Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

170 files changed, 4440 insertions, 3843 deletions

diff --git a/drivers/Kconfig b/drivers/Kconfig
index 5c91d6afb117..aeb5ab2391e4 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -68,8 +68,6 @@ source "drivers/leds/Kconfig"
 
 source "drivers/infiniband/Kconfig"
 
-source "drivers/sn/Kconfig"
-
 source "drivers/edac/Kconfig"
 
 source "drivers/rtc/Kconfig"
diff --git a/drivers/base/topology.c b/drivers/base/topology.c
index 915810f6237e..8c52421cbc54 100644
--- a/drivers/base/topology.c
+++ b/drivers/base/topology.c
@@ -107,7 +107,7 @@ static int __cpuinit topology_remove_dev(struct sys_device * sys_dev)
         return 0;
 }
 
-static int __cpuinit topology_cpu_callback(struct notifier_block *nfb,
+static int topology_cpu_callback(struct notifier_block *nfb,
                 unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 1b0fd31c57c3..1319d8f20640 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1180,6 +1180,53 @@ static int revalidate_allvol(ctlr_info_t *host)
         return 0;
 }
 
+static inline void complete_buffers(struct bio *bio, int status)
+{
+        while (bio) {
+                struct bio *xbh = bio->bi_next;
+                int nr_sectors = bio_sectors(bio);
+
+                bio->bi_next = NULL;
+                blk_finished_io(len);
+                bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
+                bio = xbh;
+        }
+
+}
+
+static void cciss_softirq_done(struct request *rq)
+{
+        CommandList_struct *cmd = rq->completion_data;
+        ctlr_info_t *h = hba[cmd->ctlr];
+        unsigned long flags;
+        u64bit temp64;
+        int i, ddir;
+
+        if (cmd->Request.Type.Direction == XFER_READ)
+                ddir = PCI_DMA_FROMDEVICE;
+        else
+                ddir = PCI_DMA_TODEVICE;
+
+        /* command did not need to be retried */
+        /* unmap the DMA mapping for all the scatter gather elements */
+        for(i=0; i<cmd->Header.SGList; i++) {
+                temp64.val32.lower = cmd->SG[i].Addr.lower;
+                temp64.val32.upper = cmd->SG[i].Addr.upper;
+                pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
+        }
+
+        complete_buffers(rq->bio, rq->errors);
+
+#ifdef CCISS_DEBUG
+        printk("Done with %p\n", rq);
+#endif /* CCISS_DEBUG */
+
+        spin_lock_irqsave(&h->lock, flags);
+        end_that_request_last(rq, rq->errors);
+        cmd_free(h, cmd,1);
+        spin_unlock_irqrestore(&h->lock, flags);
+}
+
 /* This function will check the usage_count of the drive to be updated/added.
  * If the usage_count is zero then the drive information will be updated and
  * the disk will be re-registered with the kernel.  If not then it will be
@@ -1248,6 +1295,8 @@ static void cciss_update_drive_info(int ctlr, int drv_index)
 
                 blk_queue_max_sectors(disk->queue, 512);
 
+                blk_queue_softirq_done(disk->queue, cciss_softirq_done);
+
                 disk->queue->queuedata = hba[ctlr];
 
                 blk_queue_hardsect_size(disk->queue,
@@ -2147,20 +2196,6 @@ static void start_io( ctlr_info_t *h)
                 addQ (&(h->cmpQ), c); 
         }
 }
-
-static inline void complete_buffers(struct bio *bio, int status)
-{
-        while (bio) {
-                struct bio *xbh = bio->bi_next; 
-                int nr_sectors = bio_sectors(bio);
-
-                bio->bi_next = NULL; 
-                blk_finished_io(len);
-                bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
-                bio = xbh;
-        }
-
-} 
 /* Assumes that CCISS_LOCK(h->ctlr) is held. */
 /* Zeros out the error record and then resends the command back */
 /* to the controller */
@@ -2178,39 +2213,6 @@ static inline void resend_cciss_cmd( ctlr_info_t *h, CommandList_struct *c)
         start_io(h);
 }
 
-static void cciss_softirq_done(struct request *rq)
-{
-        CommandList_struct *cmd = rq->completion_data;
-        ctlr_info_t *h = hba[cmd->ctlr];
-        unsigned long flags;
-        u64bit temp64;
-        int i, ddir;
-
-        if (cmd->Request.Type.Direction == XFER_READ)
-                ddir = PCI_DMA_FROMDEVICE;
-        else
-                ddir = PCI_DMA_TODEVICE;
-
-        /* command did not need to be retried */
-        /* unmap the DMA mapping for all the scatter gather elements */
-        for(i=0; i<cmd->Header.SGList; i++) {
-                temp64.val32.lower = cmd->SG[i].Addr.lower;
-                temp64.val32.upper = cmd->SG[i].Addr.upper;
-                pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
-        }
-
-        complete_buffers(rq->bio, rq->errors);
-
-#ifdef CCISS_DEBUG
-        printk("Done with %p\n", rq);
-#endif /* CCISS_DEBUG */ 
-
-        spin_lock_irqsave(&h->lock, flags);
-        end_that_request_last(rq, rq->errors);
-        cmd_free(h, cmd,1);
-        spin_unlock_irqrestore(&h->lock, flags);
-}
-
 /* checks the status of the job and calls complete buffers to mark all 
  * buffers for the completed job. Note that this function does not need
  * to hold the hba/queue lock.
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index bedb689b051f..dff1e67b1dd4 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4301,7 +4301,7 @@ static int __init floppy_init(void)
         }
 
         use_virtual_dma = can_use_virtual_dma & 1;
-#if defined(CONFIG_PPC64)
+#if defined(CONFIG_PPC_MERGE)
         if (check_legacy_ioport(FDC1)) {
                 del_timer(&fd_timeout);
                 err = -ENODEV;
diff --git a/drivers/char/cs5535_gpio.c b/drivers/char/cs5535_gpio.c
index 5d72f50de1ac..46d66037b917 100644
--- a/drivers/char/cs5535_gpio.c
+++ b/drivers/char/cs5535_gpio.c
@@ -241,9 +241,10 @@ static int __init cs5535_gpio_init(void)
 static void __exit cs5535_gpio_cleanup(void)
 {
         dev_t dev_id = MKDEV(major, 0);
+
+        cdev_del(&cs5535_gpio_cdev);
         unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT);
-        if (gpio_base != 0)
-                release_region(gpio_base, CS5535_GPIO_SIZE);
+        release_region(gpio_base, CS5535_GPIO_SIZE);
 }
 
 module_init(cs5535_gpio_init);
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index edc72a6348a7..cb76e5ca9a23 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -815,8 +815,6 @@ extern int drm_mem_info(char *buf, char **start, off_t offset,
 extern void *drm_realloc(void *oldpt, size_t oldsize, size_t size, int area);
 extern void *drm_ioremap(unsigned long offset, unsigned long size,
                          drm_device_t * dev);
-extern void *drm_ioremap_nocache(unsigned long offset, unsigned long size,
-                                 drm_device_t * dev);
 extern void drm_ioremapfree(void *pt, unsigned long size, drm_device_t * dev);
 
 extern DRM_AGP_MEM *drm_alloc_agp(drm_device_t * dev, int pages, u32 type);
@@ -891,7 +889,6 @@ extern int drm_lock_free(drm_device_t * dev,
                                 /* Buffer management support (drm_bufs.h) */
 extern int drm_addbufs_agp(drm_device_t * dev, drm_buf_desc_t * request);
 extern int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request);
-extern int drm_addbufs_fb(drm_device_t *dev, drm_buf_desc_t *request);
 extern int drm_addmap(drm_device_t * dev, unsigned int offset,
                       unsigned int size, drm_map_type_t type,
                       drm_map_flags_t flags, drm_local_map_t ** map_ptr);
@@ -1022,11 +1019,13 @@ static __inline__ void drm_core_ioremap(struct drm_map *map,
         map->handle = drm_ioremap(map->offset, map->size, dev);
 }
 
+#if 0
 static __inline__ void drm_core_ioremap_nocache(struct drm_map *map,
                                                 struct drm_device *dev)
 {
         map->handle = drm_ioremap_nocache(map->offset, map->size, dev);
 }
+#endif  /*  0  */
 
 static __inline__ void drm_core_ioremapfree(struct drm_map *map,
                                             struct drm_device *dev)
diff --git a/drivers/char/drm/drm_agpsupport.c b/drivers/char/drm/drm_agpsupport.c
index fabc930c67a2..40bfd9b01e39 100644
--- a/drivers/char/drm/drm_agpsupport.c
+++ b/drivers/char/drm/drm_agpsupport.c
@@ -503,8 +503,6 @@ int drm_agp_bind_memory(DRM_AGP_MEM * handle, off_t start)
         return agp_bind_memory(handle, start);
 }
 
-EXPORT_SYMBOL(drm_agp_bind_memory);
-
 /** Calls agp_unbind_memory() */
 int drm_agp_unbind_memory(DRM_AGP_MEM * handle)
 {
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 8a9cf12e6183..006b06d29727 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -386,7 +386,6 @@ int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
 
         return 0;
 }
-EXPORT_SYMBOL(drm_rmmap_locked);
 
 int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 {
@@ -398,7 +397,6 @@ int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 
         return ret;
 }
-EXPORT_SYMBOL(drm_rmmap);
 
 /* The rmmap ioctl appears to be unnecessary.  All mappings are torn down on
  * the last close of the device, and this is necessary for cleanup when things
@@ -1053,7 +1051,7 @@ static int drm_addbufs_sg(drm_device_t * dev, drm_buf_desc_t * request)
         return 0;
 }
 
-int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
+static int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
 {
         drm_device_dma_t *dma = dev->dma;
         drm_buf_entry_t *entry;
@@ -1212,7 +1210,6 @@ int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
         atomic_dec(&dev->buf_alloc);
         return 0;
 }
-EXPORT_SYMBOL(drm_addbufs_fb);
 
 
 /**
diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index dc6bbe8a18dc..3c0b882a8e72 100644
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -75,8 +75,8 @@ static drm_ioctl_desc_t drm_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_SET_SAREA_CTX)] = {drm_setsareactx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
         [DRM_IOCTL_NR(DRM_IOCTL_GET_SAREA_CTX)] = {drm_getsareactx, DRM_AUTH},
 
-        [DRM_IOCTL_NR(DRM_IOCTL_ADD_CTX)] = {drm_addctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
-        [DRM_IOCTL_NR(DRM_IOCTL_RM_CTX)] = {drm_rmctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
+        [DRM_IOCTL_NR(DRM_IOCTL_ADD_CTX)] = {drm_addctx, DRM_AUTH|DRM_ROOT_ONLY},
+        [DRM_IOCTL_NR(DRM_IOCTL_RM_CTX)] = {drm_rmctx, DRM_AUTH|DRM_ROOT_ONLY},
         [DRM_IOCTL_NR(DRM_IOCTL_MOD_CTX)] = {drm_modctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
         [DRM_IOCTL_NR(DRM_IOCTL_GET_CTX)] = {drm_getctx, DRM_AUTH},
         [DRM_IOCTL_NR(DRM_IOCTL_SWITCH_CTX)] = {drm_switchctx, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
diff --git a/drivers/char/drm/drm_memory.c b/drivers/char/drm/drm_memory.c
index dddf8de66143..7e3318e1d1c6 100644
--- a/drivers/char/drm/drm_memory.c
+++ b/drivers/char/drm/drm_memory.c
@@ -80,6 +80,71 @@ void *drm_realloc(void *oldpt, size_t oldsize, size_t size, int area)
 }
 
 #if __OS_HAS_AGP
+/*
+ * Find the drm_map that covers the range [offset, offset+size).
+ */
+static drm_map_t *drm_lookup_map(unsigned long offset,
+                                 unsigned long size, drm_device_t * dev)
+{
+        struct list_head *list;
+        drm_map_list_t *r_list;
+        drm_map_t *map;
+
+        list_for_each(list, &dev->maplist->head) {
+                r_list = (drm_map_list_t *) list;
+                map = r_list->map;
+                if (!map)
+                        continue;
+                if (map->offset <= offset
+                    && (offset + size) <= (map->offset + map->size))
+                        return map;
+        }
+        return NULL;
+}
+
+static void *agp_remap(unsigned long offset, unsigned long size,
+                       drm_device_t * dev)
+{
+        unsigned long *phys_addr_map, i, num_pages =
+            PAGE_ALIGN(size) / PAGE_SIZE;
+        struct drm_agp_mem *agpmem;
+        struct page **page_map;
+        void *addr;
+
+        size = PAGE_ALIGN(size);
+
+#ifdef __alpha__
+        offset -= dev->hose->mem_space->start;
+#endif
+
+        for (agpmem = dev->agp->memory; agpmem; agpmem = agpmem->next)
+                if (agpmem->bound <= offset
+                    && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
+                    (offset + size))
+                        break;
+        if (!agpmem)
+                return NULL;
+
+        /*
+         * OK, we're mapping AGP space on a chipset/platform on which memory accesses by
+         * the CPU do not get remapped by the GART.  We fix this by using the kernel's
+         * page-table instead (that's probably faster anyhow...).
+         */
+        /* note: use vmalloc() because num_pages could be large... */
+        page_map = vmalloc(num_pages * sizeof(struct page *));
+        if (!page_map)
+                return NULL;
+
+        phys_addr_map =
+            agpmem->memory->memory + (offset - agpmem->bound) / PAGE_SIZE;
+        for (i = 0; i < num_pages; ++i)
+                page_map[i] = pfn_to_page(phys_addr_map[i] >> PAGE_SHIFT);
+        addr = vmap(page_map, num_pages, VM_IOREMAP, PAGE_AGP);
+        vfree(page_map);
+
+        return addr;
+}
+
 /** Wrapper around agp_allocate_memory() */
 DRM_AGP_MEM *drm_alloc_agp(drm_device_t * dev, int pages, u32 type)
 {
@@ -103,5 +168,74 @@ int drm_unbind_agp(DRM_AGP_MEM * handle)
 {
         return drm_agp_unbind_memory(handle);
 }
+
+#else  /*  __OS_HAS_AGP  */
+
+static inline drm_map_t *drm_lookup_map(unsigned long offset,
+                                        unsigned long size, drm_device_t * dev)
+{
+        return NULL;
+}
+
+static inline void *agp_remap(unsigned long offset, unsigned long size,
+                              drm_device_t * dev)
+{
+        return NULL;
+}
+
 #endif                          /* agp */
+
+void *drm_ioremap(unsigned long offset, unsigned long size,
+                                drm_device_t * dev)
+{
+        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
+                drm_map_t *map = drm_lookup_map(offset, size, dev);
+
+                if (map && map->type == _DRM_AGP)
+                        return agp_remap(offset, size, dev);
+        }
+        return ioremap(offset, size);
+}
+EXPORT_SYMBOL(drm_ioremap);
+
+#if 0
+void *drm_ioremap_nocache(unsigned long offset,
+                                        unsigned long size, drm_device_t * dev)
+{
+        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
+                drm_map_t *map = drm_lookup_map(offset, size, dev);
+
+                if (map && map->type == _DRM_AGP)
+                        return agp_remap(offset, size, dev);
+        }
+        return ioremap_nocache(offset, size);
+}
+#endif  /*  0  */
+
+void drm_ioremapfree(void *pt, unsigned long size,
+                                   drm_device_t * dev)
+{
+        /*
+         * This is a bit ugly.  It would be much cleaner if the DRM API would use separate
+         * routines for handling mappings in the AGP space.  Hopefully this can be done in
+         * a future revision of the interface...
+         */
+        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture
+            && ((unsigned long)pt >= VMALLOC_START
+                && (unsigned long)pt < VMALLOC_END)) {
+                unsigned long offset;
+                drm_map_t *map;
+
+                offset = drm_follow_page(pt) | ((unsigned long)pt & ~PAGE_MASK);
+                map = drm_lookup_map(offset, size, dev);
+                if (map && map->type == _DRM_AGP) {
+                        vunmap(pt);
+                        return;
+                }
+        }
+
+        iounmap(pt);
+}
+EXPORT_SYMBOL(drm_ioremapfree);
+
 #endif                          /* debug_memory */
diff --git a/drivers/char/drm/drm_memory.h b/drivers/char/drm/drm_memory.h
index 3732a61c3762..714d9aedcff5 100644
--- a/drivers/char/drm/drm_memory.h
+++ b/drivers/char/drm/drm_memory.h
@@ -57,71 +57,6 @@
 # endif
 #endif
 
-/*
- * Find the drm_map that covers the range [offset, offset+size).
- */
-static inline drm_map_t *drm_lookup_map(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
-{
-        struct list_head *list;
-        drm_map_list_t *r_list;
-        drm_map_t *map;
-
-        list_for_each(list, &dev->maplist->head) {
-                r_list = (drm_map_list_t *) list;
-                map = r_list->map;
-                if (!map)
-                        continue;
-                if (map->offset <= offset
-                    && (offset + size) <= (map->offset + map->size))
-                        return map;
-        }
-        return NULL;
-}
-
-static inline void *agp_remap(unsigned long offset, unsigned long size,
-                              drm_device_t * dev)
-{
-        unsigned long *phys_addr_map, i, num_pages =
-            PAGE_ALIGN(size) / PAGE_SIZE;
-        struct drm_agp_mem *agpmem;
-        struct page **page_map;
-        void *addr;
-
-        size = PAGE_ALIGN(size);
-
-#ifdef __alpha__
-        offset -= dev->hose->mem_space->start;
-#endif
-
-        for (agpmem = dev->agp->memory; agpmem; agpmem = agpmem->next)
-                if (agpmem->bound <= offset
-                    && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
-                    (offset + size))
-                        break;
-        if (!agpmem)
-                return NULL;
-
-        /*
-         * OK, we're mapping AGP space on a chipset/platform on which memory accesses by
-         * the CPU do not get remapped by the GART.  We fix this by using the kernel's
-         * page-table instead (that's probably faster anyhow...).
-         */
-        /* note: use vmalloc() because num_pages could be large... */
-        page_map = vmalloc(num_pages * sizeof(struct page *));
-        if (!page_map)
-                return NULL;
-
-        phys_addr_map =
-            agpmem->memory->memory + (offset - agpmem->bound) / PAGE_SIZE;
-        for (i = 0; i < num_pages; ++i)
-                page_map[i] = pfn_to_page(phys_addr_map[i] >> PAGE_SHIFT);
-        addr = vmap(page_map, num_pages, VM_IOREMAP, PAGE_AGP);
-        vfree(page_map);
-
-        return addr;
-}
-
 static inline unsigned long drm_follow_page(void *vaddr)
 {
         pgd_t *pgd = pgd_offset_k((unsigned long)vaddr);
@@ -133,18 +68,6 @@ static inline unsigned long drm_follow_page(void *vaddr)
 
 #else                           /* __OS_HAS_AGP */
 
-static inline drm_map_t *drm_lookup_map(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
-{
-        return NULL;
-}
-
-static inline void *agp_remap(unsigned long offset, unsigned long size,
-                              drm_device_t * dev)
-{
-        return NULL;
-}
-
 static inline unsigned long drm_follow_page(void *vaddr)
 {
         return 0;
@@ -152,51 +75,8 @@ static inline unsigned long drm_follow_page(void *vaddr)
 
 #endif
 
-static inline void *drm_ioremap(unsigned long offset, unsigned long size,
-                                drm_device_t * dev)
-{
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
-                drm_map_t *map = drm_lookup_map(offset, size, dev);
-
-                if (map && map->type == _DRM_AGP)
-                        return agp_remap(offset, size, dev);
-        }
-        return ioremap(offset, size);
-}
-
-static inline void *drm_ioremap_nocache(unsigned long offset,
-                                        unsigned long size, drm_device_t * dev)
-{
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture) {
-                drm_map_t *map = drm_lookup_map(offset, size, dev);
-
-                if (map && map->type == _DRM_AGP)
-                        return agp_remap(offset, size, dev);
-        }
-        return ioremap_nocache(offset, size);
-}
-
-static inline void drm_ioremapfree(void *pt, unsigned long size,
-                                   drm_device_t * dev)
-{
-        /*
-         * This is a bit ugly.  It would be much cleaner if the DRM API would use separate
-         * routines for handling mappings in the AGP space.  Hopefully this can be done in
-         * a future revision of the interface...
-         */
-        if (drm_core_has_AGP(dev) && dev->agp && dev->agp->cant_use_aperture
-            && ((unsigned long)pt >= VMALLOC_START
-                && (unsigned long)pt < VMALLOC_END)) {
-                unsigned long offset;
-                drm_map_t *map;
-
-                offset = drm_follow_page(pt) | ((unsigned long)pt & ~PAGE_MASK);
-                map = drm_lookup_map(offset, size, dev);
-                if (map && map->type == _DRM_AGP) {
-                        vunmap(pt);
-                        return;
-                }
-        }
+void *drm_ioremap(unsigned long offset, unsigned long size,
+                                drm_device_t * dev);
 
-        iounmap(pt);
-}
+void drm_ioremapfree(void *pt, unsigned long size,
+                                   drm_device_t * dev);
diff --git a/drivers/char/drm/drm_memory_debug.h b/drivers/char/drm/drm_memory_debug.h
index 7868341817da..6543b9a14c42 100644
--- a/drivers/char/drm/drm_memory_debug.h
+++ b/drivers/char/drm/drm_memory_debug.h
@@ -229,6 +229,7 @@ void *drm_ioremap (unsigned long offset, unsigned long size,
         return pt;
 }
 
+#if 0
 void *drm_ioremap_nocache (unsigned long offset, unsigned long size,
                             drm_device_t * dev) {
         void *pt;
@@ -251,6 +252,7 @@ void *drm_ioremap_nocache (unsigned long offset, unsigned long size,
         spin_unlock(&drm_mem_lock);
         return pt;
 }
+#endif  /*  0  */
 
 void drm_ioremapfree (void *pt, unsigned long size, drm_device_t * dev) {
         int alloc_count;
diff --git a/drivers/char/drm/drm_pci.c b/drivers/char/drm/drm_pci.c
index b28ca9cea8a2..86a0f1c22091 100644
--- a/drivers/char/drm/drm_pci.c
+++ b/drivers/char/drm/drm_pci.c
@@ -37,6 +37,7 @@
  */
 
 #include <linux/pci.h>
+#include <linux/dma-mapping.h>
 #include "drmP.h"
 
 /**********************************************************************/
diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
index 68073e14fdec..9a842a36bb27 100644
--- a/drivers/char/drm/drm_stub.c
+++ b/drivers/char/drm/drm_stub.c
@@ -229,8 +229,6 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         return ret;
 }
 
-EXPORT_SYMBOL(drm_get_dev);
-
 /**
  * Put a device minor number.
  *
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index b108c7f913b2..26bdf2ca59d7 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -723,7 +723,7 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
         
         dev_priv->scratch_ages[header.scratch.reg]++;
         
-        ref_age_base = *(u32 **)cmdbuf->buf;
+        ref_age_base =  (u32 *)(unsigned long)*((uint64_t *)cmdbuf->buf);
         
         cmdbuf->buf += sizeof(u64);
         cmdbuf->bufsz -= sizeof(u64);
diff --git a/drivers/char/drm/via_irq.c b/drivers/char/drm/via_irq.c
index 6152415644e9..c33d068cde19 100644
--- a/drivers/char/drm/via_irq.c
+++ b/drivers/char/drm/via_irq.c
@@ -196,9 +196,9 @@ via_driver_irq_wait(drm_device_t * dev, unsigned int irq, int force_sequence,
 {
         drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
         unsigned int cur_irq_sequence;
-        drm_via_irq_t *cur_irq = dev_priv->via_irqs;
+        drm_via_irq_t *cur_irq;
         int ret = 0;
-        maskarray_t *masks = dev_priv->irq_masks;
+        maskarray_t *masks;
         int real_irq;
 
         DRM_DEBUG("%s\n", __FUNCTION__);
@@ -221,8 +221,9 @@ via_driver_irq_wait(drm_device_t * dev, unsigned int irq, int force_sequence,
                           __FUNCTION__, irq);
                 return DRM_ERR(EINVAL);
         }
-        
-        cur_irq += real_irq;
+
+        masks = dev_priv->irq_masks;
+        cur_irq = dev_priv->via_irqs + real_irq;
 
         if (masks[real_irq][2] && !force_sequence) {
                 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
@@ -247,11 +248,12 @@ void via_driver_irq_preinstall(drm_device_t * dev)
 {
         drm_via_private_t *dev_priv = (drm_via_private_t *) dev->dev_private;
         u32 status;
-        drm_via_irq_t *cur_irq = dev_priv->via_irqs;
+        drm_via_irq_t *cur_irq;
         int i;
 
         DRM_DEBUG("driver_irq_preinstall: dev_priv: %p\n", dev_priv);
         if (dev_priv) {
+                cur_irq = dev_priv->via_irqs;
 
                 dev_priv->irq_enable_mask = VIA_IRQ_VBLANK_ENABLE;
                 dev_priv->irq_pending_mask = VIA_IRQ_VBLANK_PENDING;
diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
index d3a2bc36129b..588fca542a98 100644
--- a/drivers/char/genrtc.c
+++ b/drivers/char/genrtc.c
@@ -200,13 +200,13 @@ static ssize_t gen_rtc_read(struct file *file, char __user *buf,
         /* first test allows optimizer to nuke this case for 32-bit machines */
         if (sizeof (int) != sizeof (long) && count == sizeof (unsigned int)) {
                 unsigned int uidata = data;
-                retval = put_user(uidata, (unsigned long __user *)buf);
+                retval = put_user(uidata, (unsigned int __user *)buf) ?:
+                        sizeof(unsigned int);
         }
         else {
-                retval = put_user(data, (unsigned long __user *)buf);
+                retval = put_user(data, (unsigned long __user *)buf) ?:
+                        sizeof(unsigned long);
         }
-        if (!retval)
-                retval = sizeof(unsigned long);
  out:
         current->state = TASK_RUNNING;
         remove_wait_queue(&gen_rtc_wait, &wait);
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index 58dcdee1cd71..0030cd8e2e95 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -165,7 +165,7 @@ static int bt_start_transaction(struct si_sm_data *bt,
 {
         unsigned int i;
 
-        if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
+        if ((size < 2) || (size > (IPMI_MAX_MSG_LENGTH - 2)))
                return -1;
 
         if ((bt->state != BT_STATE_IDLE) && (bt->state != BT_STATE_HOSED))
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index a86c0f29953e..b36eef0e9d19 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2198,11 +2198,11 @@ static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
         }
 }
 
-static struct ipmi_default_vals
+static __devinitdata struct ipmi_default_vals
 {
         int type;
         int port;
-} __devinit ipmi_defaults[] =
+} ipmi_defaults[] =
 {
         { .type = SI_KCS, .port = 0xca2 },
         { .type = SI_SMIC, .port = 0xca9 },
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 935670a3cd98..5755b7e5f187 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -860,9 +860,32 @@ static void k_slock(struct vc_data *vc, unsigned char value, char up_flag, struc
 }
 
 /* by default, 300ms interval for combination release */
-static long brl_timeout = 300;
-MODULE_PARM_DESC(brl_timeout, "Braille keys release delay in ms (0 for combination on first release, < 0 for dead characters)");
-module_param(brl_timeout, long, 0644);
+static unsigned brl_timeout = 300;
+MODULE_PARM_DESC(brl_timeout, "Braille keys release delay in ms (0 for commit on first key release)");
+module_param(brl_timeout, uint, 0644);
+
+static unsigned brl_nbchords = 1;
+MODULE_PARM_DESC(brl_nbchords, "Number of chords that produce a braille pattern (0 for dead chords)");
+module_param(brl_nbchords, uint, 0644);
+
+static void k_brlcommit(struct vc_data *vc, unsigned int pattern, char up_flag, struct pt_regs *regs)
+{
+        static unsigned long chords;
+        static unsigned committed;
+
+        if (!brl_nbchords)
+                k_deadunicode(vc, BRL_UC_ROW | pattern, up_flag, regs);
+        else {
+                committed |= pattern;
+                chords++;
+                if (chords == brl_nbchords) {
+                        k_unicode(vc, BRL_UC_ROW | committed, up_flag, regs);
+                        chords = 0;
+                        committed = 0;
+                }
+        }
+}
+
 static void k_brl(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
 {
         static unsigned pressed,committing;
@@ -882,11 +905,6 @@ static void k_brl(struct vc_data *vc, unsigned char value, char up_flag, struct
         if (value > 8)
                 return;
 
-        if (brl_timeout < 0) {
-                k_deadunicode(vc, BRL_UC_ROW | (1 << (value - 1)), up_flag, regs);
-                return;
-        }
-
         if (up_flag) {
                 if (brl_timeout) {
                         if (!committing ||
@@ -897,13 +915,13 @@ static void k_brl(struct vc_data *vc, unsigned char value, char up_flag, struct
                         pressed &= ~(1 << (value - 1));
                         if (!pressed) {
                                 if (committing) {
-                                        k_unicode(vc, BRL_UC_ROW | committing, 0, regs);
+                                        k_brlcommit(vc, committing, 0, regs);
                                         committing = 0;
                                 }
                         }
                 } else {
                         if (committing) {
-                                k_unicode(vc, BRL_UC_ROW | committing, 0, regs);
+                                k_brlcommit(vc, committing, 0, regs);
                                 committing = 0;
                         }
                         pressed &= ~(1 << (value - 1));
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 66719f9d294c..1fa9fa157c12 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -27,6 +27,7 @@
 #include <linux/crash_dump.h>
 #include <linux/backing-dev.h>
 #include <linux/bootmem.h>
+#include <linux/pipe_fs_i.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -578,6 +579,18 @@ static ssize_t write_null(struct file * file, const char __user * buf,
         return count;
 }
 
+static int pipe_to_null(struct pipe_inode_info *info, struct pipe_buffer *buf,
+                        struct splice_desc *sd)
+{
+        return sd->len;
+}
+
+static ssize_t splice_write_null(struct pipe_inode_info *pipe,struct file *out,
+                                 loff_t *ppos, size_t len, unsigned int flags)
+{
+        return splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_null);
+}
+
 #ifdef CONFIG_MMU
 /*
  * For fun, we are using the MMU for this.
@@ -785,6 +798,7 @@ static struct file_operations null_fops = {
         .llseek         = null_lseek,
         .read           = read_null,
         .write          = write_null,
+        .splice_write   = splice_write_null,
 };
 
 #if defined(CONFIG_ISA) || !defined(__mc68000__)
diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index 8666171e187b..d3ba2f860ef0 100644
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -271,7 +271,7 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
                                 ipcnum,
                                 pDrvData->IPCs[ipcnum].usIntCount);
         
-                        if (ipcnum > ARRAY_SIZE(pDrvData->IPCs)) {
+                        if (ipcnum >= ARRAY_SIZE(pDrvData->IPCs)) {
                                 PRINTK_ERROR(KERN_ERR_MWAVE
                                                 "mwavedd::mwave_ioctl:"
                                                 " IOCTL_MW_REGISTER_IPC:"
diff --git a/drivers/char/snsc.c b/drivers/char/snsc.c
index b543821d8cb4..56c8243cdb73 100644
--- a/drivers/char/snsc.c
+++ b/drivers/char/snsc.c
@@ -390,7 +390,8 @@ scdrv_init(void)
                         format_module_id(devnamep, geo_module(geoid),
                                          MODULE_FORMAT_BRIEF);
                         devnamep = devname + strlen(devname);
-                        sprintf(devnamep, "#%d", geo_slab(geoid));
+                        sprintf(devnamep, "^%d#%d", geo_slot(geoid),
+                                geo_slab(geoid));
 
                         /* allocate sysctl device data */
                         scd = kzalloc(sizeof (struct sysctl_data_s),
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index f8dd8527c6aa..a90f5d97df35 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1341,6 +1341,9 @@ static int __devinit sonypi_probe(struct platform_device *dev)
         else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
                                           PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
                 sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
+        else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                          PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
+                sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
         else
                 sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2;
 
diff --git a/drivers/char/tipar.c b/drivers/char/tipar.c
index eb2eb3e12d6a..079db5a935a1 100644
--- a/drivers/char/tipar.c
+++ b/drivers/char/tipar.c
@@ -515,7 +515,7 @@ tipar_init_module(void)
                 err = PTR_ERR(tipar_class);
                 goto out_chrdev;
         }
-        if (parport_register_driver(&tipar_driver) || tp_count == 0) {
+        if (parport_register_driver(&tipar_driver)) {
                 printk(KERN_ERR "tipar: unable to register with parport\n");
                 err = -EIO;
                 goto out_class;
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index a6873bf89ffa..1efde3b27619 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -20,9 +20,18 @@ config TCG_TPM
           Note: For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
           and CONFIG_PNPACPI.
 
+config TCG_TIS
+        tristate "TPM Interface Specification 1.2 Interface"
+        depends on TCG_TPM
+        ---help---
+          If you have a TPM security chip that is compliant with the
+          TCG TIS 1.2 TPM specification say Yes and it will be accessible
+          from within Linux.  To compile this driver as a module, choose
+          M here; the module will be called tpm_tis.
+
 config TCG_NSC
         tristate "National Semiconductor TPM Interface"
-        depends on TCG_TPM
+        depends on TCG_TPM && PNPACPI
         ---help---
           If you have a TPM security chip from National Semicondutor 
           say Yes and it will be accessible from within Linux.  To 
diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index ba4582d160fd..ea3a1e02a824 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_TCG_TPM) += tpm.o
 ifdef CONFIG_ACPI
         obj-$(CONFIG_TCG_TPM) += tpm_bios.o
 endif
+obj-$(CONFIG_TCG_TIS) += tpm_tis.o
 obj-$(CONFIG_TCG_NSC) += tpm_nsc.o
 obj-$(CONFIG_TCG_ATMEL) += tpm_atmel.o
 obj-$(CONFIG_TCG_INFINEON) += tpm_infineon.o
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 5a3870477ef1..6889e7db3aff 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -32,12 +32,291 @@ enum tpm_const {
         TPM_MINOR = 224,        /* officially assigned */
         TPM_BUFSIZE = 2048,
         TPM_NUM_DEVICES = 256,
-        TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
 };
 
+enum tpm_duration {
+        TPM_SHORT = 0,
+        TPM_MEDIUM = 1,
+        TPM_LONG = 2,
+        TPM_UNDEFINED,
+};
+
+#define TPM_MAX_ORDINAL 243
+#define TPM_MAX_PROTECTED_ORDINAL 12
+#define TPM_PROTECTED_ORDINAL_MASK 0xFF
+
 static LIST_HEAD(tpm_chip_list);
 static DEFINE_SPINLOCK(driver_lock);
-static int dev_mask[TPM_NUM_MASK_ENTRIES];
+static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
+
+/*
+ * Array with one entry per ordinal defining the maximum amount
+ * of time the chip could take to return the result.  The ordinal
+ * designation of short, medium or long is defined in a table in
+ * TCG Specification TPM Main Part 2 TPM Structures Section 17. The
+ * values of the SHORT, MEDIUM, and LONG durations are retrieved
+ * from the chip during initialization with a call to tpm_get_timeouts.
+ */
+static const u8 tpm_protected_ordinal_duration[TPM_MAX_PROTECTED_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+};
+
+static const u8 tpm_ordinal_duration[TPM_MAX_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 15 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,              /* 20 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,              /* 25 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 30 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 35 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 40 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 45 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 50 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 55 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 60 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 65 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 70 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 75 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 80 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 85 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 90 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 95 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 100 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 105 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 110 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 115 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 120 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 125 */
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 130 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 135 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 140 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 145 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 150 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 155 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 160 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 165 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 170 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 175 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 180 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,             /* 185 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 190 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 195 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 200 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 205 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 210 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 215 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 220 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 225 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 230 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 235 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 240 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+};
 
 static void user_reader_timeout(unsigned long ptr)
 {
@@ -46,7 +325,7 @@ static void user_reader_timeout(unsigned long ptr)
         schedule_work(&chip->work);
 }
 
-static void timeout_work(void * ptr)
+static void timeout_work(void *ptr)
 {
         struct tpm_chip *chip = ptr;
 
@@ -57,17 +336,43 @@ static void timeout_work(void * ptr)
 }
 
 /*
+ * Returns max number of jiffies to wait
+ */
+unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
+                                           u32 ordinal)
+{
+        int duration_idx = TPM_UNDEFINED;
+        int duration = 0;
+
+        if (ordinal < TPM_MAX_ORDINAL)
+                duration_idx = tpm_ordinal_duration[ordinal];
+        else if ((ordinal & TPM_PROTECTED_ORDINAL_MASK) <
+                 TPM_MAX_PROTECTED_ORDINAL)
+                duration_idx =
+                    tpm_protected_ordinal_duration[ordinal &
+                                                   TPM_PROTECTED_ORDINAL_MASK];
+
+        if (duration_idx != TPM_UNDEFINED)
+                duration = chip->vendor.duration[duration_idx];
+        if (duration <= 0)
+                return 2 * 60 * HZ;
+        else
+                return duration;
+}
+EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
+
+/*
  * Internal kernel interface to transmit TPM commands
  */
 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                             size_t bufsiz)
 {
         ssize_t rc;
-        u32 count;
+        u32 count, ordinal;
         unsigned long stop;
 
         count = be32_to_cpu(*((__be32 *) (buf + 2)));
-
+        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
         if (count == 0)
                 return -ENODATA;
         if (count > bufsiz) {
@@ -78,21 +383,23 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
 
         down(&chip->tpm_mutex);
 
-        if ((rc = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
+        if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_send: error %zd\n", rc);
                 goto out;
         }
 
-        stop = jiffies + 2 * 60 * HZ;
+        if (chip->vendor.irq)
+                goto out_recv;
+
+        stop = jiffies + tpm_calc_ordinal_duration(chip, ordinal);
         do {
-                u8 status = chip->vendor->status(chip);
-                if ((status & chip->vendor->req_complete_mask) ==
-                    chip->vendor->req_complete_val) {
+                u8 status = chip->vendor.status(chip);
+                if ((status & chip->vendor.req_complete_mask) ==
+                    chip->vendor.req_complete_val)
                         goto out_recv;
-                }
 
-                if ((status == chip->vendor->req_canceled)) {
+                if ((status == chip->vendor.req_canceled)) {
                         dev_err(chip->dev, "Operation Canceled\n");
                         rc = -ECANCELED;
                         goto out;
@@ -102,14 +409,13 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                 rmb();
         } while (time_before(jiffies, stop));
 
-
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
         dev_err(chip->dev, "Operation Timed out\n");
         rc = -ETIME;
         goto out;
 
 out_recv:
-        rc = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
+        rc = chip->vendor.recv(chip, (u8 *) buf, bufsiz);
         if (rc < 0)
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_recv: error %zd\n", rc);
@@ -119,17 +425,247 @@ out:
 }
 
 #define TPM_DIGEST_SIZE 20
-#define CAP_PCR_RESULT_SIZE 18
-static const u8 cap_pcr[] = {
+#define TPM_ERROR_SIZE 10
+#define TPM_RET_CODE_IDX 6
+#define TPM_GET_CAP_RET_SIZE_IDX 10
+#define TPM_GET_CAP_RET_UINT32_1_IDX 14
+#define TPM_GET_CAP_RET_UINT32_2_IDX 18
+#define TPM_GET_CAP_RET_UINT32_3_IDX 22
+#define TPM_GET_CAP_RET_UINT32_4_IDX 26
+#define TPM_GET_CAP_PERM_DISABLE_IDX 16
+#define TPM_GET_CAP_PERM_INACTIVE_IDX 18
+#define TPM_GET_CAP_RET_BOOL_1_IDX 14
+#define TPM_GET_CAP_TEMP_INACTIVE_IDX 16
+
+#define TPM_CAP_IDX 13
+#define TPM_CAP_SUBCAP_IDX 21
+
+enum tpm_capabilities {
+        TPM_CAP_FLAG = 4,
+        TPM_CAP_PROP = 5,
+};
+
+enum tpm_sub_capabilities {
+        TPM_CAP_PROP_PCR = 0x1,
+        TPM_CAP_PROP_MANUFACTURER = 0x3,
+        TPM_CAP_FLAG_PERM = 0x8,
+        TPM_CAP_FLAG_VOL = 0x9,
+        TPM_CAP_PROP_OWNER = 0x11,
+        TPM_CAP_PROP_TIS_TIMEOUT = 0x15,
+        TPM_CAP_PROP_TIS_DURATION = 0x20,
+};
+
+/*
+ * This is a semi generic GetCapability command for use
+ * with the capability type TPM_CAP_PROP or TPM_CAP_FLAG
+ * and their associated sub_capabilities.
+ */
+
+static const u8 tpm_cap[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 22,            /* length */
         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 1
+        0, 0, 0, 0,             /* TPM_CAP_<TYPE> */
+        0, 0, 0, 4,             /* TPM_CAP_SUB_<TYPE> size */
+        0, 0, 1, 0              /* TPM_CAP_SUB_<TYPE> */
 };
 
-#define READ_PCR_RESULT_SIZE 30
+static ssize_t transmit_cmd(struct tpm_chip *chip, u8 *data, int len,
+                            char *desc)
+{
+        int err;
+
+        len = tpm_transmit(chip, data, len);
+        if (len <  0)
+                return len;
+        if (len == TPM_ERROR_SIZE) {
+                err = be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX)));
+                dev_dbg(chip->dev, "A TPM error (%d) occurred %s\n", err, desc);
+                return err;
+        }
+        return 0;
+}
+
+void tpm_gen_interrupt(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+}
+EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
+
+void tpm_get_timeouts(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+        u32 timeout;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+        if (rc)
+                goto duration;
+
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 4 * sizeof(u32))
+                goto duration;
+
+        /* Don't overwrite default if value is 0 */
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX)));
+        if (timeout)
+                chip->vendor.timeout_a = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_2_IDX)));
+        if (timeout)
+                chip->vendor.timeout_b = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_3_IDX)));
+        if (timeout)
+                chip->vendor.timeout_c = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_4_IDX)));
+        if (timeout)
+                chip->vendor.timeout_d = msecs_to_jiffies(timeout);
+
+duration:
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_DURATION;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the durations");
+        if (rc)
+                return;
+
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 3 * sizeof(u32))
+                return;
+
+        chip->vendor.duration[TPM_SHORT] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_1_IDX))));
+        chip->vendor.duration[TPM_MEDIUM] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_2_IDX))));
+        chip->vendor.duration[TPM_LONG] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_3_IDX))));
+}
+EXPORT_SYMBOL_GPL(tpm_get_timeouts);
+
+void tpm_continue_selftest(struct tpm_chip *chip)
+{
+        u8 data[] = {
+                0, 193,                 /* TPM_TAG_RQU_COMMAND */
+                0, 0, 0, 10,            /* length */
+                0, 0, 0, 83,            /* TPM_ORD_GetCapability */
+        };
+
+        tpm_transmit(chip, data, sizeof(data));
+}
+EXPORT_SYMBOL_GPL(tpm_continue_selftest);
+
+ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_DISABLE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_enabled);
+
+ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_active);
+
+ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_OWNER;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the owner state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_RET_BOOL_1_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_owned);
+
+ssize_t tpm_show_temp_deactivated(struct device * dev,
+                                struct device_attribute * attr, char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_VOL;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the temporary state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_TEMP_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_temp_deactivated);
+
 static const u8 pcrread[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 14,            /* length */
@@ -140,8 +676,8 @@ static const u8 pcrread[] = {
 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
-        u8 data[READ_PCR_RESULT_SIZE];
-        ssize_t len;
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(pcrread)), 30)];
+        ssize_t rc;
         int i, j, num_pcrs;
         __be32 index;
         char *str = buf;
@@ -150,29 +686,24 @@ ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
         if (chip == NULL)
                 return -ENODEV;
 
-        memcpy(data, cap_pcr, sizeof(cap_pcr));
-        if ((len = tpm_transmit(chip, data, sizeof(data)))
-            < CAP_PCR_RESULT_SIZE) {
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to determine the number of PCRS\n",
-                        be32_to_cpu(*((__be32 *) (data + 6))));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_PCR;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the number of PCRS");
+        if (rc)
                 return 0;
-        }
 
         num_pcrs = be32_to_cpu(*((__be32 *) (data + 14)));
-
         for (i = 0; i < num_pcrs; i++) {
                 memcpy(data, pcrread, sizeof(pcrread));
                 index = cpu_to_be32(i);
                 memcpy(data + 10, &index, 4);
-                if ((len = tpm_transmit(chip, data, sizeof(data)))
-                    < READ_PCR_RESULT_SIZE){
-                        dev_dbg(chip->dev, "A TPM error (%d) occurred"
-                                " attempting to read PCR %d of %d\n",
-                                be32_to_cpu(*((__be32 *) (data + 6))),
-                                i, num_pcrs);
+                rc = transmit_cmd(chip, data, sizeof(data),
+                                "attempting to read a PCR");
+                if (rc)
                         goto out;
-                }
                 str += sprintf(str, "PCR-%02d: ", i);
                 for (j = 0; j < TPM_DIGEST_SIZE; j++)
                         str += sprintf(str, "%02X ", *(data + 10 + j));
@@ -194,7 +725,7 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                        char *buf)
 {
         u8 *data;
-        ssize_t len;
+        ssize_t err;
         int i, rc;
         char *str = buf;
 
@@ -208,14 +739,10 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
 
         memcpy(data, readpubek, sizeof(readpubek));
 
-        if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
-            READ_PUBEK_RESULT_SIZE) {
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to read the PUBEK\n",
-                            be32_to_cpu(*((__be32 *) (data + 6))));
-                rc = 0;
+        err = transmit_cmd(chip, data, READ_PUBEK_RESULT_SIZE,
+                        "attempting to read the PUBEK");
+        if (err)
                 goto out;
-        }
 
         /* 
            ignore header 10 bytes
@@ -245,67 +772,110 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                 if ((i + 1) % 16 == 0)
                         str += sprintf(str, "\n");
         }
-        rc = str - buf;
 out:
+        rc = str - buf;
         kfree(data);
         return rc;
 }
 EXPORT_SYMBOL_GPL(tpm_show_pubek);
 
-#define CAP_VER_RESULT_SIZE 18
+#define CAP_VERSION_1_1 6
+#define CAP_VERSION_1_2 0x1A
+#define CAP_VERSION_IDX 13
 static const u8 cap_version[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 18,            /* length */
         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 6,
+        0, 0, 0, 0,
         0, 0, 0, 0
 };
 
-#define CAP_MANUFACTURER_RESULT_SIZE 18
-static const u8 cap_manufacturer[] = {
-        0, 193,                 /* TPM_TAG_RQU_COMMAND */
-        0, 0, 0, 22,            /* length */
-        0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 3
-};
-
 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
-        u8 data[sizeof(cap_manufacturer)];
-        ssize_t len;
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t rc;
         char *str = buf;
 
         struct tpm_chip *chip = dev_get_drvdata(dev);
         if (chip == NULL)
                 return -ENODEV;
 
-        memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
 
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
-            CAP_MANUFACTURER_RESULT_SIZE)
-                return len;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the manufacturer");
+        if (rc)
+                return 0;
 
         str += sprintf(str, "Manufacturer: 0x%x\n",
-                       be32_to_cpu(*((__be32 *) (data + 14))));
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
 
         memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_1;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the 1.1 version");
+        if (rc)
+                goto out;
 
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
-            CAP_VER_RESULT_SIZE)
-                return len;
-
-        str +=
-            sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
-                    (int) data[14], (int) data[15], (int) data[16],
-                    (int) data[17]);
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[14], (int) data[15], (int) data[16],
+                       (int) data[17]);
 
+out:
         return str - buf;
 }
 EXPORT_SYMBOL_GPL(tpm_show_caps);
 
+ssize_t tpm_show_caps_1_2(struct device * dev,
+                          struct device_attribute * attr, char *buf)
+{
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t len;
+        char *str = buf;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
+
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_dbg(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the manufacturer\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                return 0;
+        }
+
+        str += sprintf(str, "Manufacturer: 0x%x\n",
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
+
+        memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_2;
+
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_err(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the 1.2 version\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                goto out;
+        }
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[16], (int) data[17], (int) data[18],
+                       (int) data[19]);
+
+out:
+        return str - buf;
+}
+EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
+
 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
                         const char *buf, size_t count)
 {
@@ -313,7 +883,7 @@ ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
         if (chip == NULL)
                 return 0;
 
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
         return count;
 }
 EXPORT_SYMBOL_GPL(tpm_store_cancel);
@@ -329,7 +899,7 @@ int tpm_open(struct inode *inode, struct file *file)
         spin_lock(&driver_lock);
 
         list_for_each_entry(pos, &tpm_chip_list, list) {
-                if (pos->vendor->miscdev.minor == minor) {
+                if (pos->vendor.miscdev.minor == minor) {
                         chip = pos;
                         break;
                 }
@@ -387,7 +957,7 @@ int tpm_release(struct inode *inode, struct file *file)
 EXPORT_SYMBOL_GPL(tpm_release);
 
 ssize_t tpm_write(struct file *file, const char __user *buf,
-                  size_t size, loff_t * off)
+                  size_t size, loff_t *off)
 {
         struct tpm_chip *chip = file->private_data;
         int in_size = size, out_size;
@@ -419,11 +989,10 @@ ssize_t tpm_write(struct file *file, const char __user *buf,
 
         return in_size;
 }
-
 EXPORT_SYMBOL_GPL(tpm_write);
 
-ssize_t tpm_read(struct file * file, char __user *buf,
-                 size_t size, loff_t * off)
+ssize_t tpm_read(struct file *file, char __user *buf,
+                 size_t size, loff_t *off)
 {
         struct tpm_chip *chip = file->private_data;
         int ret_size;
@@ -462,14 +1031,13 @@ void tpm_remove_hardware(struct device *dev)
         spin_unlock(&driver_lock);
 
         dev_set_drvdata(dev, NULL);
-        misc_deregister(&chip->vendor->miscdev);
-        kfree(chip->vendor->miscdev.name);
+        misc_deregister(&chip->vendor.miscdev);
+        kfree(chip->vendor.miscdev.name);
 
-        sysfs_remove_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
         tpm_bios_log_teardown(chip->bios_dir);
 
-        dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &=
-                ~(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
+        clear_bit(chip->dev_num, dev_mask);
 
         kfree(chip);
 
@@ -520,18 +1088,18 @@ EXPORT_SYMBOL_GPL(tpm_pm_resume);
  * upon errant exit from this function specific probe function should call
  * pci_disable_device
  */
-int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
+struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vendor_specific
+                                       *entry)
 {
 #define DEVNAME_SIZE 7
 
         char *devname;
         struct tpm_chip *chip;
-        int i, j;
 
         /* Driver specific per-device data */
         chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
-                return -ENOMEM;
+                return NULL;
 
         init_MUTEX(&chip->buffer_mutex);
         init_MUTEX(&chip->tpm_mutex);
@@ -543,45 +1111,37 @@ int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
         chip->user_read_timer.function = user_reader_timeout;
         chip->user_read_timer.data = (unsigned long) chip;
 
-        chip->vendor = entry;
-
-        chip->dev_num = -1;
+        memcpy(&chip->vendor, entry, sizeof(struct tpm_vendor_specific));
 
-        for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
-                for (j = 0; j < 8 * sizeof(int); j++)
-                        if ((dev_mask[i] & (1 << j)) == 0) {
-                                chip->dev_num =
-                                    i * TPM_NUM_MASK_ENTRIES + j;
-                                dev_mask[i] |= 1 << j;
-                                goto dev_num_search_complete;
-                        }
+        chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
 
-dev_num_search_complete:
-        if (chip->dev_num < 0) {
+        if (chip->dev_num >= TPM_NUM_DEVICES) {
                 dev_err(dev, "No available tpm device numbers\n");
                 kfree(chip);
-                return -ENODEV;
+                return NULL;
         } else if (chip->dev_num == 0)
-                chip->vendor->miscdev.minor = TPM_MINOR;
+                chip->vendor.miscdev.minor = TPM_MINOR;
         else
-                chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
+                chip->vendor.miscdev.minor = MISC_DYNAMIC_MINOR;
+
+        set_bit(chip->dev_num, dev_mask);
 
         devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
         scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
-        chip->vendor->miscdev.name = devname;
+        chip->vendor.miscdev.name = devname;
 
-        chip->vendor->miscdev.dev = dev;
+        chip->vendor.miscdev.dev = dev;
         chip->dev = get_device(dev);
 
-        if (misc_register(&chip->vendor->miscdev)) {
+        if (misc_register(&chip->vendor.miscdev)) {
                 dev_err(chip->dev,
                         "unable to misc_register %s, minor %d\n",
-                        chip->vendor->miscdev.name,
-                        chip->vendor->miscdev.minor);
+                        chip->vendor.miscdev.name,
+                        chip->vendor.miscdev.minor);
                 put_device(dev);
+                clear_bit(chip->dev_num, dev_mask);
                 kfree(chip);
-                dev_mask[i] &= !(1 << j);
-                return -ENODEV;
+                return NULL;
         }
 
         spin_lock(&driver_lock);
@@ -592,11 +1152,11 @@ dev_num_search_complete:
 
         spin_unlock(&driver_lock);
 
-        sysfs_create_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_create_group(&dev->kobj, chip->vendor.attr_group);
 
         chip->bios_dir = tpm_bios_log_setup(devname);
 
-        return 0;
+        return chip;
 }
 EXPORT_SYMBOL_GPL(tpm_register_hardware);
 
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index dec0224b4478..54a4c804e25f 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -42,18 +42,30 @@ extern ssize_t tpm_show_pcrs(struct device *, struct device_attribute *attr,
                                 char *);
 extern ssize_t tpm_show_caps(struct device *, struct device_attribute *attr,
                                 char *);
+extern ssize_t tpm_show_caps_1_2(struct device *, struct device_attribute *attr,
+                                char *);
 extern ssize_t tpm_store_cancel(struct device *, struct device_attribute *attr,
                                 const char *, size_t);
+extern ssize_t tpm_show_enabled(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_active(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_temp_deactivated(struct device *,
+                                         struct device_attribute *attr, char *);
 
 struct tpm_chip;
 
 struct tpm_vendor_specific {
-        u8 req_complete_mask;
-        u8 req_complete_val;
-        u8 req_canceled;
+        const u8 req_complete_mask;
+        const u8 req_complete_val;
+        const u8 req_canceled;
         void __iomem *iobase;           /* ioremapped address */
         unsigned long base;             /* TPM base address */
 
+        int irq;
+
         int region_size;
         int have_region;
 
@@ -63,6 +75,13 @@ struct tpm_vendor_specific {
         u8 (*status) (struct tpm_chip *);
         struct miscdevice miscdev;
         struct attribute_group *attr_group;
+        struct list_head list;
+        int locality;
+        unsigned long timeout_a, timeout_b, timeout_c, timeout_d; /* jiffies */
+        unsigned long duration[3]; /* jiffies */
+
+        wait_queue_head_t read_queue;
+        wait_queue_head_t int_queue;
 };
 
 struct tpm_chip {
@@ -81,13 +100,15 @@ struct tpm_chip {
         struct work_struct work;
         struct semaphore tpm_mutex;     /* tpm is processing */
 
-        struct tpm_vendor_specific *vendor;
+        struct tpm_vendor_specific vendor;
 
         struct dentry **bios_dir;
 
         struct list_head list;
 };
 
+#define to_tpm_chip(n) container_of(n, struct tpm_chip, vendor)
+
 static inline int tpm_read_index(int base, int index)
 {
         outb(index, base);
@@ -100,8 +121,12 @@ static inline void tpm_write_index(int base, int index, int value)
         outb(value & 0xFF, base+1);
 }
 
-extern int tpm_register_hardware(struct device *,
-                                 struct tpm_vendor_specific *);
+extern void tpm_get_timeouts(struct tpm_chip *);
+extern void tpm_gen_interrupt(struct tpm_chip *);
+extern void tpm_continue_selftest(struct tpm_chip *);
+extern unsigned long tpm_calc_ordinal_duration(struct tpm_chip *, u32);
+extern struct tpm_chip* tpm_register_hardware(struct device *,
+                                 const struct tpm_vendor_specific *);
 extern int tpm_open(struct inode *, struct file *);
 extern int tpm_release(struct inode *, struct file *);
 extern ssize_t tpm_write(struct file *, const char __user *, size_t,
diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
index ff3654964fe3..58a258cec153 100644
--- a/drivers/char/tpm/tpm_atmel.c
+++ b/drivers/char/tpm/tpm_atmel.c
@@ -47,12 +47,12 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                 return -EIO;
 
         for (i = 0; i < 6; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                 if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                         dev_err(chip->dev, "error reading header\n");
                         return -EIO;
                 }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
         }
 
         /* size of the data received */
@@ -63,7 +63,7 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                 dev_err(chip->dev,
                         "Recv size(%d) less than available space\n", size);
                 for (; i < size; i++) { /* clear the waiting data anyway */
-                        status = ioread8(chip->vendor->iobase + 1);
+                        status = ioread8(chip->vendor.iobase + 1);
                         if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                                 dev_err(chip->dev, "error reading data\n");
                                 return -EIO;
@@ -74,16 +74,16 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 
         /* read all the data available */
         for (; i < size; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                 if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                         dev_err(chip->dev, "error reading data\n");
                         return -EIO;
                 }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
         }
 
         /* make sure data available is gone */
-        status = ioread8(chip->vendor->iobase + 1);
+        status = ioread8(chip->vendor.iobase + 1);
 
         if (status & ATML_STATUS_DATA_AVAIL) {
                 dev_err(chip->dev, "data available is stuck\n");
@@ -100,7 +100,7 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
         dev_dbg(chip->dev, "tpm_atml_send:\n");
         for (i = 0; i < count; i++) {
                 dev_dbg(chip->dev, "%d 0x%x(%d)\n",  i, buf[i], buf[i]);
-                iowrite8(buf[i], chip->vendor->iobase);
+                iowrite8(buf[i], chip->vendor.iobase);
         }
 
         return count;
@@ -108,12 +108,12 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
 
 static void tpm_atml_cancel(struct tpm_chip *chip)
 {
-        iowrite8(ATML_STATUS_ABORT, chip->vendor->iobase + 1);
+        iowrite8(ATML_STATUS_ABORT, chip->vendor.iobase + 1);
 }
 
 static u8 tpm_atml_status(struct tpm_chip *chip)
 {
-        return ioread8(chip->vendor->iobase + 1);
+        return ioread8(chip->vendor.iobase + 1);
 }
 
 static struct file_operations atmel_ops = {
@@ -140,7 +140,7 @@ static struct attribute* atmel_attrs[] = {
 
 static struct attribute_group atmel_attr_grp = { .attrs = atmel_attrs };
 
-static struct tpm_vendor_specific tpm_atmel = {
+static const struct tpm_vendor_specific tpm_atmel = {
         .recv = tpm_atml_recv,
         .send = tpm_atml_send,
         .cancel = tpm_atml_cancel,
@@ -159,10 +159,10 @@ static void atml_plat_remove(void)
         struct tpm_chip *chip = dev_get_drvdata(&pdev->dev);
 
         if (chip) {
-                if (chip->vendor->have_region)
-                        atmel_release_region(chip->vendor->base,
-                                             chip->vendor->region_size);
-                atmel_put_base_addr(chip->vendor);
+                if (chip->vendor.have_region)
+                        atmel_release_region(chip->vendor.base,
+                                             chip->vendor.region_size);
+                atmel_put_base_addr(chip->vendor.iobase);
                 tpm_remove_hardware(chip->dev);
                 platform_device_unregister(pdev);
         }
@@ -179,18 +179,22 @@ static struct device_driver atml_drv = {
 static int __init init_atmel(void)
 {
         int rc = 0;
+        void __iomem *iobase = NULL;
+        int have_region, region_size;
+        unsigned long base;
+        struct  tpm_chip *chip;
 
         driver_register(&atml_drv);
 
-        if ((tpm_atmel.iobase = atmel_get_base_addr(&tpm_atmel)) == NULL) {
+        if ((iobase = atmel_get_base_addr(&base, &region_size)) == NULL) {
                 rc = -ENODEV;
                 goto err_unreg_drv;
         }
 
-        tpm_atmel.have_region =
+        have_region =
             (atmel_request_region
-             (tpm_atmel.base, tpm_atmel.region_size,
-              "tpm_atmel0") == NULL) ? 0 : 1;
+             (tpm_atmel.base, region_size, "tpm_atmel0") == NULL) ? 0 : 1;
+
 
         if (IS_ERR
             (pdev =
@@ -199,17 +203,25 @@ static int __init init_atmel(void)
                 goto err_rel_reg;
         }
 
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_atmel)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_atmel))) {
+                rc = -ENODEV;
                 goto err_unreg_dev;
+        }
+
+        chip->vendor.iobase = iobase;
+        chip->vendor.base = base;
+        chip->vendor.have_region = have_region;
+        chip->vendor.region_size = region_size;
+
         return 0;
 
 err_unreg_dev:
         platform_device_unregister(pdev);
 err_rel_reg:
-        atmel_put_base_addr(&tpm_atmel);
-        if (tpm_atmel.have_region)
-                atmel_release_region(tpm_atmel.base,
-                                     tpm_atmel.region_size);
+        atmel_put_base_addr(iobase);
+        if (have_region)
+                atmel_release_region(base,
+                                     region_size);
 err_unreg_drv:
         driver_unregister(&atml_drv);
         return rc;
diff --git a/drivers/char/tpm/tpm_atmel.h b/drivers/char/tpm/tpm_atmel.h
index d3478aaadd77..2e68eeb8a2cd 100644
--- a/drivers/char/tpm/tpm_atmel.h
+++ b/drivers/char/tpm/tpm_atmel.h
@@ -28,13 +28,12 @@
 #define atmel_request_region request_mem_region
 #define atmel_release_region release_mem_region
 
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static inline void atmel_put_base_addr(void __iomem *iobase)
 {
-        iounmap(vendor->iobase);
+        iounmap(iobase);
 }
 
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
         struct device_node *dn;
         unsigned long address, size;
@@ -71,9 +70,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
         else
                 size = reg[naddrc];
 
-        vendor->base = address;
-        vendor->region_size = size;
-        return ioremap(vendor->base, vendor->region_size);
+        *base = address;
+        *region_size = size;
+        return ioremap(*base, *region_size);
 }
 #else
 #define atmel_getb(chip, offset) inb(chip->vendor->base + offset)
@@ -106,14 +105,12 @@ static int atmel_verify_tpm11(void)
         return 0;
 }
 
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static inline void atmel_put_base_addr(void __iomem *iobase)
 {
 }
 
 /* Determine where to talk to device */
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
         int lo, hi;
 
@@ -123,9 +120,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
         lo = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_LO);
         hi = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_HI);
 
-        vendor->base = (hi << 8) | lo;
-        vendor->region_size = 2;
+        *base = (hi << 8) | lo;
+        *region_size = 2;
 
-        return ioport_map(vendor->base, vendor->region_size);
+        return ioport_map(*base, *region_size);
 }
 #endif
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index 537aa45d8c67..e45f0d3d12de 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -29,6 +29,11 @@
 #define MAX_TEXT_EVENT          1000    /* Max event string length */
 #define ACPI_TCPA_SIG           "TCPA"  /* 0x41504354 /'TCPA' */
 
+enum bios_platform_class {
+        BIOS_CLIENT = 0x00,
+        BIOS_SERVER = 0x01,
+};
+
 struct tpm_bios_log {
         void *bios_event_log;
         void *bios_event_log_end;
@@ -36,9 +41,18 @@ struct tpm_bios_log {
 
 struct acpi_tcpa {
         struct acpi_table_header hdr;
-        u16 reserved;
-        u32 log_max_len __attribute__ ((packed));
-        u32 log_start_addr __attribute__ ((packed));
+        u16 platform_class;
+        union {
+                struct client_hdr {
+                        u32 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } client;
+                struct server_hdr {
+                        u16 reserved;
+                        u64 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } server;
+        };
 };
 
 struct tcpa_event {
@@ -120,6 +134,7 @@ static const char* tcpa_pc_event_id_strings[] = {
         "S-CRTM Version",
         "S-CRTM Contents",
         "S-CRTM POST Contents",
+        "POST Contents",
 };
 
 /* returns pointer to start of pos. entry of tcg log */
@@ -306,6 +321,7 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
         /* 5th: delimiter */
         seq_putc(m, '\0');
 
+        kfree(eventname);
         return 0;
 }
 
@@ -353,6 +369,7 @@ static int tpm_ascii_bios_measurements_show(struct seq_file *m, void *v)
         /* 4th: eventname <= max + \'0' delimiter */
         seq_printf(m, " %s\n", eventname);
 
+        kfree(eventname);
         return 0;
 }
 
@@ -376,6 +393,7 @@ static int read_log(struct tpm_bios_log *log)
         struct acpi_tcpa *buff;
         acpi_status status;
         struct acpi_table_header *virt;
+        u64 len, start;
 
         if (log->bios_event_log != NULL) {
                 printk(KERN_ERR
@@ -396,27 +414,37 @@ static int read_log(struct tpm_bios_log *log)
                 return -EIO;
         }
 
-        if (buff->log_max_len == 0) {
+        switch(buff->platform_class) {
+        case BIOS_SERVER:
+                len = buff->server.log_max_len;
+                start = buff->server.log_start_addr;
+                break;
+        case BIOS_CLIENT:
+        default:
+                len = buff->client.log_max_len;
+                start = buff->client.log_start_addr;
+                break;
+        }
+        if (!len) {
                 printk(KERN_ERR "%s: ERROR - TCPA log area empty\n", __func__);
                 return -EIO;
         }
 
         /* malloc EventLog space */
-        log->bios_event_log = kmalloc(buff->log_max_len, GFP_KERNEL);
+        log->bios_event_log = kmalloc(len, GFP_KERNEL);
         if (!log->bios_event_log) {
-                printk
-                    ("%s: ERROR - Not enough  Memory for BIOS measurements\n",
-                     __func__);
+                printk("%s: ERROR - Not enough  Memory for BIOS measurements\n",
+                        __func__);
                 return -ENOMEM;
         }
 
-        log->bios_event_log_end = log->bios_event_log + buff->log_max_len;
+        log->bios_event_log_end = log->bios_event_log + len;
 
-        acpi_os_map_memory(buff->log_start_addr, buff->log_max_len, (void *) &virt);
+        acpi_os_map_memory(start, len, (void *) &virt);
 
-        memcpy(log->bios_event_log, virt, buff->log_max_len);
+        memcpy(log->bios_event_log, virt, len);
 
-        acpi_os_unmap_memory(virt, buff->log_max_len);
+        acpi_os_unmap_memory(virt, len);
         return 0;
 }
 
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 24095f6ee6da..adfff21beb21 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -15,6 +15,7 @@
  * License.
  */
 
+#include <linux/init.h>
 #include <linux/pnp.h>
 #include "tpm.h"
 
@@ -104,7 +105,7 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
 
         if (clear_wrfifo) {
                 for (i = 0; i < 4096; i++) {
-                        status = inb(chip->vendor->base + WRFIFO);
+                        status = inb(chip->vendor.base + WRFIFO);
                         if (status == 0xff) {
                                 if (check == 5)
                                         break;
@@ -124,8 +125,8 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
          */
         i = 0;
         do {
-                status = inb(chip->vendor->base + RDFIFO);
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + RDFIFO);
+                status = inb(chip->vendor.base + STAT);
                 i++;
                 if (i == TPM_MAX_TRIES)
                         return -EIO;
@@ -138,7 +139,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
         int status;
         int i;
         for (i = 0; i < TPM_MAX_TRIES; i++) {
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + STAT);
                 /* check the status-register if wait_for_bit is set */
                 if (status & 1 << wait_for_bit)
                         break;
@@ -157,7 +158,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
 static void wait_and_send(struct tpm_chip *chip, u8 sendbyte)
 {
         wait(chip, STAT_XFE);
-        outb(sendbyte, chip->vendor->base + WRFIFO);
+        outb(sendbyte, chip->vendor.base + WRFIFO);
 }
 
     /* Note: WTX means Waiting-Time-Extension. Whenever the TPM needs more
@@ -204,7 +205,7 @@ recv_begin:
                 ret = wait(chip, STAT_RDA);
                 if (ret)
                         return -EIO;
-                buf[i] = inb(chip->vendor->base + RDFIFO);
+                buf[i] = inb(chip->vendor.base + RDFIFO);
         }
 
         if (buf[0] != TPM_VL_VER) {
@@ -219,7 +220,7 @@ recv_begin:
 
                 for (i = 0; i < size; i++) {
                         wait(chip, STAT_RDA);
-                        buf[i] = inb(chip->vendor->base + RDFIFO);
+                        buf[i] = inb(chip->vendor.base + RDFIFO);
                 }
 
                 if ((size == 0x6D00) && (buf[1] == 0x80)) {
@@ -268,7 +269,7 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
         u8 count_high, count_low, count_4, count_3, count_2, count_1;
 
         /* Disabling Reset, LP and IRQC */
-        outb(RESET_LP_IRQC_DISABLE, chip->vendor->base + CMD);
+        outb(RESET_LP_IRQC_DISABLE, chip->vendor.base + CMD);
 
         ret = empty_fifo(chip, 1);
         if (ret) {
@@ -319,7 +320,7 @@ static void tpm_inf_cancel(struct tpm_chip *chip)
 
 static u8 tpm_inf_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + STAT);
+        return inb(chip->vendor.base + STAT);
 }
 
 static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
@@ -346,7 +347,7 @@ static struct file_operations inf_ops = {
         .release = tpm_release,
 };
 
-static struct tpm_vendor_specific tpm_inf = {
+static const struct tpm_vendor_specific tpm_inf = {
         .recv = tpm_inf_recv,
         .send = tpm_inf_send,
         .cancel = tpm_inf_cancel,
@@ -375,6 +376,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         int version[2];
         int productid[2];
         char chipname[20];
+        struct tpm_chip *chip;
 
         /* read IO-ports through PnP */
         if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
@@ -395,14 +397,13 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         goto err_last;
                 }
                 /* publish my base address and request region */
-                tpm_inf.base = TPM_INF_BASE;
                 if (request_region
-                    (tpm_inf.base, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
+                    (TPM_INF_BASE, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
                         rc = -EINVAL;
                         goto err_last;
                 }
-                if (request_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN,
-                                "tpm_infineon0") == NULL) {
+                if (request_region
+                    (TPM_INF_ADDR, TPM_INF_ADDR_LEN, "tpm_infineon0") == NULL) {
                         rc = -EINVAL;
                         goto err_last;
                 }
@@ -442,9 +443,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
 
                 /* configure TPM with IO-ports */
                 outb(IOLIMH, TPM_INF_ADDR);
-                outb(((tpm_inf.base >> 8) & 0xff), TPM_INF_DATA);
+                outb(((TPM_INF_BASE >> 8) & 0xff), TPM_INF_DATA);
                 outb(IOLIML, TPM_INF_ADDR);
-                outb((tpm_inf.base & 0xff), TPM_INF_DATA);
+                outb((TPM_INF_BASE & 0xff), TPM_INF_DATA);
 
                 /* control if IO-ports are set correctly */
                 outb(IOLIMH, TPM_INF_ADDR);
@@ -452,10 +453,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                 outb(IOLIML, TPM_INF_ADDR);
                 iol = inb(TPM_INF_DATA);
 
-                if ((ioh << 8 | iol) != tpm_inf.base) {
+                if ((ioh << 8 | iol) != TPM_INF_BASE) {
                         dev_err(&dev->dev,
-                                "Could not set IO-ports to 0x%lx\n",
-                                tpm_inf.base);
+                                "Could not set IO-ports to 0x%x\n",
+                                TPM_INF_BASE);
                         rc = -EIO;
                         goto err_release_region;
                 }
@@ -466,15 +467,15 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                 outb(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
 
                 /* disable RESET, LP and IRQC */
-                outb(RESET_LP_IRQC_DISABLE, tpm_inf.base + CMD);
+                outb(RESET_LP_IRQC_DISABLE, TPM_INF_BASE + CMD);
 
                 /* Finally, we're done, print some infos */
                 dev_info(&dev->dev, "TPM found: "
                          "config base 0x%x, "
                          "io base 0x%x, "
-                         "chip version %02x%02x, "
-                         "vendor id %x%x (Infineon), "
-                         "product id %02x%02x"
+                         "chip version 0x%02x%02x, "
+                         "vendor id 0x%x%x (Infineon), "
+                         "product id 0x%02x%02x"
                          "%s\n",
                          TPM_INF_ADDR,
                          TPM_INF_BASE,
@@ -482,11 +483,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                          vendorid[0], vendorid[1],
                          productid[0], productid[1], chipname);
 
-                rc = tpm_register_hardware(&dev->dev, &tpm_inf);
-                if (rc < 0) {
-                        rc = -ENODEV;
+                if (!(chip = tpm_register_hardware(&dev->dev, &tpm_inf))) {
                         goto err_release_region;
                 }
+                chip->vendor.base = TPM_INF_BASE;
                 return 0;
         } else {
                 rc = -ENODEV;
@@ -494,7 +494,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         }
 
 err_release_region:
-        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
+        release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
         release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
 
 err_last:
@@ -506,7 +506,8 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
         struct tpm_chip *chip = pnp_get_drvdata(dev);
 
         if (chip) {
-                release_region(chip->vendor->base, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
                 tpm_remove_hardware(chip->dev);
         }
 }
@@ -520,7 +521,7 @@ static struct pnp_driver tpm_inf_pnp = {
         },
         .id_table = tpm_pnp_tbl,
         .probe = tpm_inf_pnp_probe,
-        .remove = tpm_inf_pnp_remove,
+        .remove = __devexit_p(tpm_inf_pnp_remove),
 };
 
 static int __init init_inf(void)
@@ -538,5 +539,5 @@ module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.7");
+MODULE_VERSION("1.8");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 680a8e331887..4c8bc06c7d95 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -71,7 +71,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
         unsigned long stop;
 
         /* status immediately available check */
-        *data = inb(chip->vendor->base + NSC_STATUS);
+        *data = inb(chip->vendor.base + NSC_STATUS);
         if ((*data & mask) == val)
                 return 0;
 
@@ -79,7 +79,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
         stop = jiffies + 10 * HZ;
         do {
                 msleep(TPM_TIMEOUT);
-                *data = inb(chip->vendor->base + 1);
+                *data = inb(chip->vendor.base + 1);
                 if ((*data & mask) == val)
                         return 0;
         }
@@ -94,9 +94,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
         unsigned long stop;
 
         /* status immediately available check */
-        status = inb(chip->vendor->base + NSC_STATUS);
+        status = inb(chip->vendor.base + NSC_STATUS);
         if (status & NSC_STATUS_OBF)
-                status = inb(chip->vendor->base + NSC_DATA);
+                status = inb(chip->vendor.base + NSC_DATA);
         if (status & NSC_STATUS_RDY)
                 return 0;
 
@@ -104,9 +104,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
         stop = jiffies + 100;
         do {
                 msleep(TPM_TIMEOUT);
-                status = inb(chip->vendor->base + NSC_STATUS);
+                status = inb(chip->vendor.base + NSC_STATUS);
                 if (status & NSC_STATUS_OBF)
-                        status = inb(chip->vendor->base + NSC_DATA);
+                        status = inb(chip->vendor.base + NSC_DATA);
                 if (status & NSC_STATUS_RDY)
                         return 0;
         }
@@ -132,7 +132,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 return -EIO;
         }
         if ((data =
-             inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
+             inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
                 dev_err(chip->dev, "not in normal mode (0x%x)\n",
                         data);
                 return -EIO;
@@ -148,7 +148,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 }
                 if (data & NSC_STATUS_F0)
                         break;
-                *p = inb(chip->vendor->base + NSC_DATA);
+                *p = inb(chip->vendor.base + NSC_DATA);
         }
 
         if ((data & NSC_STATUS_F0) == 0 &&
@@ -156,7 +156,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 dev_err(chip->dev, "F0 not set\n");
                 return -EIO;
         }
-        if ((data = inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_EOC) {
+        if ((data = inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_EOC) {
                 dev_err(chip->dev,
                         "expected end of command(0x%x)\n", data);
                 return -EIO;
@@ -182,7 +182,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
          * fix it. Not sure why this is needed, we followed the flow
          * chart in the manual to the letter.
          */
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 
         if (nsc_wait_for_ready(chip) != 0)
                 return -EIO;
@@ -192,7 +192,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                 return -EIO;
         }
 
-        outb(NSC_COMMAND_NORMAL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_NORMAL, chip->vendor.base + NSC_COMMAND);
         if (wait_for_stat(chip, NSC_STATUS_IBR, NSC_STATUS_IBR, &data) < 0) {
                 dev_err(chip->dev, "IBR timeout\n");
                 return -EIO;
@@ -204,26 +204,26 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                                 "IBF timeout (while writing data)\n");
                         return -EIO;
                 }
-                outb(buf[i], chip->vendor->base + NSC_DATA);
+                outb(buf[i], chip->vendor.base + NSC_DATA);
         }
 
         if (wait_for_stat(chip, NSC_STATUS_IBF, 0, &data) < 0) {
                 dev_err(chip->dev, "IBF timeout\n");
                 return -EIO;
         }
-        outb(NSC_COMMAND_EOC, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_EOC, chip->vendor.base + NSC_COMMAND);
 
         return count;
 }
 
 static void tpm_nsc_cancel(struct tpm_chip *chip)
 {
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 }
 
 static u8 tpm_nsc_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + NSC_STATUS);
+        return inb(chip->vendor.base + NSC_STATUS);
 }
 
 static struct file_operations nsc_ops = {
@@ -250,7 +250,7 @@ static struct attribute * nsc_attrs[] = {
 
 static struct attribute_group nsc_attr_grp = { .attrs = nsc_attrs };
 
-static struct tpm_vendor_specific tpm_nsc = {
+static const struct tpm_vendor_specific tpm_nsc = {
         .recv = tpm_nsc_recv,
         .send = tpm_nsc_send,
         .cancel = tpm_nsc_cancel,
@@ -268,7 +268,7 @@ static void __devexit tpm_nsc_remove(struct device *dev)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
         if ( chip ) {
-                release_region(chip->vendor->base, 2);
+                release_region(chip->vendor.base, 2);
                 tpm_remove_hardware(chip->dev);
         }
 }
@@ -286,7 +286,8 @@ static int __init init_nsc(void)
         int rc = 0;
         int lo, hi;
         int nscAddrBase = TPM_ADDR;
-
+        struct tpm_chip *chip;
+        unsigned long base;
 
         /* verify that it is a National part (SID) */
         if (tpm_read_index(TPM_ADDR, NSC_SID_INDEX) != 0xEF) {
@@ -300,7 +301,7 @@ static int __init init_nsc(void)
 
         hi = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_HI);
         lo = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_LO);
-        tpm_nsc.base = (hi<<8) | lo;
+        base = (hi<<8) | lo;
 
         /* enable the DPM module */
         tpm_write_index(nscAddrBase, NSC_LDC_INDEX, 0x01);
@@ -320,13 +321,15 @@ static int __init init_nsc(void)
         if ((rc = platform_device_register(pdev)) < 0)
                 goto err_free_dev;
 
-        if (request_region(tpm_nsc.base, 2, "tpm_nsc0") == NULL ) {
+        if (request_region(base, 2, "tpm_nsc0") == NULL ) {
                 rc = -EBUSY;
                 goto err_unreg_dev;
         }
 
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_nsc)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_nsc))) {
+                rc = -ENODEV;
                 goto err_rel_reg;
+        }
 
         dev_dbg(&pdev->dev, "NSC TPM detected\n");
         dev_dbg(&pdev->dev,
@@ -361,10 +364,12 @@ static int __init init_nsc(void)
                  "NSC TPM revision %d\n",
                  tpm_read_index(nscAddrBase, 0x27) & 0x1F);
 
+        chip->vendor.base = base;
+
         return 0;
 
 err_rel_reg:
-        release_region(tpm_nsc.base, 2);
+        release_region(base, 2);
 err_unreg_dev:
         platform_device_unregister(pdev);
 err_free_dev:
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
new file mode 100644
index 000000000000..b9cae9a238bb
--- /dev/null
+++ b/drivers/char/tpm/tpm_tis.c
@@ -0,0 +1,669 @@
+/*
+ * Copyright (C) 2005, 2006 IBM Corporation
+ *
+ * Authors:
+ * Leendert van Doorn <leendert@watson.ibm.com>
+ * Kylene Hall <kjhall@us.ibm.com>
+ *
+ * Device driver for TCG/TCPA TPM (trusted platform module).
+ * Specifications at www.trustedcomputinggroup.org
+ *
+ * This device driver implements the TPM interface as defined in
+ * the TCG TPM Interface Spec version 1.2, revision 1.0.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/pnp.h>
+#include <linux/interrupt.h>
+#include <linux/wait.h>
+#include "tpm.h"
+
+#define TPM_HEADER_SIZE 10
+
+enum tis_access {
+        TPM_ACCESS_VALID = 0x80,
+        TPM_ACCESS_ACTIVE_LOCALITY = 0x20,
+        TPM_ACCESS_REQUEST_PENDING = 0x04,
+        TPM_ACCESS_REQUEST_USE = 0x02,
+};
+
+enum tis_status {
+        TPM_STS_VALID = 0x80,
+        TPM_STS_COMMAND_READY = 0x40,
+        TPM_STS_GO = 0x20,
+        TPM_STS_DATA_AVAIL = 0x10,
+        TPM_STS_DATA_EXPECT = 0x08,
+};
+
+enum tis_int_flags {
+        TPM_GLOBAL_INT_ENABLE = 0x80000000,
+        TPM_INTF_BURST_COUNT_STATIC = 0x100,
+        TPM_INTF_CMD_READY_INT = 0x080,
+        TPM_INTF_INT_EDGE_FALLING = 0x040,
+        TPM_INTF_INT_EDGE_RISING = 0x020,
+        TPM_INTF_INT_LEVEL_LOW = 0x010,
+        TPM_INTF_INT_LEVEL_HIGH = 0x008,
+        TPM_INTF_LOCALITY_CHANGE_INT = 0x004,
+        TPM_INTF_STS_VALID_INT = 0x002,
+        TPM_INTF_DATA_AVAIL_INT = 0x001,
+};
+
+enum tis_defaults {
+        TIS_MEM_BASE = 0xFED4000,
+        TIS_MEM_LEN = 0x5000,
+        TIS_SHORT_TIMEOUT = 750,        /* ms */
+        TIS_LONG_TIMEOUT = 2000,        /* 2 sec */
+};
+
+#define TPM_ACCESS(l)                   (0x0000 | ((l) << 12))
+#define TPM_INT_ENABLE(l)               (0x0008 | ((l) << 12))
+#define TPM_INT_VECTOR(l)               (0x000C | ((l) << 12))
+#define TPM_INT_STATUS(l)               (0x0010 | ((l) << 12))
+#define TPM_INTF_CAPS(l)                (0x0014 | ((l) << 12))
+#define TPM_STS(l)                      (0x0018 | ((l) << 12))
+#define TPM_DATA_FIFO(l)                (0x0024 | ((l) << 12))
+
+#define TPM_DID_VID(l)                  (0x0F00 | ((l) << 12))
+#define TPM_RID(l)                      (0x0F04 | ((l) << 12))
+
+static LIST_HEAD(tis_chips);
+static DEFINE_SPINLOCK(tis_lock);
+
+static int check_locality(struct tpm_chip *chip, int l)
+{
+        if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+             (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID))
+                return chip->vendor.locality = l;
+
+        return -1;
+}
+
+static void release_locality(struct tpm_chip *chip, int l, int force)
+{
+        if (force || (ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+                      (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID))
+                iowrite8(TPM_ACCESS_ACTIVE_LOCALITY,
+                         chip->vendor.iobase + TPM_ACCESS(l));
+}
+
+static int request_locality(struct tpm_chip *chip, int l)
+{
+        unsigned long stop;
+        long rc;
+
+        if (check_locality(chip, l) >= 0)
+                return l;
+
+        iowrite8(TPM_ACCESS_REQUEST_USE,
+                 chip->vendor.iobase + TPM_ACCESS(l));
+
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(chip->vendor.int_queue,
+                                                      (check_locality
+                                                       (chip, l) >= 0),
+                                                      chip->vendor.timeout_a);
+                if (rc > 0)
+                        return l;
+
+        } else {
+                /* wait for burstcount */
+                stop = jiffies + chip->vendor.timeout_a;
+                do {
+                        if (check_locality(chip, l) >= 0)
+                                return l;
+                        msleep(TPM_TIMEOUT);
+                }
+                while (time_before(jiffies, stop));
+        }
+        return -1;
+}
+
+static u8 tpm_tis_status(struct tpm_chip *chip)
+{
+        return ioread8(chip->vendor.iobase +
+                       TPM_STS(chip->vendor.locality));
+}
+
+static void tpm_tis_ready(struct tpm_chip *chip)
+{
+        /* this causes the current command to be aborted */
+        iowrite8(TPM_STS_COMMAND_READY,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+}
+
+static int get_burstcount(struct tpm_chip *chip)
+{
+        unsigned long stop;
+        int burstcnt;
+
+        /* wait for burstcount */
+        /* which timeout value, spec has 2 answers (c & d) */
+        stop = jiffies + chip->vendor.timeout_d;
+        do {
+                burstcnt = ioread8(chip->vendor.iobase +
+                                   TPM_STS(chip->vendor.locality) + 1);
+                burstcnt += ioread8(chip->vendor.iobase +
+                                    TPM_STS(chip->vendor.locality) +
+                                    2) << 8;
+                if (burstcnt)
+                        return burstcnt;
+                msleep(TPM_TIMEOUT);
+        } while (time_before(jiffies, stop));
+        return -EBUSY;
+}
+
+static int wait_for_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
+                         wait_queue_head_t *queue)
+{
+        unsigned long stop;
+        long rc;
+        u8 status;
+
+        /* check current status */
+        status = tpm_tis_status(chip);
+        if ((status & mask) == mask)
+                return 0;
+
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(*queue,
+                                                      ((tpm_tis_status
+                                                        (chip) & mask) ==
+                                                       mask), timeout);
+                if (rc > 0)
+                        return 0;
+        } else {
+                stop = jiffies + timeout;
+                do {
+                        msleep(TPM_TIMEOUT);
+                        status = tpm_tis_status(chip);
+                        if ((status & mask) == mask)
+                                return 0;
+                } while (time_before(jiffies, stop));
+        }
+        return -ETIME;
+}
+
+static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0, burstcnt;
+        while (size < count &&
+               wait_for_stat(chip,
+                             TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                             chip->vendor.timeout_c,
+                             &chip->vendor.read_queue)
+               == 0) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && size < count; burstcnt--)
+                        buf[size++] = ioread8(chip->vendor.iobase +
+                                              TPM_DATA_FIFO(chip->vendor.
+                                                            locality));
+        }
+        return size;
+}
+
+static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0;
+        int expected, status;
+
+        if (count < TPM_HEADER_SIZE) {
+                size = -EIO;
+                goto out;
+        }
+
+        /* read first 10 bytes, including tag, paramsize, and result */
+        if ((size =
+             recv_data(chip, buf, TPM_HEADER_SIZE)) < TPM_HEADER_SIZE) {
+                dev_err(chip->dev, "Unable to read header\n");
+                goto out;
+        }
+
+        expected = be32_to_cpu(*(__be32 *) (buf + 2));
+        if (expected > count) {
+                size = -EIO;
+                goto out;
+        }
+
+        if ((size +=
+             recv_data(chip, &buf[TPM_HEADER_SIZE],
+                       expected - TPM_HEADER_SIZE)) < expected) {
+                dev_err(chip->dev, "Unable to read remainder of result\n");
+                size = -ETIME;
+                goto out;
+        }
+
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if (status & TPM_STS_DATA_AVAIL) {      /* retry? */
+                dev_err(chip->dev, "Error left over data\n");
+                size = -EIO;
+                goto out;
+        }
+
+out:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return size;
+}
+
+/*
+ * If interrupts are used (signaled by an irq set in the vendor structure)
+ * tpm.c can skip polling for the data to be available as the interrupt is
+ * waited for here
+ */
+static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
+{
+        int rc, status, burstcnt;
+        size_t count = 0;
+        u32 ordinal;
+
+        if (request_locality(chip, 0) < 0)
+                return -EBUSY;
+
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_COMMAND_READY) == 0) {
+                tpm_tis_ready(chip);
+                if (wait_for_stat
+                    (chip, TPM_STS_COMMAND_READY, chip->vendor.timeout_b,
+                     &chip->vendor.int_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+
+        while (count < len - 1) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && count < len - 1; burstcnt--) {
+                        iowrite8(buf[count], chip->vendor.iobase +
+                                 TPM_DATA_FIFO(chip->vendor.locality));
+                        count++;
+                }
+
+                wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                              &chip->vendor.int_queue);
+                status = tpm_tis_status(chip);
+                if ((status & TPM_STS_DATA_EXPECT) == 0) {
+                        rc = -EIO;
+                        goto out_err;
+                }
+        }
+
+        /* write last byte */
+        iowrite8(buf[count],
+                 chip->vendor.iobase +
+                 TPM_DATA_FIFO(chip->vendor.locality));
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_DATA_EXPECT) != 0) {
+                rc = -EIO;
+                goto out_err;
+        }
+
+        /* go and do it */
+        iowrite8(TPM_STS_GO,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+
+        if (chip->vendor.irq) {
+                ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
+                if (wait_for_stat
+                    (chip, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                     tpm_calc_ordinal_duration(chip, ordinal),
+                     &chip->vendor.read_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+        return len;
+out_err:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return rc;
+}
+
+static struct file_operations tis_ops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .open = tpm_open,
+        .read = tpm_read,
+        .write = tpm_write,
+        .release = tpm_release,
+};
+
+static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
+static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL);
+static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
+static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
+static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
+static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
+                   NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+
+static struct attribute *tis_attrs[] = {
+        &dev_attr_pubek.attr,
+        &dev_attr_pcrs.attr,
+        &dev_attr_enabled.attr,
+        &dev_attr_active.attr,
+        &dev_attr_owned.attr,
+        &dev_attr_temp_deactivated.attr,
+        &dev_attr_caps.attr,
+        &dev_attr_cancel.attr, NULL,
+};
+
+static struct attribute_group tis_attr_grp = {
+        .attrs = tis_attrs
+};
+
+static struct tpm_vendor_specific tpm_tis = {
+        .status = tpm_tis_status,
+        .recv = tpm_tis_recv,
+        .send = tpm_tis_send,
+        .cancel = tpm_tis_ready,
+        .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_canceled = TPM_STS_COMMAND_READY,
+        .attr_group = &tis_attr_grp,
+        .miscdev = {
+                    .fops = &tis_ops,},
+};
+
+static irqreturn_t tis_int_probe(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+
+        if (interrupt == 0)
+                return IRQ_NONE;
+
+        chip->vendor.irq = irq;
+
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t tis_int_handler(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+        int i;
+
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+
+        if (interrupt == 0)
+                return IRQ_NONE;
+
+        if (interrupt & TPM_INTF_DATA_AVAIL_INT)
+                wake_up_interruptible(&chip->vendor.read_queue);
+        if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
+                for (i = 0; i < 5; i++)
+                        if (check_locality(chip, i) >= 0)
+                                break;
+        if (interrupt &
+            (TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_STS_VALID_INT |
+             TPM_INTF_CMD_READY_INT))
+                wake_up_interruptible(&chip->vendor.int_queue);
+
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+
+static int interrupts = 1;
+module_param(interrupts, bool, 0444);
+MODULE_PARM_DESC(interrupts, "Enable interrupts");
+
+static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
+                                      const struct pnp_device_id *pnp_id)
+{
+        u32 vendor, intfcaps, intmask;
+        int rc, i;
+        unsigned long start, len;
+        struct tpm_chip *chip;
+
+        start = pnp_mem_start(pnp_dev, 0);
+        len = pnp_mem_len(pnp_dev, 0);
+
+        if (!start)
+                start = TIS_MEM_BASE;
+        if (!len)
+                len = TIS_MEM_LEN;
+
+        if (!(chip = tpm_register_hardware(&pnp_dev->dev, &tpm_tis)))
+                return -ENODEV;
+
+        chip->vendor.iobase = ioremap(start, len);
+        if (!chip->vendor.iobase) {
+                rc = -EIO;
+                goto out_err;
+        }
+
+        vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+        if ((vendor & 0xFFFF) == 0xFFFF) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        /* Default timeouts */
+        chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
+        chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+
+        dev_info(&pnp_dev->dev,
+                 "1.2 TPM (device-id 0x%X, rev-id %d)\n",
+                 vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+
+        /* Figure out the capabilities */
+        intfcaps =
+            ioread32(chip->vendor.iobase +
+                     TPM_INTF_CAPS(chip->vendor.locality));
+        dev_dbg(&pnp_dev->dev, "TPM interface capabilities (0x%x):\n",
+                intfcaps);
+        if (intfcaps & TPM_INTF_BURST_COUNT_STATIC)
+                dev_dbg(&pnp_dev->dev, "\tBurst Count Static\n");
+        if (intfcaps & TPM_INTF_CMD_READY_INT)
+                dev_dbg(&pnp_dev->dev, "\tCommand Ready Int Support\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_FALLING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Falling\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_RISING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Rising\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_LOW)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level Low\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_HIGH)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level High\n");
+        if (intfcaps & TPM_INTF_LOCALITY_CHANGE_INT)
+                dev_dbg(&pnp_dev->dev, "\tLocality Change Int Support\n");
+        if (intfcaps & TPM_INTF_STS_VALID_INT)
+                dev_dbg(&pnp_dev->dev, "\tSts Valid Int Support\n");
+        if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
+                dev_dbg(&pnp_dev->dev, "\tData Avail Int Support\n");
+
+        if (request_locality(chip, 0) != 0) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        /* INTERRUPT Setup */
+        init_waitqueue_head(&chip->vendor.read_queue);
+        init_waitqueue_head(&chip->vendor.int_queue);
+
+        intmask =
+            ioread32(chip->vendor.iobase +
+                     TPM_INT_ENABLE(chip->vendor.locality));
+
+        intmask |= TPM_INTF_CMD_READY_INT
+            | TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT
+            | TPM_INTF_STS_VALID_INT;
+
+        iowrite32(intmask,
+                  chip->vendor.iobase +
+                  TPM_INT_ENABLE(chip->vendor.locality));
+        if (interrupts) {
+                chip->vendor.irq =
+                    ioread8(chip->vendor.iobase +
+                            TPM_INT_VECTOR(chip->vendor.locality));
+
+                for (i = 3; i < 16 && chip->vendor.irq == 0; i++) {
+                        iowrite8(i, chip->vendor.iobase +
+                                    TPM_INT_VECTOR(chip->vendor.locality));
+                        if (request_irq
+                            (i, tis_int_probe, SA_SHIRQ,
+                             chip->vendor.miscdev.name, chip) != 0) {
+                                dev_info(chip->dev,
+                                         "Unable to request irq: %d for probe\n",
+                                         i);
+                                continue;
+                        }
+
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+
+                        /* Generate Interrupts */
+                        tpm_gen_interrupt(chip);
+
+                        /* Turn off */
+                        iowrite32(intmask,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                        free_irq(i, chip);
+                }
+        }
+        if (chip->vendor.irq) {
+                iowrite8(chip->vendor.irq,
+                         chip->vendor.iobase +
+                         TPM_INT_VECTOR(chip->vendor.locality));
+                if (request_irq
+                    (chip->vendor.irq, tis_int_handler, SA_SHIRQ,
+                     chip->vendor.miscdev.name, chip) != 0) {
+                        dev_info(chip->dev,
+                                 "Unable to request irq: %d for use\n",
+                                 chip->vendor.irq);
+                        chip->vendor.irq = 0;
+                } else {
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                }
+        }
+
+        INIT_LIST_HEAD(&chip->vendor.list);
+        spin_lock(&tis_lock);
+        list_add(&chip->vendor.list, &tis_chips);
+        spin_unlock(&tis_lock);
+
+        tpm_get_timeouts(chip);
+        tpm_continue_selftest(chip);
+
+        return 0;
+out_err:
+        if (chip->vendor.iobase)
+                iounmap(chip->vendor.iobase);
+        tpm_remove_hardware(chip->dev);
+        return rc;
+}
+
+static int tpm_tis_pnp_suspend(struct pnp_dev *dev, pm_message_t msg)
+{
+        return tpm_pm_suspend(&dev->dev, msg);
+}
+
+static int tpm_tis_pnp_resume(struct pnp_dev *dev)
+{
+        return tpm_pm_resume(&dev->dev);
+}
+
+static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = {
+        {"PNP0C31", 0},         /* TPM */
+        {"ATM1200", 0},         /* Atmel */
+        {"IFX0102", 0},         /* Infineon */
+        {"BCM0101", 0},         /* Broadcom */
+        {"NSC1200", 0},         /* National */
+        /* Add new here */
+        {"", 0},                /* User Specified */
+        {"", 0}                 /* Terminator */
+};
+
+static struct pnp_driver tis_pnp_driver = {
+        .name = "tpm_tis",
+        .id_table = tpm_pnp_tbl,
+        .probe = tpm_tis_pnp_init,
+        .suspend = tpm_tis_pnp_suspend,
+        .resume = tpm_tis_pnp_resume,
+};
+
+#define TIS_HID_USR_IDX sizeof(tpm_pnp_tbl)/sizeof(struct pnp_device_id) -2
+module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
+                    sizeof(tpm_pnp_tbl[TIS_HID_USR_IDX].id), 0444);
+MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
+
+static int __init init_tis(void)
+{
+        return pnp_register_driver(&tis_pnp_driver);
+}
+
+static void __exit cleanup_tis(void)
+{
+        struct tpm_vendor_specific *i, *j;
+        struct tpm_chip *chip;
+        spin_lock(&tis_lock);
+        list_for_each_entry_safe(i, j, &tis_chips, list) {
+                chip = to_tpm_chip(i);
+                iowrite32(~TPM_GLOBAL_INT_ENABLE &
+                          ioread32(chip->vendor.iobase +
+                                   TPM_INT_ENABLE(chip->vendor.
+                                                  locality)),
+                          chip->vendor.iobase +
+                          TPM_INT_ENABLE(chip->vendor.locality));
+                release_locality(chip, chip->vendor.locality, 1);
+                if (chip->vendor.irq)
+                        free_irq(chip->vendor.irq, chip);
+                iounmap(i->iobase);
+                list_del(&i->list);
+                tpm_remove_hardware(chip->dev);
+        }
+        spin_unlock(&tis_lock);
+        pnp_unregister_driver(&tis_pnp_driver);
+}
+
+module_init(init_tis);
+module_exit(cleanup_tis);
+MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
+MODULE_DESCRIPTION("TPM Driver");
+MODULE_VERSION("2.0");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 841f0bd3eaaf..f07637a8f88f 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -2723,7 +2723,11 @@ static void __do_SAK(void *arg)
                 }
                 task_lock(p);
                 if (p->files) {
-                        rcu_read_lock();
+                        /*
+                         * We don't take a ref to the file, so we must
+                         * hold ->file_lock instead.
+                         */
+                        spin_lock(&p->files->file_lock);
                         fdt = files_fdtable(p->files);
                         for (i=0; i < fdt->max_fds; i++) {
                                 filp = fcheck_files(p->files, i);
@@ -2738,7 +2742,7 @@ static void __do_SAK(void *arg)
                                         break;
                                 }
                         }
-                        rcu_read_unlock();
+                        spin_unlock(&p->files->file_lock);
                 }
                 task_unlock(p);
         } while_each_thread(g, p);
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index 60c9be99c6d9..2cc71b66231e 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -99,7 +99,7 @@ config CPU_FREQ_GOV_USERSPACE
           Enable this cpufreq governor when you either want to set the
           CPU frequency manually or when an userspace program shall
           be able to set the CPU dynamically, like on LART 
-          <http://www.lart.tudelft.nl/>
+          <http://www.lartmaker.nl/>.
 
           For details, take a look at <file:Documentation/cpu-freq/>.
 
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 9b6ae7dc8b8a..29b2fa5534ae 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -319,7 +319,6 @@ out:
         }
         return -EINVAL;
 }
-EXPORT_SYMBOL_GPL(cpufreq_parse_governor);
 
 
 /* drivers/base/cpu.c */
@@ -346,6 +345,8 @@ show_one(scaling_min_freq, min);
 show_one(scaling_max_freq, max);
 show_one(scaling_cur_freq, cur);
 
+static int __cpufreq_set_policy(struct cpufreq_policy *data, struct cpufreq_policy *policy);
+
 /**
  * cpufreq_per_cpu_attr_write() / store_##file_name() - sysfs write access
  */
@@ -364,7 +365,10 @@ static ssize_t store_##file_name					\
         if (ret != 1)                                                   \
                 return -EINVAL;                                         \
                                                                         \
-        ret = cpufreq_set_policy(&new_policy);                          \
+        mutex_lock(&policy->lock);                                      \
+        ret = __cpufreq_set_policy(policy, &new_policy);                \
+        policy->user_policy.object = policy->object;                    \
+        mutex_unlock(&policy->lock);                                    \
                                                                         \
         return ret ? ret : count;                                       \
 }
@@ -420,7 +424,15 @@ static ssize_t store_scaling_governor (struct cpufreq_policy * policy,
         if (cpufreq_parse_governor(str_governor, &new_policy.policy, &new_policy.governor))
                 return -EINVAL;
 
-        ret = cpufreq_set_policy(&new_policy);
+        /* Do not use cpufreq_set_policy here or the user_policy.max
+           will be wrongly overridden */
+        mutex_lock(&policy->lock);
+        ret = __cpufreq_set_policy(policy, &new_policy);
+
+        policy->user_policy.policy = policy->policy;
+        policy->user_policy.governor = policy->governor;
+        mutex_unlock(&policy->lock);
+
         return ret ? ret : count;
 }
 
@@ -685,7 +697,7 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                 if (!cpu_online(j))
                         continue;
 
-                dprintk("CPU already managed, adding link\n");
+                dprintk("CPU %u already managed, adding link\n", j);
                 cpufreq_cpu_get(cpu);
                 cpu_sys_dev = get_cpu_sysdev(j);
                 sysfs_create_link(&cpu_sys_dev->kobj, &policy->kobj,
@@ -695,9 +707,8 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
         policy->governor = NULL; /* to assure that the starting sequence is
                                   * run in cpufreq_set_policy */
         mutex_unlock(&policy->lock);
-        
+
         /* set default policy */
-        
         ret = cpufreq_set_policy(&new_policy);
         if (ret) {
                 dprintk("setting policy failed\n");
@@ -707,7 +718,7 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
         module_put(cpufreq_driver->owner);
         dprintk("initialization complete\n");
         cpufreq_debug_enable_ratelimit();
-        
+
         return 0;
 
 
@@ -1486,7 +1497,7 @@ int cpufreq_update_policy(unsigned int cpu)
 }
 EXPORT_SYMBOL(cpufreq_update_policy);
 
-static int __cpuinit cpufreq_cpu_callback(struct notifier_block *nfb,
+static int cpufreq_cpu_callback(struct notifier_block *nfb,
                                         unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 037f6bf4543c..e07a35487bde 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -176,8 +176,7 @@ static ssize_t store_up_threshold(struct cpufreq_policy *unused,
         ret = sscanf (buf, "%u", &input);
 
         mutex_lock(&dbs_mutex);
-        if (ret != 1 || input > 100 || input < 0 ||
-                        input <= dbs_tuners_ins.down_threshold) {
+        if (ret != 1 || input > 100 || input <= dbs_tuners_ins.down_threshold) {
                 mutex_unlock(&dbs_mutex);
                 return -EINVAL;
         }
@@ -196,8 +195,7 @@ static ssize_t store_down_threshold(struct cpufreq_policy *unused,
         ret = sscanf (buf, "%u", &input);
 
         mutex_lock(&dbs_mutex);
-        if (ret != 1 || input > 100 || input < 0 ||
-                        input >= dbs_tuners_ins.up_threshold) {
+        if (ret != 1 || input > 100 || input >= dbs_tuners_ins.up_threshold) {
                 mutex_unlock(&dbs_mutex);
                 return -EINVAL;
         }
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 8e0f3158215f..dfca74933625 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -478,6 +478,11 @@ static s32 i801_access(struct i2c_adapter * adap, u16 addr,
                 ret = i801_transaction();
         }
 
+        /* Some BIOSes don't like it when PEC is enabled at reboot or resume
+           time, so we forcibly disable it after every transaction. */
+        if (hwpec)
+                outb_p(0, SMBAUXCTL);
+
         if(block)
                 return ret;
         if(ret)
diff --git a/drivers/i2c/chips/m41t00.c b/drivers/i2c/chips/m41t00.c
index 27fc9ff2961a..99ab4ec34390 100644
--- a/drivers/i2c/chips/m41t00.c
+++ b/drivers/i2c/chips/m41t00.c
@@ -131,13 +131,13 @@ m41t00_set(void *arg)
         if ((i2c_smbus_write_byte_data(save_client, 0, tm.tm_sec & 0x7f) < 0)
                 || (i2c_smbus_write_byte_data(save_client, 1, tm.tm_min & 0x7f)
                         < 0)
-                || (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x7f)
+                || (i2c_smbus_write_byte_data(save_client, 2, tm.tm_hour & 0x3f)
                         < 0)
-                || (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x7f)
+                || (i2c_smbus_write_byte_data(save_client, 4, tm.tm_mday & 0x3f)
                         < 0)
-                || (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x7f)
+                || (i2c_smbus_write_byte_data(save_client, 5, tm.tm_mon & 0x1f)
                         < 0)
-                || (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0x7f)
+                || (i2c_smbus_write_byte_data(save_client, 6, tm.tm_year & 0xff)
                         < 0))
 
                 dev_warn(&save_client->dev,"m41t00: can't write to rtc chip\n");
diff --git a/drivers/ide/pci/alim15x3.c b/drivers/ide/pci/alim15x3.c
index cf84350efc55..8b24b4f2a839 100644
--- a/drivers/ide/pci/alim15x3.c
+++ b/drivers/ide/pci/alim15x3.c
@@ -731,6 +731,8 @@ static unsigned int __devinit ata66_ali15x3 (ide_hwif_t *hwif)
         
         if(m5229_revision <= 0x20)
                 tmpbyte = (tmpbyte & (~0x02)) | 0x01;
+        else if (m5229_revision == 0xc7)
+                tmpbyte |= 0x03;
         else
                 tmpbyte |= 0x01;
 
diff --git a/drivers/ide/pci/atiixp.c b/drivers/ide/pci/atiixp.c
index df9ee9a78435..900efd1da587 100644
--- a/drivers/ide/pci/atiixp.c
+++ b/drivers/ide/pci/atiixp.c
@@ -348,6 +348,7 @@ static struct pci_device_id atiixp_pci_tbl[] = {
         { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP200_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP300_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP600_IDE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, atiixp_pci_tbl);
diff --git a/drivers/ide/pci/pdc202xx_old.c b/drivers/ide/pci/pdc202xx_old.c
index 6f8f8645b02c..7ce5bf783688 100644
--- a/drivers/ide/pci/pdc202xx_old.c
+++ b/drivers/ide/pci/pdc202xx_old.c
@@ -798,7 +798,6 @@ static ide_pci_device_t pdc202xx_chipsets[] __devinitdata = {
                 .autodma        = AUTODMA,
                 .bootable       = OFF_BOARD,
                 .extra          = 48,
-                .flags          = IDEPCI_FLAG_FORCE_PDC,
         },{     /* 2 */
                 .name           = "PDC20263",
                 .init_setup     = init_setup_pdc202ata4,
@@ -819,7 +818,6 @@ static ide_pci_device_t pdc202xx_chipsets[] __devinitdata = {
                 .autodma        = AUTODMA,
                 .bootable       = OFF_BOARD,
                 .extra          = 48,
-                .flags          = IDEPCI_FLAG_FORCE_PDC,
         },{     /* 4 */
                 .name           = "PDC20267",
                 .init_setup     = init_setup_pdc202xx,
diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
index 7ebf992e8c2f..462ed3006c30 100644
--- a/drivers/ide/setup-pci.c
+++ b/drivers/ide/setup-pci.c
@@ -580,7 +580,6 @@ void ide_pci_setup_ports(struct pci_dev *dev, ide_pci_device_t *d, int pciirq, a
         int port;
         int at_least_one_hwif_enabled = 0;
         ide_hwif_t *hwif, *mate = NULL;
-        static int secondpdc = 0;
         u8 tmp;
 
         index->all = 0xf0f0;
@@ -592,21 +591,9 @@ void ide_pci_setup_ports(struct pci_dev *dev, ide_pci_device_t *d, int pciirq, a
         for (port = 0; port <= 1; ++port) {
                 ide_pci_enablebit_t *e = &(d->enablebits[port]);
         
-                /* 
-                 * If this is a Promise FakeRaid controller,
-                 * the 2nd controller will be marked as 
-                 * disabled while it is actually there and enabled
-                 * by the bios for raid purposes. 
-                 * Skip the normal "is it enabled" test for those.
-                 */
-                if ((d->flags & IDEPCI_FLAG_FORCE_PDC) &&
-                    (secondpdc++==1) && (port==1))
-                        goto controller_ok;
-                        
                 if (e->reg && (pci_read_config_byte(dev, e->reg, &tmp) ||
                     (tmp & e->mask) != e->val))
                         continue;       /* port not enabled */
-controller_ok:
 
                 if (d->channels <= port)
                         break;
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 3a702da83e41..469b6923a2e2 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -228,10 +228,7 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
                                 goto error1;
                 }
                 /* Make sure class supplied is consistent with RMPP */
-                if (ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
-                        if (!rmpp_version)
-                                goto error1;
-                } else {
+                if (!ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
                         if (rmpp_version)
                                 goto error1;
                 }
diff --git a/drivers/infiniband/hw/ipath/ipath_debug.h b/drivers/infiniband/hw/ipath/ipath_debug.h
index 593e28969c69..46762387f5f8 100644
--- a/drivers/infiniband/hw/ipath/ipath_debug.h
+++ b/drivers/infiniband/hw/ipath/ipath_debug.h
@@ -60,11 +60,11 @@
 #define __IPATH_KERNEL_SEND 0x2000      /* use kernel mode send */
 #define __IPATH_EPKTDBG     0x4000      /* print ethernet packet data */
 #define __IPATH_SMADBG      0x8000      /* sma packet debug */
-#define __IPATH_IPATHDBG    0x10000     /* Ethernet (IPATH) general debug on */
-#define __IPATH_IPATHWARN   0x20000     /* Ethernet (IPATH) warnings on */
-#define __IPATH_IPATHERR    0x40000     /* Ethernet (IPATH) errors on */
-#define __IPATH_IPATHPD     0x80000     /* Ethernet (IPATH) packet dump on */
-#define __IPATH_IPATHTABLE  0x100000    /* Ethernet (IPATH) table dump on */
+#define __IPATH_IPATHDBG    0x10000     /* Ethernet (IPATH) gen debug */
+#define __IPATH_IPATHWARN   0x20000     /* Ethernet (IPATH) warnings */
+#define __IPATH_IPATHERR    0x40000     /* Ethernet (IPATH) errors */
+#define __IPATH_IPATHPD     0x80000     /* Ethernet (IPATH) packet dump */
+#define __IPATH_IPATHTABLE  0x100000    /* Ethernet (IPATH) table dump */
 
 #else                           /* _IPATH_DEBUGGING */
 
@@ -79,11 +79,12 @@
 #define __IPATH_TRSAMPLE  0x0   /* generate trace buffer sample entries */
 #define __IPATH_VERBDBG   0x0   /* very verbose debug */
 #define __IPATH_PKTDBG    0x0   /* print packet data */
-#define __IPATH_PROCDBG   0x0   /* print process startup (init)/exit messages */
+#define __IPATH_PROCDBG   0x0   /* process startup (init)/exit messages */
 /* print mmap/nopage stuff, not using VDBG any more */
 #define __IPATH_MMDBG     0x0
 #define __IPATH_EPKTDBG   0x0   /* print ethernet packet data */
-#define __IPATH_SMADBG    0x0   /* print process startup (init)/exit messages */#define __IPATH_IPATHDBG  0x0   /* Ethernet (IPATH) table dump on */
+#define __IPATH_SMADBG    0x0   /* process startup (init)/exit messages */
+#define __IPATH_IPATHDBG  0x0   /* Ethernet (IPATH) table dump on */
 #define __IPATH_IPATHWARN 0x0   /* Ethernet (IPATH) warnings on   */
 #define __IPATH_IPATHERR  0x0   /* Ethernet (IPATH) errors on   */
 #define __IPATH_IPATHPD   0x0   /* Ethernet (IPATH) packet dump on   */
diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
index cd533cf951c2..28ddceb260e8 100644
--- a/drivers/infiniband/hw/ipath/ipath_diag.c
+++ b/drivers/infiniband/hw/ipath/ipath_diag.c
@@ -277,13 +277,14 @@ static int ipath_diag_open(struct inode *in, struct file *fp)
 
 bail:
         spin_unlock_irqrestore(&ipath_devs_lock, flags);
-        mutex_unlock(&ipath_mutex);
 
         /* Only expose a way to reset the device if we
            make it into diag mode. */
         if (ret == 0)
                 ipath_expose_reset(&dd->pcidev->dev);
 
+        mutex_unlock(&ipath_mutex);
+
         return ret;
 }
 
@@ -365,15 +366,3 @@ static ssize_t ipath_diag_write(struct file *fp, const char __user *data,
 bail:
         return ret;
 }
-
-void ipath_diag_bringup_link(struct ipath_devdata *dd)
-{
-        if (diag_set_link || (dd->ipath_flags & IPATH_LINKACTIVE))
-                return;
-
-        diag_set_link = 1;
-        ipath_cdbg(VERBOSE, "Trying to set to set link active for "
-                   "diag pkt\n");
-        ipath_layer_set_linkstate(dd, IPATH_IB_LINKARM);
-        ipath_layer_set_linkstate(dd, IPATH_IB_LINKACTIVE);
-}
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 58a94efb0070..398add4d4cb1 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -418,9 +418,19 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
 
         ret = pci_set_dma_mask(pdev, DMA_64BIT_MASK);
         if (ret) {
-                dev_info(&pdev->dev, "pci_set_dma_mask unit %u "
-                         "fails: %d\n", dd->ipath_unit, ret);
-                goto bail_regions;
+                /*
+                 * if the 64 bit setup fails, try 32 bit.  Some systems
+                 * do not setup 64 bit maps on systems with 2GB or less
+                 * memory installed.
+                 */
+                ret = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
+                if (ret) {
+                        dev_info(&pdev->dev, "pci_set_dma_mask unit %u "
+                                 "fails: %d\n", dd->ipath_unit, ret);
+                        goto bail_regions;
+                }
+                else
+                        ipath_dbg("No 64bit DMA mask, used 32 bit mask\n");
         }
 
         pci_set_master(pdev);
@@ -1729,7 +1739,7 @@ void ipath_free_pddata(struct ipath_devdata *dd, u32 port, int freehdrq)
         }
 }
 
-int __init infinipath_init(void)
+static int __init infinipath_init(void)
 {
         int ret;
 
@@ -1949,7 +1959,7 @@ int ipath_reset_device(int unit)
         }
 
         if (dd->ipath_pd)
-                for (i = 1; i < dd->ipath_portcnt; i++) {
+                for (i = 1; i < dd->ipath_cfgports; i++) {
                         if (dd->ipath_pd[i] && dd->ipath_pd[i]->port_cnt) {
                                 ipath_dbg("unit %u port %d is in use "
                                           "(PID %u cmd %s), can't reset\n",
diff --git a/drivers/infiniband/hw/ipath/ipath_init_chip.c b/drivers/infiniband/hw/ipath/ipath_init_chip.c
index 2823ff9c0c62..16f640e1c16e 100644
--- a/drivers/infiniband/hw/ipath/ipath_init_chip.c
+++ b/drivers/infiniband/hw/ipath/ipath_init_chip.c
@@ -53,13 +53,19 @@ MODULE_PARM_DESC(cfgports, "Set max number of ports to use");
 
 /*
  * Number of buffers reserved for driver (layered drivers and SMA
- * send).  Reserved at end of buffer list.
+ * send).  Reserved at end of buffer list.   Initialized based on
+ * number of PIO buffers if not set via module interface.
+ * The problem with this is that it's global, but we'll use different
+ * numbers for different chip types.  So the default value is not
+ * very useful.  I've redefined it for the 1.3 release so that it's
+ * zero unless set by the user to something else, in which case we
+ * try to respect it.
  */
-static ushort ipath_kpiobufs = 32;
+static ushort ipath_kpiobufs;
 
 static int ipath_set_kpiobufs(const char *val, struct kernel_param *kp);
 
-module_param_call(kpiobufs, ipath_set_kpiobufs, param_get_uint,
+module_param_call(kpiobufs, ipath_set_kpiobufs, param_get_ushort,
                   &ipath_kpiobufs, S_IWUSR | S_IRUGO);
 MODULE_PARM_DESC(kpiobufs, "Set number of PIO buffers for driver");
 
@@ -531,8 +537,11 @@ static int init_housekeeping(struct ipath_devdata *dd,
          * Don't clear ipath_flags as 8bit mode was set before
          * entering this func. However, we do set the linkstate to
          * unknown, so we can watch for a transition.
+         * PRESENT is set because we want register reads to work,
+         * and the kernel infrastructure saw it in config space;
+         * We clear it if we have failures.
          */
-        dd->ipath_flags |= IPATH_LINKUNK;
+        dd->ipath_flags |= IPATH_LINKUNK | IPATH_PRESENT;
         dd->ipath_flags &= ~(IPATH_LINKACTIVE | IPATH_LINKARMED |
                              IPATH_LINKDOWN | IPATH_LINKINIT);
 
@@ -560,6 +569,7 @@ static int init_housekeeping(struct ipath_devdata *dd,
             || (dd->ipath_uregbase & 0xffffffff) == 0xffffffff) {
                 ipath_dev_err(dd, "Register read failures from chip, "
                               "giving up initialization\n");
+                dd->ipath_flags &= ~IPATH_PRESENT;
                 ret = -ENODEV;
                 goto done;
         }
@@ -682,16 +692,14 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
          */
         dd->ipath_pioavregs = ALIGN(val, sizeof(u64) * BITS_PER_BYTE / 2)
                 / (sizeof(u64) * BITS_PER_BYTE / 2);
-        if (!ipath_kpiobufs)    /* have to have at least 1, for SMA */
-                kpiobufs = ipath_kpiobufs = 1;
-        else if ((dd->ipath_piobcnt2k + dd->ipath_piobcnt4k) <
-                 (dd->ipath_cfgports * IPATH_MIN_USER_PORT_BUFCNT)) {
-                dev_info(&dd->pcidev->dev, "Too few PIO buffers (%u) "
-                         "for %u ports to have %u each!\n",
-                         dd->ipath_piobcnt2k + dd->ipath_piobcnt4k,
-                         dd->ipath_cfgports, IPATH_MIN_USER_PORT_BUFCNT);
-                kpiobufs = 1;   /* reserve just the minimum for SMA/ether */
-        } else
+        if (ipath_kpiobufs == 0) {
+                /* not set by user, or set explictly to default  */
+                if ((dd->ipath_piobcnt2k + dd->ipath_piobcnt4k) > 128)
+                        kpiobufs = 32;
+                else
+                        kpiobufs = 16;
+        }
+        else
                 kpiobufs = ipath_kpiobufs;
 
         if (kpiobufs >
diff --git a/drivers/infiniband/hw/ipath/ipath_intr.c b/drivers/infiniband/hw/ipath/ipath_intr.c
index 60f5f4108069..3e72a1fe3d73 100644
--- a/drivers/infiniband/hw/ipath/ipath_intr.c
+++ b/drivers/infiniband/hw/ipath/ipath_intr.c
@@ -172,8 +172,8 @@ static void handle_e_ibstatuschanged(struct ipath_devdata *dd,
                                    "was %s\n", dd->ipath_unit,
                                    ib_linkstate(lstate),
                                    ib_linkstate((unsigned)
-                                                dd->ipath_lastibcstat
-                                                & IPATH_IBSTATE_MASK));
+                                                dd->ipath_lastibcstat
+                                                & IPATH_IBSTATE_MASK));
         }
         else {
                 lstate = dd->ipath_lastibcstat & IPATH_IBSTATE_MASK;
@@ -665,14 +665,14 @@ static void handle_layer_pioavail(struct ipath_devdata *dd)
 
         ret = __ipath_layer_intr(dd, IPATH_LAYER_INT_SEND_CONTINUE);
         if (ret > 0)
-                goto clear;
+                goto set;
 
         ret = __ipath_verbs_piobufavail(dd);
         if (ret > 0)
-                goto clear;
+                goto set;
 
         return;
-clear:
+set:
         set_bit(IPATH_S_PIOINTBUFAVAIL, &dd->ipath_sendctrl);
         ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
                          dd->ipath_sendctrl);
@@ -719,11 +719,24 @@ static void handle_rcv(struct ipath_devdata *dd, u32 istat)
 irqreturn_t ipath_intr(int irq, void *data, struct pt_regs *regs)
 {
         struct ipath_devdata *dd = data;
-        u32 istat = ipath_read_kreg32(dd, dd->ipath_kregs->kr_intstatus);
+        u32 istat;
         ipath_err_t estat = 0;
         static unsigned unexpected = 0;
         irqreturn_t ret;
 
+        if(!(dd->ipath_flags & IPATH_PRESENT)) {
+                /* this is mostly so we don't try to touch the chip while
+                 * it is being reset */
+                /*
+                 * This return value is perhaps odd, but we do not want the
+                 * interrupt core code to remove our interrupt handler
+                 * because we don't appear to be handling an interrupt
+                 * during a chip reset.
+                 */
+                return IRQ_HANDLED;
+        }
+
+        istat = ipath_read_kreg32(dd, dd->ipath_kregs->kr_intstatus);
         if (unlikely(!istat)) {
                 ipath_stats.sps_nullintr++;
                 ret = IRQ_NONE; /* not our interrupt, or already handled */
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
index 159d0aed31a5..e6507f8115bc 100644
--- a/drivers/infiniband/hw/ipath/ipath_kernel.h
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -528,7 +528,6 @@ extern spinlock_t ipath_devs_lock;
 extern struct ipath_devdata *ipath_lookup(int unit);
 
 extern u16 ipath_layer_rcv_opcode;
-extern int ipath_verbs_registered;
 extern int __ipath_layer_intr(struct ipath_devdata *, u32);
 extern int ipath_layer_intr(struct ipath_devdata *, u32);
 extern int __ipath_layer_rcv(struct ipath_devdata *, void *,
@@ -732,7 +731,7 @@ u64 ipath_read_kreg64_port(const struct ipath_devdata *, ipath_kreg,
 static inline u32 ipath_read_ureg32(const struct ipath_devdata *dd,
                                     ipath_ureg regno, int port)
 {
-        if (!dd->ipath_kregbase)
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT))
                 return 0;
 
         return readl(regno + (u64 __iomem *)
@@ -763,7 +762,7 @@ static inline void ipath_write_ureg(const struct ipath_devdata *dd,
 static inline u32 ipath_read_kreg32(const struct ipath_devdata *dd,
                                     ipath_kreg regno)
 {
-        if (!dd->ipath_kregbase)
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT))
                 return -1;
         return readl((u32 __iomem *) & dd->ipath_kregbase[regno]);
 }
@@ -771,7 +770,7 @@ static inline u32 ipath_read_kreg32(const struct ipath_devdata *dd,
 static inline u64 ipath_read_kreg64(const struct ipath_devdata *dd,
                                     ipath_kreg regno)
 {
-        if (!dd->ipath_kregbase)
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT))
                 return -1;
 
         return readq(&dd->ipath_kregbase[regno]);
@@ -787,7 +786,7 @@ static inline void ipath_write_kreg(const struct ipath_devdata *dd,
 static inline u64 ipath_read_creg(const struct ipath_devdata *dd,
                                   ipath_sreg regno)
 {
-        if (!dd->ipath_kregbase)
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT))
                 return 0;
 
         return readq(regno + (u64 __iomem *)
@@ -798,7 +797,7 @@ static inline u64 ipath_read_creg(const struct ipath_devdata *dd,
 static inline u32 ipath_read_creg32(const struct ipath_devdata *dd,
                                          ipath_sreg regno)
 {
-        if (!dd->ipath_kregbase)
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT))
                 return 0;
         return readl(regno + (u64 __iomem *)
                      (dd->ipath_cregbase +
diff --git a/drivers/infiniband/hw/ipath/ipath_layer.c b/drivers/infiniband/hw/ipath/ipath_layer.c
index 2cabf6340572..9cb5258ffed9 100644
--- a/drivers/infiniband/hw/ipath/ipath_layer.c
+++ b/drivers/infiniband/hw/ipath/ipath_layer.c
@@ -46,13 +46,15 @@
 /* Acquire before ipath_devs_lock. */
 static DEFINE_MUTEX(ipath_layer_mutex);
 
+static int ipath_verbs_registered;
+
 u16 ipath_layer_rcv_opcode;
+
 static int (*layer_intr)(void *, u32);
 static int (*layer_rcv)(void *, void *, struct sk_buff *);
 static int (*layer_rcv_lid)(void *, void *);
 static int (*verbs_piobufavail)(void *);
 static void (*verbs_rcv)(void *, void *, void *, u32);
-int ipath_verbs_registered;
 
 static void *(*layer_add_one)(int, struct ipath_devdata *);
 static void (*layer_remove_one)(void *);
@@ -586,6 +588,8 @@ void ipath_verbs_unregister(void)
         verbs_rcv = NULL;
         verbs_timer_cb = NULL;
 
+        ipath_verbs_registered = 0;
+
         mutex_unlock(&ipath_layer_mutex);
 }
 
diff --git a/drivers/infiniband/hw/ipath/ipath_pe800.c b/drivers/infiniband/hw/ipath/ipath_pe800.c
index e693a7a82667..6318067ab5ec 100644
--- a/drivers/infiniband/hw/ipath/ipath_pe800.c
+++ b/drivers/infiniband/hw/ipath/ipath_pe800.c
@@ -305,8 +305,8 @@ static const struct ipath_cregs ipath_pe_cregs = {
  * we'll print them and continue.  We reuse the same message buffer as
  * ipath_handle_errors() to avoid excessive stack usage.
  */
-void ipath_pe_handle_hwerrors(struct ipath_devdata *dd, char *msg,
-        size_t msgl)
+static void ipath_pe_handle_hwerrors(struct ipath_devdata *dd, char *msg,
+                                     size_t msgl)
 {
         ipath_err_t hwerrs;
         u32 bits, ctrl;
@@ -552,7 +552,7 @@ static int ipath_pe_boardname(struct ipath_devdata *dd, char *name,
  * freeze mode), and enable hardware errors as errors (along with
  * everything else) in errormask
  */
-void ipath_pe_init_hwerrors(struct ipath_devdata *dd)
+static void ipath_pe_init_hwerrors(struct ipath_devdata *dd)
 {
         ipath_err_t val;
         u64 extsval;
@@ -577,7 +577,7 @@ void ipath_pe_init_hwerrors(struct ipath_devdata *dd)
  * ipath_pe_bringup_serdes - bring up the serdes
  * @dd: the infinipath device
  */
-int ipath_pe_bringup_serdes(struct ipath_devdata *dd)
+static int ipath_pe_bringup_serdes(struct ipath_devdata *dd)
 {
         u64 val, tmp, config1;
         int ret = 0, change = 0;
@@ -694,7 +694,7 @@ int ipath_pe_bringup_serdes(struct ipath_devdata *dd)
  * @dd: the infinipath device
  * Called when driver is being unloaded
  */
-void ipath_pe_quiet_serdes(struct ipath_devdata *dd)
+static void ipath_pe_quiet_serdes(struct ipath_devdata *dd)
 {
         u64 val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesconfig0);
 
@@ -972,6 +972,8 @@ static int ipath_setup_pe_reset(struct ipath_devdata *dd)
         /* Use ERROR so it shows up in logs, etc. */
         ipath_dev_err(dd, "Resetting PE-800 unit %u\n",
                       dd->ipath_unit);
+        /* keep chip from being accessed in a few places */
+        dd->ipath_flags &= ~(IPATH_INITTED|IPATH_PRESENT);
         val = dd->ipath_control | INFINIPATH_C_RESET;
         ipath_write_kreg(dd, dd->ipath_kregs->kr_control, val);
         mb();
@@ -997,6 +999,8 @@ static int ipath_setup_pe_reset(struct ipath_devdata *dd)
                 if ((r = pci_enable_device(dd->pcidev)))
                         ipath_dev_err(dd, "pci_enable_device failed after "
                                       "reset: %d\n", r);
+                /* whether it worked or not, mark as present, again */
+                dd->ipath_flags |= IPATH_PRESENT;
                 val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_revision);
                 if (val == dd->ipath_revision) {
                         ipath_cdbg(VERBOSE, "Got matching revision "
diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c
index 6058d70d7577..18890716db1e 100644
--- a/drivers/infiniband/hw/ipath/ipath_qp.c
+++ b/drivers/infiniband/hw/ipath/ipath_qp.c
@@ -188,8 +188,8 @@ static void free_qpn(struct ipath_qp_table *qpt, u32 qpn)
  * Allocate the next available QPN and put the QP into the hash table.
  * The hash table holds a reference to the QP.
  */
-int ipath_alloc_qpn(struct ipath_qp_table *qpt, struct ipath_qp *qp,
-                    enum ib_qp_type type)
+static int ipath_alloc_qpn(struct ipath_qp_table *qpt, struct ipath_qp *qp,
+                           enum ib_qp_type type)
 {
         unsigned long flags;
         u32 qpn;
@@ -232,7 +232,7 @@ bail:
  * Remove the QP from the table so it can't be found asynchronously by
  * the receive interrupt routine.
  */
-void ipath_free_qp(struct ipath_qp_table *qpt, struct ipath_qp *qp)
+static void ipath_free_qp(struct ipath_qp_table *qpt, struct ipath_qp *qp)
 {
         struct ipath_qp *q, **qpp;
         unsigned long flags;
@@ -358,6 +358,65 @@ static void ipath_reset_qp(struct ipath_qp *qp)
 }
 
 /**
+ * ipath_error_qp - put a QP into an error state
+ * @qp: the QP to put into an error state
+ *
+ * Flushes both send and receive work queues.
+ * QP r_rq.lock and s_lock should be held.
+ */
+
+static void ipath_error_qp(struct ipath_qp *qp)
+{
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        struct ib_wc wc;
+
+        _VERBS_INFO("QP%d/%d in error state\n",
+                    qp->ibqp.qp_num, qp->remote_qpn);
+
+        spin_lock(&dev->pending_lock);
+        /* XXX What if its already removed by the timeout code? */
+        if (qp->timerwait.next != LIST_POISON1)
+                list_del(&qp->timerwait);
+        if (qp->piowait.next != LIST_POISON1)
+                list_del(&qp->piowait);
+        spin_unlock(&dev->pending_lock);
+
+        wc.status = IB_WC_WR_FLUSH_ERR;
+        wc.vendor_err = 0;
+        wc.byte_len = 0;
+        wc.imm_data = 0;
+        wc.qp_num = qp->ibqp.qp_num;
+        wc.src_qp = 0;
+        wc.wc_flags = 0;
+        wc.pkey_index = 0;
+        wc.slid = 0;
+        wc.sl = 0;
+        wc.dlid_path_bits = 0;
+        wc.port_num = 0;
+
+        while (qp->s_last != qp->s_head) {
+                struct ipath_swqe *wqe = get_swqe_ptr(qp, qp->s_last);
+
+                wc.wr_id = wqe->wr.wr_id;
+                wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                if (++qp->s_last >= qp->s_size)
+                        qp->s_last = 0;
+                ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 1);
+        }
+        qp->s_cur = qp->s_tail = qp->s_head;
+        qp->s_hdrwords = 0;
+        qp->s_ack_state = IB_OPCODE_RC_ACKNOWLEDGE;
+
+        wc.opcode = IB_WC_RECV;
+        while (qp->r_rq.tail != qp->r_rq.head) {
+                wc.wr_id = get_rwqe_ptr(&qp->r_rq, qp->r_rq.tail)->wr_id;
+                if (++qp->r_rq.tail >= qp->r_rq.size)
+                        qp->r_rq.tail = 0;
+                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc, 1);
+        }
+}
+
+/**
  * ipath_modify_qp - modify the attributes of a queue pair
  * @ibqp: the queue pair who's attributes we're modifying
  * @attr: the new attributes
@@ -821,65 +880,6 @@ void ipath_sqerror_qp(struct ipath_qp *qp, struct ib_wc *wc)
 }
 
 /**
- * ipath_error_qp - put a QP into an error state
- * @qp: the QP to put into an error state
- *
- * Flushes both send and receive work queues.
- * QP r_rq.lock and s_lock should be held.
- */
-
-void ipath_error_qp(struct ipath_qp *qp)
-{
-        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
-        struct ib_wc wc;
-
-        _VERBS_INFO("QP%d/%d in error state\n",
-                    qp->ibqp.qp_num, qp->remote_qpn);
-
-        spin_lock(&dev->pending_lock);
-        /* XXX What if its already removed by the timeout code? */
-        if (qp->timerwait.next != LIST_POISON1)
-                list_del(&qp->timerwait);
-        if (qp->piowait.next != LIST_POISON1)
-                list_del(&qp->piowait);
-        spin_unlock(&dev->pending_lock);
-
-        wc.status = IB_WC_WR_FLUSH_ERR;
-        wc.vendor_err = 0;
-        wc.byte_len = 0;
-        wc.imm_data = 0;
-        wc.qp_num = qp->ibqp.qp_num;
-        wc.src_qp = 0;
-        wc.wc_flags = 0;
-        wc.pkey_index = 0;
-        wc.slid = 0;
-        wc.sl = 0;
-        wc.dlid_path_bits = 0;
-        wc.port_num = 0;
-
-        while (qp->s_last != qp->s_head) {
-                struct ipath_swqe *wqe = get_swqe_ptr(qp, qp->s_last);
-
-                wc.wr_id = wqe->wr.wr_id;
-                wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
-                if (++qp->s_last >= qp->s_size)
-                        qp->s_last = 0;
-                ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 1);
-        }
-        qp->s_cur = qp->s_tail = qp->s_head;
-        qp->s_hdrwords = 0;
-        qp->s_ack_state = IB_OPCODE_RC_ACKNOWLEDGE;
-
-        wc.opcode = IB_WC_RECV;
-        while (qp->r_rq.tail != qp->r_rq.head) {
-                wc.wr_id = get_rwqe_ptr(&qp->r_rq, qp->r_rq.tail)->wr_id;
-                if (++qp->r_rq.tail >= qp->r_rq.size)
-                        qp->r_rq.tail = 0;
-                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc, 1);
-        }
-}
-
-/**
  * ipath_get_credit - flush the send work queue of a QP
  * @qp: the qp who's send work queue to flush
  * @aeth: the Acknowledge Extended Transport Header
diff --git a/drivers/infiniband/hw/ipath/ipath_registers.h b/drivers/infiniband/hw/ipath/ipath_registers.h
index 1e59750c5f63..402126eb79c9 100644
--- a/drivers/infiniband/hw/ipath/ipath_registers.h
+++ b/drivers/infiniband/hw/ipath/ipath_registers.h
@@ -34,8 +34,9 @@
 #define _IPATH_REGISTERS_H
 
 /*
- * This file should only be included by kernel source, and by the diags.
- * It defines the registers, and their contents, for the InfiniPath HT-400 chip
+ * This file should only be included by kernel source, and by the diags.  It
+ * defines the registers, and their contents, for the InfiniPath HT-400
+ * chip.
  */
 
 /*
@@ -156,8 +157,10 @@
 #define INFINIPATH_IBCC_FLOWCTRLWATERMARK_SHIFT 8
 #define INFINIPATH_IBCC_LINKINITCMD_MASK 0x3ULL
 #define INFINIPATH_IBCC_LINKINITCMD_DISABLE 1
-#define INFINIPATH_IBCC_LINKINITCMD_POLL 2      /* cycle through TS1/TS2 till OK */
-#define INFINIPATH_IBCC_LINKINITCMD_SLEEP 3     /* wait for TS1, then go on */
+/* cycle through TS1/TS2 till OK */
+#define INFINIPATH_IBCC_LINKINITCMD_POLL 2
+/* wait for TS1, then go on */
+#define INFINIPATH_IBCC_LINKINITCMD_SLEEP 3
 #define INFINIPATH_IBCC_LINKINITCMD_SHIFT 16
 #define INFINIPATH_IBCC_LINKCMD_MASK 0x3ULL
 #define INFINIPATH_IBCC_LINKCMD_INIT 1  /* move to 0x11 */
@@ -182,7 +185,8 @@
 #define INFINIPATH_IBCS_LINKSTATE_SHIFT 4
 #define INFINIPATH_IBCS_TXREADY       0x40000000
 #define INFINIPATH_IBCS_TXCREDITOK    0x80000000
-/* link training states (shift by INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT) */
+/* link training states (shift by
+   INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT) */
 #define INFINIPATH_IBCS_LT_STATE_DISABLED       0x00
 #define INFINIPATH_IBCS_LT_STATE_LINKUP         0x01
 #define INFINIPATH_IBCS_LT_STATE_POLLACTIVE     0x02
@@ -267,10 +271,12 @@
 /* kr_serdesconfig0 bits */
 #define INFINIPATH_SERDC0_RESET_MASK  0xfULL    /* overal reset bits */
 #define INFINIPATH_SERDC0_RESET_PLL   0x10000000ULL     /* pll reset */
-#define INFINIPATH_SERDC0_TXIDLE      0xF000ULL /* tx idle enables (per lane) */
-#define INFINIPATH_SERDC0_RXDETECT_EN 0xF0000ULL        /* rx detect enables (per lane) */
-#define INFINIPATH_SERDC0_L1PWR_DN       0xF0ULL        /* L1 Power down; use with RXDETECT,
-                                                           Otherwise not used on IB side */
+/* tx idle enables (per lane) */
+#define INFINIPATH_SERDC0_TXIDLE      0xF000ULL
+/* rx detect enables (per lane) */
+#define INFINIPATH_SERDC0_RXDETECT_EN 0xF0000ULL
+/* L1 Power down; use with RXDETECT, Otherwise not used on IB side */
+#define INFINIPATH_SERDC0_L1PWR_DN       0xF0ULL
 
 /* kr_xgxsconfig bits */
 #define INFINIPATH_XGXS_RESET          0x7ULL
@@ -390,12 +396,13 @@ struct ipath_kregs {
         ipath_kreg kr_txintmemsize;
         ipath_kreg kr_xgxsconfig;
         ipath_kreg kr_ibpllcfg;
-        /* use these two (and the following N ports) only with ipath_k*_kreg64_port();
-         * not *kreg64() */
+        /* use these two (and the following N ports) only with
+         * ipath_k*_kreg64_port(); not *kreg64() */
         ipath_kreg kr_rcvhdraddr;
         ipath_kreg kr_rcvhdrtailaddr;
 
-        /* remaining registers are not present on all types of infinipath chips  */
+        /* remaining registers are not present on all types of infinipath
+           chips  */
         ipath_kreg kr_rcvpktledcnt;
         ipath_kreg kr_pcierbuftestreg0;
         ipath_kreg kr_pcierbuftestreg1;
diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
index f232e77b78ee..eb81424b3c5b 100644
--- a/drivers/infiniband/hw/ipath/ipath_ruc.c
+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
@@ -531,19 +531,12 @@ int ipath_post_rc_send(struct ipath_qp *qp, struct ib_send_wr *wr)
         }
         wqe->wr.num_sge = j;
         qp->s_head = next;
-        /*
-         * Wake up the send tasklet if the QP is not waiting
-         * for an RNR timeout.
-         */
-        next = qp->s_rnr_timeout;
         spin_unlock_irqrestore(&qp->s_lock, flags);
 
-        if (next == 0) {
-                if (qp->ibqp.qp_type == IB_QPT_UC)
-                        ipath_do_uc_send((unsigned long) qp);
-                else
-                        ipath_do_rc_send((unsigned long) qp);
-        }
+        if (qp->ibqp.qp_type == IB_QPT_UC)
+                ipath_do_uc_send((unsigned long) qp);
+        else
+                ipath_do_rc_send((unsigned long) qp);
 
         ret = 0;
 
diff --git a/drivers/infiniband/hw/ipath/ipath_sysfs.c b/drivers/infiniband/hw/ipath/ipath_sysfs.c
index 32acd8048b49..f323791cc495 100644
--- a/drivers/infiniband/hw/ipath/ipath_sysfs.c
+++ b/drivers/infiniband/hw/ipath/ipath_sysfs.c
@@ -711,10 +711,22 @@ static struct attribute_group dev_attr_group = {
  * enters diag mode.  A device reset is quite likely to crash the
  * machine entirely, so we don't want to normally make it
  * available.
+ *
+ * Called with ipath_mutex held.
  */
 int ipath_expose_reset(struct device *dev)
 {
-        return device_create_file(dev, &dev_attr_reset);
+        static int exposed;
+        int ret;
+
+        if (!exposed) {
+                ret = device_create_file(dev, &dev_attr_reset);
+                exposed = 1;
+        }
+        else
+                ret = 0;
+
+        return ret;
 }
 
 int ipath_driver_create_group(struct device_driver *drv)
diff --git a/drivers/infiniband/hw/ipath/ipath_ud.c b/drivers/infiniband/hw/ipath/ipath_ud.c
index 5ff3de6128b2..e606daf83210 100644
--- a/drivers/infiniband/hw/ipath/ipath_ud.c
+++ b/drivers/infiniband/hw/ipath/ipath_ud.c
@@ -46,8 +46,10 @@
  * This is called from ipath_post_ud_send() to forward a WQE addressed
  * to the same HCA.
  */
-void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_sge_state *ss,
-                       u32 length, struct ib_send_wr *wr, struct ib_wc *wc)
+static void ipath_ud_loopback(struct ipath_qp *sqp,
+                              struct ipath_sge_state *ss,
+                              u32 length, struct ib_send_wr *wr,
+                              struct ib_wc *wc)
 {
         struct ipath_ibdev *dev = to_idev(sqp->ibqp.device);
         struct ipath_qp *qp;
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 9f27fd35cdbb..cb9e387c301f 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -41,7 +41,7 @@
 /* Not static, because we don't want the compiler removing it */
 const char ipath_verbs_version[] = "ipath_verbs " IPATH_IDSTR;
 
-unsigned int ib_ipath_qp_table_size = 251;
+static unsigned int ib_ipath_qp_table_size = 251;
 module_param_named(qp_table_size, ib_ipath_qp_table_size, uint, S_IRUGO);
 MODULE_PARM_DESC(qp_table_size, "QP table size");
 
@@ -87,7 +87,7 @@ const enum ib_wc_opcode ib_ipath_wc_opcode[] = {
 /*
  * System image GUID.
  */
-__be64 sys_image_guid;
+static __be64 sys_image_guid;
 
 /**
  * ipath_copy_sge - copy data to SGE memory
@@ -449,7 +449,6 @@ static void ipath_ib_timer(void *arg)
 {
         struct ipath_ibdev *dev = (struct ipath_ibdev *) arg;
         struct ipath_qp *resend = NULL;
-        struct ipath_qp *rnr = NULL;
         struct list_head *last;
         struct ipath_qp *qp;
         unsigned long flags;
@@ -465,32 +464,18 @@ static void ipath_ib_timer(void *arg)
         last = &dev->pending[dev->pending_index];
         while (!list_empty(last)) {
                 qp = list_entry(last->next, struct ipath_qp, timerwait);
-                if (last->next == LIST_POISON1 ||
-                    last->next != &qp->timerwait ||
-                    qp->timerwait.prev != last) {
-                        INIT_LIST_HEAD(last);
-                } else {
-                        list_del(&qp->timerwait);
-                        qp->timerwait.prev = (struct list_head *) resend;
-                        resend = qp;
-                        atomic_inc(&qp->refcount);
-                }
+                list_del(&qp->timerwait);
+                qp->timer_next = resend;
+                resend = qp;
+                atomic_inc(&qp->refcount);
         }
         last = &dev->rnrwait;
         if (!list_empty(last)) {
                 qp = list_entry(last->next, struct ipath_qp, timerwait);
                 if (--qp->s_rnr_timeout == 0) {
                         do {
-                                if (last->next == LIST_POISON1 ||
-                                    last->next != &qp->timerwait ||
-                                    qp->timerwait.prev != last) {
-                                        INIT_LIST_HEAD(last);
-                                        break;
-                                }
                                 list_del(&qp->timerwait);
-                                qp->timerwait.prev =
-                                        (struct list_head *) rnr;
-                                rnr = qp;
+                                tasklet_hi_schedule(&qp->s_task);
                                 if (list_empty(last))
                                         break;
                                 qp = list_entry(last->next, struct ipath_qp,
@@ -530,8 +515,7 @@ static void ipath_ib_timer(void *arg)
         spin_unlock_irqrestore(&dev->pending_lock, flags);
 
         /* XXX What if timer fires again while this is running? */
-        for (qp = resend; qp != NULL;
-             qp = (struct ipath_qp *) qp->timerwait.prev) {
+        for (qp = resend; qp != NULL; qp = qp->timer_next) {
                 struct ib_wc wc;
 
                 spin_lock_irqsave(&qp->s_lock, flags);
@@ -545,9 +529,6 @@ static void ipath_ib_timer(void *arg)
                 if (atomic_dec_and_test(&qp->refcount))
                         wake_up(&qp->wait);
         }
-        for (qp = rnr; qp != NULL;
-             qp = (struct ipath_qp *) qp->timerwait.prev)
-                tasklet_hi_schedule(&qp->s_task);
 }
 
 /**
@@ -556,9 +537,9 @@ static void ipath_ib_timer(void *arg)
  *
  * This is called from ipath_intr() at interrupt level when a PIO buffer is
  * available after ipath_verbs_send() returned an error that no buffers were
- * available.  Return 0 if we consumed all the PIO buffers and we still have
+ * available.  Return 1 if we consumed all the PIO buffers and we still have
  * QPs waiting for buffers (for now, just do a tasklet_hi_schedule and
- * return one).
+ * return zero).
  */
 static int ipath_ib_piobufavail(void *arg)
 {
@@ -579,7 +560,7 @@ static int ipath_ib_piobufavail(void *arg)
         spin_unlock_irqrestore(&dev->pending_lock, flags);
 
 bail:
-        return 1;
+        return 0;
 }
 
 static int ipath_query_device(struct ib_device *ibdev,
@@ -1110,7 +1091,7 @@ static void ipath_unregister_ib_device(void *arg)
         ib_dealloc_device(ibdev);
 }
 
-int __init ipath_verbs_init(void)
+static int __init ipath_verbs_init(void)
 {
         return ipath_verbs_register(ipath_register_ib_device,
                                     ipath_unregister_ib_device,
@@ -1118,33 +1099,33 @@ int __init ipath_verbs_init(void)
                                     ipath_ib_timer);
 }
 
-void __exit ipath_verbs_cleanup(void)
+static void __exit ipath_verbs_cleanup(void)
 {
         ipath_verbs_unregister();
 }
 
 static ssize_t show_rev(struct class_device *cdev, char *buf)
 {
-        struct ipath_ibdev *dev =
-                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
-        int vendor, boardrev, majrev, minrev;
+        struct ipath_ibdev *dev =
+                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
+        int vendor, boardrev, majrev, minrev;
 
-        ipath_layer_query_device(dev->dd, &vendor, &boardrev,
-                                 &majrev, &minrev);
-        return sprintf(buf, "%d.%d\n", majrev, minrev);
+        ipath_layer_query_device(dev->dd, &vendor, &boardrev,
+                                 &majrev, &minrev);
+        return sprintf(buf, "%d.%d\n", majrev, minrev);
 }
 
 static ssize_t show_hca(struct class_device *cdev, char *buf)
 {
-        struct ipath_ibdev *dev =
-                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
-        int ret;
+        struct ipath_ibdev *dev =
+                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
+        int ret;
 
-        ret = ipath_layer_get_boardname(dev->dd, buf, 128);
-        if (ret < 0)
-                goto bail;
-        strcat(buf, "\n");
-        ret = strlen(buf);
+        ret = ipath_layer_get_boardname(dev->dd, buf, 128);
+        if (ret < 0)
+                goto bail;
+        strcat(buf, "\n");
+        ret = strlen(buf);
 
 bail:
         return ret;
@@ -1152,40 +1133,40 @@ bail:
 
 static ssize_t show_stats(struct class_device *cdev, char *buf)
 {
-        struct ipath_ibdev *dev =
-                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
-        int i;
-        int len;
-
-        len = sprintf(buf,
-                      "RC resends  %d\n"
-                      "RC QACKs    %d\n"
-                      "RC ACKs     %d\n"
-                      "RC SEQ NAKs %d\n"
-                      "RC RDMA seq %d\n"
-                      "RC RNR NAKs %d\n"
-                      "RC OTH NAKs %d\n"
-                      "RC timeouts %d\n"
-                      "RC RDMA dup %d\n"
-                      "piobuf wait %d\n"
-                      "no piobuf   %d\n"
-                      "PKT drops   %d\n"
-                      "WQE errs    %d\n",
-                      dev->n_rc_resends, dev->n_rc_qacks, dev->n_rc_acks,
-                      dev->n_seq_naks, dev->n_rdma_seq, dev->n_rnr_naks,
-                      dev->n_other_naks, dev->n_timeouts,
-                      dev->n_rdma_dup_busy, dev->n_piowait,
-                      dev->n_no_piobuf, dev->n_pkt_drops, dev->n_wqe_errs);
-        for (i = 0; i < ARRAY_SIZE(dev->opstats); i++) {
+        struct ipath_ibdev *dev =
+                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
+        int i;
+        int len;
+
+        len = sprintf(buf,
+                      "RC resends  %d\n"
+                      "RC no QACK  %d\n"
+                      "RC ACKs     %d\n"
+                      "RC SEQ NAKs %d\n"
+                      "RC RDMA seq %d\n"
+                      "RC RNR NAKs %d\n"
+                      "RC OTH NAKs %d\n"
+                      "RC timeouts %d\n"
+                      "RC RDMA dup %d\n"
+                      "piobuf wait %d\n"
+                      "no piobuf   %d\n"
+                      "PKT drops   %d\n"
+                      "WQE errs    %d\n",
+                      dev->n_rc_resends, dev->n_rc_qacks, dev->n_rc_acks,
+                      dev->n_seq_naks, dev->n_rdma_seq, dev->n_rnr_naks,
+                      dev->n_other_naks, dev->n_timeouts,
+                      dev->n_rdma_dup_busy, dev->n_piowait,
+                      dev->n_no_piobuf, dev->n_pkt_drops, dev->n_wqe_errs);
+        for (i = 0; i < ARRAY_SIZE(dev->opstats); i++) {
                 const struct ipath_opcode_stats *si = &dev->opstats[i];
 
-                if (!si->n_packets && !si->n_bytes)
-                        continue;
-                len += sprintf(buf + len, "%02x %llu/%llu\n", i,
+                if (!si->n_packets && !si->n_bytes)
+                        continue;
+                len += sprintf(buf + len, "%02x %llu/%llu\n", i,
                                (unsigned long long) si->n_packets,
-                               (unsigned long long) si->n_bytes);
-        }
-        return len;
+                               (unsigned long long) si->n_bytes);
+        }
+        return len;
 }
 
 static CLASS_DEVICE_ATTR(hw_rev, S_IRUGO, show_rev, NULL);
@@ -1194,25 +1175,25 @@ static CLASS_DEVICE_ATTR(board_id, S_IRUGO, show_hca, NULL);
 static CLASS_DEVICE_ATTR(stats, S_IRUGO, show_stats, NULL);
 
 static struct class_device_attribute *ipath_class_attributes[] = {
-        &class_device_attr_hw_rev,
-        &class_device_attr_hca_type,
-        &class_device_attr_board_id,
-        &class_device_attr_stats
+        &class_device_attr_hw_rev,
+        &class_device_attr_hca_type,
+        &class_device_attr_board_id,
+        &class_device_attr_stats
 };
 
 static int ipath_verbs_register_sysfs(struct ib_device *dev)
 {
-        int i;
+        int i;
         int ret;
 
-        for (i = 0; i < ARRAY_SIZE(ipath_class_attributes); ++i)
-                if (class_device_create_file(&dev->class_dev,
-                                             ipath_class_attributes[i])) {
-                        ret = 1;
+        for (i = 0; i < ARRAY_SIZE(ipath_class_attributes); ++i)
+                if (class_device_create_file(&dev->class_dev,
+                                             ipath_class_attributes[i])) {
+                        ret = 1;
                         goto bail;
                 }
 
-        ret = 0;
+        ret = 0;
 
 bail:
         return ret;
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.h b/drivers/infiniband/hw/ipath/ipath_verbs.h
index b824632b2a8c..4f8d59300e9b 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.h
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.h
@@ -282,7 +282,8 @@ struct ipath_srq {
  */
 struct ipath_qp {
         struct ib_qp ibqp;
-        struct ipath_qp *next;  /* link list for QPN hash table */
+        struct ipath_qp *next;          /* link list for QPN hash table */
+        struct ipath_qp *timer_next;    /* link list for ipath_ib_timer() */
         struct list_head piowait;       /* link for wait PIO buf */
         struct list_head timerwait;     /* link for waiting for timeouts */
         struct ib_ah_attr remote_ah_attr;
@@ -577,8 +578,6 @@ int ipath_init_qp_table(struct ipath_ibdev *idev, int size);
 
 void ipath_sqerror_qp(struct ipath_qp *qp, struct ib_wc *wc);
 
-void ipath_error_qp(struct ipath_qp *qp);
-
 void ipath_get_credit(struct ipath_qp *qp, u32 aeth);
 
 void ipath_do_rc_send(unsigned long data);
@@ -607,9 +606,6 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
 
 void ipath_restart_rc(struct ipath_qp *qp, u32 psn, struct ib_wc *wc);
 
-void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_sge_state *ss,
-                       u32 length, struct ib_send_wr *wr, struct ib_wc *wc);
-
 int ipath_post_ud_send(struct ipath_qp *qp, struct ib_send_wr *wr);
 
 void ipath_ud_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
diff --git a/drivers/infiniband/hw/ipath/ips_common.h b/drivers/infiniband/hw/ipath/ips_common.h
index 410a764dfcef..ab7cbbbfd03a 100644
--- a/drivers/infiniband/hw/ipath/ips_common.h
+++ b/drivers/infiniband/hw/ipath/ips_common.h
@@ -95,7 +95,7 @@ struct ether_header {
         __u8 seq_num;
         __le32 len;
         /* MUST be of word size due to PIO write requirements */
-        __u32 csum;
+        __le32 csum;
         __le16 csum_offset;
         __le16 flags;
         __u16 first_2_bytes;
diff --git a/drivers/infiniband/hw/mthca/mthca_mad.c b/drivers/infiniband/hw/mthca/mthca_mad.c
index f235c7ea42f0..4730863ece9a 100644
--- a/drivers/infiniband/hw/mthca/mthca_mad.c
+++ b/drivers/infiniband/hw/mthca/mthca_mad.c
@@ -49,7 +49,7 @@ enum {
         MTHCA_VENDOR_CLASS2 = 0xa
 };
 
-int mthca_update_rate(struct mthca_dev *dev, u8 port_num)
+static int mthca_update_rate(struct mthca_dev *dev, u8 port_num)
 {
         struct ib_port_attr *tprops = NULL;
         int                  ret;
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 565a24b1756f..a2eae8a30167 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -306,7 +306,7 @@ static int mthca_query_gid(struct ib_device *ibdev, u8 port,
                 goto out;
         }
 
-        memcpy(gid->raw + 8, out_mad->data + (index % 8) * 16, 8);
+        memcpy(gid->raw + 8, out_mad->data + (index % 8) * 8, 8);
 
  out:
         kfree(in_mad);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 5f2b3f6e4c47..5bb55742ada6 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -617,6 +617,14 @@ static void srp_unmap_data(struct scsi_cmnd *scmnd,
                      scmnd->sc_data_direction);
 }
 
+static void srp_remove_req(struct srp_target_port *target, struct srp_request *req,
+                           int index)
+{
+        list_del(&req->list);
+        req->next = target->req_head;
+        target->req_head = index;
+}
+
 static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
 {
         struct srp_request *req;
@@ -664,9 +672,7 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
                         scmnd->host_scribble = (void *) -1L;
                         scmnd->scsi_done(scmnd);
 
-                        list_del(&req->list);
-                        req->next = target->req_head;
-                        target->req_head = rsp->tag & ~SRP_TAG_TSK_MGMT;
+                        srp_remove_req(target, req, rsp->tag & ~SRP_TAG_TSK_MGMT);
                 } else
                         req->cmd_done = 1;
         }
@@ -1188,12 +1194,10 @@ static int srp_send_tsk_mgmt(struct scsi_cmnd *scmnd, u8 func)
         spin_lock_irq(target->scsi_host->host_lock);
 
         if (req->cmd_done) {
-                list_del(&req->list);
-                req->next = target->req_head;
-                target->req_head = req_index;
-
+                srp_remove_req(target, req, req_index);
                 scmnd->scsi_done(scmnd);
         } else if (!req->tsk_status) {
+                srp_remove_req(target, req, req_index);
                 scmnd->result = DID_ABORT << 16;
                 ret = SUCCESS;
         }
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index a34e3d91d9ed..ba325f16d077 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -403,6 +403,27 @@ static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
                 case EVIOCGID:
                         if (copy_to_user(p, &dev->id, sizeof(struct input_id)))
                                 return -EFAULT;
+                        return 0;
+
+                case EVIOCGREP:
+                        if (!test_bit(EV_REP, dev->evbit))
+                                return -ENOSYS;
+                        if (put_user(dev->rep[REP_DELAY], ip))
+                                return -EFAULT;
+                        if (put_user(dev->rep[REP_PERIOD], ip + 1))
+                                return -EFAULT;
+                        return 0;
+
+                case EVIOCSREP:
+                        if (!test_bit(EV_REP, dev->evbit))
+                                return -ENOSYS;
+                        if (get_user(u, ip))
+                                return -EFAULT;
+                        if (get_user(v, ip + 1))
+                                return -EFAULT;
+
+                        input_event(dev, EV_REP, REP_DELAY, u);
+                        input_event(dev, EV_REP, REP_PERIOD, v);
 
                         return 0;
 
diff --git a/drivers/input/input.c b/drivers/input/input.c
index a935abeffffc..3038c268917d 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -155,6 +155,9 @@ void input_event(struct input_dev *dev, unsigned int type, unsigned int code, in
                         if (code > SND_MAX || !test_bit(code, dev->sndbit))
                                 return;
 
+                        if (!!test_bit(code, dev->snd) != !!value)
+                                change_bit(code, dev->snd);
+
                         if (dev->event) dev->event(dev, type, code, value);
 
                         break;
@@ -286,19 +289,19 @@ static struct input_device_id *input_match_device(struct input_device_id *id, st
         for (; id->flags || id->driver_info; id++) {
 
                 if (id->flags & INPUT_DEVICE_ID_MATCH_BUS)
-                        if (id->id.bustype != dev->id.bustype)
+                        if (id->bustype != dev->id.bustype)
                                 continue;
 
                 if (id->flags & INPUT_DEVICE_ID_MATCH_VENDOR)
-                        if (id->id.vendor != dev->id.vendor)
+                        if (id->vendor != dev->id.vendor)
                                 continue;
 
                 if (id->flags & INPUT_DEVICE_ID_MATCH_PRODUCT)
-                        if (id->id.product != dev->id.product)
+                        if (id->product != dev->id.product)
                                 continue;
 
                 if (id->flags & INPUT_DEVICE_ID_MATCH_VERSION)
-                        if (id->id.version != dev->id.version)
+                        if (id->version != dev->id.version)
                                 continue;
 
                 MATCH_BIT(evbit,  EV_MAX);
diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
index 1dca3cf42a54..2e4abdc26367 100644
--- a/drivers/input/keyboard/hil_kbd.c
+++ b/drivers/input/keyboard/hil_kbd.c
@@ -350,11 +350,11 @@ static int hil_kbd_connect(struct serio *serio, struct serio_driver *drv)
         return 0;
  bail2:
         serio_close(serio);
+        serio_set_drvdata(serio, NULL);
  bail1:
         input_free_device(kbd->dev);
  bail0:
         kfree(kbd);
-        serio_set_drvdata(serio, NULL);
         return -EIO;
 }
 
diff --git a/drivers/input/keyboard/spitzkbd.c b/drivers/input/keyboard/spitzkbd.c
index bc61cf8cfc65..1d238a9d52d6 100644
--- a/drivers/input/keyboard/spitzkbd.c
+++ b/drivers/input/keyboard/spitzkbd.c
@@ -53,8 +53,8 @@ static unsigned char spitzkbd_keycode[NR_SCANCODES] = {
         KEY_LEFTCTRL, KEY_1, KEY_3, KEY_5, KEY_6, KEY_7, KEY_9, KEY_0, KEY_BACKSPACE, SPITZ_KEY_EXOK, SPITZ_KEY_EXCANCEL, 0, 0, 0, 0, 0,  /* 1-16 */
         0, KEY_2, KEY_4, KEY_R, KEY_Y, KEY_8, KEY_I, KEY_O, KEY_P, SPITZ_KEY_EXJOGDOWN, SPITZ_KEY_EXJOGUP, 0, 0, 0, 0, 0, /* 17-32 */
         KEY_TAB, KEY_Q, KEY_E, KEY_T, KEY_G, KEY_U, KEY_J, KEY_K, 0, 0, 0, 0, 0, 0, 0, 0,                                 /* 33-48 */
-        SPITZ_KEY_CALENDER, KEY_W, KEY_S, KEY_F, KEY_V, KEY_H, KEY_M, KEY_L, 0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0, 0,         /* 49-64 */
-        SPITZ_KEY_ADDRESS, KEY_A, KEY_D, KEY_C, KEY_B, KEY_N, KEY_DOT, 0, KEY_ENTER, KEY_LEFTSHIFT, 0, 0, 0, 0, 0, 0,     /* 65-80 */
+        SPITZ_KEY_ADDRESS, KEY_W, KEY_S, KEY_F, KEY_V, KEY_H, KEY_M, KEY_L, 0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0, 0,         /* 49-64 */
+        SPITZ_KEY_CALENDER, KEY_A, KEY_D, KEY_C, KEY_B, KEY_N, KEY_DOT, 0, KEY_ENTER, KEY_LEFTSHIFT, 0, 0, 0, 0, 0, 0,    /* 65-80 */
         SPITZ_KEY_MAIL, KEY_Z, KEY_X, KEY_MINUS, KEY_SPACE, KEY_COMMA, 0, KEY_UP, 0, 0, SPITZ_KEY_FN, 0, 0, 0, 0, 0,      /* 81-96 */
         KEY_SYSRQ, SPITZ_KEY_JAP1, SPITZ_KEY_JAP2, SPITZ_KEY_CANCEL, SPITZ_KEY_OK, SPITZ_KEY_MENU, KEY_LEFT, KEY_DOWN, KEY_RIGHT, 0, 0, 0, 0, 0, 0, 0  /* 97-112 */
 };
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 4b415d9b0123..36cd2e07fce8 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -273,6 +273,18 @@ static struct key_entry keymap_fs_amilo_pro_v2000[] = {
         { KE_END,  0 }
 };
 
+static struct key_entry keymap_fujitsu_n3510[] = {
+        { KE_KEY, 0x11, KEY_PROG1 },
+        { KE_KEY, 0x12, KEY_PROG2 },
+        { KE_KEY, 0x36, KEY_WWW },
+        { KE_KEY, 0x31, KEY_MAIL },
+        { KE_KEY, 0x71, KEY_STOPCD },
+        { KE_KEY, 0x72, KEY_PLAYPAUSE },
+        { KE_KEY, 0x74, KEY_REWIND },
+        { KE_KEY, 0x78, KEY_FORWARD },
+        { KE_END, 0 }
+};
+
 static struct key_entry keymap_wistron_ms2141[] = {
         { KE_KEY,  0x11, KEY_PROG1 },
         { KE_KEY,  0x12, KEY_PROG2 },
@@ -323,6 +335,24 @@ static struct dmi_system_id dmi_ids[] = {
         },
         {
                 .callback = dmi_matched,
+                .ident = "Fujitsu-Siemens Amilo M7400",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO M        "),
+                },
+                .driver_data = keymap_fs_amilo_pro_v2000
+        },
+        {
+                .callback = dmi_matched,
+                .ident = "Fujitsu N3510",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "N3510"),
+                },
+                .driver_data = keymap_fujitsu_n3510
+        },
+        {
+                .callback = dmi_matched,
                 .ident = "Acer Aspire 1500",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 32d70ed8f41d..136321a2cfdb 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -302,8 +302,10 @@ static irqreturn_t psmouse_interrupt(struct serio *serio,
  * Check if this is a new device announcement (0xAA 0x00)
  */
         if (unlikely(psmouse->packet[0] == PSMOUSE_RET_BAT && psmouse->pktcnt <= 2)) {
-                if (psmouse->pktcnt == 1)
+                if (psmouse->pktcnt == 1) {
+                        psmouse->last = jiffies;
                         goto out;
+                }
 
                 if (psmouse->packet[1] == PSMOUSE_RET_ID) {
                         __psmouse_set_state(psmouse, PSMOUSE_IGNORE);
diff --git a/drivers/input/serio/i8042-io.h b/drivers/input/serio/i8042-io.h
index 9a9221644250..cc21914fbc72 100644
--- a/drivers/input/serio/i8042-io.h
+++ b/drivers/input/serio/i8042-io.h
@@ -67,14 +67,14 @@ static inline int i8042_platform_init(void)
  * On some platforms touching the i8042 data register region can do really
  * bad things. Because of this the region is always reserved on such boxes.
  */
-#if !defined(__sh__) && !defined(__alpha__) && !defined(__mips__) && !defined(CONFIG_PPC64)
+#if !defined(__sh__) && !defined(__alpha__) && !defined(__mips__) && !defined(CONFIG_PPC_MERGE)
         if (!request_region(I8042_DATA_REG, 16, "i8042"))
                 return -EBUSY;
 #endif
 
         i8042_reset = 1;
 
-#if defined(CONFIG_PPC64)
+#if defined(CONFIG_PPC_MERGE)
         if (check_legacy_ioport(I8042_DATA_REG))
                 return -EBUSY;
         if (!request_region(I8042_DATA_REG, 16, "i8042"))
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 46d1fec2cfd8..1494175ac6fe 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -2,6 +2,8 @@
  * ADS7846 based touchscreen and sensor driver
  *
  * Copyright (c) 2005 David Brownell
+ * Copyright (c) 2006 Nokia Corporation
+ * Various changes: Imre Deak <imre.deak@nokia.com>
  *
  * Using code from:
  *  - corgi_ts.c
@@ -34,17 +36,25 @@
 
 
 /*
- * This code has been lightly tested on an ads7846.
+ * This code has been tested on an ads7846 / N770 device.
  * Support for ads7843 and ads7845 has only been stubbed in.
  *
- * Not yet done:  investigate the values reported.  Are x/y/pressure
- * event values sane enough for X11?  How accurate are the temperature
- * and voltage readings?  (System-specific calibration should support
+ * Not yet done:  How accurate are the temperature and voltage
+ * readings? (System-specific calibration should support
  * accuracy of 0.3 degrees C; otherwise it's 2.0 degrees.)
  *
+ * IRQ handling needs a workaround because of a shortcoming in handling
+ * edge triggered IRQs on some platforms like the OMAP1/2. These
+ * platforms don't handle the ARM lazy IRQ disabling properly, thus we
+ * have to maintain our own SW IRQ disabled status. This should be
+ * removed as soon as the affected platform's IRQ handling is fixed.
+ *
  * app note sbaa036 talks in more detail about accurate sampling...
  * that ought to help in situations like LCDs inducing noise (which
  * can also be helped by using synch signals) and more generally.
+ * This driver tries to utilize the measures described in the app
+ * note. The strength of filtering can be set in the board-* specific
+ * files.
  */
 
 #define TS_POLL_PERIOD  msecs_to_jiffies(10)
@@ -61,6 +71,7 @@ struct ts_event {
         __be16 x;
         __be16 y;
         __be16 z1, z2;
+        int    ignore;
 };
 
 struct ads7846 {
@@ -71,12 +82,23 @@ struct ads7846 {
         u16                     model;
         u16                     vref_delay_usecs;
         u16                     x_plate_ohms;
+        u16                     pressure_max;
 
-        u8                      read_x, read_y, read_z1, read_z2;
+        u8                      read_x, read_y, read_z1, read_z2, pwrdown;
+        u16                     dummy;          /* for the pwrdown read */
         struct ts_event         tc;
 
-        struct spi_transfer     xfer[8];
-        struct spi_message      msg;
+        struct spi_transfer     xfer[10];
+        struct spi_message      msg[5];
+        struct spi_message      *last_msg;
+        int                     msg_idx;
+        int                     read_cnt;
+        int                     read_rep;
+        int                     last_read;
+
+        u16                     debounce_max;
+        u16                     debounce_tol;
+        u16                     debounce_rep;
 
         spinlock_t              lock;
         struct timer_list       timer;          /* P: lock */
@@ -84,6 +106,9 @@ struct ads7846 {
         unsigned                pending:1;      /* P: lock */
 // FIXME remove "irq_disabled"
         unsigned                irq_disabled:1; /* P: lock */
+        unsigned                disabled:1;
+
+        int                     (*get_pendown_state)(void);
 };
 
 /* leave chip selected when we're done, for quicker re-select? */
@@ -125,7 +150,9 @@ struct ads7846 {
 #define READ_Y  (READ_12BIT_DFR(y)  | ADS_PD10_ADC_ON)
 #define READ_Z1 (READ_12BIT_DFR(z1) | ADS_PD10_ADC_ON)
 #define READ_Z2 (READ_12BIT_DFR(z2) | ADS_PD10_ADC_ON)
-#define READ_X  (READ_12BIT_DFR(x)  | ADS_PD10_PDOWN)   /* LAST */
+
+#define READ_X  (READ_12BIT_DFR(x)  | ADS_PD10_ADC_ON)
+#define PWRDOWN (READ_12BIT_DFR(y)  | ADS_PD10_PDOWN)   /* LAST */
 
 /* single-ended samples need to first power up reference voltage;
  * we leave both ADC and VREF powered
@@ -152,6 +179,15 @@ struct ser_req {
         struct spi_transfer     xfer[6];
 };
 
+static void ads7846_enable(struct ads7846 *ts);
+static void ads7846_disable(struct ads7846 *ts);
+
+static int device_suspended(struct device *dev)
+{
+        struct ads7846 *ts = dev_get_drvdata(dev);
+        return dev->power.power_state.event != PM_EVENT_ON || ts->disabled;
+}
+
 static int ads7846_read12_ser(struct device *dev, unsigned command)
 {
         struct spi_device       *spi = to_spi_device(dev);
@@ -164,7 +200,7 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
         if (!req)
                 return -ENOMEM;
 
-        INIT_LIST_HEAD(&req->msg.transfers);
+        spi_message_init(&req->msg);
 
         /* activate reference, so it has time to settle; */
         req->ref_on = REF_ON;
@@ -204,8 +240,10 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
         for (i = 0; i < 6; i++)
                 spi_message_add_tail(&req->xfer[i], &req->msg);
 
+        ts->irq_disabled = 1;
         disable_irq(spi->irq);
         status = spi_sync(spi, &req->msg);
+        ts->irq_disabled = 0;
         enable_irq(spi->irq);
 
         if (req->msg.status)
@@ -233,6 +271,52 @@ SHOW(temp1)
 SHOW(vaux)
 SHOW(vbatt)
 
+static int is_pen_down(struct device *dev)
+{
+        struct ads7846          *ts = dev_get_drvdata(dev);
+
+        return ts->pendown;
+}
+
+static ssize_t ads7846_pen_down_show(struct device *dev,
+                                     struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%u\n", is_pen_down(dev));
+}
+
+static DEVICE_ATTR(pen_down, S_IRUGO, ads7846_pen_down_show, NULL);
+
+static ssize_t ads7846_disable_show(struct device *dev,
+                                     struct device_attribute *attr, char *buf)
+{
+        struct ads7846  *ts = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%u\n", ts->disabled);
+}
+
+static ssize_t ads7846_disable_store(struct device *dev,
+                                     struct device_attribute *attr,
+                                     const char *buf, size_t count)
+{
+        struct ads7846 *ts = dev_get_drvdata(dev);
+        char *endp;
+        int i;
+
+        i = simple_strtoul(buf, &endp, 10);
+        spin_lock_irq(&ts->lock);
+
+        if (i)
+                ads7846_disable(ts);
+        else
+                ads7846_enable(ts);
+
+        spin_unlock_irq(&ts->lock);
+
+        return count;
+}
+
+static DEVICE_ATTR(disable, 0664, ads7846_disable_show, ads7846_disable_store);
+
 /*--------------------------------------------------------------------------*/
 
 /*
@@ -264,7 +348,7 @@ static void ads7846_rx(void *ads)
         if (x == MAX_12BIT)
                 x = 0;
 
-        if (x && z1 && ts->spi->dev.power.power_state.event == PM_EVENT_ON) {
+        if (likely(x && z1 && !device_suspended(&ts->spi->dev))) {
                 /* compute touch pressure resistance using equation #2 */
                 Rt = z2;
                 Rt -= z1;
@@ -275,6 +359,14 @@ static void ads7846_rx(void *ads)
         } else
                 Rt = 0;
 
+        /* Sample found inconsistent by debouncing or pressure is beyond
+        * the maximum. Don't report it to user space, repeat at least
+        * once more the measurement */
+        if (ts->tc.ignore || Rt > ts->pressure_max) {
+                mod_timer(&ts->timer, jiffies + TS_POLL_PERIOD);
+                return;
+        }
+
         /* NOTE:  "pendown" is inferred from pressure; we don't rely on
          * being able to check nPENIRQ status, or "friendly" trigger modes
          * (both-edges is much better than just-falling or low-level).
@@ -296,11 +388,13 @@ static void ads7846_rx(void *ads)
         if (Rt) {
                 input_report_abs(input_dev, ABS_X, x);
                 input_report_abs(input_dev, ABS_Y, y);
-                input_report_abs(input_dev, ABS_PRESSURE, Rt);
                 sync = 1;
         }
-        if (sync)
+
+        if (sync) {
+                input_report_abs(input_dev, ABS_PRESSURE, Rt);
                 input_sync(input_dev);
+        }
 
 #ifdef  VERBOSE
         if (Rt || ts->pendown)
@@ -308,80 +402,138 @@ static void ads7846_rx(void *ads)
                         x, y, Rt, Rt ? "" : " UP");
 #endif
 
-        /* don't retrigger while we're suspended */
         spin_lock_irqsave(&ts->lock, flags);
 
         ts->pendown = (Rt != 0);
-        ts->pending = 0;
+        mod_timer(&ts->timer, jiffies + TS_POLL_PERIOD);
 
-        if (ts->spi->dev.power.power_state.event == PM_EVENT_ON) {
-                if (ts->pendown)
-                        mod_timer(&ts->timer, jiffies + TS_POLL_PERIOD);
-                else if (ts->irq_disabled) {
-                        ts->irq_disabled = 0;
-                        enable_irq(ts->spi->irq);
+        spin_unlock_irqrestore(&ts->lock, flags);
+}
+
+static void ads7846_debounce(void *ads)
+{
+        struct ads7846          *ts = ads;
+        struct spi_message      *m;
+        struct spi_transfer     *t;
+        int                     val;
+        int                     status;
+
+        m = &ts->msg[ts->msg_idx];
+        t = list_entry(m->transfers.prev, struct spi_transfer, transfer_list);
+        val = (*(u16 *)t->rx_buf) >> 3;
+        if (!ts->read_cnt || (abs(ts->last_read - val) > ts->debounce_tol)) {
+                /* Repeat it, if this was the first read or the read
+                 * wasn't consistent enough. */
+                if (ts->read_cnt < ts->debounce_max) {
+                        ts->last_read = val;
+                        ts->read_cnt++;
+                } else {
+                        /* Maximum number of debouncing reached and still
+                         * not enough number of consistent readings. Abort
+                         * the whole sample, repeat it in the next sampling
+                         * period.
+                         */
+                        ts->tc.ignore = 1;
+                        ts->read_cnt = 0;
+                        /* Last message will contain ads7846_rx() as the
+                         * completion function.
+                         */
+                        m = ts->last_msg;
                 }
+                /* Start over collecting consistent readings. */
+                ts->read_rep = 0;
+        } else {
+                if (++ts->read_rep > ts->debounce_rep) {
+                        /* Got a good reading for this coordinate,
+                         * go for the next one. */
+                        ts->tc.ignore = 0;
+                        ts->msg_idx++;
+                        ts->read_cnt = 0;
+                        ts->read_rep = 0;
+                        m++;
+                } else
+                        /* Read more values that are consistent. */
+                        ts->read_cnt++;
         }
-
-        spin_unlock_irqrestore(&ts->lock, flags);
+        status = spi_async(ts->spi, m);
+        if (status)
+                dev_err(&ts->spi->dev, "spi_async --> %d\n",
+                                status);
 }
 
 static void ads7846_timer(unsigned long handle)
 {
         struct ads7846  *ts = (void *)handle;
         int             status = 0;
-        unsigned long   flags;
+
+        spin_lock_irq(&ts->lock);
+
+        if (unlikely(ts->msg_idx && !ts->pendown)) {
+                /* measurment cycle ended */
+                if (!device_suspended(&ts->spi->dev)) {
+                        ts->irq_disabled = 0;
+                        enable_irq(ts->spi->irq);
+                }
+                ts->pending = 0;
+                ts->msg_idx = 0;
+        } else {
+                /* pen is still down, continue with the measurement */
+                ts->msg_idx = 0;
+                status = spi_async(ts->spi, &ts->msg[0]);
+                if (status)
+                        dev_err(&ts->spi->dev, "spi_async --> %d\n", status);
+        }
+
+        spin_unlock_irq(&ts->lock);
+}
+
+static irqreturn_t ads7846_irq(int irq, void *handle, struct pt_regs *regs)
+{
+        struct ads7846 *ts = handle;
+        unsigned long flags;
 
         spin_lock_irqsave(&ts->lock, flags);
-        if (!ts->pending) {
-                ts->pending = 1;
+        if (likely(ts->get_pendown_state())) {
                 if (!ts->irq_disabled) {
+                        /* REVISIT irq logic for many ARM chips has cloned a
+                         * bug wherein disabling an irq in its handler won't
+                         * work;(it's disabled lazily, and too late to work.
+                         * until all their irq logic is fixed, we must shadow
+                         * that state here.
+                         */
                         ts->irq_disabled = 1;
                         disable_irq(ts->spi->irq);
+                        ts->pending = 1;
+                        mod_timer(&ts->timer, jiffies);
                 }
-                status = spi_async(ts->spi, &ts->msg);
-                if (status)
-                        dev_err(&ts->spi->dev, "spi_async --> %d\n",
-                                        status);
         }
         spin_unlock_irqrestore(&ts->lock, flags);
-}
 
-static irqreturn_t ads7846_irq(int irq, void *handle, struct pt_regs *regs)
-{
-        ads7846_timer((unsigned long) handle);
         return IRQ_HANDLED;
 }
 
 /*--------------------------------------------------------------------------*/
 
-static int
-ads7846_suspend(struct spi_device *spi, pm_message_t message)
+/* Must be called with ts->lock held */
+static void ads7846_disable(struct ads7846 *ts)
 {
-        struct ads7846 *ts = dev_get_drvdata(&spi->dev);
-        unsigned long   flags;
+        if (ts->disabled)
+                return;
 
-        spin_lock_irqsave(&ts->lock, flags);
-
-        spi->dev.power.power_state = message;
+        ts->disabled = 1;
 
         /* are we waiting for IRQ, or polling? */
-        if (!ts->pendown) {
-                if (!ts->irq_disabled) {
-                        ts->irq_disabled = 1;
-                        disable_irq(ts->spi->irq);
-                }
+        if (!ts->pending) {
+                ts->irq_disabled = 1;
+                disable_irq(ts->spi->irq);
         } else {
-                /* polling; force a final SPI completion;
-                 * that will clean things up neatly
+                /* the timer will run at least once more, and
+                 * leave everything in a clean state, IRQ disabled
                  */
-                if (!ts->pending)
-                        mod_timer(&ts->timer, jiffies);
-
-                while (ts->pendown || ts->pending) {
-                        spin_unlock_irqrestore(&ts->lock, flags);
-                        udelay(10);
-                        spin_lock_irqsave(&ts->lock, flags);
+                while (ts->pending) {
+                        spin_unlock_irq(&ts->lock);
+                        msleep(1);
+                        spin_lock_irq(&ts->lock);
                 }
         }
 
@@ -389,17 +541,45 @@ ads7846_suspend(struct spi_device *spi, pm_message_t message)
          * leave it that way after every request
          */
 
-        spin_unlock_irqrestore(&ts->lock, flags);
+}
+
+/* Must be called with ts->lock held */
+static void ads7846_enable(struct ads7846 *ts)
+{
+        if (!ts->disabled)
+                return;
+
+        ts->disabled = 0;
+        ts->irq_disabled = 0;
+        enable_irq(ts->spi->irq);
+}
+
+static int ads7846_suspend(struct spi_device *spi, pm_message_t message)
+{
+        struct ads7846 *ts = dev_get_drvdata(&spi->dev);
+
+        spin_lock_irq(&ts->lock);
+
+        spi->dev.power.power_state = message;
+        ads7846_disable(ts);
+
+        spin_unlock_irq(&ts->lock);
+
         return 0;
+
 }
 
 static int ads7846_resume(struct spi_device *spi)
 {
         struct ads7846 *ts = dev_get_drvdata(&spi->dev);
 
-        ts->irq_disabled = 0;
-        enable_irq(ts->spi->irq);
+        spin_lock_irq(&ts->lock);
+
         spi->dev.power.power_state = PMSG_ON;
+        ads7846_enable(ts);
+
+        spin_unlock_irq(&ts->lock);
+
         return 0;
 }
 
@@ -408,6 +588,7 @@ static int __devinit ads7846_probe(struct spi_device *spi)
         struct ads7846                  *ts;
         struct input_dev                *input_dev;
         struct ads7846_platform_data    *pdata = spi->dev.platform_data;
+        struct spi_message              *m;
         struct spi_transfer             *x;
         int                             err;
 
@@ -428,6 +609,11 @@ static int __devinit ads7846_probe(struct spi_device *spi)
                 return -EINVAL;
         }
 
+        if (pdata->get_pendown_state == NULL) {
+                dev_dbg(&spi->dev, "no get_pendown_state function?\n");
+                return -EINVAL;
+        }
+
         /* We'd set the wordsize to 12 bits ... except that some controllers
          * will then treat the 8 bit command words as 12 bits (and drop the
          * four MSBs of the 12 bit result).  Result: inputs must be shifted
@@ -451,9 +637,21 @@ static int __devinit ads7846_probe(struct spi_device *spi)
         ts->timer.data = (unsigned long) ts;
         ts->timer.function = ads7846_timer;
 
+        spin_lock_init(&ts->lock);
+
         ts->model = pdata->model ? : 7846;
         ts->vref_delay_usecs = pdata->vref_delay_usecs ? : 100;
         ts->x_plate_ohms = pdata->x_plate_ohms ? : 400;
+        ts->pressure_max = pdata->pressure_max ? : ~0;
+        if (pdata->debounce_max) {
+                ts->debounce_max = pdata->debounce_max;
+                ts->debounce_tol = pdata->debounce_tol;
+                ts->debounce_rep = pdata->debounce_rep;
+                if (ts->debounce_rep > ts->debounce_max + 1)
+                        ts->debounce_rep = ts->debounce_max - 1;
+        } else
+                ts->debounce_tol = ~0;
+        ts->get_pendown_state = pdata->get_pendown_state;
 
         snprintf(ts->phys, sizeof(ts->phys), "%s/input0", spi->dev.bus_id);
 
@@ -477,60 +675,100 @@ static int __devinit ads7846_probe(struct spi_device *spi)
         /* set up the transfers to read touchscreen state; this assumes we
          * use formula #2 for pressure, not #3.
          */
-        INIT_LIST_HEAD(&ts->msg.transfers);
+        m = &ts->msg[0];
         x = ts->xfer;
 
+        spi_message_init(m);
+
         /* y- still on; turn on only y+ (and ADC) */
         ts->read_y = READ_Y;
         x->tx_buf = &ts->read_y;
         x->len = 1;
-        spi_message_add_tail(x, &ts->msg);
+        spi_message_add_tail(x, m);
 
         x++;
         x->rx_buf = &ts->tc.y;
         x->len = 2;
-        spi_message_add_tail(x, &ts->msg);
+        spi_message_add_tail(x, m);
+
+        m->complete = ads7846_debounce;
+        m->context = ts;
+
+        m++;
+        spi_message_init(m);
+
+        /* turn y- off, x+ on, then leave in lowpower */
+        x++;
+        ts->read_x = READ_X;
+        x->tx_buf = &ts->read_x;
+        x->len = 1;
+        spi_message_add_tail(x, m);
+
+        x++;
+        x->rx_buf = &ts->tc.x;
+        x->len = 2;
+        spi_message_add_tail(x, m);
+
+        m->complete = ads7846_debounce;
+        m->context = ts;
 
         /* turn y+ off, x- on; we'll use formula #2 */
         if (ts->model == 7846) {
+                m++;
+                spi_message_init(m);
+
                 x++;
                 ts->read_z1 = READ_Z1;
                 x->tx_buf = &ts->read_z1;
                 x->len = 1;
-                spi_message_add_tail(x, &ts->msg);
+                spi_message_add_tail(x, m);
 
                 x++;
                 x->rx_buf = &ts->tc.z1;
                 x->len = 2;
-                spi_message_add_tail(x, &ts->msg);
+                spi_message_add_tail(x, m);
+
+                m->complete = ads7846_debounce;
+                m->context = ts;
+
+                m++;
+                spi_message_init(m);
 
                 x++;
                 ts->read_z2 = READ_Z2;
                 x->tx_buf = &ts->read_z2;
                 x->len = 1;
-                spi_message_add_tail(x, &ts->msg);
+                spi_message_add_tail(x, m);
 
                 x++;
                 x->rx_buf = &ts->tc.z2;
                 x->len = 2;
-                spi_message_add_tail(x, &ts->msg);
+                spi_message_add_tail(x, m);
+
+                m->complete = ads7846_debounce;
+                m->context = ts;
         }
 
-        /* turn y- off, x+ on, then leave in lowpower */
+        /* power down */
+        m++;
+        spi_message_init(m);
+
         x++;
-        ts->read_x = READ_X;
-        x->tx_buf = &ts->read_x;
+        ts->pwrdown = PWRDOWN;
+        x->tx_buf = &ts->pwrdown;
         x->len = 1;
-        spi_message_add_tail(x, &ts->msg);
+        spi_message_add_tail(x, m);
 
         x++;
-        x->rx_buf = &ts->tc.x;
+        x->rx_buf = &ts->dummy;
         x->len = 2;
         CS_CHANGE(*x);
-        spi_message_add_tail(x, &ts->msg);
+        spi_message_add_tail(x, m);
 
-        ts->msg.complete = ads7846_rx;
-        ts->msg.context = ts;
+        m->complete = ads7846_rx;
+        m->context = ts;
+
+        ts->last_msg = m;
 
         if (request_irq(spi->irq, ads7846_irq,
                         SA_SAMPLE_RANDOM | SA_TRIGGER_FALLING,
@@ -559,13 +797,27 @@ static int __devinit ads7846_probe(struct spi_device *spi)
                 device_create_file(&spi->dev, &dev_attr_vbatt);
         device_create_file(&spi->dev, &dev_attr_vaux);
 
+        device_create_file(&spi->dev, &dev_attr_pen_down);
+
+        device_create_file(&spi->dev, &dev_attr_disable);
+
         err = input_register_device(input_dev);
         if (err)
-                goto err_free_irq;
+                goto err_remove_attr;
 
         return 0;
 
- err_free_irq:
+ err_remove_attr:
+        device_remove_file(&spi->dev, &dev_attr_disable);
+        device_remove_file(&spi->dev, &dev_attr_pen_down);
+        if (ts->model == 7846) {
+                device_remove_file(&spi->dev, &dev_attr_temp1);
+                device_remove_file(&spi->dev, &dev_attr_temp0);
+        }
+        if (ts->model != 7845)
+                device_remove_file(&spi->dev, &dev_attr_vbatt);
+        device_remove_file(&spi->dev, &dev_attr_vaux);
+
         free_irq(spi->irq, ts);
  err_free_mem:
         input_free_device(input_dev);
@@ -577,20 +829,24 @@ static int __devexit ads7846_remove(struct spi_device *spi)
 {
         struct ads7846          *ts = dev_get_drvdata(&spi->dev);
 
+        input_unregister_device(ts->input);
+
         ads7846_suspend(spi, PMSG_SUSPEND);
-        free_irq(ts->spi->irq, ts);
-        if (ts->irq_disabled)
-                enable_irq(ts->spi->irq);
 
+        device_remove_file(&spi->dev, &dev_attr_disable);
+        device_remove_file(&spi->dev, &dev_attr_pen_down);
         if (ts->model == 7846) {
-                device_remove_file(&spi->dev, &dev_attr_temp0);
                 device_remove_file(&spi->dev, &dev_attr_temp1);
+                device_remove_file(&spi->dev, &dev_attr_temp0);
         }
         if (ts->model != 7845)
                 device_remove_file(&spi->dev, &dev_attr_vbatt);
         device_remove_file(&spi->dev, &dev_attr_vaux);
 
-        input_unregister_device(ts->input);
+        free_irq(ts->spi->irq, ts);
+        /* suspend left the IRQ disabled */
+        enable_irq(ts->spi->irq);
+
         kfree(ts);
 
         dev_dbg(&spi->dev, "unregistered touchscreen\n");
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index f86ed6af3aa2..eb41aba3ddef 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -5,8 +5,6 @@
  *                       Tilman Schmidt <tilman@imap.cc>,
  *                       Stefan Eilers.
  *
- * Based on usb-gigaset.c.
- *
  * =====================================================================
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License as
@@ -46,19 +44,20 @@ MODULE_PARM_DESC(cidmode, "Call-ID mode");
 #define GIGASET_DEVFSNAME  "gig/bas/"
 #define GIGASET_DEVNAME    "ttyGB"
 
-#define IF_WRITEBUF 256 //FIXME
+/* length limit according to Siemens 3070usb-protokoll.doc ch. 2.1 */
+#define IF_WRITEBUF 264
 
 /* Values for the Gigaset 307x */
 #define USB_GIGA_VENDOR_ID      0x0681
-#define USB_GIGA_PRODUCT_ID     0x0001
-#define USB_4175_PRODUCT_ID     0x0002
+#define USB_3070_PRODUCT_ID     0x0001
+#define USB_3075_PRODUCT_ID     0x0002
 #define USB_SX303_PRODUCT_ID    0x0021
 #define USB_SX353_PRODUCT_ID    0x0022
 
 /* table of devices that work with this driver */
 static struct usb_device_id gigaset_table [] = {
-        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_GIGA_PRODUCT_ID) },
-        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_4175_PRODUCT_ID) },
+        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3070_PRODUCT_ID) },
+        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3075_PRODUCT_ID) },
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX303_PRODUCT_ID) },
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX353_PRODUCT_ID) },
         { } /* Terminating entry */
@@ -77,6 +76,10 @@ static int gigaset_probe(struct usb_interface *interface,
 /* Function will be called if the device is unplugged */
 static void gigaset_disconnect(struct usb_interface *interface);
 
+static void read_ctrl_callback(struct urb *, struct pt_regs *);
+static void stopurbs(struct bas_bc_state *);
+static int atwrite_submit(struct cardstate *, unsigned char *, int);
+static int start_cbsend(struct cardstate *);
 
 /*==============================================================================*/
 
@@ -111,12 +114,14 @@ struct bas_cardstate {
 };
 
 /* status of direct USB connection to 307x base (bits in basstate) */
-#define BS_ATOPEN       0x001
-#define BS_B1OPEN       0x002
-#define BS_B2OPEN       0x004
-#define BS_ATREADY      0x008
-#define BS_INIT         0x010
-#define BS_ATTIMER      0x020
+#define BS_ATOPEN       0x001   /* AT channel open */
+#define BS_B1OPEN       0x002   /* B channel 1 open */
+#define BS_B2OPEN       0x004   /* B channel 2 open */
+#define BS_ATREADY      0x008   /* base ready for AT command */
+#define BS_INIT         0x010   /* base has signalled INIT_OK */
+#define BS_ATTIMER      0x020   /* waiting for HD_READY_SEND_ATDATA */
+#define BS_ATRDPEND     0x040   /* urb_cmd_in in use */
+#define BS_ATWRPEND     0x080   /* urb_cmd_out in use */
 
 
 static struct gigaset_driver *driver = NULL;
@@ -130,6 +135,47 @@ static struct usb_driver gigaset_usb_driver = {
         .id_table =     gigaset_table,
 };
 
+/* get message text for usb_submit_urb return code
+ */
+static char *get_usb_rcmsg(int rc)
+{
+        static char unkmsg[28];
+
+        switch (rc) {
+        case 0:
+                return "success";
+        case -ENOMEM:
+                return "out of memory";
+        case -ENODEV:
+                return "device not present";
+        case -ENOENT:
+                return "endpoint not present";
+        case -ENXIO:
+                return "URB type not supported";
+        case -EINVAL:
+                return "invalid argument";
+        case -EAGAIN:
+                return "start frame too early or too much scheduled";
+        case -EFBIG:
+                return "too many isochronous frames requested";
+        case -EPIPE:
+                return "endpoint stalled";
+        case -EMSGSIZE:
+                return "invalid packet size";
+        case -ENOSPC:
+                return "would overcommit USB bandwidth";
+        case -ESHUTDOWN:
+                return "device shut down";
+        case -EPERM:
+                return "reject flag set";
+        case -EHOSTUNREACH:
+                return "device suspended";
+        default:
+                snprintf(unkmsg, sizeof(unkmsg), "unknown error %d", rc);
+                return unkmsg;
+        }
+}
+
 /* get message text for USB status code
  */
 static char *get_usb_statmsg(int status)
@@ -140,43 +186,37 @@ static char *get_usb_statmsg(int status)
         case 0:
                 return "success";
         case -ENOENT:
-                return "canceled";
-        case -ECONNRESET:
-                return "canceled (async)";
+                return "unlinked (sync)";
         case -EINPROGRESS:
                 return "pending";
         case -EPROTO:
-                return "bit stuffing or unknown USB error";
+                return "bit stuffing error, timeout, or unknown USB error";
         case -EILSEQ:
-                return "Illegal byte sequence (CRC mismatch)";
-        case -EPIPE:
-                return "babble detect or endpoint stalled";
-        case -ENOSR:
-                return "buffer error";
+                return "CRC mismatch, timeout, or unknown USB error";
         case -ETIMEDOUT:
                 return "timed out";
-        case -ENODEV:
-                return "device not present";
+        case -EPIPE:
+                return "endpoint stalled";
+        case -ECOMM:
+                return "IN buffer overrun";
+        case -ENOSR:
+                return "OUT buffer underrun";
+        case -EOVERFLOW:
+                return "too much data";
         case -EREMOTEIO:
                 return "short packet detected";
+        case -ENODEV:
+                return "device removed";
         case -EXDEV:
                 return "partial isochronous transfer";
         case -EINVAL:
                 return "invalid argument";
-        case -ENXIO:
-                return "URB already queued";
-        case -EAGAIN:
-                return "isochronous start frame too early or too much scheduled";
-        case -EFBIG:
-                return "too many isochronous frames requested";
-        case -EMSGSIZE:
-                return "endpoint message size zero";
+        case -ECONNRESET:
+                return "unlinked (async)";
         case -ESHUTDOWN:
-                return "endpoint shutdown";
-        case -EBUSY:
-                return "another request pending";
+                return "device shut down";
         default:
-                snprintf(unkmsg, sizeof(unkmsg), "unknown error %d", status);
+                snprintf(unkmsg, sizeof(unkmsg), "unknown status %d", status);
                 return unkmsg;
         }
 }
@@ -277,18 +317,17 @@ static inline void error_hangup(struct bc_state *bcs)
         gig_dbg(DEBUG_ANY, "%s: scheduling HUP for channel %d",
                 __func__, bcs->channel);
 
-        if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL)) {
-                //FIXME what should we do?
-                return;
-        }
+        if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL))
+                dev_err(cs->dev, "event queue full\n");
 
         gigaset_schedule_event(cs);
 }
 
 /* error_reset
  * reset Gigaset device because of an unrecoverable error
- * This function may be called from any context and takes care of scheduling
- * the necessary actions for execution outside of interrupt context.
+ * This function may be called from any context, and should take care of
+ * scheduling the necessary actions for execution outside of interrupt context.
+ * Right now, it just generates a kernel message calling for help.
  * argument:
  *      controller state structure
  */
@@ -364,36 +403,38 @@ static void cmd_in_timeout(unsigned long data)
 {
         struct cardstate *cs = (struct cardstate *) data;
         struct bas_cardstate *ucs = cs->hw.bas;
-        unsigned long flags;
 
-        spin_lock_irqsave(&cs->lock, flags);
-        if (unlikely(!cs->connected)) {
-                gig_dbg(DEBUG_USBREQ, "%s: disconnected", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
-                return;
-        }
         if (!ucs->rcvbuf_size) {
                 gig_dbg(DEBUG_USBREQ, "%s: no receive in progress", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
                 return;
         }
-        spin_unlock_irqrestore(&cs->lock, flags);
 
         dev_err(cs->dev, "timeout reading AT response\n");
         error_reset(cs);        //FIXME retry?
 }
 
+/* set/clear bits in base connection state, return previous state
+ */
+inline static int update_basstate(struct bas_cardstate *ucs,
+                                  int set, int clear)
+{
+        unsigned long flags;
+        int state;
 
-static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs);
+        spin_lock_irqsave(&ucs->lock, flags);
+        state = atomic_read(&ucs->basstate);
+        atomic_set(&ucs->basstate, (state & ~clear) | set);
+        spin_unlock_irqrestore(&ucs->lock, flags);
+        return state;
+}
 
 /* atread_submit
- * submit an HD_READ_ATMESSAGE command URB
+ * submit an HD_READ_ATMESSAGE command URB and optionally start a timeout
  * parameters:
  *      cs      controller state structure
  *      timeout timeout in 1/10 sec., 0: none
  * return value:
  *      0 on success
- *      -EINVAL if a NULL pointer is encountered somewhere
  *      -EBUSY if another request is pending
  *      any URB submission error code
  */
@@ -405,7 +446,7 @@ static int atread_submit(struct cardstate *cs, int timeout)
         gig_dbg(DEBUG_USBREQ, "-------> HD_READ_ATMESSAGE (%d)",
                 ucs->rcvbuf_size);
 
-        if (ucs->urb_cmd_in->status == -EINPROGRESS) {
+        if (update_basstate(ucs, BS_ATRDPEND, 0) & BS_ATRDPEND) {
                 dev_err(cs->dev,
                         "could not submit HD_READ_ATMESSAGE: URB busy\n");
                 return -EBUSY;
@@ -423,6 +464,7 @@ static int atread_submit(struct cardstate *cs, int timeout)
                              read_ctrl_callback, cs->inbuf);
 
         if ((ret = usb_submit_urb(ucs->urb_cmd_in, SLAB_ATOMIC)) != 0) {
+                update_basstate(ucs, 0, BS_ATRDPEND);
                 dev_err(cs->dev, "could not submit HD_READ_ATMESSAGE: %s\n",
                         get_usb_statmsg(ret));
                 return ret;
@@ -438,26 +480,6 @@ static int atread_submit(struct cardstate *cs, int timeout)
         return 0;
 }
 
-static void stopurbs(struct bas_bc_state *);
-static int start_cbsend(struct cardstate *);
-
-/* set/clear bits in base connection state
- */
-inline static void update_basstate(struct bas_cardstate *ucs,
-                                   int set, int clear)
-{
-        unsigned long flags;
-        int state;
-
-        spin_lock_irqsave(&ucs->lock, flags);
-        state = atomic_read(&ucs->basstate);
-        state &= ~clear;
-        state |= set;
-        atomic_set(&ucs->basstate, state);
-        spin_unlock_irqrestore(&ucs->lock, flags);
-}
-
-
 /* read_int_callback
  * USB completion handler for interrupt pipe input
  * called by the USB subsystem in interrupt context
@@ -471,20 +493,25 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
         struct bas_cardstate *ucs = cs->hw.bas;
         struct bc_state *bcs;
         unsigned long flags;
-        int status;
+        int rc;
         unsigned l;
         int channel;
 
         switch (urb->status) {
         case 0:                 /* success */
                 break;
-        case -ENOENT:                   /* canceled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
         case -EINPROGRESS:              /* pending */
                 /* ignore silently */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
                 return;
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
+                //FIXME use this as disconnect indicator?
+                gig_dbg(DEBUG_USBREQ, "%s: device disconnected", __func__);
+                return;
         default:                /* severe trouble */
                 dev_warn(cs->dev, "interrupt read: %s\n",
                          get_usb_statmsg(urb->status));
@@ -492,6 +519,13 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                 goto resubmit;
         }
 
+        /* drop incomplete packets even if the missing bytes wouldn't matter */
+        if (unlikely(urb->actual_length < 3)) {
+                dev_warn(cs->dev, "incomplete interrupt packet (%d bytes)\n",
+                         urb->actual_length);
+                goto resubmit;
+        }
+
         l = (unsigned) ucs->int_in_buf[1] +
             (((unsigned) ucs->int_in_buf[2]) << 8);
 
@@ -558,25 +592,28 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                 }
                 spin_lock_irqsave(&cs->lock, flags);
                 if (ucs->rcvbuf_size) {
-                        spin_unlock_irqrestore(&cs->lock, flags);
+                        /* throw away previous buffer - we have no queue */
                         dev_err(cs->dev,
-                                "receive AT data overrun, %d bytes lost\n", l);
-                        error_reset(cs);        //FIXME reschedule
-                        break;
+                                "receive AT data overrun, %d bytes lost\n",
+                                ucs->rcvbuf_size);
+                        kfree(ucs->rcvbuf);
+                        ucs->rcvbuf_size = 0;
                 }
                 if ((ucs->rcvbuf = kmalloc(l, GFP_ATOMIC)) == NULL) {
                         spin_unlock_irqrestore(&cs->lock, flags);
-                        dev_err(cs->dev, "out of memory, %d bytes lost\n", l);
-                        error_reset(cs);        //FIXME reschedule
+                        dev_err(cs->dev, "out of memory receiving AT data\n");
+                        error_reset(cs);
                         break;
                 }
                 ucs->rcvbuf_size = l;
                 ucs->retry_cmd_in = 0;
-                if ((status = atread_submit(cs, BAS_TIMEOUT)) < 0) {
+                if ((rc = atread_submit(cs, BAS_TIMEOUT)) < 0) {
                         kfree(ucs->rcvbuf);
                         ucs->rcvbuf = NULL;
                         ucs->rcvbuf_size = 0;
-                        error_reset(cs);        //FIXME reschedule
+                        if (rc != -ENODEV)
+                                //FIXME corrective action?
+                                error_reset(cs);
                 }
                 spin_unlock_irqrestore(&cs->lock, flags);
                 break;
@@ -598,12 +635,10 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
         check_pending(ucs);
 
 resubmit:
-        spin_lock_irqsave(&cs->lock, flags);
-        status = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
-        spin_unlock_irqrestore(&cs->lock, flags);
-        if (unlikely(status)) {
+        rc = usb_submit_urb(urb, SLAB_ATOMIC);
+        if (unlikely(rc != 0 && rc != -ENODEV)) {
                 dev_err(cs->dev, "could not resubmit interrupt URB: %s\n",
-                        get_usb_statmsg(status));
+                        get_usb_rcmsg(rc));
                 error_reset(cs);
         }
 }
@@ -622,18 +657,12 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
         struct bas_cardstate *ucs = cs->hw.bas;
         int have_data = 0;
         unsigned numbytes;
-        unsigned long flags;
+        int rc;
 
-        spin_lock_irqsave(&cs->lock, flags);
-        if (unlikely(!cs->connected)) {
-                warn("%s: disconnected", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
-                return;
-        }
+        update_basstate(ucs, 0, BS_ATRDPEND);
 
         if (!ucs->rcvbuf_size) {
                 dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
                 return;
         }
 
@@ -666,9 +695,11 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
                 }
                 break;
 
-        case -ENOENT:                   /* canceled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
         case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
                 /* no action necessary */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
@@ -681,11 +712,11 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
                 if (ucs->retry_cmd_in++ < BAS_RETRY) {
                         dev_notice(cs->dev, "control read: retry %d\n",
                                    ucs->retry_cmd_in);
-                        if (atread_submit(cs, BAS_TIMEOUT) >= 0) {
-                                /* resubmitted - bypass regular exit block */
-                                spin_unlock_irqrestore(&cs->lock, flags);
+                        rc = atread_submit(cs, BAS_TIMEOUT);
+                        if (rc >= 0 || rc == -ENODEV)
+                                /* resubmitted or disconnected */
+                                /* - bypass regular exit block */
                                 return;
-                        }
                 } else {
                         dev_err(cs->dev,
                                 "control read: giving up after %d tries\n",
@@ -697,7 +728,6 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
         kfree(ucs->rcvbuf);
         ucs->rcvbuf = NULL;
         ucs->rcvbuf_size = 0;
-        spin_unlock_irqrestore(&cs->lock, flags);
         if (have_data) {
                 gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
                 gigaset_schedule_event(cs);
@@ -719,8 +749,11 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
         int i, rc;
 
         /* status codes not worth bothering the tasklet with */
-        if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
-                     urb->status == -EINPROGRESS)) {
+        if (unlikely(urb->status == -ENOENT ||
+                     urb->status == -ECONNRESET ||
+                     urb->status == -EINPROGRESS ||
+                     urb->status == -ENODEV ||
+                     urb->status == -ESHUTDOWN)) {
                 gig_dbg(DEBUG_ISO, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
                 return;
@@ -740,9 +773,9 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
                 for (i = 0; i < BAS_NUMFRAMES; i++) {
                         ubc->isoinlost += urb->iso_frame_desc[i].actual_length;
                         if (unlikely(urb->iso_frame_desc[i].status != 0 &&
-                                     urb->iso_frame_desc[i].status != -EINPROGRESS)) {
+                                     urb->iso_frame_desc[i].status !=
+                                                                -EINPROGRESS))
                                 ubc->loststatus = urb->iso_frame_desc[i].status;
-                        }
                         urb->iso_frame_desc[i].status = 0;
                         urb->iso_frame_desc[i].actual_length = 0;
                 }
@@ -754,10 +787,10 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
                         gig_dbg(DEBUG_ISO, "%s: isoc read overrun/resubmit",
                                 __func__);
                         rc = usb_submit_urb(urb, SLAB_ATOMIC);
-                        if (unlikely(rc != 0)) {
+                        if (unlikely(rc != 0 && rc != -ENODEV)) {
                                 dev_err(bcs->cs->dev,
                                         "could not resubmit isochronous read "
-                                        "URB: %s\n", get_usb_statmsg(rc));
+                                        "URB: %s\n", get_usb_rcmsg(rc));
                                 dump_urb(DEBUG_ISO, "isoc read", urb);
                                 error_hangup(bcs);
                         }
@@ -780,8 +813,11 @@ static void write_iso_callback(struct urb *urb, struct pt_regs *regs)
         unsigned long flags;
 
         /* status codes not worth bothering the tasklet with */
-        if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
-                     urb->status == -EINPROGRESS)) {
+        if (unlikely(urb->status == -ENOENT ||
+                     urb->status == -ECONNRESET ||
+                     urb->status == -EINPROGRESS ||
+                     urb->status == -ENODEV ||
+                     urb->status == -ESHUTDOWN)) {
                 gig_dbg(DEBUG_ISO, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
                 return;
@@ -822,7 +858,6 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < BAS_INURBS; k++) {
                 urb = ubc->isoinurbs[k];
                 if (!urb) {
-                        dev_err(bcs->cs->dev, "isoinurbs[%d]==NULL\n", k);
                         rc = -EFAULT;
                         goto error;
                 }
@@ -844,12 +879,8 @@ static int starturbs(struct bc_state *bcs)
                 }
 
                 dump_urb(DEBUG_ISO, "Initial isoc read", urb);
-                if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0) {
-                        dev_err(bcs->cs->dev,
-                               "could not submit isochronous read URB %d: %s\n",
-                                k, get_usb_statmsg(rc));
+                if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0)
                         goto error;
-                }
         }
 
         /* initialize L2 transmission */
@@ -859,7 +890,6 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < BAS_OUTURBS; ++k) {
                 urb = ubc->isoouturbs[k].urb;
                 if (!urb) {
-                        dev_err(bcs->cs->dev, "isoouturbs[%d].urb==NULL\n", k);
                         rc = -EFAULT;
                         goto error;
                 }
@@ -885,12 +915,8 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < 2; ++k) {
                 dump_urb(DEBUG_ISO, "Initial isoc write", urb);
                 rc = usb_submit_urb(ubc->isoouturbs[k].urb, SLAB_ATOMIC);
-                if (rc != 0) {
-                        dev_err(bcs->cs->dev,
-                              "could not submit isochronous write URB %d: %s\n",
-                                k, get_usb_statmsg(rc));
+                if (rc != 0)
                         goto error;
-                }
         }
         dump_urb(DEBUG_ISO, "Initial isoc write (free)", urb);
         ubc->isooutfree = &ubc->isoouturbs[2];
@@ -916,15 +942,15 @@ static void stopurbs(struct bas_bc_state *ubc)
         for (k = 0; k < BAS_INURBS; ++k) {
                 rc = usb_unlink_urb(ubc->isoinurbs[k]);
                 gig_dbg(DEBUG_ISO,
-                        "%s: isoc input URB %d unlinked, result = %d",
-                        __func__, k, rc);
+                        "%s: isoc input URB %d unlinked, result = %s",
+                        __func__, k, get_usb_rcmsg(rc));
         }
 
         for (k = 0; k < BAS_OUTURBS; ++k) {
                 rc = usb_unlink_urb(ubc->isoouturbs[k].urb);
                 gig_dbg(DEBUG_ISO,
-                        "%s: isoc output URB %d unlinked, result = %d",
-                        __func__, k, rc);
+                        "%s: isoc output URB %d unlinked, result = %s",
+                        __func__, k, get_usb_rcmsg(rc));
         }
 }
 
@@ -934,7 +960,7 @@ static void stopurbs(struct bas_bc_state *ubc)
 /* submit_iso_write_urb
  * fill and submit the next isochronous write URB
  * parameters:
- *      bcs     B channel state structure
+ *      ucx     context structure containing URB
  * return value:
  *      number of frames submitted in URB
  *      0 if URB not submitted because no data available (isooutbuf busy)
@@ -946,7 +972,6 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
         struct bas_bc_state *ubc = ucx->bcs->hw.bas;
         struct usb_iso_packet_descriptor *ifd;
         int corrbytes, nframe, rc;
-        unsigned long flags;
 
         /* urb->dev is clobbered by USB subsystem */
         urb->dev = ucx->bcs->cs->hw.bas->udev;
@@ -992,20 +1017,22 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
                 ifd->status = 0;
                 ifd->actual_length = 0;
         }
-        if ((urb->number_of_packets = nframe) > 0) {
-                spin_lock_irqsave(&ucx->bcs->cs->lock, flags);
-                rc = ucx->bcs->cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
-                spin_unlock_irqrestore(&ucx->bcs->cs->lock, flags);
+        if (unlikely(nframe == 0))
+                return 0;       /* no data to send */
+        urb->number_of_packets = nframe;
 
-                if (rc) {
+        rc = usb_submit_urb(urb, SLAB_ATOMIC);
+        if (unlikely(rc)) {
+                if (rc == -ENODEV)
+                        /* device removed - give up silently */
+                        gig_dbg(DEBUG_ISO, "%s: disconnected", __func__);
+                else
                         dev_err(ucx->bcs->cs->dev,
                                 "could not submit isochronous write URB: %s\n",
-                                get_usb_statmsg(rc));
-                        dump_urb(DEBUG_ISO, "isoc write", urb);
-                        return rc;
-                }
-                ++ubc->numsub;
+                                get_usb_rcmsg(rc));
+                return rc;
         }
+        ++ubc->numsub;
         return nframe;
 }
 
@@ -1028,6 +1055,7 @@ static void write_iso_tasklet(unsigned long data)
         int i;
         struct sk_buff *skb;
         int len;
+        int rc;
 
         /* loop while completed URBs arrive in time */
         for (;;) {
@@ -1057,7 +1085,8 @@ static void write_iso_tasklet(unsigned long data)
                 ubc->isooutfree = NULL;
                 spin_unlock_irqrestore(&ubc->isooutlock, flags);
                 if (next) {
-                        if (submit_iso_write_urb(next) <= 0) {
+                        rc = submit_iso_write_urb(next);
+                        if (unlikely(rc <= 0 && rc != -ENODEV)) {
                                 /* could not submit URB, put it back */
                                 spin_lock_irqsave(&ubc->isooutlock, flags);
                                 if (ubc->isooutfree == NULL) {
@@ -1077,17 +1106,18 @@ static void write_iso_tasklet(unsigned long data)
                 /* process completed URB */
                 urb = done->urb;
                 switch (urb->status) {
+                case -EXDEV:                    /* partial completion */
+                        gig_dbg(DEBUG_ISO, "%s: URB partially completed",
+                                __func__);
+                        /* fall through - what's the difference anyway? */
                 case 0:                         /* normal completion */
-                        break;
-                case -EXDEV:                    /* inspect individual frames */
-                        /* assumptions (for lack of documentation):
-                         * - actual_length bytes of the frame in error are
+                        /* inspect individual frames
+                         * assumptions (for lack of documentation):
+                         * - actual_length bytes of first frame in error are
                          *   successfully sent
                          * - all following frames are not sent at all
                          */
-                        gig_dbg(DEBUG_ISO, "%s: URB partially completed",
-                                __func__);
-                        offset = done->limit;   /* just in case */
+                        offset = done->limit;   /* default (no error) */
                         for (i = 0; i < BAS_NUMFRAMES; i++) {
                                 ifd = &urb->iso_frame_desc[i];
                                 if (ifd->status ||
@@ -1122,7 +1152,7 @@ static void write_iso_tasklet(unsigned long data)
                         }
 #endif
                         break;
-                case -EPIPE:            //FIXME is this the code for "underrun"?
+                case -EPIPE:                    /* stall - probably underrun */
                         dev_err(cs->dev, "isochronous write stalled\n");
                         error_hangup(bcs);
                         break;
@@ -1142,7 +1172,8 @@ static void write_iso_tasklet(unsigned long data)
                 spin_unlock_irqrestore(&ubc->isooutlock, flags);
                 if (next) {
                         /* only one URB still active - resubmit one */
-                        if (submit_iso_write_urb(next) <= 0) {
+                        rc = submit_iso_write_urb(next);
+                        if (unlikely(rc <= 0 && rc != -ENODEV)) {
                                 /* couldn't submit */
                                 error_hangup(bcs);
                         }
@@ -1222,10 +1253,9 @@ static void read_iso_tasklet(unsigned long data)
                         break;
                 case -ENOENT:
                 case -ECONNRESET:
-                        gig_dbg(DEBUG_ISO, "%s: URB canceled", __func__);
-                        continue;               /* -> skip */
-                case -EINPROGRESS:              /* huh? */
-                        gig_dbg(DEBUG_ISO, "%s: URB still pending", __func__);
+                case -EINPROGRESS:
+                        gig_dbg(DEBUG_ISO, "%s: %s",
+                                __func__, get_usb_statmsg(urb->status));
                         continue;               /* -> skip */
                 case -EPIPE:
                         dev_err(cs->dev, "isochronous read stalled\n");
@@ -1290,13 +1320,11 @@ static void read_iso_tasklet(unsigned long data)
                 urb->dev = bcs->cs->hw.bas->udev;
                 urb->transfer_flags = URB_ISO_ASAP;
                 urb->number_of_packets = BAS_NUMFRAMES;
-                spin_lock_irqsave(&cs->lock, flags);
-                rc = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
-                spin_unlock_irqrestore(&cs->lock, flags);
-                if (rc) {
+                rc = usb_submit_urb(urb, SLAB_ATOMIC);
+                if (unlikely(rc != 0 && rc != -ENODEV)) {
                         dev_err(cs->dev,
                                 "could not resubmit isochronous read URB: %s\n",
-                                get_usb_statmsg(rc));
+                                get_usb_rcmsg(rc));
                         dump_urb(DEBUG_ISO, "resubmit iso read", urb);
                         error_hangup(bcs);
                 }
@@ -1397,7 +1425,6 @@ static void write_ctrl_callback(struct urb *urb, struct pt_regs *regs)
  *      timeout timeout in seconds (0: no timeout)
  * return value:
  *      0 on success
- *      -EINVAL if a NULL pointer is encountered somewhere
  *      -EBUSY if another request is pending
  *      any URB submission error code
  */
@@ -1418,12 +1445,6 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
                         req, ucs->pending);
                 return -EBUSY;
         }
-        if (ucs->urb_ctrl->status == -EINPROGRESS) {
-                spin_unlock_irqrestore(&ucs->lock, flags);
-                dev_err(bcs->cs->dev,
-                        "could not submit request 0x%02x: URB busy\n", req);
-                return -EBUSY;
-        }
 
         ucs->dr_ctrl.bRequestType = OUT_VENDOR_REQ;
         ucs->dr_ctrl.bRequest = req;
@@ -1465,22 +1486,36 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
 static int gigaset_init_bchannel(struct bc_state *bcs)
 {
         int req, ret;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (unlikely(!bcs->cs->connected)) {
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                return -ENODEV;
+        }
 
         if ((ret = starturbs(bcs)) < 0) {
                 dev_err(bcs->cs->dev,
-                        "could not start isochronous I/O for channel %d\n",
-                        bcs->channel + 1);
-                error_hangup(bcs);
+                        "could not start isochronous I/O for channel B%d: %s\n",
+                        bcs->channel + 1,
+                        ret == -EFAULT ? "null URB" : get_usb_rcmsg(ret));
+                if (ret != -ENODEV)
+                        error_hangup(bcs);
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
                 return ret;
         }
 
         req = bcs->channel ? HD_OPEN_B2CHANNEL : HD_OPEN_B1CHANNEL;
         if ((ret = req_submit(bcs, req, 0, BAS_TIMEOUT)) < 0) {
-                dev_err(bcs->cs->dev, "could not open channel %d: %s\n",
-                        bcs->channel + 1, get_usb_statmsg(ret));
+                dev_err(bcs->cs->dev, "could not open channel B%d\n",
+                        bcs->channel + 1);
                 stopurbs(bcs->hw.bas);
-                error_hangup(bcs);
+                if (ret != -ENODEV)
+                        error_hangup(bcs);
         }
+
+        spin_unlock_irqrestore(&bcs->cs->lock, flags);
         return ret;
 }
 
@@ -1497,19 +1532,30 @@ static int gigaset_init_bchannel(struct bc_state *bcs)
 static int gigaset_close_bchannel(struct bc_state *bcs)
 {
         int req, ret;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (unlikely(!bcs->cs->connected)) {
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                return -ENODEV;
+        }
 
         if (!(atomic_read(&bcs->cs->hw.bas->basstate) &
               (bcs->channel ? BS_B2OPEN : BS_B1OPEN))) {
                 /* channel not running: just signal common.c */
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
                 gigaset_bchannel_down(bcs);
                 return 0;
         }
 
+        /* channel running: tell device to close it */
         req = bcs->channel ? HD_CLOSE_B2CHANNEL : HD_CLOSE_B1CHANNEL;
         if ((ret = req_submit(bcs, req, 0, BAS_TIMEOUT)) < 0)
-                dev_err(bcs->cs->dev,
-                        "could not submit HD_CLOSE_BxCHANNEL request: %s\n",
-                        get_usb_statmsg(ret));
+                dev_err(bcs->cs->dev, "closing channel B%d failed\n",
+                        bcs->channel + 1);
+
+        spin_unlock_irqrestore(&bcs->cs->lock, flags);
         return ret;
 }
 
@@ -1545,8 +1591,6 @@ static void complete_cb(struct cardstate *cs)
         kfree(cb);
 }
 
-static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len);
-
 /* write_command_callback
  * USB completion handler for AT command transmission
  * called by the USB subsystem in interrupt context
@@ -1560,13 +1604,17 @@ static void write_command_callback(struct urb *urb, struct pt_regs *regs)
         struct bas_cardstate *ucs = cs->hw.bas;
         unsigned long flags;
 
+        update_basstate(ucs, 0, BS_ATWRPEND);
+
         /* check status */
         switch (urb->status) {
         case 0:                                 /* normal completion */
                 break;
-        case -ENOENT:                   /* canceled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
         case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
                 /* ignore silently */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
@@ -1627,19 +1675,17 @@ static void atrdy_timeout(unsigned long data)
  *      len     length of command to send
  * return value:
  *      0 on success
- *      -EFAULT if a NULL pointer is encountered somewhere
  *      -EBUSY if another request is pending
  *      any URB submission error code
  */
 static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
 {
         struct bas_cardstate *ucs = cs->hw.bas;
-        unsigned long flags;
-        int ret;
+        int rc;
 
         gig_dbg(DEBUG_USBREQ, "-------> HD_WRITE_ATMESSAGE (%d)", len);
 
-        if (ucs->urb_cmd_out->status == -EINPROGRESS) {
+        if (update_basstate(ucs, BS_ATWRPEND, 0) & BS_ATWRPEND) {
                 dev_err(cs->dev,
                         "could not submit HD_WRITE_ATMESSAGE: URB busy\n");
                 return -EBUSY;
@@ -1654,29 +1700,22 @@ static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
                              usb_sndctrlpipe(ucs->udev, 0),
                              (unsigned char*) &ucs->dr_cmd_out, buf, len,
                              write_command_callback, cs);
-
-        spin_lock_irqsave(&cs->lock, flags);
-        ret = cs->connected ? usb_submit_urb(ucs->urb_cmd_out, SLAB_ATOMIC) : -ENODEV;
-        spin_unlock_irqrestore(&cs->lock, flags);
-
-        if (ret) {
+        rc = usb_submit_urb(ucs->urb_cmd_out, SLAB_ATOMIC);
+        if (unlikely(rc)) {
+                update_basstate(ucs, 0, BS_ATWRPEND);
                 dev_err(cs->dev, "could not submit HD_WRITE_ATMESSAGE: %s\n",
-                        get_usb_statmsg(ret));
-                return ret;
+                        get_usb_rcmsg(rc));
+                return rc;
         }
 
-        /* submitted successfully */
-        update_basstate(ucs, 0, BS_ATREADY);
-
-        /* start timeout if necessary */
-        if (!(atomic_read(&ucs->basstate) & BS_ATTIMER)) {
+        /* submitted successfully, start timeout if necessary */
+        if (!(update_basstate(ucs, BS_ATTIMER, BS_ATREADY) & BS_ATTIMER)) {
                 gig_dbg(DEBUG_OUTPUT, "setting ATREADY timeout of %d/10 secs",
                         ATRDY_TIMEOUT);
                 ucs->timer_atrdy.expires = jiffies + ATRDY_TIMEOUT * HZ / 10;
                 ucs->timer_atrdy.data = (unsigned long) cs;
                 ucs->timer_atrdy.function = atrdy_timeout;
                 add_timer(&ucs->timer_atrdy);
-                update_basstate(ucs, BS_ATTIMER, 0);
         }
         return 0;
 }
@@ -1702,7 +1741,6 @@ static int start_cbsend(struct cardstate *cs)
                 gig_dbg(DEBUG_TRANSCMD|DEBUG_LOCKCMD, "AT channel not open");
                 rc = req_submit(cs->bcs, HD_OPEN_ATCHANNEL, 0, BAS_TIMEOUT);
                 if (rc < 0) {
-                        dev_err(cs->dev, "could not open AT channel\n");
                         /* flush command queue */
                         spin_lock_irqsave(&cs->cmdlock, flags);
                         while (cs->cmdbuf != NULL)
@@ -1786,8 +1824,14 @@ static int gigaset_write_cmd(struct cardstate *cs,
         cs->lastcmdbuf = cb;
         spin_unlock_irqrestore(&cs->cmdlock, flags);
 
+        spin_lock_irqsave(&cs->lock, flags);
+        if (unlikely(!cs->connected)) {
+                spin_unlock_irqrestore(&cs->lock, flags);
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                return -ENODEV;
+        }
         status = start_cbsend(cs);
-
+        spin_unlock_irqrestore(&cs->lock, flags);
         return status < 0 ? status : len;
 }
 
@@ -1849,12 +1893,32 @@ static int gigaset_brkchars(struct cardstate *cs, const unsigned char buf[6])
  */
 static int gigaset_freebcshw(struct bc_state *bcs)
 {
-        if (!bcs->hw.bas)
+        struct bas_bc_state *ubc = bcs->hw.bas;
+        int i;
+
+        if (!ubc)
                 return 0;
 
-        if (bcs->hw.bas->isooutbuf)
-                kfree(bcs->hw.bas->isooutbuf);
-        kfree(bcs->hw.bas);
+        /* kill URBs and tasklets before freeing - better safe than sorry */
+        atomic_set(&ubc->running, 0);
+        for (i = 0; i < BAS_OUTURBS; ++i)
+                if (ubc->isoouturbs[i].urb) {
+                        gig_dbg(DEBUG_INIT, "%s: killing iso out URB %d",
+                                __func__, i);
+                        usb_kill_urb(ubc->isoouturbs[i].urb);
+                        usb_free_urb(ubc->isoouturbs[i].urb);
+                }
+        for (i = 0; i < BAS_INURBS; ++i)
+                if (ubc->isoinurbs[i]) {
+                        gig_dbg(DEBUG_INIT, "%s: killing iso in URB %d",
+                                __func__, i);
+                        usb_kill_urb(ubc->isoinurbs[i]);
+                        usb_free_urb(ubc->isoinurbs[i]);
+                }
+        tasklet_kill(&ubc->sent_tasklet);
+        tasklet_kill(&ubc->rcvd_tasklet);
+        kfree(ubc->isooutbuf);
+        kfree(ubc);
         bcs->hw.bas = NULL;
         return 1;
 }
@@ -1931,13 +1995,9 @@ static void gigaset_reinitbcshw(struct bc_state *bcs)
 
 static void gigaset_freecshw(struct cardstate *cs)
 {
-        struct bas_cardstate *ucs = cs->hw.bas;
-
-        del_timer(&ucs->timer_ctrl);
-        del_timer(&ucs->timer_atrdy);
-        del_timer(&ucs->timer_cmd_in);
-
+        /* timers, URBs and rcvbuf are disposed of in disconnect */
         kfree(cs->hw.bas);
+        cs->hw.bas = NULL;
 }
 
 static int gigaset_initcshw(struct cardstate *cs)
@@ -2041,23 +2101,13 @@ static int gigaset_probe(struct usb_interface *interface,
         struct bas_bc_state *ubc;
         struct usb_endpoint_descriptor *endpoint;
         int i, j;
-        int ret;
+        int rc;
 
         gig_dbg(DEBUG_ANY,
                 "%s: Check if device matches .. (Vendor: 0x%x, Product: 0x%x)",
                 __func__, le16_to_cpu(udev->descriptor.idVendor),
                 le16_to_cpu(udev->descriptor.idProduct));
 
-        /* See if the device offered us matches what we can accept */
-        if ((le16_to_cpu(udev->descriptor.idVendor)  != USB_GIGA_VENDOR_ID) ||
-            (le16_to_cpu(udev->descriptor.idProduct) != USB_GIGA_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_4175_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_SX303_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_SX353_PRODUCT_ID)) {
-                gig_dbg(DEBUG_ANY, "%s: unmatched ID - exiting", __func__);
-                return -ENODEV;
-        }
-
         /* set required alternate setting */
         hostif = interface->cur_altsetting;
         if (hostif->desc.bAlternateSetting != 3) {
@@ -2105,45 +2155,22 @@ static int gigaset_probe(struct usb_interface *interface,
          * - three for the different uses of the default control pipe
          * - three for each isochronous pipe
          */
-        ucs->urb_int_in = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_int_in) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_cmd_in = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_cmd_in) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_cmd_out = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_cmd_out) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_ctrl = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_ctrl) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
+        if (!(ucs->urb_int_in = usb_alloc_urb(0, SLAB_KERNEL)) ||
+            !(ucs->urb_cmd_in = usb_alloc_urb(0, SLAB_KERNEL)) ||
+            !(ucs->urb_cmd_out = usb_alloc_urb(0, SLAB_KERNEL)) ||
+            !(ucs->urb_ctrl = usb_alloc_urb(0, SLAB_KERNEL)))
+                goto allocerr;
 
         for (j = 0; j < 2; ++j) {
                 ubc = cs->bcs[j].hw.bas;
-                for (i = 0; i < BAS_OUTURBS; ++i) {
-                        ubc->isoouturbs[i].urb =
-                                usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL);
-                        if (!ubc->isoouturbs[i].urb) {
-                                dev_err(cs->dev, "no free urbs available\n");
-                                goto error;
-                        }
-                }
-                for (i = 0; i < BAS_INURBS; ++i) {
-                        ubc->isoinurbs[i] =
-                                usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL);
-                        if (!ubc->isoinurbs[i]) {
-                                dev_err(cs->dev, "no free urbs available\n");
-                                goto error;
-                        }
-                }
+                for (i = 0; i < BAS_OUTURBS; ++i)
+                        if (!(ubc->isoouturbs[i].urb =
+                              usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL)))
+                                goto allocerr;
+                for (i = 0; i < BAS_INURBS; ++i)
+                        if (!(ubc->isoinurbs[i] =
+                              usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL)))
+                                goto allocerr;
         }
 
         ucs->rcvbuf = NULL;
@@ -2156,15 +2183,14 @@ static int gigaset_probe(struct usb_interface *interface,
                                         (endpoint->bEndpointAddress) & 0x0f),
                          ucs->int_in_buf, 3, read_int_callback, cs,
                          endpoint->bInterval);
-        ret = usb_submit_urb(ucs->urb_int_in, SLAB_KERNEL);
-        if (ret) {
+        if ((rc = usb_submit_urb(ucs->urb_int_in, SLAB_KERNEL)) != 0) {
                 dev_err(cs->dev, "could not submit interrupt URB: %s\n",
-                        get_usb_statmsg(ret));
+                        get_usb_rcmsg(rc));
                 goto error;
         }
 
         /* tell the device that the driver is ready */
-        if ((ret = req_submit(cs->bcs, HD_DEVICE_INIT_ACK, 0, 0)) != 0)
+        if ((rc = req_submit(cs->bcs, HD_DEVICE_INIT_ACK, 0, 0)) != 0)
                 goto error;
 
         /* tell common part that the device is ready */
@@ -2179,6 +2205,8 @@ static int gigaset_probe(struct usb_interface *interface,
 
         return 0;
 
+allocerr:
+        dev_err(cs->dev, "could not allocate URBs\n");
 error:
         freeurbs(cs);
         usb_set_intfdata(interface, NULL);
@@ -2193,19 +2221,34 @@ static void gigaset_disconnect(struct usb_interface *interface)
 {
         struct cardstate *cs;
         struct bas_cardstate *ucs;
+        int j;
 
         cs = usb_get_intfdata(interface);
 
         ucs = cs->hw.bas;
 
         dev_info(cs->dev, "disconnecting Gigaset base\n");
+
+        /* mark base as not ready, all channels disconnected */
+        atomic_set(&ucs->basstate, 0);
+
+        /* tell LL all channels are down */
+        //FIXME shouldn't gigaset_stop() do this?
+        for (j = 0; j < 2; ++j)
+                gigaset_bchannel_down(cs->bcs + j);
+
+        /* stop driver (common part) */
         gigaset_stop(cs);
+
+        /* stop timers and URBs, free ressources */
+        del_timer_sync(&ucs->timer_ctrl);
+        del_timer_sync(&ucs->timer_atrdy);
+        del_timer_sync(&ucs->timer_cmd_in);
         freeurbs(cs);
         usb_set_intfdata(interface, NULL);
         kfree(ucs->rcvbuf);
         ucs->rcvbuf = NULL;
         ucs->rcvbuf_size = 0;
-        atomic_set(&ucs->basstate, 0);
         usb_put_dev(ucs->udev);
         ucs->interface = NULL;
         ucs->udev = NULL;
@@ -2277,6 +2320,8 @@ error:	if (cardstate)
  */
 static void __exit bas_gigaset_exit(void)
 {
+        struct bas_cardstate *ucs = cardstate->hw.bas;
+
         gigaset_blockdriver(driver); /* => probe will fail
                                       * => no gigaset_start any more
                                       */
@@ -2284,14 +2329,26 @@ static void __exit bas_gigaset_exit(void)
         gigaset_shutdown(cardstate);
         /* from now on, no isdn callback should be possible */
 
-        if (atomic_read(&cardstate->hw.bas->basstate) & BS_ATOPEN) {
-                gig_dbg(DEBUG_ANY, "closing AT channel");
-                if (req_submit(cardstate->bcs,
-                               HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT) >= 0) {
-                        /* successfully submitted */
-                        //FIXME wait for completion?
-                }
+        /* close all still open channels */
+        if (atomic_read(&ucs->basstate) & BS_B1OPEN) {
+                gig_dbg(DEBUG_INIT, "closing B1 channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_B1CHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
+        }
+        if (atomic_read(&ucs->basstate) & BS_B2OPEN) {
+                gig_dbg(DEBUG_INIT, "closing B2 channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_B2CHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
+        }
+        if (atomic_read(&ucs->basstate) & BS_ATOPEN) {
+                gig_dbg(DEBUG_INIT, "closing AT channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_ATCHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
         }
+        atomic_set(&ucs->basstate, 0);
 
         /* deregister this driver with the USB subsystem */
         usb_deregister(&gigaset_usb_driver);
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 749b3da1236e..e55767b2ccd3 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -781,8 +781,7 @@ error:	if (cs)
 }
 EXPORT_SYMBOL_GPL(gigaset_initcs);
 
-/* ReInitialize the b-channel structure */
-/* e.g. called on hangup, disconnect */
+/* ReInitialize the b-channel structure on hangup */
 void gigaset_bcs_reinit(struct bc_state *bcs)
 {
         struct sk_buff *skb;
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 1ba3424a286b..18e05c09b71c 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -373,6 +373,9 @@ struct reply_t gigaset_tab_cid_m10x[] = /* for M10x */
 
         {EV_TIMEOUT,  750,750, -1,                  0, 0, {ACT_CONNTIMEOUT}},
 
+        /* B channel closed (general case) */
+        {EV_BC_CLOSED, -1, -1, -1,                 -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME
+
         /* misc. */
         {EV_PROTO_L2,  -1, -1, -1,                 -1,-1, {ACT_PROTO_L2}}, //FIXME
 
diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
index 9d21ba8757b0..22b9693f7c0a 100644
--- a/drivers/isdn/gigaset/gigaset.h
+++ b/drivers/isdn/gigaset/gigaset.h
@@ -75,7 +75,7 @@ extern int gigaset_debuglevel;	/* "needs" cast to (enum debuglevel) */
  * e.g. 'insmod usb_gigaset.o debug=0x2c' will set DEBUG_OPEN, DEBUG_CMD and
  * DEBUG_INTR.
  */
-enum debuglevel { /* up to 24 bits (atomic_t) */
+enum debuglevel {
         DEBUG_REG         = 0x0002, /* serial port I/O register operations */
         DEBUG_OPEN        = 0x0004, /* open/close serial port */
         DEBUG_INTR        = 0x0008, /* interrupt processing */
@@ -141,7 +141,7 @@ enum debuglevel { /* up to 24 bits (atomic_t) */
                         printk(KERN_DEBUG KBUILD_MODNAME ": " format "\n", \
                                ## arg); \
         } while (0)
-#define DEBUG_DEFAULT (DEBUG_INIT | DEBUG_TRANSCMD | DEBUG_CMD | DEBUG_USBREQ)
+#define DEBUG_DEFAULT (DEBUG_TRANSCMD | DEBUG_CMD | DEBUG_USBREQ)
 
 #else
 
@@ -627,8 +627,7 @@ struct gigaset_ops {
         /* Called by gigaset_freecs() for freeing bcs->hw.xxx */
         int (*freebcshw)(struct bc_state *bcs);
 
-        /* Called by gigaset_stop() or gigaset_bchannel_down() for resetting
-           bcs->hw.xxx */
+        /* Called by gigaset_bchannel_down() for resetting bcs->hw.xxx */
         void (*reinitbcshw)(struct bc_state *bcs);
 
         /* Called by gigaset_initcs() for setting up cs->hw.xxx */
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index 0815dbfb8291..1654fa413575 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -73,7 +73,7 @@ static int writebuf_from_LL(int driverID, int channel, int ack,
                 len, skblen, (unsigned) skb->head[0], (unsigned) skb->head[1]);
 
         /* pass to device-specific module */
-        return cs->ops->send_skb(bcs, skb); //FIXME cs->ops->send_skb() must handle !cs->connected correctly
+        return cs->ops->send_skb(bcs, skb);
 }
 
 void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb)
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index 45f017ed6e8c..8667daaa1a82 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -992,14 +992,18 @@ int gigaset_isoc_send_skb(struct bc_state *bcs, struct sk_buff *skb)
         int len = skb->len;
         unsigned long flags;
 
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (!bcs->cs->connected) {
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                return -ENODEV;
+        }
+
         skb_queue_tail(&bcs->squeue, skb);
         gig_dbg(DEBUG_ISO, "%s: skb queued, qlen=%d",
                 __func__, skb_queue_len(&bcs->squeue));
 
         /* tasklet submits URB if necessary */
-        spin_lock_irqsave(&bcs->cs->lock, flags);
-        if (bcs->cs->connected)
-                tasklet_schedule(&bcs->hw.bas->sent_tasklet);
+        tasklet_schedule(&bcs->hw.bas->sent_tasklet);
         spin_unlock_irqrestore(&bcs->cs->lock, flags);
 
         return len;     /* ok so far */
diff --git a/drivers/macintosh/therm_adt746x.c b/drivers/macintosh/therm_adt746x.c
index 5ebfd1d138da..5282fec17075 100644
--- a/drivers/macintosh/therm_adt746x.c
+++ b/drivers/macintosh/therm_adt746x.c
@@ -627,8 +627,8 @@ thermostat_init(void)
         if(therm_type == ADT7460)
                 device_create_file(&of_dev->dev, &dev_attr_sensor2_fan_speed);
 
-#ifndef CONFIG_I2C_KEYWEST
-        request_module("i2c-keywest");
+#ifndef CONFIG_I2C_POWERMAC
+        request_module("i2c-powermac");
 #endif
 
         return i2c_add_driver(&thermostat_driver);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 434ca39d19c1..d7316b829a62 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -279,11 +279,6 @@ static inline int mddev_lock(mddev_t * mddev)
         return mutex_lock_interruptible(&mddev->reconfig_mutex);
 }
 
-static inline void mddev_lock_uninterruptible(mddev_t * mddev)
-{
-        mutex_lock(&mddev->reconfig_mutex);
-}
-
 static inline int mddev_trylock(mddev_t * mddev)
 {
         return mutex_trylock(&mddev->reconfig_mutex);
@@ -2458,9 +2453,11 @@ md_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
 
         if (!entry->show)
                 return -EIO;
-        mddev_lock(mddev);
-        rv = entry->show(mddev, page);
-        mddev_unlock(mddev);
+        rv = mddev_lock(mddev);
+        if (!rv) {
+                rv = entry->show(mddev, page);
+                mddev_unlock(mddev);
+        }
         return rv;
 }
 
@@ -2474,9 +2471,11 @@ md_attr_store(struct kobject *kobj, struct attribute *attr,
 
         if (!entry->store)
                 return -EIO;
-        mddev_lock(mddev);
-        rv = entry->store(mddev, page, length);
-        mddev_unlock(mddev);
+        rv = mddev_lock(mddev);
+        if (!rv) {
+                rv = entry->store(mddev, page, length);
+                mddev_unlock(mddev);
+        }
         return rv;
 }
 
@@ -4341,8 +4340,9 @@ static int md_seq_show(struct seq_file *seq, void *v)
                 return 0;
         }
 
-        if (mddev_lock(mddev)!=0) 
+        if (mddev_lock(mddev) < 0)
                 return -EINTR;
+
         if (mddev->pers || mddev->raid_disks || !list_empty(&mddev->disks)) {
                 seq_printf(seq, "%s : %sactive", mdname(mddev),
                                                 mddev->pers ? "" : "in");
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 6081941de1b3..4070eff6f0f8 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -315,10 +315,11 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                 if (r1_bio->bios[mirror] == bio)
                         break;
 
-        if (error == -ENOTSUPP && test_bit(R1BIO_Barrier, &r1_bio->state)) {
+        if (error == -EOPNOTSUPP && test_bit(R1BIO_Barrier, &r1_bio->state)) {
                 set_bit(BarriersNotsupp, &conf->mirrors[mirror].rdev->flags);
                 set_bit(R1BIO_BarrierRetry, &r1_bio->state);
                 r1_bio->mddev->barriers_work = 0;
+                /* Don't rdev_dec_pending in this branch - keep it for the retry */
         } else {
                 /*
                  * this branch is our 'one mirror IO has finished' event handler:
@@ -365,6 +366,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                                 }
                         }
                 }
+                rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev);
         }
         /*
          *
@@ -374,11 +376,9 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
         if (atomic_dec_and_test(&r1_bio->remaining)) {
                 if (test_bit(R1BIO_BarrierRetry, &r1_bio->state)) {
                         reschedule_retry(r1_bio);
-                        /* Don't dec_pending yet, we want to hold
-                         * the reference over the retry
-                         */
                         goto out;
                 }
+                /* it really is the end of this request */
                 if (test_bit(R1BIO_BehindIO, &r1_bio->state)) {
                         /* free extra copy of the data pages */
                         int i = bio->bi_vcnt;
@@ -393,8 +393,6 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                 md_write_end(r1_bio->mddev);
                 raid_end_bio_io(r1_bio);
         }
-
-        rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev);
  out:
         if (to_put)
                 bio_put(to_put);
@@ -753,18 +751,24 @@ static int make_request(request_queue_t *q, struct bio * bio)
         const int rw = bio_data_dir(bio);
         int do_barriers;
 
-        if (unlikely(!mddev->barriers_work && bio_barrier(bio))) {
-                bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
-                return 0;
-        }
-
         /*
          * Register the new request and wait if the reconstruction
          * thread has put up a bar for new requests.
          * Continue immediately if no resync is active currently.
+         * We test barriers_work *after* md_write_start as md_write_start
+         * may cause the first superblock write, and that will check out
+         * if barriers work.
          */
+
         md_write_start(mddev, bio); /* wait on superblock update early */
 
+        if (unlikely(!mddev->barriers_work && bio_barrier(bio))) {
+                if (rw == WRITE)
+                        md_write_end(mddev);
+                bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
+                return 0;
+        }
+
         wait_barrier(conf);
 
         disk_stat_inc(mddev->gendisk, ios[rw]);
@@ -1404,10 +1408,11 @@ static void raid1d(mddev_t *mddev)
                         unplug = 1;
                 } else if (test_bit(R1BIO_BarrierRetry, &r1_bio->state)) {
                         /* some requests in the r1bio were BIO_RW_BARRIER
-                         * requests which failed with -ENOTSUPP.  Hohumm..
+                         * requests which failed with -EOPNOTSUPP.  Hohumm..
                          * Better resubmit without the barrier.
                          * We know which devices to resubmit for, because
                          * all others have had their bios[] entry cleared.
+                         * We already have a nr_pending reference on these rdevs.
                          */
                         int i;
                         clear_bit(R1BIO_BarrierRetry, &r1_bio->state);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 617012bc107a..1440935414e6 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1407,43 +1407,54 @@ static void raid10d(mddev_t *mddev)
                                 if (s > (PAGE_SIZE>>9))
                                         s = PAGE_SIZE >> 9;
 
+                                rcu_read_lock();
                                 do {
                                         int d = r10_bio->devs[sl].devnum;
-                                        rdev = conf->mirrors[d].rdev;
+                                        rdev = rcu_dereference(conf->mirrors[d].rdev);
                                         if (rdev &&
-                                            test_bit(In_sync, &rdev->flags) &&
-                                            sync_page_io(rdev->bdev,
-                                                         r10_bio->devs[sl].addr +
-                                                         sect + rdev->data_offset,
-                                                         s<<9,
-                                                         conf->tmppage, READ))
-                                                success = 1;
-                                        else {
-                                                sl++;
-                                                if (sl == conf->copies)
-                                                        sl = 0;
+                                            test_bit(In_sync, &rdev->flags)) {
+                                                atomic_inc(&rdev->nr_pending);
+                                                rcu_read_unlock();
+                                                success = sync_page_io(rdev->bdev,
+                                                                       r10_bio->devs[sl].addr +
+                                                                       sect + rdev->data_offset,
+                                                                       s<<9,
+                                                                       conf->tmppage, READ);
+                                                rdev_dec_pending(rdev, mddev);
+                                                rcu_read_lock();
+                                                if (success)
+                                                        break;
                                         }
+                                        sl++;
+                                        if (sl == conf->copies)
+                                                sl = 0;
                                 } while (!success && sl != r10_bio->read_slot);
+                                rcu_read_unlock();
 
                                 if (success) {
                                         int start = sl;
                                         /* write it back and re-read */
+                                        rcu_read_lock();
                                         while (sl != r10_bio->read_slot) {
                                                 int d;
                                                 if (sl==0)
                                                         sl = conf->copies;
                                                 sl--;
                                                 d = r10_bio->devs[sl].devnum;
-                                                rdev = conf->mirrors[d].rdev;
-                                                atomic_add(s, &rdev->corrected_errors);
+                                                rdev = rcu_dereference(conf->mirrors[d].rdev);
                                                 if (rdev &&
                                                     test_bit(In_sync, &rdev->flags)) {
+                                                        atomic_inc(&rdev->nr_pending);
+                                                        rcu_read_unlock();
+                                                        atomic_add(s, &rdev->corrected_errors);
                                                         if (sync_page_io(rdev->bdev,
                                                                          r10_bio->devs[sl].addr +
                                                                          sect + rdev->data_offset,
                                                                          s<<9, conf->tmppage, WRITE) == 0)
                                                                 /* Well, this device is dead */
                                                                 md_error(mddev, rdev);
+                                                        rdev_dec_pending(rdev, mddev);
+                                                        rcu_read_lock();
                                                 }
                                         }
                                         sl = start;
@@ -1453,17 +1464,22 @@ static void raid10d(mddev_t *mddev)
                                                         sl = conf->copies;
                                                 sl--;
                                                 d = r10_bio->devs[sl].devnum;
-                                                rdev = conf->mirrors[d].rdev;
+                                                rdev = rcu_dereference(conf->mirrors[d].rdev);
                                                 if (rdev &&
                                                     test_bit(In_sync, &rdev->flags)) {
+                                                        atomic_inc(&rdev->nr_pending);
+                                                        rcu_read_unlock();
                                                         if (sync_page_io(rdev->bdev,
                                                                          r10_bio->devs[sl].addr +
                                                                          sect + rdev->data_offset,
                                                                          s<<9, conf->tmppage, READ) == 0)
                                                                 /* Well, this device is dead */
                                                                 md_error(mddev, rdev);
+                                                        rdev_dec_pending(rdev, mddev);
+                                                        rcu_read_lock();
                                                 }
                                         }
+                                        rcu_read_unlock();
                                 } else {
                                         /* Cannot read from anywhere -- bye bye array */
                                         md_error(mddev, conf->mirrors[r10_bio->devs[r10_bio->read_slot].devnum].rdev);
diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
index f9d87b86492c..320b3d9384ba 100644
--- a/drivers/media/video/cx88/cx88-alsa.c
+++ b/drivers/media/video/cx88/cx88-alsa.c
@@ -616,7 +616,7 @@ static struct snd_kcontrol_new snd_cx88_capture_volume = {
  * Only boards with eeprom and byte 1 at eeprom=1 have it
  */
 
-static struct pci_device_id cx88_audio_pci_tbl[] = {
+static struct pci_device_id cx88_audio_pci_tbl[] __devinitdata = {
         {0x14f1,0x8801,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
         {0x14f1,0x8811,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
         {0, }
diff --git a/drivers/mmc/pxamci.c b/drivers/mmc/pxamci.c
index eb9a8826e9b5..eb42cb349420 100644
--- a/drivers/mmc/pxamci.c
+++ b/drivers/mmc/pxamci.c
@@ -65,11 +65,6 @@ struct pxamci_host {
         unsigned int            dma_dir;
 };
 
-static inline unsigned int ns_to_clocks(unsigned int ns)
-{
-        return (ns * (CLOCKRATE / 1000000) + 999) / 1000;
-}
-
 static void pxamci_stop_clock(struct pxamci_host *host)
 {
         if (readl(host->base + MMC_STAT) & STAT_CLK_EN) {
@@ -113,6 +108,7 @@ static void pxamci_disable_irq(struct pxamci_host *host, unsigned int mask)
 static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
 {
         unsigned int nob = data->blocks;
+        unsigned long long clks;
         unsigned int timeout;
         u32 dcmd;
         int i;
@@ -125,7 +121,9 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
         writel(nob, host->base + MMC_NOB);
         writel(1 << data->blksz_bits, host->base + MMC_BLKLEN);
 
-        timeout = ns_to_clocks(data->timeout_ns) + data->timeout_clks;
+        clks = (unsigned long long)data->timeout_ns * CLOCKRATE;
+        do_div(clks, 1000000000UL);
+        timeout = (unsigned int)clks + (data->timeout_clks << host->clkrt);
         writel((timeout + 255) / 256, host->base + MMC_RDTO);
 
         if (data->flags & MMC_DATA_READ) {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index add8dc4aa7b0..c99e87838f92 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3768,6 +3768,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                         ps_page->ps_page[j] = NULL;
                         skb->len += length;
                         skb->data_len += length;
+                        skb->truesize += length;
                 }
 
 copydone:
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 7627a75f4f7c..f7235c9bc421 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -105,6 +105,8 @@
  *      0.50: 20 Jan 2006: Add 8021pq tagging support.
  *      0.51: 20 Jan 2006: Add 64bit consistent memory allocation for rings.
  *      0.52: 20 Jan 2006: Add MSI/MSIX support.
+ *      0.53: 19 Mar 2006: Fix init from low power mode and add hw reset.
+ *      0.54: 21 Mar 2006: Fix spin locks for multi irqs and cleanup.
  *
  * Known bugs:
  * We suspect that on some hardware no TX done interrupts are generated.
@@ -116,7 +118,7 @@
  * DEV_NEED_TIMERIRQ will not harm you on sane hardware, only generating a few
  * superfluous timer interrupts from the nic.
  */
-#define FORCEDETH_VERSION               "0.52"
+#define FORCEDETH_VERSION               "0.54"
 #define DRV_NAME                        "forcedeth"
 
 #include <linux/module.h>
@@ -160,6 +162,7 @@
 #define DEV_HAS_VLAN            0x0020  /* device supports vlan tagging and striping */
 #define DEV_HAS_MSI             0x0040  /* device supports MSI */
 #define DEV_HAS_MSI_X           0x0080  /* device supports MSI-X */
+#define DEV_HAS_POWER_CNTRL     0x0100  /* device supports power savings */
 
 enum {
         NvRegIrqStatus = 0x000,
@@ -203,6 +206,8 @@ enum {
 #define NVREG_MISC1_HD          0x02
 #define NVREG_MISC1_FORCE       0x3b0f3c
 
+        NvRegMacReset = 0x3c,
+#define NVREG_MAC_RESET_ASSERT  0x0F3
         NvRegTransmitterControl = 0x084,
 #define NVREG_XMITCTL_START     0x01
         NvRegTransmitterStatus = 0x088,
@@ -326,6 +331,10 @@ enum {
         NvRegMSIXMap0 = 0x3e0,
         NvRegMSIXMap1 = 0x3e4,
         NvRegMSIXIrqStatus = 0x3f0,
+
+        NvRegPowerState2 = 0x600,
+#define NVREG_POWERSTATE2_POWERUP_MASK          0x0F11
+#define NVREG_POWERSTATE2_POWERUP_REV_A3        0x0001
 };
 
 /* Big endian: should work, but is untested */
@@ -414,7 +423,8 @@ typedef union _ring_type {
 #define NV_RX3_VLAN_TAG_MASK    (0x0000FFFF)
 
 /* Miscelaneous hardware related defines: */
-#define NV_PCI_REGSZ            0x270
+#define NV_PCI_REGSZ_VER1       0x270
+#define NV_PCI_REGSZ_VER2       0x604
 
 /* various timeout delays: all in usec */
 #define NV_TXRX_RESET_DELAY     4
@@ -431,6 +441,7 @@ typedef union _ring_type {
 #define NV_MIIBUSY_DELAY        50
 #define NV_MIIPHY_DELAY 10
 #define NV_MIIPHY_DELAYMAX      10000
+#define NV_MAC_RESET_DELAY      64
 
 #define NV_WAKEUPPATTERNS       5
 #define NV_WAKEUPMASKENTRIES    4
@@ -552,6 +563,8 @@ struct fe_priv {
         u32 desc_ver;
         u32 txrxctl_bits;
         u32 vlanctl_bits;
+        u32 driver_data;
+        u32 register_size;
 
         void __iomem *base;
 
@@ -698,6 +711,72 @@ static void setup_hw_rings(struct net_device *dev, int rxtx_flags)
         }
 }
 
+static int using_multi_irqs(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+
+        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
+            ((np->msi_flags & NV_MSI_X_ENABLED) &&
+             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1)))
+                return 0;
+        else
+                return 1;
+}
+
+static void nv_enable_irq(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+
+        if (!using_multi_irqs(dev)) {
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        enable_irq(dev->irq);
+        } else {
+                enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+                enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+                enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
+        }
+}
+
+static void nv_disable_irq(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+
+        if (!using_multi_irqs(dev)) {
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        disable_irq(dev->irq);
+        } else {
+                disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+                disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+                disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
+        }
+}
+
+/* In MSIX mode, a write to irqmask behaves as XOR */
+static void nv_enable_hw_interrupts(struct net_device *dev, u32 mask)
+{
+        u8 __iomem *base = get_hwbase(dev);
+
+        writel(mask, base + NvRegIrqMask);
+}
+
+static void nv_disable_hw_interrupts(struct net_device *dev, u32 mask)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+
+        if (np->msi_flags & NV_MSI_X_ENABLED) {
+                writel(mask, base + NvRegIrqMask);
+        } else {
+                if (np->msi_flags & NV_MSI_ENABLED)
+                        writel(0, base + NvRegMSIIrqMask);
+                writel(0, base + NvRegIrqMask);
+        }
+}
+
 #define MII_READ        (-1)
 /* mii_rw: read/write a register on the PHY.
  *
@@ -919,6 +998,24 @@ static void nv_txrx_reset(struct net_device *dev)
         pci_push(base);
 }
 
+static void nv_mac_reset(struct net_device *dev)
+{
+        struct fe_priv *np = netdev_priv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+
+        dprintk(KERN_DEBUG "%s: nv_mac_reset\n", dev->name);
+        writel(NVREG_TXRXCTL_BIT2 | NVREG_TXRXCTL_RESET | np->txrxctl_bits, base + NvRegTxRxControl);
+        pci_push(base);
+        writel(NVREG_MAC_RESET_ASSERT, base + NvRegMacReset);
+        pci_push(base);
+        udelay(NV_MAC_RESET_DELAY);
+        writel(0, base + NvRegMacReset);
+        pci_push(base);
+        udelay(NV_MAC_RESET_DELAY);
+        writel(NVREG_TXRXCTL_BIT2 | np->txrxctl_bits, base + NvRegTxRxControl);
+        pci_push(base);
+}
+
 /*
  * nv_get_stats: dev->get_stats function
  * Get latest stats value from the nic.
@@ -989,24 +1086,25 @@ static void nv_do_rx_refill(unsigned long data)
         struct net_device *dev = (struct net_device *) data;
         struct fe_priv *np = netdev_priv(dev);
 
-
-        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
-            ((np->msi_flags & NV_MSI_X_ENABLED) && 
-             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
-                disable_irq(dev->irq);
+        if (!using_multi_irqs(dev)) {
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        disable_irq(dev->irq);
         } else {
                 disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
         }
         if (nv_alloc_rx(dev)) {
-                spin_lock(&np->lock);
+                spin_lock_irq(&np->lock);
                 if (!np->in_shutdown)
                         mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
-                spin_unlock(&np->lock);
+                spin_unlock_irq(&np->lock);
         }
-        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
-            ((np->msi_flags & NV_MSI_X_ENABLED) && 
-             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
-                enable_irq(dev->irq);
+        if (!using_multi_irqs(dev)) {
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        enable_irq(dev->irq);
         } else {
                 enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
         }
@@ -1331,7 +1429,7 @@ static void nv_tx_timeout(struct net_device *dev)
                                 dev->name, (unsigned long)np->ring_addr,
                                 np->next_tx, np->nic_tx);
                 printk(KERN_INFO "%s: Dumping tx registers\n", dev->name);
-                for (i=0;i<0x400;i+= 32) {
+                for (i=0;i<=np->register_size;i+= 32) {
                         printk(KERN_INFO "%3x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
                                         i,
                                         readl(base + i + 0), readl(base + i + 4),
@@ -1638,15 +1736,7 @@ static int nv_change_mtu(struct net_device *dev, int new_mtu)
                  * guessed, there is probably a simpler approach.
                  * Changing the MTU is a rare event, it shouldn't matter.
                  */
-                if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
-                    ((np->msi_flags & NV_MSI_X_ENABLED) && 
-                     ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
-                        disable_irq(dev->irq);
-                } else {
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
-                }
+                nv_disable_irq(dev);
                 spin_lock_bh(&dev->xmit_lock);
                 spin_lock(&np->lock);
                 /* stop engines */
@@ -1679,15 +1769,7 @@ static int nv_change_mtu(struct net_device *dev, int new_mtu)
                 nv_start_tx(dev);
                 spin_unlock(&np->lock);
                 spin_unlock_bh(&dev->xmit_lock);
-                if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
-                    ((np->msi_flags & NV_MSI_X_ENABLED) && 
-                     ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
-                        enable_irq(dev->irq);
-                } else {
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
-                }
+                nv_enable_irq(dev);
         }
         return 0;
 }
@@ -2078,16 +2160,16 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data, struct pt_regs *regs)
                 if (!(events & np->irqmask))
                         break;
 
-                spin_lock(&np->lock);
+                spin_lock_irq(&np->lock);
                 nv_tx_done(dev);
-                spin_unlock(&np->lock);
+                spin_unlock_irq(&np->lock);
                 
                 if (events & (NVREG_IRQ_TX_ERR)) {
                         dprintk(KERN_DEBUG "%s: received irq with events 0x%x. Probably TX fail.\n",
                                                 dev->name, events);
                 }
                 if (i > max_interrupt_work) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         /* disable interrupts on the nic */
                         writel(NVREG_IRQ_TX_ALL, base + NvRegIrqMask);
                         pci_push(base);
@@ -2097,7 +2179,7 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data, struct pt_regs *regs)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                         break;
                 }
 
@@ -2127,14 +2209,14 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data, struct pt_regs *regs)
                 
                 nv_rx_process(dev);
                 if (nv_alloc_rx(dev)) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         if (!np->in_shutdown)
                                 mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                 }
                 
                 if (i > max_interrupt_work) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         /* disable interrupts on the nic */
                         writel(NVREG_IRQ_RX_ALL, base + NvRegIrqMask);
                         pci_push(base);
@@ -2144,7 +2226,7 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data, struct pt_regs *regs)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                         break;
                 }
 
@@ -2173,14 +2255,14 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data, struct pt_regs *regs)
                         break;
                 
                 if (events & NVREG_IRQ_LINK) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         nv_link_irq(dev);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                 }
                 if (np->need_linktimer && time_after(jiffies, np->link_timeout)) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         nv_linkchange(dev);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                         np->link_timeout = jiffies + LINK_TIMEOUT;
                 }
                 if (events & (NVREG_IRQ_UNKNOWN)) {
@@ -2188,7 +2270,7 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data, struct pt_regs *regs)
                                                 dev->name, events);
                 }
                 if (i > max_interrupt_work) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         /* disable interrupts on the nic */
                         writel(NVREG_IRQ_OTHER, base + NvRegIrqMask);
                         pci_push(base);
@@ -2198,7 +2280,7 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data, struct pt_regs *regs)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                         break;
                 }
 
@@ -2221,10 +2303,11 @@ static void nv_do_nic_poll(unsigned long data)
          * nv_nic_irq because that may decide to do otherwise
          */
 
-        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
-            ((np->msi_flags & NV_MSI_X_ENABLED) && 
-             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
-                disable_irq(dev->irq);
+        if (!using_multi_irqs(dev)) {
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        disable_irq(dev->irq);
                 mask = np->irqmask;
         } else {
                 if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
@@ -2247,11 +2330,12 @@ static void nv_do_nic_poll(unsigned long data)
         writel(mask, base + NvRegIrqMask);
         pci_push(base);
 
-        if (!(np->msi_flags & NV_MSI_X_ENABLED) || 
-            ((np->msi_flags & NV_MSI_X_ENABLED) && 
-             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
+        if (!using_multi_irqs(dev)) {
                 nv_nic_irq((int) 0, (void *) data, (struct pt_regs *) NULL);
-                enable_irq(dev->irq);
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        enable_irq(dev->irq);
         } else {
                 if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
                         nv_nic_irq_rx((int) 0, (void *) data, (struct pt_regs *) NULL);
@@ -2488,11 +2572,11 @@ static int nv_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
 }
 
 #define FORCEDETH_REGS_VER      1
-#define FORCEDETH_REGS_SIZE     0x400 /* 256 32-bit registers */
 
 static int nv_get_regs_len(struct net_device *dev)
 {
-        return FORCEDETH_REGS_SIZE;
+        struct fe_priv *np = netdev_priv(dev);
+        return np->register_size;
 }
 
 static void nv_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *buf)
@@ -2504,7 +2588,7 @@ static void nv_get_regs(struct net_device *dev, struct ethtool_regs *regs, void
 
         regs->version = FORCEDETH_REGS_VER;
         spin_lock_irq(&np->lock);
-        for (i=0;i<FORCEDETH_REGS_SIZE/sizeof(u32);i++)
+        for (i = 0;i <= np->register_size/sizeof(u32); i++)
                 rbuf[i] = readl(base + i*sizeof(u32));
         spin_unlock_irq(&np->lock);
 }
@@ -2598,6 +2682,113 @@ static void set_msix_vector_map(struct net_device *dev, u32 vector, u32 irqmask)
         writel(readl(base + NvRegMSIXMap1) | msixmap, base + NvRegMSIXMap1);
 }
 
+static int nv_request_irq(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+        int ret = 1;
+        int i;
+
+        if (np->msi_flags & NV_MSI_X_CAPABLE) {
+                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
+                        np->msi_x_entry[i].entry = i;
+                }
+                if ((ret = pci_enable_msix(np->pci_dev, np->msi_x_entry, (np->msi_flags & NV_MSI_X_VECTORS_MASK))) == 0) {
+                        np->msi_flags |= NV_MSI_X_ENABLED;
+                        if (optimization_mode == NV_OPTIMIZATION_MODE_THROUGHPUT) {
+                                /* Request irq for rx handling */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector, &nv_nic_irq_rx, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed for rx %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_err;
+                                }
+                                /* Request irq for tx handling */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector, &nv_nic_irq_tx, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed for tx %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_free_rx;
+                                }
+                                /* Request irq for link and timer handling */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector, &nv_nic_irq_other, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed for link %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_free_tx;
+                                }
+                                /* map interrupts to their respective vector */
+                                writel(0, base + NvRegMSIXMap0);
+                                writel(0, base + NvRegMSIXMap1);
+                                set_msix_vector_map(dev, NV_MSI_X_VECTOR_RX, NVREG_IRQ_RX_ALL);
+                                set_msix_vector_map(dev, NV_MSI_X_VECTOR_TX, NVREG_IRQ_TX_ALL);
+                                set_msix_vector_map(dev, NV_MSI_X_VECTOR_OTHER, NVREG_IRQ_OTHER);
+                        } else {
+                                /* Request irq for all interrupts */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector, &nv_nic_irq, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_err;
+                                }
+
+                                /* map interrupts to vector 0 */
+                                writel(0, base + NvRegMSIXMap0);
+                                writel(0, base + NvRegMSIXMap1);
+                        }
+                }
+        }
+        if (ret != 0 && np->msi_flags & NV_MSI_CAPABLE) {
+                if ((ret = pci_enable_msi(np->pci_dev)) == 0) {
+                        np->msi_flags |= NV_MSI_ENABLED;
+                        if (request_irq(np->pci_dev->irq, &nv_nic_irq, SA_SHIRQ, dev->name, dev) != 0) {
+                                printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+                                pci_disable_msi(np->pci_dev);
+                                np->msi_flags &= ~NV_MSI_ENABLED;
+                                goto out_err;
+                        }
+
+                        /* map interrupts to vector 0 */
+                        writel(0, base + NvRegMSIMap0);
+                        writel(0, base + NvRegMSIMap1);
+                        /* enable msi vector 0 */
+                        writel(NVREG_MSI_VECTOR_0_ENABLED, base + NvRegMSIIrqMask);
+                }
+        }
+        if (ret != 0) {
+                if (request_irq(np->pci_dev->irq, &nv_nic_irq, SA_SHIRQ, dev->name, dev) != 0)
+                        goto out_err;
+        }
+
+        return 0;
+out_free_tx:
+        free_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector, dev);
+out_free_rx:
+        free_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector, dev);
+out_err:
+        return 1;
+}
+
+static void nv_free_irq(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        int i;
+
+        if (np->msi_flags & NV_MSI_X_ENABLED) {
+                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
+                        free_irq(np->msi_x_entry[i].vector, dev);
+                }
+                pci_disable_msix(np->pci_dev);
+                np->msi_flags &= ~NV_MSI_X_ENABLED;
+        } else {
+                free_irq(np->pci_dev->irq, dev);
+                if (np->msi_flags & NV_MSI_ENABLED) {
+                        pci_disable_msi(np->pci_dev);
+                        np->msi_flags &= ~NV_MSI_ENABLED;
+                }
+        }
+}
+
 static int nv_open(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
@@ -2608,6 +2799,8 @@ static int nv_open(struct net_device *dev)
         dprintk(KERN_DEBUG "nv_open: begin\n");
 
         /* 1) erase previous misconfiguration */
+        if (np->driver_data & DEV_HAS_POWER_CNTRL)
+                nv_mac_reset(dev);
         /* 4.1-1: stop adapter: ignored, 4.3 seems to be overkill */
         writel(NVREG_MCASTADDRA_FORCE, base + NvRegMulticastAddrA);
         writel(0, base + NvRegMulticastAddrB);
@@ -2688,12 +2881,16 @@ static int nv_open(struct net_device *dev)
         udelay(10);
         writel(readl(base + NvRegPowerState) | NVREG_POWERSTATE_VALID, base + NvRegPowerState);
 
-        writel(0, base + NvRegIrqMask);
+        nv_disable_hw_interrupts(dev, np->irqmask);
         pci_push(base);
         writel(NVREG_MIISTAT_MASK2, base + NvRegMIIStatus);
         writel(NVREG_IRQSTAT_MASK, base + NvRegIrqStatus);
         pci_push(base);
 
+        if (nv_request_irq(dev)) {
+                goto out_drain;
+        }
+
         if (np->msi_flags & NV_MSI_X_CAPABLE) {
                 for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
                         np->msi_x_entry[i].entry = i;
@@ -2767,7 +2964,7 @@ static int nv_open(struct net_device *dev)
         }
 
         /* ask for interrupts */
-        writel(np->irqmask, base + NvRegIrqMask);
+        nv_enable_hw_interrupts(dev, np->irqmask);
 
         spin_lock_irq(&np->lock);
         writel(NVREG_MCASTADDRA_FORCE, base + NvRegMulticastAddrA);
@@ -2811,7 +3008,6 @@ static int nv_close(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base;
-        int i;
 
         spin_lock_irq(&np->lock);
         np->in_shutdown = 1;
@@ -2829,31 +3025,13 @@ static int nv_close(struct net_device *dev)
 
         /* disable interrupts on the nic or we will lock up */
         base = get_hwbase(dev);
-        if (np->msi_flags & NV_MSI_X_ENABLED) {
-                writel(np->irqmask, base + NvRegIrqMask);
-        } else {
-                if (np->msi_flags & NV_MSI_ENABLED)
-                        writel(0, base + NvRegMSIIrqMask);
-                writel(0, base + NvRegIrqMask);
-        }
+        nv_disable_hw_interrupts(dev, np->irqmask);
         pci_push(base);
         dprintk(KERN_INFO "%s: Irqmask is zero again\n", dev->name);
 
         spin_unlock_irq(&np->lock);
 
-        if (np->msi_flags & NV_MSI_X_ENABLED) {
-                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
-                        free_irq(np->msi_x_entry[i].vector, dev);
-                }
-                pci_disable_msix(np->pci_dev);
-                np->msi_flags &= ~NV_MSI_X_ENABLED;
-        } else {
-                free_irq(np->pci_dev->irq, dev);
-                if (np->msi_flags & NV_MSI_ENABLED) {
-                        pci_disable_msi(np->pci_dev);
-                        np->msi_flags &= ~NV_MSI_ENABLED;
-                }
-        }
+        nv_free_irq(dev);
 
         drain_ring(dev);
 
@@ -2878,6 +3056,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         unsigned long addr;
         u8 __iomem *base;
         int err, i;
+        u32 powerstate;
 
         dev = alloc_etherdev(sizeof(struct fe_priv));
         err = -ENOMEM;
@@ -2910,6 +3089,11 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         if (err < 0)
                 goto out_disable;
 
+        if (id->driver_data & (DEV_HAS_VLAN|DEV_HAS_MSI_X|DEV_HAS_POWER_CNTRL))
+                np->register_size = NV_PCI_REGSZ_VER2;
+        else
+                np->register_size = NV_PCI_REGSZ_VER1;
+
         err = -EINVAL;
         addr = 0;
         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
@@ -2918,7 +3102,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                                 pci_resource_len(pci_dev, i),
                                 pci_resource_flags(pci_dev, i));
                 if (pci_resource_flags(pci_dev, i) & IORESOURCE_MEM &&
-                                pci_resource_len(pci_dev, i) >= NV_PCI_REGSZ) {
+                                pci_resource_len(pci_dev, i) >= np->register_size) {
                         addr = pci_resource_start(pci_dev, i);
                         break;
                 }
@@ -2929,24 +3113,25 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 goto out_relreg;
         }
 
+        /* copy of driver data */
+        np->driver_data = id->driver_data;
+
         /* handle different descriptor versions */
         if (id->driver_data & DEV_HAS_HIGH_DMA) {
                 /* packet format 3: supports 40-bit addressing */
                 np->desc_ver = DESC_VER_3;
+                np->txrxctl_bits = NVREG_TXRXCTL_DESC_3;
                 if (pci_set_dma_mask(pci_dev, DMA_39BIT_MASK)) {
                         printk(KERN_INFO "forcedeth: 64-bit DMA failed, using 32-bit addressing for device %s.\n",
                                         pci_name(pci_dev));
                 } else {
-                        if (pci_set_consistent_dma_mask(pci_dev, 0x0000007fffffffffULL)) {
-                                printk(KERN_INFO "forcedeth: 64-bit DMA (consistent) failed for device %s.\n",
-                                        pci_name(pci_dev));
-                                goto out_relreg;
-                        } else {
-                                dev->features |= NETIF_F_HIGHDMA;
-                                printk(KERN_INFO "forcedeth: using HIGHDMA\n");
-                        }
+                        dev->features |= NETIF_F_HIGHDMA;
+                        printk(KERN_INFO "forcedeth: using HIGHDMA\n");
+                }
+                if (pci_set_consistent_dma_mask(pci_dev, 0x0000007fffffffffULL)) {
+                        printk(KERN_INFO "forcedeth: 64-bit DMA (consistent) failed for device %s.\n",
+                               pci_name(pci_dev));
                 }
-                np->txrxctl_bits = NVREG_TXRXCTL_DESC_3;
         } else if (id->driver_data & DEV_HAS_LARGEDESC) {
                 /* packet format 2: supports jumbo frames */
                 np->desc_ver = DESC_VER_2;
@@ -2986,7 +3171,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         }
 
         err = -ENOMEM;
-        np->base = ioremap(addr, NV_PCI_REGSZ);
+        np->base = ioremap(addr, np->register_size);
         if (!np->base)
                 goto out_relreg;
         dev->base_addr = (unsigned long)np->base;
@@ -3062,6 +3247,20 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         writel(0, base + NvRegWakeUpFlags);
         np->wolenabled = 0;
 
+        if (id->driver_data & DEV_HAS_POWER_CNTRL) {
+                u8 revision_id;
+                pci_read_config_byte(pci_dev, PCI_REVISION_ID, &revision_id);
+
+                /* take phy and nic out of low power mode */
+                powerstate = readl(base + NvRegPowerState2);
+                powerstate &= ~NVREG_POWERSTATE2_POWERUP_MASK;
+                if ((id->device == PCI_DEVICE_ID_NVIDIA_NVENET_12 ||
+                     id->device == PCI_DEVICE_ID_NVIDIA_NVENET_13) &&
+                    revision_id >= 0xA3)
+                        powerstate |= NVREG_POWERSTATE2_POWERUP_REV_A3;
+                writel(powerstate, base + NvRegPowerState2);
+        }
+
         if (np->desc_ver == DESC_VER_1) {
                 np->tx_flags = NV_TX_VALID;
         } else {
@@ -3223,19 +3422,19 @@ static struct pci_device_id pci_tbl[] = {
         },
         {       /* MCP51 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_12),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL,
         },
         {       /* MCP51 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_13),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL,
         },
         {       /* MCP55 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_14),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X|DEV_HAS_POWER_CNTRL,
         },
         {       /* MCP55 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_15),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X|DEV_HAS_POWER_CNTRL,
         },
         {0,},
 };
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 771e25d8c417..218d31764c52 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -210,7 +210,8 @@ static int gfar_probe(struct platform_device *pdev)
                 goto regs_fail;
         }
 
-        spin_lock_init(&priv->lock);
+        spin_lock_init(&priv->txlock);
+        spin_lock_init(&priv->rxlock);
 
         platform_set_drvdata(pdev, dev);
 
@@ -515,11 +516,13 @@ void stop_gfar(struct net_device *dev)
         phy_stop(priv->phydev);
 
         /* Lock it down */
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
+        spin_lock(&priv->rxlock);
 
         gfar_halt(dev);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock(&priv->rxlock);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         /* Free the IRQs */
         if (priv->einfo->device_flags & FSL_GIANFAR_DEV_HAS_MULTI_INTR) {
@@ -605,14 +608,15 @@ void gfar_start(struct net_device *dev)
         tempval |= DMACTRL_INIT_SETTINGS;
         gfar_write(&priv->regs->dmactrl, tempval);
 
-        /* Clear THLT, so that the DMA starts polling now */
-        gfar_write(&regs->tstat, TSTAT_CLEAR_THALT);
-
         /* Make sure we aren't stopped */
         tempval = gfar_read(&priv->regs->dmactrl);
         tempval &= ~(DMACTRL_GRS | DMACTRL_GTS);
         gfar_write(&priv->regs->dmactrl, tempval);
 
+        /* Clear THLT/RHLT, so that the DMA starts polling now */
+        gfar_write(&regs->tstat, TSTAT_CLEAR_THALT);
+        gfar_write(&regs->rstat, RSTAT_CLEAR_RHALT);
+
         /* Unmask the interrupts we look for */
         gfar_write(&regs->imask, IMASK_DEFAULT);
 }
@@ -928,12 +932,13 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct txfcb *fcb = NULL;
         struct txbd8 *txbdp;
         u16 status;
+        unsigned long flags;
 
         /* Update transmit stats */
         priv->stats.tx_bytes += skb->len;
 
         /* Lock priv now */
-        spin_lock_irq(&priv->lock);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         /* Point at the first free tx descriptor */
         txbdp = priv->cur_tx;
@@ -1004,7 +1009,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         gfar_write(&priv->regs->tstat, TSTAT_CLEAR_THALT);
 
         /* Unlock priv */
-        spin_unlock_irq(&priv->lock);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return 0;
 }
@@ -1049,7 +1054,7 @@ static void gfar_vlan_rx_register(struct net_device *dev,
         unsigned long flags;
         u32 tempval;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
 
         priv->vlgrp = grp;
 
@@ -1076,7 +1081,7 @@ static void gfar_vlan_rx_register(struct net_device *dev,
                 gfar_write(&priv->regs->rctrl, tempval);
         }
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 }
 
 
@@ -1085,12 +1090,12 @@ static void gfar_vlan_rx_kill_vid(struct net_device *dev, uint16_t vid)
         struct gfar_private *priv = netdev_priv(dev);
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
 
         if (priv->vlgrp)
                 priv->vlgrp->vlan_devices[vid] = NULL;
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 }
 
 
@@ -1179,7 +1184,7 @@ static irqreturn_t gfar_transmit(int irq, void *dev_id, struct pt_regs *regs)
         gfar_write(&priv->regs->ievent, IEVENT_TX_MASK);
 
         /* Lock priv */
-        spin_lock(&priv->lock);
+        spin_lock(&priv->txlock);
         bdp = priv->dirty_tx;
         while ((bdp->status & TXBD_READY) == 0) {
                 /* If dirty_tx and cur_tx are the same, then either the */
@@ -1224,7 +1229,7 @@ static irqreturn_t gfar_transmit(int irq, void *dev_id, struct pt_regs *regs)
         else
                 gfar_write(&priv->regs->txic, 0);
 
-        spin_unlock(&priv->lock);
+        spin_unlock(&priv->txlock);
 
         return IRQ_HANDLED;
 }
@@ -1305,9 +1310,10 @@ irqreturn_t gfar_receive(int irq, void *dev_id, struct pt_regs *regs)
 {
         struct net_device *dev = (struct net_device *) dev_id;
         struct gfar_private *priv = netdev_priv(dev);
-
 #ifdef CONFIG_GFAR_NAPI
         u32 tempval;
+#else
+        unsigned long flags;
 #endif
 
         /* Clear IEVENT, so rx interrupt isn't called again
@@ -1330,7 +1336,7 @@ irqreturn_t gfar_receive(int irq, void *dev_id, struct pt_regs *regs)
         }
 #else
 
-        spin_lock(&priv->lock);
+        spin_lock_irqsave(&priv->rxlock, flags);
         gfar_clean_rx_ring(dev, priv->rx_ring_size);
 
         /* If we are coalescing interrupts, update the timer */
@@ -1341,7 +1347,7 @@ irqreturn_t gfar_receive(int irq, void *dev_id, struct pt_regs *regs)
         else
                 gfar_write(&priv->regs->rxic, 0);
 
-        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 #endif
 
         return IRQ_HANDLED;
@@ -1490,13 +1496,6 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
         /* Update the current rxbd pointer to be the next one */
         priv->cur_rx = bdp;
 
-        /* If no packets have arrived since the
-         * last one we processed, clear the IEVENT RX and
-         * BSY bits so that another interrupt won't be
-         * generated when we set IMASK */
-        if (bdp->status & RXBD_EMPTY)
-                gfar_write(&priv->regs->ievent, IEVENT_RX_MASK);
-
         return howmany;
 }
 
@@ -1516,7 +1515,7 @@ static int gfar_poll(struct net_device *dev, int *budget)
         rx_work_limit -= howmany;
         *budget -= howmany;
 
-        if (rx_work_limit >= 0) {
+        if (rx_work_limit > 0) {
                 netif_rx_complete(dev);
 
                 /* Clear the halt bit in RSTAT */
@@ -1533,7 +1532,8 @@ static int gfar_poll(struct net_device *dev, int *budget)
                         gfar_write(&priv->regs->rxic, 0);
         }
 
-        return (rx_work_limit < 0) ? 1 : 0;
+        /* Return 1 if there's more work to do */
+        return (rx_work_limit > 0) ? 0 : 1;
 }
 #endif
 
@@ -1629,7 +1629,7 @@ static void adjust_link(struct net_device *dev)
         struct phy_device *phydev = priv->phydev;
         int new_state = 0;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
         if (phydev->link) {
                 u32 tempval = gfar_read(&regs->maccfg2);
                 u32 ecntrl = gfar_read(&regs->ecntrl);
@@ -1694,7 +1694,7 @@ static void adjust_link(struct net_device *dev)
         if (new_state && netif_msg_link(priv))
                 phy_print_status(phydev);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 }
 
 /* Update the hash table based on the current list of multicast
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index d37d5401be6e..127c98cf3336 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -656,43 +656,62 @@ struct gfar {
  * the buffer descriptor determines the actual condition.
  */
 struct gfar_private {
-        /* pointers to arrays of skbuffs for tx and rx */
+        /* Fields controlled by TX lock */
+        spinlock_t txlock;
+
+        /* Pointer to the array of skbuffs */
         struct sk_buff ** tx_skbuff;
-        struct sk_buff ** rx_skbuff;
 
-        /* indices pointing to the next free sbk in skb arrays */
+        /* next free skb in the array */
         u16 skb_curtx;
-        u16 skb_currx;
 
-        /* index of the first skb which hasn't been transmitted
-         * yet. */
+        /* First skb in line to be transmitted */
         u16 skb_dirtytx;
 
         /* Configuration info for the coalescing features */
         unsigned char txcoalescing;
         unsigned short txcount;
         unsigned short txtime;
+
+        /* Buffer descriptor pointers */
+        struct txbd8 *tx_bd_base;       /* First tx buffer descriptor */
+        struct txbd8 *cur_tx;           /* Next free ring entry */
+        struct txbd8 *dirty_tx;         /* First buffer in line
+                                           to be transmitted */
+        unsigned int tx_ring_size;
+
+        /* RX Locked fields */
+        spinlock_t rxlock;
+
+        /* skb array and index */
+        struct sk_buff ** rx_skbuff;
+        u16 skb_currx;
+
+        /* RX Coalescing values */
         unsigned char rxcoalescing;
         unsigned short rxcount;
         unsigned short rxtime;
 
-        /* GFAR addresses */
-        struct rxbd8 *rx_bd_base;       /* Base addresses of Rx and Tx Buffers */
-        struct txbd8 *tx_bd_base;
+        struct rxbd8 *rx_bd_base;       /* First Rx buffers */
         struct rxbd8 *cur_rx;           /* Next free rx ring entry */
-        struct txbd8 *cur_tx;           /* Next free ring entry */
-        struct txbd8 *dirty_tx;         /* The Ring entry to be freed. */
-        struct gfar __iomem *regs;      /* Pointer to the GFAR memory mapped Registers */
-        u32 __iomem *hash_regs[16];
-        int hash_width;
-        struct net_device_stats stats; /* linux network statistics */
-        struct gfar_extra_stats extra_stats;
-        spinlock_t lock;
+
+        /* RX parameters */
+        unsigned int rx_ring_size;
         unsigned int rx_buffer_size;
         unsigned int rx_stash_size;
         unsigned int rx_stash_index;
-        unsigned int tx_ring_size;
-        unsigned int rx_ring_size;
+
+        struct vlan_group *vlgrp;
+
+        /* Unprotected fields */
+        /* Pointer to the GFAR memory mapped Registers */
+        struct gfar __iomem *regs;
+
+        /* Hash registers and their width */
+        u32 __iomem *hash_regs[16];
+        int hash_width;
+
+        /* global parameters */
         unsigned int fifo_threshold;
         unsigned int fifo_starve;
         unsigned int fifo_starve_off;
@@ -702,13 +721,15 @@ struct gfar_private {
                 extended_hash:1,
                 bd_stash_en:1;
         unsigned short padding;
-        struct vlan_group *vlgrp;
-        /* Info structure initialized by board setup code */
+
         unsigned int interruptTransmit;
         unsigned int interruptReceive;
         unsigned int interruptError;
+
+        /* info structure initialized by platform code */
         struct gianfar_platform_data *einfo;
 
+        /* PHY stuff */
         struct phy_device *phydev;
         struct mii_bus *mii_bus;
         int oldspeed;
@@ -716,6 +737,10 @@ struct gfar_private {
         int oldlink;
 
         uint32_t msg_enable;
+
+        /* Network Statistics */
+        struct net_device_stats stats;
+        struct gfar_extra_stats extra_stats;
 };
 
 static inline u32 gfar_read(volatile unsigned __iomem *addr)
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 5de7b2e259dc..d69698c695ef 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -455,10 +455,14 @@ static int gfar_sringparam(struct net_device *dev, struct ethtool_ringparam *rva
 
                 /* Halt TX and RX, and process the frames which
                  * have already been received */
-                spin_lock_irqsave(&priv->lock, flags);
+                spin_lock_irqsave(&priv->txlock, flags);
+                spin_lock(&priv->rxlock);
+
                 gfar_halt(dev);
                 gfar_clean_rx_ring(dev, priv->rx_ring_size);
-                spin_unlock_irqrestore(&priv->lock, flags);
+
+                spin_unlock(&priv->rxlock);
+                spin_unlock_irqrestore(&priv->txlock, flags);
 
                 /* Now we take down the rings to rebuild them */
                 stop_gfar(dev);
@@ -488,10 +492,14 @@ static int gfar_set_rx_csum(struct net_device *dev, uint32_t data)
 
                 /* Halt TX and RX, and process the frames which
                  * have already been received */
-                spin_lock_irqsave(&priv->lock, flags);
+                spin_lock_irqsave(&priv->txlock, flags);
+                spin_lock(&priv->rxlock);
+
                 gfar_halt(dev);
                 gfar_clean_rx_ring(dev, priv->rx_ring_size);
-                spin_unlock_irqrestore(&priv->lock, flags);
+
+                spin_unlock(&priv->rxlock);
+                spin_unlock_irqrestore(&priv->txlock, flags);
 
                 /* Now we take down the rings to rebuild them */
                 stop_gfar(dev);
@@ -523,7 +531,7 @@ static int gfar_set_tx_csum(struct net_device *dev, uint32_t data)
         if (!(priv->einfo->device_flags & FSL_GIANFAR_DEV_HAS_CSUM))
                 return -EOPNOTSUPP;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
         gfar_halt(dev);
 
         if (data)
@@ -532,7 +540,7 @@ static int gfar_set_tx_csum(struct net_device *dev, uint32_t data)
                 dev->features &= ~NETIF_F_IP_CSUM;
 
         gfar_start(dev);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return 0;
 }
diff --git a/drivers/net/gianfar_sysfs.c b/drivers/net/gianfar_sysfs.c
index 51ef181b1368..a6d5c43199cb 100644
--- a/drivers/net/gianfar_sysfs.c
+++ b/drivers/net/gianfar_sysfs.c
@@ -82,7 +82,7 @@ static ssize_t gfar_set_bd_stash(struct class_device *cdev,
         else
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
 
         /* Set the new stashing value */
         priv->bd_stash_en = new_setting;
@@ -96,7 +96,7 @@ static ssize_t gfar_set_bd_stash(struct class_device *cdev,
 
         gfar_write(&priv->regs->attr, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 
         return count;
 }
@@ -118,7 +118,7 @@ static ssize_t gfar_set_rx_stash_size(struct class_device *cdev,
         u32 temp;
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
         if (length > priv->rx_buffer_size)
                 return count;
 
@@ -142,7 +142,7 @@ static ssize_t gfar_set_rx_stash_size(struct class_device *cdev,
 
         gfar_write(&priv->regs->attr, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 
         return count;
 }
@@ -166,7 +166,7 @@ static ssize_t gfar_set_rx_stash_index(struct class_device *cdev,
         u32 temp;
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
         if (index > priv->rx_stash_size)
                 return count;
 
@@ -180,7 +180,7 @@ static ssize_t gfar_set_rx_stash_index(struct class_device *cdev,
         temp |= ATTRELI_EI(index);
         gfar_write(&priv->regs->attreli, flags);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 
         return count;
 }
@@ -205,7 +205,7 @@ static ssize_t gfar_set_fifo_threshold(struct class_device *cdev,
         if (length > GFAR_MAX_FIFO_THRESHOLD)
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         priv->fifo_threshold = length;
 
@@ -214,7 +214,7 @@ static ssize_t gfar_set_fifo_threshold(struct class_device *cdev,
         temp |= length;
         gfar_write(&priv->regs->fifo_tx_thr, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return count;
 }
@@ -240,7 +240,7 @@ static ssize_t gfar_set_fifo_starve(struct class_device *cdev,
         if (num > GFAR_MAX_FIFO_STARVE)
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         priv->fifo_starve = num;
 
@@ -249,7 +249,7 @@ static ssize_t gfar_set_fifo_starve(struct class_device *cdev,
         temp |= num;
         gfar_write(&priv->regs->fifo_tx_starve, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return count;
 }
@@ -274,7 +274,7 @@ static ssize_t gfar_set_fifo_starve_off(struct class_device *cdev,
         if (num > GFAR_MAX_FIFO_STARVE_OFF)
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         priv->fifo_starve_off = num;
 
@@ -283,7 +283,7 @@ static ssize_t gfar_set_fifo_starve_off(struct class_device *cdev,
         temp |= num;
         gfar_write(&priv->regs->fifo_tx_starve_shutoff, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return count;
 }
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index ea62a3e7d586..411f4d809c47 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -1419,6 +1419,8 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
         mv643xx_eth_update_pscr(dev, &cmd);
         mv643xx_set_settings(dev, &cmd);
 
+        SET_MODULE_OWNER(dev);
+        SET_NETDEV_DEV(dev, &pdev->dev);
         err = register_netdev(dev);
         if (err)
                 goto out;
diff --git a/drivers/net/ne.c b/drivers/net/ne.c
index 08b218c5bfbc..93c494bcd18d 100644
--- a/drivers/net/ne.c
+++ b/drivers/net/ne.c
@@ -226,7 +226,7 @@ struct net_device * __init ne_probe(int unit)
         netdev_boot_setup_check(dev);
 
 #ifdef CONFIG_TOSHIBA_RBTX4938
-        dev->base_addr = 0x07f20280;
+        dev->base_addr = RBTX4938_RTL_8019_BASE;
         dev->irq = RBTX4938_RTL_8019_IRQ;
 #endif
         err = do_ne_probe(dev);
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 506e777c5f06..d090df413049 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1639,6 +1639,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("CONTEC", "C-NET(PC)C-10L", 0x21cab552, 0xf6f90722),
         PCMCIA_DEVICE_PROD_ID12("corega", "FEther PCC-TXF", 0x0a21501a, 0xa51564a2),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-T", 0x5261440f, 0xfa9d85bd),
+        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-TD", 0x5261440f, 0xc49bd73d),
         PCMCIA_DEVICE_PROD_ID12("Corega K.K.", "corega EtherII PCC-TD", 0xd4fdcbd8, 0xc49bd73d),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega Ether PCC-T", 0x5261440f, 0x6705fcaa),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega FastEther PCC-TX", 0x5261440f, 0x485e85d9),
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 67b0eab16589..227df9876a2c 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -51,7 +51,7 @@
 #include "sky2.h"
 
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "1.1"
+#define DRV_VERSION             "1.2"
 #define PFX                     DRV_NAME " "
 
 /*
@@ -925,8 +925,7 @@ static inline struct sk_buff *sky2_alloc_skb(unsigned int size, gfp_t gfp_mask)
         skb = alloc_skb(size + RX_SKB_ALIGN, gfp_mask);
         if (likely(skb)) {
                 unsigned long p = (unsigned long) skb->data;
-                skb_reserve(skb,
-                        ((p + RX_SKB_ALIGN - 1) & ~(RX_SKB_ALIGN - 1)) - p);
+                skb_reserve(skb, ALIGN(p, RX_SKB_ALIGN) - p);
         }
 
         return skb;
@@ -1686,13 +1685,12 @@ static void sky2_tx_timeout(struct net_device *dev)
 }
 
 
-#define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))
 /* Want receive buffer size to be multiple of 64 bits
  * and incl room for vlan and truncation
  */
 static inline unsigned sky2_buf_size(int mtu)
 {
-        return roundup(mtu + ETH_HLEN + VLAN_HLEN, 8) + 8;
+        return ALIGN(mtu + ETH_HLEN + VLAN_HLEN, 8) + 8;
 }
 
 static int sky2_change_mtu(struct net_device *dev, int new_mtu)
@@ -2086,6 +2084,20 @@ static void sky2_descriptor_error(struct sky2_hw *hw, unsigned port,
         }
 }
 
+/* If idle then force a fake soft NAPI poll once a second
+ * to work around cases where sharing an edge triggered interrupt.
+ */
+static void sky2_idle(unsigned long arg)
+{
+        struct net_device *dev = (struct net_device *) arg;
+
+        local_irq_disable();
+        if (__netif_rx_schedule_prep(dev))
+                __netif_rx_schedule(dev);
+        local_irq_enable();
+}
+
+
 static int sky2_poll(struct net_device *dev0, int *budget)
 {
         struct sky2_hw *hw = ((struct sky2_port *) netdev_priv(dev0))->hw;
@@ -2093,6 +2105,7 @@ static int sky2_poll(struct net_device *dev0, int *budget)
         int work_done = 0;
         u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
 
+ restart_poll:
         if (unlikely(status & ~Y2_IS_STAT_BMU)) {
                 if (status & Y2_IS_HW_ERR)
                         sky2_hw_intr(hw);
@@ -2123,7 +2136,7 @@ static int sky2_poll(struct net_device *dev0, int *budget)
         }
 
         if (status & Y2_IS_STAT_BMU) {
-                work_done = sky2_status_intr(hw, work_limit);
+                work_done += sky2_status_intr(hw, work_limit - work_done);
                 *budget -= work_done;
                 dev0->quota -= work_done;
 
@@ -2133,9 +2146,24 @@ static int sky2_poll(struct net_device *dev0, int *budget)
                 sky2_write32(hw, STAT_CTRL, SC_STAT_CLR_IRQ);
         }
 
-        netif_rx_complete(dev0);
+        mod_timer(&hw->idle_timer, jiffies + HZ);
+
+        local_irq_disable();
+        __netif_rx_complete(dev0);
 
         status = sky2_read32(hw, B0_Y2_SP_LISR);
+
+        if (unlikely(status)) {
+                /* More work pending, try and keep going */
+                if (__netif_rx_schedule_prep(dev0)) {
+                        __netif_rx_reschedule(dev0, work_done);
+                        status = sky2_read32(hw, B0_Y2_SP_EISR);
+                        local_irq_enable();
+                        goto restart_poll;
+                }
+        }
+
+        local_irq_enable();
         return 0;
 }
 
@@ -2153,8 +2181,6 @@ static irqreturn_t sky2_intr(int irq, void *dev_id, struct pt_regs *regs)
         prefetch(&hw->st_le[hw->st_idx]);
         if (likely(__netif_rx_schedule_prep(dev0)))
                 __netif_rx_schedule(dev0);
-        else
-                printk(KERN_DEBUG PFX "irq race detected\n");
 
         return IRQ_HANDLED;
 }
@@ -2193,7 +2219,7 @@ static inline u32 sky2_clk2us(const struct sky2_hw *hw, u32 clk)
 }
 
 
-static int sky2_reset(struct sky2_hw *hw)
+static int __devinit sky2_reset(struct sky2_hw *hw)
 {
         u16 status;
         u8 t8, pmd_type;
@@ -3276,6 +3302,8 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
 
         sky2_write32(hw, B0_IMSK, Y2_IS_BASE);
 
+        setup_timer(&hw->idle_timer, sky2_idle, (unsigned long) dev);
+
         pci_set_drvdata(pdev, hw);
 
         return 0;
@@ -3311,13 +3339,15 @@ static void __devexit sky2_remove(struct pci_dev *pdev)
         if (!hw)
                 return;
 
+        del_timer_sync(&hw->idle_timer);
+
+        sky2_write32(hw, B0_IMSK, 0);
         dev0 = hw->dev[0];
         dev1 = hw->dev[1];
         if (dev1)
                 unregister_netdev(dev1);
         unregister_netdev(dev0);
 
-        sky2_write32(hw, B0_IMSK, 0);
         sky2_set_power_state(hw, PCI_D3hot);
         sky2_write16(hw, B0_Y2LED, LED_STAT_OFF);
         sky2_write8(hw, B0_CTST, CS_RST_SET);
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index 89dd18cd12f0..b026f5653f04 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -1880,6 +1880,8 @@ struct sky2_hw {
         struct sky2_status_le *st_le;
         u32                  st_idx;
         dma_addr_t           st_dma;
+
+        struct timer_list    idle_timer;
         int                  msi_detected;
         wait_queue_head_t    msi_wait;
 };
diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
index cb0aba95d4e3..046371ee5bbe 100644
--- a/drivers/net/sungem_phy.c
+++ b/drivers/net/sungem_phy.c
@@ -275,7 +275,7 @@ static int bcm5411_init(struct mii_phy* phy)
         return 0;
 }
 
-static int bcm5411_suspend(struct mii_phy* phy)
+static int generic_suspend(struct mii_phy* phy)
 {
         phy_write(phy, MII_BMCR, BMCR_PDOWN);
 
@@ -738,7 +738,7 @@ static struct mii_phy_def bcm5401_phy_def = {
 /* Broadcom BCM 5411 */
 static struct mii_phy_ops bcm5411_phy_ops = {
         .init           = bcm5411_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -757,7 +757,7 @@ static struct mii_phy_def bcm5411_phy_def = {
 /* Broadcom BCM 5421 */
 static struct mii_phy_ops bcm5421_phy_ops = {
         .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -776,7 +776,7 @@ static struct mii_phy_def bcm5421_phy_def = {
 /* Broadcom BCM 5421 built-in K2 */
 static struct mii_phy_ops bcm5421k2_phy_ops = {
         .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -795,7 +795,7 @@ static struct mii_phy_def bcm5421k2_phy_def = {
 /* Broadcom BCM 5462 built-in Vesta */
 static struct mii_phy_ops bcm5462V_phy_ops = {
         .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -816,6 +816,7 @@ static struct mii_phy_def bcm5462V_phy_def = {
  * would be useful here) --BenH.
  */
 static struct mii_phy_ops marvell_phy_ops = {
+        .suspend        = generic_suspend,
         .setup_aneg     = marvell_setup_aneg,
         .setup_forced   = marvell_setup_forced,
         .poll_link      = genmii_poll_link,
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 73e271e59c6a..beeb612be98f 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -69,8 +69,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.56"
-#define DRV_MODULE_RELDATE      "Apr 1, 2006"
+#define DRV_MODULE_VERSION      "3.57"
+#define DRV_MODULE_RELDATE      "Apr 28, 2006"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -974,6 +974,8 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
         return err;
 }
 
+static void tg3_link_report(struct tg3 *);
+
 /* This will reset the tigon3 PHY if there is no valid
  * link unless the FORCE argument is non-zero.
  */
@@ -987,6 +989,11 @@ static int tg3_phy_reset(struct tg3 *tp)
         if (err != 0)
                 return -EBUSY;
 
+        if (netif_running(tp->dev) && netif_carrier_ok(tp->dev)) {
+                netif_carrier_off(tp->dev);
+                tg3_link_report(tp);
+        }
+
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5703 ||
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704 ||
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705) {
@@ -1023,6 +1030,12 @@ out:
                 tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x14e2);
                 tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0400);
         }
+        else if (tp->tg3_flags2 & TG3_FLG2_PHY_JITTER_BUG) {
+                tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0c00);
+                tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x000a);
+                tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x010b);
+                tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0400);
+        }
         /* Set Extended packet length bit (bit 14) on all chips that */
         /* support jumbo frames */
         if ((tp->phy_id & PHY_ID_MASK) == PHY_ID_BCM5401) {
@@ -3531,7 +3544,7 @@ static irqreturn_t tg3_test_isr(int irq, void *dev_id,
         return IRQ_RETVAL(0);
 }
 
-static int tg3_init_hw(struct tg3 *);
+static int tg3_init_hw(struct tg3 *, int);
 static int tg3_halt(struct tg3 *, int, int);
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -3567,7 +3580,7 @@ static void tg3_reset_task(void *_data)
         tp->tg3_flags2 &= ~TG3_FLG2_RESTART_TIMER;
 
         tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
-        tg3_init_hw(tp);
+        tg3_init_hw(tp, 1);
 
         tg3_netif_start(tp);
 
@@ -4042,7 +4055,7 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
 
         tg3_set_mtu(dev, tp, new_mtu);
 
-        tg3_init_hw(tp);
+        tg3_init_hw(tp, 0);
 
         tg3_netif_start(tp);
 
@@ -5719,9 +5732,23 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
         if (!netif_running(dev))
                 return 0;
 
-        spin_lock_bh(&tp->lock);
-        __tg3_set_mac_addr(tp);
-        spin_unlock_bh(&tp->lock);
+        if (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) {
+                /* Reset chip so that ASF can re-init any MAC addresses it
+                 * needs.
+                 */
+                tg3_netif_stop(tp);
+                tg3_full_lock(tp, 1);
+
+                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+                tg3_init_hw(tp, 0);
+
+                tg3_netif_start(tp);
+                tg3_full_unlock(tp);
+        } else {
+                spin_lock_bh(&tp->lock);
+                __tg3_set_mac_addr(tp);
+                spin_unlock_bh(&tp->lock);
+        }
 
         return 0;
 }
@@ -5771,7 +5798,7 @@ static void __tg3_set_coalesce(struct tg3 *tp, struct ethtool_coalesce *ec)
 }
 
 /* tp->lock is held. */
-static int tg3_reset_hw(struct tg3 *tp)
+static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
 {
         u32 val, rdmac_mode;
         int i, err, limit;
@@ -5786,7 +5813,7 @@ static int tg3_reset_hw(struct tg3 *tp)
                 tg3_abort_hw(tp, 1);
         }
 
-        if (tp->tg3_flags2 & TG3_FLG2_MII_SERDES)
+        if ((tp->tg3_flags2 & TG3_FLG2_MII_SERDES) && reset_phy)
                 tg3_phy_reset(tp);
 
         err = tg3_chip_reset(tp);
@@ -6327,7 +6354,7 @@ static int tg3_reset_hw(struct tg3 *tp)
                 tw32(GRC_LOCAL_CTRL, tp->grc_local_ctrl);
         }
 
-        err = tg3_setup_phy(tp, 1);
+        err = tg3_setup_phy(tp, reset_phy);
         if (err)
                 return err;
 
@@ -6400,7 +6427,7 @@ static int tg3_reset_hw(struct tg3 *tp)
 /* Called at device open time to get the chip ready for
  * packet processing.  Invoked with tp->lock held.
  */
-static int tg3_init_hw(struct tg3 *tp)
+static int tg3_init_hw(struct tg3 *tp, int reset_phy)
 {
         int err;
 
@@ -6413,7 +6440,7 @@ static int tg3_init_hw(struct tg3 *tp)
 
         tw32(TG3PCI_MEM_WIN_BASE_ADDR, 0);
 
-        err = tg3_reset_hw(tp);
+        err = tg3_reset_hw(tp, reset_phy);
 
 out:
         return err;
@@ -6683,7 +6710,7 @@ static int tg3_test_msi(struct tg3 *tp)
         tg3_full_lock(tp, 1);
 
         tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-        err = tg3_init_hw(tp);
+        err = tg3_init_hw(tp, 1);
 
         tg3_full_unlock(tp);
 
@@ -6748,7 +6775,7 @@ static int tg3_open(struct net_device *dev)
 
         tg3_full_lock(tp, 0);
 
-        err = tg3_init_hw(tp);
+        err = tg3_init_hw(tp, 1);
         if (err) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
                 tg3_free_rings(tp);
@@ -7839,7 +7866,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp);
+                tg3_init_hw(tp, 1);
                 tg3_netif_start(tp);
         }
 
@@ -7884,7 +7911,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp);
+                tg3_init_hw(tp, 1);
                 tg3_netif_start(tp);
         }
 
@@ -8522,7 +8549,7 @@ static int tg3_test_loopback(struct tg3 *tp)
         if (!netif_running(tp->dev))
                 return TG3_LOOPBACK_FAILED;
 
-        tg3_reset_hw(tp);
+        tg3_reset_hw(tp, 1);
 
         if (tg3_run_loopback(tp, TG3_MAC_LOOPBACK))
                 err |= TG3_MAC_LOOPBACK_FAILED;
@@ -8596,7 +8623,7 @@ static void tg3_self_test(struct net_device *dev, struct ethtool_test *etest,
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
                 if (netif_running(dev)) {
                         tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                        tg3_init_hw(tp);
+                        tg3_init_hw(tp, 1);
                         tg3_netif_start(tp);
                 }
 
@@ -9377,7 +9404,7 @@ static int tg3_nvram_write_block_buffered(struct tg3 *tp, u32 offset, u32 len,
 
                 if ((page_off == 0) || (i == 0))
                         nvram_cmd |= NVRAM_CMD_FIRST;
-                else if (page_off == (tp->nvram_pagesize - 4))
+                if (page_off == (tp->nvram_pagesize - 4))
                         nvram_cmd |= NVRAM_CMD_LAST;
 
                 if (i == (len - 4))
@@ -10353,10 +10380,13 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (tp->pci_chip_rev_id == CHIPREV_ID_5704_A0)
                 tp->tg3_flags2 |= TG3_FLG2_PHY_5704_A0_BUG;
 
-        if ((tp->tg3_flags2 & TG3_FLG2_5705_PLUS) &&
-            (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5755) &&
-            (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5787))
-                tp->tg3_flags2 |= TG3_FLG2_PHY_BER_BUG;
+        if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS) {
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5755 ||
+                    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5787)
+                        tp->tg3_flags2 |= TG3_FLG2_PHY_JITTER_BUG;
+                else
+                        tp->tg3_flags2 |= TG3_FLG2_PHY_BER_BUG;
+        }
 
         tp->coalesce_mode = 0;
         if (GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_5700_AX &&
@@ -11569,7 +11599,7 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
                 tg3_full_lock(tp, 0);
 
                 tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                tg3_init_hw(tp);
+                tg3_init_hw(tp, 1);
 
                 tp->timer.expires = jiffies + tp->timer_offset;
                 add_timer(&tp->timer);
@@ -11603,7 +11633,7 @@ static int tg3_resume(struct pci_dev *pdev)
         tg3_full_lock(tp, 0);
 
         tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-        tg3_init_hw(tp);
+        tg3_init_hw(tp, 1);
 
         tp->timer.expires = jiffies + tp->timer_offset;
         add_timer(&tp->timer);
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 8c8b987d1250..0e29b885d449 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2215,6 +2215,7 @@ struct tg3 {
 #define TG3_FLG2_HW_TSO_2               0x08000000
 #define TG3_FLG2_HW_TSO                 (TG3_FLG2_HW_TSO_1 | TG3_FLG2_HW_TSO_2)
 #define TG3_FLG2_1SHOT_MSI              0x10000000
+#define TG3_FLG2_PHY_JITTER_BUG         0x20000000
 
         u32                             split_mode_max_reqs;
 #define SPLIT_MODE_5704_MAX_REQ         3
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 6a23964c1317..a6dc53b4250d 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -129,6 +129,7 @@
         - Massive clean-up
         - Rewrite PHY, media handling (remove options, full_duplex, backoff)
         - Fix Tx engine race for good
+        - Craig Brind: Zero padded aligned buffers for short packets.
 
 */
 
@@ -1326,7 +1327,12 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
                         rp->stats.tx_dropped++;
                         return 0;
                 }
+
+                /* Padding is not copied and so must be redone. */
                 skb_copy_and_csum_dev(skb, rp->tx_buf[entry]);
+                if (skb->len < ETH_ZLEN)
+                        memset(rp->tx_buf[entry] + skb->len, 0,
+                               ETH_ZLEN - skb->len);
                 rp->tx_skbuff_dma[entry] = 0;
                 rp->tx_ring[entry].addr = cpu_to_le32(rp->tx_bufs_dma +
                                                       (rp->tx_buf[entry] -
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index bad09ebdb50b..e0874cbfefea 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -6,7 +6,7 @@ menu "Wireless LAN (non-hamradio)"
         depends on NETDEVICES
 
 config NET_RADIO
-        bool "Wireless LAN drivers (non-hamradio)"
+        bool "Wireless LAN drivers (non-hamradio) & Wireless Extensions"
         select WIRELESS_EXT
         ---help---
           Support for wireless LANs and everything having to do with radio,
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 108d9fed8f07..00764ddd74d8 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -3139,6 +3139,7 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                 }
                 if ( status & EV_LINK ) {
                         union iwreq_data        wrqu;
+                        int scan_forceloss = 0;
                         /* The link status has changed, if you want to put a
                            monitor hook in, do it here.  (Remember that
                            interrupts are still disabled!)
@@ -3157,7 +3158,8 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                           code) */
 #define AUTHFAIL 0x0300 /* Authentication failure (low byte is reason
                            code) */
-#define ASSOCIATED 0x0400 /* Assocatied */
+#define ASSOCIATED 0x0400 /* Associated */
+#define REASSOCIATED 0x0600 /* Reassociated?  Only on firmware >= 5.30.17 */
 #define RC_RESERVED 0 /* Reserved return code */
 #define RC_NOREASON 1 /* Unspecified reason */
 #define RC_AUTHINV 2 /* Previous authentication invalid */
@@ -3174,44 +3176,30 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                           leaving BSS */
 #define RC_NOAUTH 9 /* Station requesting (Re)Association is not
                        Authenticated with the responding station */
-                        if (newStatus != ASSOCIATED) {
-                                if (auto_wep && !apriv->expires) {
-                                        apriv->expires = RUN_AT(3*HZ);
-                                        wake_up_interruptible(&apriv->thr_wait);
-                                }
-                        } else {
-                                struct task_struct *task = apriv->task;
+                        if (newStatus == FORCELOSS && apriv->scan_timeout > 0)
+                                scan_forceloss = 1;
+                        if(newStatus == ASSOCIATED || newStatus == REASSOCIATED) {
                                 if (auto_wep)
                                         apriv->expires = 0;
-                                if (task)
-                                        wake_up_process (task);
+                                if (apriv->task)
+                                        wake_up_process (apriv->task);
                                 set_bit(FLAG_UPDATE_UNI, &apriv->flags);
                                 set_bit(FLAG_UPDATE_MULTI, &apriv->flags);
-                        }
-                        /* Question : is ASSOCIATED the only status
-                         * that is valid ? We want to catch handover
-                         * and reassociations as valid status
-                         * Jean II */
-                        if(newStatus == ASSOCIATED) {
-#if 0
-                                /* FIXME: Grabbing scan results here
-                                 * seems to be too early???  Just wait for
-                                 * timeout instead. */
-                                if (apriv->scan_timeout > 0) {
-                                        set_bit(JOB_SCAN_RESULTS, &apriv->flags);
-                                        wake_up_interruptible(&apriv->thr_wait);
-                                }
-#endif
+
                                 if (down_trylock(&apriv->sem) != 0) {
                                         set_bit(JOB_EVENT, &apriv->flags);
                                         wake_up_interruptible(&apriv->thr_wait);
                                 } else
                                         airo_send_event(dev);
-                        } else {
-                                memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
-                                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        } else if (!scan_forceloss) {
+                                if (auto_wep && !apriv->expires) {
+                                        apriv->expires = RUN_AT(3*HZ);
+                                        wake_up_interruptible(&apriv->thr_wait);
+                                }
 
                                 /* Send event to user space */
+                                memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
+                                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
                                 wireless_send_event(dev, SIOCGIWAP, &wrqu,NULL);
                         }
                 }
@@ -7136,10 +7124,10 @@ static int airo_set_scan(struct net_device *dev,
                 goto out;
 
         /* Initiate a scan command */
+        ai->scan_timeout = RUN_AT(3*HZ);
         memset(&cmd, 0, sizeof(cmd));
         cmd.cmd=CMD_LISTBSS;
         issuecommand(ai, &cmd, &rsp);
-        ai->scan_timeout = RUN_AT(3*HZ);
         wake = 1;
 
 out:
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 87afa6878f26..8606c88886fc 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -3463,6 +3463,7 @@ static void atmel_command_irq(struct atmel_private *priv)
         u8 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
         u8 command = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET));
         int fast_scan;
+        union iwreq_data wrqu;
 
         if (status == CMD_STATUS_IDLE ||
             status == CMD_STATUS_IN_PROGRESS)
@@ -3487,6 +3488,7 @@ static void atmel_command_irq(struct atmel_private *priv)
                         atmel_scan(priv, 1);
                 } else {
                         int bss_index = retrieve_bss(priv);
+                        int notify_scan_complete = 1;
                         if (bss_index != -1) {
                                 atmel_join_bss(priv, bss_index);
                         } else if (priv->operating_mode == IW_MODE_ADHOC &&
@@ -3495,8 +3497,14 @@ static void atmel_command_irq(struct atmel_private *priv)
                         } else {
                                 priv->fast_scan = !fast_scan;
                                 atmel_scan(priv, 1);
+                                notify_scan_complete = 0;
                         }
                         priv->site_survey_state = SITE_SURVEY_COMPLETED;
+                        if (notify_scan_complete) {
+                                wrqu.data.length = 0;
+                                wrqu.data.flags = 0;
+                                wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
+                        }
                 }
                 break;
 
@@ -3509,6 +3517,9 @@ static void atmel_command_irq(struct atmel_private *priv)
                 priv->site_survey_state = SITE_SURVEY_COMPLETED;
                 if (priv->station_is_associated) {
                         atmel_enter_state(priv, STATION_STATE_READY);
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
                 } else {
                         atmel_scan(priv, 1);
                 }
diff --git a/drivers/net/wireless/bcm43xx/Kconfig b/drivers/net/wireless/bcm43xx/Kconfig
index 418465600a77..25ea4748f0b9 100644
--- a/drivers/net/wireless/bcm43xx/Kconfig
+++ b/drivers/net/wireless/bcm43xx/Kconfig
@@ -17,8 +17,11 @@ config BCM43XX_DEBUG
 
 config BCM43XX_DMA
         bool
+        depends on BCM43XX
+
 config BCM43XX_PIO
         bool
+        depends on BCM43XX
 
 choice
         prompt "BCM43xx data transfer mode"
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx.h b/drivers/net/wireless/bcm43xx/bcm43xx.h
index dcadd295de4f..2e83083935e1 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx.h
@@ -15,7 +15,6 @@
 
 #include "bcm43xx_debugfs.h"
 #include "bcm43xx_leds.h"
-#include "bcm43xx_sysfs.h"
 
 
 #define PFX                             KBUILD_MODNAME ": "
@@ -638,8 +637,6 @@ struct bcm43xx_key {
 };
 
 struct bcm43xx_private {
-        struct bcm43xx_sysfs sysfs;
-
         struct ieee80211_device *ieee;
         struct ieee80211softmac_device *softmac;
 
@@ -772,6 +769,20 @@ struct bcm43xx_private * bcm43xx_priv(struct net_device *dev)
         return ieee80211softmac_priv(dev);
 }
 
+struct device;
+
+static inline
+struct bcm43xx_private * dev_to_bcm(struct device *dev)
+{
+        struct net_device *net_dev;
+        struct bcm43xx_private *bcm;
+
+        net_dev = dev_get_drvdata(dev);
+        bcm = bcm43xx_priv(net_dev);
+
+        return bcm;
+}
+
 
 /* Helper function, which returns a boolean.
  * TRUE, if PIO is used; FALSE, if DMA is used.
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
index d2c3401e9b70..35a4fcb6d923 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
@@ -452,12 +452,12 @@ void bcm43xx_printk_dump(const char *data,
         size_t i;
         char c;
 
-        printk(KERN_INFO PFX "Data dump (%s, %u bytes):",
+        printk(KERN_INFO PFX "Data dump (%s, %zd bytes):",
                description, size);
         for (i = 0; i < size; i++) {
                 c = data[i];
                 if (i % 8 == 0)
-                        printk("\n" KERN_INFO PFX "0x%08x:  0x%02x, ", i, c & 0xff);
+                        printk("\n" KERN_INFO PFX "0x%08zx:  0x%02x, ", i, c & 0xff);
                 else
                         printk("0x%02x, ", c & 0xff);
         }
@@ -472,12 +472,12 @@ void bcm43xx_printk_bitdump(const unsigned char *data,
         int j;
         const unsigned char *d;
 
-        printk(KERN_INFO PFX "*** Bitdump (%s, %u bytes, %s) ***",
+        printk(KERN_INFO PFX "*** Bitdump (%s, %zd bytes, %s) ***",
                description, bytes, msb_to_lsb ? "MSB to LSB" : "LSB to MSB");
         for (i = 0; i < bytes; i++) {
                 d = data + i;
                 if (i % 8 == 0)
-                        printk("\n" KERN_INFO PFX "0x%08x:  ", i);
+                        printk("\n" KERN_INFO PFX "0x%08zx:  ", i);
                 if (msb_to_lsb) {
                         for (j = 7; j >= 0; j--) {
                                 if (*d & (1 << j))
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
index c3681b8f09b4..bbecba02e697 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
@@ -196,8 +196,9 @@ static int alloc_ringmemory(struct bcm43xx_dmaring *ring)
         }
         if (ring->dmabase + BCM43xx_DMA_RINGMEMSIZE > BCM43xx_DMA_BUSADDRMAX) {
                 printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA RINGMEMORY >1G "
-                                    "(0x%08x, len: %lu)\n",
-                       ring->dmabase, BCM43xx_DMA_RINGMEMSIZE);
+                                    "(0x%llx, len: %lu)\n",
+                                (unsigned long long)ring->dmabase,
+                                BCM43xx_DMA_RINGMEMSIZE);
                 dma_free_coherent(dev, BCM43xx_DMA_RINGMEMSIZE,
                                   ring->vbase, ring->dmabase);
                 return -ENOMEM;
@@ -307,8 +308,8 @@ static int setup_rx_descbuffer(struct bcm43xx_dmaring *ring,
                 unmap_descbuffer(ring, dmaaddr, ring->rx_buffersize, 0);
                 dev_kfree_skb_any(skb);
                 printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA RX SKB >1G "
-                                    "(0x%08x, len: %u)\n",
-                       dmaaddr, ring->rx_buffersize);
+                                    "(0x%llx, len: %u)\n",
+                        (unsigned long long)dmaaddr, ring->rx_buffersize);
                 return -ENOMEM;
         }
         meta->skb = skb;
@@ -729,8 +730,8 @@ static int dma_tx_fragment(struct bcm43xx_dmaring *ring,
         if (unlikely(meta->dmaaddr + skb->len > BCM43xx_DMA_BUSADDRMAX)) {
                 return_slot(ring, slot);
                 printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA TX SKB >1G "
-                                    "(0x%08x, len: %u)\n",
-                       meta->dmaaddr, skb->len);
+                                    "(0x%llx, len: %u)\n",
+                        (unsigned long long)meta->dmaaddr, skb->len);
                 return -ENOMEM;
         }
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.h b/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
index 2d520e4b0276..b7d77638ba8c 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
@@ -213,6 +213,14 @@ static inline
 void bcm43xx_dma_rx(struct bcm43xx_dmaring *ring)
 {
 }
+static inline
+void bcm43xx_dma_tx_suspend(struct bcm43xx_dmaring *ring)
+{
+}
+static inline
+void bcm43xx_dma_tx_resume(struct bcm43xx_dmaring *ring)
+{
+}
 
 #endif /* CONFIG_BCM43XX_DMA */
 #endif /* BCM43xx_DMA_H_ */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index c37371fc9e01..9a06e61df0a2 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -52,6 +52,7 @@
 #include "bcm43xx_wx.h"
 #include "bcm43xx_ethtool.h"
 #include "bcm43xx_xmit.h"
+#include "bcm43xx_sysfs.h"
 
 
 MODULE_DESCRIPTION("Broadcom BCM43xx wireless driver");
@@ -3522,6 +3523,7 @@ static inline int bcm43xx_tx(struct bcm43xx_private *bcm,
                 err = bcm43xx_pio_tx(bcm, txb);
         else
                 err = bcm43xx_dma_tx(bcm, txb);
+        bcm->net_dev->trans_start = jiffies;
 
         return err;
 }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
index 0a66f43ca0c0..33137165727f 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
@@ -2151,6 +2151,7 @@ int bcm43xx_phy_init_tssi2dbm_table(struct bcm43xx_private *bcm)
                                 phy->tssi2dbm = NULL;
                                 printk(KERN_ERR PFX "Could not generate "
                                                     "tssi2dBm table\n");
+                                kfree(dyn_tssi2dbm);
                                 return -ENODEV;
                         }
                 phy->tssi2dbm = dyn_tssi2dbm;
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_pio.c b/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
index c59ddd40680d..0aa1bd269a25 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
@@ -27,6 +27,7 @@
 #include "bcm43xx_pio.h"
 #include "bcm43xx_main.h"
 #include "bcm43xx_xmit.h"
+#include "bcm43xx_power.h"
 
 #include <linux/delay.h>
 
@@ -44,10 +45,10 @@ static void tx_octet(struct bcm43xx_pioqueue *queue,
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXDATA,
                                   octet);
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
-                                  BCM43xx_PIO_TXCTL_WRITEHI);
+                                  BCM43xx_PIO_TXCTL_WRITELO);
         } else {
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
-                                  BCM43xx_PIO_TXCTL_WRITEHI);
+                                  BCM43xx_PIO_TXCTL_WRITELO);
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXDATA,
                                   octet);
         }
@@ -103,7 +104,7 @@ static void tx_complete(struct bcm43xx_pioqueue *queue,
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXDATA,
                                   skb->data[skb->len - 1]);
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
-                                  BCM43xx_PIO_TXCTL_WRITEHI |
+                                  BCM43xx_PIO_TXCTL_WRITELO |
                                   BCM43xx_PIO_TXCTL_COMPLETE);
         } else {
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
@@ -112,9 +113,10 @@ static void tx_complete(struct bcm43xx_pioqueue *queue,
 }
 
 static u16 generate_cookie(struct bcm43xx_pioqueue *queue,
-                           int packetindex)
+                           struct bcm43xx_pio_txpacket *packet)
 {
         u16 cookie = 0x0000;
+        int packetindex;
 
         /* We use the upper 4 bits for the PIO
          * controller ID and the lower 12 bits
@@ -135,6 +137,7 @@ static u16 generate_cookie(struct bcm43xx_pioqueue *queue,
         default:
                 assert(0);
         }
+        packetindex = pio_txpacket_getindex(packet);
         assert(((u16)packetindex & 0xF000) == 0x0000);
         cookie |= (u16)packetindex;
 
@@ -184,7 +187,7 @@ static void pio_tx_write_fragment(struct bcm43xx_pioqueue *queue,
         bcm43xx_generate_txhdr(queue->bcm,
                                &txhdr, skb->data, skb->len,
                                (packet->xmitted_frags == 0),
-                               generate_cookie(queue, pio_txpacket_getindex(packet)));
+                               generate_cookie(queue, packet));
 
         tx_start(queue);
         octets = skb->len + sizeof(txhdr);
@@ -241,7 +244,7 @@ static int pio_tx_packet(struct bcm43xx_pio_txpacket *packet)
                 queue->tx_devq_packets++;
                 queue->tx_devq_used += octets;
 
-                assert(packet->xmitted_frags <= packet->txb->nr_frags);
+                assert(packet->xmitted_frags < packet->txb->nr_frags);
                 packet->xmitted_frags++;
                 packet->xmitted_octets += octets;
         }
@@ -257,8 +260,14 @@ static void tx_tasklet(unsigned long d)
         unsigned long flags;
         struct bcm43xx_pio_txpacket *packet, *tmp_packet;
         int err;
+        u16 txctl;
 
         bcm43xx_lock_mmio(bcm, flags);
+
+        txctl = bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL);
+        if (txctl & BCM43xx_PIO_TXCTL_SUSPEND)
+                goto out_unlock;
+
         list_for_each_entry_safe(packet, tmp_packet, &queue->txqueue, list) {
                 assert(packet->xmitted_frags < packet->txb->nr_frags);
                 if (packet->xmitted_frags == 0) {
@@ -288,6 +297,7 @@ static void tx_tasklet(unsigned long d)
         next_packet:
                 continue;
         }
+out_unlock:
         bcm43xx_unlock_mmio(bcm, flags);
 }
 
@@ -330,12 +340,19 @@ struct bcm43xx_pioqueue * bcm43xx_setup_pioqueue(struct bcm43xx_private *bcm,
                      (unsigned long)queue);
 
         value = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
-        value |= BCM43xx_SBF_XFER_REG_BYTESWAP;
+        value &= ~BCM43xx_SBF_XFER_REG_BYTESWAP;
         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value);
 
         qsize = bcm43xx_read16(bcm, queue->mmio_base + BCM43xx_PIO_TXQBUFSIZE);
+        if (qsize == 0) {
+                printk(KERN_ERR PFX "ERROR: This card does not support PIO "
+                                    "operation mode. Please use DMA mode "
+                                    "(module parameter pio=0).\n");
+                goto err_freequeue;
+        }
         if (qsize <= BCM43xx_PIO_TXQADJUST) {
-                printk(KERN_ERR PFX "PIO tx device-queue too small (%u)\n", qsize);
+                printk(KERN_ERR PFX "PIO tx device-queue too small (%u)\n",
+                       qsize);
                 goto err_freequeue;
         }
         qsize -= BCM43xx_PIO_TXQADJUST;
@@ -444,15 +461,10 @@ int bcm43xx_pio_tx(struct bcm43xx_private *bcm,
 {
         struct bcm43xx_pioqueue *queue = bcm43xx_current_pio(bcm)->queue1;
         struct bcm43xx_pio_txpacket *packet;
-        u16 tmp;
 
         assert(!queue->tx_suspended);
         assert(!list_empty(&queue->txfree));
 
-        tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL);
-        if (tmp & BCM43xx_PIO_TXCTL_SUSPEND)
-                return -EBUSY;
-
         packet = list_entry(queue->txfree.next, struct bcm43xx_pio_txpacket, list);
         packet->txb = txb;
         packet->xmitted_frags = 0;
@@ -462,7 +474,7 @@ int bcm43xx_pio_tx(struct bcm43xx_private *bcm,
         assert(queue->nr_txfree < BCM43xx_PIO_MAXTXPACKETS);
 
         /* Suspend TX, if we are out of packets in the "free" queue. */
-        if (unlikely(list_empty(&queue->txfree))) {
+        if (list_empty(&queue->txfree)) {
                 netif_stop_queue(queue->bcm->net_dev);
                 queue->tx_suspended = 1;
         }
@@ -480,15 +492,15 @@ void bcm43xx_pio_handle_xmitstatus(struct bcm43xx_private *bcm,
 
         queue = parse_cookie(bcm, status->cookie, &packet);
         assert(queue);
-//TODO
-if (!queue)
-return;
+
         free_txpacket(packet, 1);
-        if (unlikely(queue->tx_suspended)) {
+        if (queue->tx_suspended) {
                 queue->tx_suspended = 0;
                 netif_wake_queue(queue->bcm->net_dev);
         }
-        /* If there are packets on the txqueue, poke the tasklet. */
+        /* If there are packets on the txqueue, poke the tasklet
+         * to transmit them.
+         */
         if (!list_empty(&queue->txqueue))
                 tasklet_schedule(&queue->txtask);
 }
@@ -519,12 +531,9 @@ void bcm43xx_pio_rx(struct bcm43xx_pioqueue *queue)
         int i, preamble_readwords;
         struct sk_buff *skb;
 
-return;
         tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXCTL);
-        if (!(tmp & BCM43xx_PIO_RXCTL_DATAAVAILABLE)) {
-                dprintkl(KERN_ERR PFX "PIO RX: No data available\n");//TODO: remove this printk.
+        if (!(tmp & BCM43xx_PIO_RXCTL_DATAAVAILABLE))
                 return;
-        }
         bcm43xx_pio_write(queue, BCM43xx_PIO_RXCTL,
                           BCM43xx_PIO_RXCTL_DATAAVAILABLE);
 
@@ -538,8 +547,7 @@ return;
         return;
 data_ready:
 
-//FIXME: endianess in this function.
-        len = le16_to_cpu(bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA));
+        len = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
         if (unlikely(len > 0x700)) {
                 pio_rx_error(queue, 0, "len > 0x700");
                 return;
@@ -555,7 +563,7 @@ data_ready:
                 preamble_readwords = 18 / sizeof(u16);
         for (i = 0; i < preamble_readwords; i++) {
                 tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
-                preamble[i + 1] = cpu_to_be16(tmp);//FIXME?
+                preamble[i + 1] = cpu_to_le16(tmp);
         }
         rxhdr = (struct bcm43xx_rxhdr *)preamble;
         rxflags2 = le16_to_cpu(rxhdr->flags2);
@@ -591,16 +599,40 @@ data_ready:
         }
         skb_put(skb, len);
         for (i = 0; i < len - 1; i += 2) {
-                tmp = cpu_to_be16(bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA));
-                *((u16 *)(skb->data + i)) = tmp;
+                tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
+                *((u16 *)(skb->data + i)) = cpu_to_le16(tmp);
         }
         if (len % 2) {
                 tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
                 skb->data[len - 1] = (tmp & 0x00FF);
+/* The specs say the following is required, but
+ * it is wrong and corrupts the PLCP. If we don't do
+ * this, the PLCP seems to be correct. So ifdef it out for now.
+ */
+#if 0
                 if (rxflags2 & BCM43xx_RXHDR_FLAGS2_TYPE2FRAME)
-                        skb->data[0x20] = (tmp & 0xFF00) >> 8;
+                        skb->data[2] = (tmp & 0xFF00) >> 8;
                 else
-                        skb->data[0x1E] = (tmp & 0xFF00) >> 8;
+                        skb->data[0] = (tmp & 0xFF00) >> 8;
+#endif
         }
+        skb_trim(skb, len - IEEE80211_FCS_LEN);
         bcm43xx_rx(queue->bcm, skb, rxhdr);
 }
+
+void bcm43xx_pio_tx_suspend(struct bcm43xx_pioqueue *queue)
+{
+        bcm43xx_power_saving_ctl_bits(queue->bcm, -1, 1);
+        bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
+                          bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL)
+                          | BCM43xx_PIO_TXCTL_SUSPEND);
+}
+
+void bcm43xx_pio_tx_resume(struct bcm43xx_pioqueue *queue)
+{
+        bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
+                          bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL)
+                          & ~BCM43xx_PIO_TXCTL_SUSPEND);
+        bcm43xx_power_saving_ctl_bits(queue->bcm, -1, -1);
+        tasklet_schedule(&queue->txtask);
+}
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_pio.h b/drivers/net/wireless/bcm43xx/bcm43xx_pio.h
index 970627bc1769..dfc78209e3a3 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_pio.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_pio.h
@@ -14,8 +14,8 @@
 #define BCM43xx_PIO_RXCTL               0x08
 #define BCM43xx_PIO_RXDATA              0x0A
 
-#define BCM43xx_PIO_TXCTL_WRITEHI       (1 << 0)
-#define BCM43xx_PIO_TXCTL_WRITELO       (1 << 1)
+#define BCM43xx_PIO_TXCTL_WRITELO       (1 << 0)
+#define BCM43xx_PIO_TXCTL_WRITEHI       (1 << 1)
 #define BCM43xx_PIO_TXCTL_COMPLETE      (1 << 2)
 #define BCM43xx_PIO_TXCTL_INIT          (1 << 3)
 #define BCM43xx_PIO_TXCTL_SUSPEND       (1 << 7)
@@ -95,6 +95,7 @@ void bcm43xx_pio_write(struct bcm43xx_pioqueue *queue,
                        u16 offset, u16 value)
 {
         bcm43xx_write16(queue->bcm, queue->mmio_base + offset, value);
+        mmiowb();
 }
 
 
@@ -107,6 +108,9 @@ void bcm43xx_pio_handle_xmitstatus(struct bcm43xx_private *bcm,
                                    struct bcm43xx_xmitstatus *status);
 void bcm43xx_pio_rx(struct bcm43xx_pioqueue *queue);
 
+void bcm43xx_pio_tx_suspend(struct bcm43xx_pioqueue *queue);
+void bcm43xx_pio_tx_resume(struct bcm43xx_pioqueue *queue);
+
 #else /* CONFIG_BCM43XX_PIO */
 
 static inline
@@ -133,6 +137,14 @@ static inline
 void bcm43xx_pio_rx(struct bcm43xx_pioqueue *queue)
 {
 }
+static inline
+void bcm43xx_pio_tx_suspend(struct bcm43xx_pioqueue *queue)
+{
+}
+static inline
+void bcm43xx_pio_tx_resume(struct bcm43xx_pioqueue *queue)
+{
+}
 
 #endif /* CONFIG_BCM43XX_PIO */
 #endif /* BCM43xx_PIO_H_ */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_power.c b/drivers/net/wireless/bcm43xx/bcm43xx_power.c
index 3c92b62807c5..6569da3a7a39 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_power.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_power.c
@@ -35,77 +35,101 @@
 #include "bcm43xx_main.h"
 
 
+/* Get the Slow Clock Source */
+static int bcm43xx_pctl_get_slowclksrc(struct bcm43xx_private *bcm)
+{
+        u32 tmp;
+        int err;
+
+        assert(bcm->current_core == &bcm->core_chipcommon);
+        if (bcm->current_core->rev < 6) {
+                if (bcm->bustype == BCM43xx_BUSTYPE_PCMCIA ||
+                    bcm->bustype == BCM43xx_BUSTYPE_SB)
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                if (bcm->bustype == BCM43xx_BUSTYPE_PCI) {
+                        err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCTL_OUT, &tmp);
+                        assert(!err);
+                        if (tmp & 0x10)
+                                return BCM43xx_PCTL_CLKSRC_PCI;
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                }
+        }
+        if (bcm->current_core->rev < 10) {
+                tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SLOWCLKCTL);
+                tmp &= 0x7;
+                if (tmp == 0)
+                        return BCM43xx_PCTL_CLKSRC_LOPWROS;
+                if (tmp == 1)
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                if (tmp == 2)
+                        return BCM43xx_PCTL_CLKSRC_PCI;
+        }
+
+        return BCM43xx_PCTL_CLKSRC_XTALOS;
+}
+
 /* Get max/min slowclock frequency
  * as described in http://bcm-specs.sipsolutions.net/PowerControl
  */
 static int bcm43xx_pctl_clockfreqlimit(struct bcm43xx_private *bcm,
                                        int get_max)
 {
-        int limit = 0;
+        int limit;
+        int clocksrc;
         int divisor;
-        int selection;
-        int err;
         u32 tmp;
-        struct bcm43xx_coreinfo *old_core;
 
-        if (!(bcm->chipcommon_capabilities & BCM43xx_CAPABILITIES_PCTL))
-                goto out;
-        old_core = bcm->current_core;
-        err = bcm43xx_switch_core(bcm, &bcm->core_chipcommon);
-        if (err)
-                goto out;
+        assert(bcm->chipcommon_capabilities & BCM43xx_CAPABILITIES_PCTL);
+        assert(bcm->current_core == &bcm->core_chipcommon);
 
+        clocksrc = bcm43xx_pctl_get_slowclksrc(bcm);
         if (bcm->current_core->rev < 6) {
-                if ((bcm->bustype == BCM43xx_BUSTYPE_PCMCIA) ||
-                        (bcm->bustype == BCM43xx_BUSTYPE_SB)) {
-                        selection = 1;
+                switch (clocksrc) {
+                case BCM43xx_PCTL_CLKSRC_PCI:
+                        divisor = 64;
+                        break;
+                case BCM43xx_PCTL_CLKSRC_XTALOS:
                         divisor = 32;
-                } else {
-                        err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCTL_OUT, &tmp);
-                        if (err) {
-                                printk(KERN_ERR PFX "clockfreqlimit pcicfg read failure\n");
-                                goto out_switchback;
-                        }
-                        if (tmp & 0x10) {
-                                /* PCI */
-                                selection = 2;
-                                divisor = 64;
-                        } else {
-                                /* XTAL */
-                                selection = 1;
-                                divisor = 32;
-                        }
+                        break;
+                default:
+                        assert(0);
+                        divisor = 1;
                 }
         } else if (bcm->current_core->rev < 10) {
-                selection = (tmp & 0x07);
-                if (selection) {
+                switch (clocksrc) {
+                case BCM43xx_PCTL_CLKSRC_LOPWROS:
+                        divisor = 1;
+                        break;
+                case BCM43xx_PCTL_CLKSRC_XTALOS:
+                case BCM43xx_PCTL_CLKSRC_PCI:
                         tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SLOWCLKCTL);
-                        divisor = 4 * (1 + ((tmp & 0xFFFF0000) >> 16));
-                } else
+                        divisor = ((tmp & 0xFFFF0000) >> 16) + 1;
+                        divisor *= 4;
+                        break;
+                default:
+                        assert(0);
                         divisor = 1;
+                }
         } else {
                 tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SYSCLKCTL);
-                divisor = 4 * (1 + ((tmp & 0xFFFF0000) >> 16));
-                selection = 1;
+                divisor = ((tmp & 0xFFFF0000) >> 16) + 1;
+                divisor *= 4;
         }
-        
-        switch (selection) {
-        case 0:
-                /* LPO */
+
+        switch (clocksrc) {
+        case BCM43xx_PCTL_CLKSRC_LOPWROS:
                 if (get_max)
                         limit = 43000;
                 else
                         limit = 25000;
                 break;
-        case 1:
-                /* XTAL */
+        case BCM43xx_PCTL_CLKSRC_XTALOS:
                 if (get_max)
                         limit = 20200000;
                 else
                         limit = 19800000;
                 break;
-        case 2:
-                /* PCI */
+        case BCM43xx_PCTL_CLKSRC_PCI:
                 if (get_max)
                         limit = 34000000;
                 else
@@ -113,17 +137,14 @@ static int bcm43xx_pctl_clockfreqlimit(struct bcm43xx_private *bcm,
                 break;
         default:
                 assert(0);
+                limit = 0;
         }
         limit /= divisor;
 
-out_switchback:
-        err = bcm43xx_switch_core(bcm, old_core);
-        assert(err == 0);
-
-out:
         return limit;
 }
 
+
 /* init power control
  * as described in http://bcm-specs.sipsolutions.net/PowerControl
  */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_power.h b/drivers/net/wireless/bcm43xx/bcm43xx_power.h
index 5f63640810bd..c966ab3a5a8c 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_power.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_power.h
@@ -33,6 +33,15 @@
 
 #include <linux/types.h>
 
+/* Clock sources */
+enum {
+        /* PCI clock */
+        BCM43xx_PCTL_CLKSRC_PCI,
+        /* Crystal slow clock oscillator */
+        BCM43xx_PCTL_CLKSRC_XTALOS,
+        /* Low power oscillator */
+        BCM43xx_PCTL_CLKSRC_LOPWROS,
+};
 
 struct bcm43xx_private;
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
index c44d890b949b..b438f48e891d 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
@@ -71,14 +71,46 @@ static int get_boolean(const char *buf, size_t count)
         return -EINVAL;
 }
 
+static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len)
+{
+        int i, pos = 0;
+
+        for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
+                pos += snprintf(buf + pos, buf_len - pos - 1,
+                                "%04X", swab16(sprom[i]) & 0xFFFF);
+        }
+        pos += snprintf(buf + pos, buf_len - pos - 1, "\n");
+
+        return pos + 1;
+}
+
+static int hex2sprom(u16 *sprom, const char *dump, size_t len)
+{
+        char tmp[5] = { 0 };
+        int cnt = 0;
+        unsigned long parsed;
+
+        if (len < BCM43xx_SPROM_SIZE * sizeof(u16) * 2)
+                return -EINVAL;
+
+        while (cnt < BCM43xx_SPROM_SIZE) {
+                memcpy(tmp, dump, 4);
+                dump += 4;
+                parsed = simple_strtoul(tmp, NULL, 16);
+                sprom[cnt++] = swab16((u16)parsed);
+        }
+
+        return 0;
+}
+
 static ssize_t bcm43xx_attr_sprom_show(struct device *dev,
                                        struct device_attribute *attr,
                                        char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_sprom);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         u16 *sprom;
         unsigned long flags;
-        int i, err;
+        int err;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
@@ -91,55 +123,53 @@ static ssize_t bcm43xx_attr_sprom_show(struct device *dev,
         bcm43xx_lock_mmio(bcm, flags);
         assert(bcm->initialized);
         err = bcm43xx_sprom_read(bcm, sprom);
-        if (!err) {
-                for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
-                        buf[i * 2] = sprom[i] & 0x00FF;
-                        buf[i * 2 + 1] = (sprom[i] & 0xFF00) >> 8;
-                }
-        }
+        if (!err)
+                err = sprom2hex(sprom, buf, PAGE_SIZE);
         bcm43xx_unlock_mmio(bcm, flags);
         kfree(sprom);
 
-        return err ? err : BCM43xx_SPROM_SIZE * sizeof(u16);
+        return err;
 }
 
 static ssize_t bcm43xx_attr_sprom_store(struct device *dev,
                                         struct device_attribute *attr,
                                         const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_sprom);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         u16 *sprom;
         unsigned long flags;
-        int i, err;
+        int err;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        if (count != BCM43xx_SPROM_SIZE * sizeof(u16))
-                return -EINVAL;
         sprom = kmalloc(BCM43xx_SPROM_SIZE * sizeof(*sprom),
                         GFP_KERNEL);
         if (!sprom)
                 return -ENOMEM;
-        for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
-                sprom[i] = buf[i * 2] & 0xFF;
-                sprom[i] |= ((u16)(buf[i * 2 + 1] & 0xFF)) << 8;
-        }
+        err = hex2sprom(sprom, buf, count);
+        if (err)
+                goto out_kfree;
         bcm43xx_lock_mmio(bcm, flags);
         assert(bcm->initialized);
         err = bcm43xx_sprom_write(bcm, sprom);
         bcm43xx_unlock_mmio(bcm, flags);
+out_kfree:
         kfree(sprom);
 
         return err ? err : count;
 
 }
 
+static DEVICE_ATTR(sprom, 0600,
+                   bcm43xx_attr_sprom_show,
+                   bcm43xx_attr_sprom_store);
+
 static ssize_t bcm43xx_attr_interfmode_show(struct device *dev,
                                             struct device_attribute *attr,
                                             char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_interfmode);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         ssize_t count = 0;
@@ -175,7 +205,7 @@ static ssize_t bcm43xx_attr_interfmode_store(struct device *dev,
                                              struct device_attribute *attr,
                                              const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_interfmode);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         int mode;
@@ -215,11 +245,15 @@ static ssize_t bcm43xx_attr_interfmode_store(struct device *dev,
         return err ? err : count;
 }
 
+static DEVICE_ATTR(interference, 0644,
+                   bcm43xx_attr_interfmode_show,
+                   bcm43xx_attr_interfmode_store);
+
 static ssize_t bcm43xx_attr_preamble_show(struct device *dev,
                                           struct device_attribute *attr,
                                           char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_preamble);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         ssize_t count;
@@ -245,7 +279,7 @@ static ssize_t bcm43xx_attr_preamble_store(struct device *dev,
                                            struct device_attribute *attr,
                                            const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_preamble);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         int value;
@@ -267,56 +301,41 @@ static ssize_t bcm43xx_attr_preamble_store(struct device *dev,
         return err ? err : count;
 }
 
+static DEVICE_ATTR(shortpreamble, 0644,
+                   bcm43xx_attr_preamble_show,
+                   bcm43xx_attr_preamble_store);
+
 int bcm43xx_sysfs_register(struct bcm43xx_private *bcm)
 {
         struct device *dev = &bcm->pci_dev->dev;
-        struct bcm43xx_sysfs *sysfs = &bcm->sysfs;
         int err;
 
         assert(bcm->initialized);
 
-        sysfs->attr_sprom.attr.name = "sprom";
-        sysfs->attr_sprom.attr.owner = THIS_MODULE;
-        sysfs->attr_sprom.attr.mode = 0600;
-        sysfs->attr_sprom.show = bcm43xx_attr_sprom_show;
-        sysfs->attr_sprom.store = bcm43xx_attr_sprom_store;
-        err = device_create_file(dev, &sysfs->attr_sprom);
+        err = device_create_file(dev, &dev_attr_sprom);
         if (err)
                 goto out;
-
-        sysfs->attr_interfmode.attr.name = "interference";
-        sysfs->attr_interfmode.attr.owner = THIS_MODULE;
-        sysfs->attr_interfmode.attr.mode = 0600;
-        sysfs->attr_interfmode.show = bcm43xx_attr_interfmode_show;
-        sysfs->attr_interfmode.store = bcm43xx_attr_interfmode_store;
-        err = device_create_file(dev, &sysfs->attr_interfmode);
+        err = device_create_file(dev, &dev_attr_interference);
         if (err)
                 goto err_remove_sprom;
-
-        sysfs->attr_preamble.attr.name = "shortpreamble";
-        sysfs->attr_preamble.attr.owner = THIS_MODULE;
-        sysfs->attr_preamble.attr.mode = 0600;
-        sysfs->attr_preamble.show = bcm43xx_attr_preamble_show;
-        sysfs->attr_preamble.store = bcm43xx_attr_preamble_store;
-        err = device_create_file(dev, &sysfs->attr_preamble);
+        err = device_create_file(dev, &dev_attr_shortpreamble);
         if (err)
                 goto err_remove_interfmode;
 
 out:
         return err;
 err_remove_interfmode:
-        device_remove_file(dev, &sysfs->attr_interfmode);
+        device_remove_file(dev, &dev_attr_interference);
 err_remove_sprom:
-        device_remove_file(dev, &sysfs->attr_sprom);
+        device_remove_file(dev, &dev_attr_sprom);
         goto out;
 }
 
 void bcm43xx_sysfs_unregister(struct bcm43xx_private *bcm)
 {
         struct device *dev = &bcm->pci_dev->dev;
-        struct bcm43xx_sysfs *sysfs = &bcm->sysfs;
 
-        device_remove_file(dev, &sysfs->attr_preamble);
-        device_remove_file(dev, &sysfs->attr_interfmode);
-        device_remove_file(dev, &sysfs->attr_sprom);
+        device_remove_file(dev, &dev_attr_shortpreamble);
+        device_remove_file(dev, &dev_attr_interference);
+        device_remove_file(dev, &dev_attr_sprom);
 }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
index 57f14514e3e0..cc701df71e2a 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
@@ -1,22 +1,6 @@
 #ifndef BCM43xx_SYSFS_H_
 #define BCM43xx_SYSFS_H_
 
-#include <linux/device.h>
-
-
-struct bcm43xx_sysfs {
-        struct device_attribute attr_sprom;
-        struct device_attribute attr_interfmode;
-        struct device_attribute attr_preamble;
-};
-
-#define devattr_to_bcm(attr, attr_name) ({                              \
-        struct bcm43xx_sysfs *__s; struct bcm43xx_private *__p;         \
-        __s = container_of((attr), struct bcm43xx_sysfs, attr_name);    \
-        __p = container_of(__s, struct bcm43xx_private, sysfs);         \
-        __p;                                                            \
-                                        })
-
 struct bcm43xx_private;
 
 int bcm43xx_sysfs_register(struct bcm43xx_private *bcm);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
index 3daee828ef4b..3edbb481a0a0 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
@@ -962,22 +962,22 @@ static const struct iw_priv_args bcm43xx_priv_wx_args[] = {
         {
                 .cmd            = PRIV_WX_SET_SHORTPREAMBLE,
                 .set_args       = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-                .name           = "set_shortpreambl",
+                .name           = "set_shortpreamb",
         },
         {
                 .cmd            = PRIV_WX_GET_SHORTPREAMBLE,
                 .get_args       = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
-                .name           = "get_shortpreambl",
+                .name           = "get_shortpreamb",
         },
         {
                 .cmd            = PRIV_WX_SET_SWENCRYPTION,
                 .set_args       = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-                .name           = "set_swencryption",
+                .name           = "set_swencrypt",
         },
         {
                 .cmd            = PRIV_WX_GET_SWENCRYPTION,
                 .get_args       = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
-                .name           = "get_swencryption",
+                .name           = "get_swencrypt",
         },
         {
                 .cmd            = PRIV_WX_SPROM_WRITE,
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index 8b37e824dfcb..8399de581893 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -1860,7 +1860,7 @@ static char * __prism2_translate_scan(local_info_t *local,
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
         if (scan) {
-                chan = scan->chid;
+                chan = le16_to_cpu(scan->chid);
         } else if (bss) {
                 chan = bss->chan;
         } else {
@@ -1868,7 +1868,7 @@ static char * __prism2_translate_scan(local_info_t *local,
         }
 
         if (chan > 0) {
-                iwe.u.freq.m = freq_list[le16_to_cpu(chan - 1)] * 100000;
+                iwe.u.freq.m = freq_list[chan - 1] * 100000;
                 iwe.u.freq.e = 1;
                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                                   IW_EV_FREQ_LEN);
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 8dfdfbd5966c..06523e2a8471 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -390,7 +390,7 @@ static struct iw_statistics *orinoco_get_wireless_stats(struct net_device *dev)
                 }
         } else {
                 struct {
-                        __le16 qual, signal, noise;
+                        __le16 qual, signal, noise, unused;
                 } __attribute__ ((packed)) cq;
 
                 err = HERMES_READ_RECORD(hw, USER_BAP,
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index 4e53be9c03ab..bbeabe3fc4c6 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -535,7 +535,7 @@ pdcs_auto_read(struct subsystem *entry, char *buf, int knob)
 {
         char *out = buf;
         struct pdcspath_entry *pathentry;
-        
+
         if (!entry || !buf)
                 return -EINVAL;
 
diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
index 42b32ff2fca6..278f325021ee 100644
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -178,6 +178,11 @@ extern struct proc_dir_entry * proc_mckinley_root;
 #define ROPE6_CTL       0x230
 #define ROPE7_CTL       0x238
 
+#define IOC_ROPE0_CFG   0x500   /* pluto only */
+#define   IOC_ROPE_AO     0x10  /* Allow "Relaxed Ordering" */
+
+
+
 #define HF_ENABLE       0x40
 
 
@@ -1759,19 +1764,33 @@ printk("sba_hw_init(): mem_boot 0x%x 0x%x 0x%x 0x%x\n", PAGE0->mem_boot.hpa,
 
         sba_dev->num_ioc = num_ioc;
         for (i = 0; i < num_ioc; i++) {
-                /*
-                ** Make sure the box crashes if we get any errors on a rope.
-                */
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE0_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE1_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE2_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE3_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE4_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE5_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE6_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE7_CTL);
-
-                /* flush out the writes */
+                unsigned long ioc_hpa = sba_dev->ioc[i].ioc_hpa;
+                unsigned int j;
+
+                for (j=0; j < sizeof(u64) * ROPES_PER_IOC; j+=sizeof(u64)) {
+
+                        /*
+                         * Clear ROPE(N)_CONFIG AO bit.
+                         * Disables "NT Ordering" (~= !"Relaxed Ordering")
+                         * Overrides bit 1 in DMA Hint Sets.
+                         * Improves netperf UDP_STREAM by ~10% for bcm5701.
+                         */
+                        if (IS_PLUTO(sba_dev->iodc)) {
+                                unsigned long rope_cfg, cfg_val;
+
+                                rope_cfg = ioc_hpa + IOC_ROPE0_CFG + j;
+                                cfg_val = READ_REG(rope_cfg);
+                                cfg_val &= ~IOC_ROPE_AO;
+                                WRITE_REG(cfg_val, rope_cfg);
+                        }
+
+                        /*
+                        ** Make sure the box crashes on rope errors.
+                        */
+                        WRITE_REG(HF_ENABLE, ioc_hpa + ROPE0_CTL + j);
+                }
+
+                /* flush out the last writes */
                 READ_REG(sba_dev->ioc[i].ioc_hpa + ROPE7_CTL);
 
                 DBG_INIT("      ioc[%d] ROPE_CFG 0x%Lx  ROPE_DBG 0x%Lx\n",
diff --git a/drivers/parisc/superio.c b/drivers/parisc/superio.c
index 719b863bc20e..828eb45062de 100644
--- a/drivers/parisc/superio.c
+++ b/drivers/parisc/superio.c
@@ -155,7 +155,7 @@ superio_init(struct pci_dev *pcidev)
         struct pci_dev *pdev = sio->lio_pdev;
         u16 word;
 
-        if (sio->suckyio_irq_enabled)                                       
+        if (sio->suckyio_irq_enabled)
                 return;
 
         BUG_ON(!pdev);
@@ -194,7 +194,7 @@ superio_init(struct pci_dev *pcidev)
         request_region (sio->acpi_base, 0x1f, "acpi");
 
         /* Enable the legacy I/O function */
-        pci_read_config_word (pdev, PCI_COMMAND, &word);
+        pci_read_config_word (pdev, PCI_COMMAND, &word);
         word |= PCI_COMMAND_SERR | PCI_COMMAND_PARITY | PCI_COMMAND_IO;
         pci_write_config_word (pdev, PCI_COMMAND, word);
 
diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
index d5890027f8af..48bbf32fd980 100644
--- a/drivers/parport/parport_pc.c
+++ b/drivers/parport/parport_pc.c
@@ -97,7 +97,7 @@ static struct superio_struct {	/* For Super-IO chips autodetection */
         int io;
         int irq;
         int dma;
-} superios[NR_SUPERIOS] __devinitdata = { {0,},};
+} superios[NR_SUPERIOS] = { {0,},};
 
 static int user_specified;
 #if defined(CONFIG_PARPORT_PC_SUPERIO) || \
@@ -1557,7 +1557,7 @@ static int __devinit get_superio_dma (struct parport *p)
         return PARPORT_DMA_NONE;
 }
 
-static int __devinit get_superio_irq (struct parport *p)
+static int get_superio_irq (struct parport *p)
 {
         int i=0;
         while( (superios[i].io != p->base) && (i<NR_SUPERIOS))
@@ -1579,7 +1579,7 @@ static int __devinit get_superio_irq (struct parport *p)
  *                         this shall always be the case!)
  *
  */
-static int __devinit parport_SPP_supported(struct parport *pb)
+static int parport_SPP_supported(struct parport *pb)
 {
         unsigned char r, w;
 
@@ -1660,7 +1660,7 @@ static int __devinit parport_SPP_supported(struct parport *pb)
  * two bits of ECR aren't writable, so we check by writing ECR and
  * reading it back to see if it's what we expect.
  */
-static int __devinit parport_ECR_present(struct parport *pb)
+static int parport_ECR_present(struct parport *pb)
 {
         struct parport_pc_private *priv = pb->private_data;
         unsigned char r = 0xc;
@@ -1712,7 +1712,7 @@ static int __devinit parport_ECR_present(struct parport *pb)
  * be misdetected here is rather academic. 
  */
 
-static int __devinit parport_PS2_supported(struct parport *pb)
+static int parport_PS2_supported(struct parport *pb)
 {
         int ok = 0;
   
@@ -1868,7 +1868,7 @@ static int __devinit parport_ECP_supported(struct parport *pb)
 }
 #endif
 
-static int __devinit parport_ECPPS2_supported(struct parport *pb)
+static int parport_ECPPS2_supported(struct parport *pb)
 {
         const struct parport_pc_private *priv = pb->private_data;
         int result;
@@ -1886,7 +1886,7 @@ static int __devinit parport_ECPPS2_supported(struct parport *pb)
 
 /* EPP mode detection  */
 
-static int __devinit parport_EPP_supported(struct parport *pb)
+static int parport_EPP_supported(struct parport *pb)
 {
         const struct parport_pc_private *priv = pb->private_data;
 
@@ -1931,7 +1931,7 @@ static int __devinit parport_EPP_supported(struct parport *pb)
         return 1;
 }
 
-static int __devinit parport_ECPEPP_supported(struct parport *pb)
+static int parport_ECPEPP_supported(struct parport *pb)
 {
         struct parport_pc_private *priv = pb->private_data;
         int result;
@@ -2073,7 +2073,7 @@ static int __devinit irq_probe_SPP(struct parport *pb)
  * When ECP is available we can autoprobe for IRQs.
  * NOTE: If we can autoprobe it, we can register the IRQ.
  */
-static int __devinit parport_irq_probe(struct parport *pb)
+static int parport_irq_probe(struct parport *pb)
 {
         struct parport_pc_private *priv = pb->private_data;
 
@@ -2779,7 +2779,7 @@ static struct parport_pc_pci {
         /* If set, this is called after probing for ports.  If 'failed'
          * is non-zero we couldn't use any of the ports. */
         void (*postinit_hook) (struct pci_dev *pdev, int failed);
-} cards[] __devinitdata = {
+} cards[] = {
         /* siig_1p_10x */               { 1, { { 2, 3 }, } },
         /* siig_2p_10x */               { 2, { { 2, 3 }, { 4, 5 }, } },
         /* siig_1p_20x */               { 1, { { 0, 1 }, } },
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 2087a397ef16..9855c4c920b8 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -793,8 +793,10 @@ static int msix_capability_init(struct pci_dev *dev,
                 if (!entry)
                         break;
                 vector = get_msi_vector(dev);
-                if (vector < 0)
+                if (vector < 0) {
+                        kmem_cache_free(msi_cachep, entry);
                         break;
+                }
 
                 j = entries[i].entry;
                 entries[i].vector = vector;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 827550d25c9e..19e2b174d33c 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -642,13 +642,15 @@ static void quirk_via_irq(struct pci_dev *dev)
         new_irq = dev->irq & 0xf;
         pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &irq);
         if (new_irq != irq) {
-                printk(KERN_INFO "PCI: Via IRQ fixup for %s, from %d to %d\n",
+                printk(KERN_INFO "PCI: VIA IRQ fixup for %s, from %d to %d\n",
                         pci_name(dev), irq, new_irq);
                 udelay(15);     /* unknown if delay really needed */
                 pci_write_config_byte(dev, PCI_INTERRUPT_LINE, new_irq);
         }
 }
-DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_ANY_ID, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_5, quirk_via_irq);
 
 /*
  * VIA VT82C598 has its device ID settable and many BIOSes
@@ -865,6 +867,35 @@ static void __init quirk_eisa_bridge(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82375,      quirk_eisa_bridge );
 
 /*
+ * On the MSI-K8T-Neo2Fir Board, the internal Soundcard is disabled
+ * when a PCI-Soundcard is added. The BIOS only gives Options
+ * "Disabled" and "AUTO". This Quirk Sets the corresponding
+ * Register-Value to enable the Soundcard.
+ */
+static void __init k8t_sound_hostbridge(struct pci_dev *dev)
+{
+        unsigned char val;
+
+        printk(KERN_INFO "PCI: Quirk-MSI-K8T Soundcard On\n");
+        pci_read_config_byte(dev, 0x50, &val);
+        if (val == 0x88 || val == 0xc8) {
+                pci_write_config_byte(dev, 0x50, val & (~0x40));
+
+                /* Verify the Change for Status output */
+                pci_read_config_byte(dev, 0x50, &val);
+                if (val & 0x40)
+                        printk(KERN_INFO "PCI: MSI-K8T soundcard still off\n");
+                else
+                        printk(KERN_INFO "PCI: MSI-K8T soundcard on\n");
+        } else {
+                printk(KERN_INFO "PCI: Unexpected Value in PCI-Register: "
+                                        "no Change!\n");
+        }
+
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, k8t_sound_hostbridge);
+
+/*
  * On ASUS P4B boards, the SMBus PCI Device within the ICH2/4 southbridge
  * is not activated. The myth is that Asus said that they do not want the
  * users to be irritated by just another PCI Device in the Win98 device
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index cba6c9eef28e..61cb4b29f55c 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -250,7 +250,7 @@ config M32R_CFC_NUM
 
 config PCMCIA_VRC4171
         tristate "NEC VRC4171 Card Controllers support"
-        depends on VRC4171 && PCMCIA
+        depends on CPU_VR41XX && ISA && PCMCIA
 
 config PCMCIA_VRC4173
         tristate "NEC VRC4173 CARDU support"
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index ae10d1eed65e..48d3b3d30c21 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -236,11 +236,11 @@ static void pcmcia_check_driver(struct pcmcia_driver *p_drv)
 /**
  * pcmcia_load_firmware - load CIS from userspace if device-provided is broken
  * @dev - the pcmcia device which needs a CIS override
- * @filename - requested filename in /lib/firmware/cis/
+ * @filename - requested filename in /lib/firmware/
  *
  * This uses the in-kernel firmware loading mechanism to use a "fake CIS" if
  * the one provided by the card is broken. The firmware files reside in
- * /lib/firmware/cis/ in userspace.
+ * /lib/firmware/ in userspace.
  */
 static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
 {
@@ -298,9 +298,6 @@ static inline int pcmcia_load_firmware(struct pcmcia_device *dev, char * filenam
  *
  * Registers a PCMCIA driver with the PCMCIA bus core.
  */
-static int pcmcia_device_probe(struct device *dev);
-static int pcmcia_device_remove(struct device * dev);
-
 int pcmcia_register_driver(struct pcmcia_driver *driver)
 {
         if (!driver)
@@ -400,7 +397,7 @@ static int pcmcia_device_probe(struct device * dev)
          * call which will then check whether there are two
          * pseudo devices, and if not, add the second one.
          */
-        did = (struct pcmcia_device_id *) p_dev->dev.driver_data;
+        did = p_dev->dev.driver_data;
         if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
             (p_dev->socket->device_count == 1) && (p_dev->device_no == 0))
                 pcmcia_add_pseudo_device(p_dev->socket);
@@ -448,7 +445,6 @@ static void pcmcia_card_remove(struct pcmcia_socket *s, struct pcmcia_device *le
         return;
 }
 
-
 static int pcmcia_device_remove(struct device * dev)
 {
         struct pcmcia_device *p_dev;
@@ -463,7 +459,7 @@ static int pcmcia_device_remove(struct device * dev)
          * pseudo multi-function card, we need to unbind
          * all devices
          */
-        did = (struct pcmcia_device_id *) p_dev->dev.driver_data;
+        did = p_dev->dev.driver_data;
         if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
             (p_dev->socket->device_count != 0) &&
             (p_dev->device_no == 0))
@@ -476,6 +472,8 @@ static int pcmcia_device_remove(struct device * dev)
         if (p_drv->remove)
                 p_drv->remove(p_dev);
 
+        p_dev->dev_node = NULL;
+
         /* check for proper unloading */
         if (p_dev->_irq || p_dev->_io || p_dev->_locked)
                 printk(KERN_INFO "pcmcia: driver %s did not release config properly\n",
@@ -628,7 +626,7 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
                 }
 
         /* Add to the list in pcmcia_bus_socket */
-        list_add_tail(&p_dev->socket_device_list, &s->devices_list);
+        list_add(&p_dev->socket_device_list, &s->devices_list);
 
         spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
 
diff --git a/drivers/pcmcia/i82365.c b/drivers/pcmcia/i82365.c
index bd0308e89815..a2f05f485156 100644
--- a/drivers/pcmcia/i82365.c
+++ b/drivers/pcmcia/i82365.c
@@ -509,7 +509,8 @@ static irqreturn_t i365_count_irq(int irq, void *dev, struct pt_regs *regs)
 static u_int __init test_irq(u_short sock, int irq)
 {
     debug(2, "  testing ISA irq %d\n", irq);
-    if (request_irq(irq, i365_count_irq, 0, "scan", i365_count_irq) != 0)
+    if (request_irq(irq, i365_count_irq, SA_PROBEIRQ, "scan",
+                        i365_count_irq) != 0)
         return 1;
     irq_hits = 0; irq_sock = sock;
     msleep(10);
@@ -561,7 +562,7 @@ static u_int __init isa_scan(u_short sock, u_int mask0)
     } else {
         /* Fallback: just find interrupts that aren't in use */
         for (i = 0; i < 16; i++)
-            if ((mask0 & (1 << i)) && (_check_irq(i, 0) == 0))
+            if ((mask0 & (1 << i)) && (_check_irq(i, SA_PROBEIRQ) == 0))
                 mask1 |= (1 << i);
         printk("default");
         /* If scan failed, default to polled status */
@@ -725,7 +726,7 @@ static void __init add_pcic(int ns, int type)
         u_int cs_mask = mask & ((cs_irq) ? (1<<cs_irq) : ~(1<<12));
         for (cs_irq = 15; cs_irq > 0; cs_irq--)
             if ((cs_mask & (1 << cs_irq)) &&
-                (_check_irq(cs_irq, 0) == 0))
+                (_check_irq(cs_irq, SA_PROBEIRQ) == 0))
                 break;
         if (cs_irq) {
             grab_irq = 1;
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 45063b4e5b78..3131bb0a0095 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -88,7 +88,6 @@ static int alloc_io_space(struct pcmcia_socket *s, u_int attr, ioaddr_t *base,
         }
         if ((s->features & SS_CAP_STATIC_MAP) && s->io_offset) {
                 *base = s->io_offset | (*base & 0x0fff);
-                s->io[0].res->flags = (s->io[0].res->flags & ~IORESOURCE_BITS) | (attr & IORESOURCE_BITS);
                 return 0;
         }
         /* Check for an already-allocated window that must conflict with
@@ -209,7 +208,6 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
         if (!(s->state & SOCKET_PRESENT))
                 return CS_NO_CARD;
 
-        config->Function = p_dev->func;
 
 #ifdef CONFIG_CARDBUS
         if (s->state & SOCKET_CARDBUS) {
@@ -223,14 +221,22 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
                         config->AssignedIRQ = s->irq.AssignedIRQ;
                         if (config->AssignedIRQ)
                                 config->Attributes |= CONF_ENABLE_IRQ;
-                        config->BasePort1 = s->io[0].res->start;
-                        config->NumPorts1 = s->io[0].res->end - config->BasePort1 + 1;
+                        if (s->io[0].res) {
+                                config->BasePort1 = s->io[0].res->start;
+                                config->NumPorts1 = s->io[0].res->end - config->BasePort1 + 1;
+                        }
                 }
                 return CS_SUCCESS;
         }
 #endif
 
-        c = (p_dev) ? p_dev->function_config : NULL;
+        if (p_dev) {
+                c = p_dev->function_config;
+                config->Function = p_dev->func;
+        } else {
+                c = NULL;
+                config->Function = 0;
+        }
 
         if ((c == NULL) || !(c->state & CONFIG_LOCKED)) {
                 config->Attributes = 0;
@@ -947,7 +953,5 @@ void pcmcia_disable_device(struct pcmcia_device *p_dev) {
         pcmcia_release_irq(p_dev, &p_dev->irq);
         if (&p_dev->win)
                 pcmcia_release_window(p_dev->win);
-
-        p_dev->dev_node = NULL;
 }
 EXPORT_SYMBOL(pcmcia_disable_device);
diff --git a/drivers/pcmcia/pxa2xx_sharpsl.c b/drivers/pcmcia/pxa2xx_sharpsl.c
index fd3647368955..b7b9e149c5b9 100644
--- a/drivers/pcmcia/pxa2xx_sharpsl.c
+++ b/drivers/pcmcia/pxa2xx_sharpsl.c
@@ -26,14 +26,6 @@
 #include "soc_common.h"
 
 #define NO_KEEP_VS 0x0001
-
-/* PCMCIA to Scoop linkage
-
-   There is no easy way to link multiple scoop devices into one
-   single entity for the pxa2xx_pcmcia device so this structure
-   is used which is setup by the platform code
-*/
-struct scoop_pcmcia_config *platform_scoop_config;
 #define SCOOP_DEV platform_scoop_config->devs
 
 static void sharpsl_pcmcia_init_reset(struct soc_pcmcia_socket *skt)
diff --git a/drivers/pnp/manager.c b/drivers/pnp/manager.c
index c4256aa32bcb..6fff109bdab6 100644
--- a/drivers/pnp/manager.c
+++ b/drivers/pnp/manager.c
@@ -479,7 +479,7 @@ int pnp_auto_config_dev(struct pnp_dev *dev)
 int pnp_start_dev(struct pnp_dev *dev)
 {
         if (!pnp_can_write(dev)) {
-                pnp_info("Device %s does not supported activation.", dev->dev.bus_id);
+                pnp_info("Device %s does not support activation.", dev->dev.bus_id);
                 return -EINVAL;
         }
 
@@ -503,7 +503,7 @@ int pnp_start_dev(struct pnp_dev *dev)
 int pnp_stop_dev(struct pnp_dev *dev)
 {
         if (!pnp_can_disable(dev)) {
-                pnp_info("Device %s does not supported disabling.", dev->dev.bus_id);
+                pnp_info("Device %s does not support disabling.", dev->dev.bus_id);
                 return -EINVAL;
         }
         if (dev->protocol->disable(dev)<0) {
diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
index b1e3e6179e56..6c9ad92747fd 100644
--- a/drivers/rtc/rtc-dev.c
+++ b/drivers/rtc/rtc-dev.c
@@ -58,7 +58,7 @@ rtc_dev_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         unsigned long data;
         ssize_t ret;
 
-        if (count < sizeof(unsigned long))
+        if (count != sizeof(unsigned int) && count < sizeof(unsigned long))
                 return -EINVAL;
 
         add_wait_queue(&rtc->irq_queue, &wait);
@@ -90,11 +90,16 @@ rtc_dev_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         if (ret == 0) {
                 /* Check for any data updates */
                 if (rtc->ops->read_callback)
-                        data = rtc->ops->read_callback(rtc->class_dev.dev, data);
-
-                ret = put_user(data, (unsigned long __user *)buf);
-                if (ret == 0)
-                        ret = sizeof(unsigned long);
+                        data = rtc->ops->read_callback(rtc->class_dev.dev,
+                                                       data);
+
+                if (sizeof(int) != sizeof(long) &&
+                    count == sizeof(unsigned int))
+                        ret = put_user(data, (unsigned int __user *)buf) ?:
+                                sizeof(unsigned int);
+                else
+                        ret = put_user(data, (unsigned long __user *)buf) ?:
+                                sizeof(unsigned long);
         }
         return ret;
 }
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index a3bfebcf31ef..cfb1fff3787c 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -315,6 +315,11 @@ dasd_increase_state(struct dasd_device *device)
                 rc = dasd_state_basic_to_ready(device);
 
         if (!rc &&
+            device->state == DASD_STATE_UNFMT &&
+            device->target > DASD_STATE_UNFMT)
+                rc = -EPERM;
+
+        if (!rc &&
             device->state == DASD_STATE_READY &&
             device->target >= DASD_STATE_ONLINE)
                 rc = dasd_state_ready_to_online(device);
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index c1c6f1381150..216bc4fba199 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -45,6 +45,7 @@ struct dasd_devmap {
         unsigned int devindex;
         unsigned short features;
         struct dasd_device *device;
+        struct dasd_uid uid;
 };
 
 /*
@@ -716,6 +717,68 @@ dasd_discipline_show(struct device *dev, struct device_attribute *attr, char *bu
 
 static DEVICE_ATTR(discipline, 0444, dasd_discipline_show, NULL);
 
+static ssize_t
+dasd_alias_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct dasd_devmap *devmap;
+        int alias;
+
+        devmap = dasd_find_busid(dev->bus_id);
+        spin_lock(&dasd_devmap_lock);
+        if (!IS_ERR(devmap))
+                alias = devmap->uid.alias;
+        else
+                alias = 0;
+        spin_unlock(&dasd_devmap_lock);
+
+        return sprintf(buf, alias ? "1\n" : "0\n");
+}
+
+static DEVICE_ATTR(alias, 0444, dasd_alias_show, NULL);
+
+static ssize_t
+dasd_vendor_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct dasd_devmap *devmap;
+        char *vendor;
+
+        devmap = dasd_find_busid(dev->bus_id);
+        spin_lock(&dasd_devmap_lock);
+        if (!IS_ERR(devmap) && strlen(devmap->uid.vendor) > 0)
+                vendor = devmap->uid.vendor;
+        else
+                vendor = "";
+        spin_unlock(&dasd_devmap_lock);
+
+        return snprintf(buf, PAGE_SIZE, "%s\n", vendor);
+}
+
+static DEVICE_ATTR(vendor, 0444, dasd_vendor_show, NULL);
+
+#define UID_STRLEN ( /* vendor */ 3 + 1 + /* serial    */ 14 + 1 +\
+                     /* SSID   */ 4 + 1 + /* unit addr */ 2 + 1)
+
+static ssize_t
+dasd_uid_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct dasd_devmap *devmap;
+        char uid[UID_STRLEN];
+
+        devmap = dasd_find_busid(dev->bus_id);
+        spin_lock(&dasd_devmap_lock);
+        if (!IS_ERR(devmap) && strlen(devmap->uid.vendor) > 0)
+                snprintf(uid, sizeof(uid), "%s.%s.%04x.%02x",
+                         devmap->uid.vendor, devmap->uid.serial,
+                         devmap->uid.ssid, devmap->uid.unit_addr);
+        else
+                uid[0] = 0;
+        spin_unlock(&dasd_devmap_lock);
+
+        return snprintf(buf, PAGE_SIZE, "%s\n", uid);
+}
+
+static DEVICE_ATTR(uid, 0444, dasd_uid_show, NULL);
+
 /*
  * extended error-reporting
  */
@@ -759,6 +822,9 @@ static DEVICE_ATTR(eer_enabled, 0644, dasd_eer_show, dasd_eer_store);
 static struct attribute * dasd_attrs[] = {
         &dev_attr_readonly.attr,
         &dev_attr_discipline.attr,
+        &dev_attr_alias.attr,
+        &dev_attr_vendor.attr,
+        &dev_attr_uid.attr,
         &dev_attr_use_diag.attr,
         &dev_attr_eer_enabled.attr,
         NULL,
@@ -768,6 +834,42 @@ static struct attribute_group dasd_attr_group = {
         .attrs = dasd_attrs,
 };
 
+
+/*
+ * Return copy of the device unique identifier.
+ */
+int
+dasd_get_uid(struct ccw_device *cdev, struct dasd_uid *uid)
+{
+        struct dasd_devmap *devmap;
+
+        devmap = dasd_find_busid(cdev->dev.bus_id);
+        if (IS_ERR(devmap))
+                return PTR_ERR(devmap);
+        spin_lock(&dasd_devmap_lock);
+        *uid = devmap->uid;
+        spin_unlock(&dasd_devmap_lock);
+        return 0;
+}
+
+/*
+ * Register the given device unique identifier into devmap struct.
+ */
+int
+dasd_set_uid(struct ccw_device *cdev, struct dasd_uid *uid)
+{
+        struct dasd_devmap *devmap;
+
+        devmap = dasd_find_busid(cdev->dev.bus_id);
+        if (IS_ERR(devmap))
+                return PTR_ERR(devmap);
+        spin_lock(&dasd_devmap_lock);
+        devmap->uid = *uid;
+        spin_unlock(&dasd_devmap_lock);
+        return 0;
+}
+EXPORT_SYMBOL(dasd_set_uid);
+
 /*
  * Return value of the specified feature.
  */
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index ee09ef33d08d..7d5a6cee4bd8 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -446,6 +446,39 @@ dasd_eckd_cdl_reclen(int recid)
         return LABEL_SIZE;
 }
 
+/*
+ * Generate device unique id that specifies the physical device.
+ */
+static int
+dasd_eckd_generate_uid(struct dasd_device *device, struct dasd_uid *uid)
+{
+        struct dasd_eckd_private *private;
+        struct dasd_eckd_confdata *confdata;
+
+        private = (struct dasd_eckd_private *) device->private;
+        if (!private)
+                return -ENODEV;
+        confdata = &private->conf_data;
+        if (!confdata)
+                return -ENODEV;
+
+        memset(uid, 0, sizeof(struct dasd_uid));
+        strncpy(uid->vendor, confdata->ned1.HDA_manufacturer,
+                sizeof(uid->vendor) - 1);
+        EBCASC(uid->vendor, sizeof(uid->vendor) - 1);
+        strncpy(uid->serial, confdata->ned1.HDA_location,
+                sizeof(uid->serial) - 1);
+        EBCASC(uid->serial, sizeof(uid->serial) - 1);
+        uid->ssid = confdata->neq.subsystemID;
+        if (confdata->ned2.sneq.flags == 0x40) {
+                uid->alias = 1;
+                uid->unit_addr = confdata->ned2.sneq.base_unit_addr;
+        } else
+                uid->unit_addr = confdata->ned1.unit_addr;
+
+        return 0;
+}
+
 static int
 dasd_eckd_read_conf(struct dasd_device *device)
 {
@@ -507,11 +540,15 @@ dasd_eckd_read_conf(struct dasd_device *device)
         return 0;
 }
 
-
+/*
+ * Check device characteristics.
+ * If the device is accessible using ECKD discipline, the device is enabled.
+ */
 static int
 dasd_eckd_check_characteristics(struct dasd_device *device)
 {
         struct dasd_eckd_private *private;
+        struct dasd_uid uid;
         void *rdc_data;
         int rc;
 
@@ -536,6 +573,7 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
 
         /* Read Device Characteristics */
         rdc_data = (void *) &(private->rdc_data);
+        memset(rdc_data, 0, sizeof(rdc_data));
         rc = read_dev_chars(device->cdev, &rdc_data, 64);
         if (rc) {
                 DEV_MESSAGE(KERN_WARNING, device,
@@ -556,8 +594,17 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
 
         /* Read Configuration Data */
         rc = dasd_eckd_read_conf (device);
-        return rc;
+        if (rc)
+                return rc;
+
+        /* Generate device unique id and register in devmap */
+        rc = dasd_eckd_generate_uid(device, &uid);
+        if (rc)
+                return rc;
 
+        rc = dasd_set_uid(device->cdev, &uid);
+
+        return rc;
 }
 
 static struct dasd_ccw_req *
diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
index ad8524bb7bb3..d5734e976e1c 100644
--- a/drivers/s390/block/dasd_eckd.h
+++ b/drivers/s390/block/dasd_eckd.h
@@ -228,26 +228,36 @@ struct dasd_eckd_confdata {
                 unsigned char HDA_manufacturer[3];
                 unsigned char HDA_location[2];
                 unsigned char HDA_seqno[12];
-                __u16 ID;
+                __u8 ID;
+                __u8 unit_addr;
         } __attribute__ ((packed)) ned1;
-        struct {
+        union {
                 struct {
-                        unsigned char identifier:2;
-                        unsigned char token_id:1;
-                        unsigned char sno_valid:1;
-                        unsigned char subst_sno:1;
-                        unsigned char recNED:1;
-                        unsigned char emuNED:1;
-                        unsigned char reserved:1;
-                } __attribute__ ((packed)) flags;
-                __u8 descriptor;
-                __u8 reserved[2];
-                unsigned char dev_type[6];
-                unsigned char dev_model[3];
-                unsigned char DASD_manufacturer[3];
-                unsigned char DASD_location[2];
-                unsigned char DASD_seqno[12];
-                __u16 ID;
+                        struct {
+                                unsigned char identifier:2;
+                                unsigned char token_id:1;
+                                unsigned char sno_valid:1;
+                                unsigned char subst_sno:1;
+                                unsigned char recNED:1;
+                                unsigned char emuNED:1;
+                                unsigned char reserved:1;
+                        } __attribute__ ((packed)) flags;
+                        __u8 descriptor;
+                        __u8 reserved[2];
+                        unsigned char dev_type[6];
+                        unsigned char dev_model[3];
+                        unsigned char DASD_manufacturer[3];
+                        unsigned char DASD_location[2];
+                        unsigned char DASD_seqno[12];
+                        __u16 ID;
+                } __attribute__ ((packed)) ned;
+                struct {
+                        unsigned char flags;            /* byte  0    */
+                        unsigned char res2[7];          /* byte  1- 7 */
+                        unsigned char sua_flags;        /* byte  8    */
+                        __u8 base_unit_addr;            /* byte  9    */
+                        unsigned char res3[22];         /* byte 10-31 */
+                } __attribute__ ((packed)) sneq;
         } __attribute__ ((packed)) ned2;
         struct {
                 struct {
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index 4293ba827523..d4b13e300a76 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -268,6 +268,16 @@ struct dasd_discipline {
 
 extern struct dasd_discipline *dasd_diag_discipline_pointer;
 
+/*
+ * Unique identifier for dasd device.
+ */
+struct dasd_uid {
+        __u8 alias;
+        char vendor[4];
+        char serial[15];
+        __u16 ssid;
+        __u8 unit_addr;
+};
 
 /*
  * Notification numbers for extended error reporting notifications:
@@ -516,6 +526,8 @@ void dasd_devmap_exit(void);
 struct dasd_device *dasd_create_device(struct ccw_device *);
 void dasd_delete_device(struct dasd_device *);
 
+int dasd_get_uid(struct ccw_device *, struct dasd_uid *);
+int dasd_set_uid(struct ccw_device *, struct dasd_uid *);
 int dasd_get_feature(struct ccw_device *, int);
 int dasd_set_feature(struct ccw_device *, int, int);
 
diff --git a/drivers/s390/char/tape_3590.c b/drivers/s390/char/tape_3590.c
index c3915f60a3aa..d71ef1adea59 100644
--- a/drivers/s390/char/tape_3590.c
+++ b/drivers/s390/char/tape_3590.c
@@ -230,14 +230,16 @@ tape_3590_read_attmsg(struct tape_device *device)
  * These functions are used to schedule follow-up actions from within an
  * interrupt context (like unsolicited interrupts).
  */
+struct work_handler_data {
+        struct tape_device *device;
+        enum tape_op        op;
+        struct work_struct  work;
+};
+
 static void
 tape_3590_work_handler(void *data)
 {
-        struct {
-                struct tape_device *device;
-                enum tape_op op;
-                struct work_struct work;
-        } *p = data;
+        struct work_handler_data *p = data;
 
         switch (p->op) {
         case TO_MSEN:
@@ -257,11 +259,7 @@ tape_3590_work_handler(void *data)
 static int
 tape_3590_schedule_work(struct tape_device *device, enum tape_op op)
 {
-        struct {
-                struct tape_device *device;
-                enum tape_op op;
-                struct work_struct work;
-        } *p;
+        struct work_handler_data *p;
 
         if ((p = kzalloc(sizeof(*p), GFP_ATOMIC)) == NULL)
                 return -ENOMEM;
@@ -316,7 +314,7 @@ tape_3590_bread(struct tape_device *device, struct request *req)
 
         rq_for_each_bio(bio, req) {
                 bio_for_each_segment(bv, bio, i) {
-                        dst = kmap(bv->bv_page) + bv->bv_offset;
+                        dst = page_address(bv->bv_page) + bv->bv_offset;
                         for (off = 0; off < bv->bv_len;
                              off += TAPEBLOCK_HSEC_SIZE) {
                                 ccw->flags = CCW_FLAG_CC;
@@ -1168,6 +1166,7 @@ tape_3590_setup_device(struct tape_device *device)
 static void
 tape_3590_cleanup_device(struct tape_device *device)
 {
+        flush_scheduled_work();
         tape_std_unassign(device);
 
         kfree(device->discdata);
@@ -1234,6 +1233,7 @@ static struct tape_discipline tape_discipline_3590 = {
 
 static struct ccw_device_id tape_3590_ids[] = {
         {CCW_DEVICE_DEVTYPE(0x3590, 0, 0x3590, 0), .driver_info = tape_3590},
+        {CCW_DEVICE_DEVTYPE(0x3592, 0, 0x3592, 0), .driver_info = tape_3592},
         { /* end of list */ }
 };
 
diff --git a/drivers/s390/char/tape_std.h b/drivers/s390/char/tape_std.h
index 2d311798edf4..1fc952359341 100644
--- a/drivers/s390/char/tape_std.h
+++ b/drivers/s390/char/tape_std.h
@@ -153,6 +153,7 @@ enum s390_tape_type {
         tape_3480,
         tape_3490,
         tape_3590,
+        tape_3592,
 };
 
 #endif // _TAPE_STD_H
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 6412b2c3edd3..72187e54dcac 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -242,28 +242,10 @@ s390_subchannel_remove_chpid(struct device *dev, void *data)
         if (sch->vpm == mask)
                 goto out_unreg;
 
-        if ((sch->schib.scsw.actl & (SCSW_ACTL_CLEAR_PEND |
-                                     SCSW_ACTL_HALT_PEND |
-                                     SCSW_ACTL_START_PEND |
-                                     SCSW_ACTL_RESUME_PEND)) &&
-            (sch->schib.pmcw.lpum == mask)) {
-                int cc = cio_cancel(sch);
-                
-                if (cc == -ENODEV)
-                        goto out_unreg;
-
-                if (cc == -EINVAL) {
-                        cc = cio_clear(sch);
-                        if (cc == -ENODEV)
-                                goto out_unreg;
-                        /* Call handler. */
-                        if (sch->driver && sch->driver->termination)
-                                sch->driver->termination(&sch->dev);
-                        goto out_unlock;
-                }
-        } else if ((sch->schib.scsw.actl & SCSW_ACTL_DEVACT) &&
-                   (sch->schib.scsw.actl & SCSW_ACTL_SCHACT) &&
-                   (sch->schib.pmcw.lpum == mask)) {
+        if ((sch->schib.scsw.actl & SCSW_ACTL_DEVACT) &&
+            (sch->schib.scsw.actl & SCSW_ACTL_SCHACT) &&
+            (sch->schib.pmcw.lpum == mask) &&
+            (sch->vpm == 0)) {
                 int cc;
 
                 cc = cio_clear(sch);
@@ -653,13 +635,13 @@ __chp_add(struct subchannel_id schid, void *data)
                 if (sch->schib.pmcw.chpid[i] == chp->id) {
                         if (stsch(sch->schid, &sch->schib) != 0) {
                                 /* Endgame. */
-                                spin_unlock(&sch->lock);
+                                spin_unlock_irq(&sch->lock);
                                 return -ENXIO;
                         }
                         break;
                 }
         if (i==8) {
-                spin_unlock(&sch->lock);
+                spin_unlock_irq(&sch->lock);
                 return 0;
         }
         sch->lpm = ((sch->schib.pmcw.pim &
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index 814f9258ce00..96f519281d92 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -38,6 +38,7 @@
 #include <linux/kernel.h>
 #include <linux/proc_fs.h>
 #include <linux/timer.h>
+#include <linux/mempool.h>
 
 #include <asm/ccwdev.h>
 #include <asm/io.h>
@@ -80,6 +81,8 @@ static int indicator_used[INDICATORS_PER_CACHELINE];
 static __u32 * volatile indicators;
 static __u32 volatile spare_indicator;
 static atomic_t spare_indicator_usecount;
+#define QDIO_MEMPOOL_SCSSC_ELEMENTS 2
+static mempool_t *qdio_mempool_scssc;
 
 static debug_info_t *qdio_dbf_setup;
 static debug_info_t *qdio_dbf_sbal;
@@ -1637,7 +1640,7 @@ next:
 
         }
         kfree(irq_ptr->qdr);
-        kfree(irq_ptr);
+        free_page((unsigned long) irq_ptr);
 }
 
 static void
@@ -2304,7 +2307,7 @@ qdio_get_ssqd_information(struct qdio_irq *irq_ptr)
 
         QDIO_DBF_TEXT0(0,setup,"getssqd");
         qdioac = 0;
-        ssqd_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
+        ssqd_area = mempool_alloc(qdio_mempool_scssc, GFP_ATOMIC);
         if (!ssqd_area) {
                 QDIO_PRINT_WARN("Could not get memory for chsc. Using all " \
                                 "SIGAs for sch x%x.\n", irq_ptr->schid.sch_no);
@@ -2364,7 +2367,7 @@ qdio_get_ssqd_information(struct qdio_irq *irq_ptr)
 out:
         qdio_check_subchannel_qebsm(irq_ptr, qdioac,
                                     ssqd_area->sch_token);
-        free_page ((unsigned long) ssqd_area);
+        mempool_free(ssqd_area, qdio_mempool_scssc);
         irq_ptr->qdioac = qdioac;
 }
 
@@ -2458,7 +2461,7 @@ tiqdio_set_subchannel_ind(struct qdio_irq *irq_ptr, int reset_to_zero)
                         virt_to_phys((volatile void *)irq_ptr->dev_st_chg_ind);
         }
 
-        scssc_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
+        scssc_area = mempool_alloc(qdio_mempool_scssc, GFP_ATOMIC);
         if (!scssc_area) {
                 QDIO_PRINT_WARN("No memory for setting indicators on " \
                                 "subchannel 0.%x.%x.\n",
@@ -2514,7 +2517,7 @@ tiqdio_set_subchannel_ind(struct qdio_irq *irq_ptr, int reset_to_zero)
         QDIO_DBF_HEX2(0,setup,&real_addr_dev_st_chg_ind,sizeof(unsigned long));
         result = 0;
 out:
-        free_page ((unsigned long) scssc_area);
+        mempool_free(scssc_area, qdio_mempool_scssc);
         return result;
 
 }
@@ -2543,7 +2546,7 @@ tiqdio_set_delay_target(struct qdio_irq *irq_ptr, unsigned long delay_target)
         if (!irq_ptr->is_thinint_irq)
                 return -ENODEV;
 
-        scsscf_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
+        scsscf_area = mempool_alloc(qdio_mempool_scssc, GFP_ATOMIC);
         if (!scsscf_area) {
                 QDIO_PRINT_WARN("No memory for setting delay target on " \
                                 "subchannel 0.%x.%x.\n",
@@ -2581,7 +2584,7 @@ tiqdio_set_delay_target(struct qdio_irq *irq_ptr, unsigned long delay_target)
         QDIO_DBF_HEX2(0,trace,&delay_target,sizeof(unsigned long));
         result = 0; /* not critical */
 out:
-        free_page ((unsigned long) scsscf_area);
+        mempool_free(scsscf_area, qdio_mempool_scssc);
         return result;
 }
 
@@ -2980,7 +2983,7 @@ qdio_allocate(struct qdio_initialize *init_data)
         qdio_allocate_do_dbf(init_data);
 
         /* create irq */
-        irq_ptr = kzalloc(sizeof(struct qdio_irq), GFP_KERNEL | GFP_DMA);
+        irq_ptr = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
 
         QDIO_DBF_TEXT0(0,setup,"irq_ptr:");
         QDIO_DBF_HEX0(0,setup,&irq_ptr,sizeof(void*));
@@ -2995,7 +2998,7 @@ qdio_allocate(struct qdio_initialize *init_data)
         /* QDR must be in DMA area since CCW data address is only 32 bit */
         irq_ptr->qdr=kmalloc(sizeof(struct qdr), GFP_KERNEL | GFP_DMA);
         if (!(irq_ptr->qdr)) {
-                kfree(irq_ptr);
+                free_page((unsigned long) irq_ptr);
                 QDIO_PRINT_ERR("kmalloc of irq_ptr->qdr failed!\n");
                 return -ENOMEM;
         }
@@ -3780,6 +3783,16 @@ oom:
         return -ENOMEM;
 }
 
+static void *qdio_mempool_alloc(gfp_t gfp_mask, void *size)
+{
+        return (void *) get_zeroed_page(gfp_mask|GFP_DMA);
+}
+
+static void qdio_mempool_free(void *element, void *size)
+{
+        free_page((unsigned long) element);
+}
+
 static int __init
 init_QDIO(void)
 {
@@ -3809,6 +3822,10 @@ init_QDIO(void)
 
         qdio_add_procfs_entry();
 
+        qdio_mempool_scssc = mempool_create(QDIO_MEMPOOL_SCSSC_ELEMENTS,
+                                            qdio_mempool_alloc,
+                                            qdio_mempool_free, NULL);
+
         if (tiqdio_check_chsc_availability())
                 QDIO_PRINT_ERR("Not all CHSCs supported. Continuing.\n");
 
@@ -3824,6 +3841,7 @@ cleanup_QDIO(void)
         qdio_remove_procfs_entry();
         qdio_release_qdio_memory();
         qdio_unregister_dbf_views();
+        mempool_destroy(qdio_mempool_scssc);
 
         printk("qdio: %s: module removed\n",version);
 }
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index b3c6e7907790..cb14642d97aa 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -8014,7 +8014,6 @@ static int (*qeth_old_arp_constructor) (struct neighbour *);
 
 static struct neigh_ops arp_direct_ops_template = {
         .family = AF_INET,
-        .destructor = NULL,
         .solicit = NULL,
         .error_report = NULL,
         .output = dev_queue_xmit,
diff --git a/drivers/s390/s390mach.c b/drivers/s390/s390mach.c
index 3bf466603512..f99e55308b32 100644
--- a/drivers/s390/s390mach.c
+++ b/drivers/s390/s390mach.c
@@ -13,6 +13,7 @@
 #include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/workqueue.h>
+#include <linux/time.h>
 
 #include <asm/lowcore.h>
 
@@ -362,12 +363,19 @@ s390_revalidate_registers(struct mci *mci)
         return kill_task;
 }
 
+#define MAX_IPD_COUNT   29
+#define MAX_IPD_TIME    (5 * 60 * USEC_PER_SEC) /* 5 minutes */
+
 /*
  * machine check handler.
  */
 void
 s390_do_machine_check(struct pt_regs *regs)
 {
+        static DEFINE_SPINLOCK(ipd_lock);
+        static unsigned long long last_ipd;
+        static int ipd_count;
+        unsigned long long tmp;
         struct mci *mci;
         struct mcck_struct *mcck;
         int umode;
@@ -404,11 +412,27 @@ s390_do_machine_check(struct pt_regs *regs)
                                 s390_handle_damage("processing backup machine "
                                                    "check with damage.");
                         }
-                        if (!umode)
-                                s390_handle_damage("processing backup machine "
-                                                   "check in kernel mode.");
-                        mcck->kill_task = 1;
-                        mcck->mcck_code = *(unsigned long long *) mci;
+
+                        /*
+                         * Nullifying exigent condition, therefore we might
+                         * retry this instruction.
+                         */
+
+                        spin_lock(&ipd_lock);
+
+                        tmp = get_clock();
+
+                        if (((tmp - last_ipd) >> 12) < MAX_IPD_TIME)
+                                ipd_count++;
+                        else
+                                ipd_count = 1;
+
+                        last_ipd = tmp;
+
+                        if (ipd_count == MAX_IPD_COUNT)
+                                s390_handle_damage("too many ipd retries.");
+
+                        spin_unlock(&ipd_lock);
                 }
                 else {
                         /* Processing damage -> stopping machine */
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 3e7302692dbe..a480a3742d47 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -446,7 +446,9 @@ config SCSI_DPT_I2O
 
 config SCSI_ADVANSYS
         tristate "AdvanSys SCSI support"
-        depends on (ISA || EISA || PCI) && SCSI && BROKEN
+        depends on SCSI
+        depends on ISA || EISA || PCI
+        depends on BROKEN || X86_32
         help
           This is a driver for all SCSI host adapters manufactured by
           AdvanSys. It is documented in the kernel source in
diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index 28b93057b607..2a419634b256 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -2051,7 +2051,7 @@ STATIC ASC_DCNT  AscGetMaxDmaCount(ushort);
 #define ADV_VADDR_TO_U32   virt_to_bus
 #define ADV_U32_TO_VADDR   bus_to_virt
 
-#define AdvPortAddr  ulong              /* Virtual memory address size */
+#define AdvPortAddr  void __iomem *     /* Virtual memory address size */
 
 /*
  * Define Adv Library required memory access macros.
diff --git a/drivers/serial/cpm_uart/cpm_uart.h b/drivers/serial/cpm_uart/cpm_uart.h
index 73c8a088c160..aa5eb7ddeda9 100644
--- a/drivers/serial/cpm_uart/cpm_uart.h
+++ b/drivers/serial/cpm_uart/cpm_uart.h
@@ -10,6 +10,8 @@
 #define CPM_UART_H
 
 #include <linux/config.h>
+#include <linux/platform_device.h>
+#include <linux/fs_uart_pd.h>
 
 #if defined(CONFIG_CPM2)
 #include "cpm_uart_cpm2.h"
@@ -26,14 +28,14 @@
 #define FLAG_SMC        0x00000002
 #define FLAG_CONSOLE    0x00000001
 
-#define UART_SMC1       0
-#define UART_SMC2       1
-#define UART_SCC1       2
-#define UART_SCC2       3
-#define UART_SCC3       4
-#define UART_SCC4       5
+#define UART_SMC1       fsid_smc1_uart
+#define UART_SMC2       fsid_smc2_uart
+#define UART_SCC1       fsid_scc1_uart
+#define UART_SCC2       fsid_scc2_uart
+#define UART_SCC3       fsid_scc3_uart
+#define UART_SCC4       fsid_scc4_uart
 
-#define UART_NR 6
+#define UART_NR         fs_uart_nr
 
 #define RX_NUM_FIFO     4
 #define RX_BUF_SIZE     32
@@ -64,6 +66,7 @@ struct uart_cpm_port {
         uint                     dp_addr;
         void                    *mem_addr;
         dma_addr_t               dma_addr;
+        u32                     mem_size;
         /* helpers */
         int                      baud;
         int                      bits;
@@ -90,4 +93,36 @@ void scc2_lineif(struct uart_cpm_port *pinfo);
 void scc3_lineif(struct uart_cpm_port *pinfo);
 void scc4_lineif(struct uart_cpm_port *pinfo);
 
+/*
+   virtual to phys transtalion
+*/
+static inline unsigned long cpu2cpm_addr(void* addr, struct uart_cpm_port *pinfo)
+{
+        int offset;
+        u32 val = (u32)addr;
+        /* sane check */
+        if ((val >= (u32)pinfo->mem_addr) &&
+                        (val<((u32)pinfo->mem_addr + pinfo->mem_size))) {
+                offset = val - (u32)pinfo->mem_addr;
+                return pinfo->dma_addr+offset;
+        }
+        printk("%s(): address %x to translate out of range!\n", __FUNCTION__, val);
+        return 0;
+}
+
+static inline void *cpm2cpu_addr(unsigned long addr, struct uart_cpm_port *pinfo)
+{
+        int offset;
+        u32 val = addr;
+        /* sane check */
+        if ((val >= pinfo->dma_addr) &&
+                        (val<(pinfo->dma_addr + pinfo->mem_size))) {
+                offset = val - (u32)pinfo->dma_addr;
+                return (void*)(pinfo->mem_addr+offset);
+        }
+        printk("%s(): address %x to translate out of range!\n", __FUNCTION__, val);
+        return 0;
+}
+
+
 #endif /* CPM_UART_H */
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index b7bf4c698a47..ced193bf9e1e 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -41,6 +41,7 @@
 #include <linux/device.h>
 #include <linux/bootmem.h>
 #include <linux/dma-mapping.h>
+#include <linux/fs_uart_pd.h>
 
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -60,7 +61,7 @@
 /* Track which ports are configured as uarts */
 int cpm_uart_port_map[UART_NR];
 /* How many ports did we config as uarts */
-int cpm_uart_nr;
+int cpm_uart_nr = 0;
 
 /**************************************************************/
 
@@ -71,18 +72,36 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo);
 
 /**************************************************************/
 
-static inline unsigned long cpu2cpm_addr(void *addr)
+
+/* Place-holder for board-specific stuff */
+struct platform_device* __attribute__ ((weak)) __init
+early_uart_get_pdev(int index)
 {
-        if ((unsigned long)addr >= CPM_ADDR)
-                return (unsigned long)addr;
-        return virt_to_bus(addr);
+        return NULL;
 }
 
-static inline void *cpm2cpu_addr(unsigned long addr)
+
+void cpm_uart_count(void)
 {
-        if (addr >= CPM_ADDR)
-                return (void *)addr;
-        return bus_to_virt(addr);
+        cpm_uart_nr = 0;
+#ifdef CONFIG_SERIAL_CPM_SMC1
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SMC1;
+#endif
+#ifdef CONFIG_SERIAL_CPM_SMC2
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SMC2;
+#endif
+#ifdef CONFIG_SERIAL_CPM_SCC1
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SCC1;
+#endif
+#ifdef CONFIG_SERIAL_CPM_SCC2
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SCC2;
+#endif
+#ifdef CONFIG_SERIAL_CPM_SCC3
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SCC3;
+#endif
+#ifdef CONFIG_SERIAL_CPM_SCC4
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SCC4;
+#endif
 }
 
 /*
@@ -258,7 +277,7 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                 }
 
                 /* get pointer */
-                cp = cpm2cpu_addr(bdp->cbd_bufaddr);
+                cp = cpm2cpu_addr(bdp->cbd_bufaddr, pinfo);
 
                 /* loop through the buffer */
                 while (i-- > 0) {
@@ -601,7 +620,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
                 /* Pick next descriptor and fill from buffer */
                 bdp = pinfo->tx_cur;
 
-                p = cpm2cpu_addr(bdp->cbd_bufaddr);
+                p = cpm2cpu_addr(bdp->cbd_bufaddr, pinfo);
 
                 *p++ = port->x_char;
                 bdp->cbd_datlen = 1;
@@ -628,7 +647,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
 
         while (!(bdp->cbd_sc & BD_SC_READY) && (xmit->tail != xmit->head)) {
                 count = 0;
-                p = cpm2cpu_addr(bdp->cbd_bufaddr);
+                p = cpm2cpu_addr(bdp->cbd_bufaddr, pinfo);
                 while (count < pinfo->tx_fifosize) {
                         *p++ = xmit->buf[xmit->tail];
                         xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
@@ -677,12 +696,12 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
         mem_addr = pinfo->mem_addr;
         bdp = pinfo->rx_cur = pinfo->rx_bd_base;
         for (i = 0; i < (pinfo->rx_nrfifos - 1); i++, bdp++) {
-                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
+                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr, pinfo);
                 bdp->cbd_sc = BD_SC_EMPTY | BD_SC_INTRPT;
                 mem_addr += pinfo->rx_fifosize;
         }
 
-        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
+        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr, pinfo);
         bdp->cbd_sc = BD_SC_WRAP | BD_SC_EMPTY | BD_SC_INTRPT;
 
         /* Set the physical address of the host memory
@@ -692,12 +711,12 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
         mem_addr = pinfo->mem_addr + L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize);
         bdp = pinfo->tx_cur = pinfo->tx_bd_base;
         for (i = 0; i < (pinfo->tx_nrfifos - 1); i++, bdp++) {
-                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
+                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr, pinfo);
                 bdp->cbd_sc = BD_SC_INTRPT;
                 mem_addr += pinfo->tx_fifosize;
         }
 
-        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
+        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr, pinfo);
         bdp->cbd_sc = BD_SC_WRAP | BD_SC_INTRPT;
 }
 
@@ -829,14 +848,6 @@ static int cpm_uart_request_port(struct uart_port *port)
         if (pinfo->flags & FLAG_CONSOLE)
                 return 0;
 
-        /*
-         * Setup any port IO, connect any baud rate generators,
-         * etc.  This is expected to be handled by board
-         * dependant code
-         */
-        if (pinfo->set_lineif)
-                pinfo->set_lineif(pinfo);
-
         if (IS_SMC(pinfo)) {
                 pinfo->smcp->smc_smcm &= ~(SMCM_RX | SMCM_TX);
                 pinfo->smcp->smc_smcmr &= ~(SMCMR_REN | SMCMR_TEN);
@@ -988,6 +999,54 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
         },
 };
 
+int cpm_uart_drv_get_platform_data(struct platform_device *pdev, int is_con)
+{
+        struct resource *r;
+        struct fs_uart_platform_info *pdata = pdev->dev.platform_data;
+        int idx = pdata->fs_no; /* It is UART_SMCx or UART_SCCx index */
+        struct uart_cpm_port *pinfo;
+        int line;
+        u32 mem, pram;
+
+        for (line=0; line<UART_NR && cpm_uart_port_map[line]!=pdata->fs_no; line++);
+
+        pinfo = (struct uart_cpm_port *) &cpm_uart_ports[idx];
+
+        pinfo->brg = pdata->brg;
+
+        if (!is_con) {
+                pinfo->port.line = line;
+                pinfo->port.flags = UPF_BOOT_AUTOCONF;
+        }
+
+        if (!(r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs")))
+                return -EINVAL;
+        mem = r->start;
+
+        if (!(r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pram")))
+                return -EINVAL;
+        pram = r->start;
+
+        if(idx > fsid_smc2_uart) {
+                pinfo->sccp = (scc_t *)mem;
+                pinfo->sccup = (scc_uart_t *)pram;
+        } else {
+                pinfo->smcp = (smc_t *)mem;
+                pinfo->smcup = (smc_uart_t *)pram;
+        }
+        pinfo->tx_nrfifos = pdata->tx_num_fifo;
+        pinfo->tx_fifosize = pdata->tx_buf_size;
+
+        pinfo->rx_nrfifos = pdata->rx_num_fifo;
+        pinfo->rx_fifosize = pdata->rx_buf_size;
+
+        pinfo->port.uartclk = pdata->uart_clk;
+        pinfo->port.mapbase = (unsigned long)mem;
+        pinfo->port.irq = platform_get_irq(pdev, 0);
+
+        return 0;
+}
+
 #ifdef CONFIG_SERIAL_CPM_CONSOLE
 /*
  *      Print a string to the serial port trying not to disturb
@@ -1027,7 +1086,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                  * If the buffer address is in the CPM DPRAM, don't
                  * convert it.
                  */
-                cp = cpm2cpu_addr(bdp->cbd_bufaddr);
+                cp = cpm2cpu_addr(bdp->cbd_bufaddr, pinfo);
 
                 *cp = *s;
 
@@ -1044,7 +1103,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                         while ((bdp->cbd_sc & BD_SC_READY) != 0)
                                 ;
 
-                        cp = cpm2cpu_addr(bdp->cbd_bufaddr);
+                        cp = cpm2cpu_addr(bdp->cbd_bufaddr, pinfo);
 
                         *cp = 13;
                         bdp->cbd_datlen = 1;
@@ -1067,9 +1126,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
         pinfo->tx_cur = (volatile cbd_t *) bdp;
 }
 
-/*
- * Setup console. Be careful is called early !
- */
+
 static int __init cpm_uart_console_setup(struct console *co, char *options)
 {
         struct uart_port *port;
@@ -1080,9 +1137,27 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
         int flow = 'n';
         int ret;
 
+        struct fs_uart_platform_info *pdata;
+        struct platform_device* pdev = early_uart_get_pdev(co->index);
+
         port =
             (struct uart_port *)&cpm_uart_ports[cpm_uart_port_map[co->index]];
         pinfo = (struct uart_cpm_port *)port;
+        if (!pdev) {
+                pr_info("cpm_uart: console: compat mode\n");
+                /* compatibility - will be cleaned up */
+                cpm_uart_init_portdesc();
+
+                if (pinfo->set_lineif)
+                        pinfo->set_lineif(pinfo);
+        } else {
+                pdata = pdev->dev.platform_data;
+                if (pdata)
+                        if (pdata->init_ioports)
+                                pdata->init_ioports();
+
+                cpm_uart_drv_get_platform_data(pdev, 1);
+        }
 
         pinfo->flags |= FLAG_CONSOLE;
 
@@ -1097,14 +1172,6 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
                         baud = 9600;
         }
 
-        /*
-         * Setup any port IO, connect any baud rate generators,
-         * etc.  This is expected to be handled by board
-         * dependant code
-         */
-        if (pinfo->set_lineif)
-                pinfo->set_lineif(pinfo);
-
         if (IS_SMC(pinfo)) {
                 pinfo->smcp->smc_smcm &= ~(SMCM_RX | SMCM_TX);
                 pinfo->smcp->smc_smcmr &= ~(SMCMR_REN | SMCMR_TEN);
@@ -1143,11 +1210,8 @@ static struct console cpm_scc_uart_console = {
 
 int __init cpm_uart_console_init(void)
 {
-        int ret = cpm_uart_init_portdesc();
-
-        if (!ret)
-                register_console(&cpm_scc_uart_console);
-        return ret;
+        register_console(&cpm_scc_uart_console);
+        return 0;
 }
 
 console_initcall(cpm_uart_console_init);
@@ -1165,44 +1229,130 @@ static struct uart_driver cpm_reg = {
         .minor          = SERIAL_CPM_MINOR,
         .cons           = CPM_UART_CONSOLE,
 };
-
-static int __init cpm_uart_init(void)
+static int cpm_uart_drv_probe(struct device *dev)
 {
-        int ret, i;
-
-        printk(KERN_INFO "Serial: CPM driver $Revision: 0.01 $\n");
+        struct platform_device  *pdev = to_platform_device(dev);
+        struct fs_uart_platform_info *pdata;
+        int ret = -ENODEV;
 
-#ifndef CONFIG_SERIAL_CPM_CONSOLE
-        ret = cpm_uart_init_portdesc();
-        if (ret)
+        if(!pdev) {
+                printk(KERN_ERR"CPM UART: platform data missing!\n");
                 return ret;
-#endif
+        }
 
-        cpm_reg.nr = cpm_uart_nr;
-        ret = uart_register_driver(&cpm_reg);
+        pdata = pdev->dev.platform_data;
+        pr_debug("cpm_uart_drv_probe: Adding CPM UART %d\n",
+                        cpm_uart_port_map[pdata->fs_no]);
 
-        if (ret)
+        if ((ret = cpm_uart_drv_get_platform_data(pdev, 0)))
                 return ret;
 
-        for (i = 0; i < cpm_uart_nr; i++) {
-                int con = cpm_uart_port_map[i];
-                cpm_uart_ports[con].port.line = i;
-                cpm_uart_ports[con].port.flags = UPF_BOOT_AUTOCONF;
-                uart_add_one_port(&cpm_reg, &cpm_uart_ports[con].port);
-        }
+        if (pdata->init_ioports)
+                pdata->init_ioports();
 
-        return ret;
+        ret = uart_add_one_port(&cpm_reg, &cpm_uart_ports[pdata->fs_no].port);
+
+        return ret;
 }
 
-static void __exit cpm_uart_exit(void)
+static int cpm_uart_drv_remove(struct device *dev)
+{
+        struct platform_device  *pdev = to_platform_device(dev);
+        struct fs_uart_platform_info *pdata = pdev->dev.platform_data;
+
+        pr_debug("cpm_uart_drv_remove: Removing CPM UART %d\n",
+                        cpm_uart_port_map[pdata->fs_no]);
+
+        uart_remove_one_port(&cpm_reg, &cpm_uart_ports[pdata->fs_no].port);
+        return 0;
+}
+
+static struct device_driver cpm_smc_uart_driver = {
+        .name   = "fsl-cpm-smc:uart",
+        .bus    = &platform_bus_type,
+        .probe  = cpm_uart_drv_probe,
+        .remove = cpm_uart_drv_remove,
+};
+
+static struct device_driver cpm_scc_uart_driver = {
+        .name   = "fsl-cpm-scc:uart",
+        .bus    = &platform_bus_type,
+        .probe  = cpm_uart_drv_probe,
+        .remove = cpm_uart_drv_remove,
+};
+
+/*
+   This is supposed to match uart devices on platform bus,
+   */
+static int match_is_uart (struct device* dev, void* data)
 {
+        struct platform_device* pdev = container_of(dev, struct platform_device, dev);
+        int ret = 0;
+        /* this was setfunc as uart */
+        if(strstr(pdev->name,":uart")) {
+                ret = 1;
+        }
+        return ret;
+}
+
+
+static int cpm_uart_init(void) {
+
+        int ret;
         int i;
+        struct device *dev;
+        printk(KERN_INFO "Serial: CPM driver $Revision: 0.02 $\n");
+
+        /* lookup the bus for uart devices */
+        dev = bus_find_device(&platform_bus_type, NULL, 0, match_is_uart);
+
+        /* There are devices on the bus - all should be OK  */
+        if (dev) {
+                cpm_uart_count();
+                cpm_reg.nr = cpm_uart_nr;
+
+                if (!(ret = uart_register_driver(&cpm_reg))) {
+                        if ((ret = driver_register(&cpm_smc_uart_driver))) {
+                                uart_unregister_driver(&cpm_reg);
+                                return ret;
+                        }
+                        if ((ret = driver_register(&cpm_scc_uart_driver))) {
+                                driver_unregister(&cpm_scc_uart_driver);
+                                uart_unregister_driver(&cpm_reg);
+                        }
+                }
+        } else {
+        /* No capable platform devices found - falling back to legacy mode */
+                pr_info("cpm_uart: WARNING: no UART devices found on platform bus!\n");
+                pr_info(
+                "cpm_uart: the driver will guess configuration, but this mode is no longer supported.\n");
+#ifndef CONFIG_SERIAL_CPM_CONSOLE
+                ret = cpm_uart_init_portdesc();
+                if (ret)
+                        return ret;
+#endif
+
+                cpm_reg.nr = cpm_uart_nr;
+                ret = uart_register_driver(&cpm_reg);
+
+                if (ret)
+                        return ret;
+
+                for (i = 0; i < cpm_uart_nr; i++) {
+                        int con = cpm_uart_port_map[i];
+                        cpm_uart_ports[con].port.line = i;
+                        cpm_uart_ports[con].port.flags = UPF_BOOT_AUTOCONF;
+                        uart_add_one_port(&cpm_reg, &cpm_uart_ports[con].port);
+                }
 
-        for (i = 0; i < cpm_uart_nr; i++) {
-                int con = cpm_uart_port_map[i];
-                uart_remove_one_port(&cpm_reg, &cpm_uart_ports[con].port);
         }
+        return ret;
+}
 
+static void __exit cpm_uart_exit(void)
+{
+        driver_unregister(&cpm_scc_uart_driver);
+        driver_unregister(&cpm_smc_uart_driver);
         uart_unregister_driver(&cpm_reg);
 }
 
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.c b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
index d789ee55cbb7..a5a30622637a 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
@@ -81,58 +81,11 @@ void cpm_line_cr_cmd(int line, int cmd)
 
 void smc1_lineif(struct uart_cpm_port *pinfo)
 {
-        volatile cpm8xx_t *cp = cpmp;
-
-        (void)cp;       /* fix warning */
-#if defined (CONFIG_MPC885ADS)
-        /* Enable SMC1 transceivers */
-        {
-                cp->cp_pepar |= 0x000000c0;
-                cp->cp_pedir &= ~0x000000c0;
-                cp->cp_peso &= ~0x00000040;
-                cp->cp_peso |= 0x00000080;
-        }
-#elif defined (CONFIG_MPC86XADS)
-        unsigned int iobits = 0x000000c0;
-
-        if (!pinfo->is_portb) {
-                cp->cp_pbpar |= iobits;
-                cp->cp_pbdir &= ~iobits;
-                cp->cp_pbodr &= ~iobits;
-        } else {
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_papar |= iobits;
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_padir &= ~iobits;
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_paodr &= ~iobits;
-        }
-#endif
         pinfo->brg = 1;
 }
 
 void smc2_lineif(struct uart_cpm_port *pinfo)
 {
-        volatile cpm8xx_t *cp = cpmp;
-
-        (void)cp;       /* fix warning */
-#if defined (CONFIG_MPC885ADS)
-        cp->cp_pepar |= 0x00000c00;
-        cp->cp_pedir &= ~0x00000c00;
-        cp->cp_peso &= ~0x00000400;
-        cp->cp_peso |= 0x00000800;
-#elif defined (CONFIG_MPC86XADS)
-        unsigned int iobits = 0x00000c00;
-
-        if (!pinfo->is_portb) {
-                cp->cp_pbpar |= iobits;
-                cp->cp_pbdir &= ~iobits;
-                cp->cp_pbodr &= ~iobits;
-        } else {
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_papar |= iobits;
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_padir &= ~iobits;
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_paodr &= ~iobits;
-        }
-
-#endif
-
         pinfo->brg = 2;
 }
 
@@ -191,7 +144,7 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
                 /* was hostalloc but changed cause it blows away the */
                 /* large tlb mapping when pinning the kernel area    */
                 mem_addr = (u8 *) cpm_dpram_addr(cpm_dpalloc(memsz, 8));
-                dma_addr = 0;
+                dma_addr = (u32)mem_addr;
         } else
                 mem_addr = dma_alloc_coherent(NULL, memsz, &dma_addr,
                                               GFP_KERNEL);
@@ -204,8 +157,9 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
         }
 
         pinfo->dp_addr = dp_offset;
-        pinfo->mem_addr = mem_addr;
-        pinfo->dma_addr = dma_addr;
+        pinfo->mem_addr = mem_addr;             /*  virtual address*/
+        pinfo->dma_addr = dma_addr;             /*  physical address*/
+        pinfo->mem_size = memsz;
 
         pinfo->rx_buf = mem_addr;
         pinfo->tx_buf = pinfo->rx_buf + L1_CACHE_ALIGN(pinfo->rx_nrfifos
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm2.c b/drivers/serial/cpm_uart/cpm_uart_cpm2.c
index fd9e53ed3feb..7c6b07aeea92 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm2.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm2.c
@@ -142,14 +142,6 @@ void scc2_lineif(struct uart_cpm_port *pinfo)
          * be supported in a sane fashion.
          */
 #ifndef CONFIG_STX_GP3
-#ifdef CONFIG_MPC8560_ADS
-        volatile iop_cpm2_t *io = &cpm2_immr->im_ioport;
-        io->iop_ppard |= 0x00000018;
-        io->iop_psord &= ~0x00000008;   /* Rx */
-        io->iop_psord &= ~0x00000010;   /* Tx */
-        io->iop_pdird &= ~0x00000008;   /* Rx */
-        io->iop_pdird |= 0x00000010;    /* Tx */
-#else
         volatile iop_cpm2_t *io = &cpm2_immr->im_ioport;
         io->iop_pparb |= 0x008b0000;
         io->iop_pdirb |= 0x00880000;
@@ -157,7 +149,6 @@ void scc2_lineif(struct uart_cpm_port *pinfo)
         io->iop_pdirb &= ~0x00030000;
         io->iop_psorb &= ~0x00030000;
 #endif
-#endif
         cpm2_immr->im_cpmux.cmx_scr &= 0xff00ffff;
         cpm2_immr->im_cpmux.cmx_scr |= 0x00090000;
         pinfo->brg = 2;
@@ -218,8 +209,10 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
 
         memsz = L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize) +
             L1_CACHE_ALIGN(pinfo->tx_nrfifos * pinfo->tx_fifosize);
-        if (is_con)
+        if (is_con) {
                 mem_addr = alloc_bootmem(memsz);
+                dma_addr = mem_addr;
+        }
         else
                 mem_addr = dma_alloc_coherent(NULL, memsz, &dma_addr,
                                               GFP_KERNEL);
@@ -234,6 +227,7 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
         pinfo->dp_addr = dp_offset;
         pinfo->mem_addr = mem_addr;
         pinfo->dma_addr = dma_addr;
+        pinfo->mem_size = memsz;
 
         pinfo->rx_buf = mem_addr;
         pinfo->tx_buf = pinfo->rx_buf + L1_CACHE_ALIGN(pinfo->rx_nrfifos
diff --git a/drivers/serial/m32r_sio.c b/drivers/serial/m32r_sio.c
index e9c10c0a30fc..321a40f33b50 100644
--- a/drivers/serial/m32r_sio.c
+++ b/drivers/serial/m32r_sio.c
@@ -1057,7 +1057,6 @@ static void m32r_sio_console_write(struct console *co, const char *s,
 {
         struct uart_sio_port *up = &m32r_sio_ports[co->index];
         unsigned int ier;
-        int i;
 
         /*
          *      First save the UER then disable the interrupts
diff --git a/drivers/sn/ioc3.c b/drivers/sn/ioc3.c
index 0b49ff78efc1..501316b198e5 100644
--- a/drivers/sn/ioc3.c
+++ b/drivers/sn/ioc3.c
@@ -678,7 +678,7 @@ static int ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
         /* Track PCI-device specific data */
         pci_set_drvdata(pdev, idd);
         down_write(&ioc3_devices_rwsem);
-        list_add(&idd->list, &ioc3_devices);
+        list_add_tail(&idd->list, &ioc3_devices);
         idd->id = ioc3_counter++;
         up_write(&ioc3_devices_rwsem);
 
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 42b457030b03..0eb010a3f5bc 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -1614,6 +1614,7 @@ static int activate_ep_files (struct dev_data *dev)
                                 data, &ep_config_operations,
                                 &data->dentry);
                 if (!data->inode) {
+                        usb_ep_free_request(ep, data->req);
                         kfree (data);
                         goto enomem;
                 }
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index 6a4b93ad1082..0b9293493957 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -2166,7 +2166,7 @@ static void handle_ep_small (struct net2280_ep *ep)
                                         ep->stopped = 1;
                                         set_halt (ep);
                                         mode = 2;
-                                } else if (!req && ep->stopped)
+                                } else if (!req && !ep->stopped)
                                         write_fifo (ep, NULL);
                         }
                 } else {
@@ -2280,9 +2280,7 @@ static void handle_ep_small (struct net2280_ep *ep)
                 /* if we wrote it all, we're usually done */
                 if (req->req.actual == req->req.length) {
                         if (ep->num == 0) {
-                                /* wait for control status */
-                                if (mode != 2)
-                                        req = NULL;
+                                /* send zlps until the status stage */
                         } else if (!req->req.zero || len != ep->ep.maxpacket)
                                 mode = 2;
                 }
@@ -2744,6 +2742,10 @@ static irqreturn_t net2280_irq (int irq, void *_dev, struct pt_regs * r)
 {
         struct net2280          *dev = _dev;
 
+        /* shared interrupt, not ours */
+        if (!(readl(&dev->regs->irqstat0) & (1 << INTA_ASSERTED)))
+                return IRQ_NONE;
+
         spin_lock (&dev->lock);
 
         /* handle disconnect, dma, and more */
@@ -2831,13 +2833,13 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
         }
 
         /* alloc, and start init */
-        dev = kmalloc (sizeof *dev, SLAB_KERNEL);
+        dev = kzalloc (sizeof *dev, SLAB_KERNEL);
         if (dev == NULL){
                 retval = -ENOMEM;
                 goto done;
         }
 
-        memset (dev, 0, sizeof *dev);
+        pci_set_drvdata (pdev, dev);
         spin_lock_init (&dev->lock);
         dev->pdev = pdev;
         dev->gadget.ops = &net2280_ops;
@@ -2950,7 +2952,6 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
         dev->chiprev = get_idx_reg (dev->regs, REG_CHIPREV) & 0xffff;
 
         /* done */
-        pci_set_drvdata (pdev, dev);
         INFO (dev, "%s\n", driver_desc);
         INFO (dev, "irq %s, pci mem %p, chip rev %04x\n",
                         bufp, base, dev->chiprev);
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 1e03f1a5a5fd..a1bd2bea6deb 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -350,7 +350,7 @@ static const struct hc_driver ehci_pci_hc_driver = {
 /* PCI driver selection metadata; PCI hotplugging uses this */
 static const struct pci_device_id pci_ids [] = { {
         /* handle any USB 2.0 EHCI controller */
-        PCI_DEVICE_CLASS(((PCI_CLASS_SERIAL_USB << 8) | 0x20), ~0),
+        PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_EHCI, ~0),
         .driver_data =  (unsigned long) &ehci_pci_hc_driver,
         },
         { /* end: all zeroes */ }
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index 1bfe96f4d045..b268537e389e 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -206,7 +206,7 @@ static const struct hc_driver ohci_pci_hc_driver = {
 
 static const struct pci_device_id pci_ids [] = { {
         /* handle any USB OHCI controller */
-        PCI_DEVICE_CLASS((PCI_CLASS_SERIAL_USB << 8) | 0x10, ~0),
+        PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_OHCI, ~0),
         .driver_data =  (unsigned long) &ohci_pci_hc_driver,
         }, { /* end: all zeroes */ }
 };
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index c0c4db78b590..d225e11f4055 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -858,7 +858,7 @@ static const struct hc_driver uhci_driver = {
 
 static const struct pci_device_id uhci_pci_ids[] = { {
         /* handle any USB UHCI controller */
-        PCI_DEVICE_CLASS(((PCI_CLASS_SERIAL_USB << 8) | 0x00), ~0),
+        PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_UHCI, ~0),
         .driver_data =  (unsigned long) &uhci_driver,
         }, { /* end: all zeroes */ }
 };
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index f5851db67f5b..82151207d814 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -308,6 +308,7 @@ static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
 
 static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_IRTRANS_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_IPLUS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SIO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_8U232AM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_8U232AM_ALT_PID) },
@@ -493,6 +494,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_WESTREX_MODEL_777_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_WESTREX_MODEL_8900F_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
         { USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
         { USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
         { },                                    /* Optional parameter entry */
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 2155f0e4a378..2c55a5ea9c99 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -39,6 +39,9 @@
 /* www.thoughttechnology.com/ TT-USB provide with procomp use ftdi_sio */
 #define FTDI_TTUSB_PID 0xFF20 /* Product Id */
 
+/* iPlus device */
+#define FTDI_IPLUS_PID 0xD070 /* Product Id */
+
 /* www.crystalfontz.com devices - thanx for providing free devices for evaluation ! */
 /* they use the ftdi chipset for the USB interface and the vendor id is the same */
 #define FTDI_XF_632_PID 0xFC08  /* 632: 16x2 Character Display */
@@ -153,6 +156,11 @@
 #define ICOM_ID1_PID            0x0004
 
 /*
+ * ASK.fr devices
+ */
+#define FTDI_ASK_RDR400_PID     0xC991  /* ASK RDR 400 series card reader */
+
+/*
  * DSS-20 Sync Station for Sony Ericsson P800
  */
  
@@ -400,6 +408,11 @@
 #define FTDI_WESTREX_MODEL_8900F_PID    0xDC01  /* Model 8900F */
 
 /*
+ * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
+ */
+#define FTDI_RRCIRKITS_LOCOBUFFER_PID   0xc7d0  /* LocoBuffer USB */
+
+/*
  * Eclo (http://www.eclo.pt/) product IDs.
  * PID 0xEA90 submitted by Martin Grill.
  */
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index ccf746b27d4e..c96714bb1cb8 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -61,6 +61,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
         { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID_UCSGT) },
         { USB_DEVICE(ITEGNO_VENDOR_ID, ITEGNO_PRODUCT_ID) },
+        { USB_DEVICE(ITEGNO_VENDOR_ID, ITEGNO_PRODUCT_ID_2080) },
         { USB_DEVICE(MA620_VENDOR_ID, MA620_PRODUCT_ID) },
         { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID) },
         { USB_DEVICE(TRIPP_VENDOR_ID, TRIPP_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 09f379b19e98..7f29e81d3e35 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -26,6 +26,7 @@
 
 #define ITEGNO_VENDOR_ID        0x0eba
 #define ITEGNO_PRODUCT_ID       0x1080
+#define ITEGNO_PRODUCT_ID_2080  0x2080
 
 #define MA620_VENDOR_ID         0x0df7
 #define MA620_PRODUCT_ID        0x0620
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 557411c6e7c7..f806553cd9a4 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -508,6 +508,7 @@ no_firmware:
         err("%s: Unable to retrieve firmware version, try replugging\n", serial->type->description);
         err("%s: If the firmware is not running (status led not blinking)\n", serial->type->description);
         err("%s: please contact support@connecttech.com\n", serial->type->description);
+        kfree(result);
         return -ENODEV;
 
 no_command_private:
diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig
index 92be101feba7..be9eec225743 100644
--- a/drivers/usb/storage/Kconfig
+++ b/drivers/usb/storage/Kconfig
@@ -48,7 +48,8 @@ config USB_STORAGE_FREECOM
 
 config USB_STORAGE_ISD200
         bool "ISD-200 USB/ATA Bridge support"
-        depends on USB_STORAGE && BLK_DEV_IDE
+        depends on USB_STORAGE
+        depends on BLK_DEV_IDE=y || BLK_DEV_IDE=USB_STORAGE
         ---help---
           Say Y here if you want to use USB Mass Store devices based
           on the In-Systems Design ISD-200 USB/ATA bridge.
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c4a9dcff5f2b..aec5ea8682d5 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -411,7 +411,7 @@ UNUSUAL_DEV(  0x050d, 0x0115, 0x0133, 0x0133,
 UNUSUAL_DEV(  0x0525, 0xa140, 0x0100, 0x0100,
                 "Iomega",
                 "USB Clik! 40",
-                US_SC_8070, US_PR_BULK, NULL,
+                US_SC_8070, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY ),
 
 /* Yakumo Mega Image 37
@@ -773,6 +773,13 @@ UNUSUAL_DEV(  0x069b, 0x3004, 0x0001, 0x0001,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY ),
 
+/* Reported by Olivier Blondeau <zeitoun@gmail.com> */
+UNUSUAL_DEV(  0x0727, 0x0306, 0x0100, 0x0100,
+                "ATMEL",
+                "SND1 Storage",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE),
+
 /* Submitted by Roman Hodek <roman@hodek.net> */
 UNUSUAL_DEV(  0x0781, 0x0001, 0x0200, 0x0200,
                 "Sandisk",
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 9060e7137441..4587087d777a 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -400,6 +400,8 @@ config FB_ASILIANT
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the Asiliant 69030 chipset
 
 config FB_IMSTT
         bool "IMS Twin Turbo display support"
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index 9a6b5b39b88e..387a18a47ac2 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -2265,7 +2265,7 @@ static struct bin_attribute edid2_attr = {
 };
 
 
-static int radeonfb_pci_register (struct pci_dev *pdev,
+static int __devinit radeonfb_pci_register (struct pci_dev *pdev,
                                   const struct pci_device_id *ent)
 {
         struct fb_info *info;
diff --git a/drivers/video/au1200fb.c b/drivers/video/au1200fb.c
index b367de30b98c..600d3e0e08b7 100644
--- a/drivers/video/au1200fb.c
+++ b/drivers/video/au1200fb.c
@@ -1920,1925 +1920,3 @@ module_exit(au1200fb_cleanup);
 
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
-/*
- * BRIEF MODULE DESCRIPTION
- *      Au1200 LCD Driver.
- *
- * Copyright 2004-2005 AMD
- * Author: AMD
- *
- * Based on:
- * linux/drivers/video/skeletonfb.c -- Skeleton for a frame buffer device
- *  Created 28 Dec 1997 by Geert Uytterhoeven
- *
- *  This program is free software; you can redistribute  it and/or modify it
- *  under  the terms of  the GNU General  Public License as published by the
- *  Free Software Foundation;  either version 2 of the  License, or (at your
- *  option) any later version.
- *
- *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
- *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
- *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
- *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
- *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
- *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
- *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *  You should have received a copy of the  GNU General Public License along
- *  with this program; if not, write  to the Free Software Foundation, Inc.,
- *  675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/string.h>
-#include <linux/mm.h>
-#include <linux/fb.h>
-#include <linux/init.h>
-#include <linux/interrupt.h>
-#include <linux/ctype.h>
-#include <linux/dma-mapping.h>
-
-#include <asm/mach-au1x00/au1000.h>
-#include "au1200fb.h"
-
-#ifdef CONFIG_PM
-#include <asm/mach-au1x00/au1xxx_pm.h>
-#endif
-
-#ifndef CONFIG_FB_AU1200_DEVS
-#define CONFIG_FB_AU1200_DEVS 4
-#endif
-
-#define DRIVER_NAME "au1200fb"
-#define DRIVER_DESC "LCD controller driver for AU1200 processors"
-
-#define DEBUG 1
-
-#define print_err(f, arg...) printk(KERN_ERR DRIVER_NAME ": " f "\n", ## arg)
-#define print_warn(f, arg...) printk(KERN_WARNING DRIVER_NAME ": " f "\n", ## arg)
-#define print_info(f, arg...) printk(KERN_INFO DRIVER_NAME ": " f "\n", ## arg)
-
-#if DEBUG
-#define print_dbg(f, arg...) printk(KERN_DEBUG __FILE__ ": " f "\n", ## arg)
-#else
-#define print_dbg(f, arg...) do {} while (0)
-#endif
-
-
-#define AU1200_LCD_FB_IOCTL 0x46FF
-
-#define AU1200_LCD_SET_SCREEN 1
-#define AU1200_LCD_GET_SCREEN 2
-#define AU1200_LCD_SET_WINDOW 3
-#define AU1200_LCD_GET_WINDOW 4
-#define AU1200_LCD_SET_PANEL  5
-#define AU1200_LCD_GET_PANEL  6
-
-#define SCREEN_SIZE                 (1<< 1)
-#define SCREEN_BACKCOLOR    (1<< 2)
-#define SCREEN_BRIGHTNESS   (1<< 3)
-#define SCREEN_COLORKEY     (1<< 4)
-#define SCREEN_MASK         (1<< 5)
-
-struct au1200_lcd_global_regs_t {
-        unsigned int flags;
-        unsigned int xsize;
-        unsigned int ysize;
-        unsigned int backcolor;
-        unsigned int brightness;
-        unsigned int colorkey;
-        unsigned int mask;
-        unsigned int panel_choice;
-        char panel_desc[80];
-
-};
-
-#define WIN_POSITION            (1<< 0)
-#define WIN_ALPHA_COLOR         (1<< 1)
-#define WIN_ALPHA_MODE          (1<< 2)
-#define WIN_PRIORITY            (1<< 3)
-#define WIN_CHANNEL             (1<< 4)
-#define WIN_BUFFER_FORMAT       (1<< 5)
-#define WIN_COLOR_ORDER         (1<< 6)
-#define WIN_PIXEL_ORDER         (1<< 7)
-#define WIN_SIZE                (1<< 8)
-#define WIN_COLORKEY_MODE       (1<< 9)
-#define WIN_DOUBLE_BUFFER_MODE  (1<< 10)
-#define WIN_RAM_ARRAY_MODE      (1<< 11)
-#define WIN_BUFFER_SCALE        (1<< 12)
-#define WIN_ENABLE                  (1<< 13)
-
-struct au1200_lcd_window_regs_t {
-        unsigned int flags;
-        unsigned int xpos;
-        unsigned int ypos;
-        unsigned int alpha_color;
-        unsigned int alpha_mode;
-        unsigned int priority;
-        unsigned int channel;
-        unsigned int buffer_format;
-        unsigned int color_order;
-        unsigned int pixel_order;
-        unsigned int xsize;
-        unsigned int ysize;
-        unsigned int colorkey_mode;
-        unsigned int double_buffer_mode;
-        unsigned int ram_array_mode;
-        unsigned int xscale;
-        unsigned int yscale;
-        unsigned int enable;
-};
-
-
-struct au1200_lcd_iodata_t {
-        unsigned int subcmd;
-        struct au1200_lcd_global_regs_t global;
-        struct au1200_lcd_window_regs_t window;
-};
-
-#if defined(__BIG_ENDIAN)
-#define LCD_CONTROL_DEFAULT_PO LCD_CONTROL_PO_11
-#else
-#define LCD_CONTROL_DEFAULT_PO LCD_CONTROL_PO_00
-#endif
-#define LCD_CONTROL_DEFAULT_SBPPF LCD_CONTROL_SBPPF_565
-
-/* Private, per-framebuffer management information (independent of the panel itself) */
-struct au1200fb_device {
-        struct fb_info fb_info;                 /* FB driver info record */
-
-        int                                     plane;
-        unsigned char*          fb_mem;         /* FrameBuffer memory map */
-        unsigned int            fb_len;
-        dma_addr_t              fb_phys;
-};
-
-static struct au1200fb_device _au1200fb_devices[CONFIG_FB_AU1200_DEVS];
-/********************************************************************/
-
-/* LCD controller restrictions */
-#define AU1200_LCD_MAX_XRES     1280
-#define AU1200_LCD_MAX_YRES     1024
-#define AU1200_LCD_MAX_BPP      32
-#define AU1200_LCD_MAX_CLK      96000000 /* fixme: this needs to go away ? */
-#define AU1200_LCD_NBR_PALETTE_ENTRIES 256
-
-/* Default number of visible screen buffer to allocate */
-#define AU1200FB_NBR_VIDEO_BUFFERS 1
-
-/********************************************************************/
-
-static struct au1200_lcd *lcd = (struct au1200_lcd *) AU1200_LCD_ADDR;
-static int window_index = 2; /* default is zero */
-static int panel_index = 2; /* default is zero */
-static struct window_settings *win;
-static struct panel_settings *panel;
-static int noblanking = 1;
-static int nohwcursor = 0;
-
-struct window_settings {
-        unsigned char name[64];
-        uint32 mode_backcolor;
-        uint32 mode_colorkey;
-        uint32 mode_colorkeymsk;
-        struct {
-                int xres;
-                int yres;
-                int xpos;
-                int ypos;
-                uint32 mode_winctrl1; /* winctrl1[FRM,CCO,PO,PIPE] */
-                uint32 mode_winenable;
-        } w[4];
-};
-
-#if defined(__BIG_ENDIAN)
-#define LCD_WINCTRL1_PO_16BPP LCD_WINCTRL1_PO_00
-#else
-#define LCD_WINCTRL1_PO_16BPP LCD_WINCTRL1_PO_01
-#endif
-
-extern int board_au1200fb_panel_init (void);
-extern int board_au1200fb_panel_shutdown (void);
-
-#ifdef CONFIG_PM
-int au1200fb_pm_callback(au1xxx_power_dev_t *dev,
-                au1xxx_request_t request, void *data);
-au1xxx_power_dev_t *LCD_pm_dev;
-#endif
-
-/*
- * Default window configurations
- */
-static struct window_settings windows[] = {
-        { /* Index 0 */
-                "0-FS gfx, 1-video, 2-ovly gfx, 3-ovly gfx",
-                /* mode_backcolor       */ 0x006600ff,
-                /* mode_colorkey,msk*/ 0, 0,
-                {
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP,
-                        /* mode_winenable*/ LCD_WINENABLE_WEN0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 100, 100, 100, 100,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP |
-                                LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ LCD_WINENABLE_WEN1,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP,
-                        /* mode_winenable*/ 0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP |
-                                LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ 0,
-                        },
-                },
-        },
-
-        { /* Index 1 */
-                "0-FS gfx, 1-video, 2-ovly gfx, 3-ovly gfx",
-                /* mode_backcolor       */ 0x006600ff,
-                /* mode_colorkey,msk*/ 0, 0,
-                {
-                        {
-                        /* xres, yres, xpos, ypos */ 320, 240, 5, 5,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_24BPP |
-                                LCD_WINCTRL1_PO_00,
-                        /* mode_winenable*/ LCD_WINENABLE_WEN0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565
-                                | LCD_WINCTRL1_PO_16BPP,
-                        /* mode_winenable*/ 0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 100, 100, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP |
-                                LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ 0/*LCD_WINENABLE_WEN2*/,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 200, 25, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP |
-                                LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ 0,
-                        },
-                },
-        },
-        { /* Index 2 */
-                "0-FS gfx, 1-video, 2-ovly gfx, 3-ovly gfx",
-                /* mode_backcolor       */ 0x006600ff,
-                /* mode_colorkey,msk*/ 0, 0,
-                {
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP,
-                        /* mode_winenable*/ LCD_WINENABLE_WEN0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP,
-                        /* mode_winenable*/ 0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_32BPP |
-                                LCD_WINCTRL1_PO_00|LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ 0/*LCD_WINENABLE_WEN2*/,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP |
-                                LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ 0,
-                        },
-                },
-        },
-        /* Need VGA 640 @ 24bpp, @ 32bpp */
-        /* Need VGA 800 @ 24bpp, @ 32bpp */
-        /* Need VGA 1024 @ 24bpp, @ 32bpp */
-};
-
-/*
- * Controller configurations for various panels.
- */
-
-struct panel_settings
-{
-        const char name[25];            /* Full name <vendor>_<model> */
-
-        struct  fb_monspecs monspecs;   /* FB monitor specs */
-
-        /* panel timings */
-        uint32 mode_screen;
-        uint32 mode_horztiming;
-        uint32 mode_verttiming;
-        uint32 mode_clkcontrol;
-        uint32 mode_pwmdiv;
-        uint32 mode_pwmhi;
-        uint32 mode_outmask;
-        uint32 mode_fifoctrl;
-        uint32 mode_toyclksrc;
-        uint32 mode_backlight;
-        uint32 mode_auxpll;
-        int (*device_init)(void);
-        int (*device_shutdown)(void);
-#define Xres min_xres
-#define Yres min_yres
-        u32     min_xres;               /* Minimum horizontal resolution */
-        u32     max_xres;               /* Maximum horizontal resolution */
-        u32     min_yres;               /* Minimum vertical resolution */
-        u32     max_yres;               /* Maximum vertical resolution */
-};
-
-/********************************************************************/
-/* fixme: Maybe a modedb for the CRT ? otherwise panels should be as-is */
-
-/* List of panels known to work with the AU1200 LCD controller.
- * To add a new panel, enter the same specifications as the
- * Generic_TFT one, and MAKE SURE that it doesn't conflicts
- * with the controller restrictions. Restrictions are:
- *
- * STN color panels: max_bpp <= 12
- * STN mono panels: max_bpp <= 4
- * TFT panels: max_bpp <= 16
- * max_xres <= 800
- * max_yres <= 600
- */
-static struct panel_settings known_lcd_panels[] =
-{
-        [0] = { /* QVGA 320x240 H:33.3kHz V:110Hz */
-                .name = "QVGA_320x240",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = LCD_SCREEN_SX_N(320) |
-                        LCD_SCREEN_SY_N(240),
-                .mode_horztiming        = 0x00c4623b,
-                .mode_verttiming        = 0x00502814,
-                .mode_clkcontrol        = 0x00020002, /* /4=24Mhz */
-                .mode_pwmdiv            = 0x00000000,
-                .mode_pwmhi             = 0x00000000,
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = NULL,
-                .device_shutdown        = NULL,
-                320, 320,
-                240, 240,
-        },
-
-        [1] = { /* VGA 640x480 H:30.3kHz V:58Hz */
-                .name = "VGA_640x480",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = 0x13f9df80,
-                .mode_horztiming        = 0x003c5859,
-                .mode_verttiming        = 0x00741201,
-                .mode_clkcontrol        = 0x00020001, /* /4=24Mhz */
-                .mode_pwmdiv            = 0x00000000,
-                .mode_pwmhi             = 0x00000000,
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = NULL,
-                .device_shutdown        = NULL,
-                640, 480,
-                640, 480,
-        },
-
-        [2] = { /* SVGA 800x600 H:46.1kHz V:69Hz */
-                .name = "SVGA_800x600",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = 0x18fa5780,
-                .mode_horztiming        = 0x00dc7e77,
-                .mode_verttiming        = 0x00584805,
-                .mode_clkcontrol        = 0x00020000, /* /2=48Mhz */
-                .mode_pwmdiv            = 0x00000000,
-                .mode_pwmhi             = 0x00000000,
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = NULL,
-                .device_shutdown        = NULL,
-                800, 800,
-                600, 600,
-        },
-
-        [3] = { /* XVGA 1024x768 H:56.2kHz V:70Hz */
-                .name = "XVGA_1024x768",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = 0x1ffaff80,
-                .mode_horztiming        = 0x007d0e57,
-                .mode_verttiming        = 0x00740a01,
-                .mode_clkcontrol        = 0x000A0000, /* /1 */
-                .mode_pwmdiv            = 0x00000000,
-                .mode_pwmhi             = 0x00000000,
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 6, /* 72MHz AUXPLL */
-                .device_init            = NULL,
-                .device_shutdown        = NULL,
-                1024, 1024,
-                768, 768,
-        },
-
-        [4] = { /* XVGA XVGA 1280x1024 H:68.5kHz V:65Hz */
-                .name = "XVGA_1280x1024",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = 0x27fbff80,
-                .mode_horztiming        = 0x00cdb2c7,
-                .mode_verttiming        = 0x00600002,
-                .mode_clkcontrol        = 0x000A0000, /* /1 */
-                .mode_pwmdiv            = 0x00000000,
-                .mode_pwmhi             = 0x00000000,
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 10, /* 120MHz AUXPLL */
-                .device_init            = NULL,
-                .device_shutdown        = NULL,
-                1280, 1280,
-                1024, 1024,
-        },
-
-        [5] = { /* Samsung 1024x768 TFT */
-                .name = "Samsung_1024x768_TFT",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = 0x1ffaff80,
-                .mode_horztiming        = 0x018cc677,
-                .mode_verttiming        = 0x00241217,
-                .mode_clkcontrol        = 0x00000000, /* SCB 0x1 /4=24Mhz */
-                .mode_pwmdiv            = 0x8000063f, /* SCB 0x0 */
-                .mode_pwmhi             = 0x03400000, /* SCB 0x0 */
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = board_au1200fb_panel_init,
-                .device_shutdown        = board_au1200fb_panel_shutdown,
-                1024, 1024,
-                768, 768,
-        },
-
-        [6] = { /* Toshiba 640x480 TFT */
-                .name = "Toshiba_640x480_TFT",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = LCD_SCREEN_SX_N(640) |
-                        LCD_SCREEN_SY_N(480),
-                .mode_horztiming        = LCD_HORZTIMING_HPW_N(96) |
-                        LCD_HORZTIMING_HND1_N(13) | LCD_HORZTIMING_HND2_N(51),
-                .mode_verttiming        = LCD_VERTTIMING_VPW_N(2) |
-                        LCD_VERTTIMING_VND1_N(11) | LCD_VERTTIMING_VND2_N(32),
-                .mode_clkcontrol        = 0x00000000, /* /4=24Mhz */
-                .mode_pwmdiv            = 0x8000063f,
-                .mode_pwmhi             = 0x03400000,
-                .mode_outmask   = 0x00fcfcfc,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = board_au1200fb_panel_init,
-                .device_shutdown        = board_au1200fb_panel_shutdown,
-                640, 480,
-                640, 480,
-        },
-
-        [7] = { /* Sharp 320x240 TFT */
-                .name = "Sharp_320x240_TFT",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 12500,
-                        .hfmax = 20000,
-                        .vfmin = 38,
-                        .vfmax = 81,
-                        .dclkmin = 4500000,
-                        .dclkmax = 6800000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = LCD_SCREEN_SX_N(320) |
-                        LCD_SCREEN_SY_N(240),
-                .mode_horztiming        = LCD_HORZTIMING_HPW_N(60) |
-                        LCD_HORZTIMING_HND1_N(13) | LCD_HORZTIMING_HND2_N(2),
-                .mode_verttiming        = LCD_VERTTIMING_VPW_N(2) |
-                        LCD_VERTTIMING_VND1_N(2) | LCD_VERTTIMING_VND2_N(5),
-                .mode_clkcontrol        = LCD_CLKCONTROL_PCD_N(7), /*16=6Mhz*/
-                .mode_pwmdiv            = 0x8000063f,
-                .mode_pwmhi             = 0x03400000,
-                .mode_outmask   = 0x00fcfcfc,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = board_au1200fb_panel_init,
-                .device_shutdown        = board_au1200fb_panel_shutdown,
-                320, 320,
-                240, 240,
-        },
-
-        [8] = { /* Toppoly TD070WGCB2 7" 856x480 TFT */
-                .name = "Toppoly_TD070WGCB2",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = LCD_SCREEN_SX_N(856) |
-                        LCD_SCREEN_SY_N(480),
-                .mode_horztiming        = LCD_HORZTIMING_HND2_N(43) |
-                        LCD_HORZTIMING_HND1_N(43) | LCD_HORZTIMING_HPW_N(114),
-                .mode_verttiming        = LCD_VERTTIMING_VND2_N(20) |
-                        LCD_VERTTIMING_VND1_N(21) | LCD_VERTTIMING_VPW_N(4),
-                .mode_clkcontrol        = 0x00020001, /* /4=24Mhz */
-                .mode_pwmdiv            = 0x8000063f,
-                .mode_pwmhi             = 0x03400000,
-                .mode_outmask   = 0x00fcfcfc,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = board_au1200fb_panel_init,
-                .device_shutdown        = board_au1200fb_panel_shutdown,
-                856, 856,
-                480, 480,
-        },
-};
-
-#define NUM_PANELS (ARRAY_SIZE(known_lcd_panels))
-
-/********************************************************************/
-
-#ifdef CONFIG_PM
-static int set_brightness(unsigned int brightness)
-{
-        unsigned int hi1, divider;
-
-        /* limit brightness pwm duty to >= 30/1600 */
-        if (brightness < 30) {
-                brightness = 30;
-        }
-        divider = (lcd->pwmdiv & 0x3FFFF) + 1;
-        hi1 = (lcd->pwmhi >> 16) + 1;
-        hi1 = (((brightness & 0xFF) + 1) * divider >> 8);
-        lcd->pwmhi &= 0xFFFF;
-        lcd->pwmhi |= (hi1 << 16);
-
-        return brightness;
-}
-#endif /* CONFIG_PM */
-
-static int winbpp (unsigned int winctrl1)
-{
-        int bits = 0;
-
-        /* how many bits are needed for each pixel format */
-        switch (winctrl1 & LCD_WINCTRL1_FRM) {
-        case LCD_WINCTRL1_FRM_1BPP:
-                bits = 1;
-                break;
-        case LCD_WINCTRL1_FRM_2BPP:
-                bits = 2;
-                break;
-        case LCD_WINCTRL1_FRM_4BPP:
-                bits = 4;
-                break;
-        case LCD_WINCTRL1_FRM_8BPP:
-                bits = 8;
-                break;
-        case LCD_WINCTRL1_FRM_12BPP:
-        case LCD_WINCTRL1_FRM_16BPP655:
-        case LCD_WINCTRL1_FRM_16BPP565:
-        case LCD_WINCTRL1_FRM_16BPP556:
-        case LCD_WINCTRL1_FRM_16BPPI1555:
-        case LCD_WINCTRL1_FRM_16BPPI5551:
-        case LCD_WINCTRL1_FRM_16BPPA1555:
-        case LCD_WINCTRL1_FRM_16BPPA5551:
-                bits = 16;
-                break;
-        case LCD_WINCTRL1_FRM_24BPP:
-        case LCD_WINCTRL1_FRM_32BPP:
-                bits = 32;
-                break;
-        }
-
-        return bits;
-}
-
-static int fbinfo2index (struct fb_info *fb_info)
-{
-        int i;
-
-        for (i = 0; i < CONFIG_FB_AU1200_DEVS; ++i) {
-                if (fb_info == (struct fb_info *)(&_au1200fb_devices[i].fb_info))
-                        return i;
-        }
-        printk("au1200fb: ERROR: fbinfo2index failed!\n");
-        return -1;
-}
-
-static int au1200_setlocation (struct au1200fb_device *fbdev, int plane,
-        int xpos, int ypos)
-{
-        uint32 winctrl0, winctrl1, winenable, fb_offset = 0;
-        int xsz, ysz;
-
-        /* FIX!!! NOT CHECKING FOR COMPLETE OFFSCREEN YET */
-
-        winctrl0 = lcd->window[plane].winctrl0;
-        winctrl1 = lcd->window[plane].winctrl1;
-        winctrl0 &= (LCD_WINCTRL0_A | LCD_WINCTRL0_AEN);
-        winctrl1 &= ~(LCD_WINCTRL1_SZX | LCD_WINCTRL1_SZY);
-
-        /* Check for off-screen adjustments */
-        xsz = win->w[plane].xres;
-        ysz = win->w[plane].yres;
-        if ((xpos + win->w[plane].xres) > panel->Xres) {
-                /* Off-screen to the right */
-                xsz = panel->Xres - xpos; /* off by 1 ??? */
-                /*printk("off screen right\n");*/
-        }
-
-        if ((ypos + win->w[plane].yres) > panel->Yres) {
-                /* Off-screen to the bottom */
-                ysz = panel->Yres - ypos; /* off by 1 ??? */
-                /*printk("off screen bottom\n");*/
-        }
-
-        if (xpos < 0) {
-                /* Off-screen to the left */
-                xsz = win->w[plane].xres + xpos;
-                fb_offset += (((0 - xpos) * winbpp(lcd->window[plane].winctrl1))/8);
-                xpos = 0;
-                /*printk("off screen left\n");*/
-        }
-
-        if (ypos < 0) {
-                /* Off-screen to the top */
-                ysz = win->w[plane].yres + ypos;
-                /* fixme: fb_offset += ((0-ypos)*fb_pars[plane].line_length); */
-                ypos = 0;
-                /*printk("off screen top\n");*/
-        }
-
-        /* record settings */
-        win->w[plane].xpos = xpos;
-        win->w[plane].ypos = ypos;
-
-        xsz -= 1;
-        ysz -= 1;
-        winctrl0 |= (xpos << 21);
-        winctrl0 |= (ypos << 10);
-        winctrl1 |= (xsz << 11);
-        winctrl1 |= (ysz << 0);
-
-        /* Disable the window while making changes, then restore WINEN */
-        winenable = lcd->winenable & (1 << plane);
-        au_sync();
-        lcd->winenable &= ~(1 << plane);
-        lcd->window[plane].winctrl0 = winctrl0;
-        lcd->window[plane].winctrl1 = winctrl1;
-        lcd->window[plane].winbuf0 =
-        lcd->window[plane].winbuf1 = fbdev->fb_phys;
-        lcd->window[plane].winbufctrl = 0; /* select winbuf0 */
-        lcd->winenable |= winenable;
-        au_sync();
-
-        return 0;
-}
-
-static void au1200_setpanel (struct panel_settings *newpanel)
-{
-        /*
-         * Perform global setup/init of LCD controller
-         */
-        uint32 winenable;
-
-        /* Make sure all windows disabled */
-        winenable = lcd->winenable;
-        lcd->winenable = 0;
-        au_sync();
-        /*
-         * Ensure everything is disabled before reconfiguring
-         */
-        if (lcd->screen & LCD_SCREEN_SEN) {
-                /* Wait for vertical sync period */
-                lcd->intstatus = LCD_INT_SS;
-                while ((lcd->intstatus & LCD_INT_SS) == 0) {
-                        au_sync();
-                }
-
-                lcd->screen &= ~LCD_SCREEN_SEN; /*disable the controller*/
-
-                do {
-                        lcd->intstatus = lcd->intstatus; /*clear interrupts*/
-                        au_sync();
-                /*wait for controller to shut down*/
-                } while ((lcd->intstatus & LCD_INT_SD) == 0);
-
-                /* Call shutdown of current panel (if up) */
-                /* this must occur last, because if an external clock is driving
-                    the controller, the clock cannot be turned off before first
-                        shutting down the controller.
-                 */
-                if (panel->device_shutdown != NULL)
-                        panel->device_shutdown();
-        }
-
-        /* Newpanel == NULL indicates a shutdown operation only */
-        if (newpanel == NULL)
-                return;
-
-        panel = newpanel;
-
-        printk("Panel(%s), %dx%d\n", panel->name, panel->Xres, panel->Yres);
-
-        /*
-         * Setup clocking if internal LCD clock source (assumes sys_auxpll valid)
-         */
-        if (!(panel->mode_clkcontrol & LCD_CLKCONTROL_EXT))
-        {
-                uint32 sys_clksrc;
-                au_writel(panel->mode_auxpll, SYS_AUXPLL);
-                sys_clksrc = au_readl(SYS_CLKSRC) & ~0x0000001f;
-                sys_clksrc |= panel->mode_toyclksrc;
-                au_writel(sys_clksrc, SYS_CLKSRC);
-        }
-
-        /*
-         * Configure panel timings
-         */
-        lcd->screen = panel->mode_screen;
-        lcd->horztiming = panel->mode_horztiming;
-        lcd->verttiming = panel->mode_verttiming;
-        lcd->clkcontrol = panel->mode_clkcontrol;
-        lcd->pwmdiv = panel->mode_pwmdiv;
-        lcd->pwmhi = panel->mode_pwmhi;
-        lcd->outmask = panel->mode_outmask;
-        lcd->fifoctrl = panel->mode_fifoctrl;
-        au_sync();
-
-        /* fixme: Check window settings to make sure still valid
-         * for new geometry */
-#if 0
-        au1200_setlocation(fbdev, 0, win->w[0].xpos, win->w[0].ypos);
-        au1200_setlocation(fbdev, 1, win->w[1].xpos, win->w[1].ypos);
-        au1200_setlocation(fbdev, 2, win->w[2].xpos, win->w[2].ypos);
-        au1200_setlocation(fbdev, 3, win->w[3].xpos, win->w[3].ypos);
-#endif
-        lcd->winenable = winenable;
-
-        /*
-         * Re-enable screen now that it is configured
-         */
-        lcd->screen |= LCD_SCREEN_SEN;
-        au_sync();
-
-        /* Call init of panel */
-        if (panel->device_init != NULL) panel->device_init();
-
-        /* FIX!!!! not appropriate on panel change!!! Global setup/init */
-        lcd->intenable = 0;
-        lcd->intstatus = ~0;
-        lcd->backcolor = win->mode_backcolor;
-
-        /* Setup Color Key - FIX!!! */
-        lcd->colorkey = win->mode_colorkey;
-        lcd->colorkeymsk = win->mode_colorkeymsk;
-
-        /* Setup HWCursor - FIX!!! Need to support this eventually */
-        lcd->hwc.cursorctrl = 0;
-        lcd->hwc.cursorpos = 0;
-        lcd->hwc.cursorcolor0 = 0;
-        lcd->hwc.cursorcolor1 = 0;
-        lcd->hwc.cursorcolor2 = 0;
-        lcd->hwc.cursorcolor3 = 0;
-
-
-#if 0
-#define D(X) printk("%25s: %08X\n", #X, X)
-        D(lcd->screen);
-        D(lcd->horztiming);
-        D(lcd->verttiming);
-        D(lcd->clkcontrol);
-        D(lcd->pwmdiv);
-        D(lcd->pwmhi);
-        D(lcd->outmask);
-        D(lcd->fifoctrl);
-        D(lcd->window[0].winctrl0);
-        D(lcd->window[0].winctrl1);
-        D(lcd->window[0].winctrl2);
-        D(lcd->window[0].winbuf0);
-        D(lcd->window[0].winbuf1);
-        D(lcd->window[0].winbufctrl);
-        D(lcd->window[1].winctrl0);
-        D(lcd->window[1].winctrl1);
-        D(lcd->window[1].winctrl2);
-        D(lcd->window[1].winbuf0);
-        D(lcd->window[1].winbuf1);
-        D(lcd->window[1].winbufctrl);
-        D(lcd->window[2].winctrl0);
-        D(lcd->window[2].winctrl1);
-        D(lcd->window[2].winctrl2);
-        D(lcd->window[2].winbuf0);
-        D(lcd->window[2].winbuf1);
-        D(lcd->window[2].winbufctrl);
-        D(lcd->window[3].winctrl0);
-        D(lcd->window[3].winctrl1);
-        D(lcd->window[3].winctrl2);
-        D(lcd->window[3].winbuf0);
-        D(lcd->window[3].winbuf1);
-        D(lcd->window[3].winbufctrl);
-        D(lcd->winenable);
-        D(lcd->intenable);
-        D(lcd->intstatus);
-        D(lcd->backcolor);
-        D(lcd->winenable);
-        D(lcd->colorkey);
-    D(lcd->colorkeymsk);
-        D(lcd->hwc.cursorctrl);
-        D(lcd->hwc.cursorpos);
-        D(lcd->hwc.cursorcolor0);
-        D(lcd->hwc.cursorcolor1);
-        D(lcd->hwc.cursorcolor2);
-        D(lcd->hwc.cursorcolor3);
-#endif
-}
-
-static void au1200_setmode(struct au1200fb_device *fbdev)
-{
-        int plane = fbdev->plane;
-        /* Window/plane setup */
-        lcd->window[plane].winctrl1 = ( 0
-                | LCD_WINCTRL1_PRI_N(plane)
-                | win->w[plane].mode_winctrl1 /* FRM,CCO,PO,PIPE */
-                ) ;
-
-        au1200_setlocation(fbdev, plane, win->w[plane].xpos, win->w[plane].ypos);
-
-        lcd->window[plane].winctrl2 = ( 0
-                | LCD_WINCTRL2_CKMODE_00
-                | LCD_WINCTRL2_DBM
-                | LCD_WINCTRL2_BX_N( fbdev->fb_info.fix.line_length)
-                | LCD_WINCTRL2_SCX_1
-                | LCD_WINCTRL2_SCY_1
-                ) ;
-        lcd->winenable |= win->w[plane].mode_winenable;
-        au_sync();
-}
-
-
-/* Inline helpers */
-
-/*#define panel_is_dual(panel)  ((panel->mode_screen & LCD_SCREEN_PT) == LCD_SCREEN_PT_010)*/
-/*#define panel_is_active(panel)((panel->mode_screen & LCD_SCREEN_PT) == LCD_SCREEN_PT_010)*/
-
-#define panel_is_color(panel) ((panel->mode_screen & LCD_SCREEN_PT) <= LCD_SCREEN_PT_CDSTN)
-
-/* Bitfields format supported by the controller. */
-static struct fb_bitfield rgb_bitfields[][4] = {
-        /*     Red,        Green,        Blue,       Transp   */
-        [LCD_WINCTRL1_FRM_16BPP655 >> 25] =
-                { { 10, 6, 0 }, { 5, 5, 0 }, { 0, 5, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPP565 >> 25] =
-                { { 11, 5, 0 }, { 5, 6, 0 }, { 0, 5, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPP556 >> 25] =
-                { { 11, 5, 0 }, { 6, 5, 0 }, { 0, 6, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPPI1555 >> 25] =
-                { { 10, 5, 0 }, { 5, 5, 0 }, { 0, 5, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPPI5551 >> 25] =
-                { { 11, 5, 0 }, { 6, 5, 0 }, { 1, 5, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPPA1555 >> 25] =
-                { { 10, 5, 0 }, { 5, 5, 0 }, { 0, 5, 0 }, { 15, 1, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPPA5551 >> 25] =
-                { { 11, 5, 0 }, { 6, 5, 0 }, { 1, 5, 0 }, { 0, 1, 0 } },
-
-        [LCD_WINCTRL1_FRM_24BPP >> 25] =
-                { { 16, 8, 0 }, { 8, 8, 0 }, { 0, 8, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_32BPP >> 25] =
-                { { 16, 8, 0 }, { 8, 8, 0 }, { 0, 8, 0 }, { 24, 0, 0 } },
-};
-
-/*-------------------------------------------------------------------------*/
-
-/* Helpers */
-
-static void au1200fb_update_fbinfo(struct fb_info *fbi)
-{
-        /* FIX!!!! This also needs to take the window pixel format into account!!! */
-
-        /* Update var-dependent FB info */
-        if (panel_is_color(panel)) {
-                if (fbi->var.bits_per_pixel <= 8) {
-                        /* palettized */
-                        fbi->fix.visual = FB_VISUAL_PSEUDOCOLOR;
-                        fbi->fix.line_length = fbi->var.xres_virtual /
-                                (8/fbi->var.bits_per_pixel);
-                } else {
-                        /* non-palettized */
-                        fbi->fix.visual = FB_VISUAL_TRUECOLOR;
-                        fbi->fix.line_length = fbi->var.xres_virtual * (fbi->var.bits_per_pixel / 8);
-                }
-        } else {
-                /* mono FIX!!! mono 8 and 4 bits */
-                fbi->fix.visual = FB_VISUAL_MONO10;
-                fbi->fix.line_length = fbi->var.xres_virtual / 8;
-        }
-
-        fbi->screen_size = fbi->fix.line_length * fbi->var.yres_virtual;
-        print_dbg("line length: %d\n", fbi->fix.line_length);
-        print_dbg("bits_per_pixel: %d\n", fbi->var.bits_per_pixel);
-}
-
-/*-------------------------------------------------------------------------*/
-
-/* AU1200 framebuffer driver */
-
-/* fb_check_var
- * Validate var settings with hardware restrictions and modify it if necessary
- */
-static int au1200fb_fb_check_var(struct fb_var_screeninfo *var,
-        struct fb_info *fbi)
-{
-        struct au1200fb_device *fbdev = (struct au1200fb_device *)fbi;
-        u32 pixclock;
-        int screen_size, plane;
-
-        plane = fbdev->plane;
-
-        /* Make sure that the mode respect all LCD controller and
-         * panel restrictions. */
-        var->xres = win->w[plane].xres;
-        var->yres = win->w[plane].yres;
-
-        /* No need for virtual resolution support */
-        var->xres_virtual = var->xres;
-        var->yres_virtual = var->yres;
-
-        var->bits_per_pixel = winbpp(win->w[plane].mode_winctrl1);
-
-        screen_size = var->xres_virtual * var->yres_virtual;
-        if (var->bits_per_pixel > 8) screen_size *= (var->bits_per_pixel / 8);
-        else screen_size /= (8/var->bits_per_pixel);
-
-        if (fbdev->fb_len < screen_size)
-                return -EINVAL; /* Virtual screen is to big, abort */
-
-        /* FIX!!!! what are the implicaitons of ignoring this for windows ??? */
-        /* The max LCD clock is fixed to 48MHz (value of AUX_CLK). The pixel
-         * clock can only be obtain by dividing this value by an even integer.
-         * Fallback to a slower pixel clock if necessary. */
-        pixclock = max((u32)(PICOS2KHZ(var->pixclock) * 1000), fbi->monspecs.dclkmin);
-        pixclock = min(pixclock, min(fbi->monspecs.dclkmax, (u32)AU1200_LCD_MAX_CLK/2));
-
-        if (AU1200_LCD_MAX_CLK % pixclock) {
-                int diff = AU1200_LCD_MAX_CLK % pixclock;
-                pixclock -= diff;
-        }
-
-        var->pixclock = KHZ2PICOS(pixclock/1000);
-#if 0
-        if (!panel_is_active(panel)) {
-                int pcd = AU1200_LCD_MAX_CLK / (pixclock * 2) - 1;
-
-                if (!panel_is_color(panel)
-                        && (panel->control_base & LCD_CONTROL_MPI) && (pcd < 3)) {
-                        /* STN 8bit mono panel support is up to 6MHz pixclock */
-                        var->pixclock = KHZ2PICOS(6000);
-                } else if (!pcd) {
-                        /* Other STN panel support is up to 12MHz  */
-                        var->pixclock = KHZ2PICOS(12000);
-                }
-        }
-#endif
-        /* Set bitfield accordingly */
-        switch (var->bits_per_pixel) {
-                case 16:
-                {
-                        /* 16bpp True color.
-                         * These must be set to MATCH WINCTRL[FORM] */
-                        int idx;
-                        idx = (win->w[0].mode_winctrl1 & LCD_WINCTRL1_FRM) >> 25;
-                        var->red    = rgb_bitfields[idx][0];
-                        var->green  = rgb_bitfields[idx][1];
-                        var->blue   = rgb_bitfields[idx][2];
-                        var->transp = rgb_bitfields[idx][3];
-                        break;
-                }
-
-                case 32:
-                {
-                        /* 32bpp True color.
-                         * These must be set to MATCH WINCTRL[FORM] */
-                        int idx;
-                        idx = (win->w[0].mode_winctrl1 & LCD_WINCTRL1_FRM) >> 25;
-                        var->red    = rgb_bitfields[idx][0];
-                        var->green  = rgb_bitfields[idx][1];
-                        var->blue   = rgb_bitfields[idx][2];
-                        var->transp = rgb_bitfields[idx][3];
-                        break;
-                }
-                default:
-                        print_dbg("Unsupported depth %dbpp", var->bits_per_pixel);
-                        return -EINVAL;
-        }
-
-        return 0;
-}
-
-/* fb_set_par
- * Set hardware with var settings. This will enable the controller with a
- * specific mode, normally validated with the fb_check_var method
- */
-static int au1200fb_fb_set_par(struct fb_info *fbi)
-{
-        struct au1200fb_device *fbdev = (struct au1200fb_device *)fbi;
-
-        au1200fb_update_fbinfo(fbi);
-        au1200_setmode(fbdev);
-
-        return 0;
-}
-
-/* fb_setcolreg
- * Set color in LCD palette.
- */
-static int au1200fb_fb_setcolreg(unsigned regno, unsigned red, unsigned green,
-        unsigned blue, unsigned transp, struct fb_info *fbi)
-{
-        volatile u32 *palette = lcd->palette;
-        u32 value;
-
-        if (regno > (AU1200_LCD_NBR_PALETTE_ENTRIES - 1))
-                return -EINVAL;
-
-        if (fbi->var.grayscale) {
-                /* Convert color to grayscale */
-                red = green = blue =
-                        (19595 * red + 38470 * green + 7471 * blue) >> 16;
-        }
-
-        if (fbi->fix.visual == FB_VISUAL_TRUECOLOR) {
-                /* Place color in the pseudopalette */
-                if (regno > 16)
-                        return -EINVAL;
-
-                palette = (u32*) fbi->pseudo_palette;
-
-                red   >>= (16 - fbi->var.red.length);
-                green >>= (16 - fbi->var.green.length);
-                blue  >>= (16 - fbi->var.blue.length);
-
-                value = (red   << fbi->var.red.offset)  |
-                        (green << fbi->var.green.offset)|
-                        (blue  << fbi->var.blue.offset);
-                value &= 0xFFFF;
-
-        } else if (1 /*FIX!!! panel_is_active(fbdev->panel)*/) {
-                /* COLOR TFT PALLETTIZED (use RGB 565) */
-                value = (red & 0xF800)|((green >> 5) &
-                                0x07E0)|((blue >> 11) & 0x001F);
-                value &= 0xFFFF;
-
-        } else if (0 /*panel_is_color(fbdev->panel)*/) {
-                /* COLOR STN MODE */
-                value = 0x1234;
-                value &= 0xFFF;
-        } else {
-                /* MONOCHROME MODE */
-                value = (green >> 12) & 0x000F;
-                value &= 0xF;
-        }
-
-        palette[regno] = value;
-
-        return 0;
-}
-
-/* fb_blank
- * Blank the screen. Depending on the mode, the screen will be
- * activated with the backlight color, or desactivated
- */
-static int au1200fb_fb_blank(int blank_mode, struct fb_info *fbi)
-{
-        /* Short-circuit screen blanking */
-        if (noblanking)
-                return 0;
-
-        switch (blank_mode) {
-
-        case FB_BLANK_UNBLANK:
-        case FB_BLANK_NORMAL:
-                /* printk("turn on panel\n"); */
-                au1200_setpanel(panel);
-                break;
-        case FB_BLANK_VSYNC_SUSPEND:
-        case FB_BLANK_HSYNC_SUSPEND:
-        case FB_BLANK_POWERDOWN:
-                /* printk("turn off panel\n"); */
-                au1200_setpanel(NULL);
-                break;
-        default:
-                break;
-
-        }
-
-        /* FB_BLANK_NORMAL is a soft blank */
-        return (blank_mode == FB_BLANK_NORMAL) ? -EINVAL : 0;
-}
-
-/* fb_mmap
- * Map video memory in user space. We don't use the generic fb_mmap
- * method mainly to allow the use of the TLB streaming flag (CCA=6)
- */
-static int au1200fb_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
-
-{
-        unsigned int len;
-        unsigned long start=0, off;
-        struct au1200fb_device *fbdev = (struct au1200fb_device *) info;
-
-#ifdef CONFIG_PM
-        au1xxx_pm_access(LCD_pm_dev);
-#endif
-
-        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
-                return -EINVAL;
-        }
-
-        start = fbdev->fb_phys & PAGE_MASK;
-        len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
-
-        off = vma->vm_pgoff << PAGE_SHIFT;
-
-        if ((vma->vm_end - vma->vm_start + off) > len) {
-                return -EINVAL;
-        }
-
-        off += start;
-        vma->vm_pgoff = off >> PAGE_SHIFT;
-
-        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-        pgprot_val(vma->vm_page_prot) |= _CACHE_MASK; /* CCA=7 */
-
-        vma->vm_flags |= VM_IO;
-
-        return io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
-                                  vma->vm_end - vma->vm_start,
-                                  vma->vm_page_prot);
-
-        return 0;
-}
-
-static void set_global(u_int cmd, struct au1200_lcd_global_regs_t *pdata)
-{
-
-        unsigned int hi1, divider;
-
-        /* SCREEN_SIZE: user cannot reset size, must switch panel choice */
-
-        if (pdata->flags & SCREEN_BACKCOLOR)
-                lcd->backcolor = pdata->backcolor;
-
-        if (pdata->flags & SCREEN_BRIGHTNESS) {
-
-                // limit brightness pwm duty to >= 30/1600
-                if (pdata->brightness < 30) {
-                        pdata->brightness = 30;
-                }
-                divider = (lcd->pwmdiv & 0x3FFFF) + 1;
-                hi1 = (lcd->pwmhi >> 16) + 1;
-                hi1 = (((pdata->brightness & 0xFF)+1) * divider >> 8);
-                lcd->pwmhi &= 0xFFFF;
-                lcd->pwmhi |= (hi1 << 16);
-        }
-
-        if (pdata->flags & SCREEN_COLORKEY)
-                lcd->colorkey = pdata->colorkey;
-
-        if (pdata->flags & SCREEN_MASK)
-                lcd->colorkeymsk = pdata->mask;
-        au_sync();
-}
-
-static void get_global(u_int cmd, struct au1200_lcd_global_regs_t *pdata)
-{
-        unsigned int hi1, divider;
-
-        pdata->xsize = ((lcd->screen & LCD_SCREEN_SX) >> 19) + 1;
-        pdata->ysize = ((lcd->screen & LCD_SCREEN_SY) >> 8) + 1;
-
-        pdata->backcolor = lcd->backcolor;
-        pdata->colorkey = lcd->colorkey;
-        pdata->mask = lcd->colorkeymsk;
-
-        // brightness
-        hi1 = (lcd->pwmhi >> 16) + 1;
-        divider = (lcd->pwmdiv & 0x3FFFF) + 1;
-        pdata->brightness = ((hi1 << 8) / divider) - 1;
-        au_sync();
-}
-
-static void set_window(unsigned int plane,
-        struct au1200_lcd_window_regs_t *pdata)
-{
-        unsigned int val, bpp;
-
-        /* Window control register 0 */
-        if (pdata->flags & WIN_POSITION) {
-                val = lcd->window[plane].winctrl0 & ~(LCD_WINCTRL0_OX |
-                                LCD_WINCTRL0_OY);
-                val |= ((pdata->xpos << 21) & LCD_WINCTRL0_OX);
-                val |= ((pdata->ypos << 10) & LCD_WINCTRL0_OY);
-                lcd->window[plane].winctrl0 = val;
-        }
-        if (pdata->flags & WIN_ALPHA_COLOR) {
-                val = lcd->window[plane].winctrl0 & ~(LCD_WINCTRL0_A);
-                val |= ((pdata->alpha_color << 2) & LCD_WINCTRL0_A);
-                lcd->window[plane].winctrl0 = val;
-        }
-        if (pdata->flags & WIN_ALPHA_MODE) {
-                val = lcd->window[plane].winctrl0 & ~(LCD_WINCTRL0_AEN);
-                val |= ((pdata->alpha_mode << 1) & LCD_WINCTRL0_AEN);
-                lcd->window[plane].winctrl0 = val;
-        }
-
-        /* Window control register 1 */
-        if (pdata->flags & WIN_PRIORITY) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_PRI);
-                val |= ((pdata->priority << 30) & LCD_WINCTRL1_PRI);
-                lcd->window[plane].winctrl1 = val;
-        }
-        if (pdata->flags & WIN_CHANNEL) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_PIPE);
-                val |= ((pdata->channel << 29) & LCD_WINCTRL1_PIPE);
-                lcd->window[plane].winctrl1 = val;
-        }
-        if (pdata->flags & WIN_BUFFER_FORMAT) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_FRM);
-                val |= ((pdata->buffer_format << 25) & LCD_WINCTRL1_FRM);
-                lcd->window[plane].winctrl1 = val;
-        }
-        if (pdata->flags & WIN_COLOR_ORDER) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_CCO);
-                val |= ((pdata->color_order << 24) & LCD_WINCTRL1_CCO);
-                lcd->window[plane].winctrl1 = val;
-        }
-        if (pdata->flags & WIN_PIXEL_ORDER) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_PO);
-                val |= ((pdata->pixel_order << 22) & LCD_WINCTRL1_PO);
-                lcd->window[plane].winctrl1 = val;
-        }
-        if (pdata->flags & WIN_SIZE) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_SZX |
-                                LCD_WINCTRL1_SZY);
-                val |= (((pdata->xsize << 11) - 1) & LCD_WINCTRL1_SZX);
-                val |= (((pdata->ysize) - 1) & LCD_WINCTRL1_SZY);
-                lcd->window[plane].winctrl1 = val;
-                /* program buffer line width */
-                bpp = winbpp(val) / 8;
-                val = lcd->window[plane].winctrl2 & ~(LCD_WINCTRL2_BX);
-                val |= (((pdata->xsize * bpp) << 8) & LCD_WINCTRL2_BX);
-                lcd->window[plane].winctrl2 = val;
-        }
-
-        /* Window control register 2 */
-        if (pdata->flags & WIN_COLORKEY_MODE) {
-                val = lcd->window[plane].winctrl2 & ~(LCD_WINCTRL2_CKMODE);
-                val |= ((pdata->colorkey_mode << 24) & LCD_WINCTRL2_CKMODE);
-                lcd->window[plane].winctrl2 = val;
-        }
-        if (pdata->flags & WIN_DOUBLE_BUFFER_MODE) {
-                val = lcd->window[plane].winctrl2 & ~(LCD_WINCTRL2_DBM);
-                val |= ((pdata->double_buffer_mode << 23) & LCD_WINCTRL2_DBM);
-                lcd->window[plane].winctrl2 = val;
-        }
-        if (pdata->flags & WIN_RAM_ARRAY_MODE) {
-                val = lcd->window[plane].winctrl2 & ~(LCD_WINCTRL2_RAM);
-                val |= ((pdata->ram_array_mode << 21) & LCD_WINCTRL2_RAM);
-                lcd->window[plane].winctrl2 = val;
-        }
-
-        /* Buffer line width programmed with WIN_SIZE */
-
-        if (pdata->flags & WIN_BUFFER_SCALE) {
-                val = lcd->window[plane].winctrl2 & ~(LCD_WINCTRL2_SCX |
-                                LCD_WINCTRL2_SCY);
-                val |= ((pdata->xsize << 11) & LCD_WINCTRL2_SCX);
-                val |= ((pdata->ysize) & LCD_WINCTRL2_SCY);
-                lcd->window[plane].winctrl2 = val;
-        }
-
-        if (pdata->flags & WIN_ENABLE) {
-                val = lcd->winenable;
-                val &= ~(1<<plane);
-                val |= (pdata->enable & 1) << plane;
-                lcd->winenable = val;
-        }
-        au_sync();
-}
-
-static void get_window(unsigned int plane,
-        struct au1200_lcd_window_regs_t *pdata)
-{
-        /* Window control register 0 */
-        pdata->xpos = (lcd->window[plane].winctrl0 & LCD_WINCTRL0_OX) >> 21;
-        pdata->ypos = (lcd->window[plane].winctrl0 & LCD_WINCTRL0_OY) >> 10;
-        pdata->alpha_color = (lcd->window[plane].winctrl0 & LCD_WINCTRL0_A) >> 2;
-        pdata->alpha_mode = (lcd->window[plane].winctrl0 & LCD_WINCTRL0_AEN) >> 1;
-
-        /* Window control register 1 */
-        pdata->priority = (lcd->window[plane].winctrl1& LCD_WINCTRL1_PRI) >> 30;
-        pdata->channel = (lcd->window[plane].winctrl1 & LCD_WINCTRL1_PIPE) >> 29;
-        pdata->buffer_format = (lcd->window[plane].winctrl1 & LCD_WINCTRL1_FRM) >> 25;
-        pdata->color_order = (lcd->window[plane].winctrl1 & LCD_WINCTRL1_CCO) >> 24;
-        pdata->pixel_order = (lcd->window[plane].winctrl1 & LCD_WINCTRL1_PO) >> 22;
-        pdata->xsize = ((lcd->window[plane].winctrl1 & LCD_WINCTRL1_SZX) >> 11) + 1;
-        pdata->ysize = (lcd->window[plane].winctrl1 & LCD_WINCTRL1_SZY) + 1;
-
-        /* Window control register 2 */
-        pdata->colorkey_mode = (lcd->window[plane].winctrl2 & LCD_WINCTRL2_CKMODE) >> 24;
-        pdata->double_buffer_mode = (lcd->window[plane].winctrl2 & LCD_WINCTRL2_DBM) >> 23;
-        pdata->ram_array_mode = (lcd->window[plane].winctrl2 & LCD_WINCTRL2_RAM) >> 21;
-
-        pdata->enable = (lcd->winenable >> plane) & 1;
-        au_sync();
-}
-
-static int au1200fb_ioctl(struct fb_info *info, unsigned int cmd,
-                          unsigned long arg)
-{
-        int plane;
-        int val;
-
-#ifdef CONFIG_PM
-        au1xxx_pm_access(LCD_pm_dev);
-#endif
-
-        plane = fbinfo2index(info);
-        print_dbg("au1200fb: ioctl %d on plane %d\n", cmd, plane);
-
-        if (cmd == AU1200_LCD_FB_IOCTL) {
-                struct au1200_lcd_iodata_t iodata;
-
-                if (copy_from_user(&iodata, (void __user *) arg, sizeof(iodata)))
-                        return -EFAULT;
-
-                print_dbg("FB IOCTL called\n");
-
-                switch (iodata.subcmd) {
-                case AU1200_LCD_SET_SCREEN:
-                        print_dbg("AU1200_LCD_SET_SCREEN\n");
-                        set_global(cmd, &iodata.global);
-                        break;
-
-                case AU1200_LCD_GET_SCREEN:
-                        print_dbg("AU1200_LCD_GET_SCREEN\n");
-                        get_global(cmd, &iodata.global);
-                        break;
-
-                case AU1200_LCD_SET_WINDOW:
-                        print_dbg("AU1200_LCD_SET_WINDOW\n");
-                        set_window(plane, &iodata.window);
-                        break;
-
-                case AU1200_LCD_GET_WINDOW:
-                        print_dbg("AU1200_LCD_GET_WINDOW\n");
-                        get_window(plane, &iodata.window);
-                        break;
-
-                case AU1200_LCD_SET_PANEL:
-                        print_dbg("AU1200_LCD_SET_PANEL\n");
-                        if ((iodata.global.panel_choice >= 0) &&
-                                        (iodata.global.panel_choice <
-                                         NUM_PANELS))
-                        {
-                                struct panel_settings *newpanel;
-                                panel_index = iodata.global.panel_choice;
-                                newpanel = &known_lcd_panels[panel_index];
-                                au1200_setpanel(newpanel);
-                        }
-                        break;
-
-                case AU1200_LCD_GET_PANEL:
-                        print_dbg("AU1200_LCD_GET_PANEL\n");
-                        iodata.global.panel_choice = panel_index;
-                        break;
-
-                default:
-                        return -EINVAL;
-                }
-
-                val = copy_to_user((void __user *) arg, &iodata, sizeof(iodata));
-                if (val) {
-                        print_dbg("error: could not copy %d bytes\n", val);
-                        return -EFAULT;
-                }
-        }
-
-        return 0;
-}
-
-
-static struct fb_ops au1200fb_fb_ops = {
-        .owner          = THIS_MODULE,
-        .fb_check_var   = au1200fb_fb_check_var,
-        .fb_set_par     = au1200fb_fb_set_par,
-        .fb_setcolreg   = au1200fb_fb_setcolreg,
-        .fb_blank       = au1200fb_fb_blank,
-        .fb_fillrect    = cfb_fillrect,
-        .fb_copyarea    = cfb_copyarea,
-        .fb_imageblit   = cfb_imageblit,
-        .fb_sync        = NULL,
-        .fb_ioctl       = au1200fb_ioctl,
-        .fb_mmap        = au1200fb_fb_mmap,
-};
-
-/*-------------------------------------------------------------------------*/
-
-static irqreturn_t au1200fb_handle_irq(int irq, void* dev_id, struct pt_regs *regs)
-{
-        /* Nothing to do for now, just clear any pending interrupt */
-        lcd->intstatus = lcd->intstatus;
-        au_sync();
-
-        return IRQ_HANDLED;
-}
-
-/*-------------------------------------------------------------------------*/
-
-/* AU1200 LCD device probe helpers */
-
-static int au1200fb_init_fbinfo(struct au1200fb_device *fbdev)
-{
-        struct fb_info *fbi = &fbdev->fb_info;
-        int bpp;
-
-        memset(fbi, 0, sizeof(struct fb_info));
-        fbi->fbops = &au1200fb_fb_ops;
-
-        bpp = winbpp(win->w[fbdev->plane].mode_winctrl1);
-
-        /* Copy monitor specs from panel data */
-        /* fixme: we're setting up LCD controller windows, so these dont give a
-        damn as to what the monitor specs are (the panel itself does, but that
-        isnt done here...so maybe need a generic catchall monitor setting??? */
-        memcpy(&fbi->monspecs, &panel->monspecs, sizeof(struct fb_monspecs));
-
-        /* We first try the user mode passed in argument. If that failed,
-         * or if no one has been specified, we default to the first mode of the
-         * panel list. Note that after this call, var data will be set */
-        if (!fb_find_mode(&fbi->var,
-                          fbi,
-                          NULL, /* drv_info.opt_mode, */
-                          fbi->monspecs.modedb,
-                          fbi->monspecs.modedb_len,
-                          fbi->monspecs.modedb,
-                          bpp)) {
-
-                print_err("Cannot find valid mode for panel %s", panel->name);
-                return -EFAULT;
-        }
-
-        fbi->pseudo_palette = kmalloc(sizeof(u32) * 16, GFP_KERNEL);
-        if (!fbi->pseudo_palette) {
-                return -ENOMEM;
-        }
-        memset(fbi->pseudo_palette, 0, sizeof(u32) * 16);
-
-        if (fb_alloc_cmap(&fbi->cmap, AU1200_LCD_NBR_PALETTE_ENTRIES, 0) < 0) {
-                print_err("Fail to allocate colormap (%d entries)",
-                           AU1200_LCD_NBR_PALETTE_ENTRIES);
-                kfree(fbi->pseudo_palette);
-                return -EFAULT;
-        }
-
-        strncpy(fbi->fix.id, "AU1200", sizeof(fbi->fix.id));
-        fbi->fix.smem_start = fbdev->fb_phys;
-        fbi->fix.smem_len = fbdev->fb_len;
-        fbi->fix.type = FB_TYPE_PACKED_PIXELS;
-        fbi->fix.xpanstep = 0;
-        fbi->fix.ypanstep = 0;
-        fbi->fix.mmio_start = 0;
-        fbi->fix.mmio_len = 0;
-        fbi->fix.accel = FB_ACCEL_NONE;
-
-        fbi->screen_base = (char __iomem *) fbdev->fb_mem;
-
-        au1200fb_update_fbinfo(fbi);
-
-        return 0;
-}
-
-/*-------------------------------------------------------------------------*/
-
-/* AU1200 LCD controller device driver */
-
-static int au1200fb_drv_probe(struct device *dev)
-{
-        struct au1200fb_device *fbdev;
-        unsigned long page;
-        int bpp, plane, ret;
-
-        if (!dev)
-                return -EINVAL;
-
-        for (plane = 0; plane < CONFIG_FB_AU1200_DEVS; ++plane) {
-                bpp = winbpp(win->w[plane].mode_winctrl1);
-                if (win->w[plane].xres == 0)
-                        win->w[plane].xres = panel->Xres;
-                if (win->w[plane].yres == 0)
-                        win->w[plane].yres = panel->Yres;
-
-                fbdev = &_au1200fb_devices[plane];
-                memset(fbdev, 0, sizeof(struct au1200fb_device));
-                fbdev->plane = plane;
-
-                /* Allocate the framebuffer to the maximum screen size */
-                fbdev->fb_len = (win->w[plane].xres * win->w[plane].yres * bpp) / 8;
-
-                fbdev->fb_mem = dma_alloc_noncoherent(dev,
-                                PAGE_ALIGN(fbdev->fb_len),
-                                &fbdev->fb_phys, GFP_KERNEL);
-                if (!fbdev->fb_mem) {
-                        print_err("fail to allocate frambuffer (size: %dK))",
-                                  fbdev->fb_len / 1024);
-                        return -ENOMEM;
-                }
-
-                /*
-                 * Set page reserved so that mmap will work. This is necessary
-                 * since we'll be remapping normal memory.
-                 */
-                for (page = (unsigned long)fbdev->fb_phys;
-                     page < PAGE_ALIGN((unsigned long)fbdev->fb_phys +
-                             fbdev->fb_len);
-                     page += PAGE_SIZE) {
-                        SetPageReserved(pfn_to_page(page >> PAGE_SHIFT)); /* LCD DMA is NOT coherent on Au1200 */
-                }
-                print_dbg("Framebuffer memory map at %p", fbdev->fb_mem);
-                print_dbg("phys=0x%08x, size=%dK", fbdev->fb_phys, fbdev->fb_len / 1024);
-
-                /* Init FB data */
-                if ((ret = au1200fb_init_fbinfo(fbdev)) < 0)
-                        goto failed;
-
-                /* Register new framebuffer */
-                if ((ret = register_framebuffer(&fbdev->fb_info)) < 0) {
-                        print_err("cannot register new framebuffer");
-                        goto failed;
-                }
-
-                au1200fb_fb_set_par(&fbdev->fb_info);
-
-#if !defined(CONFIG_FRAMEBUFFER_CONSOLE) && defined(CONFIG_LOGO)
-                if (plane == 0)
-                        if (fb_prepare_logo(&fbdev->fb_info, FB_ROTATE_UR)) {
-                                /* Start display and show logo on boot */
-                                fb_set_cmap(&fbdev->fb_info.cmap,
-                                                &fbdev->fb_info);
-
-                                fb_show_logo(&fbdev->fb_info, FB_ROTATE_UR);
-                        }
-#endif
-        }
-
-        /* Now hook interrupt too */
-        if ((ret = request_irq(AU1200_LCD_INT, au1200fb_handle_irq,
-                          SA_INTERRUPT | SA_SHIRQ, "lcd", (void *)dev)) < 0) {
-                print_err("fail to request interrupt line %d (err: %d)",
-                          AU1200_LCD_INT, ret);
-                goto failed;
-        }
-
-        return 0;
-
-failed:
-        /* NOTE: This only does the current plane/window that failed; others are still active */
-        if (fbdev->fb_mem)
-                dma_free_noncoherent(dev, PAGE_ALIGN(fbdev->fb_len),
-                                fbdev->fb_mem, fbdev->fb_phys);
-        if (fbdev->fb_info.cmap.len != 0)
-                fb_dealloc_cmap(&fbdev->fb_info.cmap);
-        if (fbdev->fb_info.pseudo_palette)
-                kfree(fbdev->fb_info.pseudo_palette);
-        if (plane == 0)
-                free_irq(AU1200_LCD_INT, (void*)dev);
-        return ret;
-}
-
-static int au1200fb_drv_remove(struct device *dev)
-{
-        struct au1200fb_device *fbdev;
-        int plane;
-
-        if (!dev)
-                return -ENODEV;
-
-        /* Turn off the panel */
-        au1200_setpanel(NULL);
-
-        for (plane = 0; plane < CONFIG_FB_AU1200_DEVS; ++plane)
-        {
-                fbdev = &_au1200fb_devices[plane];
-
-                /* Clean up all probe data */
-                unregister_framebuffer(&fbdev->fb_info);
-                if (fbdev->fb_mem)
-                        dma_free_noncoherent(dev, PAGE_ALIGN(fbdev->fb_len),
-                                        fbdev->fb_mem, fbdev->fb_phys);
-                if (fbdev->fb_info.cmap.len != 0)
-                        fb_dealloc_cmap(&fbdev->fb_info.cmap);
-                if (fbdev->fb_info.pseudo_palette)
-                        kfree(fbdev->fb_info.pseudo_palette);
-        }
-
-        free_irq(AU1200_LCD_INT, (void *)dev);
-
-        return 0;
-}
-
-#ifdef CONFIG_PM
-static int au1200fb_drv_suspend(struct device *dev, u32 state, u32 level)
-{
-        /* TODO */
-        return 0;
-}
-
-static int au1200fb_drv_resume(struct device *dev, u32 level)
-{
-        /* TODO */
-        return 0;
-}
-#endif /* CONFIG_PM */
-
-static struct device_driver au1200fb_driver = {
-        .name           = "au1200-lcd",
-        .bus            = &platform_bus_type,
-        .probe          = au1200fb_drv_probe,
-        .remove         = au1200fb_drv_remove,
-#ifdef CONFIG_PM
-        .suspend        = au1200fb_drv_suspend,
-        .resume         = au1200fb_drv_resume,
-#endif
-};
-
-/*-------------------------------------------------------------------------*/
-
-/* Kernel driver */
-
-static void au1200fb_setup(void)
-{
-        char* options = NULL;
-        char* this_opt;
-        int num_panels = ARRAY_SIZE(known_lcd_panels);
-        int panel_idx = -1;
-
-        fb_get_options(DRIVER_NAME, &options);
-
-        if (options) {
-                while ((this_opt = strsep(&options,",")) != NULL) {
-                        /* Panel option - can be panel name,
-                         * "bs" for board-switch, or number/index */
-                        if (!strncmp(this_opt, "panel:", 6)) {
-                                int i;
-                                long int li;
-                                char *endptr;
-                                this_opt += 6;
-                                /* First check for index, which allows
-                                 * to short circuit this mess */
-                                li = simple_strtol(this_opt, &endptr, 0);
-                                if (*endptr == '\0') {
-                                        panel_idx = (int)li;
-                                }
-                                else if (strcmp(this_opt, "bs") == 0) {
-                                        extern int board_au1200fb_panel(void);
-                                        panel_idx = board_au1200fb_panel();
-                                }
-
-                                else
-                                for (i = 0; i < num_panels; i++) {
-                                        if (!strcmp(this_opt, known_lcd_panels[i].name)) {
-                                                panel_idx = i;
-                                                break;
-                                        }
-                                }
-
-                                if ((panel_idx < 0) || (panel_idx >= num_panels)) {
-                                                print_warn("Panel %s not supported!", this_opt);
-                                }
-                                else
-                                        panel_index = panel_idx;
-                        }
-
-                        else if (strncmp(this_opt, "nohwcursor", 10) == 0) {
-                                nohwcursor = 1;
-                        }
-
-                        /* Unsupported option */
-                        else {
-                                print_warn("Unsupported option \"%s\"", this_opt);
-                        }
-                }
-        }
-}
-
-#ifdef CONFIG_PM
-static int au1200fb_pm_callback(au1xxx_power_dev_t *dev,
-                au1xxx_request_t request, void *data) {
-        int retval = -1;
-        unsigned int d = 0;
-        unsigned int brightness = 0;
-
-        if (request == AU1XXX_PM_SLEEP) {
-                board_au1200fb_panel_shutdown();
-        }
-        else if (request == AU1XXX_PM_WAKEUP) {
-                if(dev->prev_state == SLEEP_STATE)
-                {
-                        int plane;
-                        au1200_setpanel(panel);
-                        for (plane = 0; plane < CONFIG_FB_AU1200_DEVS; ++plane)         {
-                                struct au1200fb_device *fbdev;
-                                fbdev = &_au1200fb_devices[plane];
-                                au1200fb_fb_set_par(&fbdev->fb_info);
-                        }
-                }
-
-                d = *((unsigned int*)data);
-                if(d <=10) brightness = 26;
-                else if(d<=20) brightness = 51;
-                else if(d<=30) brightness = 77;
-                else if(d<=40) brightness = 102;
-                else if(d<=50) brightness = 128;
-                else if(d<=60) brightness = 153;
-                else if(d<=70) brightness = 179;
-                else if(d<=80) brightness = 204;
-                else if(d<=90) brightness = 230;
-                else brightness = 255;
-                set_brightness(brightness);
-        } else if (request == AU1XXX_PM_GETSTATUS) {
-                return dev->cur_state;
-        } else if (request == AU1XXX_PM_ACCESS) {
-                if (dev->cur_state != SLEEP_STATE)
-                        return retval;
-                else {
-                        au1200_setpanel(panel);
-                }
-        } else if (request == AU1XXX_PM_IDLE) {
-        } else if (request == AU1XXX_PM_CLEANUP) {
-        }
-
-        return retval;
-}
-#endif
-
-static int __init au1200fb_init(void)
-{
-        print_info("" DRIVER_DESC "");
-
-        /* Setup driver with options */
-        au1200fb_setup();
-
-        /* Point to the panel selected */
-        panel = &known_lcd_panels[panel_index];
-        win = &windows[window_index];
-
-        printk(DRIVER_NAME ": Panel %d %s\n", panel_index, panel->name);
-        printk(DRIVER_NAME ": Win %d %s\n", window_index, win->name);
-
-        /* Kickstart the panel, the framebuffers/windows come soon enough */
-        au1200_setpanel(panel);
-
-        #ifdef CONFIG_PM
-        LCD_pm_dev = new_au1xxx_power_device("LCD", &au1200fb_pm_callback, NULL);
-        if ( LCD_pm_dev == NULL)
-                printk(KERN_INFO "Unable to create a power management device entry for the au1200fb.\n");
-        else
-                printk(KERN_INFO "Power management device entry for the au1200fb loaded.\n");
-        #endif
-
-        return driver_register(&au1200fb_driver);
-}
-
-static void __exit au1200fb_cleanup(void)
-{
-        driver_unregister(&au1200fb_driver);
-}
-
-module_init(au1200fb_init);
-module_exit(au1200fb_cleanup);
-
-MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_LICENSE("GPL");
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 8d8eadb64853..372aa1776827 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -674,13 +674,19 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
                 total_size = info->fix.smem_len;
 
         if (p > total_size)
-                return 0;
+                return -EFBIG;
 
-        if (count >= total_size)
+        if (count > total_size) {
+                err = -EFBIG;
                 count = total_size;
+        }
+
+        if (count + p > total_size) {
+                if (!err)
+                        err = -ENOSPC;
 
-        if (count + p > total_size)
                 count = total_size - p;
+        }
 
         buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count,
                          GFP_KERNEL);
@@ -722,7 +728,7 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 
         kfree(buffer);
 
-        return (err) ? err : cnt;
+        return (cnt) ? cnt : err;
 }
 
 #ifdef CONFIG_KMOD
diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbsysfs.c
index b72b05250a9d..34e07399756b 100644
--- a/drivers/video/fbsysfs.c
+++ b/drivers/video/fbsysfs.c
@@ -305,94 +305,6 @@ static ssize_t show_stride(struct class_device *class_device, char *buf)
         return snprintf(buf, PAGE_SIZE, "%d\n", fb_info->fix.line_length);
 }
 
-/* Format for cmap is "%02x%c%4x%4x%4x\n" */
-/* %02x entry %c transp %4x red %4x blue %4x green \n */
-/* 256 rows at 16 chars equals 4096, the normal page size */
-/* the code will automatically adjust for different page sizes */
-static ssize_t store_cmap(struct class_device *class_device, const char *buf,
-                          size_t count)
-{
-        struct fb_info *fb_info = class_get_devdata(class_device);
-        int rc, i, start, length, transp = 0;
-
-        if ((count > PAGE_SIZE) || ((count % 16) != 0))
-                return -EINVAL;
-
-        if (!fb_info->fbops->fb_setcolreg && !fb_info->fbops->fb_setcmap)
-                return -EINVAL;
-
-        sscanf(buf, "%02x", &start);
-        length = count / 16;
-
-        for (i = 0; i < length; i++)
-                if (buf[i * 16 + 2] != ' ')
-                        transp = 1;
-
-        /* If we can batch, do it */
-        if (fb_info->fbops->fb_setcmap && length > 1) {
-                struct fb_cmap umap;
-
-                memset(&umap, 0, sizeof(umap));
-                if ((rc = fb_alloc_cmap(&umap, length, transp)))
-                        return rc;
-
-                umap.start = start;
-                for (i = 0; i < length; i++) {
-                        sscanf(&buf[i * 16 +  3], "%4hx", &umap.red[i]);
-                        sscanf(&buf[i * 16 +  7], "%4hx", &umap.blue[i]);
-                        sscanf(&buf[i * 16 + 11], "%4hx", &umap.green[i]);
-                        if (transp)
-                                umap.transp[i] = (buf[i * 16 +  2] != ' ');
-                }
-                rc = fb_info->fbops->fb_setcmap(&umap, fb_info);
-                fb_copy_cmap(&umap, &fb_info->cmap);
-                fb_dealloc_cmap(&umap);
-
-                return rc ?: count;
-        }
-        for (i = 0; i < length; i++) {
-                u16 red, blue, green, tsp;
-
-                sscanf(&buf[i * 16 +  3], "%4hx", &red);
-                sscanf(&buf[i * 16 +  7], "%4hx", &blue);
-                sscanf(&buf[i * 16 + 11], "%4hx", &green);
-                tsp = (buf[i * 16 +  2] != ' ');
-                if ((rc = fb_info->fbops->fb_setcolreg(start++,
-                                      red, green, blue, tsp, fb_info)))
-                        return rc;
-
-                fb_info->cmap.red[i] = red;
-                fb_info->cmap.blue[i] = blue;
-                fb_info->cmap.green[i] = green;
-                if (transp)
-                        fb_info->cmap.transp[i] = tsp;
-        }
-        return count;
-}
-
-static ssize_t show_cmap(struct class_device *class_device, char *buf)
-{
-        struct fb_info *fb_info = class_get_devdata(class_device);
-        unsigned int i;
-
-        if (!fb_info->cmap.red || !fb_info->cmap.blue ||
-           !fb_info->cmap.green)
-                return -EINVAL;
-
-        if (fb_info->cmap.len > PAGE_SIZE / 16)
-                return -EINVAL;
-
-        /* don't mess with the format, the buffer is PAGE_SIZE */
-        /* 256 entries at 16 chars per line equals 4096 = PAGE_SIZE */
-        for (i = 0; i < fb_info->cmap.len; i++) {
-                snprintf(&buf[ i * 16], PAGE_SIZE - i * 16, "%02x%c%4x%4x%4x\n", i + fb_info->cmap.start,
-                        ((fb_info->cmap.transp && fb_info->cmap.transp[i]) ? '*' : ' '),
-                        fb_info->cmap.red[i], fb_info->cmap.blue[i],
-                        fb_info->cmap.green[i]);
-        }
-        return 16 * fb_info->cmap.len;
-}
-
 static ssize_t store_blank(struct class_device *class_device, const char * buf,
                            size_t count)
 {
@@ -502,10 +414,12 @@ static ssize_t show_fbstate(struct class_device *class_device, char *buf)
         return snprintf(buf, PAGE_SIZE, "%d\n", fb_info->state);
 }
 
+/* When cmap is added back in it should be a binary attribute
+ * not a text one. Consideration should also be given to converting
+ * fbdev to use configfs instead of sysfs */
 static struct class_device_attribute class_device_attrs[] = {
         __ATTR(bits_per_pixel, S_IRUGO|S_IWUSR, show_bpp, store_bpp),
         __ATTR(blank, S_IRUGO|S_IWUSR, show_blank, store_blank),
-        __ATTR(color_map, S_IRUGO|S_IWUSR, show_cmap, store_cmap),
         __ATTR(console, S_IRUGO|S_IWUSR, show_console, store_console),
         __ATTR(cursor, S_IRUGO|S_IWUSR, show_cursor, store_cursor),
         __ATTR(mode, S_IRUGO|S_IWUSR, show_mode, store_mode),
diff --git a/drivers/video/pm2fb.c b/drivers/video/pm2fb.c
index 5fe197943deb..4e963930b50a 100644
--- a/drivers/video/pm2fb.c
+++ b/drivers/video/pm2fb.c
@@ -73,8 +73,8 @@ static char *mode __devinitdata = NULL;
  * these flags allow the user to specify that requests for +ve sync
  * should be silently turned in -ve sync.
  */
-static int lowhsync __devinitdata = 0;
-static int lowvsync __devinitdata = 0;
+static int lowhsync;
+static int lowvsync;
 
 /*
  * The hardware state of the graphics card that isn't part of the
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index 10e6b3aab9ea..0da624e6524f 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -73,7 +73,7 @@
 /* --------------------------------------------------------------------- */
 
 
-static char *mode_option __initdata = NULL;
+static char *mode_option __devinitdata = NULL;
 
 #ifdef MODULE
 
@@ -1545,7 +1545,7 @@ static int __devinit savage_map_mmio (struct fb_info *info)
         return 0;
 }
 
-static void __devinit savage_unmap_mmio (struct fb_info *info)
+static void savage_unmap_mmio (struct fb_info *info)
 {
         struct savagefb_par *par = info->par;
         DBG ("savage_unmap_mmio");
@@ -1597,7 +1597,7 @@ static int __devinit savage_map_video (struct fb_info *info,
         return 0;
 }
 
-static void __devinit savage_unmap_video (struct fb_info *info)
+static void savage_unmap_video (struct fb_info *info)
 {
         struct savagefb_par *par = info->par;
 
@@ -1614,7 +1614,7 @@ static void __devinit savage_unmap_video (struct fb_info *info)
         }
 }
 
-static int __devinit savage_init_hw (struct savagefb_par *par)
+static int savage_init_hw (struct savagefb_par *par)
 {
         unsigned char config1, m, n, n1, n2, sr8, cr3f, cr66 = 0, tmp;