus->gf1.port, d);
-                        return -ENODEV;
-                }
-        }
-#else
-        if ((snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET) & 0x07) != 1)
+        if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 1) {
+                snd_printdd("[0x%lx] check 2 failed - 0x%x\n", gus->gf1.port, d);
                 return -ENODEV;
-#endif
+        }
+
         return 0;
 }
 
@@ -239,25 +225,25 @@ static int __init snd_gusmax_probe(int dev)
         xirq = irq[dev];
         if (xirq == SNDRV_AUTO_IRQ) {
                 if ((xirq = snd_legacy_find_free_irq(possible_irqs)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free IRQ\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free IRQ\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
         xdma1 = dma1[dev];
         if (xdma1 == SNDRV_AUTO_DMA) {
                 if ((xdma1 = snd_legacy_find_free_dma(possible_dmas)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free DMA1\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA1\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
         xdma2 = dma2[dev];
         if (xdma2 == SNDRV_AUTO_DMA) {
                 if ((xdma2 = snd_legacy_find_free_dma(possible_dmas)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free DMA2\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA2\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
 
@@ -266,31 +252,28 @@ static int __init snd_gusmax_probe(int dev)
                                   -xirq, xdma1, xdma2,
                                   0, channels[dev],
                                   pcm_channels[dev],
-                                  0, &gus)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_gusmax_detect(gus)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                  0, &gus)) < 0)
+                goto _err;
+
+        if ((err = snd_gusmax_detect(gus)) < 0)
+                goto _err;
+
         maxcard->gus_status_reg = gus->gf1.reg_irqstat;
         maxcard->pcm_status_reg = gus->gf1.port + 0x10c + 2;
         snd_gusmax_init(dev, card, gus);
-        if ((err = snd_gus_initialize(gus)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_gus_initialize(gus)) < 0)
+                goto _err;
+
         if (!gus->max_flag) {
-                printk(KERN_ERR "GUS MAX soundcard was not detected at 0x%lx\n", gus->gf1.port);
-                snd_card_free(card);
-                return -ENODEV;
+                snd_printk(KERN_ERR PFX "GUS MAX soundcard was not detected at 0x%lx\n", gus->gf1.port);
+                err = -ENODEV;
+                goto _err;
         }
 
         if (request_irq(xirq, snd_gusmax_interrupt, SA_INTERRUPT, "GUS MAX", (void *)maxcard)) {
-                snd_card_free(card);
-                printk(KERN_ERR "gusmax: unable to grab IRQ %d\n", xirq);
-                return -EBUSY;
+                snd_printk(KERN_ERR PFX "unable to grab IRQ %d\n", xirq);
+                err = -EBUSY;
+                goto _err;
         }
         maxcard->irq = xirq;
         
@@ -301,50 +284,46 @@ static int __init snd_gusmax_probe(int dev)
                                      CS4231_HWSHARE_IRQ |
                                      CS4231_HWSHARE_DMA1 |
                                      CS4231_HWSHARE_DMA2,
-                                     &cs4231)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_cs4231_pcm(cs4231, 0, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_cs4231_mixer(cs4231)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_cs4231_timer(cs4231, 2, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                     &cs4231)) < 0)
+                goto _err;
+
+        if ((err = snd_cs4231_pcm(cs4231, 0, NULL)) < 0)
+                goto _err;
+
+        if ((err = snd_cs4231_mixer(cs4231)) < 0)
+                goto _err;
+
+        if ((err = snd_cs4231_timer(cs4231, 2, NULL)) < 0)
+                goto _err;
+
         if (pcm_channels[dev] > 0) {
-                if ((err = snd_gf1_pcm_new(gus, 1, 1, NULL)) < 0) {
-                        snd_card_free(card);
-                        return err;
-                }
-        }
-        if ((err = snd_gusmax_mixer(cs4231)) < 0) {
-                snd_card_free(card);
-                return err;
+                if ((err = snd_gf1_pcm_new(gus, 1, 1, NULL)) < 0)
+                        goto _err;
         }
+        if ((err = snd_gusmax_mixer(cs4231)) < 0)
+                goto _err;
 
-        if ((err = snd_gf1_rawmidi_new(gus, 0, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_gf1_rawmidi_new(gus, 0, NULL)) < 0)
+                goto _err;
 
         sprintf(card->longname + strlen(card->longname), " at 0x%lx, irq %i, dma %i", gus->gf1.port, xirq, xdma1);
         if (xdma2 >= 0)
                 sprintf(card->longname + strlen(card->longname), "&%i", xdma2);
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
                 
         maxcard->gus = gus;
         maxcard->cs4231 = cs4231;
         snd_gusmax_cards[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __init snd_gusmax_legacy_auto_probe(unsigned long xport)
diff --git a/sound/isa/gus/interwave.c b/sound/isa/gus/interwave.c
index 46e867daba6a..358cba9d738f 100644
--- a/sound/isa/gus/interwave.c
+++ b/sound/isa/gus/interwave.c
@@ -73,6 +73,12 @@ static int midi[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 0};
 static int pcm_channels[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 2};
 static int effect[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 0};
 
+#ifdef SNDRV_STB
+#define PFX "interwave-stb: "
+#else
+#define PFX "interwave: "
+#endif
+
 module_param_array(index, int, NULL, 0444);
 MODULE_PARM_DESC(index, "Index value for InterWave soundcard.");
 module_param_array(id, charp, NULL, 0444);
@@ -249,38 +255,20 @@ static int __devinit snd_interwave_detect(struct snd_interwave *iwcard,
 {
         unsigned long flags;
         unsigned char rev1, rev2;
+        int d;
 
         snd_gf1_i_write8(gus, SNDRV_GF1_GB_RESET, 0);   /* reset GF1 */
-#ifdef CONFIG_SND_DEBUG_DETECT
-        {
-                int d;
-
-                if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 0) {
-                        snd_printk("[0x%lx] check 1 failed - 0x%x\n", gus->gf1.port, d);
-                        return -ENODEV;
-                }
-        }
-#else
-        if ((snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET) & 0x07) != 0)
+        if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 0) {
+                snd_printdd("[0x%lx] check 1 failed - 0x%x\n", gus->gf1.port, d);
                 return -ENODEV;
-#endif
+        }
         udelay(160);
         snd_gf1_i_write8(gus, SNDRV_GF1_GB_RESET, 1);   /* release reset */
         udelay(160);
-#ifdef CONFIG_SND_DEBUG_DETECT
-        {
-                int d;
-
-                if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 1) {
-                        snd_printk("[0x%lx] check 2 failed - 0x%x\n", gus->gf1.port, d);
-                        return -ENODEV;
-                }
-        }
-#else
-        if ((snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET) & 0x07) != 1)
+        if (((d = snd_gf1_i_look8(gus, SNDRV_GF1_GB_RESET)) & 0x07) != 1) {
+                snd_printdd("[0x%lx] check 2 failed - 0x%x\n", gus->gf1.port, d);
                 return -ENODEV;
-#endif
-
+        }
         spin_lock_irqsave(&gus->reg_lock, flags);
         rev1 = snd_gf1_look8(gus, SNDRV_GF1_GB_VERSION_NUMBER);
         snd_gf1_write8(gus, SNDRV_GF1_GB_VERSION_NUMBER, ~rev1);
@@ -686,35 +674,33 @@ static int __devinit snd_interwave_probe(int dev, struct pnp_card_link *pcard,
         card->private_free = snd_interwave_free;
 #ifdef CONFIG_PNP
         if (isapnp[dev]) {
-                if (snd_interwave_pnp(dev, iwcard, pcard, pid)) {
-                        snd_card_free(card);
-                        return -ENODEV;
-                }
+                if ((err = snd_interwave_pnp(dev, iwcard, pcard, pid)) < 0)
+                        goto _err;
                 snd_card_set_dev(card, &pcard->card->dev);
         }
 #endif
         xirq = irq[dev];
         if (xirq == SNDRV_AUTO_IRQ) {
                 if ((xirq = snd_legacy_find_free_irq(possible_irqs)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free IRQ\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free IRQ\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
         xdma1 = dma1[dev];
         if (xdma1 == SNDRV_AUTO_DMA) {
                 if ((xdma1 = snd_legacy_find_free_dma(possible_dmas)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free DMA1\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA1\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
         xdma2 = dma2[dev];
         if (xdma2 == SNDRV_AUTO_DMA) {
                 if ((xdma2 = snd_legacy_find_free_dma(possible_dmas)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free DMA2\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA2\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
 
@@ -722,32 +708,28 @@ static int __devinit snd_interwave_probe(int dev, struct pnp_card_link *pcard,
                                   port[dev],
                                   -xirq, xdma1, xdma2,
                                   0, 32,
-                                  pcm_channels[dev], effect[dev], &gus)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                  pcm_channels[dev], effect[dev], &gus)) < 0)
+                goto _err;
+
         if ((err = snd_interwave_detect(iwcard, gus, dev
 #ifdef SNDRV_STB
             , &i2c_bus
 #endif
-            )) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+            )) < 0)
+                goto _err;
+
         iwcard->gus_status_reg = gus->gf1.reg_irqstat;
         iwcard->pcm_status_reg = gus->gf1.port + 0x10c + 2;
 
         snd_interwave_init(dev, gus);
         snd_interwave_detect_memory(gus);
-        if ((err = snd_gus_initialize(gus)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_gus_initialize(gus)) < 0)
+                goto _err;
 
         if (request_irq(xirq, snd_interwave_interrupt, SA_INTERRUPT, "InterWave", (void *)iwcard)) {
-                snd_card_free(card);
-                snd_printk("unable to grab IRQ %d\n", xirq);
-                return -EBUSY;
+                snd_printk(KERN_ERR PFX "unable to grab IRQ %d\n", xirq);
+                err = -EBUSY;
+                goto _err;
         }
         iwcard->irq = xirq;
 
@@ -758,34 +740,28 @@ static int __devinit snd_interwave_probe(int dev, struct pnp_card_link *pcard,
                                      CS4231_HWSHARE_IRQ |
                                      CS4231_HWSHARE_DMA1 |
                                      CS4231_HWSHARE_DMA2,
-                                     &cs4231)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_cs4231_pcm(cs4231, 0, &pcm)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                     &cs4231)) < 0)
+                goto _err;
+
+        if ((err = snd_cs4231_pcm(cs4231, 0, &pcm)) < 0)
+                goto _err;
+
         sprintf(pcm->name + strlen(pcm->name), " rev %c", gus->revision + 'A');
         strcat(pcm->name, " (codec)");
-        if ((err = snd_cs4231_timer(cs4231, 2, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_cs4231_mixer(cs4231)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+
+        if ((err = snd_cs4231_timer(cs4231, 2, NULL)) < 0)
+                goto _err;
+
+        if ((err = snd_cs4231_mixer(cs4231)) < 0)
+                goto _err;
+
         if (pcm_channels[dev] > 0) {
-                if ((err = snd_gf1_pcm_new(gus, 1, 1, NULL)) < 0) {
-                        snd_card_free(card);
-                        return err;
-                }
-        }
-        if ((err = snd_interwave_mixer(cs4231)) < 0) {
-                snd_card_free(card);
-                return err;
+                if ((err = snd_gf1_pcm_new(gus, 1, 1, NULL)) < 0)
+                        goto _err;
         }
+        if ((err = snd_interwave_mixer(cs4231)) < 0)
+                goto _err;
+
 #ifdef SNDRV_STB
         {
                 snd_ctl_elem_id_t id1, id2;
@@ -795,28 +771,20 @@ static int __devinit snd_interwave_probe(int dev, struct pnp_card_link *pcard,
                 strcpy(id1.name, "Master Playback Switch");
                 strcpy(id2.name, id1.name);
                 id2.index = 1;
-                if ((err = snd_ctl_rename_id(card, &id1, &id2)) < 0) {
-                        snd_card_free(card);
-                        return err;
-                }
+                if ((err = snd_ctl_rename_id(card, &id1, &id2)) < 0)
+                        goto _err;
                 strcpy(id1.name, "Master Playback Volume");
                 strcpy(id2.name, id1.name);
-                if ((err = snd_ctl_rename_id(card, &id1, &id2)) < 0) {
-                        snd_card_free(card);
-                        return err;
-                }
-                if ((err = snd_tea6330t_update_mixer(card, i2c_bus, 0, 1)) < 0) {
-                        snd_card_free(card);
-                        return err;
-                }
+                if ((err = snd_ctl_rename_id(card, &id1, &id2)) < 0)
+                        goto _err;
+                if ((err = snd_tea6330t_update_mixer(card, i2c_bus, 0, 1)) < 0)
+                        goto _err;
         }
 #endif
 
         gus->uart_enable = midi[dev];
-        if ((err = snd_gf1_rawmidi_new(gus, 0, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_gf1_rawmidi_new(gus, 0, NULL)) < 0)
+                goto _err;
 
 #ifndef SNDRV_STB
         str = "AMD InterWave";
@@ -835,10 +803,11 @@ static int __devinit snd_interwave_probe(int dev, struct pnp_card_link *pcard,
         if (xdma2 >= 0)
                 sprintf(card->longname + strlen(card->longname), "&%d", xdma2);
 
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
         
         iwcard->cs4231 = cs4231;
         iwcard->gus = gus;
@@ -847,6 +816,10 @@ static int __devinit snd_interwave_probe(int dev, struct pnp_card_link *pcard,
         else
                 snd_interwave_legacy[dev++] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __devinit snd_interwave_probe_legacy_port(unsigned long xport)
diff --git a/sound/isa/opl3sa2.c b/sound/isa/opl3sa2.c
index 75bd6eca63e7..e2d2babcd20b 100644
--- a/sound/isa/opl3sa2.c
+++ b/sound/isa/opl3sa2.c
@@ -143,6 +143,8 @@ struct snd_opl3sa2 {
 
 static snd_card_t *snd_opl3sa2_legacy[SNDRV_CARDS] = SNDRV_DEFAULT_PTR;
 
+#define PFX     "opl3sa2: "
+
 #ifdef CONFIG_PNP
 
 static struct pnp_device_id snd_opl3sa2_pnpbiosids[] = {
@@ -231,7 +233,7 @@ static int __init snd_opl3sa2_detect(opl3sa2_t *chip)
         card = chip->card;
         port = chip->port;
         if ((chip->res_port = request_region(port, 2, "OPL3-SA control")) == NULL) {
-                snd_printk(KERN_ERR "opl3sa2: can't grab port 0x%lx\n", port);
+                snd_printk(KERN_ERR PFX "can't grab port 0x%lx\n", port);
                 return -EBUSY;
         }
         // snd_printk("REG 0A = 0x%x\n", snd_opl3sa2_read(chip, 0x0a));
@@ -668,6 +670,12 @@ static int snd_opl3sa2_dev_free(snd_device_t *device)
         return snd_opl3sa2_free(chip);
 }
 
+#ifdef CONFIG_PNP
+#define is_isapnp_selected(dev)         isapnp[dev]
+#else
+#define is_isapnp_selected(dev)         0
+#endif
+
 static int __devinit snd_opl3sa2_probe(int dev,
                                        struct pnp_dev *pdev,
                                        struct pnp_card_link *pcard,
@@ -683,34 +691,31 @@ static int __devinit snd_opl3sa2_probe(int dev,
         };
         int err;
 
-#ifdef CONFIG_PNP
-        if (!isapnp[dev]) {
-#endif
+        if (! is_isapnp_selected(dev)) {
                 if (port[dev] == SNDRV_AUTO_PORT) {
-                        snd_printk("specify port\n");
+                        snd_printk(KERN_ERR PFX "specify port\n");
                         return -EINVAL;
                 }
                 if (wss_port[dev] == SNDRV_AUTO_PORT) {
-                        snd_printk("specify wss_port\n");
+                        snd_printk(KERN_ERR PFX "specify wss_port\n");
                         return -EINVAL;
                 }
                 if (fm_port[dev] == SNDRV_AUTO_PORT) {
-                        snd_printk("specify fm_port\n");
+                        snd_printk(KERN_ERR PFX "specify fm_port\n");
                         return -EINVAL;
                 }
                 if (midi_port[dev] == SNDRV_AUTO_PORT) {
-                        snd_printk("specify midi_port\n");
+                        snd_printk(KERN_ERR PFX "specify midi_port\n");
                         return -EINVAL;
                 }
-#ifdef CONFIG_PNP
         }
-#endif
+
         card = snd_card_new(index[dev], id[dev], THIS_MODULE, 0);
         if (card == NULL)
                 return -ENOMEM;
         strcpy(card->driver, "OPL3SA2");
         strcpy(card->shortname, "Yamaha OPL3-SA2");
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 err = -ENOMEM;
                 goto __error;
@@ -742,7 +747,7 @@ static int __devinit snd_opl3sa2_probe(int dev,
         if ((err = snd_opl3sa2_detect(chip)) < 0)
                 goto __error;
         if (request_irq(xirq, snd_opl3sa2_interrupt, SA_INTERRUPT, "OPL3-SA2", (void *)chip)) {
-                snd_printk(KERN_ERR "opl3sa2: can't grab IRQ %d\n", xirq);
+                snd_printk(KERN_ERR PFX "can't grab IRQ %d\n", xirq);
                 err = -ENODEV;
                 goto __error;
         }
@@ -795,6 +800,9 @@ static int __devinit snd_opl3sa2_probe(int dev,
         if (dma2 >= 0)
                 sprintf(card->longname + strlen(card->longname), "&%d", xdma2);
 
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto __error;
+
         if ((err = snd_card_register(card)) < 0)
                 goto __error;
 
@@ -852,8 +860,10 @@ static int __devinit snd_opl3sa2_pnp_cdetect(struct pnp_card_link *card,
         int res;
 
         for ( ; dev < SNDRV_CARDS; dev++) {
-                if (!enable[dev] || !isapnp[dev])
-                        continue;
+                if (!enable[dev])
+                        continue;
+                if (is_isapnp_selected(dev))
+                        continue;
                 res = snd_opl3sa2_probe(dev, NULL, card, id);
                 if (res < 0)
                         return res;
diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c
index 411a702d85ba..73573cb1db6a 100644
--- a/sound/isa/opti9xx/opti92x-ad1848.c
+++ b/sound/isa/opti9xx/opti92x-ad1848.c
@@ -1038,8 +1038,7 @@ static int snd_opti93x_capture_prepare(snd_pcm_substream_t *substream)
 
         chip->c_dma_size = size;
         snd_opti93x_out_mask(chip, OPTi93X_IFACE_CONF,
-                OPTi93X_CAPTURE_ENABLE | OPTi93X_CAPTURE_PIO,
-                (unsigned char)~(OPTi93X_CAPTURE_ENABLE | OPTi93X_CAPTURE_PIO));
+                OPTi93X_CAPTURE_ENABLE | OPTi93X_CAPTURE_PIO, 0);
 
         snd_dma_program(chip->dma2, runtime->dma_addr, size,
                 DMA_MODE_READ | DMA_AUTOINIT);
@@ -1274,7 +1273,7 @@ static int snd_opti93x_create(snd_card_t *card, opti9xx_t *chip,
         opti93x_t *codec;
 
         *rcodec = NULL;
-        codec = kcalloc(1, sizeof(*codec), GFP_KERNEL);
+        codec = kzalloc(sizeof(*codec), GFP_KERNEL);
         if (codec == NULL)
                 return -ENOMEM;
         codec->irq = -1;
@@ -1895,8 +1894,8 @@ static void snd_card_opti9xx_free(snd_card_t *card)
         }
 }
 
-static int __devinit snd_card_opti9xx_probe(struct pnp_card_link *pcard,
-                                            const struct pnp_card_device_id *pid)
+static int snd_card_opti9xx_probe(struct pnp_card_link *pcard,
+                                  const struct pnp_card_device_id *pid)
 {
         static long possible_ports[] = {0x530, 0xe80, 0xf40, 0x604, -1};
         static long possible_mpu_ports[] = {0x300, 0x310, 0x320, 0x330, -1};
@@ -1966,6 +1965,10 @@ static int __devinit snd_card_opti9xx_probe(struct pnp_card_link *pcard,
                         snd_card_free(card);
                         return error;
                 }
+                if ((error = snd_card_set_generic_dev(card)) < 0) {
+                        snd_card_free(card);
+                        return error;
+                }
 #ifdef CONFIG_PNP
         }
 #endif  /* CONFIG_PNP */
diff --git a/sound/isa/sb/emu8000.c b/sound/isa/sb/emu8000.c
index 028af4066595..5375705c054b 100644
--- a/sound/isa/sb/emu8000.c
+++ b/sound/isa/sb/emu8000.c
@@ -1097,7 +1097,7 @@ snd_emu8000_new(snd_card_t *card, int index, long port, int seq_ports, snd_seq_d
         if (seq_ports <= 0)
                 return 0;
 
-        hw = kcalloc(1, sizeof(*hw), GFP_KERNEL);
+        hw = kzalloc(sizeof(*hw), GFP_KERNEL);
         if (hw == NULL)
                 return -ENOMEM;
         spin_lock_init(&hw->reg_lock);
diff --git a/sound/isa/sb/emu8000_pcm.c b/sound/isa/sb/emu8000_pcm.c
index db5eb8b55058..0209790dc4b5 100644
--- a/sound/isa/sb/emu8000_pcm.c
+++ b/sound/isa/sb/emu8000_pcm.c
@@ -233,7 +233,7 @@ static int emu8k_pcm_open(snd_pcm_substream_t *subs)
         emu8k_pcm_t *rec;
         snd_pcm_runtime_t *runtime = subs->runtime;
 
-        rec = kcalloc(1, sizeof(*rec), GFP_KERNEL);
+        rec = kzalloc(sizeof(*rec), GFP_KERNEL);
         if (! rec)
                 return -ENOMEM;
 
diff --git a/sound/isa/sb/sb16.c b/sound/isa/sb/sb16.c
index 60e2c53c49fc..7888783d68f5 100644
--- a/sound/isa/sb/sb16.c
+++ b/sound/isa/sb/sb16.c
@@ -351,6 +351,12 @@ static void snd_sb16_free(snd_card_t *card)
         }
 }
 
+#ifdef CONFIG_PNP
+#define is_isapnp_selected(dev)         isapnp[dev]
+#else
+#define is_isapnp_selected(dev)         0
+#endif
+
 static int __init snd_sb16_probe(int dev,
                                  struct pnp_card_link *pcard,
                                  const struct pnp_card_device_id *pid)
@@ -378,10 +384,8 @@ static int __init snd_sb16_probe(int dev,
         card->private_free = snd_sb16_free;
 #ifdef CONFIG_PNP
         if (isapnp[dev]) {
-                if ((err = snd_card_sb16_pnp(dev, acard, pcard, pid))) {
-                        snd_card_free(card);
-                        return err;
-                }
+                if ((err = snd_card_sb16_pnp(dev, acard, pcard, pid)))
+                        goto _err;
                 snd_card_set_dev(card, &pcard->card->dev);
         }
 #endif
@@ -389,41 +393,37 @@ static int __init snd_sb16_probe(int dev,
         xirq = irq[dev];
         xdma8 = dma8[dev];
         xdma16 = dma16[dev];
-#ifdef CONFIG_PNP
-        if (!isapnp[dev]) {
-#endif
-        if (xirq == SNDRV_AUTO_IRQ) {
-                if ((xirq = snd_legacy_find_free_irq(possible_irqs)) < 0) {
-                        snd_card_free(card);
-                        snd_printk(KERN_ERR PFX "unable to find a free IRQ\n");
-                        return -EBUSY;
+        if (! is_isapnp_selected(dev)) {
+                if (xirq == SNDRV_AUTO_IRQ) {
+                        if ((xirq = snd_legacy_find_free_irq(possible_irqs)) < 0) {
+                                snd_printk(KERN_ERR PFX "unable to find a free IRQ\n");
+                                err = -EBUSY;
+                                goto _err;
+                        }
                 }
-        }
-        if (xdma8 == SNDRV_AUTO_DMA) {
-                if ((xdma8 = snd_legacy_find_free_dma(possible_dmas8)) < 0) {
-                        snd_card_free(card);
-                        snd_printk(KERN_ERR PFX "unable to find a free 8-bit DMA\n");
-                        return -EBUSY;
+                if (xdma8 == SNDRV_AUTO_DMA) {
+                        if ((xdma8 = snd_legacy_find_free_dma(possible_dmas8)) < 0) {
+                                snd_printk(KERN_ERR PFX "unable to find a free 8-bit DMA\n");
+                                err = -EBUSY;
+                                goto _err;
+                        }
                 }
-        }
-        if (xdma16 == SNDRV_AUTO_DMA) {
-                if ((xdma16 = snd_legacy_find_free_dma(possible_dmas16)) < 0) {
-                        snd_card_free(card);
-                        snd_printk(KERN_ERR PFX "unable to find a free 16-bit DMA\n");
-                        return -EBUSY;
+                if (xdma16 == SNDRV_AUTO_DMA) {
+                        if ((xdma16 = snd_legacy_find_free_dma(possible_dmas16)) < 0) {
+                                snd_printk(KERN_ERR PFX "unable to find a free 16-bit DMA\n");
+                                err = -EBUSY;
+                                goto _err;
+                        }
                 }
-        }
-        /* non-PnP FM port address is hardwired with base port address */
-        fm_port[dev] = port[dev];
-        /* block the 0x388 port to avoid PnP conflicts */
-        acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
+                /* non-PnP FM port address is hardwired with base port address */
+                fm_port[dev] = port[dev];
+                /* block the 0x388 port to avoid PnP conflicts */
+                acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
 #ifdef SNDRV_SBAWE_EMU8000
-        /* non-PnP AWE port address is hardwired with base port address */
-        awe_port[dev] = port[dev] + 0x400;
+                /* non-PnP AWE port address is hardwired with base port address */
+                awe_port[dev] = port[dev] + 0x400;
 #endif
-#ifdef CONFIG_PNP
         }
-#endif
 
         if ((err = snd_sbdsp_create(card,
                                     port[dev],
@@ -432,28 +432,20 @@ static int __init snd_sb16_probe(int dev,
                                     xdma8,
                                     xdma16,
                                     SB_HW_AUTO,
-                                    &chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                    &chip)) < 0)
+                goto _err;
+
         if (chip->hardware != SB_HW_16) {
-                snd_card_free(card);
-                snd_printdd("SB 16 chip was not detected at 0x%lx\n", port[dev]);
-                return -ENODEV;
+                snd_printk(KERN_ERR PFX "SB 16 chip was not detected at 0x%lx\n", port[dev]);
+                err = -ENODEV;
+                goto _err;
         }
         chip->mpu_port = mpu_port[dev];
-#ifdef CONFIG_PNP
-        if (!isapnp[dev] && (err = snd_sb16dsp_configure(chip)) < 0) {
-#else
-        if ((err = snd_sb16dsp_configure(chip)) < 0) {
-#endif
-                snd_card_free(card);
-                return -ENXIO;
-        }
-        if ((err = snd_sb16dsp_pcm(chip, 0, NULL)) < 0) {
-                snd_card_free(card);
-                return -ENXIO;
-        }
+        if (! is_isapnp_selected(dev) && (err = snd_sb16dsp_configure(chip)) < 0)
+                goto _err;
+
+        if ((err = snd_sb16dsp_pcm(chip, 0, NULL)) < 0)
+                goto _err;
 
         strcpy(card->driver,
 #ifdef SNDRV_SBAWE_EMU8000
@@ -474,10 +466,8 @@ static int __init snd_sb16_probe(int dev,
         if (chip->mpu_port > 0 && chip->mpu_port != SNDRV_AUTO_PORT) {
                 if ((err = snd_mpu401_uart_new(card, 0, MPU401_HW_SB,
                                                chip->mpu_port, 0,
-                                               xirq, 0, &chip->rmidi)) < 0) {
-                        snd_card_free(card);
-                        return -ENXIO;
-                }
+                                               xirq, 0, &chip->rmidi)) < 0)
+                        goto _err;
                 chip->rmidi_callback = snd_mpu401_uart_interrupt;
         }
 
@@ -499,17 +489,13 @@ static int __init snd_sb16_probe(int dev,
 #else
                         int seqdev = 1;
 #endif
-                        if ((err = snd_opl3_hwdep_new(opl3, 0, seqdev, &synth)) < 0) {
-                                snd_card_free(card);
-                                return -ENXIO;
-                        }
+                        if ((err = snd_opl3_hwdep_new(opl3, 0, seqdev, &synth)) < 0)
+                                goto _err;
                 }
         }
 
-        if ((err = snd_sbmixer_new(chip)) < 0) {
-                snd_card_free(card);
-                return -ENXIO;
-        }
+        if ((err = snd_sbmixer_new(chip)) < 0)
+                goto _err;
 
 #ifdef CONFIG_SND_SB16_CSP
         /* CSP chip on SB16ASP/AWE32 */
@@ -525,11 +511,11 @@ static int __init snd_sb16_probe(int dev,
 #endif
 #ifdef SNDRV_SBAWE_EMU8000
         if (awe_port[dev] > 0) {
-                if (snd_emu8000_new(card, 1, awe_port[dev],
-                                    seq_ports[dev], NULL) < 0) {
+                if ((err = snd_emu8000_new(card, 1, awe_port[dev],
+                                           seq_ports[dev], NULL)) < 0) {
                         snd_printk(KERN_ERR PFX "fatal error - EMU-8000 synthesizer not detected at 0x%lx\n", awe_port[dev]);
-                        snd_card_free(card);
-                        return -ENXIO;
+
+                        goto _err;
                 }
         }
 #endif
@@ -541,15 +527,21 @@ static int __init snd_sb16_probe(int dev,
                 (mic_agc[dev] ? 0x00 : 0x01));
         spin_unlock_irqrestore(&chip->mixer_lock, flags);
 
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
+
         if (pcard)
                 pnp_set_card_drvdata(pcard, card);
         else
                 snd_sb16_legacy[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __init snd_sb16_probe_legacy_port(unsigned long xport)
@@ -560,10 +552,8 @@ static int __init snd_sb16_probe_legacy_port(unsigned long xport)
         for ( ; dev < SNDRV_CARDS; dev++) {
                 if (!enable[dev] || port[dev] != SNDRV_AUTO_PORT)
                         continue;
-#ifdef CONFIG_PNP
-                if (isapnp[dev])
+                if (is_isapnp_selected(dev))
                         continue;
-#endif
                 port[dev] = xport;
                 res = snd_sb16_probe(dev, NULL, NULL);
                 if (res < 0)
@@ -621,10 +611,8 @@ static int __init alsa_card_sb16_init(void)
         for (dev = 0; dev < SNDRV_CARDS; dev++) {
                 if (!enable[dev] || port[dev] == SNDRV_AUTO_PORT)
                         continue;
-#ifdef CONFIG_PNP
-                if (isapnp[dev])
+                if (is_isapnp_selected(dev))
                         continue;
-#endif
                 if (!snd_sb16_probe(dev, NULL, NULL)) {
                         cards++;
                         continue;
diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c
index d64790bcd831..7192d4c758e6 100644
--- a/sound/isa/sb/sb16_csp.c
+++ b/sound/isa/sb/sb16_csp.c
@@ -122,7 +122,7 @@ int snd_sb_csp_new(sb_t *chip, int device, snd_hwdep_t ** rhwdep)
         if ((err = snd_hwdep_new(chip->card, "SB16-CSP", device, &hw)) < 0)
                 return err;
 
-        if ((p = kcalloc(1, sizeof(*p), GFP_KERNEL)) == NULL) {
+        if ((p = kzalloc(sizeof(*p), GFP_KERNEL)) == NULL) {
                 snd_device_free(chip->card, hw);
                 return -ENOMEM;
         }
diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c
index e2cbc4202b3d..c41ac25e85ca 100644
--- a/sound/isa/sb/sb8.c
+++ b/sound/isa/sb/sb8.c
@@ -107,54 +107,47 @@ static int __init snd_sb8_probe(int dev)
                                     dma8[dev],
                                     -1,
                                     SB_HW_AUTO,
-                                    &chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                    &chip)) < 0)
+                goto _err;
+
         if (chip->hardware >= SB_HW_16) {
-                snd_card_free(card);
                 if (chip->hardware == SB_HW_ALS100)
-                        snd_printdd("ALS100 chip detected at 0x%lx, try snd-als100 module\n",
+                        snd_printk(KERN_WARNING "ALS100 chip detected at 0x%lx, try snd-als100 module\n",
                                     port[dev]);
                 else
-                        snd_printdd("SB 16 chip detected at 0x%lx, try snd-sb16 module\n",
-                                    port[dev]);
-                return -ENODEV;
+                        snd_printk(KERN_WARNING "SB 16 chip detected at 0x%lx, try snd-sb16 module\n",
+                                   port[dev]);
+                err = -ENODEV;
+                goto _err;
         }
 
-        if ((err = snd_sb8dsp_pcm(chip, 0, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
-        if ((err = snd_sbmixer_new(chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_sb8dsp_pcm(chip, 0, NULL)) < 0)
+                goto _err;
+
+        if ((err = snd_sbmixer_new(chip)) < 0)
+                goto _err;
+
         if (chip->hardware == SB_HW_10 || chip->hardware == SB_HW_20) {
                 if ((err = snd_opl3_create(card, chip->port + 8, 0,
                                            OPL3_HW_AUTO, 1,
                                            &opl3)) < 0) {
-                        snd_printk(KERN_ERR "sb8: no OPL device at 0x%lx\n", chip->port + 8);
+                        snd_printk(KERN_WARNING "sb8: no OPL device at 0x%lx\n", chip->port + 8);
                 }
         } else {
                 if ((err = snd_opl3_create(card, chip->port, chip->port + 2,
                                            OPL3_HW_AUTO, 1,
                                            &opl3)) < 0) {
-                        snd_printk(KERN_ERR "sb8: no OPL device at 0x%lx-0x%lx\n",
+                        snd_printk(KERN_WARNING "sb8: no OPL device at 0x%lx-0x%lx\n",
                                    chip->port, chip->port + 2);
                 }
         }
         if (err >= 0) {
-                if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0) {
-                        snd_card_free(card);
-                        return err;
-                }
+                if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0)
+                        goto _err;
         }
 
-        if ((err = snd_sb8dsp_midi(chip, 0, NULL)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_sb8dsp_midi(chip, 0, NULL)) < 0)
+                goto _err;
 
         strcpy(card->driver, chip->hardware == SB_HW_PRO ? "SB Pro" : "SB8");
         strcpy(card->shortname, chip->name);
@@ -162,12 +155,19 @@ static int __init snd_sb8_probe(int dev)
                 chip->name,
                 chip->port,
                 irq[dev], dma8[dev]);
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
+
         snd_sb8_cards[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __init snd_card_sb8_legacy_auto_probe(unsigned long xport)
diff --git a/sound/isa/sb/sb_common.c b/sound/isa/sb/sb_common.c
index 5b6bde213ea0..f0f205ae425f 100644
--- a/sound/isa/sb/sb_common.c
+++ b/sound/isa/sb/sb_common.c
@@ -221,7 +221,7 @@ int snd_sbdsp_create(snd_card_t *card,
 
         snd_assert(r_chip != NULL, return -EINVAL);
         *r_chip = NULL;
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
         spin_lock_init(&chip->reg_lock);
diff --git a/sound/isa/sgalaxy.c b/sound/isa/sgalaxy.c
index 17f585b0ddc1..52f2294da62b 100644
--- a/sound/isa/sgalaxy.c
+++ b/sound/isa/sgalaxy.c
@@ -67,6 +67,8 @@ MODULE_PARM_DESC(dma1, "DMA1 # for Sound Galaxy driver.");
 
 static snd_card_t *snd_sgalaxy_cards[SNDRV_CARDS] = SNDRV_DEFAULT_PTR;
 
+#define PFX     "sgalaxy: "
+
 /*
 
  */
@@ -135,7 +137,7 @@ static int __init snd_sgalaxy_setup_wss(unsigned long port, int irq, int dma)
         }
 
 #if 0
-        snd_printdd("sgalaxy - setting up IRQ/DMA for WSS\n");
+        snd_printdd(PFX "setting up IRQ/DMA for WSS\n");
 #endif
 
         /* initialize IRQ for WSS codec */
@@ -160,7 +162,7 @@ static int __init snd_sgalaxy_setup_wss(unsigned long port, int irq, int dma)
 static int __init snd_sgalaxy_detect(int dev, int irq, int dma)
 {
 #if 0
-        snd_printdd("sgalaxy - switching to WSS mode\n");
+        snd_printdd(PFX "switching to WSS mode\n");
 #endif
 
         /* switch to WSS mode */
@@ -223,11 +225,11 @@ static int __init snd_sgalaxy_probe(int dev)
         ad1848_t *chip;
 
         if (sbport[dev] == SNDRV_AUTO_PORT) {
-                snd_printk("specify SB port\n");
+                snd_printk(KERN_ERR PFX "specify SB port\n");
                 return -EINVAL;
         }
         if (wssport[dev] == SNDRV_AUTO_PORT) {
-                snd_printk("specify WSS port\n");
+                snd_printk(KERN_ERR PFX "specify WSS port\n");
                 return -EINVAL;
         }
         card = snd_card_new(index[dev], id[dev], THIS_MODULE, 0);
@@ -237,46 +239,39 @@ static int __init snd_sgalaxy_probe(int dev)
         xirq = irq[dev];
         if (xirq == SNDRV_AUTO_IRQ) {
                 if ((xirq = snd_legacy_find_free_irq(possible_irqs)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free IRQ\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free IRQ\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
         xdma1 = dma1[dev];
         if (xdma1 == SNDRV_AUTO_DMA) {
                 if ((xdma1 = snd_legacy_find_free_dma(possible_dmas)) < 0) {
-                        snd_card_free(card);
-                        snd_printk("unable to find a free DMA\n");
-                        return -EBUSY;
+                        snd_printk(KERN_ERR PFX "unable to find a free DMA\n");
+                        err = -EBUSY;
+                        goto _err;
                 }
         }
 
-        if ((err = snd_sgalaxy_detect(dev, xirq, xdma1)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_sgalaxy_detect(dev, xirq, xdma1)) < 0)
+                goto _err;
 
         if ((err = snd_ad1848_create(card, wssport[dev] + 4,
                                      xirq, xdma1,
-                                     AD1848_HW_DETECT, &chip)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+                                     AD1848_HW_DETECT, &chip)) < 0)
+                goto _err;
 
         if ((err = snd_ad1848_pcm(chip, 0, NULL)) < 0) {
-                snd_printdd("sgalaxy - error creating new ad1848 PCM device\n");
-                snd_card_free(card);
-                return err;
+                snd_printdd(PFX "error creating new ad1848 PCM device\n");
+                goto _err;
         }
         if ((err = snd_ad1848_mixer(chip)) < 0) {
-                snd_printdd("sgalaxy - error creating new ad1848 mixer\n");
-                snd_card_free(card);
-                return err;
+                snd_printdd(PFX "error creating new ad1848 mixer\n");
+                goto _err;
         }
-        if (snd_sgalaxy_mixer(chip) < 0) {
-                snd_printdd("sgalaxy - the mixer rewrite failed\n");
-                snd_card_free(card);
-                return err;
+        if ((err = snd_sgalaxy_mixer(chip)) < 0) {
+                snd_printdd(PFX "the mixer rewrite failed\n");
+                goto _err;
         }
 
         strcpy(card->driver, "Sound Galaxy");
@@ -284,12 +279,18 @@ static int __init snd_sgalaxy_probe(int dev)
         sprintf(card->longname, "Sound Galaxy at 0x%lx, irq %d, dma %d",
                 wssport[dev], xirq, xdma1);
 
-        if ((err = snd_card_register(card)) < 0) {
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
+
         snd_sgalaxy_cards[dev] = card;
         return 0;
+
+ _err:
+        snd_card_free(card);
+        return err;
 }
 
 static int __init alsa_card_sgalaxy_init(void)
diff --git a/sound/isa/sscape.c b/sound/isa/sscape.c
index 3959ed694eec..9f6b58c79209 100644
--- a/sound/isa/sscape.c
+++ b/sound/isa/sscape.c
@@ -1262,11 +1262,6 @@ static int __devinit create_sscape(const struct params *params, snd_card_t **rca
          */
         sscape_write(sscape, GA_INTENA_REG, 0x80);
 
-        if ((err = snd_card_register(card)) < 0) {
-                printk(KERN_ERR "sscape: Failed to register sound card\n");
-                goto _release_card;
-        }
-
         /*
          * Initialize mixer
          */
@@ -1396,6 +1391,13 @@ static int __devinit sscape_pnp_detect(struct pnp_card_link *pcard,
                         if (ret < 0)
                                 return ret;
                         snd_card_set_dev(card, &pcard->card->dev);
+
+                        if ((ret = snd_card_register(card)) < 0) {
+                                printk(KERN_ERR "sscape: Failed to register sound card\n");
+                                snd_card_free(card);
+                                return ret;
+                        }
+
                         pnp_set_card_drvdata(pcard, card);
                         ++sscape_cards;
                         ++idx;
@@ -1460,6 +1462,16 @@ static int __init sscape_manual_probe(struct params *params)
                 if (ret < 0)
                         return ret;
 
+                if ((ret = snd_card_set_generic_dev(card)) < 0) {
+                        snd_card_free(card);
+                        return ret;
+                }
+                if ((ret = snd_card_register(card)) < 0) {
+                        printk(KERN_ERR "sscape: Failed to register sound card\n");
+                        snd_card_free(card);
+                        return ret;
+                }
+
                 sscape_card[sscape_cards] = card;
                 params++;
                 sscape_cards++;
diff --git a/sound/isa/wavefront/wavefront.c b/sound/isa/wavefront/wavefront.c
index 79b022070ba3..0a572e0a47e6 100644
--- a/sound/isa/wavefront/wavefront.c
+++ b/sound/isa/wavefront/wavefront.c
@@ -622,6 +622,11 @@ snd_wavefront_probe (int dev, struct pnp_card_link *pcard,
                  ics2115_port[dev],
                  ics2115_irq[dev]);
 
+        if ((err = snd_card_set_generic_dev(card)) < 0) {
+                snd_card_free(card);
+                return err;
+        }
+
         if ((err = snd_card_register(card)) < 0) {
                 snd_card_free(card);
                 return err;
diff --git a/sound/mips/Kconfig b/sound/mips/Kconfig
index 531f8ba96a71..2433b7727404 100644
--- a/sound/mips/Kconfig
+++ b/sound/mips/Kconfig
@@ -8,6 +8,7 @@ config SND_AU1X00
         depends on (SOC_AU1000 || SOC_AU1100 || SOC_AU1500) && SND
         select SND_PCM
         select SND_AC97_CODEC
+        select SND_GENERIC_DRIVER
         help
           ALSA Sound driver for the Au1x00's AC97 port.
 
diff --git a/sound/mips/au1x00.c b/sound/mips/au1x00.c
index c20522b02134..3f9684f1d1d2 100644
--- a/sound/mips/au1x00.c
+++ b/sound/mips/au1x00.c
@@ -667,6 +667,11 @@ au1000_init(void)
         strcpy(au1000->card->shortname, "Au1000-AC97");
         sprintf(au1000->card->longname, "AMD Au1000--AC97 ALSA Driver");
 
+        if ((err = snd_card_set_generic_dev(au1000->card)) < 0) {
+                snd_card_free(au1000->card);
+                return err;
+        }
+
         if ((err = snd_card_register(au1000->card)) < 0) {
                 snd_card_free(au1000->card);
                 return err;
diff --git a/sound/oss/au1000.c b/sound/oss/au1000.c
index 4491733c9e4e..2c2ae2ee01ac 100644
--- a/sound/oss/au1000.c
+++ b/sound/oss/au1000.c
@@ -1295,7 +1295,7 @@ static int au1000_mmap(struct file *file, struct vm_area_struct *vma)
         unsigned long   size;
         int ret = 0;
 
-        dbg(__FUNCTION__);
+        dbg("%s", __FUNCTION__);
     
         lock_kernel();
         down(&s->sem);
diff --git a/sound/oss/ite8172.c b/sound/oss/ite8172.c
index 58f879fda975..26e5944b6ba8 100644
--- a/sound/oss/ite8172.c
+++ b/sound/oss/ite8172.c
@@ -1859,7 +1859,7 @@ static int it8172_release(struct inode *inode, struct file *file)
         struct it8172_state *s = (struct it8172_state *)file->private_data;
 
 #ifdef IT8172_VERBOSE_DEBUG
-        dbg(__FUNCTION__);
+        dbg("%s", __FUNCTION__);
 #endif
         lock_kernel();
         if (file->f_mode & FMODE_WRITE)
diff --git a/sound/parisc/harmony.c b/sound/parisc/harmony.c
index d7a8f9f5896f..f560dd8cdb90 100644
--- a/sound/parisc/harmony.c
+++ b/sound/parisc/harmony.c
@@ -880,6 +880,8 @@ snd_harmony_create(snd_card_t *card,
                 goto free_and_ret;
         }
 
+        snd_card_set_dev(card, &padev->dev);
+
         *rchip = h;
 
         return 0;
diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
index 1e458919cce6..a5d593c66f9f 100644
--- a/sound/pci/Kconfig
+++ b/sound/pci/Kconfig
@@ -316,6 +316,18 @@ config SND_YMFPCI
           To compile this driver as a module, choose M here: the module
           will be called snd-ymfpci.
 
+config SND_AD1889
+        tristate "Analog Devices AD1889"
+        depends on SND
+        select SND_AC97_CODEC
+        help
+          Say Y here to include support for the integrated AC97 sound
+          device found in particular on the Hewlett-Packard [BCJ]-xxx0
+          class PA-RISC workstations, using the AD1819 codec.
+
+          To compile this as a module, choose M here: the module
+          will be called snd-ad1889.
+
 config SND_ALS4000
         tristate "Avance Logic ALS4000"
         depends on SND && ISA_DMA_API
diff --git a/sound/pci/Makefile b/sound/pci/Makefile
index b40575c3349a..42fabfcfc2a9 100644
--- a/sound/pci/Makefile
+++ b/sound/pci/Makefile
@@ -3,6 +3,7 @@
 # Copyright (c) 2001 by Jaroslav Kysela <perex@suse.cz>
 #
 
+snd-ad1889-objs := ad1889.o
 snd-als4000-objs := als4000.o
 snd-atiixp-objs := atiixp.o
 snd-atiixp-modem-objs := atiixp_modem.o
@@ -25,6 +26,7 @@ snd-via82xx-objs := via82xx.o
 snd-via82xx-modem-objs := via82xx_modem.o
 
 # Toplevel Module Dependency
+obj-$(CONFIG_SND_AD1889) += snd-ad1889.o
 obj-$(CONFIG_SND_ALS4000) += snd-als4000.o
 obj-$(CONFIG_SND_ATIIXP) += snd-atiixp.o
 obj-$(CONFIG_SND_ATIIXP_MODEM) += snd-atiixp-modem.o
diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
index 5501f4440c92..e64cb07a39c2 100644
--- a/sound/pci/ac97/ac97_codec.c
+++ b/sound/pci/ac97/ac97_codec.c
@@ -112,6 +112,7 @@ static const ac97_codec_id_t snd_ac97_codec_ids[] = {
 { 0x414c4723, 0xffffffff, "ALC650F",            NULL,   NULL }, /* already patched */
 { 0x414c4720, 0xfffffff0, "ALC650",             patch_alc650,   NULL },
 { 0x414c4760, 0xfffffff0, "ALC655",             patch_alc655,   NULL },
+{ 0x414c4781, 0xffffffff, "ALC658D",            NULL,   NULL }, /* already patched */
 { 0x414c4780, 0xfffffff0, "ALC658",             patch_alc655,   NULL },
 { 0x414c4790, 0xfffffff0, "ALC850",             patch_alc850,   NULL },
 { 0x414c4730, 0xffffffff, "ALC101",             NULL,           NULL },
@@ -1796,7 +1797,7 @@ int snd_ac97_bus(snd_card_t *card, int num, ac97_bus_ops_t *ops,
 
         snd_assert(card != NULL, return -EINVAL);
         snd_assert(rbus != NULL, return -EINVAL);
-        bus = kcalloc(1, sizeof(*bus), GFP_KERNEL);
+        bus = kzalloc(sizeof(*bus), GFP_KERNEL);
         if (bus == NULL)
                 return -ENOMEM;
         bus->card = card;
@@ -1905,7 +1906,7 @@ int snd_ac97_mixer(ac97_bus_t *bus, ac97_template_t *template, ac97_t **rac97)
         }
 
         card = bus->card;
-        ac97 = kcalloc(1, sizeof(*ac97), GFP_KERNEL);
+        ac97 = kzalloc(sizeof(*ac97), GFP_KERNEL);
         if (ac97 == NULL)
                 return -ENOMEM;
         ac97->private_data = template->private_data;
diff --git a/sound/pci/ac97/ac97_id.h b/sound/pci/ac97/ac97_id.h
index dadf387ad0b8..6d73514dc49e 100644
--- a/sound/pci/ac97/ac97_id.h
+++ b/sound/pci/ac97/ac97_id.h
@@ -52,6 +52,7 @@
 #define AC97_ID_ALC650F         0x414c4723
 #define AC97_ID_ALC655          0x414c4760
 #define AC97_ID_ALC658          0x414c4780
+#define AC97_ID_ALC658D         0x414c4781
 #define AC97_ID_ALC850          0x414c4790
 #define AC97_ID_YMF753          0x594d4803
 #define AC97_ID_VT1616          0x49434551
diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
index b584172c1104..045ddc743edc 100644
--- a/sound/pci/ac97/ac97_patch.c
+++ b/sound/pci/ac97/ac97_patch.c
@@ -2134,7 +2134,13 @@ int patch_alc655(ac97_t * ac97)
 {
         unsigned int val;
 
-        ac97->spec.dev_flags = (ac97->id == 0x414c4780); /* ALC658 */
+        if (ac97->id == AC97_ID_ALC658) {
+                ac97->spec.dev_flags = 1; /* ALC658 */
+                if ((snd_ac97_read(ac97, AC97_ALC650_REVISION) & 0x3f) == 2) {
+                        ac97->id = AC97_ID_ALC658D;
+                        ac97->spec.dev_flags = 2;
+                }
+        }
 
         ac97->build_ops = &patch_alc655_ops;
 
@@ -2143,10 +2149,15 @@ int patch_alc655(ac97_t * ac97)
 
         /* adjust default values */
         val = snd_ac97_read(ac97, 0x7a); /* misc control */
-        if (ac97->id == 0x414c4780) /* ALC658 */
+        if (ac97->spec.dev_flags) /* ALC658 */
                 val &= ~(1 << 1); /* Pin 47 is spdif input pin */
-        else /* ALC655 */
-                val |= (1 << 1); /* Pin 47 is spdif input pin */
+        else { /* ALC655 */
+                if (ac97->subsystem_vendor == 0x1462 &&
+                    ac97->subsystem_device == 0x0131) /* MSI S270 laptop */
+                        val &= ~(1 << 1); /* Pin 47 is EAPD (for internal speaker) */
+                else
+                        val |= (1 << 1); /* Pin 47 is spdif input pin */
+        }
         val &= ~(1 << 12); /* vref enable */
         snd_ac97_write_cache(ac97, 0x7a, val);
         /* set default: spdif-in enabled,
@@ -2159,6 +2170,11 @@ int patch_alc655(ac97_t * ac97)
         /* full DAC volume */
         snd_ac97_write_cache(ac97, AC97_ALC650_SURR_DAC_VOL, 0x0808);
         snd_ac97_write_cache(ac97, AC97_ALC650_LFE_DAC_VOL, 0x0808);
+
+        /* update undocumented bit... */
+        if (ac97->id == AC97_ID_ALC658D)
+                snd_ac97_update_bits(ac97, 0x74, 0x0800, 0x0800);
+
         return 0;
 }
 
diff --git a/sound/pci/ac97/ak4531_codec.c b/sound/pci/ac97/ak4531_codec.c
index f9ce0fd2f52f..4032c5748370 100644
--- a/sound/pci/ac97/ak4531_codec.c
+++ b/sound/pci/ac97/ak4531_codec.c
@@ -357,7 +357,7 @@ int snd_ak4531_mixer(snd_card_t * card, ak4531_t * _ak4531, ak4531_t ** rak4531)
         snd_assert(rak4531 != NULL, return -EINVAL);
         *rak4531 = NULL;
         snd_assert(card != NULL && _ak4531 != NULL, return -EINVAL);
-        ak4531 = kcalloc(1, sizeof(*ak4531), GFP_KERNEL);
+        ak4531 = kzalloc(sizeof(*ak4531), GFP_KERNEL);
         if (ak4531 == NULL)
                 return -ENOMEM;
         *ak4531 = *_ak4531;
diff --git a/sound/pci/ad1889.c b/sound/pci/ad1889.c
new file mode 100644
index 000000000000..d7d99a25c5e5
--- /dev/null
+++ b/sound/pci/ad1889.c
@@ -0,0 +1,1090 @@
+/* Analog Devices 1889 audio driver
+ *
+ * This is a driver for the AD1889 PCI audio chipset found
+ * on the HP PA-RISC [BCJ]-xxx0 workstations.
+ *
+ * Copyright (C) 2004-2005, Kyle McMartin <kyle@parisc-linux.org>
+ * Copyright (C) 2005, Thibaut Varene <varenet@parisc-linux.org>
+ *   Based on the OSS AD1889 driver by Randolph Chung <tausq@debian.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ * TODO:
+ *      Do we need to take care of CCS register?
+ *      Maybe we could use finer grained locking (separate locks for pb/cap)?
+ * Wishlist:
+ *      Control Interface (mixer) support
+ *      Better AC97 support (VSR...)?
+ *      PM support
+ *      MIDI support
+ *      Game Port support
+ *      SG DMA support (this will need *alot* of work)
+ */
+
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/compiler.h>
+#include <linux/delay.h>
+
+#include <sound/driver.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/initval.h>
+#include <sound/ac97_codec.h>
+
+#include <asm/io.h>
+
+#include "ad1889.h"
+#include "ac97/ac97_id.h"
+
+#define AD1889_DRVVER   "$Revision: 1.3 $"
+
+MODULE_AUTHOR("Kyle McMartin <kyle@parisc-linux.org>, Thibaut Varene <t-bone@parisc-linux.org>");
+MODULE_DESCRIPTION("Analog Devices AD1889 ALSA sound driver");
+MODULE_LICENSE("GPL");
+MODULE_SUPPORTED_DEVICE("{{Analog Devices,AD1889}}");
+
+static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;
+module_param_array(index, int, NULL, 0444);
+MODULE_PARM_DESC(index, "Index value for the AD1889 soundcard.");
+
+static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;
+module_param_array(id, charp, NULL, 0444);
+MODULE_PARM_DESC(id, "ID string for the AD1889 soundcard.");
+
+static int enable[SNDRV_CARDS] = SNDRV_DEFAULT_ENABLE_PNP;
+module_param_array(enable, bool, NULL, 0444);
+MODULE_PARM_DESC(enable, "Enable AD1889 soundcard.");
+
+static char *ac97_quirk[SNDRV_CARDS];
+module_param_array(ac97_quirk, charp, NULL, 0444);
+MODULE_PARM_DESC(ac97_quirk, "AC'97 workaround for strange hardware.");
+
+#define DEVNAME "ad1889"
+#define PFX     DEVNAME ": "
+
+/* let's use the global sound debug interfaces */
+#define ad1889_debug(fmt, arg...) snd_printd(KERN_DEBUG fmt, ## arg)
+
+/* keep track of some hw registers */
+struct ad1889_register_state {
+        u16 reg;        /* reg setup */
+        u32 addr;       /* dma base address */
+        unsigned long size;     /* DMA buffer size */
+};
+
+struct snd_ad1889 {
+        snd_card_t *card;
+        struct pci_dev *pci;
+
+        int irq;
+        unsigned long bar;
+        void __iomem *iobase;
+
+        ac97_t *ac97;
+        ac97_bus_t *ac97_bus;
+        snd_pcm_t *pcm;
+        snd_info_entry_t *proc;
+
+        snd_pcm_substream_t *psubs;
+        snd_pcm_substream_t *csubs;
+
+        /* playback register state */
+        struct ad1889_register_state wave;
+        struct ad1889_register_state ramc;
+
+        spinlock_t lock;
+};
+
+static inline u16
+ad1889_readw(struct snd_ad1889 *chip, unsigned reg)
+{
+        return readw(chip->iobase + reg);
+}
+
+static inline void
+ad1889_writew(struct snd_ad1889 *chip, unsigned reg, u16 val)
+{
+        writew(val, chip->iobase + reg);
+}
+
+static inline u32
+ad1889_readl(struct snd_ad1889 *chip, unsigned reg)
+{
+        return readl(chip->iobase + reg);
+}
+
+static inline void
+ad1889_writel(struct snd_ad1889 *chip, unsigned reg, u32 val)
+{
+        writel(val, chip->iobase + reg);
+}
+
+static inline void
+ad1889_unmute(struct snd_ad1889 *chip)
+{
+        u16 st;
+        st = ad1889_readw(chip, AD_DS_WADA) & 
+                ~(AD_DS_WADA_RWAM | AD_DS_WADA_LWAM);
+        ad1889_writew(chip, AD_DS_WADA, st);
+        ad1889_readw(chip, AD_DS_WADA);
+}
+
+static inline void
+ad1889_mute(struct snd_ad1889 *chip)
+{
+        u16 st;
+        st = ad1889_readw(chip, AD_DS_WADA) | AD_DS_WADA_RWAM | AD_DS_WADA_LWAM;
+        ad1889_writew(chip, AD_DS_WADA, st);
+        ad1889_readw(chip, AD_DS_WADA);
+}
+
+static inline void
+ad1889_load_adc_buffer_address(struct snd_ad1889 *chip, u32 address)
+{
+        ad1889_writel(chip, AD_DMA_ADCBA, address);
+        ad1889_writel(chip, AD_DMA_ADCCA, address);
+}
+
+static inline void
+ad1889_load_adc_buffer_count(struct snd_ad1889 *chip, u32 count)
+{
+        ad1889_writel(chip, AD_DMA_ADCBC, count);
+        ad1889_writel(chip, AD_DMA_ADCCC, count);
+}
+
+static inline void
+ad1889_load_adc_interrupt_count(struct snd_ad1889 *chip, u32 count)
+{
+        ad1889_writel(chip, AD_DMA_ADCIB, count);
+        ad1889_writel(chip, AD_DMA_ADCIC, count);
+}
+
+static inline void
+ad1889_load_wave_buffer_address(struct snd_ad1889 *chip, u32 address)
+{
+        ad1889_writel(chip, AD_DMA_WAVBA, address);
+        ad1889_writel(chip, AD_DMA_WAVCA, address);
+}
+
+static inline void
+ad1889_load_wave_buffer_count(struct snd_ad1889 *chip, u32 count)
+{
+        ad1889_writel(chip, AD_DMA_WAVBC, count);
+        ad1889_writel(chip, AD_DMA_WAVCC, count);
+}
+
+static inline void
+ad1889_load_wave_interrupt_count(struct snd_ad1889 *chip, u32 count)
+{
+        ad1889_writel(chip, AD_DMA_WAVIB, count);
+        ad1889_writel(chip, AD_DMA_WAVIC, count);
+}
+
+static void
+ad1889_channel_reset(struct snd_ad1889 *chip, unsigned int channel)
+{
+        u16 reg;
+        
+        if (channel & AD_CHAN_WAV) {
+                /* Disable wave channel */
+                reg = ad1889_readw(chip, AD_DS_WSMC) & ~AD_DS_WSMC_WAEN;
+                ad1889_writew(chip, AD_DS_WSMC, reg);
+                chip->wave.reg = reg;
+                
+                /* disable IRQs */
+                reg = ad1889_readw(chip, AD_DMA_WAV);
+                reg &= AD_DMA_IM_DIS;
+                reg &= ~AD_DMA_LOOP;
+                ad1889_writew(chip, AD_DMA_WAV, reg);
+
+                /* clear IRQ and address counters and pointers */
+                ad1889_load_wave_buffer_address(chip, 0x0);
+                ad1889_load_wave_buffer_count(chip, 0x0);
+                ad1889_load_wave_interrupt_count(chip, 0x0);
+
+                /* flush */
+                ad1889_readw(chip, AD_DMA_WAV);
+        }
+        
+        if (channel & AD_CHAN_ADC) {
+                /* Disable ADC channel */
+                reg = ad1889_readw(chip, AD_DS_RAMC) & ~AD_DS_RAMC_ADEN;
+                ad1889_writew(chip, AD_DS_RAMC, reg);
+                chip->ramc.reg = reg;
+
+                reg = ad1889_readw(chip, AD_DMA_ADC);
+                reg &= AD_DMA_IM_DIS;
+                reg &= ~AD_DMA_LOOP;
+                ad1889_writew(chip, AD_DMA_ADC, reg);
+        
+                ad1889_load_adc_buffer_address(chip, 0x0);
+                ad1889_load_adc_buffer_count(chip, 0x0);
+                ad1889_load_adc_interrupt_count(chip, 0x0);
+
+                /* flush */
+                ad1889_readw(chip, AD_DMA_ADC);
+        }
+}
+
+static inline u16
+snd_ad1889_ac97_read(ac97_t *ac97, unsigned short reg)
+{
+        struct snd_ad1889 *chip = ac97->private_data;
+        return ad1889_readw(chip, AD_AC97_BASE + reg);
+}
+
+static inline void
+snd_ad1889_ac97_write(ac97_t *ac97, unsigned short reg, unsigned short val)
+{
+        struct snd_ad1889 *chip = ac97->private_data;
+        ad1889_writew(chip, AD_AC97_BASE + reg, val);
+}
+
+static int
+snd_ad1889_ac97_ready(struct snd_ad1889 *chip)
+{
+        int retry = 400; /* average needs 352 msec */
+        
+        while (!(ad1889_readw(chip, AD_AC97_ACIC) & AD_AC97_ACIC_ACRDY) 
+                        && --retry)
+                mdelay(1);
+        if (!retry) {
+                snd_printk(KERN_ERR PFX "[%s] Link is not ready.\n",
+                       __FUNCTION__);
+                return -EIO;
+        }
+        ad1889_debug("[%s] ready after %d ms\n", __FUNCTION__, 400 - retry);
+
+        return 0;
+}
+
+static int 
+snd_ad1889_hw_params(snd_pcm_substream_t *substream,
+                        snd_pcm_hw_params_t *hw_params)
+{
+        return snd_pcm_lib_malloc_pages(substream, 
+                                        params_buffer_bytes(hw_params));
+}
+
+static int
+snd_ad1889_hw_free(snd_pcm_substream_t *substream)
+{
+        return snd_pcm_lib_free_pages(substream);
+}
+
+static snd_pcm_hardware_t snd_ad1889_playback_hw = {
+        .info = SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
+                SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_BLOCK_TRANSFER,
+        .formats = SNDRV_PCM_FMTBIT_S16_LE,
+        .rates = SNDRV_PCM_RATE_CONTINUOUS | SNDRV_PCM_RATE_8000_48000,
+        .rate_min = 8000,       /* docs say 7000, but we're lazy */
+        .rate_max = 48000,
+        .channels_min = 1,
+        .channels_max = 2,
+        .buffer_bytes_max = BUFFER_BYTES_MAX,
+        .period_bytes_min = PERIOD_BYTES_MIN,
+        .period_bytes_max = PERIOD_BYTES_MAX,
+        .periods_min = PERIODS_MIN,
+        .periods_max = PERIODS_MAX,
+        /*.fifo_size = 0,*/
+};
+
+static snd_pcm_hardware_t snd_ad1889_capture_hw = {
+        .info = SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
+                SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_BLOCK_TRANSFER,
+        .formats = SNDRV_PCM_FMTBIT_S16_LE,
+        .rates = SNDRV_PCM_RATE_48000,
+        .rate_min = 48000,      /* docs say we could to VSR, but we're lazy */
+        .rate_max = 48000,
+        .channels_min = 1,
+        .channels_max = 2,
+        .buffer_bytes_max = BUFFER_BYTES_MAX,
+        .period_bytes_min = PERIOD_BYTES_MIN,
+        .period_bytes_max = PERIOD_BYTES_MAX,
+        .periods_min = PERIODS_MIN,
+        .periods_max = PERIODS_MAX,
+        /*.fifo_size = 0,*/
+};
+
+static int
+snd_ad1889_playback_open(snd_pcm_substream_t *ss)
+{
+        struct snd_ad1889 *chip = snd_pcm_substream_chip(ss);
+        snd_pcm_runtime_t *rt = ss->runtime;
+
+        chip->psubs = ss;
+        rt->hw = snd_ad1889_playback_hw;
+
+        return 0;
+}
+
+static int
+snd_ad1889_capture_open(snd_pcm_substream_t *ss)
+{
+        struct snd_ad1889 *chip = snd_pcm_substream_chip(ss);
+        snd_pcm_runtime_t *rt = ss->runtime;
+
+        chip->csubs = ss;
+        rt->hw = snd_ad1889_capture_hw;
+
+        return 0;
+}
+
+static int
+snd_ad1889_playback_close(snd_pcm_substream_t *ss)
+{
+        struct snd_ad1889 *chip = snd_pcm_substream_chip(ss);
+        chip->psubs = NULL;
+        return 0;
+}
+
+static int
+snd_ad1889_capture_close(snd_pcm_substream_t *ss)
+{
+        struct snd_ad1889 *chip = snd_pcm_substream_chip(ss);
+        chip->csubs = NULL;
+        return 0;
+}
+
+static int
+snd_ad1889_playback_prepare(snd_pcm_substream_t *ss)
+{
+        struct snd_ad1889 *chip = snd_pcm_substream_chip(ss);
+        snd_pcm_runtime_t *rt = ss->runtime;
+        unsigned int size = snd_pcm_lib_buffer_bytes(ss);
+        unsigned int count = snd_pcm_lib_period_bytes(ss);
+        u16 reg;
+
+        ad1889_channel_reset(chip, AD_CHAN_WAV);
+
+        reg = ad1889_readw(chip, AD_DS_WSMC);
+        
+        /* Mask out 16-bit / Stereo */
+        reg &= ~(AD_DS_WSMC_WA16 | AD_DS_WSMC_WAST);
+
+        if (snd_pcm_format_width(rt->format) == 16)
+                reg |= AD_DS_WSMC_WA16;
+
+        if (rt->channels > 1)
+                reg |= AD_DS_WSMC_WAST;
+
+        /* let's make sure we don't clobber ourselves */
+        spin_lock_irq(&chip->lock);
+        
+        chip->wave.size = size;
+        chip->wave.reg = reg;
+        chip->wave.addr = rt->dma_addr;
+
+        ad1889_writew(chip, AD_DS_WSMC, chip->wave.reg);
+        
+        /* Set sample rates on the codec */
+        ad1889_writew(chip, AD_DS_WAS, rt->rate);
+
+        /* Set up DMA */
+        ad1889_load_wave_buffer_address(chip, chip->wave.addr);
+        ad1889_load_wave_buffer_count(chip, size);
+        ad1889_load_wave_interrupt_count(chip, count);
+
+        /* writes flush */
+        ad1889_readw(chip, AD_DS_WSMC);
+        
+        spin_unlock_irq(&chip->lock);
+        
+        ad1889_debug("prepare playback: addr = 0x%x, count = %u, "
+                        "size = %u, reg = 0x%x, rate = %u\n", chip->wave.addr,
+                        count, size, reg, rt->rate);
+        return 0;
+}
+
+static int
+snd_ad1889_capture_prepare(snd_pcm_substream_t *ss)
+{
+        struct snd_ad1889 *chip = snd_pcm_substream_chip(ss);
+        snd_pcm_runtime_t *rt = ss->runtime;
+        unsigned int size = snd_pcm_lib_buffer_bytes(ss);
+        unsigned int count = snd_pcm_lib_period_bytes(ss);
+        u16 reg;
+
+        ad1889_channel_reset(chip, AD_CHAN_ADC);
+        
+        reg = ad1889_readw(chip, AD_DS_RAMC);
+
+        /* Mask out 16-bit / Stereo */
+        reg &= ~(AD_DS_RAMC_AD16 | AD_DS_RAMC_ADST);
+
+        if (snd_pcm_format_width(rt->format) == 16)
+                reg |= AD_DS_RAMC_AD16;
+
+        if (rt->channels > 1)
+                reg |= AD_DS_RAMC_ADST;
+
+        /* let's make sure we don't clobber ourselves */
+        spin_lock_irq(&chip->lock);
+        
+        chip->ramc.size = size;
+        chip->ramc.reg = reg;
+        chip->ramc.addr = rt->dma_addr;
+
+        ad1889_writew(chip, AD_DS_RAMC, chip->ramc.reg);
+
+        /* Set up DMA */
+        ad1889_load_adc_buffer_address(chip, chip->ramc.addr);
+        ad1889_load_adc_buffer_count(chip, size);
+        ad1889_load_adc_interrupt_count(chip, count);
+
+        /* writes flush */
+        ad1889_readw(chip, AD_DS_RAMC);
+        
+        spin_unlock_irq(&chip->lock);
+        
+        ad1889_debug("prepare capture: addr = 0x%x, count = %u, "
+                        "size = %u, reg = 0x%x, rate = %u\n", chip->ramc.addr,
+                        count, size, reg, rt->rate);
+        return 0;
+}
+
+/* this is called in atomic context with IRQ disabled.
+   Must be as fast as possible and not sleep.
+   DMA should be *triggered* by this call.
+   The WSMC "WAEN" bit triggers DMA Wave On/Off */
+static int
+snd_ad1889_playback_trigger(snd_pcm_substream_t *ss, int cmd)
+{
+        u16 wsmc;
+        struct snd_ad1889 *chip = snd_pcm_substream_chip(ss);
+        
+        wsmc = ad1889_readw(chip, AD_DS_WSMC);
+
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+                /* enable DMA loop & interrupts */
+                ad1889_writew(chip, AD_DMA_WAV, AD_DMA_LOOP | AD_DMA_IM_CNT);
+                wsmc |= AD_DS_WSMC_WAEN;
+                /* 1 to clear CHSS bit */
+                ad1889_writel(chip, AD_DMA_CHSS, AD_DMA_CHSS_WAVS);
+                ad1889_unmute(chip);
+                break;
+        case SNDRV_PCM_TRIGGER_STOP:
+                ad1889_mute(chip);
+                wsmc &= ~AD_DS_WSMC_WAEN;
+                break;
+        default:
+                snd_BUG();
+                return -EINVAL;
+        }
+        
+        chip->wave.reg = wsmc;
+        ad1889_writew(chip, AD_DS_WSMC, wsmc);  
+        ad1889_readw(chip, AD_DS_WSMC); /* flush */
+
+        /* reset the chip when STOP - will disable IRQs */
+        if (cmd == SNDRV_PCM_TRIGGER_STOP)
+                ad1889_channel_reset(chip, AD_CHAN_WAV);
+
+        return 0;
+}
+
+/* this is called in atomic context with IRQ disabled.
+   Must be as fast as possible and not sleep.
+   DMA should be *triggered* by this call.
+   The RAMC "ADEN" bit triggers DMA ADC On/Off */
+static int
+snd_ad1889_capture_trigger(snd_pcm_substream_t *ss, int cmd)
+{
+        u16 ramc;
+        struct snd_ad1889 *chip = snd_pcm_substream_chip(ss);
+
+        ramc = ad1889_readw(chip, AD_DS_RAMC);
+        
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+                /* enable DMA loop & interrupts */
+                ad1889_writew(chip, AD_DMA_ADC, AD_DMA_LOOP | AD_DMA_IM_CNT);
+                ramc |= AD_DS_RAMC_ADEN;
+                /* 1 to clear CHSS bit */
+                ad1889_writel(chip, AD_DMA_CHSS, AD_DMA_CHSS_ADCS);
+                break;
+        case SNDRV_PCM_TRIGGER_STOP:
+                ramc &= ~AD_DS_RAMC_ADEN;
+                break;
+        default:
+                return -EINVAL;
+        }
+        
+        chip->ramc.reg = ramc;
+        ad1889_writew(chip, AD_DS_RAMC, ramc);  
+        ad1889_readw(chip, AD_DS_RAMC); /* flush */
+        
+        /* reset the chip when STOP - will disable IRQs */
+        if (cmd == SNDRV_PCM_TRIGGER_STOP)
+                ad1889_channel_reset(chip, AD_CHAN_ADC);
+                
+        return 0;
+}
+
+/* Called in atomic context with IRQ disabled */
+static snd_pcm_uframes_t
+snd_ad1889_playback_pointer(snd_pcm_substream_t *ss)
+{
+        size_t ptr = 0;
+        struct snd_ad1889 *chip = snd_pcm_substream_chip(ss);
+
+        if (unlikely(!(chip->wave.reg & AD_DS_WSMC_WAEN)))
+                return 0;
+
+        ptr = ad1889_readl(chip, AD_DMA_WAVCA);
+        ptr -= chip->wave.addr;
+        
+        snd_assert((ptr >= 0) && (ptr < chip->wave.size), return 0);
+        
+        return bytes_to_frames(ss->runtime, ptr);
+}
+
+/* Called in atomic context with IRQ disabled */
+static snd_pcm_uframes_t
+snd_ad1889_capture_pointer(snd_pcm_substream_t *ss)
+{
+        size_t ptr = 0;
+        struct snd_ad1889 *chip = snd_pcm_substream_chip(ss);
+
+        if (unlikely(!(chip->ramc.reg & AD_DS_RAMC_ADEN)))
+                return 0;
+
+        ptr = ad1889_readl(chip, AD_DMA_ADCCA);
+        ptr -= chip->ramc.addr;
+
+        snd_assert((ptr >= 0) && (ptr < chip->ramc.size), return 0);
+        
+        return bytes_to_frames(ss->runtime, ptr);
+}
+
+static snd_pcm_ops_t snd_ad1889_playback_ops = {
+        .open = snd_ad1889_playback_open,
+        .close = snd_ad1889_playback_close,
+        .ioctl = snd_pcm_lib_ioctl,
+        .hw_params = snd_ad1889_hw_params,
+        .hw_free = snd_ad1889_hw_free,
+        .prepare = snd_ad1889_playback_prepare,
+        .trigger = snd_ad1889_playback_trigger,
+        .pointer = snd_ad1889_playback_pointer, 
+};
+
+static snd_pcm_ops_t snd_ad1889_capture_ops = {
+        .open = snd_ad1889_capture_open,
+        .close = snd_ad1889_capture_close,
+        .ioctl = snd_pcm_lib_ioctl,
+        .hw_params = snd_ad1889_hw_params,
+        .hw_free = snd_ad1889_hw_free,
+        .prepare = snd_ad1889_capture_prepare,
+        .trigger = snd_ad1889_capture_trigger,
+        .pointer = snd_ad1889_capture_pointer, 
+};
+
+static irqreturn_t
+snd_ad1889_interrupt(int irq, 
+                     void *dev_id, 
+                     struct pt_regs *regs)
+{
+        unsigned long st;
+        struct snd_ad1889 *chip = dev_id;
+
+        st = ad1889_readl(chip, AD_DMA_DISR);
+
+        /* clear ISR */
+        ad1889_writel(chip, AD_DMA_DISR, st);
+
+        st &= AD_INTR_MASK;
+
+        if (unlikely(!st))
+                return IRQ_NONE;
+
+        if (st & (AD_DMA_DISR_PMAI|AD_DMA_DISR_PTAI))
+                ad1889_debug("Unexpected master or target abort interrupt!\n");
+
+        if ((st & AD_DMA_DISR_WAVI) && chip->psubs)
+                snd_pcm_period_elapsed(chip->psubs);
+        if ((st & AD_DMA_DISR_ADCI) && chip->csubs)
+                snd_pcm_period_elapsed(chip->csubs);
+
+        return IRQ_HANDLED;
+}
+
+static void 
+snd_ad1889_pcm_free(snd_pcm_t *pcm)
+{
+        struct snd_ad1889 *chip = pcm->private_data;
+        chip->pcm = NULL;
+        snd_pcm_lib_preallocate_free_for_all(pcm);
+}
+
+static int __devinit
+snd_ad1889_pcm_init(struct snd_ad1889 *chip, int device, snd_pcm_t **rpcm)
+{
+        int err;
+        snd_pcm_t *pcm;
+
+        if (rpcm)
+                *rpcm = NULL;
+
+        err = snd_pcm_new(chip->card, chip->card->driver, device, 1, 1, &pcm);
+        if (err < 0)
+                return err;
+
+        snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, 
+                        &snd_ad1889_playback_ops);
+        snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE,
+                        &snd_ad1889_capture_ops);
+
+        pcm->private_data = chip;
+        pcm->private_free = snd_ad1889_pcm_free;
+        pcm->info_flags = 0;
+        strcpy(pcm->name, chip->card->shortname);
+        
+        chip->pcm = pcm;
+        chip->psubs = NULL;
+        chip->csubs = NULL;
+
+        err = snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV,
+                                                snd_dma_pci_data(chip->pci),
+                                                BUFFER_BYTES_MAX / 2,
+                                                BUFFER_BYTES_MAX);
+
+        if (err < 0) {
+                snd_printk(KERN_ERR PFX "buffer allocation error: %d\n", err);
+                return err;
+        }
+        
+        if (rpcm)
+                *rpcm = pcm;
+        
+        return 0;
+}
+
+static void
+snd_ad1889_proc_read(snd_info_entry_t *entry, snd_info_buffer_t *buffer)
+{
+        struct snd_ad1889 *chip = entry->private_data;
+        u16 reg;
+        int tmp;
+
+        reg = ad1889_readw(chip, AD_DS_WSMC);
+        snd_iprintf(buffer, "Wave output: %s\n",
+                        (reg & AD_DS_WSMC_WAEN) ? "enabled" : "disabled");
+        snd_iprintf(buffer, "Wave Channels: %s\n",
+                        (reg & AD_DS_WSMC_WAST) ? "stereo" : "mono");
+        snd_iprintf(buffer, "Wave Quality: %d-bit linear\n",
+                        (reg & AD_DS_WSMC_WA16) ? 16 : 8);
+        
+        /* WARQ is at offset 12 */
+        tmp = (reg & AD_DS_WSMC_WARQ) ?
+                        (((reg & AD_DS_WSMC_WARQ >> 12) & 0x01) ? 12 : 18) : 4;
+        tmp /= (reg & AD_DS_WSMC_WAST) ? 2 : 1;
+        
+        snd_iprintf(buffer, "Wave FIFO: %d %s words\n\n", tmp,
+                        (reg & AD_DS_WSMC_WAST) ? "stereo" : "mono");
+                                
+        
+        snd_iprintf(buffer, "Synthesis output: %s\n",
+                        reg & AD_DS_WSMC_SYEN ? "enabled" : "disabled");
+        
+        /* SYRQ is at offset 4 */
+        tmp = (reg & AD_DS_WSMC_SYRQ) ?
+                        (((reg & AD_DS_WSMC_SYRQ >> 4) & 0x01) ? 12 : 18) : 4;
+        tmp /= (reg & AD_DS_WSMC_WAST) ? 2 : 1;
+        
+        snd_iprintf(buffer, "Synthesis FIFO: %d %s words\n\n", tmp,
+                        (reg & AD_DS_WSMC_WAST) ? "stereo" : "mono");
+
+        reg = ad1889_readw(chip, AD_DS_RAMC);
+        snd_iprintf(buffer, "ADC input: %s\n",
+                        (reg & AD_DS_RAMC_ADEN) ? "enabled" : "disabled");
+        snd_iprintf(buffer, "ADC Channels: %s\n",
+                        (reg & AD_DS_RAMC_ADST) ? "stereo" : "mono");
+        snd_iprintf(buffer, "ADC Quality: %d-bit linear\n",
+                        (reg & AD_DS_RAMC_AD16) ? 16 : 8);
+        
+        /* ACRQ is at offset 4 */
+        tmp = (reg & AD_DS_RAMC_ACRQ) ?
+                        (((reg & AD_DS_RAMC_ACRQ >> 4) & 0x01) ? 12 : 18) : 4;
+        tmp /= (reg & AD_DS_RAMC_ADST) ? 2 : 1;
+        
+        snd_iprintf(buffer, "ADC FIFO: %d %s words\n\n", tmp,
+                        (reg & AD_DS_RAMC_ADST) ? "stereo" : "mono");
+        
+        snd_iprintf(buffer, "Resampler input: %s\n",
+                        reg & AD_DS_RAMC_REEN ? "enabled" : "disabled");
+                        
+        /* RERQ is at offset 12 */
+        tmp = (reg & AD_DS_RAMC_RERQ) ?
+                        (((reg & AD_DS_RAMC_RERQ >> 12) & 0x01) ? 12 : 18) : 4;
+        tmp /= (reg & AD_DS_RAMC_ADST) ? 2 : 1;
+        
+        snd_iprintf(buffer, "Resampler FIFO: %d %s words\n\n", tmp,
+                        (reg & AD_DS_WSMC_WAST) ? "stereo" : "mono");
+                                
+        
+        /* doc says LSB represents -1.5dB, but the max value (-94.5dB)
+        suggests that LSB is -3dB, which is more coherent with the logarithmic
+        nature of the dB scale */
+        reg = ad1889_readw(chip, AD_DS_WADA);
+        snd_iprintf(buffer, "Left: %s, -%d dB\n",
+                        (reg & AD_DS_WADA_LWAM) ? "mute" : "unmute",
+                        ((reg & AD_DS_WADA_LWAA) >> 8) * 3);
+        reg = ad1889_readw(chip, AD_DS_WADA);
+        snd_iprintf(buffer, "Right: %s, -%d dB\n",
+                        (reg & AD_DS_WADA_RWAM) ? "mute" : "unmute",
+                        ((reg & AD_DS_WADA_RWAA) >> 8) * 3);
+        
+        reg = ad1889_readw(chip, AD_DS_WAS);
+        snd_iprintf(buffer, "Wave samplerate: %u Hz\n", reg);
+        reg = ad1889_readw(chip, AD_DS_RES);
+        snd_iprintf(buffer, "Resampler samplerate: %u Hz\n", reg);
+}
+
+static void __devinit
+snd_ad1889_proc_init(struct snd_ad1889 *chip)
+{
+        snd_info_entry_t *entry;
+
+        if (!snd_card_proc_new(chip->card, chip->card->driver, &entry))
+                snd_info_set_text_ops(entry, chip, 1024, snd_ad1889_proc_read);
+}
+
+static struct ac97_quirk ac97_quirks[] = {
+        {
+                .subvendor = 0x11d4,    /* AD */
+                .subdevice = 0x1889,    /* AD1889 */
+                .codec_id = AC97_ID_AD1819,
+                .name = "AD1889",
+                .type = AC97_TUNE_HP_ONLY
+        },
+        { } /* terminator */
+};
+
+static void __devinit
+snd_ad1889_ac97_xinit(struct snd_ad1889 *chip)
+{
+        u16 reg;
+
+        reg = ad1889_readw(chip, AD_AC97_ACIC);
+        reg |= AD_AC97_ACIC_ACRD;               /* Reset Disable */
+        ad1889_writew(chip, AD_AC97_ACIC, reg);
+        ad1889_readw(chip, AD_AC97_ACIC);       /* flush posted write */
+        udelay(10);
+        /* Interface Enable */
+        reg |= AD_AC97_ACIC_ACIE;
+        ad1889_writew(chip, AD_AC97_ACIC, reg);
+        
+        snd_ad1889_ac97_ready(chip);
+
+        /* Audio Stream Output | Variable Sample Rate Mode */
+        reg = ad1889_readw(chip, AD_AC97_ACIC);
+        reg |= AD_AC97_ACIC_ASOE | AD_AC97_ACIC_VSRM;
+        ad1889_writew(chip, AD_AC97_ACIC, reg);
+        ad1889_readw(chip, AD_AC97_ACIC); /* flush posted write */
+
+}
+
+static void
+snd_ad1889_ac97_bus_free(ac97_bus_t *bus)
+{
+        struct snd_ad1889 *chip = bus->private_data;
+        chip->ac97_bus = NULL;
+}
+
+static void
+snd_ad1889_ac97_free(ac97_t *ac97)
+{
+        struct snd_ad1889 *chip = ac97->private_data;
+        chip->ac97 = NULL;
+}
+
+static int __devinit
+snd_ad1889_ac97_init(struct snd_ad1889 *chip, const char *quirk_override)
+{
+        int err;
+        ac97_template_t ac97;
+        static ac97_bus_ops_t ops = {
+                .write = snd_ad1889_ac97_write,
+                .read = snd_ad1889_ac97_read,
+        };
+
+        /* doing that here, it works. */
+        snd_ad1889_ac97_xinit(chip);
+
+        err = snd_ac97_bus(chip->card, 0, &ops, chip, &chip->ac97_bus);
+        if (err < 0)
+                return err;
+        
+        chip->ac97_bus->private_free = snd_ad1889_ac97_bus_free;
+
+        memset(&ac97, 0, sizeof(ac97));
+        ac97.private_data = chip;
+        ac97.private_free = snd_ad1889_ac97_free;
+        ac97.pci = chip->pci;
+
+        err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97);
+        if (err < 0)
+                return err;
+                
+        snd_ac97_tune_hardware(chip->ac97, ac97_quirks, quirk_override);
+        
+        return 0;
+}
+
+static int
+snd_ad1889_free(struct snd_ad1889 *chip)
+{
+        if (chip->irq < 0)
+                goto skip_hw;
+
+        spin_lock_irq(&chip->lock);
+
+        ad1889_mute(chip);
+
+        /* Turn off interrupt on count and zero DMA registers */
+        ad1889_channel_reset(chip, AD_CHAN_WAV | AD_CHAN_ADC);
+
+        /* clear DISR. If we don't, we'd better jump off the Eiffel Tower */
+        ad1889_writel(chip, AD_DMA_DISR, AD_DMA_DISR_PTAI | AD_DMA_DISR_PMAI);
+        ad1889_readl(chip, AD_DMA_DISR);        /* flush, dammit! */
+
+        spin_unlock_irq(&chip->lock);
+
+        synchronize_irq(chip->irq);
+        
+        if (chip->irq >= 0)
+                free_irq(chip->irq, (void*)chip);
+
+skip_hw:
+        if (chip->iobase)
+                iounmap(chip->iobase);
+
+        pci_release_regions(chip->pci);
+        pci_disable_device(chip->pci);
+
+        kfree(chip);
+        return 0;
+}
+
+static inline int
+snd_ad1889_dev_free(snd_device_t *device) 
+{
+        struct snd_ad1889 *chip = device->device_data;
+        return snd_ad1889_free(chip);
+}
+
+static int __devinit
+snd_ad1889_init(struct snd_ad1889 *chip) 
+{
+        ad1889_writew(chip, AD_DS_CCS, AD_DS_CCS_CLKEN); /* turn on clock */
+        ad1889_readw(chip, AD_DS_CCS);  /* flush posted write */
+
+        mdelay(10);
+
+        /* enable Master and Target abort interrupts */
+        ad1889_writel(chip, AD_DMA_DISR, AD_DMA_DISR_PMAE | AD_DMA_DISR_PTAE);
+
+        return 0;
+}
+
+static int __devinit
+snd_ad1889_create(snd_card_t *card,
+                  struct pci_dev *pci,
+                  struct snd_ad1889 **rchip)
+{
+        int err;
+
+        struct snd_ad1889 *chip;
+        static snd_device_ops_t ops = {
+                .dev_free = snd_ad1889_dev_free,
+        };
+
+        *rchip = NULL;
+
+        if ((err = pci_enable_device(pci)) < 0)
+                return err;
+        
+        /* check PCI availability (32bit DMA) */
+        if (pci_set_dma_mask(pci, 0xffffffff) < 0 ||
+            pci_set_consistent_dma_mask(pci, 0xffffffff) < 0) {
+                printk(KERN_ERR PFX "error setting 32-bit DMA mask.\n");
+                pci_disable_device(pci);
+                return -ENXIO;
+        }
+
+        /* allocate chip specific data with zero-filled memory */
+        if ((chip = kzalloc(sizeof(*chip), GFP_KERNEL)) == NULL) {
+                pci_disable_device(pci);
+                return -ENOMEM;
+        }
+
+        chip->card = card;
+        card->private_data = chip;
+        chip->pci = pci;
+        chip->irq = -1;
+
+        /* (1) PCI resource allocation */
+        if ((err = pci_request_regions(pci, card->driver)) < 0)
+                goto free_and_ret;
+
+        chip->bar = pci_resource_start(pci, 0);
+        chip->iobase = ioremap_nocache(chip->bar, pci_resource_len(pci, 0));
+        if (chip->iobase == NULL) {
+                printk(KERN_ERR PFX "unable to reserve region.\n");
+                err = -EBUSY;
+                goto free_and_ret;
+        }
+        
+        pci_set_master(pci);
+
+        spin_lock_init(&chip->lock);    /* only now can we call ad1889_free */
+
+        if (request_irq(pci->irq, snd_ad1889_interrupt,
+                        SA_INTERRUPT|SA_SHIRQ, card->driver, (void*)chip)) {
+                printk(KERN_ERR PFX "cannot obtain IRQ %d\n", pci->irq);
+                snd_ad1889_free(chip);
+                return -EBUSY;
+        }
+
+        chip->irq = pci->irq;
+        synchronize_irq(chip->irq);
+
+        /* (2) initialization of the chip hardware */
+        if ((err = snd_ad1889_init(chip)) < 0) {
+                snd_ad1889_free(chip);
+                return err;
+        }
+
+        if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) {
+                snd_ad1889_free(chip);
+                return err;
+        }
+
+        snd_card_set_dev(card, &pci->dev);
+
+        *rchip = chip;
+
+        return 0;
+
+free_and_ret:
+        if (chip)
+                kfree(chip);
+        pci_disable_device(pci);
+
+        return err;
+}
+
+static int __devinit
+snd_ad1889_probe(struct pci_dev *pci,
+                 const struct pci_device_id *pci_id)
+{
+        int err;
+        static int devno;
+        snd_card_t *card;
+        struct snd_ad1889 *chip;
+
+        /* (1) */
+        if (devno >= SNDRV_CARDS)
+                return -ENODEV;
+        if (!enable[devno]) {
+                devno++;
+                return -ENOENT;
+        }
+
+        /* (2) */
+        card = snd_card_new(index[devno], id[devno], THIS_MODULE, 0);
+        /* XXX REVISIT: we can probably allocate chip in this call */
+        if (card == NULL)
+                return -ENOMEM;
+
+        strcpy(card->driver, "AD1889");
+        strcpy(card->shortname, "Analog Devices AD1889");
+
+        /* (3) */
+        err = snd_ad1889_create(card, pci, &chip);
+        if (err < 0)
+                goto free_and_ret;
+
+        /* (4) */
+        sprintf(card->longname, "%s at 0x%lx irq %i",
+                card->shortname, chip->bar, chip->irq);
+
+        /* (5) */
+        /* register AC97 mixer */
+        err = snd_ad1889_ac97_init(chip, ac97_quirk[devno]);
+        if (err < 0)
+                goto free_and_ret;
+        
+        err = snd_ad1889_pcm_init(chip, 0, NULL);
+        if (err < 0)
+                goto free_and_ret;
+
+        /* register proc interface */
+        snd_ad1889_proc_init(chip);
+
+        /* (6) */
+        err = snd_card_register(card);
+        if (err < 0)
+                goto free_and_ret;
+
+        /* (7) */
+        pci_set_drvdata(pci, card);
+
+        devno++;
+        return 0;
+
+free_and_ret:
+        snd_card_free(card);
+        return err;
+}
+
+static void __devexit
+snd_ad1889_remove(struct pci_dev *pci)
+{
+        snd_card_free(pci_get_drvdata(pci));
+        pci_set_drvdata(pci, NULL);
+}
+
+static struct pci_device_id snd_ad1889_ids[] = {
+        { PCI_DEVICE(PCI_VENDOR_ID_ANALOG_DEVICES, PCI_DEVICE_ID_AD1889JS) },
+        { 0, },
+};
+MODULE_DEVICE_TABLE(pci, snd_ad1889_ids);
+
+static struct pci_driver ad1889_pci = {
+        .name = "AD1889 Audio",
+        .owner = THIS_MODULE,
+        .id_table = snd_ad1889_ids,
+        .probe = snd_ad1889_probe,
+        .remove = __devexit_p(snd_ad1889_remove),
+};
+
+static int __init
+alsa_ad1889_init(void)
+{
+        return pci_register_driver(&ad1889_pci);
+}
+
+static void __exit
+alsa_ad1889_fini(void)
+{
+        pci_unregister_driver(&ad1889_pci);
+}
+
+module_init(alsa_ad1889_init);
+module_exit(alsa_ad1889_fini);
diff --git a/sound/pci/ad1889.h b/sound/pci/ad1889.h
new file mode 100644
index 000000000000..5e6dad5341a1
--- /dev/null
+++ b/sound/pci/ad1889.h
@@ -0,0 +1,189 @@
+/* Analog Devices 1889 audio driver
+ * Copyright (C) 2004, Kyle McMartin <kyle@parisc-linux.org>
+ */
+
+#ifndef __AD1889_H__
+#define __AD1889_H__
+
+#define AD_DS_WSMC      0x00 /* wave/synthesis channel mixer control */
+#define  AD_DS_WSMC_SYEN 0x0004 /* synthesis channel enable */
+#define  AD_DS_WSMC_SYRQ 0x0030 /* synth. fifo request point */
+#define  AD_DS_WSMC_WA16 0x0100 /* wave channel 16bit select */
+#define  AD_DS_WSMC_WAST 0x0200 /* wave channel stereo select */
+#define  AD_DS_WSMC_WAEN 0x0400 /* wave channel enable */
+#define  AD_DS_WSMC_WARQ 0x3000 /* wave fifo request point */
+
+#define AD_DS_RAMC      0x02 /* resampler/ADC channel mixer control */
+#define  AD_DS_RAMC_AD16 0x0001 /* ADC channel 16bit select */
+#define  AD_DS_RAMC_ADST 0x0002 /* ADC channel stereo select */
+#define  AD_DS_RAMC_ADEN 0x0004 /* ADC channel enable */
+#define  AD_DS_RAMC_ACRQ 0x0030 /* ADC fifo request point */
+#define  AD_DS_RAMC_REEN 0x0400 /* resampler channel enable */
+#define  AD_DS_RAMC_RERQ 0x3000 /* res. fifo request point */
+
+#define AD_DS_WADA      0x04 /* wave channel mix attenuation */
+#define  AD_DS_WADA_RWAM 0x0080 /* right wave mute */
+#define  AD_DS_WADA_RWAA 0x001f /* right wave attenuation */
+#define  AD_DS_WADA_LWAM 0x8000 /* left wave mute */
+#define  AD_DS_WADA_LWAA 0x3e00 /* left wave attenuation */
+
+#define AD_DS_SYDA      0x06 /* synthesis channel mix attenuation */
+#define  AD_DS_SYDA_RSYM 0x0080 /* right synthesis mute */
+#define  AD_DS_SYDA_RSYA 0x001f /* right synthesis attenuation */
+#define  AD_DS_SYDA_LSYM 0x8000 /* left synthesis mute */
+#define  AD_DS_SYDA_LSYA 0x3e00 /* left synthesis attenuation */
+
+#define AD_DS_WAS       0x08 /* wave channel sample rate */
+#define  AD_DS_WAS_WAS   0xffff /* sample rate mask */
+
+#define AD_DS_RES       0x0a /* resampler channel sample rate */
+#define  AD_DS_RES_RES   0xffff /* sample rate mask */
+
+#define AD_DS_CCS       0x0c /* chip control/status */
+#define  AD_DS_CCS_ADO   0x0001 /* ADC channel overflow */
+#define  AD_DS_CCS_REO   0x0002 /* resampler channel overflow */
+#define  AD_DS_CCS_SYU   0x0004 /* synthesis channel underflow */
+#define  AD_DS_CCS_WAU   0x0008 /* wave channel underflow */
+/* bits 4 -> 7, 9, 11 -> 14 reserved */
+#define  AD_DS_CCS_XTD   0x0100 /* xtd delay control (4096 clock cycles) */
+#define  AD_DS_CCS_PDALL 0x0400 /* power */
+#define  AD_DS_CCS_CLKEN 0x8000 /* clock */
+
+#define AD_DMA_RESBA    0x40 /* RES base address */
+#define AD_DMA_RESCA    0x44 /* RES current address */
+#define AD_DMA_RESBC    0x48 /* RES base count */
+#define AD_DMA_RESCC    0x4c /* RES current count */
+
+#define AD_DMA_ADCBA    0x50 /* ADC base address */
+#define AD_DMA_ADCCA    0x54 /* ADC current address */
+#define AD_DMA_ADCBC    0x58 /* ADC base count */
+#define AD_DMA_ADCCC    0x5c /* ADC current count */
+
+#define AD_DMA_SYNBA    0x60 /* synth base address */
+#define AD_DMA_SYNCA    0x64 /* synth current address */
+#define AD_DMA_SYNBC    0x68 /* synth base count */
+#define AD_DMA_SYNCC    0x6c /* synth current count */
+
+#define AD_DMA_WAVBA    0x70 /* wave base address */
+#define AD_DMA_WAVCA    0x74 /* wave current address */
+#define AD_DMA_WAVBC    0x78 /* wave base count */
+#define AD_DMA_WAVCC    0x7c /* wave current count */
+
+#define AD_DMA_RESIC    0x80 /* RES dma interrupt current byte count */
+#define AD_DMA_RESIB    0x84 /* RES dma interrupt base byte count */
+
+#define AD_DMA_ADCIC    0x88 /* ADC dma interrupt current byte count */
+#define AD_DMA_ADCIB    0x8c /* ADC dma interrupt base byte count */
+
+#define AD_DMA_SYNIC    0x90 /* synth dma interrupt current byte count */
+#define AD_DMA_SYNIB    0x94 /* synth dma interrupt base byte count */
+
+#define AD_DMA_WAVIC    0x98 /* wave dma interrupt current byte count */
+#define AD_DMA_WAVIB    0x9c /* wave dma interrupt base byte count */
+
+#define  AD_DMA_ICC     0xffffff /* current byte count mask */
+#define  AD_DMA_IBC     0xffffff /* base byte count mask */
+/* bits 24 -> 31 reserved */
+
+/* 4 bytes pad */
+#define AD_DMA_ADC      0xa8    /* ADC      dma control and status */
+#define AD_DMA_SYNTH    0xb0    /* Synth    dma control and status */
+#define AD_DMA_WAV      0xb8    /* wave     dma control and status */
+#define AD_DMA_RES      0xa0    /* Resample dma control and status */
+
+#define  AD_DMA_SGDE    0x0001 /* SGD mode enable */
+#define  AD_DMA_LOOP    0x0002 /* loop enable */
+#define  AD_DMA_IM      0x000c /* interrupt mode mask */
+#define  AD_DMA_IM_DIS  (~AD_DMA_IM)    /* disable */
+#define  AD_DMA_IM_CNT  0x0004 /* interrupt on count */
+#define  AD_DMA_IM_SGD  0x0008 /* interrupt on SGD flag */
+#define  AD_DMA_IM_EOL  0x000c /* interrupt on End of Linked List */
+#define  AD_DMA_SGDS    0x0030 /* SGD status */
+#define  AD_DMA_SFLG    0x0040 /* SGD flag */
+#define  AD_DMA_EOL     0x0080 /* SGD end of list */
+/* bits 8 -> 15 reserved */
+
+#define AD_DMA_DISR     0xc0 /* dma interrupt status */
+#define  AD_DMA_DISR_RESI 0x000001 /* resampler channel interrupt */
+#define  AD_DMA_DISR_ADCI 0x000002 /* ADC channel interrupt */
+#define  AD_DMA_DISR_SYNI 0x000004 /* synthesis channel interrupt */
+#define  AD_DMA_DISR_WAVI 0x000008 /* wave channel interrupt */
+/* bits 4, 5 reserved */
+#define  AD_DMA_DISR_SEPS 0x000040 /* serial eeprom status */
+/* bits 7 -> 13 reserved */
+#define  AD_DMA_DISR_PMAI 0x004000 /* pci master abort interrupt */
+#define  AD_DMA_DISR_PTAI 0x008000 /* pci target abort interrupt */
+#define  AD_DMA_DISR_PTAE 0x010000 /* pci target abort interrupt enable */
+#define  AD_DMA_DISR_PMAE 0x020000 /* pci master abort interrupt enable */
+/* bits 19 -> 31 reserved */
+
+/* interrupt mask */
+#define  AD_INTR_MASK     (AD_DMA_DISR_RESI|AD_DMA_DISR_ADCI| \
+                           AD_DMA_DISR_WAVI|AD_DMA_DISR_SYNI| \
+                           AD_DMA_DISR_PMAI|AD_DMA_DISR_PTAI)
+
+#define AD_DMA_CHSS     0xc4 /* dma channel stop status */
+#define  AD_DMA_CHSS_RESS 0x000001 /* resampler channel stopped */
+#define  AD_DMA_CHSS_ADCS 0x000002 /* ADC channel stopped */
+#define  AD_DMA_CHSS_SYNS 0x000004 /* synthesis channel stopped */
+#define  AD_DMA_CHSS_WAVS 0x000008 /* wave channel stopped */
+
+#define AD_GPIO_IPC     0xc8    /* gpio port control */
+#define AD_GPIO_OP      0xca    /* gpio output port status */
+#define AD_GPIO_IP      0xcc    /* gpio  input port status */
+
+#define AD_AC97_BASE    0x100   /* ac97 base register */
+
+#define AD_AC97_RESET   0x100   /* reset */
+
+#define AD_AC97_PWR_CTL 0x126   /* == AC97_POWERDOWN */
+#define  AD_AC97_PWR_ADC 0x0001 /* ADC ready status */
+#define  AD_AC97_PWR_DAC 0x0002 /* DAC ready status */
+#define  AD_AC97_PWR_PR0 0x0100 /* PR0 (ADC) powerdown */
+#define  AD_AC97_PWR_PR1 0x0200 /* PR1 (DAC) powerdown */
+
+#define AD_MISC_CTL     0x176 /* misc control */
+#define  AD_MISC_CTL_DACZ   0x8000 /* set for zero fill, unset for repeat */
+#define  AD_MISC_CTL_ARSR   0x0001 /* set for SR1, unset for SR0 */
+#define  AD_MISC_CTL_ALSR   0x0100
+#define  AD_MISC_CTL_DLSR   0x0400
+#define  AD_MISC_CTL_DRSR   0x0004
+
+#define AD_AC97_SR0     0x178 /* sample rate 0, 0xbb80 == 48K */
+#define  AD_AC97_SR0_48K 0xbb80 /* 48KHz */
+#define AD_AC97_SR1     0x17a /* sample rate 1 */
+
+#define AD_AC97_ACIC    0x180 /* ac97 codec interface control */
+#define  AD_AC97_ACIC_ACIE  0x0001 /* analog codec interface enable */
+#define  AD_AC97_ACIC_ACRD  0x0002 /* analog codec reset disable */
+#define  AD_AC97_ACIC_ASOE  0x0004 /* audio stream output enable */
+#define  AD_AC97_ACIC_VSRM  0x0008 /* variable sample rate mode */
+#define  AD_AC97_ACIC_FSDH  0x0100 /* force SDATA_OUT high */
+#define  AD_AC97_ACIC_FSYH  0x0200 /* force sync high */
+#define  AD_AC97_ACIC_ACRDY 0x8000 /* analog codec ready status */
+/* bits 10 -> 14 reserved */
+
+
+#define AD_DS_MEMSIZE   512
+#define AD_OPL_MEMSIZE  16
+#define AD_MIDI_MEMSIZE 16
+
+#define AD_WAV_STATE    0
+#define AD_ADC_STATE    1
+#define AD_MAX_STATES   2
+
+#define AD_CHAN_WAV     0x0001
+#define AD_CHAN_ADC     0x0002
+#define AD_CHAN_RES     0x0004
+#define AD_CHAN_SYN     0x0008
+
+
+/* The chip would support 4 GB buffers and 16 MB periods,
+ * but let's not overdo it ... */
+#define BUFFER_BYTES_MAX        (256 * 1024)
+#define PERIOD_BYTES_MIN        32
+#define PERIOD_BYTES_MAX        (BUFFER_BYTES_MAX / 2)
+#define PERIODS_MIN             2
+#define PERIODS_MAX             (BUFFER_BYTES_MAX / PERIOD_BYTES_MIN)
+
+#endif /* __AD1889_H__ */
diff --git a/sound/pci/ali5451/ali5451.c b/sound/pci/ali5451/ali5451.c
index 4943299cf137..d683f7736a63 100644
--- a/sound/pci/ali5451/ali5451.c
+++ b/sound/pci/ali5451/ali5451.c
@@ -78,15 +78,7 @@ MODULE_PARM_DESC(spdif, "Support SPDIF I/O");
  *  Constants definition
  */
 
-#ifndef PCI_VENDOR_ID_ALI
-#define PCI_VENDOR_ID_ALI       0x10b9
-#endif
-
-#ifndef PCI_DEVICE_ID_ALI_5451
-#define PCI_DEVICE_ID_ALI_5451  0x5451
-#endif
-
-#define DEVICE_ID_ALI5451       ((PCI_VENDOR_ID_ALI<<16)|PCI_DEVICE_ID_ALI_5451)
+#define DEVICE_ID_ALI5451       ((PCI_VENDOR_ID_AL<<16)|PCI_DEVICE_ID_AL_M5451)
 
 
 #define ALI_CHANNELS            32
@@ -326,13 +318,12 @@ static void ali_read_regs(ali_t *codec, int channel)
 static void ali_read_cfg(unsigned int vendor, unsigned deviceid)
 {
         unsigned int dwVal;
-        struct pci_dev *pci_dev = NULL;
+        struct pci_dev *pci_dev;
         int i,j;
 
-
-        pci_dev = pci_find_device(vendor, deviceid, pci_dev);
-        if (pci_dev == NULL)
-                return ;
+        pci_dev = pci_get_device(vendor, deviceid, NULL);
+        if (pci_dev == NULL)
+                return ;
 
         printk("\nM%x PCI CFG\n", deviceid);
         printk("    ");
@@ -349,6 +340,7 @@ static void ali_read_cfg(unsigned int vendor, unsigned deviceid)
                 }
                 printk("\n");
         }
+        pci_dev_put(pci_dev);
  }
 static void ali_read_ac97regs(ali_t *codec, int secondary)
 {
@@ -2116,6 +2108,8 @@ static int snd_ali_free(ali_t * codec)
 #ifdef CONFIG_PM
         kfree(codec->image);
 #endif
+        pci_dev_put(codec->pci_m1533);
+        pci_dev_put(codec->pci_m7101);
         kfree(codec);
         return 0;
 }
@@ -2305,7 +2299,7 @@ static int __devinit snd_ali_create(snd_card_t * card,
         codec->chregs.data.ainten = 0x00;
 
         /* M1533: southbridge */
-        pci_dev = pci_find_device(0x10b9, 0x1533, NULL);
+        pci_dev = pci_get_device(0x10b9, 0x1533, NULL);
         codec->pci_m1533 = pci_dev;
         if (! codec->pci_m1533) {
                 snd_printk(KERN_ERR "ali5451: cannot find ALi 1533 chip.\n");
@@ -2313,7 +2307,7 @@ static int __devinit snd_ali_create(snd_card_t * card,
                 return -ENODEV;
         }
         /* M7101: power management */
-        pci_dev = pci_find_device(0x10b9, 0x7101, NULL);
+        pci_dev = pci_get_device(0x10b9, 0x7101, NULL);
         codec->pci_m7101 = pci_dev;
         if (! codec->pci_m7101 && codec->revision == ALI_5451_V02) {
                 snd_printk(KERN_ERR "ali5451: cannot find ALi 7101 chip.\n");
@@ -2417,6 +2411,7 @@ static void __devexit snd_ali_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "ALI 5451",
+        .owner = THIS_MODULE,
         .id_table = snd_ali_ids,
         .probe = snd_ali_probe,
         .remove = __devexit_p(snd_ali_remove),
diff --git a/sound/pci/als4000.c b/sound/pci/als4000.c
index ca28b229c704..196ec1c61bb4 100644
--- a/sound/pci/als4000.c
+++ b/sound/pci/als4000.c
@@ -770,6 +770,7 @@ static void __devexit snd_card_als4000_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "ALS4000",
+        .owner = THIS_MODULE,
         .id_table = snd_als4000_ids,
         .probe = snd_card_als4000_probe,
         .remove = __devexit_p(snd_card_als4000_remove),
diff --git a/sound/pci/atiixp.c b/sound/pci/atiixp.c
index 188df085b7ee..241eacf1e652 100644
--- a/sound/pci/atiixp.c
+++ b/sound/pci/atiixp.c
@@ -1453,6 +1453,7 @@ static int snd_atiixp_resume(snd_card_t *card)
                         atiixp_dma_t *dma = &chip->dmas[i];
                         if (dma->substream && dma->suspended) {
                                 dma->ops->enable_dma(chip, 1);
+                                dma->substream->ops->prepare(dma->substream);
                                 writel((u32)dma->desc_buf.addr | ATI_REG_LINKPTR_EN,
                                        chip->remap_addr + dma->ops->llp_offset);
                                 writel(dma->saved_curptr, chip->remap_addr + dma->ops->dt_cur);
@@ -1530,7 +1531,7 @@ static int __devinit snd_atiixp_create(snd_card_t *card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1644,6 +1645,7 @@ static void __devexit snd_atiixp_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "ATI IXP AC97 controller",
+        .owner = THIS_MODULE,
         .id_table = snd_atiixp_ids,
         .probe = snd_atiixp_probe,
         .remove = __devexit_p(snd_atiixp_remove),
diff --git a/sound/pci/atiixp_modem.c b/sound/pci/atiixp_modem.c
index 8d2002951bd7..c1a239a4dac6 100644
--- a/sound/pci/atiixp_modem.c
+++ b/sound/pci/atiixp_modem.c
@@ -405,7 +405,7 @@ static int snd_atiixp_acquire_codec(atiixp_t *chip)
 
         while (atiixp_read(chip, PHYS_OUT_ADDR) & ATI_REG_PHYS_OUT_ADDR_EN) {
                 if (! timeout--) {
-                        snd_printk(KERN_WARNING "atiixp: codec acquire timeout\n");
+                        snd_printk(KERN_WARNING "atiixp-modem: codec acquire timeout\n");
                         return -EBUSY;
                 }
                 udelay(1);
@@ -436,7 +436,7 @@ static unsigned short snd_atiixp_codec_read(atiixp_t *chip, unsigned short codec
         } while (--timeout);
         /* time out may happen during reset */
         if (reg < 0x7c)
-                snd_printk(KERN_WARNING "atiixp: codec read timeout (reg %x)\n", reg);
+                snd_printk(KERN_WARNING "atiixp-modem: codec read timeout (reg %x)\n", reg);
         return 0xffff;
 }
 
@@ -498,7 +498,7 @@ static int snd_atiixp_aclink_reset(atiixp_t *chip)
                 do_delay();
                 atiixp_update(chip, CMD, ATI_REG_CMD_AC_RESET, ATI_REG_CMD_AC_RESET);
                 if (--timeout) {
-                        snd_printk(KERN_ERR "atiixp: codec reset timeout\n");
+                        snd_printk(KERN_ERR "atiixp-modem: codec reset timeout\n");
                         break;
                 }
         }
@@ -552,7 +552,7 @@ static int snd_atiixp_codec_detect(atiixp_t *chip)
         atiixp_write(chip, IER, 0); /* disable irqs */
 
         if ((chip->codec_not_ready_bits & ALL_CODEC_NOT_READY) == ALL_CODEC_NOT_READY) {
-                snd_printk(KERN_ERR "atiixp: no codec detected!\n");
+                snd_printk(KERN_ERR "atiixp-modem: no codec detected!\n");
                 return -ENXIO;
         }
         return 0;
@@ -635,7 +635,7 @@ static void snd_atiixp_xrun_dma(atiixp_t *chip, atiixp_dma_t *dma)
 {
         if (! dma->substream || ! dma->running)
                 return;
-        snd_printdd("atiixp: XRUN detected (DMA %d)\n", dma->ops->type);
+        snd_printdd("atiixp-modem: XRUN detected (DMA %d)\n", dma->ops->type);
         snd_pcm_stop(dma->substream, SNDRV_PCM_STATE_XRUN);
 }
 
@@ -1081,14 +1081,14 @@ static int __devinit snd_atiixp_mixer_new(atiixp_t *chip, int clock)
                 ac97.scaps = AC97_SCAP_SKIP_AUDIO;
                 if ((err = snd_ac97_mixer(pbus, &ac97, &chip->ac97[i])) < 0) {
                         chip->ac97[i] = NULL; /* to be sure */
-                        snd_printdd("atiixp: codec %d not available for modem\n", i);
+                        snd_printdd("atiixp-modem: codec %d not available for modem\n", i);
                         continue;
                 }
                 codec_count++;
         }
 
         if (! codec_count) {
-                snd_printk(KERN_ERR "atiixp: no codec available\n");
+                snd_printk(KERN_ERR "atiixp-modem: no codec available\n");
                 return -ENODEV;
         }
 
@@ -1159,7 +1159,7 @@ static void __devinit snd_atiixp_proc_init(atiixp_t *chip)
 {
         snd_info_entry_t *entry;
 
-        if (! snd_card_proc_new(chip->card, "atiixp", &entry))
+        if (! snd_card_proc_new(chip->card, "atiixp-modem", &entry))
                 snd_info_set_text_ops(entry, chip, 1024, snd_atiixp_proc_read);
 }
 
@@ -1208,7 +1208,7 @@ static int __devinit snd_atiixp_create(snd_card_t *card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1318,6 +1318,7 @@ static void __devexit snd_atiixp_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "ATI IXP MC97 controller",
+        .owner = THIS_MODULE,
         .id_table = snd_atiixp_ids,
         .probe = snd_atiixp_probe,
         .remove = __devexit_p(snd_atiixp_remove),
diff --git a/sound/pci/au88x0/au88x0.c b/sound/pci/au88x0/au88x0.c
index f6236c63aaaa..04b695d6fd48 100644
--- a/sound/pci/au88x0/au88x0.c
+++ b/sound/pci/au88x0/au88x0.c
@@ -79,19 +79,21 @@ static void vortex_fix_agp_bridge(struct pci_dev *via)
 
 static void __devinit snd_vortex_workaround(struct pci_dev *vortex, int fix)
 {
-        struct pci_dev *via;
+        struct pci_dev *via = NULL;
 
         /* autodetect if workarounds are required */
         if (fix == 255) {
                 /* VIA KT133 */
-                via = pci_find_device(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8365_1, NULL);
+                via = pci_get_device(PCI_VENDOR_ID_VIA,
+                        PCI_DEVICE_ID_VIA_8365_1, NULL);
                 /* VIA Apollo */
                 if (via == NULL) {
-                        via = pci_find_device(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C598_1, NULL);
-                }
-                /* AMD Irongate */
-                if (via == NULL) {
-                        via = pci_find_device(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_FE_GATE_7007, NULL);
+                        via = pci_get_device(PCI_VENDOR_ID_VIA,
+                                PCI_DEVICE_ID_VIA_82C598_1, NULL);
+                        /* AMD Irongate */
+                        if (via == NULL)
+                                via = pci_get_device(PCI_VENDOR_ID_AMD,
+                                        PCI_DEVICE_ID_AMD_FE_GATE_7007, NULL);
                 }
                 if (via) {
                         printk(KERN_INFO CARD_NAME ": Activating latency workaround...\n");
@@ -101,13 +103,17 @@ static void __devinit snd_vortex_workaround(struct pci_dev *vortex, int fix)
         } else {
                 if (fix & 0x1)
                         vortex_fix_latency(vortex);
-                if ((fix & 0x2) && (via = pci_find_device(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8365_1, NULL)))
+                if ((fix & 0x2) && (via = pci_get_device(PCI_VENDOR_ID_VIA,
+                                PCI_DEVICE_ID_VIA_8365_1, NULL)))
                         vortex_fix_agp_bridge(via);
-                if ((fix & 0x4) && (via = pci_find_device(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C598_1, NULL)))
+                if ((fix & 0x4) && (via = pci_get_device(PCI_VENDOR_ID_VIA,
+                                PCI_DEVICE_ID_VIA_82C598_1, NULL)))
                         vortex_fix_agp_bridge(via);
-                if ((fix & 0x8) && (via = pci_find_device(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_FE_GATE_7007, NULL)))
+                if ((fix & 0x8) && (via = pci_get_device(PCI_VENDOR_ID_AMD,
+                                PCI_DEVICE_ID_AMD_FE_GATE_7007, NULL)))
                         vortex_fix_agp_bridge(via);
         }
+        pci_dev_put(via);
 }
 
 // component-destructor
@@ -150,7 +156,7 @@ snd_vortex_create(snd_card_t * card, struct pci_dev *pci, vortex_t ** rchip)
         }
         pci_set_dma_mask(pci, VORTEX_DMA_MASK);
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
 
@@ -367,6 +373,7 @@ static void __devexit snd_vortex_remove(struct pci_dev *pci)
 // pci_driver definition
 static struct pci_driver driver = {
         .name = CARD_NAME_SHORT,
+        .owner = THIS_MODULE,
         .id_table = snd_vortex_ids,
         .probe = snd_vortex_probe,
         .remove = __devexit_p(snd_vortex_remove),
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index 72bba7b2d983..d5261bdec583 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -1345,7 +1345,7 @@ static int __devinit snd_azf3328_create(snd_card_t * card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1511,6 +1511,7 @@ static void __devexit snd_azf3328_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "AZF3328",
+        .owner = THIS_MODULE,
         .id_table = snd_azf3328_ids,
         .probe = snd_azf3328_probe,
         .remove = __devexit_p(snd_azf3328_remove),
diff --git a/sound/pci/bt87x.c b/sound/pci/bt87x.c
index c5557eaf3e2e..2236c958aec0 100644
--- a/sound/pci/bt87x.c
+++ b/sound/pci/bt87x.c
@@ -59,16 +59,6 @@ module_param(load_all, bool, 0444);
 MODULE_PARM_DESC(load_all, "Allow to load the non-whitelisted cards");
 
 
-#ifndef PCI_VENDOR_ID_BROOKTREE
-#define PCI_VENDOR_ID_BROOKTREE 0x109e
-#endif
-#ifndef PCI_DEVICE_ID_BROOKTREE_878
-#define PCI_DEVICE_ID_BROOKTREE_878 0x0878
-#endif
-#ifndef PCI_DEVICE_ID_BROOKTREE_879
-#define PCI_DEVICE_ID_BROOKTREE_879 0x0879
-#endif
-
 /* register offsets */
 #define REG_INT_STAT            0x100   /* interrupt status */
 #define REG_INT_MASK            0x104   /* interrupt mask */
@@ -720,7 +710,7 @@ static int __devinit snd_bt87x_create(snd_card_t *card,
         if (err < 0)
                 return err;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (!chip) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -911,6 +901,7 @@ static struct pci_device_id snd_bt87x_default_ids[] = {
 
 static struct pci_driver driver = {
         .name = "Bt87x",
+        .owner = THIS_MODULE,
         .id_table = snd_bt87x_ids,
         .probe = snd_bt87x_probe,
         .remove = __devexit_p(snd_bt87x_remove),
diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c
index 7e27bfc37439..ba07960921d8 100644
--- a/sound/pci/ca0106/ca0106_main.c
+++ b/sound/pci/ca0106/ca0106_main.c
@@ -352,7 +352,7 @@ static int snd_ca0106_pcm_open_playback_channel(snd_pcm_substream_t *substream,
         snd_pcm_runtime_t *runtime = substream->runtime;
         int err;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
 
         if (epcm == NULL)
                 return -ENOMEM;
@@ -419,7 +419,7 @@ static int snd_ca0106_pcm_open_capture_channel(snd_pcm_substream_t *substream, i
         snd_pcm_runtime_t *runtime = substream->runtime;
         int err;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
         if (epcm == NULL) {
                 snd_printk("open_capture_channel: failed epcm alloc\n");
                 return -ENOMEM;
@@ -1144,7 +1144,7 @@ static int __devinit snd_ca0106_create(snd_card_t *card,
                 return -ENXIO;
         }
   
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1390,6 +1390,7 @@ MODULE_DEVICE_TABLE(pci, snd_ca0106_ids);
 // pci_driver definition
 static struct pci_driver driver = {
         .name = "CA0106",
+        .owner = THIS_MODULE,
         .id_table = snd_ca0106_ids,
         .probe = snd_ca0106_probe,
         .remove = __devexit_p(snd_ca0106_remove),
diff --git a/sound/pci/ca0106/ca0106_mixer.c b/sound/pci/ca0106/ca0106_mixer.c
index b6b8882ce704..c10e4a54301b 100644
--- a/sound/pci/ca0106/ca0106_mixer.c
+++ b/sound/pci/ca0106/ca0106_mixer.c
@@ -482,7 +482,7 @@ static int snd_ca0106_volume_put_feedback(snd_kcontrol_t * kcontrol,
 static snd_kcontrol_new_t snd_ca0106_volume_control_analog_front =
 {
         .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
-        .name =         "Analog Front Volume",
+        .name =         "Analog Front Playback Volume",
         .info =         snd_ca0106_volume_info,
         .get =          snd_ca0106_volume_get_analog_front,
         .put =          snd_ca0106_volume_put_analog_front
@@ -490,7 +490,7 @@ static snd_kcontrol_new_t snd_ca0106_volume_control_analog_front =
 static snd_kcontrol_new_t snd_ca0106_volume_control_analog_center_lfe =
 {
         .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
-        .name =         "Analog Center/LFE Volume",
+        .name =         "Analog Center/LFE Playback Volume",
         .info =         snd_ca0106_volume_info,
         .get =          snd_ca0106_volume_get_analog_center_lfe,
         .put =          snd_ca0106_volume_put_analog_center_lfe
@@ -498,7 +498,7 @@ static snd_kcontrol_new_t snd_ca0106_volume_control_analog_center_lfe =
 static snd_kcontrol_new_t snd_ca0106_volume_control_analog_unknown =
 {
         .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
-        .name =         "Analog Side Volume",
+        .name =         "Analog Side Playback Volume",
         .info =         snd_ca0106_volume_info,
         .get =          snd_ca0106_volume_get_analog_unknown,
         .put =          snd_ca0106_volume_put_analog_unknown
@@ -506,7 +506,7 @@ static snd_kcontrol_new_t snd_ca0106_volume_control_analog_unknown =
 static snd_kcontrol_new_t snd_ca0106_volume_control_analog_rear =
 {
         .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
-        .name =         "Analog Rear Volume",
+        .name =         "Analog Rear Playback Volume",
         .info =         snd_ca0106_volume_info,
         .get =          snd_ca0106_volume_get_analog_rear,
         .put =          snd_ca0106_volume_put_analog_rear
@@ -514,7 +514,7 @@ static snd_kcontrol_new_t snd_ca0106_volume_control_analog_rear =
 static snd_kcontrol_new_t snd_ca0106_volume_control_spdif_front =
 {
         .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
-        .name =         "SPDIF Front Volume",
+        .name =         "SPDIF Front Playback Volume",
         .info =         snd_ca0106_volume_info,
         .get =          snd_ca0106_volume_get_spdif_front,
         .put =          snd_ca0106_volume_put_spdif_front
@@ -522,7 +522,7 @@ static snd_kcontrol_new_t snd_ca0106_volume_control_spdif_front =
 static snd_kcontrol_new_t snd_ca0106_volume_control_spdif_center_lfe =
 {
         .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
-        .name =         "SPDIF Center/LFE Volume",
+        .name =         "SPDIF Center/LFE Playback Volume",
         .info =         snd_ca0106_volume_info,
         .get =          snd_ca0106_volume_get_spdif_center_lfe,
         .put =          snd_ca0106_volume_put_spdif_center_lfe
@@ -530,7 +530,7 @@ static snd_kcontrol_new_t snd_ca0106_volume_control_spdif_center_lfe =
 static snd_kcontrol_new_t snd_ca0106_volume_control_spdif_unknown =
 {
         .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
-        .name =         "SPDIF Unknown Volume",
+        .name =         "SPDIF Unknown Playback Volume",
         .info =         snd_ca0106_volume_info,
         .get =          snd_ca0106_volume_get_spdif_unknown,
         .put =          snd_ca0106_volume_put_spdif_unknown
@@ -538,7 +538,7 @@ static snd_kcontrol_new_t snd_ca0106_volume_control_spdif_unknown =
 static snd_kcontrol_new_t snd_ca0106_volume_control_spdif_rear =
 {
         .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
-        .name =         "SPDIF Rear Volume",
+        .name =         "SPDIF Rear Playback Volume",
         .info =         snd_ca0106_volume_info,
         .get =          snd_ca0106_volume_get_spdif_rear,
         .put =          snd_ca0106_volume_put_spdif_rear
@@ -547,7 +547,7 @@ static snd_kcontrol_new_t snd_ca0106_volume_control_spdif_rear =
 static snd_kcontrol_new_t snd_ca0106_volume_control_feedback =
 {
         .iface =        SNDRV_CTL_ELEM_IFACE_MIXER,
-        .name =         "CAPTURE feedback into PLAYBACK",
+        .name =         "CAPTURE feedback Playback Volume",
         .info =         snd_ca0106_volume_info,
         .get =          snd_ca0106_volume_get_feedback,
         .put =          snd_ca0106_volume_put_feedback
diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c
index b098b51099c2..1eb3315d136d 100644
--- a/sound/pci/cmipci.c
+++ b/sound/pci/cmipci.c
@@ -79,13 +79,6 @@ module_param_array(joystick_port, int, NULL, 0444);
 MODULE_PARM_DESC(joystick_port, "Joystick port address.");
 #endif
 
-#ifndef PCI_DEVICE_ID_CMEDIA_CM8738
-#define PCI_DEVICE_ID_CMEDIA_CM8738     0x0111
-#endif
-#ifndef PCI_DEVICE_ID_CMEDIA_CM8738B
-#define PCI_DEVICE_ID_CMEDIA_CM8738B    0x0112
-#endif
-
 /*
  * CM8x38 registers definition
  */
@@ -348,25 +341,6 @@ MODULE_PARM_DESC(joystick_port, "Joystick port address.");
 
 
 /*
- * pci ids
- */
-#ifndef PCI_VENDOR_ID_CMEDIA
-#define PCI_VENDOR_ID_CMEDIA         0x13F6
-#endif
-#ifndef PCI_DEVICE_ID_CMEDIA_CM8338A
-#define PCI_DEVICE_ID_CMEDIA_CM8338A 0x0100
-#endif
-#ifndef PCI_DEVICE_ID_CMEDIA_CM8338B
-#define PCI_DEVICE_ID_CMEDIA_CM8338B 0x0101
-#endif
-#ifndef PCI_DEVICE_ID_CMEDIA_CM8738
-#define PCI_DEVICE_ID_CMEDIA_CM8738  0x0111
-#endif
-#ifndef PCI_DEVICE_ID_CMEDIA_CM8738B
-#define PCI_DEVICE_ID_CMEDIA_CM8738B 0x0112
-#endif
-
-/*
  * channels for playback / capture
  */
 #define CM_CH_PLAY      0
@@ -2801,7 +2775,7 @@ static int __devinit snd_cmipci_create(snd_card_t *card, struct pci_dev *pci,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        cm = kcalloc(1, sizeof(*cm), GFP_KERNEL);
+        cm = kzalloc(sizeof(*cm), GFP_KERNEL);
         if (cm == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -3063,6 +3037,7 @@ static void __devexit snd_cmipci_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "C-Media PCI",
+        .owner = THIS_MODULE,
         .id_table = snd_cmipci_ids,
         .probe = snd_cmipci_probe,
         .remove = __devexit_p(snd_cmipci_remove),
diff --git a/sound/pci/cs4281.c b/sound/pci/cs4281.c
index c7a370d4f923..dc87e0144b5a 100644
--- a/sound/pci/cs4281.c
+++ b/sound/pci/cs4281.c
@@ -57,17 +57,6 @@ module_param_array(dual_codec, bool, NULL, 0444);
 MODULE_PARM_DESC(dual_codec, "Secondary Codec ID (0 = disabled).");
 
 /*
- *
- */
-
-#ifndef PCI_VENDOR_ID_CIRRUS
-#define PCI_VENDOR_ID_CIRRUS            0x1013
-#endif
-#ifndef PCI_DEVICE_ID_CIRRUS_4281
-#define PCI_DEVICE_ID_CIRRUS_4281       0x6005
-#endif
-
-/*
  *  Direct registers
  */
 
@@ -1394,7 +1383,7 @@ static int __devinit snd_cs4281_create(snd_card_t * card,
         *rchip = NULL;
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -2119,6 +2108,7 @@ static int cs4281_resume(snd_card_t *card)
 
 static struct pci_driver driver = {
         .name = "CS4281",
+        .owner = THIS_MODULE,
         .id_table = snd_cs4281_ids,
         .probe = snd_cs4281_probe,
         .remove = __devexit_p(snd_cs4281_remove),
diff --git a/sound/pci/cs46xx/cs46xx.c b/sound/pci/cs46xx/cs46xx.c
index b9fff4ee6f9d..32b4f8465cef 100644
--- a/sound/pci/cs46xx/cs46xx.c
+++ b/sound/pci/cs46xx/cs46xx.c
@@ -163,6 +163,7 @@ static void __devexit snd_card_cs46xx_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "Sound Fusion CS46xx",
+        .owner = THIS_MODULE,
         .id_table = snd_cs46xx_ids,
         .probe = snd_card_cs46xx_probe,
         .remove = __devexit_p(snd_card_cs46xx_remove),
diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
index 4b052158ee33..6e3855b8b33d 100644
--- a/sound/pci/cs46xx/cs46xx_lib.c
+++ b/sound/pci/cs46xx/cs46xx_lib.c
@@ -1304,7 +1304,7 @@ static int _cs46xx_playback_open_channel (snd_pcm_substream_t * substream,int pc
         cs46xx_pcm_t * cpcm;
         snd_pcm_runtime_t *runtime = substream->runtime;
 
-        cpcm = kcalloc(1, sizeof(*cpcm), GFP_KERNEL);
+        cpcm = kzalloc(sizeof(*cpcm), GFP_KERNEL);
         if (cpcm == NULL)
                 return -ENOMEM;
         if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(chip->pci),
@@ -3525,17 +3525,6 @@ static void amp_voyetra_4294(cs46xx_t *chip, int change)
 
 
 /*
- * piix4 pci ids
- */
-#ifndef PCI_VENDOR_ID_INTEL
-#define PCI_VENDOR_ID_INTEL 0x8086
-#endif /* PCI_VENDOR_ID_INTEL */
-
-#ifndef PCI_DEVICE_ID_INTEL_82371AB_3
-#define PCI_DEVICE_ID_INTEL_82371AB_3 0x7113
-#endif /* PCI_DEVICE_ID_INTEL_82371AB_3 */
-
-/*
  *      Handle the CLKRUN on a thinkpad. We must disable CLKRUN support
  *      whenever we need to beat on the chip.
  *
@@ -3548,7 +3537,7 @@ static void clkrun_hack(cs46xx_t *chip, int change)
 {
         u16 control, nval;
         
-        if (chip->acpi_dev == NULL)
+        if (!chip->acpi_port)
                 return;
 
         chip->amplifier += change;
@@ -3571,15 +3560,20 @@ static void clkrun_hack(cs46xx_t *chip, int change)
  */
 static void clkrun_init(cs46xx_t *chip)
 {
+        struct pci_dev *pdev;
         u8 pp;
 
-        chip->acpi_dev = pci_find_device(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82371AB_3, NULL);
-        if (chip->acpi_dev == NULL)
+        chip->acpi_port = 0;
+        
+        pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                PCI_DEVICE_ID_INTEL_82371AB_3, NULL);
+        if (pdev == NULL)
                 return;         /* Not a thinkpad thats for sure */
 
         /* Find the control port */             
-        pci_read_config_byte(chip->acpi_dev, 0x41, &pp);
+        pci_read_config_byte(pdev, 0x41, &pp);
         chip->acpi_port = pp << 8;
+        pci_dev_put(pdev);
 }
 
 
@@ -3780,7 +3774,7 @@ int __devinit snd_cs46xx_create(snd_card_t * card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
index fc377c4b666c..b0e00f0a7c2f 100644
--- a/sound/pci/emu10k1/emu10k1.c
+++ b/sound/pci/emu10k1/emu10k1.c
@@ -223,6 +223,7 @@ static void __devexit snd_card_emu10k1_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "EMU10K1_Audigy",
+        .owner = THIS_MODULE,
         .id_table = snd_emu10k1_ids,
         .probe = snd_card_emu10k1_probe,
         .remove = __devexit_p(snd_card_emu10k1_remove),
diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
index e69d5b739e80..e87e8427f25f 100644
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -754,12 +754,11 @@ static emu_chip_details_t emu_chip_details[] = {
          .emu10k1_chip = 1,
          .ac97_chip = 1,
          .sblive51 = 1} ,
-        /* Tested by alsa bugtrack user "hus" 12th Sept 2005 */
+        /* Tested by alsa bugtrack user "hus" bug #1297 12th Aug 2005 */
         {.vendor = 0x1102, .device = 0x0002, .subsystem = 0x80611102,
-         .driver = "EMU10K1", .name = "SBLive! Player 5.1 [SB0060]", 
+         .driver = "EMU10K1", .name = "SBLive! Platinum 5.1 [SB0060]", 
          .id = "Live",
          .emu10k1_chip = 1,
-         .ac97_chip = 1,
          .sblive51 = 1} ,
         {.vendor = 0x1102, .device = 0x0002, .subsystem = 0x80511102,
          .driver = "EMU10K1", .name = "SBLive! Value [CT4850]", 
@@ -865,7 +864,7 @@ int __devinit snd_emu10k1_create(snd_card_t * card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        emu = kcalloc(1, sizeof(*emu), GFP_KERNEL);
+        emu = kzalloc(sizeof(*emu), GFP_KERNEL);
         if (emu == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
diff --git a/sound/pci/emu10k1/emu10k1x.c b/sound/pci/emu10k1/emu10k1x.c
index 52c7826df440..ad15755a63c3 100644
--- a/sound/pci/emu10k1/emu10k1x.c
+++ b/sound/pci/emu10k1/emu10k1x.c
@@ -395,7 +395,7 @@ static int snd_emu10k1x_playback_open(snd_pcm_substream_t *substream)
         if ((err = snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_PERIOD_BYTES, 64)) < 0)
                 return err;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
         if (epcm == NULL)
                 return -ENOMEM;
         epcm->emu = chip;
@@ -571,7 +571,7 @@ static int snd_emu10k1x_pcm_open_capture(snd_pcm_substream_t *substream)
         if ((err = snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_PERIOD_BYTES, 64)) < 0)
                 return err;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
         if (epcm == NULL)
                 return -ENOMEM;
 
@@ -920,7 +920,7 @@ static int __devinit snd_emu10k1x_create(snd_card_t *card,
                 return -ENXIO;
         }
   
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1615,6 +1615,7 @@ MODULE_DEVICE_TABLE(pci, snd_emu10k1x_ids);
 // pci_driver definition
 static struct pci_driver driver = {
         .name = "EMU10K1X",
+        .owner = THIS_MODULE,
         .id_table = snd_emu10k1x_ids,
         .probe = snd_emu10k1x_probe,
         .remove = __devexit_p(snd_emu10k1x_remove),
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index 637c555cfdb1..646b5d972e6f 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -470,7 +470,7 @@ static void snd_emu10k1_write_op(emu10k1_fx8010_code_t *icode, unsigned int *ptr
 {
         u_int32_t *code;
         snd_assert(*ptr < 512, return);
-        code = (u_int32_t *)icode->code + (*ptr) * 2;
+        code = (u_int32_t __force *)icode->code + (*ptr) * 2;
         set_bit(*ptr, icode->code_valid);
         code[0] = ((x & 0x3ff) << 10) | (y & 0x3ff);
         code[1] = ((op & 0x0f) << 20) | ((r & 0x3ff) << 10) | (a & 0x3ff);
@@ -485,7 +485,7 @@ static void snd_emu10k1_audigy_write_op(emu10k1_fx8010_code_t *icode, unsigned i
 {
         u_int32_t *code;
         snd_assert(*ptr < 1024, return);
-        code = (u_int32_t *)icode->code + (*ptr) * 2;
+        code = (u_int32_t __force *)icode->code + (*ptr) * 2;
         set_bit(*ptr, icode->code_valid);
         code[0] = ((x & 0x7ff) << 12) | (y & 0x7ff);
         code[1] = ((op & 0x0f) << 24) | ((r & 0x7ff) << 12) | (a & 0x7ff);
@@ -1036,13 +1036,13 @@ static int __devinit _snd_emu10k1_audigy_init_efx(emu10k1_t *emu)
         spin_lock_init(&emu->fx8010.irq_lock);
         INIT_LIST_HEAD(&emu->fx8010.gpr_ctl);
 
-        if ((icode = kcalloc(1, sizeof(*icode), GFP_KERNEL)) == NULL ||
+        if ((icode = kzalloc(sizeof(*icode), GFP_KERNEL)) == NULL ||
             (icode->gpr_map = (u_int32_t __user *)kcalloc(512 + 256 + 256 + 2 * 1024, sizeof(u_int32_t), GFP_KERNEL)) == NULL ||
             (controls = kcalloc(SND_EMU10K1_GPR_CONTROLS, sizeof(*controls), GFP_KERNEL)) == NULL) {
                 err = -ENOMEM;
                 goto __err;
         }
-        gpr_map = (u32 *)icode->gpr_map;
+        gpr_map = (u32 __force *)icode->gpr_map;
 
         icode->tram_data_map = icode->gpr_map + 512;
         icode->tram_addr_map = icode->tram_data_map + 256;
@@ -1431,7 +1431,7 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input))
  __err:
         kfree(controls);
         if (icode != NULL) {
-                kfree((void *)icode->gpr_map);
+                kfree((void __force *)icode->gpr_map);
                 kfree(icode);
         }
         return err;
@@ -1503,15 +1503,15 @@ static int __devinit _snd_emu10k1_init_efx(emu10k1_t *emu)
         spin_lock_init(&emu->fx8010.irq_lock);
         INIT_LIST_HEAD(&emu->fx8010.gpr_ctl);
 
-        if ((icode = kcalloc(1, sizeof(*icode), GFP_KERNEL)) == NULL)
+        if ((icode = kzalloc(sizeof(*icode), GFP_KERNEL)) == NULL)
                 return -ENOMEM;
         if ((icode->gpr_map = (u_int32_t __user *)kcalloc(256 + 160 + 160 + 2 * 512, sizeof(u_int32_t), GFP_KERNEL)) == NULL ||
             (controls = kcalloc(SND_EMU10K1_GPR_CONTROLS, sizeof(emu10k1_fx8010_control_gpr_t), GFP_KERNEL)) == NULL ||
-            (ipcm = kcalloc(1, sizeof(*ipcm), GFP_KERNEL)) == NULL) {
+            (ipcm = kzalloc(sizeof(*ipcm), GFP_KERNEL)) == NULL) {
                 err = -ENOMEM;
                 goto __err;
         }
-        gpr_map = (u32 *)icode->gpr_map;
+        gpr_map = (u32 __force *)icode->gpr_map;
 
         icode->tram_data_map = icode->gpr_map + 256;
         icode->tram_addr_map = icode->tram_data_map + 160;
@@ -2032,7 +2032,7 @@ static int __devinit _snd_emu10k1_init_efx(emu10k1_t *emu)
         kfree(ipcm);
         kfree(controls);
         if (icode != NULL) {
-                kfree((void *)icode->gpr_map);
+                kfree((void __force *)icode->gpr_map);
                 kfree(icode);
         }
         return err;
@@ -2217,7 +2217,7 @@ static int snd_emu10k1_fx8010_ioctl(snd_hwdep_t * hw, struct file *file, unsigne
                 kfree(ipcm);
                 return res;
         case SNDRV_EMU10K1_IOCTL_PCM_PEEK:
-                ipcm = kcalloc(1, sizeof(*ipcm), GFP_KERNEL);
+                ipcm = kzalloc(sizeof(*ipcm), GFP_KERNEL);
                 if (ipcm == NULL)
                         return -ENOMEM;
                 if (copy_from_user(ipcm, argp, sizeof(*ipcm))) {
diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
index 9c35f6dde1b5..66ba27afe962 100644
--- a/sound/pci/emu10k1/emupcm.c
+++ b/sound/pci/emu10k1/emupcm.c
@@ -1016,7 +1016,7 @@ static int snd_emu10k1_efx_playback_open(snd_pcm_substream_t * substream)
         snd_pcm_runtime_t *runtime = substream->runtime;
         int i;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
         if (epcm == NULL)
                 return -ENOMEM;
         epcm->emu = emu;
@@ -1049,7 +1049,7 @@ static int snd_emu10k1_playback_open(snd_pcm_substream_t * substream)
         snd_pcm_runtime_t *runtime = substream->runtime;
         int i, err;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
         if (epcm == NULL)
                 return -ENOMEM;
         epcm->emu = emu;
@@ -1094,7 +1094,7 @@ static int snd_emu10k1_capture_open(snd_pcm_substream_t * substream)
         snd_pcm_runtime_t *runtime = substream->runtime;
         emu10k1_pcm_t *epcm;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
         if (epcm == NULL)
                 return -ENOMEM;
         epcm->emu = emu;
@@ -1130,7 +1130,7 @@ static int snd_emu10k1_capture_mic_open(snd_pcm_substream_t * substream)
         emu10k1_pcm_t *epcm;
         snd_pcm_runtime_t *runtime = substream->runtime;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
         if (epcm == NULL)
                 return -ENOMEM;
         epcm->emu = emu;
@@ -1170,7 +1170,7 @@ static int snd_emu10k1_capture_efx_open(snd_pcm_substream_t * substream)
         int nefx = emu->audigy ? 64 : 32;
         int idx;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
         if (epcm == NULL)
                 return -ENOMEM;
         epcm->emu = emu;
diff --git a/sound/pci/emu10k1/p16v.c b/sound/pci/emu10k1/p16v.c
index a1691330d3b6..d59c7f345ad6 100644
--- a/sound/pci/emu10k1/p16v.c
+++ b/sound/pci/emu10k1/p16v.c
@@ -178,7 +178,7 @@ static int snd_p16v_pcm_open_playback_channel(snd_pcm_substream_t *substream, in
         snd_pcm_runtime_t *runtime = substream->runtime;
         int err;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
         //snd_printk("epcm kcalloc: %p\n", epcm);
 
         if (epcm == NULL)
@@ -214,7 +214,7 @@ static int snd_p16v_pcm_open_capture_channel(snd_pcm_substream_t *substream, int
         snd_pcm_runtime_t *runtime = substream->runtime;
         int err;
 
-        epcm = kcalloc(1, sizeof(*epcm), GFP_KERNEL);
+        epcm = kzalloc(sizeof(*epcm), GFP_KERNEL);
         //snd_printk("epcm kcalloc: %p\n", epcm);
 
         if (epcm == NULL)
diff --git a/sound/pci/ens1370.c b/sound/pci/ens1370.c
index f06b95f41a1d..bef9a59f46d7 100644
--- a/sound/pci/ens1370.c
+++ b/sound/pci/ens1370.c
@@ -100,13 +100,6 @@ MODULE_PARM_DESC(joystick, "Enable joystick.");
 #endif
 #endif /* SUPPORT_JOYSTICK */
 
-#ifndef PCI_DEVICE_ID_ENSONIQ_CT5880
-#define PCI_DEVICE_ID_ENSONIQ_CT5880    0x5880
-#endif
-#ifndef PCI_DEVICE_ID_ENSONIQ_ES1371
-#define PCI_DEVICE_ID_ENSONIQ_ES1371    0x1371
-#endif
-
 /* ES1371 chip ID */
 /* This is a little confusing because all ES1371 compatible chips have the
    same DEVICE_ID, the only thing differentiating them is the REV_ID field.
@@ -1950,7 +1943,7 @@ static int __devinit snd_ensoniq_create(snd_card_t * card,
         *rensoniq = NULL;
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
-        ensoniq = kcalloc(1, sizeof(*ensoniq), GFP_KERNEL);
+        ensoniq = kzalloc(sizeof(*ensoniq), GFP_KERNEL);
         if (ensoniq == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -2394,6 +2387,7 @@ static void __devexit snd_audiopci_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = DRIVER_NAME,
+        .owner = THIS_MODULE,
         .id_table = snd_audiopci_ids,
         .probe = snd_audiopci_probe,
         .remove = __devexit_p(snd_audiopci_remove),
diff --git a/sound/pci/es1938.c b/sound/pci/es1938.c
index b492777bc30f..17fa80c23870 100644
--- a/sound/pci/es1938.c
+++ b/sound/pci/es1938.c
@@ -76,13 +76,6 @@ MODULE_SUPPORTED_DEVICE("{{ESS,ES1938},"
 #define SUPPORT_JOYSTICK 1
 #endif
 
-#ifndef PCI_VENDOR_ID_ESS
-#define PCI_VENDOR_ID_ESS               0x125d
-#endif
-#ifndef PCI_DEVICE_ID_ESS_ES1938
-#define PCI_DEVICE_ID_ESS_ES1938        0x1969
-#endif
-
 static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;      /* Index 0-MAX */
 static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;       /* ID for this card */
 static int enable[SNDRV_CARDS] = SNDRV_DEFAULT_ENABLE_PNP;      /* Enable this card */
@@ -1501,7 +1494,7 @@ static int __devinit snd_es1938_create(snd_card_t * card,
                 return -ENXIO;
         }
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1753,6 +1746,7 @@ static void __devexit snd_es1938_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "ESS ES1938 (Solo-1)",
+        .owner = THIS_MODULE,
         .id_table = snd_es1938_ids,
         .probe = snd_es1938_probe,
         .remove = __devexit_p(snd_es1938_remove),
diff --git a/sound/pci/es1968.c b/sound/pci/es1968.c
index 9d7a28783930..ecdcada90ca2 100644
--- a/sound/pci/es1968.c
+++ b/sound/pci/es1968.c
@@ -160,25 +160,6 @@ MODULE_PARM_DESC(joystick, "Enable joystick.");
 #endif
 
 
-/* PCI Dev ID's */
-
-#ifndef PCI_VENDOR_ID_ESS
-#define PCI_VENDOR_ID_ESS       0x125D
-#endif
-
-#define PCI_VENDOR_ID_ESS_OLD   0x1285  /* Platform Tech, the people the ESS
-                                           was bought form */
-
-#ifndef PCI_DEVICE_ID_ESS_M2E
-#define PCI_DEVICE_ID_ESS_M2E   0x1978
-#endif
-#ifndef PCI_DEVICE_ID_ESS_M2
-#define PCI_DEVICE_ID_ESS_M2    0x1968
-#endif
-#ifndef PCI_DEVICE_ID_ESS_M1
-#define PCI_DEVICE_ID_ESS_M1    0x0100
-#endif
-
 #define NR_APUS                 64
 #define NR_APU_REGS             16
 
@@ -1596,7 +1577,7 @@ static int snd_es1968_playback_open(snd_pcm_substream_t *substream)
         if (apu1 < 0)
                 return apu1;
 
-        es = kcalloc(1, sizeof(*es), GFP_KERNEL);
+        es = kzalloc(sizeof(*es), GFP_KERNEL);
         if (!es) {
                 snd_es1968_free_apu_pair(chip, apu1);
                 return -ENOMEM;
@@ -1641,7 +1622,7 @@ static int snd_es1968_capture_open(snd_pcm_substream_t *substream)
                 return apu2;
         }
         
-        es = kcalloc(1, sizeof(*es), GFP_KERNEL);
+        es = kzalloc(sizeof(*es), GFP_KERNEL);
         if (!es) {
                 snd_es1968_free_apu_pair(chip, apu1);
                 snd_es1968_free_apu_pair(chip, apu2);
@@ -2588,7 +2569,7 @@ static int __devinit snd_es1968_create(snd_card_t * card,
                 return -ENXIO;
         }
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (! chip) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -2782,6 +2763,7 @@ static void __devexit snd_es1968_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "ES1968 (ESS Maestro)",
+        .owner = THIS_MODULE,
         .id_table = snd_es1968_ids,
         .probe = snd_es1968_probe,
         .remove = __devexit_p(snd_es1968_remove),
diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
index 36b2f62e8573..e5cfa2a0c246 100644
--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -1263,7 +1263,7 @@ static int __devinit snd_fm801_create(snd_card_t * card,
         *rchip = NULL;
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1462,6 +1462,7 @@ static void __devexit snd_card_fm801_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "FM801",
+        .owner = THIS_MODULE,
         .id_table = snd_fm801_ids,
         .probe = snd_card_fm801_probe,
         .remove = __devexit_p(snd_card_fm801_remove),
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 20f7762f7144..3815403ed095 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -288,7 +288,7 @@ static int init_unsol_queue(struct hda_bus *bus)
 {
         struct hda_bus_unsolicited *unsol;
 
-        unsol = kcalloc(1, sizeof(*unsol), GFP_KERNEL);
+        unsol = kzalloc(sizeof(*unsol), GFP_KERNEL);
         if (! unsol) {
                 snd_printk(KERN_ERR "hda_codec: can't allocate unsolicited queue\n");
                 return -ENOMEM;
@@ -358,7 +358,7 @@ int snd_hda_bus_new(snd_card_t *card, const struct hda_bus_template *temp,
         if (busp)
                 *busp = NULL;
 
-        bus = kcalloc(1, sizeof(*bus), GFP_KERNEL);
+        bus = kzalloc(sizeof(*bus), GFP_KERNEL);
         if (bus == NULL) {
                 snd_printk(KERN_ERR "can't allocate struct hda_bus\n");
                 return -ENOMEM;
@@ -493,7 +493,7 @@ int snd_hda_codec_new(struct hda_bus *bus, unsigned int codec_addr,
                 return -EBUSY;
         }
 
-        codec = kcalloc(1, sizeof(*codec), GFP_KERNEL);
+        codec = kzalloc(sizeof(*codec), GFP_KERNEL);
         if (codec == NULL) {
                 snd_printk(KERN_ERR "can't allocate struct hda_codec\n");
                 return -ENOMEM;
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index 63a29a8a2860..bb53bcf76742 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -505,6 +505,7 @@ struct hda_pcm_stream {
 struct hda_pcm {
         char *name;
         struct hda_pcm_stream stream[2];
+        unsigned int is_modem;  /* modem codec? */
 };
 
 /* codec information */
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 1229227af5b5..5b829a1a4c60 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -98,7 +98,7 @@ static int add_new_node(struct hda_codec *codec, struct hda_gspec *spec, hda_nid
         struct hda_gnode *node;
         int nconns;
 
-        node = kcalloc(1, sizeof(*node), GFP_KERNEL);
+        node = kzalloc(sizeof(*node), GFP_KERNEL);
         if (node == NULL)
                 return -ENOMEM;
         node->nid = nid;
@@ -886,7 +886,7 @@ int snd_hda_parse_generic_codec(struct hda_codec *codec)
                 return -ENODEV;
         }
 
-        spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        spec = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL) {
                 printk(KERN_ERR "hda_generic: can't allocate spec\n");
                 return -ENOMEM;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 15107df1f490..9590ece2099d 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -62,7 +62,7 @@ MODULE_PARM_DESC(enable, "Enable Intel HD audio interface.");
 module_param_array(model, charp, NULL, 0444);
 MODULE_PARM_DESC(model, "Use the given board model.");
 module_param_array(position_fix, int, NULL, 0444);
-MODULE_PARM_DESC(position_fix, "Fix DMA pointer (0 = FIFO size, 1 = none, 2 = POSBUF).");
+MODULE_PARM_DESC(position_fix, "Fix DMA pointer (0 = auto, 1 = none, 2 = POSBUF, 3 = FIFO size).");
 
 MODULE_LICENSE("GPL");
 MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
@@ -164,7 +164,9 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 /* max buffer size - no h/w limit, you can increase as you like */
 #define AZX_MAX_BUF_SIZE        (1024*1024*1024)
 /* max number of PCM devics per card */
-#define AZX_MAX_PCMS            8
+#define AZX_MAX_AUDIO_PCMS      6
+#define AZX_MAX_MODEM_PCMS      2
+#define AZX_MAX_PCMS            (AZX_MAX_AUDIO_PCMS + AZX_MAX_MODEM_PCMS)
 
 /* RIRB int mask: overrun[2], response[0] */
 #define RIRB_INT_RESPONSE       0x01
@@ -211,9 +213,10 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 
 /* position fix mode */
 enum {
-        POS_FIX_FIFO,
+        POS_FIX_AUTO,
         POS_FIX_NONE,
-        POS_FIX_POSBUF
+        POS_FIX_POSBUF,
+        POS_FIX_FIFO,
 };
 
 /* Defines for ATI HD Audio support in SB450 south bridge */
@@ -243,6 +246,7 @@ struct snd_azx_dev {
         unsigned int fragsize;          /* size of each period in bytes */
         unsigned int frags;             /* number for period in the play buffer */
         unsigned int fifo_size;         /* FIFO size */
+        unsigned int last_pos;          /* last updated period position */
 
         void __iomem *sd_addr;          /* stream descriptor pointer */
 
@@ -256,6 +260,7 @@ struct snd_azx_dev {
 
         unsigned int opened: 1;
         unsigned int running: 1;
+        unsigned int period_updating: 1;
 };
 
 /* CORB/RIRB */
@@ -724,11 +729,9 @@ static void azx_init_chip(azx_t *chip)
         /* initialize the codec command I/O */
         azx_init_cmd_io(chip);
 
-        if (chip->position_fix == POS_FIX_POSBUF) {
-                /* program the position buffer */
-                azx_writel(chip, DPLBASE, (u32)chip->posbuf.addr);
-                azx_writel(chip, DPUBASE, upper_32bit(chip->posbuf.addr));
-        }
+        /* program the position buffer */
+        azx_writel(chip, DPLBASE, (u32)chip->posbuf.addr);
+        azx_writel(chip, DPUBASE, upper_32bit(chip->posbuf.addr));
 
         /* For ATI SB450 azalia HD audio, we need to enable snoop */
         if (chip->driver_type == AZX_DRIVER_ATI) {
@@ -763,9 +766,11 @@ static irqreturn_t azx_interrupt(int irq, void* dev_id, struct pt_regs *regs)
                 if (status & azx_dev->sd_int_sta_mask) {
                         azx_sd_writeb(azx_dev, SD_STS, SD_INT_MASK);
                         if (azx_dev->substream && azx_dev->running) {
+                                azx_dev->period_updating = 1;
                                 spin_unlock(&chip->reg_lock);
                                 snd_pcm_period_elapsed(azx_dev->substream);
                                 spin_lock(&chip->reg_lock);
+                                azx_dev->period_updating = 0;
                         }
                 }
         }
@@ -866,11 +871,9 @@ static int azx_setup_controller(azx_t *chip, azx_dev_t *azx_dev)
         /* upper BDL address */
         azx_sd_writel(azx_dev, SD_BDLPU, upper_32bit(azx_dev->bdl_addr));
 
-        if (chip->position_fix == POS_FIX_POSBUF) {
-                /* enable the position buffer */
-                if (! (azx_readl(chip, DPLBASE) & ICH6_DPLBASE_ENABLE))
-                        azx_writel(chip, DPLBASE, (u32)chip->posbuf.addr | ICH6_DPLBASE_ENABLE);
-        }
+        /* enable the position buffer */
+        if (! (azx_readl(chip, DPLBASE) & ICH6_DPLBASE_ENABLE))
+                azx_writel(chip, DPLBASE, (u32)chip->posbuf.addr | ICH6_DPLBASE_ENABLE);
 
         /* set the interrupt enable bits in the descriptor control register */
         azx_sd_writel(azx_dev, SD_CTL, azx_sd_readl(azx_dev, SD_CTL) | SD_INT_MASK);
@@ -1078,6 +1081,7 @@ static int azx_pcm_prepare(snd_pcm_substream_t *substream)
                 azx_dev->fifo_size = azx_sd_readw(azx_dev, SD_FIFOSIZE) + 1;
         else
                 azx_dev->fifo_size = 0;
+        azx_dev->last_pos = 0;
 
         return hinfo->ops.prepare(hinfo, apcm->codec, azx_dev->stream_tag,
                                   azx_dev->format_val, substream);
@@ -1133,6 +1137,26 @@ static snd_pcm_uframes_t azx_pcm_pointer(snd_pcm_substream_t *substream)
                 pos = azx_sd_readl(azx_dev, SD_LPIB);
                 if (chip->position_fix == POS_FIX_FIFO)
                         pos += azx_dev->fifo_size;
+                else if (chip->position_fix == POS_FIX_AUTO && azx_dev->period_updating) {
+                        /* check the validity of DMA position */
+                        unsigned int diff = 0;
+                        azx_dev->last_pos += azx_dev->fragsize;
+                        if (azx_dev->last_pos > pos)
+                                diff = azx_dev->last_pos - pos;
+                        if (azx_dev->last_pos >= azx_dev->bufsize) {
+                                if (pos < azx_dev->fragsize)
+                                        diff = 0;
+                                azx_dev->last_pos = 0;
+                        }
+                        if (diff > 0 && diff <= azx_dev->fifo_size)
+                                pos += azx_dev->fifo_size;
+                        else {
+                                snd_printdd(KERN_INFO "hda_intel: DMA position fix %d, switching to posbuf\n", diff);
+                                chip->position_fix = POS_FIX_POSBUF;
+                                pos = *azx_dev->posbuf;
+                        }
+                        azx_dev->period_updating = 0;
+                }
         }
         if (pos >= azx_dev->bufsize)
                 pos = 0;
@@ -1203,12 +1227,33 @@ static int __devinit azx_pcm_create(azx_t *chip)
         if ((err = snd_hda_build_pcms(chip->bus)) < 0)
                 return err;
 
+        /* create audio PCMs */
         pcm_dev = 0;
         list_for_each(p, &chip->bus->codec_list) {
                 codec = list_entry(p, struct hda_codec, list);
                 for (c = 0; c < codec->num_pcms; c++) {
+                        if (codec->pcm_info[c].is_modem)
+                                continue; /* create later */
+                        if (pcm_dev >= AZX_MAX_AUDIO_PCMS) {
+                                snd_printk(KERN_ERR SFX "Too many audio PCMs\n");
+                                return -EINVAL;
+                        }
+                        err = create_codec_pcm(chip, codec, &codec->pcm_info[c], pcm_dev);
+                        if (err < 0)
+                                return err;
+                        pcm_dev++;
+                }
+        }
+
+        /* create modem PCMs */
+        pcm_dev = AZX_MAX_AUDIO_PCMS;
+        list_for_each(p, &chip->bus->codec_list) {
+                codec = list_entry(p, struct hda_codec, list);
+                for (c = 0; c < codec->num_pcms; c++) {
+                        if (! codec->pcm_info[c].is_modem)
+                                continue; /* already created */
                         if (pcm_dev >= AZX_MAX_PCMS) {
-                                snd_printk(KERN_ERR SFX "Too many PCMs\n");
+                                snd_printk(KERN_ERR SFX "Too many modem PCMs\n");
                                 return -EINVAL;
                         }
                         err = create_codec_pcm(chip, codec, &codec->pcm_info[c], pcm_dev);
@@ -1244,8 +1289,7 @@ static int __devinit azx_init_stream(azx_t *chip)
                 azx_dev_t *azx_dev = &chip->azx_dev[i];
                 azx_dev->bdl = (u32 *)(chip->bdl.area + off);
                 azx_dev->bdl_addr = chip->bdl.addr + off;
-                if (chip->position_fix == POS_FIX_POSBUF)
-                        azx_dev->posbuf = (volatile u32 *)(chip->posbuf.area + i * 8);
+                azx_dev->posbuf = (volatile u32 *)(chip->posbuf.area + i * 8);
                 /* offset: SDI0=0x80, SDI1=0xa0, ... SDO3=0x160 */
                 azx_dev->sd_addr = chip->remap_addr + (0x20 * i + 0x80);
                 /* int mask: SDI0=0x01, SDI1=0x02, ... SDO3=0x80 */
@@ -1358,7 +1402,7 @@ static int __devinit azx_create(snd_card_t *card, struct pci_dev *pci,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         
         if (NULL == chip) {
                 snd_printk(KERN_ERR SFX "cannot allocate chip\n");
@@ -1437,13 +1481,11 @@ static int __devinit azx_create(snd_card_t *card, struct pci_dev *pci,
                 snd_printk(KERN_ERR SFX "cannot allocate BDL\n");
                 goto errout;
         }
-        if (chip->position_fix == POS_FIX_POSBUF) {
-                /* allocate memory for the position buffer */
-                if ((err = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(chip->pci),
-                                               chip->num_streams * 8, &chip->posbuf)) < 0) {
-                        snd_printk(KERN_ERR SFX "cannot allocate posbuf\n");
-                        goto errout;
-                }
+        /* allocate memory for the position buffer */
+        if ((err = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(chip->pci),
+                                       chip->num_streams * 8, &chip->posbuf)) < 0) {
+                snd_printk(KERN_ERR SFX "cannot allocate posbuf\n");
+                goto errout;
         }
         /* allocate CORB/RIRB */
         if ((err = azx_alloc_cmd_io(chip)) < 0)
@@ -1561,6 +1603,7 @@ MODULE_DEVICE_TABLE(pci, azx_ids);
 /* pci_driver definition */
 static struct pci_driver driver = {
         .name = "HDA Intel",
+        .owner = THIS_MODULE,
         .id_table = azx_ids,
         .probe = azx_probe,
         .remove = __devexit_p(azx_remove),
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index de1217bd8e68..08f6a6efc5e6 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -207,6 +207,8 @@ static void print_codec_info(snd_info_entry_t *entry, snd_info_buffer_t *buffer)
         snd_iprintf(buffer, "Vendor Id: 0x%x\n", codec->vendor_id);
         snd_iprintf(buffer, "Subsystem Id: 0x%x\n", codec->subsystem_id);
         snd_iprintf(buffer, "Revision Id: 0x%x\n", codec->revision_id);
+        if (! codec->afg)
+                return;
         snd_iprintf(buffer, "Default PCM: ");
         print_pcm_caps(buffer, codec, codec->afg);
         snd_iprintf(buffer, "Default Amp-In caps: ");
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index bceb83a42a38..da6874d3988c 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -465,7 +465,7 @@ static int patch_ad1986a(struct hda_codec *codec)
 {
         struct ad198x_spec *spec;
 
-        spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        spec = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL)
                 return -ENOMEM;
 
@@ -623,7 +623,7 @@ static int patch_ad1983(struct hda_codec *codec)
 {
         struct ad198x_spec *spec;
 
-        spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        spec = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL)
                 return -ENOMEM;
 
@@ -764,7 +764,7 @@ static int patch_ad1981(struct hda_codec *codec)
 {
         struct ad198x_spec *spec;
 
-        spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        spec = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL)
                 return -ENOMEM;
 
diff --git a/sound/pci/hda/patch_cmedia.c b/sound/pci/hda/patch_cmedia.c
index 07fb4f5a54b3..523c362ec44d 100644
--- a/sound/pci/hda/patch_cmedia.c
+++ b/sound/pci/hda/patch_cmedia.c
@@ -667,7 +667,7 @@ static int patch_cmi9880(struct hda_codec *codec)
 {
         struct cmi_spec *spec;
 
-        spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        spec = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL)
                 return -ENOMEM;
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index eeb900ab79af..849b5b50c921 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1526,6 +1526,7 @@ static struct hda_board_config alc880_cfg_tbl[] = {
         /* Back 3 jack, front 2 jack (Internal add Aux-In) */
         { .pci_subvendor = 0x1025, .pci_subdevice = 0xe310, .config = ALC880_3ST },
         { .pci_subvendor = 0x104d, .pci_subdevice = 0x81d6, .config = ALC880_3ST }, 
+        { .pci_subvendor = 0x104d, .pci_subdevice = 0x81a0, .config = ALC880_3ST },
 
         /* Back 3 jack plus 1 SPDIF out jack, front 2 jack */
         { .modelname = "3stack-digout", .config = ALC880_3ST_DIG },
@@ -1581,6 +1582,7 @@ static struct hda_board_config alc880_cfg_tbl[] = {
         { .pci_subvendor = 0x1043, .pci_subdevice = 0x1973, .config = ALC880_ASUS_DIG },
         { .pci_subvendor = 0x1043, .pci_subdevice = 0x19b3, .config = ALC880_ASUS_DIG },
         { .pci_subvendor = 0x1043, .pci_subdevice = 0x1113, .config = ALC880_ASUS_DIG },
+        { .pci_subvendor = 0x1043, .pci_subdevice = 0x1173, .config = ALC880_ASUS_DIG },
         { .pci_subvendor = 0x1043, .pci_subdevice = 0x1993, .config = ALC880_ASUS },
         { .pci_subvendor = 0x1043, .pci_subdevice = 0x10c3, .config = ALC880_ASUS_DIG },
         { .pci_subvendor = 0x1043, .pci_subdevice = 0x1133, .config = ALC880_ASUS },
@@ -2093,7 +2095,7 @@ static int patch_alc880(struct hda_codec *codec)
         int board_config;
         int i, err;
 
-        spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        spec = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL)
                 return -ENOMEM;
 
@@ -2365,7 +2367,7 @@ static int patch_alc260(struct hda_codec *codec)
         struct alc_spec *spec;
         int board_config;
 
-        spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        spec = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL)
                 return -ENOMEM;
 
@@ -2615,7 +2617,7 @@ static int patch_alc882(struct hda_codec *codec)
 {
         struct alc_spec *spec;
 
-        spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        spec = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL)
                 return -ENOMEM;
 
diff --git a/sound/pci/hda/patch_si3054.c b/sound/pci/hda/patch_si3054.c
index b0270d1b64ce..d014b7bb70df 100644
--- a/sound/pci/hda/patch_si3054.c
+++ b/sound/pci/hda/patch_si3054.c
@@ -214,6 +214,7 @@ static int si3054_build_pcms(struct hda_codec *codec)
         info->name = "Si3054 Modem";
         info->stream[SNDRV_PCM_STREAM_PLAYBACK] = si3054_pcm;
         info->stream[SNDRV_PCM_STREAM_CAPTURE]  = si3054_pcm;
+        info->is_modem = 1;
         return 0;
 }
 
@@ -282,7 +283,7 @@ static struct hda_codec_ops si3054_patch_ops = {
 
 static int patch_si3054(struct hda_codec *codec)
 {
-        struct si3054_spec *spec = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        struct si3054_spec *spec = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL)
                 return -ENOMEM;
         codec->spec = spec;
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 9d503da7320d..33a8adaea768 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -919,7 +919,7 @@ static int patch_stac9200(struct hda_codec *codec)
         struct sigmatel_spec *spec;
         int err;
 
-        spec  = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        spec  = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL)
                 return -ENOMEM;
 
@@ -957,7 +957,7 @@ static int patch_stac922x(struct hda_codec *codec)
         struct sigmatel_spec *spec;
         int err;
 
-        spec  = kcalloc(1, sizeof(*spec), GFP_KERNEL);
+        spec  = kzalloc(sizeof(*spec), GFP_KERNEL);
         if (spec == NULL)
                 return -ENOMEM;
 
diff --git a/sound/pci/ice1712/aureon.c b/sound/pci/ice1712/aureon.c
index 4405d96cbedf..2e0a31613ee6 100644
--- a/sound/pci/ice1712/aureon.c
+++ b/sound/pci/ice1712/aureon.c
@@ -1796,7 +1796,7 @@ static int __devinit aureon_init(ice1712_t *ice)
         }
 
         /* to remeber the register values of CS8415 */
-        ice->akm = kcalloc(1, sizeof(akm4xxx_t), GFP_KERNEL);
+        ice->akm = kzalloc(sizeof(akm4xxx_t), GFP_KERNEL);
         if (! ice->akm)
                 return -ENOMEM;
         ice->akm_codecs = 1;
diff --git a/sound/pci/ice1712/ice1712.c b/sound/pci/ice1712/ice1712.c
index b97f50d10ba3..a6d98013c331 100644
--- a/sound/pci/ice1712/ice1712.c
+++ b/sound/pci/ice1712/ice1712.c
@@ -100,12 +100,6 @@ MODULE_PARM_DESC(cs8427_timeout, "Define reset timeout for cs8427 chip in msec r
 module_param_array(model, charp, NULL, 0444);
 MODULE_PARM_DESC(model, "Use the given board model.");
 
-#ifndef PCI_VENDOR_ID_ICE
-#define PCI_VENDOR_ID_ICE               0x1412
-#endif
-#ifndef PCI_DEVICE_ID_ICE_1712
-#define PCI_DEVICE_ID_ICE_1712          0x1712
-#endif
 
 static struct pci_device_id snd_ice1712_ids[] = {
         { PCI_VENDOR_ID_ICE, PCI_DEVICE_ID_ICE_1712, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },   /* ICE1712 */
@@ -2535,7 +2529,7 @@ static int __devinit snd_ice1712_create(snd_card_t * card,
                 return -ENXIO;
         }
 
-        ice = kcalloc(1, sizeof(*ice), GFP_KERNEL);
+        ice = kzalloc(sizeof(*ice), GFP_KERNEL);
         if (ice == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -2741,6 +2735,7 @@ static void __devexit snd_ice1712_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "ICE1712",
+        .owner = THIS_MODULE,
         .id_table = snd_ice1712_ids,
         .probe = snd_ice1712_probe,
         .remove = __devexit_p(snd_ice1712_remove),
diff --git a/sound/pci/ice1712/ice1724.c b/sound/pci/ice1712/ice1724.c
index c7af5e5fee13..c3ce8f93740b 100644
--- a/sound/pci/ice1712/ice1724.c
+++ b/sound/pci/ice1712/ice1724.c
@@ -83,12 +83,6 @@ MODULE_PARM_DESC(enable, "Enable ICE1724 soundcard.");
 module_param_array(model, charp, NULL, 0444);
 MODULE_PARM_DESC(model, "Use the given board model.");
 
-#ifndef PCI_VENDOR_ID_ICE
-#define PCI_VENDOR_ID_ICE               0x1412
-#endif
-#ifndef PCI_DEVICE_ID_VT1724
-#define PCI_DEVICE_ID_VT1724            0x1724
-#endif
 
 /* Both VT1720 and VT1724 have the same PCI IDs */
 static struct pci_device_id snd_vt1724_ids[] = {
@@ -2130,7 +2124,7 @@ static int __devinit snd_vt1724_create(snd_card_t * card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        ice = kcalloc(1, sizeof(*ice), GFP_KERNEL);
+        ice = kzalloc(sizeof(*ice), GFP_KERNEL);
         if (ice == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -2321,6 +2315,7 @@ static void __devexit snd_vt1724_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "ICE1724",
+        .owner = THIS_MODULE,
         .id_table = snd_vt1724_ids,
         .probe = snd_vt1724_probe,
         .remove = __devexit_p(snd_vt1724_remove),
diff --git a/sound/pci/ice1712/juli.c b/sound/pci/ice1712/juli.c
index 3fb297b969cd..2437876a44e4 100644
--- a/sound/pci/ice1712/juli.c
+++ b/sound/pci/ice1712/juli.c
@@ -182,7 +182,7 @@ static int __devinit juli_init(ice1712_t *ice)
                 ice->num_total_dacs = 2;
                 ice->num_total_adcs = 2;
 
-                ak = ice->akm = kcalloc(1, sizeof(akm4xxx_t), GFP_KERNEL);
+                ak = ice->akm = kzalloc(sizeof(akm4xxx_t), GFP_KERNEL);
                 if (! ak)
                         return -ENOMEM;
                 ice->akm_codecs = 1;
diff --git a/sound/pci/ice1712/phase.c b/sound/pci/ice1712/phase.c
index 5bf734b04fa0..dcf1e8ca3f66 100644
--- a/sound/pci/ice1712/phase.c
+++ b/sound/pci/ice1712/phase.c
@@ -122,7 +122,7 @@ static int __devinit phase22_init(ice1712_t *ice)
         }
 
         // Initialize analog chips
-        ak = ice->akm = kcalloc(1, sizeof(akm4xxx_t), GFP_KERNEL);
+        ak = ice->akm = kzalloc(sizeof(akm4xxx_t), GFP_KERNEL);
         if (! ak)
                 return -ENOMEM;
         ice->akm_codecs = 1;
@@ -386,7 +386,7 @@ static int __devinit phase28_init(ice1712_t *ice)
         ice->num_total_adcs = 2;
 
         // Initialize analog chips
-        ak = ice->akm = kcalloc(1, sizeof(akm4xxx_t), GFP_KERNEL);
+        ak = ice->akm = kzalloc(sizeof(akm4xxx_t), GFP_KERNEL);
         if (!ak)
                 return -ENOMEM;
         ice->akm_codecs = 1;
diff --git a/sound/pci/ice1712/pontis.c b/sound/pci/ice1712/pontis.c
index 25f827d8fbd9..a5f852b1f575 100644
--- a/sound/pci/ice1712/pontis.c
+++ b/sound/pci/ice1712/pontis.c
@@ -781,7 +781,7 @@ static int __devinit pontis_init(ice1712_t *ice)
         ice->num_total_adcs = 2;
 
         /* to remeber the register values */
-        ice->akm = kcalloc(1, sizeof(akm4xxx_t), GFP_KERNEL);
+        ice->akm = kzalloc(sizeof(akm4xxx_t), GFP_KERNEL);
         if (! ice->akm)
                 return -ENOMEM;
         ice->akm_codecs = 1;
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index 7b548416dcef..1a96198a17ae 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -69,6 +69,7 @@ static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;	/* ID for this card */
 static int enable[SNDRV_CARDS] = SNDRV_DEFAULT_ENABLE_PNP;      /* Enable this card */
 static int ac97_clock[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 0};
 static char *ac97_quirk[SNDRV_CARDS];
+static int buggy_semaphore[SNDRV_CARDS];
 static int buggy_irq[SNDRV_CARDS];
 static int xbox[SNDRV_CARDS];
 
@@ -86,6 +87,8 @@ module_param_array(ac97_clock, int, NULL, 0444);
 MODULE_PARM_DESC(ac97_clock, "AC'97 codec clock (0 = auto-detect).");
 module_param_array(ac97_quirk, charp, NULL, 0444);
 MODULE_PARM_DESC(ac97_quirk, "AC'97 workaround for strange hardware.");
+module_param_array(buggy_semaphore, bool, NULL, 0444);
+MODULE_PARM_DESC(buggy_semaphore, "Enable workaround for hardwares with problematic codec semaphores.");
 module_param_array(buggy_irq, bool, NULL, 0444);
 MODULE_PARM_DESC(buggy_irq, "Enable workaround for buggy interrupts on some motherboards.");
 module_param_array(xbox, bool, NULL, 0444);
@@ -94,62 +97,6 @@ MODULE_PARM_DESC(xbox, "Set to 1 for Xbox, if you have problems with the AC'97 c
 /*
  *  Direct registers
  */
-
-#ifndef PCI_DEVICE_ID_INTEL_82801
-#define PCI_DEVICE_ID_INTEL_82801       0x2415
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_82901
-#define PCI_DEVICE_ID_INTEL_82901       0x2425
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_82801BA
-#define PCI_DEVICE_ID_INTEL_82801BA     0x2445
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_440MX
-#define PCI_DEVICE_ID_INTEL_440MX       0x7195
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ICH3
-#define PCI_DEVICE_ID_INTEL_ICH3        0x2485
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ICH4
-#define PCI_DEVICE_ID_INTEL_ICH4        0x24c5
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ICH5
-#define PCI_DEVICE_ID_INTEL_ICH5        0x24d5
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ESB_5
-#define PCI_DEVICE_ID_INTEL_ESB_5       0x25a6
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ICH6_18
-#define PCI_DEVICE_ID_INTEL_ICH6_18     0x266e
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ICH7_20
-#define PCI_DEVICE_ID_INTEL_ICH7_20     0x27de
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ESB2_14
-#define PCI_DEVICE_ID_INTEL_ESB2_14     0x2698
-#endif
-#ifndef PCI_DEVICE_ID_SI_7012
-#define PCI_DEVICE_ID_SI_7012           0x7012
-#endif
-#ifndef PCI_DEVICE_ID_NVIDIA_MCP_AUDIO
-#define PCI_DEVICE_ID_NVIDIA_MCP_AUDIO  0x01b1
-#endif
-#ifndef PCI_DEVICE_ID_NVIDIA_CK804_AUDIO
-#define PCI_DEVICE_ID_NVIDIA_CK804_AUDIO 0x0059
-#endif
-#ifndef PCI_DEVICE_ID_NVIDIA_MCP2_AUDIO
-#define PCI_DEVICE_ID_NVIDIA_MCP2_AUDIO 0x006a
-#endif
-#ifndef PCI_DEVICE_ID_NVIDIA_CK8_AUDIO
-#define PCI_DEVICE_ID_NVIDIA_CK8_AUDIO  0x008a
-#endif
-#ifndef PCI_DEVICE_ID_NVIDIA_MCP3_AUDIO
-#define PCI_DEVICE_ID_NVIDIA_MCP3_AUDIO 0x00da
-#endif
-#ifndef PCI_DEVICE_ID_NVIDIA_CK8S_AUDIO
-#define PCI_DEVICE_ID_NVIDIA_CK8S_AUDIO 0x00ea
-#endif
-
 enum { DEVICE_INTEL, DEVICE_INTEL_ICH4, DEVICE_SIS, DEVICE_ALI, DEVICE_NFORCE };
 
 #define ICHREG(x) ICH_REG_##x
@@ -423,6 +370,7 @@ struct _snd_intel8x0 {
         unsigned fix_nocache: 1;        /* workaround for 440MX */
         unsigned buggy_irq: 1;          /* workaround for buggy mobos */
         unsigned xbox: 1;               /* workaround for Xbox AC'97 detection */
+        unsigned buggy_semaphore: 1;    /* workaround for buggy codec semaphore */
 
         int spdif_idx;  /* SPDIF BAR index; *_SPBAR or -1 if use PCMOUT */
         unsigned int sdm_saved; /* SDM reg value */
@@ -577,6 +525,9 @@ static int snd_intel8x0_codec_semaphore(intel8x0_t *chip, unsigned int codec)
         if ((igetdword(chip, ICHREG(GLOB_STA)) & codec) == 0)
                 return -EIO;
 
+        if (chip->buggy_semaphore)
+                return 0; /* just ignore ... */
+
         /* Anyone holding a semaphore for 1 msec should be shot... */
         time = 100;
         do {
@@ -1759,6 +1710,12 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
                 .type = AC97_TUNE_ALC_JACK
         },
         {
+                .subvendor = 0x1014,
+                .subdevice = 0x0267,
+                .name = "IBM NetVista A30p",    /* AD1981B */
+                .type = AC97_TUNE_HP_ONLY
+        },
+        {
                 .subvendor = 0x1028,
                 .subdevice = 0x00d8,
                 .name = "Dell Precision 530",   /* AD1885 */
@@ -2599,6 +2556,7 @@ struct ich_reg_info {
 static int __devinit snd_intel8x0_create(snd_card_t * card,
                                          struct pci_dev *pci,
                                          unsigned long device_type,
+                                         int buggy_sem,
                                          intel8x0_t ** r_intel8x0)
 {
         intel8x0_t *chip;
@@ -2646,7 +2604,7 @@ static int __devinit snd_intel8x0_create(snd_card_t * card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -2656,6 +2614,7 @@ static int __devinit snd_intel8x0_create(snd_card_t * card,
         chip->card = card;
         chip->pci = pci;
         chip->irq = -1;
+        chip->buggy_semaphore = buggy_sem;
 
         if (pci->vendor == PCI_VENDOR_ID_INTEL &&
             pci->device == PCI_DEVICE_ID_INTEL_440MX)
@@ -2795,19 +2754,19 @@ static struct shortname_table {
         unsigned int id;
         const char *s;
 } shortnames[] __devinitdata = {
-        { PCI_DEVICE_ID_INTEL_82801, "Intel 82801AA-ICH" },
-        { PCI_DEVICE_ID_INTEL_82901, "Intel 82901AB-ICH0" },
-        { PCI_DEVICE_ID_INTEL_82801BA, "Intel 82801BA-ICH2" },
+        { PCI_DEVICE_ID_INTEL_82801AA_5, "Intel 82801AA-ICH" },
+        { PCI_DEVICE_ID_INTEL_82801AB_5, "Intel 82901AB-ICH0" },
+        { PCI_DEVICE_ID_INTEL_82801BA_4, "Intel 82801BA-ICH2" },
         { PCI_DEVICE_ID_INTEL_440MX, "Intel 440MX" },
-        { PCI_DEVICE_ID_INTEL_ICH3, "Intel 82801CA-ICH3" },
-        { PCI_DEVICE_ID_INTEL_ICH4, "Intel 82801DB-ICH4" },
-        { PCI_DEVICE_ID_INTEL_ICH5, "Intel ICH5" },
+        { PCI_DEVICE_ID_INTEL_82801CA_5, "Intel 82801CA-ICH3" },
+        { PCI_DEVICE_ID_INTEL_82801DB_5, "Intel 82801DB-ICH4" },
+        { PCI_DEVICE_ID_INTEL_82801EB_5, "Intel ICH5" },
         { PCI_DEVICE_ID_INTEL_ESB_5, "Intel 6300ESB" },
         { PCI_DEVICE_ID_INTEL_ICH6_18, "Intel ICH6" },
         { PCI_DEVICE_ID_INTEL_ICH7_20, "Intel ICH7" },
         { PCI_DEVICE_ID_INTEL_ESB2_14, "Intel ESB2" },
         { PCI_DEVICE_ID_SI_7012, "SiS SI7012" },
-        { PCI_DEVICE_ID_NVIDIA_MCP_AUDIO, "NVidia nForce" },
+        { PCI_DEVICE_ID_NVIDIA_MCP1_AUDIO, "NVidia nForce" },
         { PCI_DEVICE_ID_NVIDIA_MCP2_AUDIO, "NVidia nForce2" },
         { PCI_DEVICE_ID_NVIDIA_MCP3_AUDIO, "NVidia nForce3" },
         { PCI_DEVICE_ID_NVIDIA_CK8S_AUDIO, "NVidia CK8S" },
@@ -2860,7 +2819,8 @@ static int __devinit snd_intel8x0_probe(struct pci_dev *pci,
                 }
         }
 
-        if ((err = snd_intel8x0_create(card, pci, pci_id->driver_data, &chip)) < 0) {
+        if ((err = snd_intel8x0_create(card, pci, pci_id->driver_data,
+                                       buggy_semaphore[dev], &chip)) < 0) {
                 snd_card_free(card);
                 return err;
         }
@@ -2904,6 +2864,7 @@ static void __devexit snd_intel8x0_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "Intel ICH",
+        .owner = THIS_MODULE,
         .id_table = snd_intel8x0_ids,
         .probe = snd_intel8x0_probe,
         .remove = __devexit_p(snd_intel8x0_remove),
diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c
index bb758c77d211..9e2060d56c24 100644
--- a/sound/pci/intel8x0m.c
+++ b/sound/pci/intel8x0m.c
@@ -73,51 +73,6 @@ MODULE_PARM_DESC(ac97_clock, "AC'97 codec clock (0 = auto-detect).");
 /*
  *  Direct registers
  */
-
-#ifndef PCI_DEVICE_ID_INTEL_82801_6
-#define PCI_DEVICE_ID_INTEL_82801_6     0x2416
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_82901_6
-#define PCI_DEVICE_ID_INTEL_82901_6     0x2426
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_82801BA_6
-#define PCI_DEVICE_ID_INTEL_82801BA_6   0x2446
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_440MX_6
-#define PCI_DEVICE_ID_INTEL_440MX_6     0x7196
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ICH3_6
-#define PCI_DEVICE_ID_INTEL_ICH3_6      0x2486
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ICH4_6
-#define PCI_DEVICE_ID_INTEL_ICH4_6      0x24c6
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ICH5_6
-#define PCI_DEVICE_ID_INTEL_ICH5_6      0x24d6
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ICH6_6
-#define PCI_DEVICE_ID_INTEL_ICH6_6      0x266d
-#endif
-#ifndef PCI_DEVICE_ID_INTEL_ICH7_6
-#define PCI_DEVICE_ID_INTEL_ICH7_6      0x27dd
-#endif
-#ifndef PCI_DEVICE_ID_SI_7013
-#define PCI_DEVICE_ID_SI_7013           0x7013
-#endif
-#ifndef PCI_DEVICE_ID_NVIDIA_MCP_MODEM
-#define PCI_DEVICE_ID_NVIDIA_MCP_MODEM  0x01c1
-#endif
-#ifndef PCI_DEVICE_ID_NVIDIA_MCP2_MODEM
-#define PCI_DEVICE_ID_NVIDIA_MCP2_MODEM 0x0069
-#endif
-#ifndef PCI_DEVICE_ID_NVIDIA_MCP2S_MODEM
-#define PCI_DEVICE_ID_NVIDIA_MCP2S_MODEM 0x0089
-#endif
-#ifndef PCI_DEVICE_ID_NVIDIA_MCP3_MODEM
-#define PCI_DEVICE_ID_NVIDIA_MCP3_MODEM 0x00d9
-#endif
-
-
 enum { DEVICE_INTEL, DEVICE_SIS, DEVICE_ALI, DEVICE_NFORCE };
 
 #define ICHREG(x) ICH_REG_##x
@@ -1158,7 +1113,7 @@ static int __devinit snd_intel8x0m_create(snd_card_t * card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1283,18 +1238,18 @@ static struct shortname_table {
         unsigned int id;
         const char *s;
 } shortnames[] __devinitdata = {
-        { PCI_DEVICE_ID_INTEL_82801_6, "Intel 82801AA-ICH" },
-        { PCI_DEVICE_ID_INTEL_82901_6, "Intel 82901AB-ICH0" },
+        { PCI_DEVICE_ID_INTEL_82801AA_6, "Intel 82801AA-ICH" },
+        { PCI_DEVICE_ID_INTEL_82801AB_6, "Intel 82901AB-ICH0" },
         { PCI_DEVICE_ID_INTEL_82801BA_6, "Intel 82801BA-ICH2" },
         { PCI_DEVICE_ID_INTEL_440MX_6, "Intel 440MX" },
-        { PCI_DEVICE_ID_INTEL_ICH3_6, "Intel 82801CA-ICH3" },
-        { PCI_DEVICE_ID_INTEL_ICH4_6, "Intel 82801DB-ICH4" },
-        { PCI_DEVICE_ID_INTEL_ICH5_6, "Intel ICH5" },
-        { PCI_DEVICE_ID_INTEL_ICH6_6, "Intel ICH6" },
-        { PCI_DEVICE_ID_INTEL_ICH7_6, "Intel ICH7" },
+        { PCI_DEVICE_ID_INTEL_82801CA_6, "Intel 82801CA-ICH3" },
+        { PCI_DEVICE_ID_INTEL_82801DB_6, "Intel 82801DB-ICH4" },
+        { PCI_DEVICE_ID_INTEL_82801EB_6, "Intel ICH5" },
+        { PCI_DEVICE_ID_INTEL_ICH6_17, "Intel ICH6" },
+        { PCI_DEVICE_ID_INTEL_ICH7_19, "Intel ICH7" },
         { 0x7446, "AMD AMD768" },
         { PCI_DEVICE_ID_SI_7013, "SiS SI7013" },
-        { PCI_DEVICE_ID_NVIDIA_MCP_MODEM, "NVidia nForce" },
+        { PCI_DEVICE_ID_NVIDIA_MCP1_MODEM, "NVidia nForce" },
         { PCI_DEVICE_ID_NVIDIA_MCP2_MODEM, "NVidia nForce2" },
         { PCI_DEVICE_ID_NVIDIA_MCP2S_MODEM, "NVidia nForce2s" },
         { PCI_DEVICE_ID_NVIDIA_MCP3_MODEM, "NVidia nForce3" },
@@ -1371,6 +1326,7 @@ static void __devexit snd_intel8x0m_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "Intel ICH Modem",
+        .owner = THIS_MODULE,
         .id_table = snd_intel8x0m_ids,
         .probe = snd_intel8x0m_probe,
         .remove = __devexit_p(snd_intel8x0m_remove),
diff --git a/sound/pci/korg1212/korg1212.c b/sound/pci/korg1212/korg1212.c
index d2aa9c82d41e..09f9cbe116a3 100644
--- a/sound/pci/korg1212/korg1212.c
+++ b/sound/pci/korg1212/korg1212.c
@@ -2220,7 +2220,7 @@ static int __devinit snd_korg1212_create(snd_card_t * card, struct pci_dev *pci,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        korg1212 = kcalloc(1, sizeof(*korg1212), GFP_KERNEL);
+        korg1212 = kzalloc(sizeof(*korg1212), GFP_KERNEL);
         if (korg1212 == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -2534,6 +2534,7 @@ static void __devexit snd_korg1212_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "korg1212",
+        .owner = THIS_MODULE,
         .id_table = snd_korg1212_ids,
         .probe = snd_korg1212_probe,
         .remove = __devexit_p(snd_korg1212_remove),
diff --git a/sound/pci/maestro3.c b/sound/pci/maestro3.c
index 39b5e7db1543..2693b6f731f3 100644
--- a/sound/pci/maestro3.c
+++ b/sound/pci/maestro3.c
@@ -872,35 +872,6 @@ struct snd_m3 {
 /*
  * pci ids
  */
-
-#ifndef PCI_VENDOR_ID_ESS
-#define PCI_VENDOR_ID_ESS         0x125D
-#endif
-#ifndef PCI_DEVICE_ID_ESS_ALLEGRO_1
-#define PCI_DEVICE_ID_ESS_ALLEGRO_1     0x1988
-#endif
-#ifndef PCI_DEVICE_ID_ESS_ALLEGRO
-#define PCI_DEVICE_ID_ESS_ALLEGRO       0x1989
-#endif
-#ifndef PCI_DEVICE_ID_ESS_CANYON3D_2LE
-#define PCI_DEVICE_ID_ESS_CANYON3D_2LE  0x1990
-#endif
-#ifndef PCI_DEVICE_ID_ESS_CANYON3D_2
-#define PCI_DEVICE_ID_ESS_CANYON3D_2    0x1992
-#endif
-#ifndef PCI_DEVICE_ID_ESS_MAESTRO3
-#define PCI_DEVICE_ID_ESS_MAESTRO3      0x1998
-#endif
-#ifndef PCI_DEVICE_ID_ESS_MAESTRO3_1
-#define PCI_DEVICE_ID_ESS_MAESTRO3_1    0x1999
-#endif
-#ifndef PCI_DEVICE_ID_ESS_MAESTRO3_HW
-#define PCI_DEVICE_ID_ESS_MAESTRO3_HW   0x199a
-#endif
-#ifndef PCI_DEVICE_ID_ESS_MAESTRO3_2
-#define PCI_DEVICE_ID_ESS_MAESTRO3_2    0x199b
-#endif
-
 static struct pci_device_id snd_m3_ids[] = {
         {PCI_VENDOR_ID_ESS, PCI_DEVICE_ID_ESS_ALLEGRO_1, PCI_ANY_ID, PCI_ANY_ID,
          PCI_CLASS_MULTIMEDIA_AUDIO << 8, 0xffff00, 0},
@@ -2689,7 +2660,7 @@ snd_m3_create(snd_card_t *card, struct pci_dev *pci,
                 return -ENXIO;
         }
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -2890,6 +2861,7 @@ static void __devexit snd_m3_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "Maestro3",
+        .owner = THIS_MODULE,
         .id_table = snd_m3_ids,
         .probe = snd_m3_probe,
         .remove = __devexit_p(snd_m3_remove),
diff --git a/sound/pci/mixart/mixart.c b/sound/pci/mixart/mixart.c
index 6c868d913634..1a62c7f6c52b 100644
--- a/sound/pci/mixart/mixart.c
+++ b/sound/pci/mixart/mixart.c
@@ -1004,7 +1004,7 @@ static int __devinit snd_mixart_create(mixart_mgr_t *mgr, snd_card_t *card, int
                 .dev_free = snd_mixart_chip_dev_free,
         };
 
-        mgr->chip[idx] = chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        mgr->chip[idx] = chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (! chip) {
                 snd_printk(KERN_ERR "cannot allocate chip\n");
                 return -ENOMEM;
@@ -1292,7 +1292,7 @@ static int __devinit snd_mixart_probe(struct pci_dev *pci,
 
         /*
          */
-        mgr = kcalloc(1, sizeof(*mgr), GFP_KERNEL);
+        mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
         if (! mgr) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1424,6 +1424,7 @@ static void __devexit snd_mixart_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "Digigram miXart",
+        .owner = THIS_MODULE,
         .id_table = snd_mixart_ids,
         .probe = snd_mixart_probe,
         .remove = __devexit_p(snd_mixart_remove),
diff --git a/sound/pci/nm256/nm256.c b/sound/pci/nm256/nm256.c
index 2bbeb10ff7c4..5c55a3b1d121 100644
--- a/sound/pci/nm256/nm256.c
+++ b/sound/pci/nm256/nm256.c
@@ -259,21 +259,6 @@ struct snd_nm256 {
 /*
  * PCI ids
  */
-
-#ifndef PCI_VENDOR_ID_NEOMAGIC
-#define PCI_VENDOR_ID_NEOMEGIC 0x10c8
-#endif
-#ifndef PCI_DEVICE_ID_NEOMAGIC_NM256AV_AUDIO
-#define PCI_DEVICE_ID_NEOMAGIC_NM256AV_AUDIO 0x8005
-#endif
-#ifndef PCI_DEVICE_ID_NEOMAGIC_NM256ZX_AUDIO
-#define PCI_DEVICE_ID_NEOMAGIC_NM256ZX_AUDIO 0x8006
-#endif
-#ifndef PCI_DEVICE_ID_NEOMAGIC_NM256XL_PLUS_AUDIO
-#define PCI_DEVICE_ID_NEOMAGIC_NM256XL_PLUS_AUDIO 0x8016
-#endif
-
-
 static struct pci_device_id snd_nm256_ids[] = {
         {PCI_VENDOR_ID_NEOMAGIC, PCI_DEVICE_ID_NEOMAGIC_NM256AV_AUDIO, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         {PCI_VENDOR_ID_NEOMAGIC, PCI_DEVICE_ID_NEOMAGIC_NM256ZX_AUDIO, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
@@ -840,7 +825,7 @@ static void snd_nm256_setup_stream(nm256_t *chip, nm256_stream_t *s,
         runtime->hw = *hw_ptr;
         runtime->hw.buffer_bytes_max = s->bufsize;
         runtime->hw.period_bytes_max = s->bufsize / 2;
-        runtime->dma_area = (void*) s->bufptr;
+        runtime->dma_area = (void __force *) s->bufptr;
         runtime->dma_addr = s->bufptr_addr;
         runtime->dma_bytes = s->bufsize;
         runtime->private_data = s;
@@ -1404,7 +1389,7 @@ snd_nm256_create(snd_card_t *card, struct pci_dev *pci,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1683,6 +1668,7 @@ static void __devexit snd_nm256_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "NeoMagic 256",
+        .owner = THIS_MODULE,
         .id_table = snd_nm256_ids,
         .probe = snd_nm256_probe,
         .remove = __devexit_p(snd_nm256_remove),
diff --git a/sound/pci/rme32.c b/sound/pci/rme32.c
index 456be39e8e4a..cd313af6ebcf 100644
--- a/sound/pci/rme32.c
+++ b/sound/pci/rme32.c
@@ -192,20 +192,6 @@ MODULE_SUPPORTED_DEVICE("{{RME,Digi32}," "{RME,Digi32/8}," "{RME,Digi32 PRO}}");
 #define RME32_PRO_REVISION_WITH_8414 150
 
 
-/* PCI vendor/device ID's */
-#ifndef PCI_VENDOR_ID_XILINX_RME
-# define PCI_VENDOR_ID_XILINX_RME 0xea60
-#endif
-#ifndef PCI_DEVICE_ID_DIGI32
-# define PCI_DEVICE_ID_DIGI32 0x9896
-#endif
-#ifndef PCI_DEVICE_ID_DIGI32_PRO
-# define PCI_DEVICE_ID_DIGI32_PRO 0x9897
-#endif
-#ifndef PCI_DEVICE_ID_DIGI32_8
-# define PCI_DEVICE_ID_DIGI32_8 0x9898
-#endif
-
 typedef struct snd_rme32 {
         spinlock_t lock;
         int irq;
@@ -242,11 +228,11 @@ typedef struct snd_rme32 {
 } rme32_t;
 
 static struct pci_device_id snd_rme32_ids[] = {
-        {PCI_VENDOR_ID_XILINX_RME, PCI_DEVICE_ID_DIGI32,
+        {PCI_VENDOR_ID_XILINX_RME, PCI_DEVICE_ID_RME_DIGI32,
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0,},
-        {PCI_VENDOR_ID_XILINX_RME, PCI_DEVICE_ID_DIGI32_8,
+        {PCI_VENDOR_ID_XILINX_RME, PCI_DEVICE_ID_RME_DIGI32_8,
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0,},
-        {PCI_VENDOR_ID_XILINX_RME, PCI_DEVICE_ID_DIGI32_PRO,
+        {PCI_VENDOR_ID_XILINX_RME, PCI_DEVICE_ID_RME_DIGI32_PRO,
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0,},
         {0,}
 };
@@ -254,7 +240,7 @@ static struct pci_device_id snd_rme32_ids[] = {
 MODULE_DEVICE_TABLE(pci, snd_rme32_ids);
 
 #define RME32_ISWORKING(rme32) ((rme32)->wcreg & RME32_WCR_START)
-#define RME32_PRO_WITH_8414(rme32) ((rme32)->pci->device == PCI_DEVICE_ID_DIGI32_PRO && (rme32)->rev == RME32_PRO_REVISION_WITH_8414)
+#define RME32_PRO_WITH_8414(rme32) ((rme32)->pci->device == PCI_DEVICE_ID_RME_DIGI32_PRO && (rme32)->rev == RME32_PRO_REVISION_WITH_8414)
 
 static int snd_rme32_playback_prepare(snd_pcm_substream_t * substream);
 
@@ -541,21 +527,21 @@ static int snd_rme32_playback_setrate(rme32_t * rme32, int rate)
                         RME32_WCR_FREQ_1;
                 break;
         case 64000:
-                if (rme32->pci->device != PCI_DEVICE_ID_DIGI32_PRO)
+                if (rme32->pci->device != PCI_DEVICE_ID_RME_DIGI32_PRO)
                         return -EINVAL;
                 rme32->wcreg |= RME32_WCR_DS_BM;
                 rme32->wcreg = (rme32->wcreg | RME32_WCR_FREQ_0) & 
                         ~RME32_WCR_FREQ_1;
                 break;
         case 88200:
-                if (rme32->pci->device != PCI_DEVICE_ID_DIGI32_PRO)
+                if (rme32->pci->device != PCI_DEVICE_ID_RME_DIGI32_PRO)
                         return -EINVAL;
                 rme32->wcreg |= RME32_WCR_DS_BM;
                 rme32->wcreg = (rme32->wcreg | RME32_WCR_FREQ_1) & 
                         ~RME32_WCR_FREQ_0;
                 break;
         case 96000:
-                if (rme32->pci->device != PCI_DEVICE_ID_DIGI32_PRO)
+                if (rme32->pci->device != PCI_DEVICE_ID_RME_DIGI32_PRO)
                         return -EINVAL;
                 rme32->wcreg |= RME32_WCR_DS_BM;
                 rme32->wcreg = (rme32->wcreg | RME32_WCR_FREQ_0) | 
@@ -692,7 +678,8 @@ snd_rme32_playback_hw_params(snd_pcm_substream_t * substream,
                 if (err < 0)
                         return err;
         } else {
-                runtime->dma_area = (void *)(rme32->iobase + RME32_IO_DATA_BUFFER);
+                runtime->dma_area = (void __force *)(rme32->iobase +
+                                                     RME32_IO_DATA_BUFFER);
                 runtime->dma_addr = rme32->port + RME32_IO_DATA_BUFFER;
                 runtime->dma_bytes = RME32_BUFFER_SIZE;
         }
@@ -746,7 +733,8 @@ snd_rme32_capture_hw_params(snd_pcm_substream_t * substream,
                 if (err < 0)
                         return err;
         } else {
-                runtime->dma_area = (void *)rme32->iobase + RME32_IO_DATA_BUFFER;
+                runtime->dma_area = (void __force *)rme32->iobase +
+                                        RME32_IO_DATA_BUFFER;
                 runtime->dma_addr = rme32->port + RME32_IO_DATA_BUFFER;
                 runtime->dma_bytes = RME32_BUFFER_SIZE;
         }
@@ -893,7 +881,7 @@ static int snd_rme32_playback_spdif_open(snd_pcm_substream_t * substream)
                 runtime->hw = snd_rme32_spdif_fd_info;
         else
                 runtime->hw = snd_rme32_spdif_info;
-        if (rme32->pci->device == PCI_DEVICE_ID_DIGI32_PRO) {
+        if (rme32->pci->device == PCI_DEVICE_ID_RME_DIGI32_PRO) {
                 runtime->hw.rates |= SNDRV_PCM_RATE_64000 | SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000;
                 runtime->hw.rate_max = 96000;
         }
@@ -1420,8 +1408,8 @@ static int __devinit snd_rme32_create(rme32_t * rme32)
         }
 
         /* set up ALSA pcm device for ADAT */
-        if ((pci->device == PCI_DEVICE_ID_DIGI32) ||
-            (pci->device == PCI_DEVICE_ID_DIGI32_PRO)) {
+        if ((pci->device == PCI_DEVICE_ID_RME_DIGI32) ||
+            (pci->device == PCI_DEVICE_ID_RME_DIGI32_PRO)) {
                 /* ADAT is not available on DIGI32 and DIGI32 Pro */
                 rme32->adat_pcm = NULL;
         }
@@ -1651,11 +1639,11 @@ snd_rme32_info_inputtype_control(snd_kcontrol_t * kcontrol,
         uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
         uinfo->count = 1;
         switch (rme32->pci->device) {
-        case PCI_DEVICE_ID_DIGI32:
-        case PCI_DEVICE_ID_DIGI32_8:
+        case PCI_DEVICE_ID_RME_DIGI32:
+        case PCI_DEVICE_ID_RME_DIGI32_8:
                 uinfo->value.enumerated.items = 3;
                 break;
-        case PCI_DEVICE_ID_DIGI32_PRO:
+        case PCI_DEVICE_ID_RME_DIGI32_PRO:
                 uinfo->value.enumerated.items = 4;
                 break;
         default:
@@ -1682,11 +1670,11 @@ snd_rme32_get_inputtype_control(snd_kcontrol_t * kcontrol,
         ucontrol->value.enumerated.item[0] = snd_rme32_getinputtype(rme32);
 
         switch (rme32->pci->device) {
-        case PCI_DEVICE_ID_DIGI32:
-        case PCI_DEVICE_ID_DIGI32_8:
+        case PCI_DEVICE_ID_RME_DIGI32:
+        case PCI_DEVICE_ID_RME_DIGI32_8:
                 items = 3;
                 break;
-        case PCI_DEVICE_ID_DIGI32_PRO:
+        case PCI_DEVICE_ID_RME_DIGI32_PRO:
                 items = 4;
                 break;
         default:
@@ -1709,11 +1697,11 @@ snd_rme32_put_inputtype_control(snd_kcontrol_t * kcontrol,
         int change, items = 3;
 
         switch (rme32->pci->device) {
-        case PCI_DEVICE_ID_DIGI32:
-        case PCI_DEVICE_ID_DIGI32_8:
+        case PCI_DEVICE_ID_RME_DIGI32:
+        case PCI_DEVICE_ID_RME_DIGI32_8:
                 items = 3;
                 break;
-        case PCI_DEVICE_ID_DIGI32_PRO:
+        case PCI_DEVICE_ID_RME_DIGI32_PRO:
                 items = 4;
                 break;
         default:
@@ -1994,13 +1982,13 @@ snd_rme32_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)
 
         strcpy(card->driver, "Digi32");
         switch (rme32->pci->device) {
-        case PCI_DEVICE_ID_DIGI32:
+        case PCI_DEVICE_ID_RME_DIGI32:
                 strcpy(card->shortname, "RME Digi32");
                 break;
-        case PCI_DEVICE_ID_DIGI32_8:
+        case PCI_DEVICE_ID_RME_DIGI32_8:
                 strcpy(card->shortname, "RME Digi32/8");
                 break;
-        case PCI_DEVICE_ID_DIGI32_PRO:
+        case PCI_DEVICE_ID_RME_DIGI32_PRO:
                 strcpy(card->shortname, "RME Digi32 PRO");
                 break;
         }
@@ -2024,6 +2012,7 @@ static void __devexit snd_rme32_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name =         "RME Digi32",
+        .owner =        THIS_MODULE,
         .id_table =     snd_rme32_ids,
         .probe =        snd_rme32_probe,
         .remove =       __devexit_p(snd_rme32_remove),
diff --git a/sound/pci/rme96.c b/sound/pci/rme96.c
index 9645e9004a48..c495cae78dbf 100644
--- a/sound/pci/rme96.c
+++ b/sound/pci/rme96.c
@@ -200,25 +200,6 @@ MODULE_PARM_DESC(enable, "Enable RME Digi96 soundcard.");
 #define RME96_AD1852_VOL_BITS 14
 #define RME96_AD1855_VOL_BITS 10
 
-/*
- * PCI vendor/device ids, could in the future be defined in <linux/pci.h>,
- * therefore #ifndef is used.
- */
-#ifndef PCI_VENDOR_ID_XILINX
-#define PCI_VENDOR_ID_XILINX 0x10ee
-#endif
-#ifndef PCI_DEVICE_ID_DIGI96
-#define PCI_DEVICE_ID_DIGI96 0x3fc0
-#endif
-#ifndef PCI_DEVICE_ID_DIGI96_8
-#define PCI_DEVICE_ID_DIGI96_8 0x3fc1
-#endif
-#ifndef PCI_DEVICE_ID_DIGI96_8_PRO
-#define PCI_DEVICE_ID_DIGI96_8_PRO 0x3fc2
-#endif
-#ifndef PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST
-#define PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST 0x3fc3
-#endif
 
 typedef struct snd_rme96 {
         spinlock_t    lock;
@@ -252,13 +233,13 @@ typedef struct snd_rme96 {
 } rme96_t;
 
 static struct pci_device_id snd_rme96_ids[] = {
-        { PCI_VENDOR_ID_XILINX, PCI_DEVICE_ID_DIGI96,
+        { PCI_VENDOR_ID_XILINX, PCI_DEVICE_ID_RME_DIGI96,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, },
-        { PCI_VENDOR_ID_XILINX, PCI_DEVICE_ID_DIGI96_8,
+        { PCI_VENDOR_ID_XILINX, PCI_DEVICE_ID_RME_DIGI96_8,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, },
-        { PCI_VENDOR_ID_XILINX, PCI_DEVICE_ID_DIGI96_8_PRO,
+        { PCI_VENDOR_ID_XILINX, PCI_DEVICE_ID_RME_DIGI96_8_PRO,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, },
-        { PCI_VENDOR_ID_XILINX, PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST,
+        { PCI_VENDOR_ID_XILINX, PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0, }, 
         { 0, }
 };
@@ -267,12 +248,12 @@ MODULE_DEVICE_TABLE(pci, snd_rme96_ids);
 
 #define RME96_ISPLAYING(rme96) ((rme96)->wcreg & RME96_WCR_START)
 #define RME96_ISRECORDING(rme96) ((rme96)->wcreg & RME96_WCR_START_2)
-#define RME96_HAS_ANALOG_IN(rme96) ((rme96)->pci->device == PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST)
-#define RME96_HAS_ANALOG_OUT(rme96) ((rme96)->pci->device == PCI_DEVICE_ID_DIGI96_8_PRO || \
-                                     (rme96)->pci->device == PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST)
+#define RME96_HAS_ANALOG_IN(rme96) ((rme96)->pci->device == PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST)
+#define RME96_HAS_ANALOG_OUT(rme96) ((rme96)->pci->device == PCI_DEVICE_ID_RME_DIGI96_8_PRO || \
+                                     (rme96)->pci->device == PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST)
 #define RME96_DAC_IS_1852(rme96) (RME96_HAS_ANALOG_OUT(rme96) && (rme96)->rev >= 4)
-#define RME96_DAC_IS_1855(rme96) (((rme96)->pci->device == PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST && (rme96)->rev < 4) || \
-                                  ((rme96)->pci->device == PCI_DEVICE_ID_DIGI96_8_PRO && (rme96)->rev == 2))
+#define RME96_DAC_IS_1855(rme96) (((rme96)->pci->device == PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST && (rme96)->rev < 4) || \
+                                  ((rme96)->pci->device == PCI_DEVICE_ID_RME_DIGI96_8_PRO && (rme96)->rev == 2))
 #define RME96_185X_MAX_OUT(rme96) ((1 << (RME96_DAC_IS_1852(rme96) ? RME96_AD1852_VOL_BITS : RME96_AD1855_VOL_BITS)) - 1)
 
 static int
@@ -849,9 +830,9 @@ snd_rme96_setinputtype(rme96_t *rme96,
                         RME96_WCR_INP_1;
                 break;
         case RME96_INPUT_XLR:
-                if ((rme96->pci->device != PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST &&
-                     rme96->pci->device != PCI_DEVICE_ID_DIGI96_8_PRO) ||
-                    (rme96->pci->device == PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST &&
+                if ((rme96->pci->device != PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST &&
+                     rme96->pci->device != PCI_DEVICE_ID_RME_DIGI96_8_PRO) ||
+                    (rme96->pci->device == PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST &&
                      rme96->rev > 4))
                 {
                         /* Only Digi96/8 PRO and Digi96/8 PAD supports XLR */
@@ -985,7 +966,8 @@ snd_rme96_playback_hw_params(snd_pcm_substream_t *substream,
         snd_pcm_runtime_t *runtime = substream->runtime;
         int err, rate, dummy;
 
-        runtime->dma_area = (void *)(rme96->iobase + RME96_IO_PLAY_BUFFER);
+        runtime->dma_area = (void __force *)(rme96->iobase +
+                                             RME96_IO_PLAY_BUFFER);
         runtime->dma_addr = rme96->port + RME96_IO_PLAY_BUFFER;
         runtime->dma_bytes = RME96_BUFFER_SIZE;
 
@@ -1037,7 +1019,8 @@ snd_rme96_capture_hw_params(snd_pcm_substream_t *substream,
         snd_pcm_runtime_t *runtime = substream->runtime;
         int err, isadat, rate;
         
-        runtime->dma_area = (void *)(rme96->iobase + RME96_IO_REC_BUFFER);
+        runtime->dma_area = (void __force *)(rme96->iobase +
+                                             RME96_IO_REC_BUFFER);
         runtime->dma_addr = rme96->port + RME96_IO_REC_BUFFER;
         runtime->dma_bytes = RME96_BUFFER_SIZE;
 
@@ -1615,7 +1598,7 @@ snd_rme96_create(rme96_t *rme96)
         rme96->spdif_pcm->info_flags = 0;
 
         /* set up ALSA pcm device for ADAT */
-        if (pci->device == PCI_DEVICE_ID_DIGI96) {
+        if (pci->device == PCI_DEVICE_ID_RME_DIGI96) {
                 /* ADAT is not available on the base model */
                 rme96->adat_pcm = NULL;
         } else {
@@ -1875,14 +1858,14 @@ snd_rme96_info_inputtype_control(snd_kcontrol_t *kcontrol, snd_ctl_elem_info_t *
         uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
         uinfo->count = 1;
         switch (rme96->pci->device) {
-        case PCI_DEVICE_ID_DIGI96:
-        case PCI_DEVICE_ID_DIGI96_8:
+        case PCI_DEVICE_ID_RME_DIGI96:
+        case PCI_DEVICE_ID_RME_DIGI96_8:
                 uinfo->value.enumerated.items = 3;
                 break;
-        case PCI_DEVICE_ID_DIGI96_8_PRO:
+        case PCI_DEVICE_ID_RME_DIGI96_8_PRO:
                 uinfo->value.enumerated.items = 4;
                 break;
-        case PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST:
+        case PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST:
                 if (rme96->rev > 4) {
                         /* PST */
                         uinfo->value.enumerated.items = 4;
@@ -1912,14 +1895,14 @@ snd_rme96_get_inputtype_control(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t
         ucontrol->value.enumerated.item[0] = snd_rme96_getinputtype(rme96);
         
         switch (rme96->pci->device) {
-        case PCI_DEVICE_ID_DIGI96:
-        case PCI_DEVICE_ID_DIGI96_8:
+        case PCI_DEVICE_ID_RME_DIGI96:
+        case PCI_DEVICE_ID_RME_DIGI96_8:
                 items = 3;
                 break;
-        case PCI_DEVICE_ID_DIGI96_8_PRO:
+        case PCI_DEVICE_ID_RME_DIGI96_8_PRO:
                 items = 4;
                 break;
-        case PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST:
+        case PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST:
                 if (rme96->rev > 4) {
                         /* for handling PST case, (INPUT_ANALOG is moved to INPUT_XLR */
                         if (ucontrol->value.enumerated.item[0] == RME96_INPUT_ANALOG) {
@@ -1949,14 +1932,14 @@ snd_rme96_put_inputtype_control(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t
         int change, items = 3;
         
         switch (rme96->pci->device) {
-        case PCI_DEVICE_ID_DIGI96:
-        case PCI_DEVICE_ID_DIGI96_8:
+        case PCI_DEVICE_ID_RME_DIGI96:
+        case PCI_DEVICE_ID_RME_DIGI96_8:
                 items = 3;
                 break;
-        case PCI_DEVICE_ID_DIGI96_8_PRO:
+        case PCI_DEVICE_ID_RME_DIGI96_8_PRO:
                 items = 4;
                 break;
-        case PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST:
+        case PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST:
                 if (rme96->rev > 4) {
                         items = 4;
                 } else {
@@ -1970,7 +1953,7 @@ snd_rme96_put_inputtype_control(snd_kcontrol_t * kcontrol, snd_ctl_elem_value_t
         val = ucontrol->value.enumerated.item[0] % items;
         
         /* special case for PST */
-        if (rme96->pci->device == PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST && rme96->rev > 4) {
+        if (rme96->pci->device == PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST && rme96->rev > 4) {
                 if (val == RME96_INPUT_XLR) {
                         val = RME96_INPUT_ANALOG;
                 }
@@ -2392,16 +2375,16 @@ snd_rme96_probe(struct pci_dev *pci,
         
         strcpy(card->driver, "Digi96");
         switch (rme96->pci->device) {
-        case PCI_DEVICE_ID_DIGI96:
+        case PCI_DEVICE_ID_RME_DIGI96:
                 strcpy(card->shortname, "RME Digi96");
                 break;
-        case PCI_DEVICE_ID_DIGI96_8:
+        case PCI_DEVICE_ID_RME_DIGI96_8:
                 strcpy(card->shortname, "RME Digi96/8");
                 break;
-        case PCI_DEVICE_ID_DIGI96_8_PRO:
+        case PCI_DEVICE_ID_RME_DIGI96_8_PRO:
                 strcpy(card->shortname, "RME Digi96/8 PRO");
                 break;
-        case PCI_DEVICE_ID_DIGI96_8_PAD_OR_PST:
+        case PCI_DEVICE_ID_RME_DIGI96_8_PAD_OR_PST:
                 pci_read_config_byte(rme96->pci, 8, &val);
                 if (val < 5) {
                         strcpy(card->shortname, "RME Digi96/8 PAD");
@@ -2430,6 +2413,7 @@ static void __devexit snd_rme96_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "RME Digi96",
+        .owner = THIS_MODULE,
         .id_table = snd_rme96_ids,
         .probe = snd_rme96_probe,
         .remove = __devexit_p(snd_rme96_remove),
diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
index 6694866089b5..52525eb198c7 100644
--- a/sound/pci/rme9652/hdsp.c
+++ b/sound/pci/rme9652/hdsp.c
@@ -370,13 +370,6 @@ MODULE_SUPPORTED_DEVICE("{{RME Hammerfall-DSP},"
 #define UNITY_GAIN                       32768
 #define MINUS_INFINITY_GAIN              0
 
-#ifndef PCI_VENDOR_ID_XILINX
-#define PCI_VENDOR_ID_XILINX            0x10ee
-#endif
-#ifndef PCI_DEVICE_ID_XILINX_HAMMERFALL_DSP
-#define PCI_DEVICE_ID_XILINX_HAMMERFALL_DSP 0x3fc5
-#endif
-
 /* the size of a substream (1 mono data stream) */
 
 #define HDSP_CHANNEL_BUFFER_SAMPLES  (16*1024)
@@ -4899,6 +4892,7 @@ static int snd_hdsp_create_alsa_devices(snd_card_t *card, hdsp_t *hdsp)
         }
         
         if (!(hdsp->state & HDSP_InitializationComplete)) {
+                strcpy(card->shortname, "Hammerfall DSP");
                 sprintf(card->longname, "%s at 0x%lx, irq %d", hdsp->card_name, 
                         hdsp->port, hdsp->irq);
             
@@ -5222,6 +5216,7 @@ static void __devexit snd_hdsp_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name =     "RME Hammerfall DSP",
+        .owner =    THIS_MODULE,
         .id_table = snd_hdsp_ids,
         .probe =    snd_hdsp_probe,
         .remove = __devexit_p(snd_hdsp_remove),
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index 5d786d113b25..fc3f3283ff37 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -301,18 +301,6 @@ MODULE_SUPPORTED_DEVICE("{{RME HDSPM-MADI}}");
 #define UNITY_GAIN          32768       /* = 65536/2 */
 #define MINUS_INFINITY_GAIN 0
 
-/* PCI info */
-#ifndef PCI_VENDOR_ID_XILINX
-#define PCI_VENDOR_ID_XILINX            0x10ee
-#endif
-#ifndef PCI_DEVICE_ID_XILINX_HAMMERFALL_DSP
-#define PCI_DEVICE_ID_XILINX_HAMMERFALL_DSP 0x3fc5
-#endif
-#ifndef PCI_DEVICE_ID_XILINX_HAMMERFALL_DSP_MADI
-#define PCI_DEVICE_ID_XILINX_HAMMERFALL_DSP_MADI 0x3fc6
-#endif
-
-
 /* Number of channels for different Speed Modes */
 #define MADI_SS_CHANNELS       64
 #define MADI_DS_CHANNELS       32
@@ -3652,6 +3640,7 @@ static void __devexit snd_hdspm_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "RME Hammerfall DSP MADI",
+        .owner = THIS_MODULE,
         .id_table = snd_hdspm_ids,
         .probe = snd_hdspm_probe,
         .remove = __devexit_p(snd_hdspm_remove),
diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c
index 8ee4d6fd6ea7..b600f45e1834 100644
--- a/sound/pci/rme9652/rme9652.c
+++ b/sound/pci/rme9652/rme9652.c
@@ -120,13 +120,6 @@ MODULE_SUPPORTED_DEVICE("{{RME,Hammerfall},"
 
 #define RME9652_REV15_buf_pos(x) ((((x)&0xE0000000)>>26)|((x)&RME9652_buf_pos))
 
-#ifndef PCI_VENDOR_ID_XILINX
-#define PCI_VENDOR_ID_XILINX            0x10ee
-#endif
-#ifndef PCI_DEVICE_ID_XILINX_HAMMERFALL
-#define PCI_DEVICE_ID_XILINX_HAMMERFALL 0x3fc4
-#endif
-
 /* amount of io space we remap for register access. i'm not sure we
    even need this much, but 1K is nice round number :)
 */
@@ -2661,6 +2654,7 @@ static void __devexit snd_rme9652_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name     = "RME Digi9652 (Hammerfall)",
+        .owner    = THIS_MODULE,
         .id_table = snd_rme9652_ids,
         .probe    = snd_rme9652_probe,
         .remove   = __devexit_p(snd_rme9652_remove),
diff --git a/sound/pci/sonicvibes.c b/sound/pci/sonicvibes.c
index 60ecb2bdb65e..1f6c2bfd43fd 100644
--- a/sound/pci/sonicvibes.c
+++ b/sound/pci/sonicvibes.c
@@ -50,13 +50,6 @@ MODULE_SUPPORTED_DEVICE("{{S3,SonicVibes PCI}}");
 #define SUPPORT_JOYSTICK 1
 #endif
 
-#ifndef PCI_VENDOR_ID_S3
-#define PCI_VENDOR_ID_S3             0x5333
-#endif
-#ifndef PCI_DEVICE_ID_S3_SONICVIBES
-#define PCI_DEVICE_ID_S3_SONICVIBES  0xca00
-#endif
-
 static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;      /* Index 0-MAX */
 static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;       /* ID for this card */
 static int enable[SNDRV_CARDS] = SNDRV_DEFAULT_ENABLE_PNP;      /* Enable this card */
@@ -1257,7 +1250,7 @@ static int __devinit snd_sonicvibes_create(snd_card_t * card,
                 return -ENXIO;
         }
 
-        sonic = kcalloc(1, sizeof(*sonic), GFP_KERNEL);
+        sonic = kzalloc(sizeof(*sonic), GFP_KERNEL);
         if (sonic == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
@@ -1515,6 +1508,7 @@ static void __devexit snd_sonic_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "S3 SonicVibes",
+        .owner = THIS_MODULE,
         .id_table = snd_sonic_ids,
         .probe = snd_sonic_probe,
         .remove = __devexit_p(snd_sonic_remove),
diff --git a/sound/pci/trident/trident.c b/sound/pci/trident/trident.c
index 940d531575c0..a8ca8e17853f 100644
--- a/sound/pci/trident/trident.c
+++ b/sound/pci/trident/trident.c
@@ -177,6 +177,7 @@ static void __devexit snd_trident_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "Trident4DWaveAudio",
+        .owner = THIS_MODULE,
         .id_table = snd_trident_ids,
         .probe = snd_trident_probe,
         .remove = __devexit_p(snd_trident_remove),
diff --git a/sound/pci/trident/trident_main.c b/sound/pci/trident/trident_main.c
index f30d9d947862..777da9a7298b 100644
--- a/sound/pci/trident/trident_main.c
+++ b/sound/pci/trident/trident_main.c
@@ -2960,7 +2960,7 @@ static int __devinit snd_trident_mixer(trident_t * trident, int pcm_spdif_device
                 .read = snd_trident_codec_read,
         };
 
-        uctl = kcalloc(1, sizeof(*uctl), GFP_KERNEL);
+        uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
         if (!uctl)
                 return -ENOMEM;
 
@@ -3546,7 +3546,7 @@ int __devinit snd_trident_create(snd_card_t * card,
                 return -ENXIO;
         }
         
-        trident = kcalloc(1, sizeof(*trident), GFP_KERNEL);
+        trident = kzalloc(sizeof(*trident), GFP_KERNEL);
         if (trident == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
diff --git a/sound/pci/via82xx.c b/sound/pci/via82xx.c
index 56c6e52d7264..6db7de6b9719 100644
--- a/sound/pci/via82xx.c
+++ b/sound/pci/via82xx.c
@@ -104,14 +104,6 @@ module_param_array(dxs_support, int, NULL, 0444);
 MODULE_PARM_DESC(dxs_support, "Support for DXS channels (0 = auto, 1 = enable, 2 = disable, 3 = 48k only, 4 = no VRA, 5 = enable any sample rate)");
 
 
-/* pci ids */
-#ifndef PCI_DEVICE_ID_VIA_82C686_5
-#define PCI_DEVICE_ID_VIA_82C686_5      0x3058
-#endif
-#ifndef PCI_DEVICE_ID_VIA_8233_5
-#define PCI_DEVICE_ID_VIA_8233_5        0x3059
-#endif
-
 /* revision numbers for via686 */
 #define VIA_REV_686_A           0x10
 #define VIA_REV_686_B           0x11
@@ -1935,11 +1927,12 @@ static int snd_via82xx_chip_init(via82xx_t *chip)
                  * DXS channels don't work properly with VRA if MC97 is disabled.
                  */
                 struct pci_dev *pci;
-                pci = pci_find_device(0x1106, 0x3068, NULL); /* MC97 */
+                pci = pci_get_device(0x1106, 0x3068, NULL); /* MC97 */
                 if (pci) {
                         unsigned char data;
                         pci_read_config_byte(pci, 0x44, &data);
                         pci_write_config_byte(pci, 0x44, data | 0x40);
+                        pci_dev_put(pci);
                 }
         }
 
@@ -2065,7 +2058,7 @@ static int __devinit snd_via82xx_create(snd_card_t * card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        if ((chip = kcalloc(1, sizeof(*chip), GFP_KERNEL)) == NULL) {
+        if ((chip = kzalloc(sizeof(*chip), GFP_KERNEL)) == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
         }
@@ -2350,6 +2343,7 @@ static void __devexit snd_via82xx_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "VIA 82xx Audio",
+        .owner = THIS_MODULE,
         .id_table = snd_via82xx_ids,
         .probe = snd_via82xx_probe,
         .remove = __devexit_p(snd_via82xx_remove),
diff --git a/sound/pci/via82xx_modem.c b/sound/pci/via82xx_modem.c
index 5872d438a04a..7eac6f6ac737 100644
--- a/sound/pci/via82xx_modem.c
+++ b/sound/pci/via82xx_modem.c
@@ -1083,7 +1083,7 @@ static int __devinit snd_via82xx_create(snd_card_t * card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        if ((chip = kcalloc(1, sizeof(*chip), GFP_KERNEL)) == NULL) {
+        if ((chip = kzalloc(sizeof(*chip), GFP_KERNEL)) == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
         }
@@ -1207,6 +1207,7 @@ static void __devexit snd_via82xx_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "VIA 82xx Modem",
+        .owner = THIS_MODULE,
         .id_table = snd_via82xx_modem_ids,
         .probe = snd_via82xx_probe,
         .remove = __devexit_p(snd_via82xx_remove),
diff --git a/sound/pci/vx222/vx222.c b/sound/pci/vx222/vx222.c
index dca6bd2c7580..2a7ad9dec021 100644
--- a/sound/pci/vx222/vx222.c
+++ b/sound/pci/vx222/vx222.c
@@ -252,6 +252,7 @@ static void __devexit snd_vx222_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "Digigram VX222",
+        .owner = THIS_MODULE,
         .id_table = snd_vx222_ids,
         .probe = snd_vx222_probe,
         .remove = __devexit_p(snd_vx222_remove),
diff --git a/sound/pci/ymfpci/ymfpci.c b/sound/pci/ymfpci/ymfpci.c
index 5b5b624b47d0..2e69abe51aa9 100644
--- a/sound/pci/ymfpci/ymfpci.c
+++ b/sound/pci/ymfpci/ymfpci.c
@@ -352,6 +352,7 @@ static void __devexit snd_card_ymfpci_remove(struct pci_dev *pci)
 
 static struct pci_driver driver = {
         .name = "Yamaha DS-XG PCI",
+        .owner = THIS_MODULE,
         .id_table = snd_ymfpci_ids,
         .probe = snd_card_ymfpci_probe,
         .remove = __devexit_p(snd_card_ymfpci_remove),
diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
index 054836412dc4..27fa523639ae 100644
--- a/sound/pci/ymfpci/ymfpci_main.c
+++ b/sound/pci/ymfpci/ymfpci_main.c
@@ -839,7 +839,7 @@ static int snd_ymfpci_playback_open_1(snd_pcm_substream_t * substream)
         snd_pcm_runtime_t *runtime = substream->runtime;
         ymfpci_pcm_t *ypcm;
 
-        ypcm = kcalloc(1, sizeof(*ypcm), GFP_KERNEL);
+        ypcm = kzalloc(sizeof(*ypcm), GFP_KERNEL);
         if (ypcm == NULL)
                 return -ENOMEM;
         ypcm->chip = chip;
@@ -957,7 +957,7 @@ static int snd_ymfpci_capture_open(snd_pcm_substream_t * substream,
         snd_pcm_runtime_t *runtime = substream->runtime;
         ymfpci_pcm_t *ypcm;
 
-        ypcm = kcalloc(1, sizeof(*ypcm), GFP_KERNEL);
+        ypcm = kzalloc(sizeof(*ypcm), GFP_KERNEL);
         if (ypcm == NULL)
                 return -ENOMEM;
         ypcm->chip = chip;
@@ -2270,7 +2270,7 @@ int __devinit snd_ymfpci_create(snd_card_t * card,
         if ((err = pci_enable_device(pci)) < 0)
                 return err;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL) {
                 pci_disable_device(pci);
                 return -ENOMEM;
diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf_core.c b/sound/pcmcia/pdaudiocf/pdaudiocf_core.c
index a2132e3763dd..0208c54896b3 100644
--- a/sound/pcmcia/pdaudiocf/pdaudiocf_core.c
+++ b/sound/pcmcia/pdaudiocf/pdaudiocf_core.c
@@ -151,7 +151,7 @@ pdacf_t *snd_pdacf_create(snd_card_t *card)
 {
         pdacf_t *chip;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return NULL;
         chip->card = card;
diff --git a/sound/ppc/Kconfig b/sound/ppc/Kconfig
index 75213bf4d567..206b9333f91f 100644
--- a/sound/ppc/Kconfig
+++ b/sound/ppc/Kconfig
@@ -13,11 +13,24 @@ config SND_POWERMAC
         tristate "PowerMac (AWACS, DACA, Burgundy, Tumbler, Keywest)"
         depends on SND && I2C && INPUT && PPC_PMAC
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for the integrated sound device.
 
           To compile this driver as a module, choose M here: the module
           will be called snd-powermac.
 
-endmenu
+config SND_POWERMAC_AUTO_DRC
+        bool "Toggle DRC automatically at headphone/line plug-in"
+        depends on SND_POWERMAC
+        default y
+        help
+          Say Y here to enable the automatic toggle of DRC (dynamic
+          range compression) on Tumbler/Snapper.
+          If this feature is enabled, DRC is turned off when the
+          headphone/line jack is plugged, and turned on when unplugged.
 
+          Note that you can turn on/off DRC manually even without this
+          option.
+
+endmenu
diff --git a/sound/ppc/pmac.c b/sound/ppc/pmac.c
index c89e82eb06a6..e35b48d29c45 100644
--- a/sound/ppc/pmac.c
+++ b/sound/ppc/pmac.c
@@ -988,6 +988,7 @@ static int __init snd_pmac_detect(pmac_t *chip)
                 case 0x33:
                 case 0x29:
                 case 0x24:
+                case 0x5c:
                         chip->num_freqs = ARRAY_SIZE(tumbler_freqs);
                         chip->model = PMAC_SNAPPER;
                         chip->can_byte_swap = 0; /* FIXME: check this */
@@ -1159,7 +1160,7 @@ int __init snd_pmac_new(snd_card_t *card, pmac_t **chip_return)
         snd_runtime_check(chip_return, return -EINVAL);
         *chip_return = NULL;
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
         chip->card = card;
diff --git a/sound/ppc/powermac.c b/sound/ppc/powermac.c
index 231f6432ea6d..a6d8cbf4064f 100644
--- a/sound/ppc/powermac.c
+++ b/sound/ppc/powermac.c
@@ -131,6 +131,9 @@ static int __init snd_pmac_probe(void)
         if (enable_beep)
                 snd_pmac_attach_beep(chip);
 
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto __error;
+
         if ((err = snd_card_register(card)) < 0)
                 goto __error;
 
diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
index b94437c024b1..65384afcfc3f 100644
--- a/sound/ppc/tumbler.c
+++ b/sound/ppc/tumbler.c
@@ -948,7 +948,6 @@ static void device_change_handler(void *self)
                         msleep(10);
                 check_mute(chip, &mix->amp_mute, 1, mix->auto_mute_notify,
                            chip->speaker_sw_ctl);
-                mix->drc_enable = 0;
         } else {
                 /* unmute speaker, mute others */
                 check_mute(chip, &mix->amp_mute, 0, mix->auto_mute_notify,
@@ -960,20 +959,21 @@ static void device_change_handler(void *self)
                 if (mix->line_mute.addr != 0)
                         check_mute(chip, &mix->line_mute, 1, mix->auto_mute_notify,
                                    chip->lineout_sw_ctl);
-                mix->drc_enable = 1;
         }
-        if (mix->auto_mute_notify) {
+        if (mix->auto_mute_notify)
                 snd_ctl_notify(chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
                                        &chip->hp_detect_ctl->id);
+
+#ifdef CONFIG_SND_POWERMAC_AUTO_DRC
+        mix->drc_enable = ! (headphone || lineout);
+        if (mix->auto_mute_notify)
                 snd_ctl_notify(chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
                                &chip->drc_sw_ctl->id);
-        }
-
-        /* first set the DRC so the speaker do not explode -ReneR */
         if (chip->model == PMAC_TUMBLER)
                 tumbler_set_drc(mix);
         else
                 snapper_set_drc(mix);
+#endif
 
         /* reset the master volume so the correct amplification is applied */
         tumbler_set_master_volume(mix);
@@ -1370,6 +1370,17 @@ int __init snd_pmac_tumbler_init(pmac_t *chip)
         if ((err = snd_ctl_add(chip->card, chip->drc_sw_ctl)) < 0)
                 return err;
 
+        /* set initial DRC range to 60% */
+        if (chip->model == PMAC_TUMBLER)
+                mix->drc_range = (TAS3001_DRC_MAX * 6) / 10;
+        else
+                mix->drc_range = (TAS3004_DRC_MAX * 6) / 10;
+        mix->drc_enable = 1; /* will be changed later if AUTO_DRC is set */
+        if (chip->model == PMAC_TUMBLER)
+                tumbler_set_drc(mix);
+        else
+                snapper_set_drc(mix);
+
 #ifdef CONFIG_PM
         chip->suspend = tumbler_suspend;
         chip->resume = tumbler_resume;
diff --git a/sound/sparc/Kconfig b/sound/sparc/Kconfig
index 25a8a558ef92..09ab138646a6 100644
--- a/sound/sparc/Kconfig
+++ b/sound/sparc/Kconfig
@@ -7,6 +7,7 @@ config SND_SUN_AMD7930
         tristate "Sun AMD7930"
         depends on SBUS && SND
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for AMD7930 sound device on Sun.
 
@@ -17,6 +18,7 @@ config SND_SUN_CS4231
         tristate "Sun CS4231"
         depends on SND
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for CS4231 sound device on Sun.
 
@@ -27,6 +29,7 @@ config SND_SUN_DBRI
         tristate "Sun DBRI"
         depends on SND && SBUS
         select SND_PCM
+        select SND_GENERIC_DRIVER
         help
           Say Y here to include support for DBRI sound device on Sun.
 
diff --git a/sound/sparc/amd7930.c b/sound/sparc/amd7930.c
index bd8a850e93ea..46d504ba7e03 100644
--- a/sound/sparc/amd7930.c
+++ b/sound/sparc/amd7930.c
@@ -967,7 +967,7 @@ static int __init snd_amd7930_create(snd_card_t *card,
         int err;
 
         *ramd = NULL;
-        amd = kcalloc(1, sizeof(*amd), GFP_KERNEL);
+        amd = kzalloc(sizeof(*amd), GFP_KERNEL);
         if (amd == NULL)
                 return -ENOMEM;
 
@@ -1088,6 +1088,9 @@ static int __init amd7930_attach(int prom_node, struct sbus_dev *sdev)
         if ((err = snd_amd7930_mixer(amd)) < 0)
                 goto out_err;
 
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto out_err;
+
         if ((err = snd_card_register(card)) < 0)
                 goto out_err;
 
diff --git a/sound/sparc/cs4231.c b/sound/sparc/cs4231.c
index 36f9fe4d7bea..f4361c518e46 100644
--- a/sound/sparc/cs4231.c
+++ b/sound/sparc/cs4231.c
@@ -173,7 +173,7 @@ static cs4231_t *cs4231_list;
 
 #define CS4231_GLOBALIRQ        0x01    /* IRQ is active */
 
-/* definitions for codec irq status */
+/* definitions for codec irq status - CS4231_IRQ_STATUS */
 
 #define CS4231_PLAYBACK_IRQ     0x10
 #define CS4231_RECORD_IRQ       0x20
@@ -402,7 +402,7 @@ static void snd_cs4231_outm(cs4231_t *chip, unsigned char reg,
                 udelay(100);
 #ifdef CONFIG_SND_DEBUG
         if (__cs4231_readb(chip, CS4231P(chip, REGSEL)) & CS4231_INIT)
-                snd_printk("outm: auto calibration time out - reg = 0x%x, value = 0x%x\n", reg, value);
+                snd_printdd("outm: auto calibration time out - reg = 0x%x, value = 0x%x\n", reg, value);
 #endif
         if (chip->calibrate_mute) {
                 chip->image[reg] &= mask;
@@ -425,6 +425,10 @@ static void snd_cs4231_dout(cs4231_t *chip, unsigned char reg, unsigned char val
              timeout > 0 && (__cs4231_readb(chip, CS4231P(chip, REGSEL)) & CS4231_INIT);
              timeout--)
                 udelay(100);
+#ifdef CONFIG_SND_DEBUG
+        if (__cs4231_readb(chip, CS4231P(chip, REGSEL)) & CS4231_INIT)
+                snd_printdd("out: auto calibration time out - reg = 0x%x, value = 0x%x\n", reg, value);
+#endif
         __cs4231_writeb(chip, chip->mce_bit | reg, CS4231P(chip, REGSEL));
         __cs4231_writeb(chip, value, CS4231P(chip, REG));
         mb();
@@ -440,15 +444,12 @@ static void snd_cs4231_out(cs4231_t *chip, unsigned char reg, unsigned char valu
                 udelay(100);
 #ifdef CONFIG_SND_DEBUG
         if (__cs4231_readb(chip, CS4231P(chip, REGSEL)) & CS4231_INIT)
-                snd_printk("out: auto calibration time out - reg = 0x%x, value = 0x%x\n", reg, value);
+                snd_printdd("out: auto calibration time out - reg = 0x%x, value = 0x%x\n", reg, value);
 #endif
         __cs4231_writeb(chip, chip->mce_bit | reg, CS4231P(chip, REGSEL));
         __cs4231_writeb(chip, value, CS4231P(chip, REG));
         chip->image[reg] = value;
         mb();
-#if 0
-        printk("codec out - reg 0x%x = 0x%x\n", chip->mce_bit | reg, value);
-#endif
 }
 
 static unsigned char snd_cs4231_in(cs4231_t *chip, unsigned char reg)
@@ -462,61 +463,14 @@ static unsigned char snd_cs4231_in(cs4231_t *chip, unsigned char reg)
                 udelay(100);
 #ifdef CONFIG_SND_DEBUG
         if (__cs4231_readb(chip, CS4231P(chip, REGSEL)) & CS4231_INIT)
-                snd_printk("in: auto calibration time out - reg = 0x%x\n", reg);
+                snd_printdd("in: auto calibration time out - reg = 0x%x\n", reg);
 #endif
         __cs4231_writeb(chip, chip->mce_bit | reg, CS4231P(chip, REGSEL));
         mb();
         ret = __cs4231_readb(chip, CS4231P(chip, REG));
-#if 0
-        printk("codec in - reg 0x%x = 0x%x\n", chip->mce_bit | reg, ret);
-#endif
         return ret;
 }
 
-#if 0
-
-static void snd_cs4231_debug(cs4231_t *chip)
-{
-        printk("CS4231 REGS:      INDEX = 0x%02x  ",
-               __cs4231_readb(chip, CS4231P(chip, REGSEL)));
-        printk("                 STATUS = 0x%02x\n",
-               __cs4231_readb(chip, CS4231P(chip, STATUS)));
-        printk("  0x00: left input      = 0x%02x  ", snd_cs4231_in(chip, 0x00));
-        printk("  0x10: alt 1 (CFIG 2)  = 0x%02x\n", snd_cs4231_in(chip, 0x10));
-        printk("  0x01: right input     = 0x%02x  ", snd_cs4231_in(chip, 0x01));
-        printk("  0x11: alt 2 (CFIG 3)  = 0x%02x\n", snd_cs4231_in(chip, 0x11));
-        printk("  0x02: GF1 left input  = 0x%02x  ", snd_cs4231_in(chip, 0x02));
-        printk("  0x12: left line in    = 0x%02x\n", snd_cs4231_in(chip, 0x12));
-        printk("  0x03: GF1 right input = 0x%02x  ", snd_cs4231_in(chip, 0x03));
-        printk("  0x13: right line in   = 0x%02x\n", snd_cs4231_in(chip, 0x13));
-        printk("  0x04: CD left input   = 0x%02x  ", snd_cs4231_in(chip, 0x04));
-        printk("  0x14: timer low       = 0x%02x\n", snd_cs4231_in(chip, 0x14));
-        printk("  0x05: CD right input  = 0x%02x  ", snd_cs4231_in(chip, 0x05));
-        printk("  0x15: timer high      = 0x%02x\n", snd_cs4231_in(chip, 0x15));
-        printk("  0x06: left output     = 0x%02x  ", snd_cs4231_in(chip, 0x06));
-        printk("  0x16: left MIC (PnP)  = 0x%02x\n", snd_cs4231_in(chip, 0x16));
-        printk("  0x07: right output    = 0x%02x  ", snd_cs4231_in(chip, 0x07));
-        printk("  0x17: right MIC (PnP) = 0x%02x\n", snd_cs4231_in(chip, 0x17));
-        printk("  0x08: playback format = 0x%02x  ", snd_cs4231_in(chip, 0x08));
-        printk("  0x18: IRQ status      = 0x%02x\n", snd_cs4231_in(chip, 0x18));
-        printk("  0x09: iface (CFIG 1)  = 0x%02x  ", snd_cs4231_in(chip, 0x09));
-        printk("  0x19: left line out   = 0x%02x\n", snd_cs4231_in(chip, 0x19));
-        printk("  0x0a: pin control     = 0x%02x  ", snd_cs4231_in(chip, 0x0a));
-        printk("  0x1a: mono control    = 0x%02x\n", snd_cs4231_in(chip, 0x1a));
-        printk("  0x0b: init & status   = 0x%02x  ", snd_cs4231_in(chip, 0x0b));
-        printk("  0x1b: right line out  = 0x%02x\n", snd_cs4231_in(chip, 0x1b));
-        printk("  0x0c: revision & mode = 0x%02x  ", snd_cs4231_in(chip, 0x0c));
-        printk("  0x1c: record format   = 0x%02x\n", snd_cs4231_in(chip, 0x1c));
-        printk("  0x0d: loopback        = 0x%02x  ", snd_cs4231_in(chip, 0x0d));
-        printk("  0x1d: var freq (PnP)  = 0x%02x\n", snd_cs4231_in(chip, 0x1d));
-        printk("  0x0e: ply upr count   = 0x%02x  ", snd_cs4231_in(chip, 0x0e));
-        printk("  0x1e: rec upr count   = 0x%02x\n", snd_cs4231_in(chip, 0x1e));
-        printk("  0x0f: ply lwr count   = 0x%02x  ", snd_cs4231_in(chip, 0x0f));
-        printk("  0x1f: rec lwr count   = 0x%02x\n", snd_cs4231_in(chip, 0x1f));
-}
-
-#endif
-
 /*
  *  CS4231 detection / MCE routines
  */
@@ -528,11 +482,12 @@ static void snd_cs4231_busy_wait(cs4231_t *chip)
         /* huh.. looks like this sequence is proper for CS4231A chip (GUS MAX) */
         for (timeout = 5; timeout > 0; timeout--)
                 __cs4231_readb(chip, CS4231P(chip, REGSEL));
+
         /* end of cleanup sequence */
-        for (timeout = 250;
+        for (timeout = 500;
              timeout > 0 && (__cs4231_readb(chip, CS4231P(chip, REGSEL)) & CS4231_INIT);
              timeout--)
-                udelay(100);
+                udelay(1000);
 }
 
 static void snd_cs4231_mce_up(cs4231_t *chip)
@@ -545,12 +500,12 @@ static void snd_cs4231_mce_up(cs4231_t *chip)
                 udelay(100);
 #ifdef CONFIG_SND_DEBUG
         if (__cs4231_readb(chip, CS4231P(chip, REGSEL)) & CS4231_INIT)
-                snd_printk("mce_up - auto calibration time out (0)\n");
+                snd_printdd("mce_up - auto calibration time out (0)\n");
 #endif
         chip->mce_bit |= CS4231_MCE;
         timeout = __cs4231_readb(chip, CS4231P(chip, REGSEL));
         if (timeout == 0x80)
-                snd_printk("mce_up [%p]: serious init problem - codec still busy\n", chip->port);
+                snd_printdd("mce_up [%p]: serious init problem - codec still busy\n", chip->port);
         if (!(timeout & CS4231_MCE))
                 __cs4231_writeb(chip, chip->mce_bit | (timeout & 0x1f), CS4231P(chip, REGSEL));
         spin_unlock_irqrestore(&chip->lock, flags);
@@ -563,18 +518,15 @@ static void snd_cs4231_mce_down(cs4231_t *chip)
 
         spin_lock_irqsave(&chip->lock, flags);
         snd_cs4231_busy_wait(chip);
-#if 0
-        printk("(1) timeout = %i\n", timeout);
-#endif
 #ifdef CONFIG_SND_DEBUG
         if (__cs4231_readb(chip, CS4231P(chip, REGSEL)) & CS4231_INIT)
-                snd_printk("mce_down [%p] - auto calibration time out (0)\n", CS4231P(chip, REGSEL));
+                snd_printdd("mce_down [%p] - auto calibration time out (0)\n", CS4231P(chip, REGSEL));
 #endif
         chip->mce_bit &= ~CS4231_MCE;
         timeout = __cs4231_readb(chip, CS4231P(chip, REGSEL));
         __cs4231_writeb(chip, chip->mce_bit | (timeout & 0x1f), CS4231P(chip, REGSEL));
         if (timeout == 0x80)
-                snd_printk("mce_down [%p]: serious init problem - codec still busy\n", chip->port);
+                snd_printdd("mce_down [%p]: serious init problem - codec still busy\n", chip->port);
         if ((timeout & CS4231_MCE) == 0) {
                 spin_unlock_irqrestore(&chip->lock, flags);
                 return;
@@ -590,9 +542,7 @@ static void snd_cs4231_mce_down(cs4231_t *chip)
                 spin_unlock_irqrestore(&chip->lock, flags);
                 return;
         }
-#if 0
-        printk("(2) timeout = %i, jiffies = %li\n", timeout, jiffies);
-#endif
+
         /* in 10ms increments, check condition, up to 250ms */
         timeout = 25;
         while (snd_cs4231_in(chip, CS4231_TEST_INIT) & CS4231_CALIB_IN_PROGRESS) {
@@ -604,9 +554,7 @@ static void snd_cs4231_mce_down(cs4231_t *chip)
                 msleep(10);
                 spin_lock_irqsave(&chip->lock, flags);
         }
-#if 0
-        printk("(3) jiffies = %li\n", jiffies);
-#endif
+
         /* in 10ms increments, check condition, up to 100ms */
         timeout = 10;
         while (__cs4231_readb(chip, CS4231P(chip, REGSEL)) & CS4231_INIT) {
@@ -619,28 +567,7 @@ static void snd_cs4231_mce_down(cs4231_t *chip)
                 spin_lock_irqsave(&chip->lock, flags);
         }
         spin_unlock_irqrestore(&chip->lock, flags);
-#if 0
-        printk("(4) jiffies = %li\n", jiffies);
-        snd_printk("mce_down - exit = 0x%x\n", __cs4231_readb(chip, CS4231P(chip, REGSEL)));
-#endif
-}
-
-#if 0 /* Unused for now... */
-static unsigned int snd_cs4231_get_count(unsigned char format, unsigned int size)
-{
-        switch (format & 0xe0) {
-        case CS4231_LINEAR_16:
-        case CS4231_LINEAR_16_BIG:
-                size >>= 1;
-                break;
-        case CS4231_ADPCM_16:
-                return size >> 2;
-        }
-        if (format & CS4231_STEREO)
-                size >>= 1;
-        return size;
 }
-#endif
 
 #ifdef EBUS_SUPPORT
 static void snd_cs4231_ebus_advance_dma(struct ebus_dma_info *p, snd_pcm_substream_t *substream, unsigned int *periods_sent)
@@ -648,25 +575,50 @@ static void snd_cs4231_ebus_advance_dma(struct ebus_dma_info *p, snd_pcm_substre
         snd_pcm_runtime_t *runtime = substream->runtime;
 
         while (1) {
-                unsigned int dma_size = snd_pcm_lib_period_bytes(substream);
-                unsigned int offset = dma_size * (*periods_sent);
+                unsigned int period_size = snd_pcm_lib_period_bytes(substream);
+                unsigned int offset = period_size * (*periods_sent);
 
-                if (dma_size >= (1 << 24))
+                if (period_size >= (1 << 24))
                         BUG();
 
-                if (ebus_dma_request(p, runtime->dma_addr + offset, dma_size))
+                if (ebus_dma_request(p, runtime->dma_addr + offset, period_size))
                         return;
-#if 0
-                printk("ebus_advance: Sent period %u (size[%x] offset[%x])\n",
-                       (*periods_sent), dma_size, offset);
-#endif
                 (*periods_sent) = ((*periods_sent) + 1) % runtime->periods;
         }
 }
 #endif
 
-static void cs4231_dma_trigger(cs4231_t *chip, unsigned int what, int on)
+#ifdef SBUS_SUPPORT
+static void snd_cs4231_sbus_advance_dma(snd_pcm_substream_t *substream, unsigned int *periods_sent)
 {
+        cs4231_t *chip = snd_pcm_substream_chip(substream);
+        snd_pcm_runtime_t *runtime = substream->runtime;
+
+        unsigned int period_size = snd_pcm_lib_period_bytes(substream);
+        unsigned int offset = period_size * (*periods_sent % runtime->periods);
+
+        if (runtime->period_size > 0xffff + 1)
+                BUG();
+
+        switch (substream->stream) {
+        case SNDRV_PCM_STREAM_PLAYBACK:
+                sbus_writel(runtime->dma_addr + offset, chip->port + APCPNVA);
+                sbus_writel(period_size, chip->port + APCPNC);
+                break;
+        case SNDRV_PCM_STREAM_CAPTURE:
+                sbus_writel(runtime->dma_addr + offset, chip->port + APCCNVA);
+                sbus_writel(period_size, chip->port + APCCNC);
+                break;
+        }
+
+        (*periods_sent) = (*periods_sent + 1) % runtime->periods;
+}
+#endif
+
+static void cs4231_dma_trigger(snd_pcm_substream_t *substream, unsigned int what, int on)
+{
+        cs4231_t *chip = snd_pcm_substream_chip(substream);
+
 #ifdef EBUS_SUPPORT
         if (chip->flags & CS4231_FLAG_EBUS) {
                 if (what & CS4231_PLAYBACK_ENABLE) {
@@ -694,6 +646,60 @@ static void cs4231_dma_trigger(cs4231_t *chip, unsigned int what, int on)
         } else {
 #endif
 #ifdef SBUS_SUPPORT
+        u32 csr = sbus_readl(chip->port + APCCSR);
+        /* I don't know why, but on sbus the period counter must
+         * only start counting after the first period is sent.
+         * Therefore this dummy thing.
+         */
+        unsigned int dummy = 0;
+
+        switch (what) {
+        case CS4231_PLAYBACK_ENABLE:
+                if (on) {
+                        csr &= ~APC_XINT_PLAY;
+                        sbus_writel(csr, chip->port + APCCSR);
+
+                        csr &= ~APC_PPAUSE;
+                        sbus_writel(csr, chip->port + APCCSR);
+
+                        snd_cs4231_sbus_advance_dma(substream, &dummy);
+
+                        csr |=  APC_GENL_INT | APC_PLAY_INT | APC_XINT_ENA |
+                                APC_XINT_PLAY | APC_XINT_EMPT | APC_XINT_GENL |
+                                APC_XINT_PENA | APC_PDMA_READY;
+                        sbus_writel(csr, chip->port + APCCSR);
+                } else {
+                        csr |= APC_PPAUSE;
+                        sbus_writel(csr, chip->port + APCCSR);
+
+                        csr &= ~APC_PDMA_READY;
+                        sbus_writel(csr, chip->port + APCCSR);
+                }
+                break;
+        case CS4231_RECORD_ENABLE:
+                if (on) {
+                        csr &= ~APC_XINT_CAPT;
+                        sbus_writel(csr, chip->port + APCCSR);
+
+                        csr &= ~APC_CPAUSE;
+                        sbus_writel(csr, chip->port + APCCSR);
+
+                        snd_cs4231_sbus_advance_dma(substream, &dummy);
+
+                        csr |=  APC_GENL_INT | APC_CAPT_INT | APC_XINT_ENA |
+                                APC_XINT_CAPT | APC_XINT_CEMP | APC_XINT_GENL |
+                                APC_CDMA_READY;
+
+                        sbus_writel(csr, chip->port + APCCSR);
+                } else {
+                        csr |= APC_CPAUSE;
+                        sbus_writel(csr, chip->port + APCCSR);
+
+                        csr &= ~APC_CDMA_READY;
+                        sbus_writel(csr, chip->port + APCCSR);
+                }
+                break;
+        }
 #endif
 #ifdef EBUS_SUPPORT
         }
@@ -725,25 +731,12 @@ static int snd_cs4231_trigger(snd_pcm_substream_t *substream, int cmd)
                         }
                 }
 
-#if 0
-                printk("TRIGGER: what[%x] on(%d)\n",
-                       what, (cmd == SNDRV_PCM_TRIGGER_START));
-#endif
-
                 spin_lock_irqsave(&chip->lock, flags);
                 if (cmd == SNDRV_PCM_TRIGGER_START) {
-                        cs4231_dma_trigger(chip, what, 1);
+                        cs4231_dma_trigger(substream, what, 1);
                         chip->image[CS4231_IFACE_CTRL] |= what;
-                        if (what & CS4231_PLAYBACK_ENABLE) {
-                                snd_cs4231_out(chip, CS4231_PLY_LWR_CNT, 0xff);
-                                snd_cs4231_out(chip, CS4231_PLY_UPR_CNT, 0xff);
-                        }
-                        if (what & CS4231_RECORD_ENABLE) {
-                                snd_cs4231_out(chip, CS4231_REC_LWR_CNT, 0xff);
-                                snd_cs4231_out(chip, CS4231_REC_UPR_CNT, 0xff);
-                        }
                 } else {
-                        cs4231_dma_trigger(chip, what, 0);
+                        cs4231_dma_trigger(substream, what, 0);
                         chip->image[CS4231_IFACE_CTRL] &= ~what;
                 }
                 snd_cs4231_out(chip, CS4231_IFACE_CTRL,
@@ -755,9 +748,7 @@ static int snd_cs4231_trigger(snd_pcm_substream_t *substream, int cmd)
                 result = -EINVAL;
                 break;
         }
-#if 0
-        snd_cs4231_debug(chip);
-#endif
+
         return result;
 }
 
@@ -790,9 +781,6 @@ static unsigned char snd_cs4231_get_format(cs4231_t *chip, int format, int chann
         }
         if (channels > 1)
                 rformat |= CS4231_STEREO;
-#if 0
-        snd_printk("get_format: 0x%x (mode=0x%x)\n", format, mode);
-#endif
         return rformat;
 }
 
@@ -944,7 +932,7 @@ static void snd_cs4231_init(cs4231_t *chip)
         snd_cs4231_mce_down(chip);
 
 #ifdef SNDRV_DEBUG_MCE
-        snd_printk("init: (1)\n");
+        snd_printdd("init: (1)\n");
 #endif
         snd_cs4231_mce_up(chip);
         spin_lock_irqsave(&chip->lock, flags);
@@ -957,7 +945,7 @@ static void snd_cs4231_init(cs4231_t *chip)
         snd_cs4231_mce_down(chip);
 
 #ifdef SNDRV_DEBUG_MCE
-        snd_printk("init: (2)\n");
+        snd_printdd("init: (2)\n");
 #endif
 
         snd_cs4231_mce_up(chip);
@@ -967,7 +955,7 @@ static void snd_cs4231_init(cs4231_t *chip)
         snd_cs4231_mce_down(chip);
 
 #ifdef SNDRV_DEBUG_MCE
-        snd_printk("init: (3) - afei = 0x%x\n", chip->image[CS4231_ALT_FEATURE_1]);
+        snd_printdd("init: (3) - afei = 0x%x\n", chip->image[CS4231_ALT_FEATURE_1]);
 #endif
 
         spin_lock_irqsave(&chip->lock, flags);
@@ -981,7 +969,7 @@ static void snd_cs4231_init(cs4231_t *chip)
         snd_cs4231_mce_down(chip);
 
 #ifdef SNDRV_DEBUG_MCE
-        snd_printk("init: (4)\n");
+        snd_printdd("init: (4)\n");
 #endif
 
         snd_cs4231_mce_up(chip);
@@ -991,7 +979,7 @@ static void snd_cs4231_init(cs4231_t *chip)
         snd_cs4231_mce_down(chip);
 
 #ifdef SNDRV_DEBUG_MCE
-        snd_printk("init: (5)\n");
+        snd_printdd("init: (5)\n");
 #endif
 }
 
@@ -1022,6 +1010,7 @@ static int snd_cs4231_open(cs4231_t *chip, unsigned int mode)
                        CS4231_RECORD_IRQ |
                        CS4231_TIMER_IRQ);
         snd_cs4231_out(chip, CS4231_IRQ_STATUS, 0);
+
         spin_unlock_irqrestore(&chip->lock, flags);
 
         chip->mode = mode;
@@ -1136,11 +1125,21 @@ static int snd_cs4231_playback_hw_free(snd_pcm_substream_t *substream)
 static int snd_cs4231_playback_prepare(snd_pcm_substream_t *substream)
 {
         cs4231_t *chip = snd_pcm_substream_chip(substream);
+        snd_pcm_runtime_t *runtime = substream->runtime;
         unsigned long flags;
 
         spin_lock_irqsave(&chip->lock, flags);
+
         chip->image[CS4231_IFACE_CTRL] &= ~(CS4231_PLAYBACK_ENABLE |
                                             CS4231_PLAYBACK_PIO);
+
+        if (runtime->period_size > 0xffff + 1)
+                BUG();
+
+        snd_cs4231_out(chip, CS4231_PLY_LWR_CNT, (runtime->period_size - 1) & 0x00ff);
+        snd_cs4231_out(chip, CS4231_PLY_UPR_CNT, (runtime->period_size - 1) >> 8 & 0x00ff);
+        chip->p_periods_sent = 0;
+
         spin_unlock_irqrestore(&chip->lock, flags);
 
         return 0;
@@ -1172,12 +1171,16 @@ static int snd_cs4231_capture_hw_free(snd_pcm_substream_t *substream)
 static int snd_cs4231_capture_prepare(snd_pcm_substream_t *substream)
 {
         cs4231_t *chip = snd_pcm_substream_chip(substream);
+        snd_pcm_runtime_t *runtime = substream->runtime;
         unsigned long flags;
 
         spin_lock_irqsave(&chip->lock, flags);
         chip->image[CS4231_IFACE_CTRL] &= ~(CS4231_RECORD_ENABLE |
                                             CS4231_RECORD_PIO);
 
+        snd_cs4231_out(chip, CS4231_REC_LWR_CNT, (runtime->period_size - 1) & 0x00ff);
+        snd_cs4231_out(chip, CS4231_REC_LWR_CNT, (runtime->period_size - 1) >> 8 & 0x00ff);
+
         spin_unlock_irqrestore(&chip->lock, flags);
 
         return 0;
@@ -1196,53 +1199,61 @@ static void snd_cs4231_overrange(cs4231_t *chip)
                 chip->capture_substream->runtime->overrange++;
 }
 
-static void snd_cs4231_generic_interrupt(cs4231_t *chip)
+static irqreturn_t snd_cs4231_generic_interrupt(cs4231_t *chip)
 {
         unsigned long flags;
         unsigned char status;
 
+        /*This is IRQ is not raised by the cs4231*/
+        if (!(__cs4231_readb(chip, CS4231P(chip, STATUS)) & CS4231_GLOBALIRQ))
+                return IRQ_NONE;
+
         status = snd_cs4231_in(chip, CS4231_IRQ_STATUS);
-        if (!status)
-                return;
 
         if (status & CS4231_TIMER_IRQ) {
                 if (chip->timer)
                         snd_timer_interrupt(chip->timer, chip->timer->sticks);
         }               
-        if (status & CS4231_PLAYBACK_IRQ)
-                snd_pcm_period_elapsed(chip->playback_substream);
-        if (status & CS4231_RECORD_IRQ) {
+
+        if (status & CS4231_RECORD_IRQ)
                 snd_cs4231_overrange(chip);
-                snd_pcm_period_elapsed(chip->capture_substream);
-        }
 
         /* ACK the CS4231 interrupt. */
         spin_lock_irqsave(&chip->lock, flags);
         snd_cs4231_outm(chip, CS4231_IRQ_STATUS, ~CS4231_ALL_IRQS | ~status, 0);
         spin_unlock_irqrestore(&chip->lock, flags);
+
+        return 0;
 }
 
 #ifdef SBUS_SUPPORT
 static irqreturn_t snd_cs4231_sbus_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 {
         cs4231_t *chip = dev_id;
-        u32 csr;
-
-        csr = sbus_readl(chip->port + APCCSR);
-        if (!(csr & (APC_INT_PENDING |
-                     APC_PLAY_INT |
-                     APC_CAPT_INT |
-                     APC_GENL_INT |
-                     APC_XINT_PEMP |
-                     APC_XINT_CEMP)))
-                return IRQ_NONE;
 
         /* ACK the APC interrupt. */
+        u32 csr = sbus_readl(chip->port + APCCSR);
+
         sbus_writel(csr, chip->port + APCCSR);
 
-        snd_cs4231_generic_interrupt(chip);
+        if ((chip->image[CS4231_IFACE_CTRL] & CS4231_PLAYBACK_ENABLE) &&
+            (csr & APC_PLAY_INT) &&
+            (csr & APC_XINT_PNVA) &&
+            !(csr & APC_XINT_EMPT)) {
+                snd_cs4231_sbus_advance_dma(chip->playback_substream,
+                                            &chip->p_periods_sent);
+                snd_pcm_period_elapsed(chip->playback_substream);
+        }
 
-        return IRQ_HANDLED;
+        if ((chip->image[CS4231_IFACE_CTRL] & CS4231_RECORD_ENABLE) &&
+            (csr & APC_CAPT_INT) &&
+            (csr & APC_XINT_CNVA)) {
+                snd_cs4231_sbus_advance_dma(chip->capture_substream,
+                                            &chip->c_periods_sent);
+                snd_pcm_period_elapsed(chip->capture_substream);
+        }
+
+        return snd_cs4231_generic_interrupt(chip);
 }
 #endif
 
@@ -1290,7 +1301,8 @@ static snd_pcm_uframes_t snd_cs4231_playback_pointer(snd_pcm_substream_t *substr
 #ifdef EBUS_SUPPORT
         }
 #endif
-        ptr += (period_bytes - residue);
+        ptr += period_bytes - residue;
+
         return bytes_to_frames(substream->runtime, ptr);
 }
 
@@ -1314,7 +1326,7 @@ static snd_pcm_uframes_t snd_cs4231_capture_pointer(snd_pcm_substream_t * substr
 #ifdef EBUS_SUPPORT
         }
 #endif
-        ptr += (period_bytes - residue);
+        ptr += period_bytes - residue;
         return bytes_to_frames(substream->runtime, ptr);
 }
 
@@ -1328,9 +1340,6 @@ static int snd_cs4231_probe(cs4231_t *chip)
         int i, id, vers;
         unsigned char *ptr;
 
-#if 0
-        snd_cs4231_debug(chip);
-#endif
         id = vers = 0;
         for (i = 0; i < 50; i++) {
                 mb();
@@ -1915,6 +1924,9 @@ static int cs4231_attach_finish(snd_card_t *card, cs4231_t *chip)
         if ((err = snd_cs4231_timer(chip)) < 0)
                 goto out_err;
 
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto out_err;
+
         if ((err = snd_card_register(card)) < 0)
                 goto out_err;
 
@@ -1966,7 +1978,7 @@ static int __init snd_cs4231_sbus_create(snd_card_t *card,
         int err;
 
         *rchip = NULL;
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
 
@@ -1982,13 +1994,13 @@ static int __init snd_cs4231_sbus_create(snd_card_t *card,
         chip->port = sbus_ioremap(&sdev->resource[0], 0,
                                   chip->regs_size, "cs4231");
         if (!chip->port) {
-                snd_printk("cs4231-%d: Unable to map chip registers.\n", dev);
+                snd_printdd("cs4231-%d: Unable to map chip registers.\n", dev);
                 return -EIO;
         }
 
         if (request_irq(sdev->irqs[0], snd_cs4231_sbus_interrupt,
                         SA_SHIRQ, "cs4231", chip)) {
-                snd_printk("cs4231-%d: Unable to grab SBUS IRQ %s\n",
+                snd_printdd("cs4231-%d: Unable to grab SBUS IRQ %s\n",
                            dev,
                            __irq_itoa(sdev->irqs[0]));
                 snd_cs4231_sbus_free(chip);
@@ -2080,7 +2092,7 @@ static int __init snd_cs4231_ebus_create(snd_card_t *card,
         int err;
 
         *rchip = NULL;
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
                 return -ENOMEM;
 
@@ -2110,29 +2122,29 @@ static int __init snd_cs4231_ebus_create(snd_card_t *card,
         chip->eb2c.regs = ioremap(edev->resource[2].start, 0x10);
         if (!chip->port || !chip->eb2p.regs || !chip->eb2c.regs) {
                 snd_cs4231_ebus_free(chip);
-                snd_printk("cs4231-%d: Unable to map chip registers.\n", dev);
+                snd_printdd("cs4231-%d: Unable to map chip registers.\n", dev);
                 return -EIO;
         }
 
         if (ebus_dma_register(&chip->eb2c)) {
                 snd_cs4231_ebus_free(chip);
-                snd_printk("cs4231-%d: Unable to register EBUS capture DMA\n", dev);
+                snd_printdd("cs4231-%d: Unable to register EBUS capture DMA\n", dev);
                 return -EBUSY;
         }
         if (ebus_dma_irq_enable(&chip->eb2c, 1)) {
                 snd_cs4231_ebus_free(chip);
-                snd_printk("cs4231-%d: Unable to enable EBUS capture IRQ\n", dev);
+                snd_printdd("cs4231-%d: Unable to enable EBUS capture IRQ\n", dev);
                 return -EBUSY;
         }
 
         if (ebus_dma_register(&chip->eb2p)) {
                 snd_cs4231_ebus_free(chip);
-                snd_printk("cs4231-%d: Unable to register EBUS play DMA\n", dev);
+                snd_printdd("cs4231-%d: Unable to register EBUS play DMA\n", dev);
                 return -EBUSY;
         }
         if (ebus_dma_irq_enable(&chip->eb2p, 1)) {
                 snd_cs4231_ebus_free(chip);
-                snd_printk("cs4231-%d: Unable to enable EBUS play IRQ\n", dev);
+                snd_printdd("cs4231-%d: Unable to enable EBUS play IRQ\n", dev);
                 return -EBUSY;
         }
 
diff --git a/sound/sparc/dbri.c b/sound/sparc/dbri.c
index 941c7b1e7ebb..b5c4c15ae7f0 100644
--- a/sound/sparc/dbri.c
+++ b/sound/sparc/dbri.c
@@ -1,6 +1,6 @@
 /*
  * Driver for DBRI sound chip found on Sparcs.
- * Copyright (C) 2004 Martin Habets (mhabets@users.sourceforge.net)
+ * Copyright (C) 2004, 2005 Martin Habets (mhabets@users.sourceforge.net)
  *
  * Based entirely upon drivers/sbus/audio/dbri.c which is:
  * Copyright (C) 1997 Rudolf Koenig (rfkoenig@immd4.informatik.uni-erlangen.de)
@@ -43,6 +43,12 @@
  * audio devices. But the SUN HW group decided against it, at least on my
  * LX the speakerbox connector has at least 1 pin missing and 1 wrongly
  * connected.
+ *
+ * I've tried to stick to the following function naming conventions:
+ * snd_*        ALSA stuff
+ * cs4215_*     CS4215 codec specfic stuff
+ * dbri_*       DBRI high-level stuff
+ * other        DBRI low-level stuff
  */
 
 #include <sound/driver.h>
@@ -87,7 +93,7 @@ MODULE_PARM_DESC(enable, "Enable Sun DBRI soundcard.");
 #define D_DESC  (1<<5)
 
 static int dbri_debug = 0;
-module_param(dbri_debug, int, 0444);
+module_param(dbri_debug, int, 0644);
 MODULE_PARM_DESC(dbri_debug, "Debug value for Sun DBRI soundcard.");
 
 #ifdef DBRI_DEBUG
@@ -320,7 +326,8 @@ typedef struct snd_dbri {
         void __iomem *regs;     /* dbri HW regs */
         int dbri_version;       /* 'e' and up is OK */
         int dbri_irqp;          /* intr queue pointer */
-        int wait_seen;
+        int wait_send;          /* sequence of command buffers send */
+        int wait_ackd;          /* sequence of command buffers acknowledged */
 
         struct dbri_pipe pipes[DBRI_NO_PIPES];  /* DBRI's 32 data pipes */
         struct dbri_desc descs[DBRI_NO_DESCS];
@@ -625,16 +632,13 @@ static __u32 reverse_bytes(__u32 b, int len)
 
 Commands are sent to the DBRI by building a list of them in memory,
 then writing the address of the first list item to DBRI register 8.
-The list is terminated with a WAIT command, which can generate a
-CPU interrupt if required.
+The list is terminated with a WAIT command, which generates a
+CPU interrupt to signal completion.
 
 Since the DBRI can run in parallel with the CPU, several means of
-synchronization present themselves.  The original scheme (Rudolf's)
-was to set a flag when we "cmdlock"ed the DBRI, clear the flag when
-an interrupt signaled completion, and wait on a wait_queue if a routine
-attempted to cmdlock while the flag was set.  The problems arose when
-we tried to cmdlock from inside an interrupt handler, which might
-cause scheduling in an interrupt (if we waited), etc, etc
+synchronization present themselves.  The method implemented here is close
+to the original scheme (Rudolf's), and uses 2 counters (wait_send and
+wait_ackd) to synchronize the command buffer between the CPU and the DBRI.
 
 A more sophisticated scheme might involve a circular command buffer
 or an array of command buffers.  A routine could fill one with
@@ -642,70 +646,75 @@ commands and link it onto a list.  When a interrupt signaled
 completion of the current command buffer, look on the list for
 the next one.
 
-I've decided to implement something much simpler - after each command,
-the CPU waits for the DBRI to finish the command by polling the P bit
-in DBRI register 0.  I've tried to implement this in such a way
-that might make implementing a more sophisticated scheme easier.
-
 Every time a routine wants to write commands to the DBRI, it must
 first call dbri_cmdlock() and get an initial pointer into dbri->dma->cmd
-in return.  After the commands have been writen, dbri_cmdsend() is
-called with the final pointer value.
+in return. dbri_cmdlock() will block if the previous commands have not
+been completed yet. After this the commands can be written to the buffer,
+and dbri_cmdsend() is called with the final pointer value to send them
+to the DBRI.
 
 */
 
+static void dbri_process_interrupt_buffer(snd_dbri_t * dbri);
+
 enum dbri_lock_t { NoGetLock, GetLock };
+#define MAXLOOPS 10
 
 static volatile s32 *dbri_cmdlock(snd_dbri_t * dbri, enum dbri_lock_t get)
 {
+        int maxloops = MAXLOOPS;
+
 #ifndef SMP
         if ((get == GetLock) && spin_is_locked(&dbri->lock)) {
                 printk(KERN_ERR "DBRI: cmdlock called while in spinlock.");
         }
 #endif
 
+        /* Delay if previous commands are still being processed */
+        while ((--maxloops) > 0 && (dbri->wait_send != dbri->wait_ackd)) {
+                msleep_interruptible(1);
+                /* If dbri_cmdlock() got called from inside the
+                 * interrupt handler, this will do the processing.
+                 */
+                dbri_process_interrupt_buffer(dbri);
+        }
+        if (maxloops == 0) {
+                printk(KERN_ERR "DBRI: Chip never completed command buffer %d\n",
+                        dbri->wait_send);
+        } else {
+                dprintk(D_CMD, "Chip completed command buffer (%d)\n",
+                        MAXLOOPS - maxloops - 1);
+        }
+
         /*if (get == GetLock) spin_lock(&dbri->lock); */
         return &dbri->dma->cmd[0];
 }
 
-static void dbri_process_interrupt_buffer(snd_dbri_t *);
-
 static void dbri_cmdsend(snd_dbri_t * dbri, volatile s32 * cmd)
 {
-        int MAXLOOPS = 1000000;
-        int maxloops = MAXLOOPS;
         volatile s32 *ptr;
+        u32     reg;
 
         for (ptr = &dbri->dma->cmd[0]; ptr < cmd; ptr++) {
                 dprintk(D_CMD, "cmd: %lx:%08x\n", (unsigned long)ptr, *ptr);
         }
 
         if ((cmd - &dbri->dma->cmd[0]) >= DBRI_NO_CMDS - 1) {
-                printk("DBRI: Command buffer overflow! (bug in driver)\n");
+                printk(KERN_ERR "DBRI: Command buffer overflow! (bug in driver)\n");
                 /* Ignore the last part. */
                 cmd = &dbri->dma->cmd[DBRI_NO_CMDS - 3];
         }
 
+        dbri->wait_send++;
+        dbri->wait_send &= 0xffff;      /* restrict it to a 16 bit counter. */
         *(cmd++) = DBRI_CMD(D_PAUSE, 0, 0);
-        *(cmd++) = DBRI_CMD(D_WAIT, 1, 0);
-        dbri->wait_seen = 0;
+        *(cmd++) = DBRI_CMD(D_WAIT, 1, dbri->wait_send);
+
+        /* Set command pointer and signal it is valid. */
         sbus_writel(dbri->dma_dvma, dbri->regs + REG8);
-        while ((--maxloops) > 0 && (sbus_readl(dbri->regs + REG0) & D_P))
-                barrier();
-        if (maxloops == 0) {
-                printk(KERN_ERR "DBRI: Chip never completed command buffer\n");
-                dprintk(D_CMD, "DBRI: Chip never completed command buffer\n");
-        } else {
-                while ((--maxloops) > 0 && (!dbri->wait_seen))
-                        dbri_process_interrupt_buffer(dbri);
-                if (maxloops == 0) {
-                        printk(KERN_ERR "DBRI: Chip never acked WAIT\n");
-                        dprintk(D_CMD, "DBRI: Chip never acked WAIT\n");
-                } else {
-                        dprintk(D_CMD, "Chip completed command "
-                                "buffer (%d)\n", MAXLOOPS - maxloops);
-                }
-        }
+        reg = sbus_readl(dbri->regs + REG0);
+        reg |= D_P;
+        sbus_writel(reg, dbri->regs + REG0);
 
         /*spin_unlock(&dbri->lock); */
 }
@@ -757,10 +766,11 @@ static void dbri_initialize(snd_dbri_t * dbri)
         for (n = 0; n < DBRI_NO_PIPES; n++)
                 dbri->pipes[n].desc = dbri->pipes[n].first_desc = -1;
 
-        /* We should query the openprom to see what burst sizes this
-         * SBus supports.  For now, just disable all SBus bursts */
+        /* A brute approach - DBRI falls back to working burst size by itself
+         * On SS20 D_S does not work, so do not try so high. */
         tmp = sbus_readl(dbri->regs + REG0);
-        tmp &= ~(D_G | D_S | D_E);
+        tmp |= D_G | D_E;
+        tmp &= ~D_S;
         sbus_writel(tmp, dbri->regs + REG0);
 
         /*
@@ -805,13 +815,13 @@ static void reset_pipe(snd_dbri_t * dbri, int pipe)
         volatile int *cmd;
 
         if (pipe < 0 || pipe > 31) {
-                printk("DBRI: reset_pipe called with illegal pipe number\n");
+                printk(KERN_ERR "DBRI: reset_pipe called with illegal pipe number\n");
                 return;
         }
 
         sdp = dbri->pipes[pipe].sdp;
         if (sdp == 0) {
-                printk("DBRI: reset_pipe called on uninitialized pipe\n");
+                printk(KERN_ERR "DBRI: reset_pipe called on uninitialized pipe\n");
                 return;
         }
 
@@ -834,12 +844,12 @@ static void reset_pipe(snd_dbri_t * dbri, int pipe)
 static void setup_pipe(snd_dbri_t * dbri, int pipe, int sdp)
 {
         if (pipe < 0 || pipe > 31) {
-                printk("DBRI: setup_pipe called with illegal pipe number\n");
+                printk(KERN_ERR "DBRI: setup_pipe called with illegal pipe number\n");
                 return;
         }
 
         if ((sdp & 0xf800) != sdp) {
-                printk("DBRI: setup_pipe called with strange SDP value\n");
+                printk(KERN_ERR "DBRI: setup_pipe called with strange SDP value\n");
                 /* sdp &= 0xf800; */
         }
 
@@ -872,13 +882,13 @@ static void link_time_slot(snd_dbri_t * dbri, int pipe,
         int nextpipe;
 
         if (pipe < 0 || pipe > 31 || basepipe < 0 || basepipe > 31) {
-                printk
-                    ("DBRI: link_time_slot called with illegal pipe number\n");
+                printk(KERN_ERR 
+                    "DBRI: link_time_slot called with illegal pipe number\n");
                 return;
         }
 
         if (dbri->pipes[pipe].sdp == 0 || dbri->pipes[basepipe].sdp == 0) {
-                printk("DBRI: link_time_slot called on uninitialized pipe\n");
+                printk(KERN_ERR "DBRI: link_time_slot called on uninitialized pipe\n");
                 return;
         }
 
@@ -960,8 +970,8 @@ static void unlink_time_slot(snd_dbri_t * dbri, int pipe,
         int val;
 
         if (pipe < 0 || pipe > 31 || prevpipe < 0 || prevpipe > 31) {
-                printk
-                    ("DBRI: unlink_time_slot called with illegal pipe number\n");
+                printk(KERN_ERR 
+                    "DBRI: unlink_time_slot called with illegal pipe number\n");
                 return;
         }
 
@@ -1001,22 +1011,22 @@ static void xmit_fixed(snd_dbri_t * dbri, int pipe, unsigned int data)
         volatile s32 *cmd;
 
         if (pipe < 16 || pipe > 31) {
-                printk("DBRI: xmit_fixed: Illegal pipe number\n");
+                printk(KERN_ERR "DBRI: xmit_fixed: Illegal pipe number\n");
                 return;
         }
 
         if (D_SDP_MODE(dbri->pipes[pipe].sdp) == 0) {
-                printk("DBRI: xmit_fixed: Uninitialized pipe %d\n", pipe);
+                printk(KERN_ERR "DBRI: xmit_fixed: Uninitialized pipe %d\n", pipe);
                 return;
         }
 
         if (D_SDP_MODE(dbri->pipes[pipe].sdp) != D_SDP_FIXED) {
-                printk("DBRI: xmit_fixed: Non-fixed pipe %d\n", pipe);
+                printk(KERN_ERR "DBRI: xmit_fixed: Non-fixed pipe %d\n", pipe);
                 return;
         }
 
         if (!(dbri->pipes[pipe].sdp & D_SDP_TO_SER)) {
-                printk("DBRI: xmit_fixed: Called on receive pipe %d\n", pipe);
+                printk(KERN_ERR "DBRI: xmit_fixed: Called on receive pipe %d\n", pipe);
                 return;
         }
 
@@ -1036,17 +1046,17 @@ static void xmit_fixed(snd_dbri_t * dbri, int pipe, unsigned int data)
 static void recv_fixed(snd_dbri_t * dbri, int pipe, volatile __u32 * ptr)
 {
         if (pipe < 16 || pipe > 31) {
-                printk("DBRI: recv_fixed called with illegal pipe number\n");
+                printk(KERN_ERR "DBRI: recv_fixed called with illegal pipe number\n");
                 return;
         }
 
         if (D_SDP_MODE(dbri->pipes[pipe].sdp) != D_SDP_FIXED) {
-                printk("DBRI: recv_fixed called on non-fixed pipe %d\n", pipe);
+                printk(KERN_ERR "DBRI: recv_fixed called on non-fixed pipe %d\n", pipe);
                 return;
         }
 
         if (dbri->pipes[pipe].sdp & D_SDP_TO_SER) {
-                printk("DBRI: recv_fixed called on transmit pipe %d\n", pipe);
+                printk(KERN_ERR "DBRI: recv_fixed called on transmit pipe %d\n", pipe);
                 return;
         }
 
@@ -1075,12 +1085,12 @@ static int setup_descs(snd_dbri_t * dbri, int streamno, unsigned int period)
         int last_desc = -1;
 
         if (info->pipe < 0 || info->pipe > 15) {
-                printk("DBRI: setup_descs: Illegal pipe number\n");
+                printk(KERN_ERR "DBRI: setup_descs: Illegal pipe number\n");
                 return -2;
         }
 
         if (dbri->pipes[info->pipe].sdp == 0) {
-                printk("DBRI: setup_descs: Uninitialized pipe %d\n",
+                printk(KERN_ERR "DBRI: setup_descs: Uninitialized pipe %d\n",
                        info->pipe);
                 return -2;
         }
@@ -1090,20 +1100,20 @@ static int setup_descs(snd_dbri_t * dbri, int streamno, unsigned int period)
 
         if (streamno == DBRI_PLAY) {
                 if (!(dbri->pipes[info->pipe].sdp & D_SDP_TO_SER)) {
-                        printk("DBRI: setup_descs: Called on receive pipe %d\n",
+                        printk(KERN_ERR "DBRI: setup_descs: Called on receive pipe %d\n",
                                info->pipe);
                         return -2;
                 }
         } else {
                 if (dbri->pipes[info->pipe].sdp & D_SDP_TO_SER) {
-                        printk
-                            ("DBRI: setup_descs: Called on transmit pipe %d\n",
+                        printk(KERN_ERR 
+                            "DBRI: setup_descs: Called on transmit pipe %d\n",
                              info->pipe);
                         return -2;
                 }
                 /* Should be able to queue multiple buffers to receive on a pipe */
                 if (pipe_active(dbri, info->pipe)) {
-                        printk("DBRI: recv_on_pipe: Called on active pipe %d\n",
+                        printk(KERN_ERR "DBRI: recv_on_pipe: Called on active pipe %d\n",
                                info->pipe);
                         return -2;
                 }
@@ -1120,7 +1130,7 @@ static int setup_descs(snd_dbri_t * dbri, int streamno, unsigned int period)
                                 break;
                 }
                 if (desc == DBRI_NO_DESCS) {
-                        printk("DBRI: setup_descs: No descriptors\n");
+                        printk(KERN_ERR "DBRI: setup_descs: No descriptors\n");
                         return -1;
                 }
 
@@ -1165,7 +1175,7 @@ static int setup_descs(snd_dbri_t * dbri, int streamno, unsigned int period)
         }
 
         if (first_desc == -1 || last_desc == -1) {
-                printk("DBRI: setup_descs: Not enough descriptors available\n");
+                printk(KERN_ERR "DBRI: setup_descs: Not enough descriptors available\n");
                 return -1;
         }
 
@@ -1270,7 +1280,7 @@ static void reset_chi(snd_dbri_t * dbri, enum master_or_slave master_or_slave,
                 int divisor = 12288 / clockrate;
 
                 if (divisor > 255 || divisor * clockrate != 12288)
-                        printk("DBRI: illegal bits_per_frame in setup_chi\n");
+                        printk(KERN_ERR "DBRI: illegal bits_per_frame in setup_chi\n");
 
                 *(cmd++) = DBRI_CMD(D_CHI, 0, D_CHI_CHICM(divisor) | D_CHI_FD
                                     | D_CHI_BPF(bits_per_frame));
@@ -1474,7 +1484,6 @@ static int cs4215_setctrl(snd_dbri_t * dbri)
         /* Temporarily mute outputs, and wait 1/8000 sec (125 us)
          * to make sure this takes.  This avoids clicking noises.
          */
-
         cs4215_setdata(dbri, 1);
         udelay(125);
 
@@ -1530,8 +1539,8 @@ static int cs4215_setctrl(snd_dbri_t * dbri)
         tmp |= D_C;             /* Enable CHI */
         sbus_writel(tmp, dbri->regs + REG0);
 
-        for (i = 64; ((dbri->mm.status & 0xe4) != 0x20); --i) {
-                udelay(125);
+        for (i = 10; ((dbri->mm.status & 0xe4) != 0x20); --i) {
+                msleep_interruptible(1);
         }
         if (i == 0) {
                 dprintk(D_MM, "CS4215 didn't respond to CLB (0x%02x)\n",
@@ -1678,8 +1687,8 @@ buffer and calls dbri_process_one_interrupt() for each interrupt word.
 Complicated interrupts are handled by dedicated functions (which
 appear first in this file).  Any pending interrupts can be serviced by
 calling dbri_process_interrupt_buffer(), which works even if the CPU's
-interrupts are disabled.  This function is used by dbri_cmdsend()
-to make sure we're synced up with the chip after each command sequence,
+interrupts are disabled.  This function is used by dbri_cmdlock()
+to make sure we're synced up with the chip before each command sequence,
 even if we're running cli'ed.
 
 */
@@ -1765,11 +1774,13 @@ DECLARE_TASKLET(xmit_descs_task, xmit_descs, 0);
  * Called by main interrupt handler when DBRI signals transmission complete
  * on a pipe (interrupt triggered by the B bit in a transmit descriptor).
  *
- * Walks through the pipe's list of transmit buffer descriptors, releasing
- * each one's DMA buffer (if present), flagging the descriptor available,
- * and signaling its callback routine (if present), before proceeding
- * to the next one.  Stops when the first descriptor is found without
+ * Walks through the pipe's list of transmit buffer descriptors and marks
+ * them as available. Stops when the first descriptor is found without
  * TBC (Transmit Buffer Complete) set, or we've run through them all.
+ *
+ * The DMA buffers are not released, but re-used. Since the transmit buffer
+ * descriptors are not clobbered, they can be re-submitted as is. This is
+ * done by the xmit_descs() tasklet above since that could take longer.
  */
 
 static void transmission_complete_intr(snd_dbri_t * dbri, int pipe)
@@ -1885,7 +1896,11 @@ static void dbri_process_one_interrupt(snd_dbri_t * dbri, int x)
         }
 
         if (channel == D_INTR_CMD && command == D_WAIT) {
-                dbri->wait_seen++;
+                dbri->wait_ackd = val;
+                if (dbri->wait_send != val) {
+                        printk(KERN_ERR "Processing wait command %d when %d was send.\n",
+                               val, dbri->wait_send);
+                }
                 return;
         }
 
@@ -1994,8 +2009,7 @@ static irqreturn_t snd_dbri_interrupt(int irq, void *dev_id,
                  * The only one I've seen is MRR, which will be triggered
                  * if you let a transmit pipe underrun, then try to CDP it.
                  *
-                 * If these things persist, we should probably reset
-                 * and re-init the chip.
+                 * If these things persist, we reset the chip.
                  */
                 if ((++errcnt) % 10 == 0) {
                         dprintk(D_INT, "Interrupt errors exceeded.\n");
@@ -2094,7 +2108,7 @@ static int snd_dbri_hw_params(snd_pcm_substream_t * substream,
 
         if ((ret = snd_pcm_lib_malloc_pages(substream,
                                 params_buffer_bytes(hw_params))) < 0) {
-                snd_printk(KERN_ERR "malloc_pages failed with %d\n", ret);
+                printk(KERN_ERR "malloc_pages failed with %d\n", ret);
                 return ret;
         }
 
@@ -2455,8 +2469,7 @@ static int __init snd_dbri_mixer(snd_dbri_t * dbri)
 
         for (idx = 0; idx < NUM_CS4215_CONTROLS; idx++) {
                 if ((err = snd_ctl_add(card,
-                                       snd_ctl_new1(&dbri_controls[idx],
-                                                    dbri))) < 0)
+                                snd_ctl_new1(&dbri_controls[idx], dbri))) < 0)
                         return err;
         }
 
@@ -2490,8 +2503,6 @@ static void dbri_debug_read(snd_info_entry_t * entry,
         int pipe;
         snd_iprintf(buffer, "debug=%d\n", dbri_debug);
 
-        snd_iprintf(buffer, "CHI pipe in=%d, out=%d\n",
-                    dbri->chi_in_pipe, dbri->chi_out_pipe);
         for (pipe = 0; pipe < 32; pipe++) {
                 if (pipe_active(dbri, pipe)) {
                         struct dbri_pipe *pptr = &dbri->pipes[pipe];
@@ -2506,18 +2517,6 @@ static void dbri_debug_read(snd_info_entry_t * entry,
                 }
         }
 }
-
-static void dbri_debug_write(snd_info_entry_t * entry,
-                             snd_info_buffer_t * buffer)
-{
-        char line[80];
-        int i;
-
-        if (snd_info_get_line(buffer, line, 80) == 0) {
-                sscanf(line, "%d\n", &i);
-                dbri_debug = i & 0x3f;
-        }
-}
 #endif
 
 void snd_dbri_proc(snd_dbri_t * dbri)
@@ -2531,9 +2530,7 @@ void snd_dbri_proc(snd_dbri_t * dbri)
 #ifdef DBRI_DEBUG
         err = snd_card_proc_new(dbri->card, "debug", &entry);
         snd_info_set_text_ops(entry, dbri, 4096, dbri_debug_read);
-        entry->mode = S_IFREG | S_IRUGO | S_IWUSR; /* Writable for root */
-        entry->c.text.write_size = 256;
-        entry->c.text.write = dbri_debug_write;
+        entry->mode = S_IFREG | S_IRUGO;        /* Readable only. */
 #endif
 }
 
@@ -2637,7 +2634,11 @@ static int __init dbri_attach(int prom_node, struct sbus_dev *sdev)
                 return -ENOENT;
         }
 
-        prom_getproperty(prom_node, "intr", (char *)&irq, sizeof(irq));
+        err = prom_getproperty(prom_node, "intr", (char *)&irq, sizeof(irq));
+        if (err < 0) {
+                printk(KERN_ERR "DBRI-%d: Firmware node lacks IRQ property.\n", dev);
+                return -ENODEV;
+        }
 
         card = snd_card_new(index[dev], id[dev], THIS_MODULE,
                             sizeof(snd_dbri_t));
@@ -2657,26 +2658,20 @@ static int __init dbri_attach(int prom_node, struct sbus_dev *sdev)
         }
 
         dbri = (snd_dbri_t *) card->private_data;
-        if ((err = snd_dbri_pcm(dbri)) < 0) {
-                snd_dbri_free(dbri);
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_dbri_pcm(dbri)) < 0)
+                goto _err;
 
-        if ((err = snd_dbri_mixer(dbri)) < 0) {
-                snd_dbri_free(dbri);
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_dbri_mixer(dbri)) < 0)
+                goto _err;
 
         /* /proc file handling */
         snd_dbri_proc(dbri);
 
-        if ((err = snd_card_register(card)) < 0) {
-                snd_dbri_free(dbri);
-                snd_card_free(card);
-                return err;
-        }
+        if ((err = snd_card_set_generic_dev(card)) < 0)
+                goto _err;
+
+        if ((err = snd_card_register(card)) < 0)
+                goto _err;
 
         printk(KERN_INFO "audio%d at %p (irq %d) is DBRI(%c)+CS4215(%d)\n",
                dev, dbri->regs,
@@ -2684,6 +2679,11 @@ static int __init dbri_attach(int prom_node, struct sbus_dev *sdev)
         dev++;
 
         return 0;
+
+ _err:
+        snd_dbri_free(dbri);
+        snd_card_free(card);
+        return err;
 }
 
 /* Probe for the dbri chip and then attach the driver. */
diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c
index 60d0b2c66698..9e2b4c0c8a8a 100644
--- a/sound/synth/emux/emux.c
+++ b/sound/synth/emux/emux.c
@@ -40,7 +40,7 @@ int snd_emux_new(snd_emux_t **remu)
         snd_emux_t *emu;
 
         *remu = NULL;
-        emu = kcalloc(1, sizeof(*emu), GFP_KERNEL);
+        emu = kzalloc(sizeof(*emu), GFP_KERNEL);
         if (emu == NULL)
                 return -ENOMEM;
 
diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
index e41b28d9bf52..8ccd33f4aa57 100644
--- a/sound/synth/emux/emux_seq.c
+++ b/sound/synth/emux/emux_seq.c
@@ -146,7 +146,7 @@ snd_emux_create_port(snd_emux_t *emu, char *name,
         int i, type, cap;
 
         /* Allocate structures for this channel */
-        if ((p = kcalloc(1, sizeof(*p), GFP_KERNEL)) == NULL) {
+        if ((p = kzalloc(sizeof(*p), GFP_KERNEL)) == NULL) {
                 snd_printk("no memory\n");
                 return NULL;
         }
diff --git a/sound/synth/emux/soundfont.c b/sound/synth/emux/soundfont.c
index 901a7db05bde..d0925ea50838 100644
--- a/sound/synth/emux/soundfont.c
+++ b/sound/synth/emux/soundfont.c
@@ -266,7 +266,7 @@ newsf(snd_sf_list_t *sflist, int type, char *name)
         }
 
         /* not found -- create a new one */
-        sf = kcalloc(1, sizeof(*sf), GFP_KERNEL);
+        sf = kzalloc(sizeof(*sf), GFP_KERNEL);
         if (sf == NULL)
                 return NULL;
         sf->id = sflist->fonts_size;
@@ -346,7 +346,7 @@ sf_zone_new(snd_sf_list_t *sflist, snd_soundfont_t *sf)
 {
         snd_sf_zone_t *zp;
 
-        if ((zp = kcalloc(1, sizeof(*zp), GFP_KERNEL)) == NULL)
+        if ((zp = kzalloc(sizeof(*zp), GFP_KERNEL)) == NULL)
                 return NULL;
         zp->next = sf->zones;
         sf->zones = zp;
@@ -377,7 +377,7 @@ sf_sample_new(snd_sf_list_t *sflist, snd_soundfont_t *sf)
 {
         snd_sf_sample_t *sp;
 
-        if ((sp = kcalloc(1, sizeof(*sp), GFP_KERNEL)) == NULL)
+        if ((sp = kzalloc(sizeof(*sp), GFP_KERNEL)) == NULL)
                 return NULL;
 
         sp->next = sf->samples;
@@ -1362,7 +1362,7 @@ snd_sf_new(snd_sf_callback_t *callback, snd_util_memhdr_t *hdr)
 {
         snd_sf_list_t *sflist;
 
-        if ((sflist = kcalloc(1, sizeof(*sflist), GFP_KERNEL)) == NULL)
+        if ((sflist = kzalloc(sizeof(*sflist), GFP_KERNEL)) == NULL)
                 return NULL;
 
         init_MUTEX(&sflist->presets_mutex);
diff --git a/sound/synth/util_mem.c b/sound/synth/util_mem.c
index 8b131a11e549..5f75bf31bc36 100644
--- a/sound/synth/util_mem.c
+++ b/sound/synth/util_mem.c
@@ -38,7 +38,7 @@ snd_util_memhdr_new(int memsize)
 {
         snd_util_memhdr_t *hdr;
 
-        hdr = kcalloc(1, sizeof(*hdr), GFP_KERNEL);
+        hdr = kzalloc(sizeof(*hdr), GFP_KERNEL);
         if (hdr == NULL)
                 return NULL;
         hdr->size = memsize;
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index bfbec5876659..d5ae2055b896 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -1439,9 +1439,11 @@ static int snd_usb_pcm_prepare(snd_pcm_substream_t *substream)
 
 static snd_pcm_hardware_t snd_usb_playback =
 {
-        .info =                 (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
-                                 SNDRV_PCM_INFO_BLOCK_TRANSFER |
-                                 SNDRV_PCM_INFO_MMAP_VALID),
+        .info =                 SNDRV_PCM_INFO_MMAP |
+                                SNDRV_PCM_INFO_MMAP_VALID |
+                                SNDRV_PCM_INFO_BATCH |
+                                SNDRV_PCM_INFO_INTERLEAVED |
+                                SNDRV_PCM_INFO_BLOCK_TRANSFER,
         .buffer_bytes_max =     (256*1024),
         .period_bytes_min =     64,
         .period_bytes_max =     (128*1024),
@@ -1451,9 +1453,11 @@ static snd_pcm_hardware_t snd_usb_playback =
 
 static snd_pcm_hardware_t snd_usb_capture =
 {
-        .info =                 (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
-                                 SNDRV_PCM_INFO_BLOCK_TRANSFER |
-                                 SNDRV_PCM_INFO_MMAP_VALID),
+        .info =                 SNDRV_PCM_INFO_MMAP |
+                                SNDRV_PCM_INFO_MMAP_VALID |
+                                SNDRV_PCM_INFO_BATCH |
+                                SNDRV_PCM_INFO_INTERLEAVED |
+                                SNDRV_PCM_INFO_BLOCK_TRANSFER,
         .buffer_bytes_max =     (256*1024),
         .period_bytes_min =     64,
         .period_bytes_max =     (128*1024),
@@ -3132,7 +3136,7 @@ static int snd_usb_audio_create(struct usb_device *dev, int idx,
                 return -ENOMEM;
         }
 
-        chip = kcalloc(1, sizeof(*chip), GFP_KERNEL);
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (! chip) {
                 snd_card_free(card);
                 return -ENOMEM;
diff --git a/sound/usb/usbmidi.c b/sound/usb/usbmidi.c
index 93dedde3c428..e0d0365453b3 100644
--- a/sound/usb/usbmidi.c
+++ b/sound/usb/usbmidi.c
@@ -841,7 +841,7 @@ static int snd_usbmidi_in_endpoint_create(snd_usb_midi_t* umidi,
         int length;
 
         rep->in = NULL;
-        ep = kcalloc(1, sizeof(*ep), GFP_KERNEL);
+        ep = kzalloc(sizeof(*ep), GFP_KERNEL);
         if (!ep)
                 return -ENOMEM;
         ep->umidi = umidi;
@@ -913,7 +913,7 @@ static int snd_usbmidi_out_endpoint_create(snd_usb_midi_t* umidi,
         void* buffer;
 
         rep->out = NULL;
-        ep = kcalloc(1, sizeof(*ep), GFP_KERNEL);
+        ep = kzalloc(sizeof(*ep), GFP_KERNEL);
         if (!ep)
                 return -ENOMEM;
         ep->umidi = umidi;
@@ -1537,7 +1537,7 @@ int snd_usb_create_midi_interface(snd_usb_audio_t* chip,
         int out_ports, in_ports;
         int i, err;
 
-        umidi = kcalloc(1, sizeof(*umidi), GFP_KERNEL);
+        umidi = kzalloc(sizeof(*umidi), GFP_KERNEL);
         if (!umidi)
                 return -ENOMEM;
         umidi->chip = chip;
diff --git a/sound/usb/usbmixer.c b/sound/usb/usbmixer.c
index fa7056f5caaf..c3c08c9cb46e 100644
--- a/sound/usb/usbmixer.c
+++ b/sound/usb/usbmixer.c
@@ -824,7 +824,7 @@ static void build_feature_ctl(mixer_build_t *state, unsigned char *desc,
         if (check_ignored_ctl(state, unitid, control))
                 return;
 
-        cval = kcalloc(1, sizeof(*cval), GFP_KERNEL);
+        cval = kzalloc(sizeof(*cval), GFP_KERNEL);
         if (! cval) {
                 snd_printk(KERN_ERR "cannot malloc kcontrol\n");
                 return;
@@ -997,7 +997,7 @@ static void build_mixer_unit_ctl(mixer_build_t *state, unsigned char *desc,
         if (check_ignored_ctl(state, unitid, 0))
                 return;
 
-        cval = kcalloc(1, sizeof(*cval), GFP_KERNEL);
+        cval = kzalloc(sizeof(*cval), GFP_KERNEL);
         if (! cval)
                 return;
 
@@ -1244,7 +1244,7 @@ static int build_audio_procunit(mixer_build_t *state, int unitid, unsigned char
                         continue;
                 if (check_ignored_ctl(state, unitid, valinfo->control))
                         continue;
-                cval = kcalloc(1, sizeof(*cval), GFP_KERNEL);
+                cval = kzalloc(sizeof(*cval), GFP_KERNEL);
                 if (! cval) {
                         snd_printk(KERN_ERR "cannot malloc kcontrol\n");
                         return -ENOMEM;
@@ -1430,7 +1430,7 @@ static int parse_audio_selector_unit(mixer_build_t *state, int unitid, unsigned
         if (check_ignored_ctl(state, unitid, 0))
                 return 0;
 
-        cval = kcalloc(1, sizeof(*cval), GFP_KERNEL);
+        cval = kzalloc(sizeof(*cval), GFP_KERNEL);
         if (! cval) {
                 snd_printk(KERN_ERR "cannot malloc kcontrol\n");
                 return -ENOMEM;
@@ -1945,7 +1945,7 @@ int snd_usb_create_mixer(snd_usb_audio_t *chip, int ctrlif)
 
         strcpy(chip->card->mixername, "USB Mixer");
 
-        mixer = kcalloc(1, sizeof(*mixer), GFP_KERNEL);
+        mixer = kzalloc(sizeof(*mixer), GFP_KERNEL);
         if (!mixer)
                 return -ENOMEM;
         mixer->chip = chip;
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 62dfd28b3b07..0f09e0de52dd 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -957,7 +957,7 @@ static int usX2Y_audio_stream_new(snd_card_t *card, int playback_endpoint, int c
 
         for (i = playback_endpoint ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE;
              i <= SNDRV_PCM_STREAM_CAPTURE; ++i) {
-                usX2Y_substream[i] = kcalloc(1, sizeof(snd_usX2Y_substream_t), GFP_KERNEL);
+                usX2Y_substream[i] = kzalloc(sizeof(snd_usX2Y_substream_t), GFP_KERNEL);
                 if (NULL == usX2Y_substream[i]) {
                         snd_printk(KERN_ERR "cannot malloc\n");
                         return -ENOMEM;